search

teusink / Home-Security-by-Pi

Description on how I configured the installation and Security of Raspberry Pi and how I keep it fit for use and purpose.
MIT License
40 stars 11 forks source link

Documentation Improvements #33

Closed thexmanxyz closed 5 years ago

thexmanxyz commented 6 years ago

Hey there,

first of all I have to thank you for your great documentation. Even thought I set up my PI in a similar setup before you created the Githup repo, there were still a lot of interesting and helpful things in your repo and docs which also were very useful for me. Especially the cron, ssmtp and maintance steps.

However I noticed a few things which do not work, are not up to date anymore or need some sort of rework.

2-Configuration:

3-Hardening:

PS.: This is just a draft I will change that one if I have read everything. I already forked the repo and will prepare a PR so you don't have to worry on modifications right now.

teusink commented 6 years ago

Wauw, very nice comment and suggestions! Really appreciated! I will dive in it asap. Staying up-to-date is key in guides like these, so thanks for pointing out already out-dated stuff :).

Edit: Oh, and I'll also wait for the PR before editing it. Again, thanks!

teusink commented 6 years ago

URL: https://www.malwaredomainlist.com/hostslist/hosts.txt --> Needs to be: http://www.malwaredomainlist.com/hostslist/hosts.txt

It's not https...

teusink commented 6 years ago

interface=tun0 --> gone from my setup too, by an update... 💃 So, can indeed by deleted from manual.

teusink commented 6 years ago

/etc/dnsmasq.d/02-addint.conf --> I should have documented the why, so that is a general improvement. Especially when I do not really remember anymore why... I'll look it up.

Could it be to make sure that Pihole is also used when connecting through VPN?

thexmanxyz commented 6 years ago

@teusink Strange I tried also the non-secure version but now it seems to work. Because I directly copied the link to the Pi-hole backend and it didn't resolve (like in browser).

teusink commented 6 years ago

@thexmanxyz Yeah, I had the same experience. If its keep acting strange, I'll remove it :). I really think it worked before through https

thexmanxyz commented 6 years ago

@teusink concerning the /etc/dnsmasq.d/02-addint.conf it was/is for the tun0 and the DNS resolve through the VPN tunnel. However this isn't necessary anymore I have no interface= line in my dnsmasq configs and it resolves and pi holes everything as without the interface line. It seems like pihole now detects multiple interfaces.

teusink commented 6 years ago

E-mail capabilities --> Didn't know about the deprecation. Then indeed it should be avoided. The suggested sudos crontabs are nice. Didn't know it could be that easy. Best indeed to do that.

'But', I do not seem to get emails from cron on the pi-user. Hence I implemented the email. Something I need to look over? I added a MAILTO to the cron of root. Let's wait and see what happens :).

teusink commented 6 years ago

@thexmanxyz Ok, then deletion can be done. Less is more!

thexmanxyz commented 6 years ago

@teusink Yes but please try it before you change it because we have two different configurations...it might still be necessary, maybe I have something else configured which fixes the tun0 for me. It's already months since I set up my DNS :D so I can't 100% say if there is something else involved but I'm pretty sure it isn't necessary.

teusink commented 6 years ago

@thexmanxyz I tried removing file /etc/dnsmasq.d/02-addint.conf, but it killed my dns-resolving through VPN. IP connections still work though!

thexmanxyz commented 6 years ago

@teusink Ok so there might be something else involved because if I add the 02-addint.conf it kills my whole DNS resolving even without the VPN. Will check my configuration again and see why.

teusink commented 6 years ago

@thexmanxyz Agree with /etc/ssmtp/ssmtp.conf Should it suffice to mention: "hey, there is a plaintext pw here, make sure you do not use it elsewhere and chmod it to 0640"?

sudo chmod 0640 ssmtp.conf Doesn't change it. It remains at 683 When opening file with pi (nano) then I see nothing, with root (sudo nano) then I do see the content.

thexmanxyz commented 6 years ago

@teusink Yes concerning ssmtp.conf something like that. But give a bit time and I will carefully update the chapters and create the PR. I will also take a look on the chmod. But I have used something like this dpkg-statoverride --update --add root mail 0640 /etc/ssmtp/ssmtp.conf taken from this debian docs

Ad: that's german sorry...this keeps the permission also after update.

thexmanxyz commented 6 years ago

@teusink 683 is not a valid permission if I'm not totally wrong. If you can't open without sudo it's ok but you can easily check the permissions of the SSMTP config files within the folder with stat -c "%a %n" * to quickly verify what there octal permissions are.

teusink commented 6 years ago

Please keep me posted on further findings! And please say when ready, I'll merge the suggestions. Thanks!

teusink commented 6 years ago

@thexmanxyz With stat -c "%a %n" * it says 640, so I think it defaults already. Nonetheless, this should be included as a note/step in te guide for security purpose due to the plaintext password.

thexmanxyz commented 6 years ago

@teusink Again on the 02-addint.conf I think I know now why I do not need interface=eth0 to define and why this would cause issues if I do so. Maybe you can verify that in your PiVPN configuration. This is something we can also state in the docs.

sudo nano /etc/openvpn/server.conf and check for the following lines

# Set your primary domain name server address for clients
push "dhcp-option DNS xxx.xxx.xxx.xxx" #IP_OF_PIHOLE
push "dhcp-option DNS 8.8.8.8"

I'm pretty sure you do not have the Pi-hole IP defined in the PiVPN configuration file or did not during installation. I did and therefore my requests are automatically pi-holed and yours require an additional dnsmasq config entry. I will verify that and change my settings later to proof that this is the reason for the difference. If you want you can also try to remove 02-addint.conf and add a second DNS config entry to the VPN config and try if it now works without the 02-addint.conf .

thexmanxyz commented 6 years ago

@teusink I keep posting here with more Information I hope this is okay. I know it's already a lot of text. But seems to me to be right to continue because I found out more things which would be really great within the documentation. But more on that later. I already tested a lot of things with all the involved files for DNS, VPN and their settings (which are quite a few) but I'm not completely done. The involved files and option are:

We have to clearly include this information and state what combination should be used because multiple of them work and each tutorial I read included other settings. And I read already four of them :D. I have to better investigate about the exact behaviour of the attributes because I want to know myself.

Additionally I found out that the /etc/resolv.conf MUST be set correctly do empower Pi-hole with the functionality to resolve FQDN of local hosts within the backend (instead of the ip) and on the PI itself. Especially in case of a mixed network consisting of Windows and Linux machines. I will also include information on this topic.

But there is another thing concerning FQDN resolving which I have not found a solution yet and which may also be handled if possible. If a client connects via VPN the resolving should still be possible over the hostname. IDK if this is even achievable but I will find out.

Also I have noticed an issue on my backend, requests are counted twice by Pi-hole if my client is tunneled. Once for the VPN IP and once for the internal IP. But only if the client connects internally to the VPN. IDK if this is just a logging issue or if the DNS request is sent twice. This might be performance relevant.

I wanted to lay my findings down because I have a couple of days no time to finish testing and refine eveything. But now you also have the possibility to test and check yourself if you want. Otherwise I will come back as soon as I have time to finish :). But I think this is already helpful.

teusink commented 6 years ago

Thanks! I will look into it as soon as I can. Let's use this issue indeed to keep all info together.

teusink commented 6 years ago

@thexmanxyz In regard to:

Let's aim for consistency here indeed. Mentioning multiple ways is also really good, it helps prevent over-configuration which might send you in the dark with future issues.

What are your thoughts on this?

teusink commented 6 years ago

Added label help wanted, because you are helping :) 👍

thexmanxyz commented 6 years ago

@teusink Thanks for your efforts in listing all your settings this is great so I can better verify your it on my PI.

I will revert all my setting to yours as soon as I have the missing ones and a bit more time. Then I will check what the results are and what is truely missing / still not working. Because as you see there are a lot of settings and I'm still figuring out what are the side effects of the different settings because not all work together and it can be easily messed up. But we will get a clear view as soon as I go on with my testings. Thanks again for your efforts. I already made another list of things which I noticed through improving my install but not too much at once.

teusink commented 6 years ago

@thexmanxyz No problemo :).

Please keep me posted. I'll keep doing my best to check everything you need me to check! 👍

And thank you too!

teusink commented 6 years ago

@thexmanxyz In addition, since changing the permissions (so it seems) of ssmtp.conf, I get this error: Mar 3 02:12:08 hostname cron[297]: sendmail: Cannot open mailhub:25.

I have added a MAILTO=email@address.com using sudo crontab -u root -e to the crontab of root.

I still receive all my own configured mailing, but this error is new in my Logwatch :)

teusink commented 6 years ago

@thexmanxyz If there is anything I can do, please let me know! In the meantime, happy Pi-ing!

thexmanxyz commented 6 years ago

@teusink I think I have everything I need. With hostnames I mean the DN or FQDN of the hosts located in the internal network. So yes exactly e.g. my.computer.domain.

I will also check the interface listening behavior that might also be a factor concerning the issue of the DNS resolving without 02-addint.conf. I'm pretty sure it has an impact.

Concerning the hostname resolving through VPN e.g. router.my.domain. Can you please recheck what you wrote because under that bullet you describe two times two differnt resolving behaviour for internal and external. Just that I can be sure what is the behaviour you see you probably just confused the word not. When you reread you will see what I mean :). You can just correct the post so that I can reconstruct when I compare with my behaviour.

I will rerun the dpkg-statoverride on my pi and see if i get the same error message afterwards. But you should be able to reproduce the error Cannot open mailhub when directly calling mail or ssmpt via terminal. I have also set the cron this way and also for root and do not get this error in Logwatch. However it can be the dpkg-statoverride you can try it again with -remove parameter and then check/correct the permissions, group and ownership afterwards.

I haven't had the time to test further but I will. A bit of patience please, because I take my time to finally finish it :). But still need a few days.

teusink commented 6 years ago

Thanks! Let me retry the resolving part XD

So:

teusink commented 6 years ago

In regard to email.

Seems indeed issues now with sending as the Pi user, due to chmod settings of ssmtp.conf

teusink commented 6 years ago

I made some small changes in the guide in regard to ssmtp and crontab. Nothing fancy, but just so you know!

thexmanxyz commented 6 years ago

@teusink Thanks for info :)

teusink commented 5 years ago

More than 6 months have passed since first report, and more than 5 months have passed since latest comment. For now issue is closed. Of course most suggestion already given are taken in to this guide.

thexmanxyz commented 5 years ago

@teusink Sorry for the late feedback but I didn't even find the time to update my pi-hole in the last months and also didn't get onto it to do a full reconfiguration which I had planed and haven't done until now. The close is just fine, I keep the issue saved and will come back on this. At least to compare the actual state. If there is still something I consider useful I will simply open another issue or just prepare a PR. Sorry for the inconveniences.

teusink commented 5 years ago

@thexmanxyz Really no problem sir, cause your info helped already move this repo forward. Allot have changed since then, so you might want to merge my branch with yours.

Apart from that, feel free to initiate new tickets and thanks again for your time and effort!