Use docker for flashing an opensource Zigbee Router

 Following this procedure to increase my Zigbee network range (works amazing !), I've ended up with another method of using cc-tools :

https://www.zigbee2mqtt.io/how_tos/how_to_create_a_cc2530_router.html

At the end of step2., this is given to perform https://www.zigbee2mqtt.io/how_tos/how_to_create_a_cc2530_router.html procedure, which is very similar.

Using cc-tools was a burden for me as I use a hybrid testing/stable debian, I could not get all the dependencies solved.

I've found some docker images : https://hub.docker.com/search?q=cc-tool&type=image

So I've used joonas' one

Here is the command :

- perform 'lsusb' to get the device bus ID of the Texas Instrument flashing device.

- download the firmware image in /dest/ and bind mount it in /srv

- joonas/cc-tool:latest does not exist, so it is mandatory to use the correct image tag

docker run -it --device /dev/bus/usb/001/021 -v /dest/CC2530_CC2591_router_2020_09_29:/srv joonas/cc-tool:20210112_1334_98a05cdf cc-tool -e -w /srv/router-cc2530-cc2591-std.hex

Secure Fortigate Virtual Server

 By default, the settings for a Fortigate virtual server are not considered secure on this website : https://internet.nl/site/ or https://www.ssllabs.com/ssltest/analyze.html

 

Current FortiOS version is 6.4.4 so custom ciphers should not be used, as the traffic is not processed afterwards (bug ?)

 

The list :

 

TLS 1.1 phased out

cyphers phased out :

• ECDHE-ECDSA-DES-CBC3-SHA [1.0]
• ECDHE-RSA-DES-CBC3-SHA [1.0]
• DHE-RSA-DES-CBC3-SHA [1.0]
• AES256-GCM-SHA384 [1.2]
• AES128-GCM-SHA256 [1.2]
• AES256-SHA256 [1.2]
• AES256-SHA [1.0]
• AES128-SHA256 [1.2]
• AES128-SHA [1.0]
• DES-CBC3-SHA [1.0]

DH-2048 Key exchange phased out

Client-initiated renegotiation

Here are the settings to avoid it :

conf firewall vip

edit <vip_name>

        set ssl-dh-bits 3072
        set ssl-algorithm custom
        config ssl-cipher-suites
            edit 1
                set cipher TLS-AES-256-GCM-SHA384
                set versions tls-1.2 tls-1.3
            next
            edit 2
                set cipher TLS-CHACHA20-POLY1305-SHA256
                set versions tls-1.2 tls-1.3
            next
            edit 3
                set cipher TLS-AES-128-GCM-SHA256
                set versions tls-1.2 tls-1.3
            next
            edit 4
                set cipher TLS-AES-256-GCM-SHA384
                set versions tls-1.2 tls-1.3
            next
            edit 5
                set cipher TLS-CHACHA20-POLY1305-SHA256
                set versions tls-1.2 tls-1.3
            next
            edit 6
                set cipher TLS-AES-128-GCM-SHA256
                set versions tls-1.2 tls-1.3
            next
        end
        set ssl-min-version tls-1.2
        set ssl-client-renegotiation deny

end

end

restrict SFTP to a user and specific directory

 create a SSH Subsystem :

#Subsystem      sftp    /usr/lib/openssh/sftp-server
Subsystem sftp internal-sftp
  Match group sftpusers
  ChrootDirectory %h
  ForceCommand internal-sftp

restart ssh server

create a user member of sftpusers:

sudo useradd -g sftpusers -s /sbin/nologin -m -d /directory/to/share username

Apply permissions for Chroot


As ChrootDirectory needs to belong to root and have 755 permissions :

chown root: /directory

chown root: /directory/to

chown root: /directory/to/share

and also apply 755 permissions to these

apply the wanted permissions for the shared directory

chown -R user1:sftpusers /directory/to/share/*

Calico does not insert iptables rules

on kubernetes pod had  a DNS issue, it could not reach the outside. The Fortigate firewall was not receiving the packet.

Only one node was affected, and this node was an updated Debian Buster image from Stretch.

The difference is that Buster uses now nftables instead of iptables.

so there is the iptables command and the iptables-legacy.

I could see that the iptables -L command was not being populated with calico inputs, and instead these rules were added in iptables-legacy.

This is due to the fact that calico still uses the old iptables.

In order to make everything work, I use only the iptables-legacy :

update-alternatives --set iptables /usr/sbin/iptables-legacy

this is a known Calico issue #2322 : https://github.com/projectcalico/calico/issues/2322

External email with OVH mail on proxmox

configure the /etc/postfix/main.cf like the below

# See /usr/share/postfix/main.cf.dist for a commented, more complete version

#CHANGEME
myhostname=proxmox1.gatom.net

smtpd_banner = $myhostname ESMTP $mail_name (Debian/GNU)
biff = no

# appending .domain is the MUA's job.
append_dot_mydomain = no

# Uncomment the next line to generate "delayed mail" warnings
#delay_warning_time = 4h

alias_maps = hash:/etc/aliases
alias_database = hash:/etc/aliases
#mydestination = $myhostname, localhost.$mydomain, localhost
#relayhost =
mynetworks = 127.0.0.0/8
inet_interfaces = loopback-only
recipient_delimiter = +

compatibility_level = 2

# OVH SMTP/TLS
relayhost = [ssl0.ovh.net]:465
smtp_use_tls=yes
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_tls_CAfile = /etc/ssl/certs/ca-certificates.crt
smtp_sasl_security_options = noanonymous

smtp_tls_wrappermode = yes
smtp_tls_security_level = encrypt

the two last are required for SMTPS or error message is :

(TCP port 465) requires setting "smtp_tls_wrappermode = yes", and "smtp_tls_security_level = encrypt" (or stronger)

add credentials to /etc/postfix/sasl_passwd

 [ssl0.ovh.net]:465     login:password

set permissions

chmod 600 /etc/postfix/sasl_passwd

create the password db

postmap /etc/postfix/sasl_passwd

of the db is not correct with the given credentials, error is

(SASL authentication failed; server ssl0.ovh.net[193.70.18.144] said: 535 5.7.1 Authentication failed)

install the package for sasl

apt-get install libsasl2-modules

otherwise error is

(SASL authentication failed; cannot authenticate to server ssl0.ovh.net[193.70.18.144]: no mechanism available)

restart postfix

systemctl restart postfix

test

echo "test ok" | mail -s "Test" dest-email@domain.com

 

change Ceph permissions

ceph auth list

...
client.cloud
    key: AQB6hPddq....HcQpUMPSNunT2w==
    caps: [mds] allow rw path=/nas/path/1, allow rw path=/nas/path/2
    caps: [mon] allow r
    caps: [osd] allow rw pool=cephfs_data
...

change with :

ceph auth caps client.cloud \
     mon 'allow r' \
     osd 'allow rw pool=cephfs_data' \
     mds 'allow rw path=/nas/path/1, allow rw path=/nas/path/3'

then check with ceph auth list

...
client.cloud
    key: AQB6hPddq....HcQpUMPSNunT2w==
    caps: [mds] allow rw path=/nas/path/1, allow rw path=/nas/path/3
    caps: [mon] allow r
    caps: [osd] allow rw pool=cephfs_data
...

LoadBalance Service for Bare metal / VM Kubernetes : Metallb

I use Metallb for the LoadBalance service of my kubernetes cluster.

helm install metallb --namespace=metallb stable/metallb

apply the configmap that is the default for the chart.

remember that for the Helm chart the configmap name has to be metallb-config, which is different from the metallb documentation.

apiVersion: v1
kind: ConfigMap
metadata:
  namespace: metallb
  name: metallb-config
data:
  config: |
    address-pools:
    - name: default
      protocol: layer2
      addresses:
        - 10.0.14.100-10.0.14.200

I prefer the BGP implementation :

apiVersion: v1
kind: ConfigMap
metadata:
  namespace: metallb
  name: metallb-config
data:
  config: |
    peers:
    - peer-address: 10.0.14.1
      peer-asn: 64501
      my-asn: 64500
    address-pools:
    - name: default
      protocol: bgp
      addresses:
      - 10.0.12.128/25

I peer the BGP peers with the Fortigate firewall which is 10.0.14.1 :

config router bgp
    set as 64501
    set router-id 0.0.0.1
    config neighbor
        edit "10.0.14.11"
            set remote-as 64500
        next
        edit "10.0.14.12"
            set remote-as 64500
        next

        ... (and the remaining nodes)

        next
    end
    config redistribute "connected"
    end
    config redistribute "rip"
    end
    config redistribute "ospf"
    end
    config redistribute "static"
    end
    config redistribute "isis"
    end
    config redistribute6 "connected"
    end
    config redistribute6 "rip"
    end
    config redistribute6 "ospf"
    end
    config redistribute6 "static"
    end
    config redistribute6 "isis"
    end
end

do not forget to open the firewall rules then.

reference for the Helm chart :

https://hub.helm.sh/charts/stable/metallb

Ceph for Kubernetes

follow :
https://github.com/kubernetes-incubator/external-storage/

Straight forward with some modifications, as the claim has to have a different name, and pay attention that for CephFS and RDB, the admin secret name is different, but can be set the same.

I also used the same cephfs namespace for both.

EDIT : I made a PR that uses now the same kubernetes user for both storageclass
here : https://github.com/kubernetes-incubator/external-storage/pull/1306

ZFS storage driver for docker

This is used to have a docker setup directly on Proxmox 6 with ZFS 


stop the docker service

service docker stop


delete all the docker stuff

rm -rf /var/lib/docker


create a zfs pool dedicated for docker
  
zfs create -o mountpoint=/var/lib/docker rpool/docker


create the systemd entry for the docker service

mkdir /etc/systemd/system/docker.service.d


setup the driver for docker

nano /etc/systemd/system/docker.service.d/storage-driver.conf


[Service]
ExecStart=
ExecStart=/usr/bin/dockerd --storage-driver=zfs -H fd://


then restart daemons and docker

systemctl daemon-reload
service docker start





Samba over CephFS

I wanted to use NFS to share data on the network, but Windows 10 still isn't able to use NFS ... what a joke.

So first mount CephFS (see previous article)

Then configure the Samba server

1. install samba server 

apt-get install samba

2. edit the configuration file

set the workgroup

add a samba share, for example

[photos]
        comment = photos
        read only = no
        path = /mnt/cephfs/nas/photos
        guest ok = no
 

2. configure users

I use the same setup users as the user on the windows machine

add the user :

adduser toto

setup its password: 

passwd toto

then add this user to Samba :

smbpasswd -a toto

then restart the daemon to take into account the config :

systemctl restart smbd