-
Notifications
You must be signed in to change notification settings - Fork 5
Manual Installation Guide
WORK IN PROGRESS
This guide will provide an overview of how to manually install RaspiPass onto your own Raspbian image from base. Users with existing Raspbian installations may find it useful to read through and consider suitability of installing RaspiPass onto an existing OS.
Download the latest Raspbian image from here (this guide will use Raspbian Lite to reduce image size and avoid GUI installation)
Write the downloaded image to your Micro SD card using a tool like Win32 Disk Imager (Windows) or ApplePi-Baker (Mac)
Safely eject your Micro-SD after imaging, and insert it into your powered-down Raspberry Pi 3. Connect an HDMI cable, an ethernet cable, and a keyboard, then power on the device.
The device will likely reboot a couple of times before presenting you with a login prompt. Log in with the username pi and the password raspberry
Run the following commands to ensure all operating system files are up to date:
sudo apt-get update
sudo apt-get dist-upgrade
sudo reboot
After rebooting, run the following to complete the upgrade:
sudo apt-get update
sudo apt-get upgrade
sudo reboot
Once everything's rebooted we'll do some further device configuration.
Here we will configure Raspbian for your local settings, and start applying some RaspiPass-specific configuration
With that done (and the fstab changes ready to run when we reboot next) we can run the following command to enter the Raspbian configuration tool:
sudo raspi-config
Once open, we'll perform the following tasks:
Select option 1 and follow the prompts to ensure the OS fully-expands the filesystem to occupy as much space as possible on the Micro-SD card. After this, exit raspi-config and reboot.
When rebooted and back at the raspi-config main menu, select option 2 to change the password for the "pi" user. Set this to whatever you like - we'll be making a new user later on.
Returning to the main menu, select option 4 to enter the Internationalisation Options submenu.
Select option I1 and follow the prompts to select the appropriate locale. Note that UTF-8 is the recommended format.
Re-enter the Internationalisation submenu and choose option I2 to select the timezone for your device.
Go back to the Internationalisation submenu and select option I3 to choose your keyboard layout.
Again at the Internationalisation submenu, select option I4 and pick your appropriate WiFi country.
Here we will change the device hostname, and enable SSH access. Select option 7 to enter the Advanced Options submenu.
Select option A2 and change the hostname to "raspipass"
Back at the Advanced Options menu, select option A4 and elect to enable SSH server.
Close the raspi-config menu and run the command
sudo reboot
to ensure all settings are committed and running before we proceed.
Once rebooted, log back in and run the following commands to ensure the device firmware is up to date:
sudo apt-get install rpi-update
sudo rpi-update
The updater may download and update some device firmware. Do not interrupt this process! Once complete, reboot the device again with
sudo reboot
Note that you may wish to obtain the IP address of the device using the ifconfig command, and connect to it with an SSH client from here to ease copy/pasting.
We will add two lines to /etc/fstab in order to prolong the life of the SD card by writing Apache and RaspiPass logs to memory instead of disk.
Run sudo nano /etc/fstab and insert the following two lines at the bottom:
tmpfs /var/log/apache2 tmpfs defaults,noatime,nosuid,mode=0777,size=20m 0 0
tmpfs /var/raspipass tmpfs defaults,noatime,nosuid,mode=0777,size=10m 0 0
Save the file and reboot.
Now it's time to start installing new programs and services. Run the following command to install required packages, and their dependencies. A description of each package is below.
sudo apt-get install bridge-utils macchanger hostapd ifupdown samba randomize-lines wireless-tools libssl-dev libnl1 libnl-dev usbutils gcc iw samba-common-bin at apache2 php5 git
| Package(s) | Description |
|---|---|
| apache2, php5 | Used to host the web configuration |
| at | Scheduling tool used to bring down wifi network 5 minutes after raising |
| bridge-utils | Tools for bridging wlan0 and eth0 into a single br0 interface |
| gcc | GNU C compiler |
| git | Used to access the RaspiPass repository |
| hostapd | Tool for creating an access point |
| ifupdown | Used for bringing interfaces up/down |
| iw,wireless-tools | For additional monitoring/control of WiFi adapter |
| libssl-dev | Used for SSL |
| lib-nl,libnl-dev | Network protocol suite |
| macchanger | Tool for changing the MAC address of wlan0 |
| randomize-lines | Tool for selecting a random line from a file (for picking SSID/MAC pair) |
| samba | Used to ensure the device hostname is visible to Windows systems |
| samba-common, samba-common-bin | Additional tools for Samba |
| usbutils | USB device utilities/drivers |
You may be presented with initial configuration requests from macchanger. The options to select are listed below:
| macchanger | |
|---|---|
| Change MAC automatically | No |
By default, Samba installs a default configuration allowing file and printer access. We're going to strip it back to the very barest essentials, removing remote file access while ensuring Samba helps the device remain visible to Windows clients.
Run the command sudo nano /etc/samba/smb.conf and you'll be confronted with a very large configuration file. Press Alt+T to clear the entire configuration, and replace it with the following:
[global]
server string = %h - RaspiPass machine
map to guest = Bad User
obey pam restrictions = Yes
pam password change = Yes
passwd program = /usr/bin/passwd %u
passwd chat = *Enter\snew\s*\spassword:* %n\n *Retype\snew\s*\spassword:* %n\n *password\supdated\ssuccessfully* .
unix password sync = Yes
syslog = 0
log file = /var/log/samba/log.%m
max log size = 1000
load printers = No
printcap name = /dev/null
disable spoolss = Yes
dns proxy = No
usershare allow guests = Yes
panic action = /usr/share/samba/panic-action %d
idmap config * : backend = tdb
printing = bsd
print command = lpr -r -P'%p' %s
lpq command = lpq -P'%p'
lprm command = lprm -P'%p' %j
Now restart samba with sudo service smbd restart
From here we can run the following command to create our 'raspi' user.
sudo adduser raspi Set the password as "pinchie"; leave all other values as default
Now run sudo visudo and confirm the following exists in the file:
%sudo ALL=(ALL:ALL) ALL
This allows all members of the sudo group to use the sudo command. We're going to remove the default "pi" user from this group and add our new "raspi" user, but before this we'll add the following line to the the bottom of the file to ensure www-data has unfettered access to sudo in order to access hostapd:
www-data ALL=(ALL) NOPASSWD: ALL
Now save and exit the file, and run the following commands to add www-data to the raspi and root groups:
sudo usermod -a -G root www-data
sudo usermod -a -G raspi www-data
Now we'll adjust our members of the "sudo" group:
sudo gpasswd -d pi sudo
sudo usermod -a -G sudo raspi
Since we've delegated root access to be taken away from the "pi" user on next login, we should log out and log in as our new "raspi" user.
logout
Now it's time to create some folders for RaspiPass and the local RaspiPass repository to reside in. Run the following commands:
sudo mkdir /raspipass /raspi_secure /git
sudo chown raspi:raspi /raspipass /git
sudo chmod 744 /raspipass
sudo chmod 777 /git
sudo chmod 700 /raspi_secure
Now we can run the following two commands to download the RaspiPass files into our /git directory:
cd /
git clone https://github.com/Pinchie/RaspiPass /git
After a few moments, the /git directory will be populated with folders. It's worth noting that the file permissions will not be as required at this point, so the following command will be necessary:
sudo chmod -R 777 /git/html /git/raspipass /git/raspi_secure /git/scripts
While it seems like this will be dropping security, it is only for the git repository. The script to actually copy the files will set security restrictions when it runs. Speaking of scripts, we should run
sudo chown root:root /git/scripts/*.sh
sudo chmod 766 /git/scripts/*.sh
to ensure the installation scripts are only run as root from now on.
RaspiPass uses a bridge interface br0 to handle all eth0 and wlan0 traffic on a single device. We will need to set up this bridge, as well as making sure that the wireless interface isn't up all the time.
Run sudo nano /etc/rc.local and add the line
ifconfig wlan0 down
on its own line, just before the exit 0 line. Press ctrl+o to save, and ctrl+x to exit.
Now run sudo /git/scripts/set_interfaces.sh to overwrite the network configuration. This configuration will be applied on next boot, which will we'll be doing soon.
Execute the following commands to complete installation:
sudo /git/scripts/copy_to_sysdirs.sh
(Answer "Y" to proceed)
sudo /git/scripts/set_defaults.sh
sudo reboot
After rebooting, access http://raspipass from a web browser and set your desired configuration. Clicking "Save and Exit" will set up the crontab as required.