Reading time: < 1 minute
This is another short entry, in this case for recommending a service which we solve typical problem solved using a DNAT. Once we have a service on our laptop, or on a private server and we have to expose that service on the internet for some time or permanently usually we have to go the firewall, or router and create a NAT rule forwarding a port. This is a simple and powerful service which is going to solve that for you.
There is a free account for understanding and testing the service, other plans are available and especially affordable for professional requirements.
Yesterday I found a tool called Cryptomator, this is a client-side encryption for your files. You can use it with Dropbox, or any other cloud filesystem or you can use it in your local filesystem. Anyway, this open-source piece of software is really simple to install and is compatible with Windows, Mac and Linux. Once this is installed, using the UI the only thing we have to do is create, or select, a folder where the secure vault is going to be created. It uses a symmetric password for cyphering and when the vault is unlocked a new removable drive appear in your system. So, at the end, the vault is like a pendrive and there is no complexity on add, rename, remove, create folders, etc. inside the new drive. Once the vault is locked, the removable drive is unmounted and if you go to the location where the vault is created a tree structure with cyphered files is the only thing that you can see. Cryptomator works cyphering each file, not the complete vault as a package.
So far I installed the tool on my Windows computer for securing some sensitive files that I have on my laptop. But if it works like I expect I’m going to extend the usage with the rest of my computers. As I said it’s not required any cloud filesystem, by the way, I use Cryptomator in conjunction with Resilio Sync.
This is going to be a very short post entry, I just want to refer a very interesting mail relay (smart host) which define itself like:
Email delivery services built for developers, by developers
Combined with your language of choice, using the power of our robust cloud API couldn’t be easier.
Open a SparkPost account today and send up to 100.000 emails per month for free. The best is you can do using SMTP or using a REST API; really nice easy to use an powerful control dashboard simplify externally keys management, statistics, templates for mailings, and many more features.
Personally I love the service because is extremely useful to be configured on SSMTP service of Linux as a default relay host, for personal and professional use. Another use could be to check end-to-end mail services.
Personally I love the service, and if you want to send really big mailings theirs costs are very competitive.
Some weeks ago I finished this course from MIT. My ideas was have an overview of the IoT market from an external point of view. In the end I’m a little bit disappointment because the course was more focused on talking about general ideas with a lot of references of internal projects about IoT on universities, mainly MIT as you can imagine. I don’t know how those it work in The States where the companies are by far bigger than in Europe, but in my humble experience it’s very difficult to approach to a company talking about experimental technologies, or whatever which is not properly supported by another company. This is the language of business that I experimented in my professional career.
A part from that I want to remark that technical contents are presented by very important people in different areas of technology. But when it was time to talk about technical details the things changed a lot depending on the teacher, some teachers where lost on completely usefulness details of a completely unknown technology and others don’t go deep enough on basic specs of basic technologies.
Sadly the block where I want to contrast my point of view with others, the Architecture, was focused on completely different approach that I expected. I didn’t find any reference from architecture reference models (ARMs) of the IoT platforms, for example. Minor references to important transport protocols like CoAP, or MQTT. Both of them important standards from IETF and OASIS/ISO, respectively.
Another disappointing part is the security chapter, most of the content is focused on securing hardware to the most deep and complex parts. And practically no information referring to Internet security, or data transportation. Nothing about certificates, blockchains, or whatever other solution to improve most of the security problems in real IoT today. May be hardware security is important for some companies but usually this is not the most concerning part from most of companies today.
Sorry but from my humble opinion, the course is not well-focused and if I have to be honest with you I felt sleepy more than once when I watched some videos. A part from that, the assessments at the end of chapters are a waste of time because they try to check if you followed the explanations with simple question that you can answer looking video transcriptions. Only forums and course mates are good points, but old fashion user interface of the learning platform don’t allow you to enjoy the conversation threads.
After more than 16 years writing blog entries in my site I’ve never did so bad review of anything but I have to be honest with my feelings with the course, and I want to call for apologies to all the people who spent a lot of energy preparing materials for the course.
Luckly the cost of the course is only $495, but nobody likes to spent that amount of money for not being satisfied. Before closing the post, just a link to the course: Internet of Things: Roadmap to a Connected World.
I love “ssh -R” reverse SSH is really useful when you have to get access to a Linux machine behind a NAT or firewall. One of the most powerful scenarios to get that running is use a third machine with a public IP address. The idea will be run reverse SSH command in target Linux and publish a forward port at the third server, so you only have to connect to a published port in that third server and you’ll get the target Linux thanks to the reverse SSH connection open between them.
A long time ago I talked about that in my podcast “2×04 SSH avançat“.
With this scenario we have a security challenge with the SSH user account on the “third server”, we want a secure user:
without shell and sftp access
secure enough to only allow port forwarding features
access only allowed with authorized keys
I’m not going to give precise Linux instructions on that limited user, but for user you’re not going to have problems to get that:
/etc/passwd(-):
limited-user:x:1001:1001::/home/limited-user:
/etc/shadow(-):
limited-user:!:17037:0:99999:7:::
/etc/ssh/sshd_config:
Match User limited-user GatewayPorts yes ForceCommand echo 'This account can only be used for maintenance purposes'
Of course, you’ll have your own UID, GID and use your own username. And at “/home/limite-user/.ssh/authorized_ssh” you’ll have to pub public key of the clients that want to use the service.
It’s important to have a very clear picture about the scenario that we’re going to configure in that case because it’s a little bit particular. This is an evolution of the previous post: Ubuntu server as wifi AP and Mikrotik as a DHCP server
There is a server running Ubuntu 16.04 and offering wifi service as an AP. The wifi interface is in bridge mode with the ethernet port and send all traffic to the Mikrotik gateway where there is a DHCP server in charge to serve IP address to wifi clients.
Start by configuring the bridge in the Ubuntu server. File “/etc/network/interfaces”:
Pay attention on “bridge_ports” the wifi interface is not added on the list, this is because until the hostapd is running it doesn’t make sense to do that. You’ll see “bridge=br0” option on hostapd.conf which will fix that misbehavior.
Wifi AP configuration, “/etc/default/hostapd”:
DAEMON_CONF="/etc/hostapd/hostapd.conf"
and “/etc/hostapd/hostapd.conf”:
bridge=br0 # bridge interfaceinterface=wlp3s0 # wifi interface namedriver=nl80211ssid=the_ssid_name # name of your networkhw_mode=gchannel=1macaddr_acl=0auth_algs=1ignore_broadcast_ssid=0wpa=3wpa_passphrase=the_secret_key # secret key to joing with the wifi networkwpa_key_mgmt=WPA-PSKwpa_pairwise=TKIPrsn_pairwise=CCMPlogger_syslog=-1logger_syslog_level=3logger_stdout=-1logger_stdout_level=1
DHCP server configuration on Mikrotik:
# setting the interface address, in my case ether4/ip addressadd address=192.168.2.1/24 interface=ether4 network=192.168.2.0# setting up DHCP on interface 4 of the mikrotik device/ip dhcp-serveradd address-pool=dhcp-pool disabled=no interface=ether4 name=dhcp-pool# network of the DHCP server/ip dhcp-server networkadd address=192.168.2.1.0/24 dns-server=8.8.8.8 domain=your_network.local gateway=192.168.2.1 netmask=24# IP pool used by the DHCP server/ip pooladd name=dhcp-pool ranges=192.168.2.65-192.168.2.70
Sometimes TFTP is the only protocol available to exchange files with an embedded system. So, it’s very easy to have that supported in our workstation or any other place to exchange files with those systems.
Set up steps:
apt-get install tftpd-hpa
modify file “/etc/default/tftpd-hpa”:
TFTP_OPTIONS="--secure --create"
–secure: Change root directory on startup. This means the remote host does not need to pass along the directory as part of the transfer, and may add security. When –secure is specified, exactly one directory should be specified on the command line. The use of this option is recommended for security as well as compatibility with some boot ROMs which cannot be easily made to include a directory name in its request.
–create Allow new files to be created. By default, tftpd will only allow upload of files that already exist. Files are created with default permissions allowing anyone to read or write them, unless the –permissive or –umask options are specified.
Needed to allow uploads in that directory:
chown -R tftp /var/lib/tftpboot
Restart and check if the service is running:
service tftpd-hpa restartservice tftpd-hpa statusnetstat -a | grep tftp
At the beginning of August I’ve received a new home server, I decided to stop my old HP ML110 G5 and substitute that by a new silent and low power server also based on Intel technologies in this case it’s al i5 with 8G of RAM and 128GB of SSD for less than 300€ including custom costs I think it’s a very good investment.
I installed Ubuntu 16.04 LTS server, I don’t tried de Win10 pre-installed. I happy to see a very new and powerful BIOS with tons of options. But in this blog entry I want to explain how to set-up the wifi card as a wifi AP. I didn’t have to do anything to configure the card. It worked by default.
Ralink corp. RT3090 Wireless 802.11n 1T/1R PCIe
The first thing is check if the wifi network is compatible with the AP mode.
Next thing is install the “hostapd” which is going to take care to set-up the AP. The configuration file have to be something like that “/etc/hostapd/hostpad.conf
interface=wlan0 # change that with the wifi interface namedriver=nl80211ssid=test # your wifi network namehw_mode=gchannel=1 # look up for a free channelmacaddr_acl=0auth_algs=1ignore_broadcast_ssid=0wpa=3wpa_passphrase=1234567890 # passwor to join the wifi networkwpa_key_mgmt=WPA-PSKwpa_pairwise=TKIPrsn_pairwise=CCMP
Modify “/etc/default/hostapd” and put that:
DAEMON_CONF="/etc/hostapd/hostapd.conf"
Start the hostapd service:
sudo service hostapd start
Now the AP is running but a DHCP service giving IPs it’s need, I used “isc-dhcp-server”. First thing to configure is “/etc/default/isc-dhcp-server” with the wireless network name:
INTERFACES="wlan0"
Next file to be configured is “/etc/dhcp/dhcpd.conf”:
If it’s needed remember to create the proper iptables rules and enable “ip_forward” in /proc filesystem. I’m not going to describe that because in my case it’s not going to be useful.
This is not a specially interesting post entry but useful as a reference, when you have to use a fast and easy cookbook to setup a wifi AP.
Based on my home configuration I’m going to describe how to set up a Mikrotik to manage fail over Internet connection. Next schema describes a Mikrotik gateway with two internet connections (GUIFI and SS). Assuming GUIFI as a default Internet connection periodic checks on Google DNSes (8.8.8.8 and 8.8.4.4) will allow to know when it’s good to change the default route.
If you have some Linux routing background it will be easier to understand the configuration. Main idea is use policy routing tables and mark packets to use one table or other. In my case I have two routing tables GUIFI and SS, and of course, the default gateway of each of those tables is the gateway indicated in the schema.
First step is take care about the routes for hosts to monitor; using GUIFI connection will be checking connectivity to 8.8.8.8 and using SS the monitored host will be 8.8.4.4.
Second step is configure two routing tables, those routes will check Internet hosts availability. Routes are resolved recursively (more info), and will be active only if any host is pingable.
Next step will be create marking rules in the firewall:
# next rule mark all LAN traffic (10.2.0.0/26) before routing# it'll be processed by routing table GUIFI# it makes GUIFI the default Internet connection /ip firewall mangleadd action=mark-routing chain=prerouting comment="All LAN traffic" dst-address=\!10.0.0.0/8 new-routing-mark=GUIFI passthrough=no src-address=10.2.0.0/26
If any specific host, service or whatever want to use specific routing table, then you can create new rules with proper mark to redirect the traffic to that Internet connection. But if that path fails other Internet connection will be used.
In my case I have a more complicated scenario, internal VoIP server uses a IP Telephony service only available through GUIFI connection. The way to force that is forbidding traffic to SS connection. A simple firewall rule will help to do that:
# X.X.X.X = IP address of the IP telephony provider/ip firewall filteradd action=reject chain=forward dst-address=X.X.X.X in-interface=\ bridge-lan out-interface=SS-eth2
Yesterday I found a tool called 
Some weeks ago I finished 
