GlcoinCore/joininbox
1
0
Fork 0
mirror of https://github.com/openoms/joininbox.git synced 2026-08-14 12:43:13 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions
joininbox/FAQ.md
openoms 073ece7d1f
FAQ: how to add ssh pubkeys
2021-02-11 21:46:02 +00:00

15 KiB
Raw Blame History

Frequently Asked Questions and Notes

SSH through Tor from Linux

On a RaspiBlitz

  • since v1.4 there is a script to create a hidden service on your blitz:
    ./config.scripts/internet.hiddenservice.sh ssh 22 22
  • get the Hidden Service address to connect to with:
    sudo cat /mnt/hdd/tor/ssh/hostname

On the Debian based Linux Desktop (Ubuntu, Debian, MX Linux etc.)

  • needs Tor running on your desktop:
    sudo apt install tor

  • might need to add:
    sudo apt install torsocks

  • edit the Tor config file:
    sudo nano /etc/tor/torrc

  • add:

    # Hidden Service for ssh
HiddenServiceDir /var/lib/tor/ssh
HiddenServiceVersion 3
HiddenServicePort 22 127.0.0.1:22

  • Restart Tor:
    sudo systemctl restart tor

  • get the Hidden Service address to connect to with:
    sudo cat /mnt/hdd/tor/ssh/hostname

Use ssh with torify on the desktop (needs Tor installed):
torify ssh admin@HiddenServiceAddress.onion

Allow Tor to connect to localhost

  • To solve the error when running $ torify python yg-privacyenhanced.py wallet.jmdat

    [INFO]  starting yield generator
[INFO]  Listening on port 27183
[INFO]  Starting transaction monitor in walletservice
1580214062 WARNING torsocks[28563]: [connect] Connection to a local address are     denied since it might be a TCP DNS query to a local DNS server. Rejecting it for    safety reasons. (in tsocks_connect() at connect.c:192)

  • Edit the torsocks.conf and activate the option AllowOutboundLocalhost 1:
    $ sudo nano /etc/tor/torsocks.conf

    # Set Torsocks to allow outbound connections to the loopback interface.
# If set to 1, connect() will be allowed to be used to the loopback interface
# bypassing Tor. If set to 2, in addition to TCP connect(), UDP operations to
# the loopback interface will also be allowed, bypassing Tor. This option
# should not be used by most users. (Default: 0)
AllowOutboundLocalhost 1

  • Restart Tor:
    sudo systemctl restart tor

Set up Armbian on the Hardkernel Odroid XU4

  • Download the SDcard image
    https://dl.armbian.com/odroidxu4/Buster_legacy

  • Verify
    https://docs.armbian.com/User-Guide_Getting-Started/#how-to-check-download-authenticity

    $ gpg --verify Armbian_20.02.0-rc0_Odroidxu4_buster_legacy_4.14.165.img.asc
gpg: assuming signed data in 'Armbian_20.02.0-rc0_Odroidxu4_buster_legacy_4.14.165.img'
gpg: Signature made Mon 20 Jan 2020 05:23:20 GMT
gpg:                using RSA key DF00FAF1C577104B50BF1D0093D6889F9F0E78D5
gpg: Good signature from "Igor Pecovnik <igor@armbian.com>" [unknown]
gpg:                 aka "Igor Pecovnik (Ljubljana, Slovenia) <igor.pecovnik@gmail.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: DF00 FAF1 C577 104B 50BF  1D00 93D6 889F 9F0E 78D5

  • Preparation
    Make sure you have a good & reliable SD card and a proper power supply. Archives can be uncompressed with 7-Zip on Windows, Keka on OS X and 7z on Linux (apt-get install p7zip-full). RAW images can be written with Etcher (all OS).

  • Boot
    Insert the SD card into the slot, connect a cable to your network if possible or a display and power your board. (First) boot (with DHCP) takes up to 35 seconds with a class 10 SD Card.

  • Login
    Log in as: root Password: 1234. Then you are prompted to change this password (US-Keyboard setting). When done, you are asked to create a normal user-account for your everyday tasks.

  • Change the password.

  • Create a new user called joinmarket and set the password.
    Keep pressing [ENTER] to use the default user information.

Download and verify Raspbian SDcard image for a Raspberry Pi

To be able to open the JoinMarket-QT GUI on the dekstop from the RPI need to use the Raspberry Pi OS (32-bit) with desktop inage

Log in through SSH using a hardware wallet

Error when connecting to a full node remotely through Tor

  • Getting the error: 
    socket.gaierror: [Errno -2] Name or service not known
  • Remember to use torify with the python scripts when connecting remotely through Tor. Example:
    torify wallet-tool.py wallet.jmdat

Nuke the joinmarket user and the /home/joinmarket folder

sudo userdel -r joinmarket

Sample bitcoin.conf for a remote node accepting RPC connections through LAN

# bitcoind configuration

# mainnet/testnet
testnet=0

# Bitcoind options
server=1
daemon=1
txindex=1
disablewallet=0

main.wallet=wallet.dat
datadir=/mnt/hdd/bitcoin

# Connection settings
rpcuser=REDACTED
rpcpassword=REDACTED
rpcport=8332
#rpcallowip=127.0.0.1
#main.rpcbind=127.0.0.1:8332
# SET THE LOCAL SUBNET
rpcallowip=192.168.1.0/24
main.rpcbind=0.0.0.0
zmqpubrawblock=tcp://127.0.0.1:28332
zmqpubrawtx=tcp://127.0.0.1:28333

# SBC optimizations
dbcache=1512
maxorphantx=10
maxmempool=300
maxconnections=40
maxuploadtarget=5000

# Tor
onlynet=onion
proxy=127.0.0.1:9050
main.bind=127.0.0.1
test.bind=127.0.0.1
main.addnode=fno4aakpl6sg6y47.onion
main.addnode=toguvy5upyuctudx.onion
main.addnode=ndndword5lpb7eex.onion
main.addnode=6m2iqgnqjxh7ulyk.onion
main.addnode=5tuxetn7tar3q5kp.onion
dnsseed=0
dns=0

# for Bisq
peerbloomfilters=1

Using the 2.13" WaveShare e-ink display

https://www.waveshare.com/wiki/2.13inch_e-Paper_HAT https://www.raspberrypi.org/documentation/hardware/raspberrypi/spi/README.md SPI0 is disabled by default. To enable it, use raspi-config, or ensure the line dtparam=spi=on isn't commented out in /boot/config.txt

#Install BCM2835 libraries
wget http://www.airspayce.com/mikem/bcm2835/bcm2835-1.60.tar.gz
tar zxvf bcm2835-1.60.tar.gz 
cd bcm2835-1.60/
sudo ./configure
sudo make
sudo make check
sudo make install
#For more details, please refer to http://www.airspayce.com/mikem/bcm2835/

#Install wiringPi libraries

sudo apt-get install wiringpi

#For Pi 4, you need to update it：
cd /tmp
wget https://project-downloads.drogon.net/wiringpi-latest.deb
sudo dpkg -i wiringpi-latest.deb
gpio -v
#You will get 2.52 information if you install it correctly

#Install Python libraries
#python3
sudo apt-get update
sudo apt-get install python3-pip
sudo apt-get install python3-pil
sudo apt-get install python3-numpy
sudo pip3 install RPi.GPIO
sudo pip3 install spidev

Test:

sudo git clone https://github.com/waveshare/e-Paper
cd e-Paper/RaspberryPi\&JetsonNano/python/examples
sudo python epd_2in13_V2_test.py

Code examples:
https://github.com/waveshare/e-Paper/blob/master/RaspberryPi%26JetsonNano/python/examples/epd_2in13_V2_test.py https://github.com/21isenough/LightningATM/blob/master/displays/waveshare2in13.py

Compile Tor for the RPi Zero (armv6l)

https://2019.www.torproject.org/docs/debian#source

Build the SDcard image

Boot Ubuntu Live from USB: https://releases.ubuntu.com/focal/ubuntu-20.04.2-desktop-amd64.iso

  • Connect to a secure WiFi (hardware switch on) or LAN

Download,verify and flash the base image to the SDcard

  • Image: https://raspi.debian.net/verified/20201112_raspi_4.img.xz

  • Signature: https://raspi.debian.net/verified/20201112_raspi_4.xz.sha256.asc

    gpg --receive-key E2F63B4353F45989
gpg --verify 20201112_raspi_4.xz.sha256.asc
    gpg: Signature made Thu 12 Nov 2020 17:40:03 GMT
    gpg:                using EDDSA key 60B3093D96108E5CB97142EFE2F63B4353F45989
    gpg: Good signature from "Gunnar Wolf <gwolf@gwolf.org>" [unknown]
    gpg:                 aka "Gunnar Eyal Wolf Iszaevich <gwolf@iiec.unam.mx>" [unknown]
    gpg:                 aka "Gunnar Wolf <gwolf@debian.org>" [unknown]
    gpg: Note: This key has expired!
    Primary key fingerprint: 4D14 0506 53A4 02D7 3687  049D 2404 C954 6E14 5360
        Subkey fingerprint: 60B3 093D 9610 8E5C B971  42EF E2F6 3B43 53F4 5989
    gpg: WARNING: not a detached signature; file '20201112_raspi_4.xz.sha256' was NOT verified!
cat 20201112_raspi_4.xz.sha256.asc
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA256

    56d6e5c674fb89be07ed160807d0b166cc3713d8c32c47ff61fbc94f39452373  20201112_raspi_4.img.xz
    -----BEGIN PGP SIGNATURE-----

    iHUEARYIAB0WIQRgswk9lhCOXLlxQu/i9jtDU/RZiQUCX61zcwAKCRDi9jtDU/RZ
    ieP+AQCpUvxsiswIpHTRzxw1/3QlfI4wxgL8BVMixwp/37xBOQD/eDzqxyRVhkjX
    ywV0nAAEMJestu2TQHAufqPBfwCrxQY=
    =s/jY
    -----END PGP SIGNATURE-----
sha256sum 20201112_raspi_4.img.xz 
    56d6e5c674fb89be07ed160807d0b166cc3713d8c32c47ff61fbc94f39452373  20201112_raspi_4.img.xz

  • Connect SD card reader with a 8GB SD card

  • In the file manager open context on the .img.xz file, select Open With Disk Image Writer and write the image to the SDcard.

Prepare the base image

  • Before the first boot edit the sysconf.txt on the RASPIFIRM partition to be able to ssh remotely - needs an authorized ssh pubkey.

  • Generate ssk keys on Ubuntu with:

    ssh-keygen -t rsa -b 4096

  • Copy the ssh pubkey from the Ubuntu image to the sysconf.txt the RASPIFIRM directory:

    echo "root_authorized_key=$(cat ~/.ssh/id_rsa.pub)" | tee -a /home/ubuntu/RASPIFIRM/sysconf.txt

    The sysconf.txt will reset after boot and moves the ssh pubkey to /root/.ssh/authorized_keys

  • Boot the RPi and connect with ssh (use the hostname, arp -a or check router))

    ssh root@rpi4-20201112

  • apt update, upgrade and reboot

    apt update
apt upgrade
reboot

  • log in again and install basic dependencies

    ssh root@rpi4-20201112
apt install sudo wget

Install Joininbox

  • Download and run the build script 
    # download
wget https://raw.githubusercontent.com/openoms/joininbox/master/build_joininbox.sh
# inspect the script
cat build_joininbox.sh
# run
sudo bash build_joininbox.sh
  • Monitor/Check outputs for warnings/errors - install LCD

Prepare the SDcard release

  • Make the SDcard image safe to share by removing unique infos like ssh pubkeys and network identifiers: 
    /home/joinmarket/prepare.release.sh
  • Disconnect WiFi/LAN on build laptop (hardware switch off) and shutdown
  • Remove Ubuntu LIVE USB stick and cut power from the RaspberryPi

Sign the image

  • Connect USB stick with latest TailsOS (make it stay offline)
  • Power on the Build Laptop (press F12 for boot menu)
  • Connect USB stick with GPG signing keys - decrypt drive if needed
  • Open Terminal and cd into directory of USB Stick under /media/amnesia
  • Run gpg --import ./sub.key, check and exit
  • Disconnect USB stick with GPG keys
  • Take the SD card from the RaspberryPi and connect with an external SD card reader to the laptop
  • Click on boot volume once in the file manger
  • Connect the NTFS USB stick, open in file manager and delete old files
  • Open Terminal and cd into directory of NTFS USB stick under /media/amnesia
  • Run df to check on the SD card device name (boot - ignore last partition number)
  • dd if=/dev/[sdcarddevice] | gzip > ./raspiblitz-vX.X-YEAR-MONTH-DAY.img.gz
  • When finished you should see that more then 7GB were copied
  • Then run shasum -a 256 *.gz > sha256.txt
  • Sign with gpg --output raspiblitz-vX.X-YEAR-MONTH-DAY.img.gz.sig --detach-sign *.gz
  • Shutdown build computer
  • Connect the NTFS USB stick to MacOS (it is just read-only)
  • Run tests on the new image
  • Upload the new image to the Download Server - put sig-file next to it
  • Copy SHA256-String into GitHub README and update the download link