yubi key + pam

So,

Decided to play around with multifactor authentication setups.

A friend of mine suggested I try out the yubi keys and a central auth system. I went ahead and sprung for the yubi neo which is an nfc-enabled yubi key vs just the standard usb key. Thought it would be more interesting in the future but I really only needed the usb key.

My main interest was to set up stronger auth for my home network. Not because I need it but because I can ;)

Simple requirements:

1. multi factor passwords
2. allow me to use local validation ( say laptop without net access yet )
3. simple to set up/use
4. additionally use for my vpn ( openvpn most likely )

So far I have set up basic authentication on a VM. Simple pam auth using the yubi cloud auth servers. I'm not convinced it set up 100% the way I want it as you can bypass the authentication via ssh if you use ssh key auth. But, that does seem interesting - can have both.

The setup docs on https://github.com/Yubico/yubico-pam/wiki/YubikeyAndSSHViaPAM got me about 90% of the way there. The setup doc is short a few things.

1. You need to get an api key, https://upgrade.yubico.com/getapikey/
2. The response contains the id and an api key pair which you need to configure in your pam config. Here is my pam config
   
   auth required pam_yubico.so id= key="" mode="client" authfile=/etc/yubikey_mappings
3. They tell you to set ChallengeResponseAuthentication to no but you actually want yes

Once I got everything configured, logging in and using sudo all prompt for my yubi password ( your standard password + hit the button on the card ) for access.

$ ssh 172.16.189.140

Yubikey for `bilsch':

Welcome to Ubuntu 12.04.2 LTS (GNU/Linux 3.2.0-23-generic x86_64)

bilsch@yubi:~$ sudo bash -o vi

Yubikey for `bilsch':

root@yubi:~#

Still want to verify this is set up right. I still like the idea of having ssh key auth but for certain special boxes/host types this seems a pretty great setup so far.

sensor monitoring with arduino and raspberry pi

Thought I would change my experiment a little bit. Previously I had grabbed the DHT22 from Adafruit and hooked it up to my raspberry pi. This worked fairly well and with some modifications to their driver code I was getting fairly reasonable stats albeit running in to a minor driver issue ( getting stuck in an unbounded loop )

In the mean time I've been thinking about how I would want to handle my remote temp/humidity sensors project. The main idea so far is to put a sensor in every room and aggregate the data in to graphite ( via collectd ). The cost of the sensor plus the heft of the full linux box for a simple little sensor started bugging me - the sensor side of things is actually better off running on something like an Arduino - its very low power, commonly available and flexible enough to do what I want in the long run. Sadly, for the price/power ( cpu/memory ) the difference in price is kinda off but the platforms really are rather different.

I probably went overkill on the arduino side - picked up an R3 Mega - an Uno or maybe even the Micro may be better suited but I grabbed the Mega as I have other projects in mind for the future and thought I'd get this instead.

Adafruit has another tutorial for the same sensor but on an Arduino including a driver ( and looking at the source, I think their pi version was based off of this code ). Setting it up on the arduino was surprisingly very very easy!

The idea is to read the sensor metrics via serial ( eventually switching to XBee for RF/wireless <=> serial. For now, I'm just using jumper wires from the Mega in to the serial port of the pi ( Serial1 on the Mega )

I found a few interesting things:

1. The Serial.read does not block as I thought it would/should
• Idea was to control the collectd Interval from the exec/c code - can't do that ( at least not yet )
2. Even though I don't do a Serial.setup() trying to write to Serial1 blocks unless I have a usb connection from the hub ( which is powering the Mega ) to some system. Not sure what that is about

The driver code is fairly simple. Basically just a very slightly modified print statement to only print the temp/humidity over the serial port. On the pi I have a little ruby script exec'd by collectd which is in a read loop and ( admittedly rather blindly ) spits out the values:

while 1
  stats = sp.gets.chomp.split()
  if stats.size > 1
    temp_c   = stats[1]
    temp_f   = ( temp_c.to_f * 9 / 5 ) + 32
    humidity = stats[0]

    puts "PUTVAL \"#{hostname}/sensor-basement/gauge-tempc\" interval=10 N:#{temp_c}"
    puts "PUTVAL \"#{hostname}/sensor-basement/gauge-tempf\" interval=10 N:#{temp_f}"
    puts "PUTVAL \"#{hostname}/sensor-basement/gauge-humidity\" interval=10 N:#{humidity}"
end

So fairly simple and like I said, its rather blind but I control the input to some degree and collectd will whine if the data is not normalized

Next step is to see if I can find/assemble the right sized arduino/case and find a way to get a connector for the sensor so I can swap it out ( and not get funky/false readings ) and get some of the XBee chips to play with.

puppet on the pi

Well, a follow-up of sorts on the raspberry pi and puppet posting from a while back

Thought I would post the code up on my github account, https://github.com/bilsch.

Tried rebuilding from a fresh image. Other than burning a lot of cpu time on puppet installation itself ( think I have a fix for this one, don't generate rdoc/ri ) the fresh install to a running pi where I essentially want it. Everything worked fine except for the fimware/boot rom update which is just another git clone/copy.

itunes11 and ebook pdfs

So, Apple in their (in)finite wisdom made a few changes in itunes 11. Among them, something to do with pdf/ebooks and the book library.

It seems you can no longer add purchased ebooks ( at least, not sure how far down this goes ) to your library. The change occurred in the crap-tastic itunes 11.

The best part is the recommended solution: Go download/install the Kindle iOS application and use its doc sync features to sync up the pdfs.

WHAT?!

The other odd part is that the pdf/ebooks ( from the same vendor, Manning ) which were already in my library are fine - still there and still able to read them/sync to iphone/ipad.

Apple, why have your software products taking a nose dive these last few months? Wake up!

I think Apple may be telling us to not only use other people's software but maybe even switch to their hardware?

Raspberry pi puppet

So, I decided I really wanted to have an easy way to get my raspberry pi images to a somewhat sane state but I did not really want to write shell scripts to do this.

I've been using puppet at work for over a year now and its pretty simple really - most of the time I spend on puppet configs is debugging various isms ( like, for an ssh authorized keys manipulation, you can't throw an array to user :-< )

Planning to test out my image process soon-ish. Still need to get mcollective working properly - think its about the last module still erroring out on me.

So far, I have:

1. ssh configuration
2. various package installations
• rasp-config, ruby-shadow, python-pip, ruby-dev
• ruby packages: builder ( for gem installs ), wiringpi
• pip ( python ) package rpi.gpio
3. rsync backup, just a simple backup to my fileserver
4. /boot/config.txt so I can preserve any modifications I may want
5. locales config
6. user maint, putting my ssh key in place, forcing pi's password to be maintained/not raspberry
7. automate git clone of remote repos
   ( So I don't have to remember to do those by hand though updates/pull will be manual )

Only down side is that I'll still need a bootstrap script to put a few packages on the box - puppet/facter gems and puppet.conf, then I should just need to run puppet agent and everything should magically appear

I may upload the puppet configs to github but most of the configurations are going to be local

puppetlabs dist for arm

W: Failed to fetch http://apt.puppetlabs.com/dists/precise/Release  Unable to find expected entry 'main/binary-armhf/Packages' in Release file (Wrong sources.list entry or malformed file)

Bummer! I guess I can't use the puppet dist from puppet labs directly :-< May be worth the time to compile/install manually but for now - meh :->

Raspberry Pi 512m model ram

So this is interesting, by default ( at least with AdaFruit's occidentalis 0.2, http://learn.adafruit.com/adafruit-raspberry-pi-educational-linux-distro/occidentalis-v0-dot-2 ) I was only seeing the first 256m of the ram.

Looking at the documentation http://elinux.org/RPi_config.txt it looks like a simple modification to /boot/config.txt addressed the issue:

gpu_mem_512=8

pi@raspberrypi ~ $ free -m

             total       used       free     shared    buffers     cached
Mem:           486         56        429          0          9         28
-/+ buffers/cache:         18        467
Swap:           99          0         99

It looks like the kernel actually took 16 meg instead of 8 like I wanted but I'll take it :-> I'm logging in only via ssh so I don't see a reason to waste memory on video output.