1 Commits

Author SHA1 Message Date
e623d7f21a ed25519 support
My attempt to get ed25519 support for the doors in the script.
Please check function and syntax!
2020-05-21 20:11:56 +02:00
17 changed files with 236 additions and 416 deletions

1
.gitignore vendored
View File

@ -1 +0,0 @@
foodoord*.deb

View File

@ -1,29 +1,32 @@
# foodoord
#foodoord
Das Schließsystem läuft auf einem RaspberryPi mit der Erweiterungsplatine "PiFaceDigitalIO".
##Software##
## Konfiguration
###Installation###
<code>apt-get install python-pifacedigitalio </code>
Falls `/etc/foodoord.conf` nicht vorhanden ist:
Um das Paket zu installieren muss die */etc/apt/sources.list* angepasst werden.
* `mv /etc/foodoord.conf_example /etc/foodoord.conf`
<code>deb http://archive.raspbian.org/raspbian wheezy main contrib non-free rpi</code>
1. Trage dort die API-Config für den Türstatus ein.
2. Sind wir oben oder unten? Diese Information in `where` eintragen. Also bspw. `where = oben`.
<code>deb-src http://archive.raspbian.org/raspbian wheezy main contrib non-free rpi</code>
Wer apt-get benutzt, kann den Raspbian Pubkey zum keyring hinzufügen.
<code>wget http://archive.raspbian.org/raspbian.public.key -O - | sudo apt-key add -</code>
## Software
### Dateiliste
###Dateiliste###
Der Deamon besteht aus folgenden Dateien.
* foodoor
* foodoord
* foodoord.conf
* foodoord_initd
* foodoor-ssh-wrapper
* foodoor-update-keydb
Zusätzlich sollte für das git-repo eine Config angelegt werden:
@ -39,37 +42,30 @@ Host git.chaospott.de
Das IdentityFile ist der Deploy-SSH-Key, der im [Repo](https://git.chaospott.de/Chaospott/foodoor-keys) hinterlegt ist.
## Schüssel
##Schüssel
### Schlüsselupdate
`foodoor-update-keydb`
###Schlüsselupdate
<pre><code>foodoor-update-keydb
</code></pre>
Aktualisiert die die Schlüssel auf der Tür und baut die *Authorized_Keys* für die User *open* und *close*. Keys die nicht dem OpenSSH-Format mit 4096 bit entsprechen, werden ignoriert. Wenn das Script von Hand aufgerufen wird, werden die betroffenen Keys angezeigt. Über einen Cronjob werden die Keys alle **5 Min aktualisiert**.
### Schlüsselformate
###Schlüsselformate###
Der foodoord akzeptiert nur Pub-Keys im *OpenSSH2-Format*. Keys lassen sich unter anderem mit OpenSSH oder PuTTygen erzeugen.
### OpenSSH
#### Keys generieren
* Mit `ssh-keygen -b 4096` lassen sich Keys generieren.
* `ssh-add $Pfad_zum_Key` fügt den Key dem ssh-Agent hinzu. Die Option `ssh-add -l` zeigt geladene Keys an.
* `ssh-kegen -l -f $Pfad_zum_Key ` gibt den Fingerprint und andere Informationen zurück.
###OpenSSH####
####Keys generieren####
* Mit <code>ssh-keygen -b 4096 </code> lassen sich Keys generieren.
* <code>ssh-add $Pfad_zum_Key</code> fügt den Key dem ssh-Agent hinzu. Die Option <code>ssh-add -l</code> zeigt geladene Keys an.
* <code>ssh-kegen -l -f $Pfad_zum_Key </code> gibt den Fingerprint und andere Informationen zurück.
####Keys konvertieren(PuTTy>OpenSSH):####
* `ssh-keygen -i $Pfad_zum_Key > $Pfad_neuer_Pfad.pub<` liest ssh2-kompatible Keys(RFC 4716) ein und speichert diese im OpenSSH-Format.
* <code>ssh-keygen -i $Pfad_zum_Key > $Pfad_neuer_Pfad.pub</code> liest ssh2-kompatible Keys(RFC 4716) ein und speichert diese im OpenSSH-Format.
###PuTTy###
Da die Tür nur Keys im OpenSSH-Format verträgt, dürfen auch mit Putty nur OpenSSH-Keys genutzt werden.
###Keys generieren (OpenSSH-Format mit PuttyGen):###
1. PuTTYgen öffnen
2. Unten "Number of Bits in a generated Key:" 4096 eintippen
3. "Generate" klicken um Key zu generieren
@ -78,28 +74,21 @@ Da die Tür nur Keys im OpenSSH-Format verträgt, dürfen auch mit Putty nur Ope
Es ist zu beachten, dass Putty den PrivateKey im Putty-Format benötigt! Das heißt, falls der generierte Key vor dem Export nicht gespeichert wurde, muss der private Key noch konvertiert werden, siehe nächster Punkt!
###Keys konvertieren(OpenSSH>PuTTy):###
1. PuTTYgen öffnen
2. "Load" drücken
3. OpenSSH-Key auswählen
4. "Save Private-Key" drücken
5. Speichern
##Hardware
### Input:
* ssh-login
* Klingel
* Statustaster
### Output:
* Status LEDs
* Summer
* Keymatic

View File

@ -1,2 +0,0 @@
#!/bin/bash
dpkg-deb --root-owner-group -b debian foodoord_3.0.0_all.deb

View File

@ -1,5 +0,0 @@
Package: foodoord
Version: 3.0
Maintainer: Bandie <bandie@chaospott.de>
Architecture: all
Description: Control the doors of the club, ja!

View File

@ -1,22 +0,0 @@
#!/bin/bash
set -x
echo "Creating group and users.."
groupadd foodoor
useradd -M -d /var/lib/foodoor/close -G foodoor -s /bin/sh close
useradd -M -d /var/lib/foodoor/open -G foodoor -s /bin/sh open
useradd -M -d /var/lib/foodoor/door -G foodoor -s /bin/sh door
echo "Chown homes"
for u in close open door; do
groupadd ${u}
chown ${u}:${u} /var/lib/foodoor/${u}
done
echo "Create /state"
touch /state
chown root:foodoor /state
chmod 664 /state
systemctl daemon-reload
systemctl enable foodoord
systemctl restart foodoord

View File

@ -1 +0,0 @@
*/5 * * * * root [ -x /usr/sbin/foodoor-update-keydb ] && /usr/sbin/foodoor-update-keydb >/dev/null 2>&1

View File

@ -1,8 +0,0 @@
[doorstatus]
status_url =
key =
secret =
[foodoord]
# oben or unten
where=

View File

@ -1,37 +0,0 @@
#!/bin/sh
set -e
PIPE_PATH=/var/run/foodoord.pipe
if [ ! -e $PIPE_PATH ]
then
echo "Pipe missing. Check daemon status."
exit 1
fi
action="$1"
isTriggerActivated="0"
if [ -z "$action" ]
then
action="$SSH_ORIGINAL_COMMAND"
isTriggerActivated="1"
fi
case $action in
close|open)
echo $action | tee $PIPE_PATH |sed 's/open/UNLOCKED/;s/close/LOCKED/' > /state
;;
status)
;;
*)
echo "Usage: $(basename $0) { close, open, status }"
exit 1
;;
esac
if [ $isTriggerActivated -eq 1 ]
then
cat /state
sleep 2
fi

View File

@ -1,63 +0,0 @@
#!/bin/bash
set -e
export PATH="/usr/bin:/bin:/usr/sbin:/sbin"
dest=/var/run/foodoor-keys
temp_outfile="$dest.tmp"
if [ ! -e "${dest}/.git/config" ]
then
#echo "Repo does not exist, trying to clone..."
( cd /var/run && git clone --quiet --single-branch --depth=1 ssh://git.chaospott.de/Keyverwaltung/foodoor-keys.git "${dest}" )
else
#echo "Repo exists, updating..."
( cd "${dest}" && git fetch --quiet && git merge --quiet origin/master master )
fi
rm -f ${temp_outfile}
find "${dest}/keys" -name '*.pub' | sort | \
while read keyfile
do
ssh-keygen -l -f ${keyfile} &> /dev/null
if [ $? -eq 0 ]; then
valid=false
keyinfo=$(ssh-keygen -l -f ${keyfile}) # The whole key information
crypto=$(echo "${keyinfo}" | cut -d" " -f4) # Looks like "(RSA)" or "(ED25519)"
key_length=$(echo "${keyinfo}" | cut -d" " -f1)
if [ "${crypto}" == "(RSA)" ]; then
if [ ${key_length} -lt 4096 ]; then
echo "Key size of key ${keyfile} not equal to 4096. Not adding it to key database." >&2
continue
else
valid=true
fi
elif [ "${crypto}" == "(ED25519)" ]; then
valid=true
fi
if [ "$valid" = true ]; then
echo "command=\"/usr/sbin/foodoor \$action \",no-port-forwarding,no-X11-forwarding,no-agent-forwarding $(cat ${keyfile})" >> ${temp_outfile}
fi
fi
done
for appendix in open close door
do
action="$appendix"
if [ "$appendix" = "door" ]; then
action=""
fi
export action
outfile="${dest}/authorized_keys.${appendix}"
cat ${temp_outfile} |envsubst > ${outfile}
# Oben und unten
install -d -o ${appendix} -g nogroup -m 0700 /var/lib/foodoor/${appendix}/.ssh
install -b -S .last -o ${appendix} -g nogroup -m 0600 ${outfile} /var/lib/foodoor/${appendix}/.ssh/authorized_keys
done

View File

@ -1,143 +0,0 @@
#!/usr/bin/env python3
# vim: ts=2 sw=2 et
import os
import stat
import time
import pifacedigitalio
import signal
import sys
import grp
from configparser import ConfigParser
#Read config
parser = ConfigParser()
parser.read('/etc/foodoord.conf')
doorapi = parser.get('doorstatus', 'status_url')
consumerkey = parser.get('doorstatus', 'key')
consumersecret = parser.get('doorstatus', 'secret')
#Definitions for output
LED_RED=6
LED_GREEN=7
RELAYS_LOCK=0
RELAYS_UNLOCK=1
#Definitions for input
DOOR_BELL=0
REED_RELAYS=1 #not implementet yet
#Definitions for LEDcolor
RED=1
GREEN=2
ORANGE=3
def update_api(locked):
try:
os.system("/usr/bin/curl -XPOST --header 'Content-Type: application/json' --data '{ \"consumer_key\": \"" + consumerkey + "\", \"consumer_secret\": \"" + consumersecret + "\", \"aerie\": " + str(locked).lower() + " }' '" + doorapi + "' ")
except:
pass
if __name__ == "__main__":
def doorbell(event):
if (STATUS):
pifacedigital.relays[RELAYS_UNLOCK].toggle()
time.sleep(2)
pifacedigital.relays[RELAYS_UNLOCK].toggle()
#print 'got doorbell'
def close_button(event):
global STATUS
STATUS = False
try:
update_api(True)
except:
pass
set_led(RED)
listener = pifacedigitalio.InputEventListener()
listener.register(0, pifacedigitalio.IODIR_RISING_EDGE, doorbell, settle_time=10)
listener.register(1, pifacedigitalio.IODIR_RISING_EDGE, close_button, settle_time=5)
listener.activate()
def signal_handler(signal, frame):
listener.deactivate()
os.remove("/var/run/foodoord.pipe")
try:
update_api(True)
except:
pass
set_led(RED)
sys.exit(0)
def set_led(color):
if (color==RED):
pifacedigital.leds[LED_RED].turn_on()
pifacedigital.leds[LED_GREEN].turn_off()
elif (color==GREEN):
pifacedigital.leds[LED_GREEN].turn_on()
pifacedigital.leds[LED_RED].turn_off()
elif (color==ORANGE):
pifacedigital.leds[LED_RED].turn_on()
pifacedigital.leds[LED_GREEN].turn_on()
pifacedigital = pifacedigitalio.PiFaceDigital()
signal.signal(signal.SIGTERM, signal_handler)
#Startsettings
STATUS = False
pifacedigital.leds[LED_RED].turn_on()
#Setting up FiFo to get sshd-output
try:
os.mkfifo("/var/run/foodoord.pipe")
os.chown("/var/run/foodoord.pipe", -1, grp.getgrnam('foodoor')[2])
os.chmod("/var/run/foodoord.pipe", stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP | stat.S_IWGRP)
except OSError:
pass
with open("/var/run/foodoord.pipe", "r") as ssh_input:
while 1:
#Read sshd-output from pipe
Pipe = ssh_input.readline()[:-1]
if (Pipe == "close" and STATUS):
pifacedigital.relays[RELAYS_LOCK].toggle()
time.sleep(1)
pifacedigital.relays[RELAYS_LOCK].toggle()
STATUS = False
try:
update_api(True)
except:
pass
set_led(RED)
elif (Pipe == "open"):
pifacedigital.relays[RELAYS_UNLOCK].toggle()
time.sleep(2)
pifacedigital.relays[RELAYS_UNLOCK].toggle()
if (STATUS==False):
try:
update_api(False)
except:
pass
STATUS = True
set_led(GREEN)
time.sleep(0.1)

View File

@ -1,97 +0,0 @@
#! /usr/bin/python3
# vim: ts=2 sw=2 et
import os
import stat
import time
import signal
import sys
import RPi.GPIO as gpio
import grp
from configparser import ConfigParser
#Read config
parser = ConfigParser()
parser.read('/etc/foodoord.conf')
doorapi = parser.get('doorstatus', 'status_url')
consumerkey = parser.get('doorstatus', 'key')
consumersecret = parser.get('doorstatus', 'secret')
#Definitions for output
LED_RED=6
LED_GREEN=7
RELAYS_LOCK=0
RELAYS_UNLOCK=1
PIN_OPEN=24
PIN_CLOSE=27
#Definitions for input
DOOR_BELL=0
REED_RELAYS=1 #not implementet yet
#Definitions for LEDcolor
RED=1
GREEN=2
ORANGE=3
def write_state(state):
try:
handle = open("/tmp/door_state", "w")
handle.write(state)
handle.close()
except:
pass
def update_api(locked):
try:
os.system("/usr/bin/curl -XPOST --header 'Content-Type: application/json' --data '{ \"consumer_key\": \"" + consumerkey + "\", \"consumer_secret\": \"" + consumersecret + "\", \"cellar\": " + str(locked).lower() + " }' '" + doorapi + "' ")
except:
pass
if __name__ == "__main__":
#Startsettings
STATUS=False
gpio.setmode(gpio.BCM)
gpio.setup(PIN_OPEN, gpio.OUT)
gpio.setup(PIN_CLOSE, gpio.OUT)
#Setting up FiFo to get sshd-output
try:
os.mkfifo("/var/run/foodoord.pipe")
os.chown("/var/run/foodoord.pipe", -1, grp.getgrnam('foodoor')[2])
os.chmod("/var/run/foodoord.pipe", stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP | stat.S_IWGRP)
except OSError:
pass
with open("/var/run/foodoord.pipe", "r") as ssh_input:
while 1:
#Read sshd-output from pipe
Pipe = ssh_input.readline()[:-1]
if (Pipe == "close"):
gpio.output(PIN_CLOSE,1)
time.sleep(1)
gpio.output(PIN_CLOSE,0)
write_state("closed")
update_api(True)
elif (Pipe == "open"):
#Locking
gpio.output(PIN_OPEN,1)
time.sleep(1)
gpio.output(PIN_OPEN,0)
#Save State
write_state("open")
#Status Update
update_api(False)
time.sleep(0.2)

23
foodoor Executable file
View File

@ -0,0 +1,23 @@
#!/bin/sh
set -e
PIPE_PATH=/var/run/foodoord.pipe
if [ ! -e $PIPE_PATH ]
then
echo "Pipe missing. Check daemon status."
exit 1
fi
case $1 in
close)
echo close > $PIPE_PATH
;;
open)
echo open > $PIPE_PATH
;;
*)
echo "Usage: $(basename $0) { close, open}"
exit 1
;;
esac

2
foodoor-ssh-wrapper Executable file
View File

@ -0,0 +1,2 @@
#!/bin/sh
ssh -i /root/.ssh/id_rsa_gitlab_deploy $1 $2

41
foodoor-update-keydb Executable file
View File

@ -0,0 +1,41 @@
#!/bin/bash
set -e
export PATH="/usr/bin:/bin:/usr/sbin:/sbin"
export GIT_SSH="/usr/sbin/foodoor-ssh-wrapper"
dest=/var/run/foodoor-keys
if [ ! -e "${dest}/.git/config" ]
then
#echo "Repo does not exist, trying to clone..."
( cd /var/run && git clone --quiet --single-branch --depth=1 ssh://git.chaospott.de/Chaospott/foodoor-keys.git "${dest}" )
else
#echo "Repo exists, updating..."
( cd "${dest}" && git fetch --quiet && git merge --quiet origin/master master )
fi
for action in open close
do
outfile="${dest}/authorized_keys.${action}"
rm -f ${outfile}
find "${dest}/keys" -name '*.pub' | sort | \
while read keyfile
do
ssh-keygen -l -f ${keyfile} &> /dev/null
if [ $? -eq 0 ]; then
key_length=`ssh-keygen -l -f ${keyfile} | cut -d" " -f1`
if ssh-keygen -l -f id_ed25519.pub| cut -d" " -f4 == "(ED25519)"; then
key_length += 3840
if [ ${key_length} -lt 4096 ]; then
echo "Key size of key ${keyfile} not equal to 4096. Not adding it to key database." >&2
continue
fi
fi
printf "command=\"/usr/sbin/foodoor ${action}\",no-port-forwarding,no-X11-forwarding,no-agent-forwarding " >> ${outfile}
cat "${keyfile}" >> ${outfile}
echo >> ${outfile}
done
install -d -o ${action} -g nogroup -m 0700 /var/lib/foodoor/${action}/.ssh
install -b -S .last -o ${action} -g nogroup -m 0600 ${outfile} /var/lib/foodoor/${action}/.ssh/authorized_keys
done

140
foodoord Executable file
View File

@ -0,0 +1,140 @@
#!/usr/bin/env python2
import os
import stat
import time
import pifacedigitalio
import urllib2
import signal
import sys
import grp
from ConfigParser import SafeConfigParser
#Read config
parser = SafeConfigParser()
parser.read('/etc/foodoord.conf')
url = parser.get('door_firstlevel', 'status_url')
old_api = parser.get('door_firstlevel_old', 'status_url')
#Definitions for output
LED_RED=6
LED_GREEN=7
RELAYS_LOCK=0
RELAYS_UNLOCK=1
#Definitions for input
DOOR_BELL=0
REED_RELAYS=1 #not implementet yet
#Definitions for LEDcolor
RED=1
GREEN=2
ORANGE=3
if __name__ == "__main__":
def doorbell(event):
if (STATUS):
pifacedigital.relays[RELAYS_UNLOCK].toggle()
time.sleep(2)
pifacedigital.relays[RELAYS_UNLOCK].toggle()
#print 'got doorbell'
def close_button(event):
global STATUS
STATUS = False
try:
urllib2.urlopen(url+'&door=aerie&locked=1', timeout=2)
urllib2.urlopen(old_api+'&status=closed', timeout=2)
except:
pass
set_led(RED)
listener = pifacedigitalio.InputEventListener()
listener.register(0, pifacedigitalio.IODIR_RISING_EDGE, doorbell, settle_time=10)
listener.register(1, pifacedigitalio.IODIR_RISING_EDGE, close_button, settle_time=5)
listener.activate()
def signal_handler(signal, frame):
listener.deactivate()
os.remove("/var/run/foodoord.pipe")
try:
urllib2.urlopen(url+'&door=aerie&locked=1', timeout=2)
urllib2.urlopen(old_api+'&status=closed', timeout=2)
except:
pass
set_led(RED)
sys.exit(0)
def set_led(color):
if (color==RED):
pifacedigital.leds[LED_RED].turn_on()
pifacedigital.leds[LED_GREEN].turn_off()
elif (color==GREEN):
pifacedigital.leds[LED_GREEN].turn_on()
pifacedigital.leds[LED_RED].turn_off()
elif (color==ORANGE):
pifacedigital.leds[LED_RED].turn_on()
pifacedigital.leds[LED_GREEN].turn_on()
pifacedigital = pifacedigitalio.PiFaceDigital()
signal.signal(signal.SIGTERM, signal_handler)
#Startsettings
STATUS = False
pifacedigital.leds[LED_RED].turn_on()
#Setting up FiFo to get sshd-output
try:
os.mkfifo("/var/run/foodoord.pipe")
os.chown("/var/run/foodoord.pipe", -1, grp.getgrnam('foodoor')[2])
os.chmod("/var/run/foodoord.pipe", stat.S_IRUSR | stat.S_IWUSR | stat.S_IRGRP | stat.S_IWGRP)
except OSError:
pass
with open("/var/run/foodoord.pipe", "r") as ssh_input:
while 1:
#Read sshd-output from pipe
Pipe = ssh_input.readline()[:-1]
if (Pipe == "close" and STATUS):
pifacedigital.relays[RELAYS_LOCK].toggle()
time.sleep(1)
pifacedigital.relays[RELAYS_LOCK].toggle()
STATUS = False
try:
urllib2.urlopen(url+'&door=aerie&locked=1', timeout=2)
urllib2.urlopen(old_api+'&status=closed', timeout=2)
except:
pass
set_led(RED)
elif (Pipe == "open"):
pifacedigital.relays[RELAYS_UNLOCK].toggle()
time.sleep(2)
pifacedigital.relays[RELAYS_UNLOCK].toggle()
if (STATUS==False):
try:
urllib2.urlopen(url+'&door=aerie&locked=0', timeout=2)
urllib2.urlopen(old_api+'&status=open', timeout=2)
except:
pass
STATUS = True
set_led(GREEN)
time.sleep(0.1)

5
foodoord.conf Normal file
View File

@ -0,0 +1,5 @@
[door_firstlevel_old]
status_url =
[door_firstlevel]
status_url =

3
debian/etc/init.d/foodoord → foodoord_initd Executable file → Normal file
View File

@ -16,8 +16,7 @@
# PATH should only include /usr/* if it runs after the mountnfs.sh script
PATH=/sbin:/usr/sbin:/bin:/usr/bin
DESC="foodoor daemon"
WHERE=$(cat /etc/foodoord.conf | grep 'where' | awk -F '=' '{ print $2 }' | tr -d ' ')
NAME=foodoord_${WHERE}
NAME=foodoord
DAEMON=/usr/sbin/$NAME
#DAEMON_ARGS="--options args"
PIDFILE=/var/run/$NAME.pid