lama-lab

Category: Raspberry Pi

About Raspberry Pi

  • Setup FTP server

    Setup FTP server to transfer files from local Desktop PC to Raspberry Pi server.

    Install vsFTPd

    Install ftp server. I choosed vsFTPd. This is included in official repository of Manjaro Linux, and very easy to use.

    $ sudo pacman -S vsftpd

    Configure vsFTPd

    Edit the file /etc/vsftpd.conf

    $ sudo vi /etc/vsftpd.conf
    local_enable=YES
write_enable=YES

chroot_local_user=YES
chroot_list_enable=YES
chroot_list_file=/etc/vsftpd.chroot_list

seccomp_sandbox=NO
allow_writeable_chroot=YES

    Edit /etc/vsftpd.chroot_list

    Add the user’s name to allow to change root in this file.

    Start and Enable FTP server

    $ sudo systemctl start vsftpd
$ sudo systemctl enable vsftpd

    Check the FTP server

    $ ftp user@192.168.10.109

    Notice: To logout from the server, type “quit”.

  • SSH security issues

    SSH communication has some security issues. To avoid them, you shoud do following two things.

    Key Authentication

    SSH login with password authentication is vulnerable to external attacks. So you should use key authentication to login with ssh to your server.

    Generate a keyfile(on local PC)

    To generate a keyfile, you can use “ssh-keygen” command on your local PC.

    $ ssh-keygen -t rsa -b 4096

    Copy the keyfile to the server

    Copy the keyfile to your Raspberry Pi server by “ssh-copy-id” command.

    $ ssh-copy-id -i ~/.ssh/id_rsa.pub user@192.168.10.109

    Notice: The user name and IP address should be replaced by your user name and servers IP address.

    Login with key authentication

    To login with key authentication, use “-i” option to ssh command.

    $ ssh user@192.168.10.109 -i ~/.ssh/id_rsa

    Disable password authentication

    If you can login the server with key authentication, you should disable password authentication. Edit /etc/ssh/sshd_config file.(NOT ssh_config file.)

    $ sudo vi /etc/ssh/sshd_config

    In this file, edit the following line, “yes” to “no”.

    PasswordAuthentication no

    Restart sshd service

    $ sudo systemctl restart sshd

    Login

    $ ssh user@192.168.10.109 -i ~/.ssh/id_rsa

    Change SSH port number

    Original ssh port number is fixed to 22 and this is widely known. So this should be a security risk. So you should change the port number of SSH connections.

    Configure firewall

    Now I changed SSH port number 22 to 80022.

    $ sudo ufw allow 80022
$ sudo ufw reload

    Configure SSH service

    Edit /etc/ssh/sshd_config file.(NOT ssh_config file.)

    $ vi /etc/ssh/sshd_config

    Edit the following line, “22” to “80022”

    Port 80022

    Restart sshd service

    $ sudo systemctl restart sshd

    Login

    To login with another port number, use “-p” option to ssh command. You can use the combination of key authentication and port change, this will make ssh connections so much secure.

    $ ssh user@192.168.10.109 -i ~/.ssh/id_rsa -p 80022

    Close default SSH port

    Now you can close default SSH port(port 22).
    All the rules on UFW are displayed by following command.

    $ sudo ufw status numbered

    Delete rules of Port 22 from UFW. 

    $ sudo ufw delete <<RULE NUMBER OF PORT 22>>
$ sudo ufw reload

    SSH connection config file

    You would be lazy to type like a long ssh command every time to login. There is a short hand to do this.
    On local PC, create a file ~/.ssh/config like following.

    Host raspberrypi
  HostName 192.168.10.109
  User user
  IdentityFile ~/.ssh/id_rsa
  Port 80022

    Now you can connect to the server by the following simple command.

    $ ssh raspberrypi

  • Setup firewall

    Install UFW firewall

    To protect your server from external illegal attack, you shoud setup firewall. 

    $ sudo pacman -S ufw

    Start and enable UFW service

    $ sudo systemctl start ufw
$ sudo systemctl enable ufw

    Allow SSH connections

    $ sudo ufw allow ssh

    Enable UFW firewall

    $ sudo ufw enable

  • The first things to do on Manjaro Linux

    Full System Upgrade

    First, you should do full system upgrade for security issue.

    $ sudo pacman -Syyu

    Install vi text editor

    Install vi text editor.

    $ sudo pacman -S vi

    Install development tools

    Install development tools to use AUR Helper.

    $ sudo pacman -S base-devel

    Install yay AUR Helper

    Install yay AUR Helper to access AUR repository.

    $ sudo pacman -S yay

    Note: How to uninstall packages

    To uninstall packages from Manjaro Linux, use “-R” option to pacman command.
    For example, to uninstall vi

    $ sudo pacman -R vi

    To delete the backup configuration files at the same time, use “-Rn” option like this.

    $ sudo pacman -Rn vi

  • Install Manjaro Linux on Raspeberry Pi

    Install Raspberry Pi Imager on Manjaro Linux Desktop

    To install an OS on Raspberry Pi, you can use Raspberry Pi Imager.
    First, you should install Raspberry Pi Imager on your Desktop PC. If you are using Manjaro Linux, you can install the Imager from AUR by yay command.

    $ yay -S rpi-imager

    Write the Image on SD card

    To write Manjaro Linux for Raspberry Pi image on SD card, insert SD card into your desktop PC and type the next command on your desktop PC.

    $ sudo rpi-imager

    First, choose the Operating System to install. I choosed Manjaro ARM minimal.

    CHOOSOS -> Other general purpose Operating System 
->Manjaro ARM Linux -> Manjaro ARM minimal

    Next, choose Strage to write.

    CHOOSE STRAGE -> SD Card

    Then write the image on the SD card.

    WRITE

    Write to finish to write the image for a while.

    Install Manjaro Linux to Rasperry Pi

    1. Insert SD card into the Raspberry Pi.
    2. Connect a display, keyboard and LAN cable to Raspberry Pi.
    3. Switch on Raspberry Pi.
    4. Answer the all installer’s questions. (keymap, local, timezone etc)

    The first login

    Login on Raspberry Pi with your user name and password.

  • Nextcloud Memory cache

    Configure memory cache for Nextcloud

    $ sudo vi /var/www/nextcloud/config/config.php
    ...
'memcache.local' => '\\OC\\Memcache\\APCu',
'memcache.distributed' => '\\OC\\Memcache\\Redis',
'memcache.locking' => '\\OC\\Memcache\\Redis',
'redis' =>
  array (
    'host' => '/var/run/redis/redis-server.sock',
    'host' => 0,
    'timeout' => 0.0,
  ),
...

  • HTTP/2

    Stop apache2

    $ sudo systemctl stop apache2
$ sudo systemctl stop php7.4-fpm

    Configure modules

    $ sudo a2enmod proxy_fcgi
$ sudo a2enconf php7.4-fpm
$ sudo a2dismod php7.4
$ sudo a2dismod mpm_prefork
$ sudo a2enmod mpm_event
$ sudo a2enmod http2

    Restart Apache2

    $ sudo systemctl restart apache2
$ sudo systemctl restart php7.4-fpm

  • Virtual Host

    Create a host file

    $ sudo vi /etc/apache2/sites-available/www.example.com.conf
    <VirtualHost *:80>
  ServerName www.example.com
  SereverAdmin webmaster@example.com
  DocumentRoot /var/www/example
  ErrorLog /var/log/apache2/www.example.com.error.log
  CustomLog /var/log/apache2/www.example.com.custom.log combined
  <Directory /var/www/example>
    AllowOverride All
    Require all granted
  </Directory>
  Protocols h2 h2c http://1.1
</VirtualHost>

    Enable configuration

    $ sudo a2ensite /etc/apache2/sites-available/www.example.com.conf

    Restart Apache2

    $ sudo systemctl restart apache2

  • Create a database for Nextcloud

    Create a database

    $ sudo mariadb -u root -p
    > CRATE DATABASE nextclouddb DEFAULT CHARACTER SET utf8mb4 COLLATE utf8mb4_general_ui;
    > CREATE USER 'nextclouduser'@'localhost' IDENTIFIED BY 'xxxxxxxx';
    > GRANT ALL PRIVILLEGES ON nextclouddb.* TO 'nextclouduser'@'localhost';
    > FLUSH PRIVILEGES;
    > EXIT;

    Here is the example settings

    • Database Name : nextclouddb
    • User Name : nextclouduser
    • Password : xxxxxxxx

  • Install Nextcloud

    Download Nextcloud

    $ cd ~/Downloads
$ wget https://download.nextcloud.com/server/releases/nextcloud-21.0.0.tar.bz2

    Extract Nextcloud

    $ sudo tar xvjf nextcloud-21.0.0.tar.bz2 -C /var/www

    Configure Apache2

    $ sudo a2enmod rewrite
$ sudo a2enmod headers
$ sudo a2enmod dir
$ sudo a2enmod env
$ sudo a2enmod mime

    Setup nextcloud.conf

    nextcloud.conf file would be like below.

    Alias /nextcloud "/var/www/nextcloud/"

<Directory /var/www/nextcloud/>
  Require all granted
  AllowOverride All
  Options FollowSymLinks MultiViews

  <IfModule mod_dav.c>
    Dav off
  </IfModule>
</Directory>
    $ sudo cp nextloud.conf /etc/apache2/sites-available
$ sudo a2ensite nextcloud.conf
$ sudo systemctl reload apache2