blog-contributions/opsec/physicalsecurity/index.html

1464 lines
61 KiB
HTML
Raw Permalink Blame History

This file contains ambiguous Unicode characters

This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.

<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8">
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<meta name="description" content="">
<meta name="author" content="">
<link rel="shortcut icon" href="../../../../../../assets/img/favicon.png">
<title>Plausible Deniability Protection for an .onion Service </title>
<!-- Bootstrap core CSS -->
<link href="../../assets/css/bootstrap.css" rel="stylesheet">
<link href="../../assets/css/xt256.css" rel="stylesheet">
<!-- Custom styles for this template -->
<link href="../../assets/css/main.css" rel="stylesheet">
<!-- HTML5 shim and Respond.js IE8 support of HTML5 elements and media queries -->
<!--[if lt IE 9]>
<script src="https://oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js"></script>
<script src="https://oss.maxcdn.com/libs/respond.js/1.3.0/respond.min.js"></script>
<![endif]-->
</head>
<body>
<!-- Static navbar -->
<div class="navbar navbar-inverse-anon navbar-static-top">
<div class="container">
<div class="navbar-header">
<button type="button" class="navbar-toggle" data-toggle="collapse" data-target=".navbar-collapse">
<span class="icon-bar"></span>
<span class="icon-bar"></span>
<span class="icon-bar"></span>
</button>
<a class="navbar-brand-anon" href="\index.html">The Nihilism Blog</a>
</div>
<div class="navbar-collapse collapse">
<ul class="nav navbar-nav navbar-right">
<li><a href="/about.html">About</a></li>
<li><a href="/blog.html">Categories</a></li>
<li><a href="https://blog.nowhere.moe/donate.html">Donate</a></li>
<li><a href="/contact.html">Contact</a></li>
</ul>
</div><!--/.nav-collapse -->
</div>
</div>
<!-- +++++ Posts Lists +++++ -->
<!-- +++++ First Post +++++ -->
<div id="anon2">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2">
<a href="../index.html">Previous Page</a></br></br><p><img src="../../assets/img/user.png" width="50px" height="50px"> <ba>nihilist@mainpc - 2024-03-28</ba></p>
<h1> Plausible Deniability Protection for an .onion Service</h1>
<p>In this tutorial we're going to look at how you can protect a set of QEMU VMs running in a veracrypt hidden partition from being discovered by an adversary.</p>
<p>For this tutorial we have the following threat model:</p>
<ol>
<li><p>What if an adversary enters the room where the physical server is ?</p></li>
<li><p>What if an adversary opens up the case of the physical server ?</p></li>
<li><p>What if an adversary plugs in or removes any usb device on the server ?</p></li>
<li><p>What if an adversary shuts down the electricity of the entire house before coming in ?</p></li>
<li><p>What if an adversary steals your password or ssh key somehow and manages to login via SSH on the server ?</p></li>
<li><p>What if an adversary physically destroys the harddrive containing the veracrypt partition ?</p></li>
<li><p>What if an adversary tries to do a cold boot attack ? (meaning forensics regarding server logs and RAM live memory)</p></li>
<li><p>What if an adversary forces you to type in your password to your encrypted data ?</p></li>
</ol>
<p>Let's take all those threat vectors into account, and setup our homeserver with the following physical security setup:</p>
<img src="0.png" class="imgRz">
</div>
</div><!-- /row -->
</div> <!-- /container -->
</div><!-- /grey -->
<!-- +++++ Second Post +++++ -->
<div id="anon3">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2">
<h2><b>Initial Setup </b></h2>
<p>First we setup a debian QEMU VM in the hidden veracrypt partition:</p>
<b>DISCLAIMER: we're using only harddrives (HDDs) here, because using SSDs are not a secure way to have Plausible Deniability, that is due to hidden Volumes being detectable on devices that utilize wear-leveling</b>
<pre><code class="nim">
source: https://anonymousplanet.org/guide.html#understanding-hdd-vs-ssd
regarding wear leveling:
"Also as mentioned earlier, disabling Trim will reduce the lifetime of your SSD drive and will significantly impact its performance over time (your laptop will become slower and slower over several months of use until it becomes almost unusable, you will then have to clean the drive and re-install everything). But you must do it to prevent data leaks that could allow forensics to defeat your plausible deniability. The only way around this at the moment is to have a laptop with a classic HDD drive instead."
</pre></code>
<p>Look at <a href="../veracrypt/index.html">this tutorial</a> on how to create a veracrypt hidden partition, now create a volume that can contain a debian VM inside the hidden partition (ex: outer volume 140G, and inner/hidden volume 70G). Also follow <a href="../antiforensics/index.html">this tutorial</a> to know how to setup a QEMU hypervisor to virtualize VMs on linux. Now in the hidden partition we will create the debian QEMU VM (whose disk is 50Gb) as follows (keep in mind that we will also need to copy it into the decoy partition without overwriting the hidden partition, so make sure you can fit the same VM there aswell when you are creating the veracrypt volume!):</p>
<img src="2.png" class="imgRz">
<img src="3.png" class="imgRz">
<img src="4.png" class="imgRz">
<img src="5.png" class="imgRz">
<img src="6.png" class="imgRz">
<img src="7.png" class="imgRz">
<img src="8.png" class="imgRz">
<img src="9.png" class="imgRz">
<pre><code class="nim">
root@debian:~# apt update -y ; apt upgrade -y ; apt autoremove -y
</pre></code>
<p>side note: make sure that you also copy the same VM into the decoy partition in case if you are asked to disprove the claim that said vm name inside the veracrypt partition contains something sensitive. </p>
<p>we make it run a .onion service like so as shown on <a href="../torwebsite/index.html">this tutorial</a></p>
<p>So now we have the following graph:</p>
<img src="10.png" style="width:300px">
<p>We now have a server at home, that contains a veracrypt hidden partition (whose existance shouldnt be revealed), that hidden partition contains a VM, which contains a .onion service we want to hide the existence of. So now let's protect it: </p>
</div>
</div><!-- /row -->
</div> <!-- /container -->
</div><!-- /white -->
<!-- +++++ Second Post +++++ -->
<div id="anon2">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2">
<h2><b>Emergency Shutdown setup</b></h2> </br> </br>
<p>First let's define how to shutdown the services and hide the veracrypt hidden partition in one simple bash script:</p>
<p>We have the following order of events:</p>
<p>First we open the veracrypt volume, then we add the QEMU VM in virt-manager while naming it, then we power it on, and then we have our plausibly-deniable onion service.</p>
<img src="12.png" class="imgRz">
<p>So for an emergency shutdown, we need to do the same in the reverse order: First we shutdown the VM forcefully, then we close the hidden veracrypt partition forcefully, then we wipe the logs, then we kill the veracrypt process, and then then we wipe the ram 3 times to erase all potential trace of VMs in live memory. </p>
<img src="14.png" class="imgRz">
<p>Then we assemble that in a bashscript like so:</p>
<pre><code class="nim">
[ Wonderland ] [ /dev/pts/1 ] [~]
→ sudo cat /root/emergencyshutdown.sh
[sudo] password for nihilist:
#!/bin/bash
#remove VM and undefine it: (make sure that the VM name is exact!!!)
sudo virsh -c qemu:///system destroy debian12-VM
sudo virsh -c qemu:///system undefine debian12-VM
#make sure that there is also an innocent VM called debian12-VM in the outer partition (for plausible deniability)
#unmount veracrypt drives forcefully
sudo veracrypt -d -f
# then cleanup logs
sudo rm -rf /dev/shm/*
sudo rm -rf /var/log/*
sudo dmesg -c >/dev/null 2>/dev/null
# kill veracrypt to avoid having the veracrypt window display which drive/volume was selected
kill $(pidof veracrypt)
# then wipe ram 3 times
# apt install stress
# below change 128G to the number of Gigabytes in your system ! put 16 if you only have 16Gb of ram!
stress -m 1 --vm-bytes 128G -t 10
stress -m 1 --vm-bytes 128G -t 10
stress -m 1 --vm-bytes 128G -t 10
</code></pre>
<p>you can run it like so:</p>
<pre><code class="nim">
chmod +x ./emergencyshutdown.sh
./emergencyshutdown.sh
</code></pre>
<p>Next we need to be able to send an email from the server to the administrator to notify him that an emergency shutdown just happened.</p>
<img src="17.png" class="imgRz">
<p>We'll be using ssmtp from the homeserver itself , it's going to connect to a remote mail server to send the mail we want. (check <a href="../mailprivate/index.html">this tutorial</a> if you want to know how to setup your SMTP mail server):</p>
<pre><code class="nim">
[ Wonderland ] [ /dev/pts/1 ] [~]
→ apt install ssmtp
</code></pre>
<p>Then make sure the user exists on the smtp server:</p>
<pre><code class="nim">
root@mail-nihilism:~# useradd -G mail -m surveillance
root@mail-nihilism:~# id surveillance
uid=1003(surveillance) gid=1003(surveillance) groups=1003(surveillance),8(mail)
root@mail-nihilism:~# passwd surveillance
New password:
Retype new password:
passwd: password updated successfully
</code></pre>
<p>And then just send the mail after configuring ssmtp to send to the right place as the correct user:</p>
<pre><code class="nim">
[ Wonderland ] [ /dev/pts/5 ] [~]
→ cat /etc/ssmtp/revaliases
# sSMTP aliases
#
# Format: local_account:outgoing_address:mailhub
#
# Example: root:your_login@your.domain:mailhub.your.domain[:port]
# where [:port] is an optional port number that defaults to 25.
root:surveillance:mail.nowhere.moe:587
[ Wonderland ] [ /dev/pts/5 ] [~]
→ cat /etc/ssmtp/ssmtp.conf
rewriteDomain=nowhere.moe
mailhub=mail.nowhere.moe:587
useSTARTTLS=YES
AuthUser=surveillance
AuthPass=D9IJWDOAHWHUHWUHDAWHDUWHAHDWAIHA3213221123312F
[ Wonderland ] [ /dev/pts/5 ] [~]
→ echo "Test message from Linux server using ssmtp" | sudo ssmtp -vvv nihilist@nowhere.moe
[<<b></b>-] 220 mail.nowhere.moe ESMTP nowhere.moe (Debian/GNU)
[->] EHLO wonderland
[<<b></b>-] 250 CHUNKING
[->] STARTTLS
[<<b></b>-] 220 2.0.0 Ready to start TLS
[->] EHLO wonderland
[<<b></b>-] 250 CHUNKING
[->] AUTH LOGIN
[<<b></b>-] 334 VXNlcm5hbWU6
[->] c3VydmVpbGxhbmNl
[<<b></b>-] 334 UGFzc3dvcmQ6
[<<b></b>-] 235 2.7.0 Authentication successful
[->] MAIL FROM:<<b></b>surveillance@nowhere.moe>
[<<b></b>-] 250 2.1.0 Ok
[->] RCPT TO:<<b></b>nihilist@nowhere.moe>
[<<b></b>-] 250 2.1.5 Ok
[->] DATA
[<<b></b>-] 354 End data with <<b></b>CR><<b></b>LF>.<<b></b>CR><<b></b>LF>
[->] Received: by wonderland (sSMTP sendmail emulation); Sat, 30 Mar 2024 17:01:44 +0100
[->] From: "root" <<b></b>surveillance@nowhere.moe>
[->] Date: Sat, 30 Mar 2024 17:01:44 +0100
[->] Test message from Linux server using ssmtp
[->]
[->] .
[<<b></b>-] 250 2.0.0 Ok: queued as 9FB5E26A92
[->] QUIT
[<<b></b>-] 221 2.0.0 Bye
</code></pre>
<p>And there we see that we recieved the mail on thunderbird: </p>
<img src="11.png" class="imgRz">
<p>Meaning we have the following emergency shutdown script:</p>
<pre><code class="nim">
[ Wonderland ] [ /dev/pts/1 ] [~]
→ sudo cat /root/emergencyshutdown.sh
[sudo] password for nihilist:
#!/bin/bash
#notify the admin that the emergency shutdown is being performed
echo "PERFORMING EMERGENCY SHUTDOWN!" | sudo ssmtp -vvv nihilist@nowhere.moe
#perform the emergency shutdown:
#remove VM and undefine it: (make sure that the VM name is exact!!!)
sudo virsh -c qemu:///system destroy debian12-VM
sudo virsh -c qemu:///system undefine debian12-VM
#make sure that there is also an innocent VM called debian12-VM in the outer partition (for plausible deniability)
#unmount veracrypt drives forcefully
sudo veracrypt -d -f
# then cleanup logs
sudo rm -rf /dev/shm/*
sudo rm -rf /var/log/*
sudo dmesg -c >/dev/null 2>/dev/null
# kill veracrypt to avoid having the veracrypt window display which drive/volume was selected
kill $(pidof veracrypt)
# then wipe ram 3 times
# apt install stress
# below change 128G to the number of Gigabytes in your system ! put 16 if you only have 16Gb of ram!
stress -m 1 --vm-bytes 128G -t 10
stress -m 1 --vm-bytes 128G -t 10
stress -m 1 --vm-bytes 128G -t 10
</pre></code>
</div>
</div><!-- /row -->
</div> <!-- /container -->
</div><!-- /white -->
<div id="anon1">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2">
<h2><b>Surveillance Setup</b></h2> </br> </br>
<p>So now that we have our actions completed (emergency shutdown and sending a mail), we need to make sure that both are triggered whenever necessary, as shown below:</p>
<img src="16.png" class="imgRz">
<p>To look out for any usb change on the homeserver, we have the following script:</p>
<pre><code class="nim">
[ Wonderland ] [ /dev/pts/5 ] [~]
→ cat checkusb.sh
#!/bin/bash
action_for_unauthorized_usb_change () {
echo "[+] ACTION : SEND MAIL TO NOTIFY ADMIN"
echo -en "Subject: USB CHANGE DETECTED ON $(hostname) \n\n USB CHANGE DETECTED on $(hostname) at $(date): \n\n LSUSB WAS: \n $defaultlsusb \n\n LSUSB NOW IS: \n $(lsusb)" | sudo ssmtp -vvv nihilist@nowhere.moe
#echo "[+] ACTION : EMERGENCY SHUTDOWN SCRIPT"
}
#defaultusb = check usb store it as default usb
defaultusb=$(lsusb | sha512sum)
defaultlsusb=$(lsusb )
#set maintenanece to 0
echo 0 > /tmp/maintenance
while true; do
# check if maintenance mode or not:
if [ $(cat /tmp/maintenance) -eq 0 ]; # if no maintenance, look for usb changes
then
usbnow=$(lsusb | sha512sum)
if [ "$usbnow" = "$defaultusb" ]; #detect usb changes
then
echo "[+] No usb change..."
else
echo "[+] USB change detected, peforming action"
echo $defaultusb
echo $usbnow
action_for_unauthorized_usb_change
#sleep 3600
sleep 10
defaultlsusb=$(lsusb)
defaultusb=$(lsusb | sha512sum)
fi
else #maintenance ongoing, then not checking for usb changes
echo "[+] Maintenance mode, not checking for usb changes..."
fi
sleep 1
done
</code></pre>
<p>Then to detect any movement in the room we setup motion, this will make it possible for a cheap usb webcam to take pictures upon detecting movement in the room where the homeserver is:</p>
<pre><code class="nim">
[ Wonderland ] [ /dev/pts/5 ] [~]
→ apt-get install v4l-utils motion -y
[ Wonderland ] [ /dev/pts/5 ] [~]
→ cat /etc/motion/motion.conf
# Rename this distribution example file to motion.conf
#
# This config file was generated by motion 4.5.1
# Documentation: /usr/share/doc/motion/motion_guide.html
#
# This file contains only the basic configuration options to get a
# system working. There are many more options available. Please
# consult the documentation for the complete list of all options.
#
############################################################
# System control configuration parameters
############################################################
# Start in daemon (background) mode and release terminal.
daemon off
# Start in Setup-Mode, daemon disabled.
setup_mode off
# File to store the process ID.
; pid_file value
# File to write logs messages into. If not defined stderr and syslog is used.
#log_file /var/log/motion/motion.log
log_file /dev/null
# Level of log messages [1..9] (EMG, ALR, CRT, ERR, WRN, NTC, INF, DBG, ALL).
log_level 6
# Target directory for pictures, snapshots and movies
target_dir /tmp/room
# Video device (e.g. /dev/video0) to be used for capturing.
video_device /dev/video0
# Parameters to control video device. See motion_guide.html
; video_params value
# The full URL of the network camera stream.
; netcam_url value
# Name of mmal camera (e.g. vc.ril.camera for pi camera).
; mmalcam_name value
# Camera control parameters (see raspivid/raspistill tool documentation)
; mmalcam_params value
############################################################
# Image Processing configuration parameters
############################################################
# Image width in pixels.
width 640
# Image height in pixels.
height 480
# Maximum number of frames to be captured per second.
framerate 1
# Text to be overlayed in the lower left corner of images
text_left ROOM1
# Text to be overlayed in the lower right corner of images.
text_right %Y-%m-%d\n%T-%q
############################################################
# Motion detection configuration parameters
############################################################
# Always save pictures and movies even if there was no motion.
emulate_motion off
# Threshold for number of changed pixels that triggers motion.
threshold 1500
# Noise threshold for the motion detection.
; noise_level 32
# Despeckle the image using (E/e)rode or (D/d)ilate or (l)abel.
despeckle_filter EedDl
# Number of images that must contain motion to trigger an event.
minimum_motion_frames 1
# Gap in seconds of no motion detected that triggers the end of an event.
event_gap 60
# The number of pre-captured (buffered) pictures from before motion.
pre_capture 3
# Number of frames to capture after motion is no longer detected.
post_capture 0
############################################################
# Script execution configuration parameters
############################################################
# Command to be executed when an event starts.
; on_event_start value
# Command to be executed when an event ends.
; on_event_end value
# Command to be executed when a movie file is closed.
; on_movie_end value
############################################################
# Picture output configuration parameters
############################################################
# Output pictures when motion is detected
picture_output on
# File name(without extension) for pictures relative to target directory
picture_filename %Y%m%d%H%M%S-%q
############################################################
# Movie output configuration parameters
############################################################
# Create movies of motion events.
movie_output off
# Maximum length of movie in seconds.
movie_max_time 60
# The encoding quality of the movie. (0=use bitrate. 1=worst quality, 100=best)
movie_quality 45
# Container/Codec to used for the movie. See motion_guide.html
movie_codec mkv
# File name(without extension) for movies relative to target directory
movie_filename %t-%v-%Y%m%d%H%M%S
############################################################
# Webcontrol configuration parameters
############################################################
# Port number used for the webcontrol.
webcontrol_port 8080
# Restrict webcontrol connections to the localhost.
webcontrol_localhost off
# Type of configuration options to allow via the webcontrol.
webcontrol_parms 0
############################################################
# Live stream configuration parameters
############################################################
# The port number for the live stream.
stream_port 8081
# Restrict stream connections to the localhost.
stream_localhost off
##############################################################
# Camera config files - One for each camera.
##############################################################
; camera /usr/etc/motion/camera1.conf
; camera /usr/etc/motion/camera2.conf
; camera /usr/etc/motion/camera3.conf
; camera /usr/etc/motion/camera4.conf
##############################################################
# Directory to read '.conf' files for cameras.
##############################################################
; camera_dir /usr/etc/motion/conf.d
[ Wonderland ] [ /dev/pts/5 ] [~]
→ mkdir /tmp/room
[ Wonderland ] [ /dev/pts/5 ] [~]
→ chown -R motion:motion /tmp/room
[ Wonderland ] [ /dev/pts/5 ] [~]
→ systemctl restart motion
</code></pre>
<p>From there you can see if the webcam works on port 9091:</p>
<img src="1.png" class="imgRz">
<p>Then we can see that motion to saves pictures once per second once it detects movement in /tmp/room:</p>
<pre><code class="nim">
Every 1.0s: ls -l /tmp/room wonderland: Thu Mar 28 17:07:51 2024
total 368
-rw-r--r-- 1 motion motion 52251 Mar 28 17:07 20240328170745-01.jpg
-rw-r--r-- 1 motion motion 52129 Mar 28 17:07 20240328170746-00.jpg
-rw-r--r-- 1 motion motion 52471 Mar 28 17:07 20240328170746-01.jpg
-rw-r--r-- 1 motion motion 37158 Mar 28 17:07 20240328170747-00.jpg
-rw-r--r-- 1 motion motion 33439 Mar 28 17:07 20240328170747-01.jpg
-rw-r--r-- 1 motion motion 22586 Mar 28 17:07 20240328170748-00.jpg
-rw-r--r-- 1 motion motion 19099 Mar 28 17:07 20240328170748-01.jpg
-rw-r--r-- 1 motion motion 18205 Mar 28 17:07 20240328170749-00.jpg
-rw-r--r-- 1 motion motion 19284 Mar 28 17:07 20240328170749-01.jpg
-rw-r--r-- 1 motion motion 49770 Mar 28 17:07 20240328170750-00.jpg
</code></pre>
<p>Then we have this script to check if there are any new files in /tmp/room/ and if there are then we put them in a zipfile before SEND it via mail to the admin:</p>
<pre><code class="nim">
[ Wonderland ] [ /dev/pts/5 ] [~]
→ cat checkmovement_room.sh
#!/bin/bash
#apt-get install v4l-utils motion -y
#vim /etc/motion/motion.conf
action_for_unauthorized_room_motion () {
echo "[+] ACTION : SEND MAIL TO NOTIFY ADMIN"
find /tmp/room/ -name *.jpg > /tmp/newfiles
newfiles=$(diff -u /tmp/oldfiles /tmp/newfiles | grep -E "^\+" | grep -v "+++" | tr -d '+')
linelist=$(for line in $newfiles; do echo -en "$line " ;done)
zip /tmp/images.zip $linelist
echo -e "Subject: MOVEMENT DETECTED IN ROOM OF $(hostname) \n\n MOVEMENT DETECTED IN ROOM OF $(hostname) AT $(date):"| (cat - && uuencode /tmp/images.zip images.zip) | sudo ssmtp -vvv nihilist@nowhere.moe
rm /tmp/images.zip
rm /tmp/room/* -rf
}
#set maintenanece to 0
mkdir /tmp/room/ 2>/dev/null
rm /tmp/room/* -rf
chown motion: /tmp/room/ -R
echo 0 > /tmp/maintenance
find /tmp/room/ -name *.jpg > /tmp/oldfiles
#defaultusb = check usb store it as default usb
defaultroom=$(ls /tmp/room | sha512sum)
while true; do
# check if maintenance mode or not:
if [ $(cat /tmp/maintenance) -eq 0 ]; # if no room maintenance, look for room changes
then
roomnow=$(ls /tmp/room | sha512sum)
if [ "$roomnow" = "$defaultroom" ]; #detect usb changes
then
echo "[+] No Room Movement..."
else
echo "[+] Room movement detected, peforming action"
echo $defaulroom
echo $roomnow
action_for_unauthorized_room_motion
#sleep 3600
sleep 10
defaultroom=$(ls /tmp/room | sha512sum)
find /tmp/room/ -name *.jpg > /tmp/oldfiles
fi
else #maintenance ongoing, then not checking for room movements
echo "[+] Maintenance mode, not checking for room movements..."
fi
sleep 1
done
</code></pre>
<p>We also make a systemd service to automatically launch/relaunch the checkusb.sh script and checkmovement_room script, and also to make sure they auto start when the server boots up:</p>
<pre><code class="nim">
[ Wonderland ] [ /dev/pts/5 ] [~]
→ vim /etc/systemd/system/usbwatcher.service
[ Wonderland ] [ /dev/pts/5 ] [~]
→ cat/etc/systemd/system/usbwatcher.service
[Unit]
Description=usbwatcher
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
ExecStart=/root/checkusb.sh
ExecStop=kill -9 $(pidof /root/checkusb.sh)
Restart=always
[Install]
WantedBy=multi-user.target
[ Wonderland ] [ /dev/pts/5 ] [~]
→ vim /etc/systemd/system/motionwatcher.service
[ Wonderland ] [ /dev/pts/5 ] [~]
→ cat/etc/systemd/system/motionwatcher.service
[Unit]
Description=motionwatcher
After=network-online.target
Wants=network-online.target
[Service]
Type=simple
ExecStart=/root/checkmovement_room.sh
ExecStop=kill -9 $(pidof /root/checkmovement_room.sh)
Restart=always
[Install]
WantedBy=multi-user.target
[ Wonderland ] [ /dev/pts/5 ] [~]
→ systemctl daemon-reload
[ Wonderland ] [ /dev/pts/5 ] [~]
→ systemctl enable --now motionwatcher.service usbwatcher.service motion.service
Created symlink /etc/systemd/system/multi-user.target.wants/motionwatcher.service → /etc/systemd/system/motionwatcher.service.
Created symlink /etc/systemd/system/multi-user.target.wants/usbwatcher.service → /etc/systemd/system/usbwatcher.service.
Created symlink /etc/systemd/system/multi-user.target.wants/motion.service → /etc/systemd/system/motion.service.
[ Wonderland ] [ /dev/pts/5 ] [~]
→ systemctl status motionwatcher.service usbwatcher.service
● motionwatcher.service - motionwatcher
Loaded: loaded (/etc/systemd/system/motionwatcher.service; enabled; preset: enabled)
Active: active (running) since Mon 2024-04-01 14:38:01 CEST; 6s ago
Main PID: 3799951 (checkmovement_r)
Tasks: 2 (limit: 76929)
Memory: 676.0K
CPU: 24ms
CGroup: /system.slice/motionwatcher.service
├─3799951 /bin/bash /root/checkmovement_room.sh
└─3800321 sleep 1
Apr 01 14:38:01 wonderland systemd[1]: Started motionwatcher.service - motionwatcher.
Apr 01 14:38:01 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
Apr 01 14:38:02 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
Apr 01 14:38:03 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
Apr 01 14:38:04 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
Apr 01 14:38:05 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
Apr 01 14:38:06 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
Apr 01 14:38:07 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
● usbwatcher.service - usbwatcher
Loaded: loaded (/etc/systemd/system/usbwatcher.service; enabled; preset: enabled)
Active: active (running) since Mon 2024-04-01 14:38:01 CEST; 6s ago
Main PID: 3799953 (checkusb.sh)
Tasks: 2 (limit: 76929)
Memory: 664.0K
CPU: 40ms
CGroup: /system.slice/usbwatcher.service
├─3799953 /bin/bash /root/checkusb.sh
└─3800327 sleep 1
Apr 01 14:38:01 wonderland systemd[1]: Started usbwatcher.service - usbwatcher.
Apr 01 14:38:01 wonderland checkusb.sh[3799953]: [+] No usb change...
Apr 01 14:38:02 wonderland checkusb.sh[3799953]: [+] No usb change...
Apr 01 14:38:03 wonderland checkusb.sh[3799953]: [+] No usb change...
Apr 01 14:38:04 wonderland checkusb.sh[3799953]: [+] No usb change...
Apr 01 14:38:05 wonderland checkusb.sh[3799953]: [+] No usb change...
Apr 01 14:38:06 wonderland checkusb.sh[3799953]: [+] No usb change...
Apr 01 14:38:07 wonderland checkusb.sh[3799953]: [+] No usb change...
</pre></code>
<p>then just watch it run:</p>
<pre><code class="nim">
Every 1.0s: systemctl status motionwatcher.service usbwatcher.service wonderland: Mon Apr 1 14:40:55 2024
● motionwatcher.service - motionwatcher
Loaded: loaded (/etc/systemd/system/motionwatcher.service; enabled; preset: enabled)
Active: active (running) since Mon 2024-04-01 14:38:01 CEST; 2min 54s ago
Main PID: 3799951 (checkmovement_r)
Tasks: 2 (limit: 76929)
Memory: 680.0K
CPU: 457ms
CGroup: /system.slice/motionwatcher.service
├─3799951 /bin/bash /root/checkmovement_room.sh
└─3810241 sleep 10
Apr 01 14:40:45 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
Apr 01 14:40:46 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
Apr 01 14:40:47 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
Apr 01 14:40:48 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
Apr 01 14:40:49 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
Apr 01 14:40:50 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
Apr 01 14:40:51 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
Apr 01 14:40:52 wonderland checkmovement_room.sh[3799951]: [+] Room movement detected, peforming action
Apr 01 14:40:52 wonderland checkmovement_room.sh[3799951]: 20c1a997bdf538923ed863a64bd1c0d73a7e15337011e576bf9f473c88865fe7e95627774c8035d7f6ee00d998d0f9926cf7442b297ab8d91373ff8d2b587c2c -
Apr 01 14:40:52 wonderland checkmovement_room.sh[3799951]: [+] ACTION : SEND MAIL TO NOTIFY ADMIN
● usbwatcher.service - usbwatcher
Loaded: loaded (/etc/systemd/system/usbwatcher.service; enabled; preset: enabled)
Active: active (running) since Mon 2024-04-01 14:38:01 CEST; 2min 54s ago
Main PID: 3799953 (checkusb.sh)
Tasks: 2 (limit: 76929)
Memory: 800.0K
CPU: 929ms
CGroup: /system.slice/usbwatcher.service
├─3799953 /bin/bash /root/checkusb.sh
└─3810361 sleep 1
Apr 01 14:40:38 wonderland checkusb.sh[3799953]: [+] No usb change...
Apr 01 14:40:39 wonderland checkusb.sh[3799953]: [+] No usb change...
Apr 01 14:40:40 wonderland checkusb.sh[3799953]: [+] No usb change...
Apr 01 14:40:41 wonderland checkusb.sh[3799953]: [+] USB change detected, peforming action
Apr 01 14:40:41 wonderland checkusb.sh[3799953]: 140e9f95759026b6626bbc1098544bab9f85289c15c44f0fac44951100fbbb140214c00884f13bb50c959fc817bcdd1b6e8050781e1a987f6ea3a289c72c3198 -
Apr 01 14:40:41 wonderland checkusb.sh[3799953]: 482600aa9446e3bbe616534a224785512995e80cd70a16e84c8315e569885a5d52ac0b8363055a6973476521321c767d8b54c918c8443f96cdf0eead35b17cb9 -
Apr 01 14:40:41 wonderland checkusb.sh[3799953]: [+] ACTION : SEND MAIL TO NOTIFY ADMIN
Apr 01 14:40:52 wonderland checkusb.sh[3799953]: [+] No usb change...
Apr 01 14:40:53 wonderland checkusb.sh[3799953]: [+] No usb change...
Apr 01 14:40:54 wonderland checkusb.sh[3799953]: [+] No usb change...
</pre></code>
<p>You can also see it sending mails whenever there is a usb change detected or a room movement detected:</p>
<img src="18.png" class="imgRz">
<p>The first mail contains the details regarding what usb got plugged in or plugged out:</p>
<img src="19.png" class="imgRz">
<p>The second mail contains the zipfiles with the images taken upon movement detection:</p>
<img src="20.png" class="imgRz">
<p>And if you need to do a maintenance you can always disable them like so:</p>
<pre><code class="nim">
[ Wonderland ] [ /dev/pts/5 ] [~]
→ systemctl stop motionwatcher.service usbwatcher.service
[ Wonderland ] [ /dev/pts/5 ] [~]
→ systemctl status motionwatcher.service usbwatcher.service
× motionwatcher.service - motionwatcher
Loaded: loaded (/etc/systemd/system/motionwatcher.service; enabled; preset: enabled)
Active: failed (Result: exit-code) since Mon 2024-04-01 14:41:37 CEST; 1min 17s ago
Duration: 3min 35.887s
Process: 3799951 ExecStart=/root/checkmovement_room.sh (code=killed, signal=TERM)
Process: 3812925 ExecStop=kill -9 $(pidof /root/checkmovement_room.sh) (code=exited, status=1/FAILURE)
Main PID: 3799951 (code=killed, signal=TERM)
CPU: 545ms
Apr 01 14:41:32 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
Apr 01 14:41:33 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
Apr 01 14:41:34 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
Apr 01 14:41:35 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
Apr 01 14:41:36 wonderland checkmovement_room.sh[3799951]: [+] No Room Movement...
Apr 01 14:41:37 wonderland systemd[1]: Stopping motionwatcher.service - motionwatcher...
Apr 01 14:41:37 wonderland kill[3812925]: kill: failed to parse argument: '/root/checkmovement_room.sh)'
Apr 01 14:41:37 wonderland systemd[1]: motionwatcher.service: Control process exited, code=exited, status=1/FAILURE
Apr 01 14:41:37 wonderland systemd[1]: motionwatcher.service: Failed with result 'exit-code'.
Apr 01 14:41:37 wonderland systemd[1]: Stopped motionwatcher.service - motionwatcher.
× usbwatcher.service - usbwatcher
Loaded: loaded (/etc/systemd/system/usbwatcher.service; enabled; preset: enabled)
Active: failed (Result: exit-code) since Mon 2024-04-01 14:41:37 CEST; 1min 17s ago
Duration: 3min 35.888s
Process: 3799953 ExecStart=/root/checkusb.sh (code=killed, signal=TERM)
Process: 3812926 ExecStop=kill -9 $(pidof /root/checkusb.sh) (code=exited, status=1/FAILURE)
Main PID: 3799953 (code=killed, signal=TERM)
CPU: 1.176s
Apr 01 14:41:33 wonderland checkusb.sh[3799953]: [+] No usb change...
Apr 01 14:41:34 wonderland checkusb.sh[3799953]: [+] No usb change...
Apr 01 14:41:35 wonderland checkusb.sh[3799953]: [+] No usb change...
Apr 01 14:41:36 wonderland checkusb.sh[3799953]: [+] No usb change...
Apr 01 14:41:37 wonderland systemd[1]: Stopping usbwatcher.service - usbwatcher...
Apr 01 14:41:37 wonderland kill[3812926]: kill: failed to parse argument: '/root/checkusb.sh)'
Apr 01 14:41:37 wonderland systemd[1]: usbwatcher.service: Control process exited, code=exited, status=1/FAILURE
Apr 01 14:41:37 wonderland systemd[1]: usbwatcher.service: Failed with result 'exit-code'.
Apr 01 14:41:37 wonderland systemd[1]: Stopped usbwatcher.service - usbwatcher.
Apr 01 14:41:37 wonderland systemd[1]: usbwatcher.service: Consumed 1.176s CPU time.
</pre></code>
<p>Or you can also set the /tmp/maintenance flag to 1, but dont forget to set it back to 0 afterward.</p>
<pre><code class="nim">
[ Wonderland ] [ /dev/pts/5 ] [~]
→ echo "1" >/tmp/maintenance
[ Wonderland ] [ /dev/pts/5 ] [~]
→ systemctl status usbwatcher.service motionwatcher.service
● usbwatcher.service - usbwatcher
Loaded: loaded (/etc/systemd/system/usbwatcher.service; enabled; preset: enabled)
Active: active (running) since Mon 2024-04-01 16:14:29 CEST; 5min ago
Main PID: 4087848 (checkusb.sh)
Tasks: 2 (limit: 76929)
Memory: 584.0K
CPU: 1.969s
CGroup: /system.slice/usbwatcher.service
├─4087848 /bin/bash /root/checkusb.sh
└─4099926 sleep 1
Apr 01 16:19:52 wonderland checkusb.sh[4087848]: [+] No usb change...
Apr 01 16:19:53 wonderland checkusb.sh[4087848]: [+] No usb change...
Apr 01 16:19:54 wonderland checkusb.sh[4087848]: [+] No usb change...
Apr 01 16:19:55 wonderland checkusb.sh[4087848]: [+] No usb change...
Apr 01 16:19:56 wonderland checkusb.sh[4087848]: [+] No usb change...
Apr 01 16:19:57 wonderland checkusb.sh[4087848]: [+] No usb change...
Apr 01 16:19:58 wonderland checkusb.sh[4087848]: [+] Maintenance mode, not checking for usb changes...
Apr 01 16:19:59 wonderland checkusb.sh[4087848]: [+] Maintenance mode, not checking for usb changes...
Apr 01 16:20:00 wonderland checkusb.sh[4087848]: [+] Maintenance mode, not checking for usb changes...
Apr 01 16:20:01 wonderland checkusb.sh[4087848]: [+] Maintenance mode, not checking for usb changes...
● motionwatcher.service - motionwatcher
Loaded: loaded (/etc/systemd/system/motionwatcher.service; enabled; preset: enabled)
Active: active (running) since Mon 2024-04-01 16:14:29 CEST; 5min ago
Main PID: 4087847 (checkmovement_r)
Tasks: 2 (limit: 76929)
Memory: 644.0K
CPU: 1.006s
CGroup: /system.slice/motionwatcher.service
├─4087847 /bin/bash /root/checkmovement_room.sh
└─4099976 sleep 1
Apr 01 16:19:53 wonderland checkmovement_room.sh[4087847]: [+] No Room Movement...
Apr 01 16:19:54 wonderland checkmovement_room.sh[4087847]: [+] No Room Movement...
Apr 01 16:19:55 wonderland checkmovement_room.sh[4087847]: [+] No Room Movement...
Apr 01 16:19:56 wonderland checkmovement_room.sh[4087847]: [+] No Room Movement...
Apr 01 16:19:57 wonderland checkmovement_room.sh[4087847]: [+] No Room Movement...
Apr 01 16:19:58 wonderland checkmovement_room.sh[4087847]: [+] No Room Movement...
Apr 01 16:19:59 wonderland checkmovement_room.sh[4087847]: [+] Maintenance mode, not checking for room movements...
Apr 01 16:20:00 wonderland checkmovement_room.sh[4087847]: [+] Maintenance mode, not checking for room movements...
Apr 01 16:20:01 wonderland checkmovement_room.sh[4087847]: [+] Maintenance mode, not checking for room movements...
Apr 01 16:20:02 wonderland checkmovement_room.sh[4087847]: [+] Maintenance mode, not checking for room movements...
</pre></code>
<p>Once your maintenance is over, start them again like so:</p>
<pre><code class="nim">
[ Wonderland ] [ /dev/pts/5 ] [~]
→ systemctl start motionwatcher.service usbwatcher.service
[ Wonderland ] [ /dev/pts/5 ] [~]
→ systemctl status motionwatcher.service usbwatcher.service
● motionwatcher.service - motionwatcher
Loaded: loaded (/etc/systemd/system/motionwatcher.service; enabled; preset: enabled)
Active: active (running) since Mon 2024-04-01 14:43:28 CEST; 1s ago
Main PID: 3818336 (checkmovement_r)
Tasks: 2 (limit: 76929)
Memory: 572.0K
CPU: 9ms
CGroup: /system.slice/motionwatcher.service
├─3818336 /bin/bash /root/checkmovement_room.sh
└─3818411 sleep 1
Apr 01 14:43:28 wonderland systemd[1]: Started motionwatcher.service - motionwatcher.
Apr 01 14:43:28 wonderland checkmovement_room.sh[3818336]: [+] No Room Movement...
Apr 01 14:43:29 wonderland checkmovement_room.sh[3818336]: [+] No Room Movement...
● usbwatcher.service - usbwatcher
Loaded: loaded (/etc/systemd/system/usbwatcher.service; enabled; preset: enabled)
Active: active (running) since Mon 2024-04-01 14:43:28 CEST; 1s ago
Main PID: 3818339 (checkusb.sh)
Tasks: 2 (limit: 76929)
Memory: 572.0K
CPU: 14ms
CGroup: /system.slice/usbwatcher.service
├─3818339 /bin/bash /root/checkusb.sh
└─3818417 sleep 1
Apr 01 14:43:28 wonderland systemd[1]: Started usbwatcher.service - usbwatcher.
Apr 01 14:43:28 wonderland checkusb.sh[3818339]: [+] No usb change...
Apr 01 14:43:29 wonderland checkusb.sh[3818339]: [+] No usb change...
</pre></code>
<p>Or by just resetting the /tmp/maintenance flag to 0:</p>
<pre><code class="nim">
[ Wonderland ] [ /dev/pts/5 ] [~]
→ echo "0" >/tmp/maintenance
[ Wonderland ] [ /dev/pts/5 ] [~]
→ systemctl status usbwatcher.service motionwatcher.service
● usbwatcher.service - usbwatcher
Loaded: loaded (/etc/systemd/system/usbwatcher.service; enabled; preset: enabled)
Active: active (running) since Mon 2024-04-01 16:14:29 CEST; 6min ago
Main PID: 4087848 (checkusb.sh)
Tasks: 2 (limit: 76929)
Memory: 588.0K
CPU: 2.035s
CGroup: /system.slice/usbwatcher.service
├─4087848 /bin/bash /root/checkusb.sh
└─4101731 sleep 1
Apr 01 16:20:26 wonderland checkusb.sh[4087848]: [+] Maintenance mode, not checking for usb changes...
Apr 01 16:20:27 wonderland checkusb.sh[4087848]: [+] Maintenance mode, not checking for usb changes...
Apr 01 16:20:28 wonderland checkusb.sh[4087848]: [+] Maintenance mode, not checking for usb changes...
Apr 01 16:20:29 wonderland checkusb.sh[4087848]: [+] Maintenance mode, not checking for usb changes...
Apr 01 16:20:30 wonderland checkusb.sh[4087848]: [+] Maintenance mode, not checking for usb changes...
Apr 01 16:20:31 wonderland checkusb.sh[4087848]: [+] Maintenance mode, not checking for usb changes...
Apr 01 16:20:32 wonderland checkusb.sh[4087848]: [+] Maintenance mode, not checking for usb changes...
Apr 01 16:20:33 wonderland checkusb.sh[4087848]: [+] No usb change...
Apr 01 16:20:34 wonderland checkusb.sh[4087848]: [+] No usb change...
Apr 01 16:20:35 wonderland checkusb.sh[4087848]: [+] No usb change...
● motionwatcher.service - motionwatcher
Loaded: loaded (/etc/systemd/system/motionwatcher.service; enabled; preset: enabled)
Active: active (running) since Mon 2024-04-01 16:14:29 CEST; 6min ago
Main PID: 4087847 (checkmovement_r)
Tasks: 2 (limit: 76929)
Memory: 800.0K
CPU: 1.050s
CGroup: /system.slice/motionwatcher.service
├─4087847 /bin/bash /root/checkmovement_room.sh
└─4101784 sleep 1
Apr 01 16:20:27 wonderland checkmovement_room.sh[4087847]: [+] Maintenance mode, not checking for room movements...
Apr 01 16:20:28 wonderland checkmovement_room.sh[4087847]: [+] Maintenance mode, not checking for room movements...
Apr 01 16:20:29 wonderland checkmovement_room.sh[4087847]: [+] Maintenance mode, not checking for room movements...
Apr 01 16:20:30 wonderland checkmovement_room.sh[4087847]: [+] Maintenance mode, not checking for room movements...
Apr 01 16:20:31 wonderland checkmovement_room.sh[4087847]: [+] Maintenance mode, not checking for room movements...
Apr 01 16:20:32 wonderland checkmovement_room.sh[4087847]: [+] Maintenance mode, not checking for room movements...
Apr 01 16:20:33 wonderland checkmovement_room.sh[4087847]: [+] Maintenance mode, not checking for room movements...
Apr 01 16:20:34 wonderland checkmovement_room.sh[4087847]: [+] No Room Movement...
Apr 01 16:20:35 wonderland checkmovement_room.sh[4087847]: [+] No Room Movement...
Apr 01 16:20:36 wonderland checkmovement_room.sh[4087847]: [+] No Room Movement...
</pre></code>
<p>Then we make sure that if there is any unauthorized ssh login we should get notified by mail (using knockd and a secret ssh port)</p>
<img src="15.png" class="imgRz">
<pre><code class="nim">
[ Wonderland ] [ /dev/pts/23 ] [~]
→ apt install knockd
[ Wonderland ] [ /dev/pts/23 ] [~]
→ vim /etc/knockd.conf
[ Wonderland ] [ /dev/pts/23 ] [~]
→ cat /etc/knockd.conf
[options]
UseSyslog
[openSSH]
sequence = 7000,8000,9000
seq_timeout = 5
command = /usr/bin/systemctl start sshd2
tcpflags = syn
[closeSSH]
sequence = 9000,8000,7000
seq_timeout = 5
command = /usr/bin/systemctl stop sshd2
tcpflags = syn
[emergencyshutdown]
sequence = 12345,54321,24680,13579
seq_timeout = 5
command = /root/emergencyshutdown.sh
tcpflags = syn
[ Wonderland ] [ /dev/pts/23 ] [~]
→ cat /etc/default/knockd
# control if we start knockd at init or not
# 1 = start
# anything else = don't start
# PLEASE EDIT /etc/knockd.conf BEFORE ENABLING
START_KNOCKD=1
# command line options
KNOCKD_OPTS="-i enp8s0"
[ Wonderland ] [ /dev/pts/23 ] [~]
→ systemctl restart knockd
[ Wonderland ] [ /dev/pts/5 ] [~]
→ cat /etc/systemd/system/sshd2.service
[Unit]
Description=OpenBSD Secure Shell server
Documentation=man:sshd(8) man:sshd_config(5)
After=network.target auditd.service
ConditionPathExists=!/etc/ssh/sshd_not_to_be_run
[Service]
EnvironmentFile=-/etc/default/ssh2
ExecStartPre=/usr/sbin/sshd -t
ExecStart=/usr/sbin/sshd -D $SSHD_OPTS -f /etc/ssh/sshd2_config
ExecReload=/usr/sbin/sshd -t
ExecReload=/bin/kill -HUP $MAINPID
KillMode=process
Restart=on-failure
RestartPreventExitStatus=255
Type=notify
RuntimeDirectory=sshd2
RuntimeDirectoryMode=0755
[Install]
WantedBy=multi-user.target
Alias=sshd2.service
[ Wonderland ] [ /dev/pts/24 ] [/etc/systemd/system]
→ cat /etc/ssh/sshd2_config| grep Port
Port 2222
[ Wonderland ] [ /dev/pts/24 ] [/etc/systemd/system]
→ systemctl start sshd2
[ Wonderland ] [ /dev/pts/24 ] [/etc/systemd/system]
→ systemctl status sshd2
● sshd2.service - OpenBSD Secure Shell server
Loaded: loaded (/etc/systemd/system/sshd2.service; disabled; preset: enabled)
Active: active (running) since Fri 2024-03-29 13:44:07 CET; 5s ago
Docs: man:sshd(8)
man:sshd_config(5)
Process: 1735677 ExecStartPre=/usr/sbin/sshd -t (code=exited, status=0/SUCCESS)
Main PID: 1735678 (sshd)
Tasks: 1 (limit: 76929)
Memory: 1.4M
CPU: 10ms
CGroup: /system.slice/sshd2.service
└─1735678 "sshd: /usr/sbin/sshd -D -f /etc/ssh/sshd2_config [listener] 0 of 10-100 startups"
Mar 29 13:44:07 wonderland systemd[1]: Starting sshd2.service - OpenBSD Secure Shell server...
Mar 29 13:44:07 wonderland sshd[1735678]: Server listening on 0.0.0.0 port 2222.
Mar 29 13:44:07 wonderland sshd[1735678]: Server listening on :: port 2222.
Mar 29 13:44:07 wonderland systemd[1]: Started sshd2.service - OpenBSD Secure Shell server.
#now to open sshd2 on port 2222 you do the following:
[ mainpc ] [ /dev/pts/4 ] [~/Nextcloud/blog]
→ for x in 7000 8000 9000; do nmap -Pn --max-retries 0 -p $x 192.168.0.100; done >/dev/null
[ Wonderland ] [ /dev/pts/24 ] [/etc/systemd/system]
→ systemctl status sshd2
● sshd2.service - OpenBSD Secure Shell server
Loaded: loaded (/etc/systemd/system/sshd2.service; disabled; preset: enabled)
Active: active (running) since Fri 2024-03-29 13:55:44 CET; 4min 11s ago
Docs: man:sshd(8)
man:sshd_config(5)
Process: 1807467 ExecStartPre=/usr/sbin/sshd -t (code=exited, status=0/SUCCESS)
Main PID: 1807468 (sshd)
Tasks: 1 (limit: 76929)
Memory: 1.4M
CPU: 12ms
CGroup: /system.slice/sshd2.service
└─1807468 "sshd: /usr/sbin/sshd -D -f /etc/ssh/sshd2_config [listener] 0 of 10-100 startups"
Mar 29 13:55:44 wonderland systemd[1]: Starting sshd2.service - OpenBSD Secure Shell server...
Mar 29 13:55:44 wonderland sshd[1807468]: Server listening on 0.0.0.0 port 2222.
Mar 29 13:55:44 wonderland sshd[1807468]: Server listening on :: port 2222.
Mar 29 13:55:44 wonderland systemd[1]: Started sshd2.service - OpenBSD Secure Shell server.
#now to close sshd2 on port 2222 you do the following:
[ mainpc ] [ /dev/pts/4 ] [~/Nextcloud/blog]
→ for x in 9000 8000 7000; do nmap -Pn --max-retries 0 -p $x 192.168.0.100; done >/dev/null
[ Wonderland ] [ /dev/pts/24 ] [/etc/systemd/system]
→ systemctl status sshd2
● sshd2.service - OpenBSD Secure Shell server
Loaded: loaded (/etc/systemd/system/sshd2.service; disabled; preset: enabled)
Active: active (running) since Fri 2024-03-29 13:55:44 CET; 4min 11s ago
Docs: man:sshd(8)
man:sshd_config(5)
Process: 1807467 ExecStartPre=/usr/sbin/sshd -t (code=exited, status=0/SUCCESS)
Main PID: 1807468 (sshd)
Tasks: 1 (limit: 76929)
Memory: 1.4M
CPU: 12ms
CGroup: /system.slice/sshd2.service
└─1807468 "sshd: /usr/sbin/sshd -D -f /etc/ssh/sshd2_config [listener] 0 of 10-100 startups"
Mar 29 13:55:44 wonderland systemd[1]: Starting sshd2.service - OpenBSD Secure Shell server...
Mar 29 13:55:44 wonderland sshd[1807468]: Server listening on 0.0.0.0 port 2222.
Mar 29 13:55:44 wonderland sshd[1807468]: Server listening on :: port 2222.
Mar 29 13:55:44 wonderland systemd[1]: Started sshd2.service - OpenBSD Secure Shell server.
</code></pre>
<p>Now that we setup the real sshd service, we can edit the original sshd service to become a trap like so:</p>
<pre><code class="nim">
[ Wonderland ] [ /dev/pts/5 ] [~]
→ vim emergencyshutdown.sh
[ Wonderland ] [ /dev/pts/5 ] [~]
→ chmod +x emergencyshutdown.sh
[ Wonderland ] [ /dev/pts/5 ] [~]
→ cat emergencyshutdown.sh
#!/bin/bash
echo "Unauthorized, reporting incident to administrator, and performing emergency shutdown"
[ Wonderland ] [ /dev/pts/5 ] [~]
→ vim /etc/ssh/sshd_config
[ Wonderland ] [ /dev/pts/5 ] [~]
→ tail -n10 /etc/ssh/sshd_config
Match Group root,sudo
ForceCommand /root/emergencyshutdown.sh
AllowTcpForwarding no
PermitTunnel no
X11Forwarding no
[ Wonderland ] [ /dev/pts/5 ] [~]
→ systemctl restart sshd
[ Wonderland ] [ /dev/pts/5 ] [~]
→ systemctl status sshd
● ssh.service - OpenBSD Secure Shell server
Loaded: loaded (/lib/systemd/system/ssh.service; enabled; preset: enabled)
Active: active (running) since Mon 2024-04-01 10:31:40 CEST; 3s ago
Docs: man:sshd(8)
man:sshd_config(5)
Process: 3103408 ExecStartPre=/usr/sbin/sshd -t (code=exited, status=0/SUCCESS)
Main PID: 3103410 (sshd)
Tasks: 1 (limit: 76929)
Memory: 1.4M
CPU: 10ms
CGroup: /system.slice/ssh.service
└─3103410 "sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups"
Apr 01 10:31:40 wonderland systemd[1]: Starting ssh.service - OpenBSD Secure Shell server...
Apr 01 10:31:40 wonderland sshd[3103410]: debug1: Set /proc/self/oom_score_adj from 0 to -1000
Apr 01 10:31:40 wonderland sshd[3103410]: debug1: Bind to port 22 on 0.0.0.0.
Apr 01 10:31:40 wonderland systemd[1]: Started ssh.service - OpenBSD Secure Shell server.
Apr 01 10:31:40 wonderland sshd[3103410]: Server listening on 0.0.0.0 port 22.
Apr 01 10:31:40 wonderland sshd[3103410]: debug1: Bind to port 22 on ::.
Apr 01 10:31:40 wonderland sshd[3103410]: Server listening on :: port 22.
</pre></code>
<p>Now like this, the trap ssh service on port 22 is going to force the execution of only our emergency shutdown script if any user manages to login. Meaning the only way to get in is through the sshd2 port on port 2222 after doing the port knocking procedure:</p>
<pre><code class="nim">
#testing to login on port 22 shows that the emergencyshutdown script is triggered:
[ mainpc ] [ /dev/pts/7 ] [~]
→ ssh root@192.168.0.100 -i ~/.ssh/torified
Enter passphrase for key '/home/nihilist/.ssh/torified':
<b>Unauthorized, reporting incident to administrator, and performing emergency shutdown </b>
Connection to 192.168.0.100 closed.
#trying to evade the forced command execution fails:
[ mainpc ] [ /dev/pts/7 ] [~]
→ ssh root@192.168.0.100 -i ~/.ssh/torified bash
Enter passphrase for key '/home/nihilist/.ssh/torified':
<b>Unauthorized, reporting incident to administrator, and performing emergency shutdown</b>
#so in order to login we need to open the secret sshd2 port with the specific port knocking procedure as follows:
[ mainpc ] [ /dev/pts/7 ] [~]
→ for x in 7000 8000 9000; do nmap -Pn --max-retries 0 -p $x 192.168.0.100; done >/dev/null
#now that the port knocking is completed, we can login via ssh on port 2222:
[ mainpc ] [ /dev/pts/7 ] [~]
→ ssh root@192.168.0.100 -i ~/.ssh/torified -p 2222
Enter passphrase for key '/home/nihilist/.ssh/torified':
Linux wonderland 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Web console: https://wonderland:9090/ or https://192.168.0.100:9090/
Last login: Mon Apr 1 10:34:46 2024 from 192.168.0.61
#login successful, without any forced command execution
<b>[ Wonderland ] [ /dev/pts/25 ] [~]
→ id
uid=0(root) gid=0(root) groups=0(root),104(kvm),126(libvirt)</b>
[ Wonderland ] [ /dev/pts/25 ] [~]
→ exit
Connection to 192.168.0.100 closed.
#maintenance is over, we then close the sshd2 port.
[ mainpc ] [ /dev/pts/7 ] [~]
→ for x in 9000 8000 7000; do nmap -Pn --max-retries 0 -p $x 192.168.0.100; done >/dev/null
#we then verify that the port is closed.
[ mainpc ] [ /dev/pts/7 ] [~]
→ ssh root@192.168.0.100 -i ~/.ssh/torified -p 2222
ssh: connect to host 192.168.0.100 port 2222: Connection refused
</pre></code>
<p>Next, to make sure that failed ssh login attempts get banned with fail2ban, we make sure that sshd outputs to auth.log, that way we ward off any potential ssh bruteforce attack, you can check out how to setup fail2ban with <a href="../fail2banssh/index.html">this tutorial</a> to know how to do it.</p>
</div>
</div><!-- /row -->
</div> <!-- /container -->
</div><!-- /white -->
<div id="anon2">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2">
<h2><b>Clientside precautions</b></h2> </br> </br>
<p>So here we want to mke a bash/zsh command function to simplify the opening and closing of the secret ssh port. You can use the one i made below for the same:</p>
<pre><code class="nim">
[ mainpc ] [ /dev/pts/10 ] [~/Nextcloud/blog]
→ vim ~/.zshrc
[ mainpc ] [ /dev/pts/10 ] [~/Nextcloud/blog]
→ zsh
[ mainpc ] [ /dev/pts/10 ] [~/Nextcloud/blog]
→ which secretssh
secretssh () {
if [[ $# -ne 6 ]]
then
echo "incorrect, use the following syntax:" >&2
echo "secretssh 192.168.0.1 111 222 333 wonderland 2222" >&2
echo "192.168.0.1 = host to port knock to" >&2
echo "111 222 333 = port knocking procedure to OPEN the port (in reverse = close the port)" >&2
echo "wonderland = ssh alias to connect to." >&2
echo "2222 = the secret ssh port to connect to" >&2
else
echo "OPENIGN SECRET SSH: port knocking $1 with sequence $2 $3 $4"
for x in $2 $3 $4
do
nmap -Pn --max-retries 0 -p $x $1
done > /dev/null
sleep 1
ssh $5 -p $6
echo "CLOSING SECRET SSH: port knocking $1 with sequence $4 $3 $2"
for x in $4 $3 $2
do
nmap -Pn --max-retries 0 -p $x $1
done > /dev/null
fi
}
</pre></code>
<p>you can test it as follows, using an ssh alias (which doesn't reveal the secret ssh port!):</p>
<pre><code class="nim">
[ mainpc ] [ /dev/pts/10 ] [~/Nextcloud/blog]
→ cat ~/.ssh/config
Host wonderland
User root
Hostname 192.168.0.100
IdentityFile ~/.ssh/torified
[ mainpc ] [ /dev/pts/10 ] [~/Nextcloud/blog]
→ secretssh 192.168.0.100 7000 8000 9000 wonderland 2222
number of arguements: 6
opening secret ssh port:
port knocking 192.168.0.100 with sequence 7000 8000 9000
Enter passphrase for key '/home/nihilist/.ssh/torified':
Linux wonderland 6.1.0-18-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.76-1 (2024-02-01) x86_64
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Web console: https://wonderland:9090/ or https://192.168.0.100:9090/
Last login: Mon Apr 1 11:32:21 2024 from 192.168.0.61
[ Wonderland ] [ /dev/pts/25 ] [~]
→ id
uid=0(root) gid=0(root) groups=0(root),104(kvm),126(libvirt)
[ Wonderland ] [ /dev/pts/25 ] [~]
→ exit
Connection to 192.168.0.100 closed.
closing secret ssh port:
port knocking 192.168.0.100 with sequence 9000 8000 7000
</pre></code>
<p>That way, we make sure that we do not hardcode the port sequence to open/close the secret ssh port, and we also make sure that the secret ssh port is not revealed. This means that from now on you will need to remember the port sequence to open the secret ssh port, and also the secret ssh port itself. Without those, you will be unable to login to the server.</p>
<p>Now however the risk is that you'd reveal the port sequence and ssh port from the bash or zsh history file: </p>
<pre><code class="nim">
[ mainpc ] [ /dev/pts/10 ] [~/Nextcloud/blog]
→ history | grep secretssh
534 secretssh
535 secretssh 111 222 333
537 secretssh 111 222 333
539 secretssh 111 222 333
540 secretssh 192.168.0.100 111 222 333
542 secretssh 111 222 333
543 secretssh 192.168.0.100 111 222 333 333
544 secretssh 192.168.0.100 111 222 333 333 444
546 secretssh 192.168.0.100 111 222 333 333 444
547 secretssh 192.168.0.100 111 222 333 333
548 secretssh 192.168.0.100 111 222 333
549 secretssh 192.168.0.100 111 222
550 secretssh 192.168.0.100 111
553 secretssh 192.168.0.100 111
554 secretssh 192.168.0.100 111 222
555 secretssh 192.168.0.100 111 222 333
556 secretssh 192.168.0.100 111 222 333 444
557 secretssh 192.168.0.100 111 222 333 444 555
558 secretssh 192.168.0.100 111 222 333 666
559 secretssh 192.168.0.100 111
560 secretssh 192.168.0.100 111 222
561 secretssh 192.168.0.100 111 222 333
564 secretssh 192.168.0.100 111 222 333
565 secretssh 192.168.0.100 111 222 333 wonderland
568 secretssh 192.168.0.100 111 222 333 wonderland
569 secretssh 192.168.0.100 111 222 333 wonderland 2222
571 secretssh 192.168.0.100 111 222 333 wonderland 2222
572 secretssh 192.168.0.100 7000 8000 9000 wonderland 2222
574 secretssh 192.168.0.100 7000 8000 9000 wonderland 2222
576 secretssh 192.168.0.100 7000 8000 9000 wonderland 2222
578 secretssh 192.168.0.100 7000 8000 9000 wonderland 2222
580 secretssh 192.168.0.100 7000 8000 9000 wonderland 2222
582 secretssh 192.168.0.100 7000 8000 9000 wonderland 2222
583 which secretssh
586 which secretssh
588 which secretssh
</pre></code>
<p>so let's make sure that there is a cronjob that runs on the clientside to sed out the lines containing ssh, scp, rsync, nmap and secretssh on the /home/*/.zsh_history files:</p>
<pre><code class="nim">
[ mainpc ] [ /dev/pts/10 ] [~/Nextcloud/blog]
→ sed -i s'/.*nmap.*//gi' /home/*/.zsh_history /home/*/.bash_history /root/.zsh_history /root/.bash_history
sed: can't read /root/.zsh_history: Permission denied
sed: can't read /root/.bash_history: Permission denied
[ mainpc ] [ /dev/pts/10 ] [~/Nextcloud/blog]
→ zsh
[ mainpc ] [ /dev/pts/10 ] [~/Nextcloud/blog]
→ history | grep nmap
602 history | grep nmap
[ mainpc ] [ /dev/pts/10 ] [~/Nextcloud/blog]
→ sudo crontab -e
* * * * * sed -i s'/.*nmap.*//gi' /home/*/.zsh_history /home/*/.bash_history /root/.zsh_history /root/.bash_history
* * * * * sed -i s'/.*ssh.*//gi' /home/*/.zsh_history /home/*/.bash_history /root/.zsh_history /root/.bash_history
* * * * * sed -i s'/.*scp.*//gi' /home/*/.zsh_history /home/*/.bash_history /root/.zsh_history /root/.bash_history
* * * * * sed -i s'/.*rsync.*//gi' /home/*/.zsh_history /home/*/.bash_history /root/.zsh_history /root/.bash_history
* * * * * sed -i s'/.*secretssh.*//gi' /home/*/.zsh_history /home/*/.bash_history /root/.zsh_history /root/.bash_history
[ mainpc ] [ /dev/pts/10 ] [~/Nextcloud/blog]
→ history | grep secretssh
582 secretssh 192.168.0.100 7000 8000 9000 wonderland 2222
588 which secretssh
590 history | grep secretssh
[ mainpc ] [ /dev/pts/10 ] [~/Nextcloud/blog]
→ /usr/bin/sed -i s'/.*secretssh.*//gi' /home/*/.zsh_history /home/*/.bash_history /root/.zsh_history /root/.bash_history
/usr/bin/sed: can't read /root/.zsh_history: Permission denied
/usr/bin/sed: can't read /root/.bash_history: Permission denied
[ mainpc ] [ /dev/pts/10 ] [~/Nextcloud/blog]
→ zsh
[ mainpc ] [ /dev/pts/10 ] [~/Nextcloud/blog]
→ history | grep secretssh
611 history | grep secretssh
</pre></code>
<p>And that's it! now we have a secure way of accessing the server, without revealing the port knocking sequence nor the secret ssh port.</p>
</div>
</div><!-- /row -->
</div> <!-- /container -->
</div><!-- /white -->
<div id="anon1">
<div class="container">
<div class="row">
<div class="col-lg-8 col-lg-offset-2">
<h2><b>UPS setup in case of a power outage (WIP)</b></h2> </br> </br>
<p>TODO: Then we make sure that when the power goes out, the UPS gives the signal for the homeserver to do the emergency shutdown script before shutting down, in order to hide the content of the server, before gracefully shutting down. </p>
<pre><code class="nim">
</pre></code>
<p>Next step is to look at how to make sure the .onion service keeps running even after shutting down the entire homeserver, to make sure that it is impossible to prove that you are maintaining the sensitive service. We'll go into it with how Endgame V3 can be setup in a future tutorial.</p>
</div>
</div><!-- /row -->
</div> <!-- /container -->
</div><!-- /white -->
<!-- +++++ Footer Section +++++ -->
<div id="anonb">
<div class="container">
<div class="row">
<div class="col-lg-4">
<h4>Nihilism</h4>
<p>
Until there is Nothing left.</p></br></br><p>Creative Commons Zero: No Rights Reserved</br><img src="\CC0.png">
</p>
</div><!-- /col-lg-4 -->
<div class="col-lg-4">
<h4>My Links</h4>
<p>
<a target="_blank" rel="noopener noreferrer" href="http://blog.nowhere.moe/rss/feed.xml">RSS Feed</a><br/><a target="_blank" rel="noopener noreferrer" href="https://simplex.chat/contact#/?v=2-7&smp=smp%3A%2F%2FL5jrGV2L_Bb20Oj0aE4Gn-m5AHet9XdpYDotiqpcpGc%3D%40nowhere.moe%2FH4g7zPbitSLV5tDQ51Yz-R6RgOkMEeCc%23%2F%3Fv%3D1-3%26dh%3DMCowBQYDK2VuAyEAkts5T5AMxHGrZCCg12aeKxWcpXaxbB_XqjrXmcFYlDQ%253D&data=%7B%22type%22%3A%22group%22%2C%22groupLinkId%22%3A%22c3Y-iDaoDCFm6RhptSDOaw%3D%3D%22%7D">SimpleX Chat</a><br/>
</p>
</div><!-- /col-lg-4 -->
<div class="col-lg-4">
<h4>About nihilist</h4>
<p style="word-wrap: break-word;"><u>Donate XMR:</u> 8AUYjhQeG3D5aodJDtqG499N5jXXM71gYKD8LgSsFB9BUV1o7muLv3DXHoydRTK4SZaaUBq4EAUqpZHLrX2VZLH71Jrd9k8</p></br><p><u>Contact:</u> nihilist@contact.nowhere.moe (<a href="https://nowhere.moe/nihilist.pubkey">PGP</a>)</p>
</div><!-- /col-lg-4 -->
</div>
</div>
</div>
<!-- Bootstrap core JavaScript
================================================== -->
<!-- Placed at the end of the document so the pages load faster -->
</body>
</html>