Tag Archives: raspberry pi

Raspberry Pi as a Cheap Security Camera

One thing I wanted to look into was the use of the Raspberry Pi as a low-cost, linux based security camera. Key goals were:

Recording of HD Video
Live stream via web browser

This sets out the steps I did to get it up and running – consider some of the previous posts on the Raspberry to lock it down before opening it to the big bad interweb.

Raspberry Pi Configuration

Disable the camera led – lets not make it too obvious if we are, or aren’t recording. Add the following line to /boot/config.txt

disable_camera_led=1

There is a free, open-source motion detection/surveillance software package that we can use, called motion. Unfortunately it doesn’t yet support the Raspberry Pi Camera Module natively yet, so a special build is required.

sudo apt-get install motion
sudo apt-get remove motion

This is a little odd, but the main goal is that the APT package manager will install all the dependencies, add the service account, etc.

Then we get the customised motion package and install it:

wget https://www.dropbox.com/s/xdfcxm5hu71s97d/motion-mmal.tar.gz
tar zxvf motion-mmal.tar.gz
sudo mv motion /usr/bin/motion
sudo mv motion-mmalcam.conf /etc/motion.conf

We then need to enable motion to run as a daemon by editing /etc/default/motion to include

start_motion_daemon=yes

The main motion configuration file is /etc/motion.conf, but lets make sure that the permissions are sufficient for the motion user to modify them

sudo chmod 664 /etc/motion.conf
sudo chmod 755 /usr/bin/motion
sudo touch /tmp/motion.log
sudo chmod 775 /tmp/motion.log

At this point I tried to run it from the CLI, but was missing a library:

pi@watcher ~ $ motion
motion: error while loading shared libraries: libjpeg.so.62: cannot open shared object file: No such file or directory

Easily solved:

sudo apt-get install libjpeg62

motion.conf – some key changes

daemon on
process_id_file /tmp/motion.pid

logfile /home/pi/motion.log

width 1280
height 720

framerate 2

pre_capture 2
post_capture 2

max_movie_time 600

ffmpeg_video_codec msmpeg4

stream_localhost off

stream_auth_method 2
stream_authentication USERNAME:PASSWORD

There are many configuration options, all of which are detailed in the motion config documentation

If we are running it as a daemon on boot we also need to update /etc/init.d/motion with the log and PID variables e.g.

PIDFILE=/tmp/$NAME.pid

So far the streaming works fine is Firefox and Safari, but not Chrome.

Facebook

Twitter

Stumbleupon

Network Configuration with Raspberry Pi – WiFi and Ethernet

WiFi Config File

This is stored in /etc/wpa_supplicant/wpa_supplicant.conf

ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1

network={
ssid="network-SSID"
psk="my_network_key"
proto=RSN
key_mgmt=WPA-PSK
pairwise=TKIP
auth_alg=OPEN
id_str="<strong>home_static</strong>"
}

Interfaces File

This is /etc/network/interfaces
Note how the iface name is the same as the id_str for the home network/static IP configuration

auto lo

iface lo inet loopback

allow-hotplug eth0
iface eth0 inet dhcp

allow-hotplug wlan0
iface wlan0 inet manual
wpa-roam /etc/wpa_supplicant/wpa_supplicant.conf

iface <strong>home_static</strong> inet static
address 192.168.1.20
netmask 255.255.255.0
gateway 192.168.1.1

iface default inet dhcp

The Weirdness

For some reason if we hotplug the Ethernet port we disable wlan0 (and it makes a right mess of things as the sshd and other services aren’t bound to the correct interface any more).

So we edit /etc/default/ifplugd

INTERFACES="eth0"
HOTPLUG_INTERFACES="eth0"
ARGS="-q -f -u0 -d10 -w -I"
SUSPEND_ACTION="stop"

And to give the WiFi dongle a kick at startup we add the following to /etc/rc.local.

# Disable the ifplugd eth0
sudo ifplugd eth0 --kill
sudo ifup wlan0

Facebook

Twitter

Stumbleupon

Raspberry Pi as a server

Update the Pi

sudo apt-get update
sudo apt-get upgrade
sudo rpi-update
reboot

Secure SSH Acess

For starters, lets create a new account, get the privileges correctly, and then delete the default ‘pi’ account – just a little bit too easy.

sudo adduser serverpi

Fill in the information, and set a good password (long, mix of uppercase, lowercase, symbols, etc.)

Once this user exists, we should add them to all the groups as the pi account:

~ $ groups pi
pi : pi adm dialout cdrom sudo audio video plugdev games users netdev input spi gpio

serverpi@my-raspberry-pi ~ $ sudo usermod -a -G sudo serverpi
serverpi@my-raspberry-pi ~ $ sudo usermod -a -G adm serverpi
serverpi@my-raspberry-pi ~ $ sudo usermod -a -G pi serverpi
serverpi@my-raspberry-pi ~ $ sudo usermod -a -G dialout serverpi
serverpi@my-raspberry-pi ~ $ sudo usermod -a -G cdrom serverpi
serverpi@my-raspberry-pi ~ $ sudo usermod -a -G audio serverpi
serverpi@my-raspberry-pi ~ $ sudo usermod -a -G video serverpi
serverpi@my-raspberry-pi ~ $ sudo usermod -a -G plugdev serverpi
serverpi@my-raspberry-pi ~ $ sudo usermod -a -G games serverpi
serverpi@my-raspberry-pi ~ $ sudo usermod -a -G users serverpi
serverpi@my-raspberry-pi ~ $ sudo usermod -a -G netdev serverpi
serverpi@my-raspberry-pi ~ $ sudo usermod -a -G input serverpi
serverpi@my-raspberry-pi ~ $ sudo usermod -a -G spi serverpi
serverpi@my-raspberry-pi ~ $ sudo usermod -a -G gpio serverpi

Ideally, set the server to use PublicKey Authentication, and disable passwords – plenty of guides online to do this (create .ssh directory and add your public key to the authorized_keys file).

Test the login with the new account.

Delete the default user ‘pi’

sudo userdel pi
sudo rm -rf /home/pi

Improving the Performance

Run the configuration utility:

sudo raspi-config

Expand the filesystem
Set the locale and timezone
Set overclock to ‘modest’
Use the advanced options to set the hostname to something meaningful, and since we aren’t using a display set the GPU memory to something more modest e.g. 32 or 0

Finish up and reboot

Basic Intrusion Prevention

Something that any linux based box connecting to the internet should install is fail2ban. This is a python based framework that monitors log files and will block IP Addresses that are continually making login attempts. The ‘banned’ IP is locked out for a configurable length of time, and then unblocked.

Standard package can handle sshd, Apache, etc. which suits my purposes nicely.

sudo apt-get install fail2ban

Facebook

Twitter

Stumbleupon

Updating Raspberry Pi

Raspberry Pi – Getting SMB to work

6 Replies

I just got a new Raspberry Pi Model B and am planning on playing with it as a Media Center system. Getting the basics up and running took a little more work then I expected as I didn’t have neither HDMI/DVI converter nor USB Keyboard (PS/2 rules).

I had a pre-formatted SDCard ready to roll but when I attached the network cable and power unfortunately the device didn’t connect to the network – plugging it into the TV I saw that the it was stopping at the NOOBS loader. This allows you to get the Pi up and running easily, without network access, and to select and install from a menu of Operating Systems. Kind of conflicted about how good an idea this is to the typical linux/electronics hobbiest. Effectively this acts like a recovery partition after the first install.

Plug in a mouse, select Raspbian (as I usually work on Debian) and a few mins later the install is complete. Reboot and complete the setup and it was networked. Once I found the IP I updated and upgraded all the packages and installed XRDP for remote desktop access.

At this point I wanted to check that SMB would work – it wouldn’t 🙁

pi@raspberrypi ~ $ sudo mkdir /mnt/Media pi@raspberrypi ~ $ sudo vi /etc/fstab pi@raspberrypi ~ $ mount /mnt/Media mount: only root can mount //192.168.1.8/samba on /mnt/Media pi@raspberrypi ~ $ sudo !! sudo mount /mnt/Media mount error: cifs filesystem not supported by the system mount error(19): No such device Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) pi@raspberrypi ~ $ cd /mnt pi@raspberrypi /mnt $ ls Media pi@raspberrypi /mnt $ mount -t cifs -o user=xxxx //192.168.1.8/samba /mnt/Media mount: only root can do that pi@raspberrypi /mnt $ sudo !! sudo mount -t cifs -o user=xxxx//192.168.1.8/samba /mnt/Media Password: mount error: cifs filesystem not supported by the system mount error(19): No such device Refer to the mount.cifs(8) manual page (e.g. man mount.cifs) pi@raspberrypi /mnt $ sudo modprobe cifs libkmod: ERROR ../libkmod/libkmod.c:554 kmod_search_moddep: could not open moddep file '/lib/modules/3.6.11+/modules.dep.bin'

This was something of a puzzle as both cifs-utils and libsmbclient are installed. Turns out that the firmware was out of date – a quick rpi-update and reboot and problem solved!

pi@raspberrypi /mnt $ sudo rpi-update *** Raspberry Pi firmware updater by Hexxeh, enhanced by AndrewS *** Performing self-update % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 100 135 100 135 0 0 240 0 --:--:-- --:--:-- --:--:-- 323 100 7177 100 7177 0 0 7315 0 --:--:-- --:--:-- --:--:-- 7315 *** Relaunching after update *** Raspberry Pi firmware updater by Hexxeh, enhanced by AndrewS *** ARM/GPU split is now defined in /boot/config.txt using the gpu_mem option! *** We're running for the first time *** Setting up firmware (this may take a few minutes) Cloning into '//root/.rpi-firmware'... remote: Counting objects: 3378, done. remote: Compressing objects: 100% (2610/2610), done. Receiving objects: 100% (3378/3378), 25.96 MiB | 1.20 MiB/s, done. remote: Total 3378 (delta 1608), reused 1117 (delta 504) Resolving deltas: 100% (1608/1608), done. ...

Facebook

Twitter

Stumbleupon

Flat-Planet.net

Thoughts of a Networking Nerd

Tag Archives: raspberry pi

Raspberry Pi as a Cheap Security Camera

Raspberry Pi Configuration

motion.conf – some key changes

Network Configuration with Raspberry Pi – WiFi and Ethernet

WiFi Config File

Interfaces File

The Weirdness

Raspberry Pi as a server

Update the Pi

Secure SSH Acess

Delete the default user ‘pi’

Improving the Performance

Basic Intrusion Prevention

Updating Raspberry Pi

Raspberry Pi – Getting SMB to work