Tag Archives: Raspberry Pi

Updating NTP Servers

As always when you’re running own services you should update them regularly to have all known bugs fixed and security issues thwarted. Same for NTP servers based on Linux, as in my case running on Raspberry Pis. Especially when you’re actively joining the NTP pool project with your NTP servers you have to update them to the latest version of ntp since you might be misused for well-known DDoS attacks or other security related bugs.

So, what’s this all about? You can simply do an “apt-get upgrade”, don’t you? Well, unluckily the ntp packages within the Linux distributions are not always updated to the latest versions. Hence you need to compile the ntp software by yourself to have the latest release running. Still not that hard, though it requires a bit more attention.

Continue reading Updating NTP Servers

NTP Server via GPS on a Raspberry Pi

This post shows how to use a GPS receiver with a Raspberry Pi to build a stratum 1 NTP server. I am showing how to solder and use the GPS module (especially with its PPS pin) and listing all Linux commands to set up and check the receiver and its NTP part, which is IPv6-only in my case. Some more hints to increase the performance of the server round things off. In summary this is a nice “do it yourself” project with a working stratum 1 NTP server at really low costs. Great. However, keep in mind that you should not rely on such projects in enterprise environments that are more focused on reliability and availability (which is not the case on self soldered modules and many config file edits).

Continue reading NTP Server via GPS on a Raspberry Pi

NTP Server via DCF77 on a Raspberry Pi

In this tutorial I will show how to set up a Raspberry Pi with a DCF77 receiver as an NTP server. Since the external radio clock via DCF77 is a stratum 0 source, the NTP server itself is stratum 1. I am showing how to connect the DCF77 module and I am listing all relevant commands as a step by step guide to install the NTP things. With this tutorial you will be able to operate your own stratum 1 NTP server. Nice DIY project. ;) However, keep in mind that you should only use it on a private playground and not on an enterprise network that should consist of high reliable NTP servers rather than DIY Raspberry Pis. Anyway, let’s go:

Continue reading NTP Server via DCF77 on a Raspberry Pi

Why should I run own NTP Servers?

… since we all can use pool.ntp.org ? Easy answer: Many modern (security) techniques rely on accurate time. Certificate validation, two-factor authentication, backup auto-deletion, logs generation, and many more. Meanwhile we use an unauthenticated protocol (via stateless UDP) from unauthenticated sources (NTP pool) to rely on! Really?

TL;DR: If you want to operate a secure environment you should use your own on-site stratum 1 NTP servers along with authentication. This is the only way to eliminate time spoofing attacks from the outside. Don’t reduce your overall security to a stateless and unauthenticated (read: easy-to-spoof) network protocol!

If you are using couple of different NTP sources it might be not that easy for an attacker to spoof your time – though not unfeasible at all. And think about small routers with VPN endpoints and DNSSEC resolving enabled, or IoT devices such as cameras or door openers – they don’t even have a real-time clock with battery inside. They fully rely on NTP.

This is what this blogpost series is all about. Let’s dig into it. ;)

Continue reading Why should I run own NTP Servers?

True Random PSK Generator on a Raspi

In my previous blogpost I talked about the true random number generator (TRNG) within the Raspberry Pi. Now I am using it for a small online pre-shared key (PSK) generator at https://random.weberlab.de (IPv6-only) that you can use e.g. for site-to-site VPNs. Here are some details how I am reading the binary random data and how I built this small website.

Continue reading True Random PSK Generator on a Raspi

Playing with Randomness

Unpredictable random numbers are mandatory for cryptographic operations in many cases (ref). There are cryptographically secure pseudorandom number generators (CSPRNG) but the usage of a hardware random number generator (TRNG) is something I am especially interested in since many years. While there are many proprietary TRNGs (list) with different prices, I had a look at two cheap solutions: the Raspberry Pi’s hardware random number generator as well as an application that uses a DVB-T/RTL/SDR stick for gathering some noise.

I have tested both of them with various options and ran them against the dieharder test suite. In this post I am listing the CLI commands to get the random data from those source and I am listing the results of the tests.

Continue reading Playing with Randomness

Benchmarking DNS: namebench & dnseval

If you’re running your own DNS resolver you’re probably interested in some benchmark tests against it, such as: how fast does my own server (read: Raspberry Pi) answer to common DNS queries compared to 8.8.8.8.

In this blogpost I am showing how to use two tools for testing/benchmarking DNS resolvers: namebench & dnseval. I am listing the defaults, giving some hints about them and showing examples in which I tested some private and public DNS resolvers: a Fritzbox router, a Raspberry Pi with Unbound, Quad9, OpenDNS, and Google Public DNS.

Continue reading Benchmarking DNS: namebench & dnseval

Dump1090 ADS-B Stats

Genau das Richtige für mich: Viele Statistiken bzgl. des ADS-B Empfangs. Konkret laufen diese dump1090-tools lokal auf dem Raspberry Pi und werten das Log von dump1090-mutability aus. (Siehe meinem letzten Post zur Installation von dump1090.) Vorallem die Statistiken über die Anzahl der empfangenen Flugzeuge sowie den Empfangsbereich sind einfach zu verstehen und sehr interessant.

Die Installation dieser Tools ist ebenfalls sehr einfach – nur wenige Befehle. (Auch wenn ein alter Raspberry Pi 1 B dann über 30 Minuten zum Ausführen braucht.) Ziemlich out-of-the-box werden dann im 5 Minuten Takt neue RRDtool Grafiken erzeugt. Los geht’s:

Continue reading Dump1090 ADS-B Stats

ADS-B am Raspberry Pi: dump1090-mutability

Bereits seit einigen Jahren setze ich einen DVB-T Stick zum Empfang von ADS-B Daten an einem Raspberry Pi ein. Damals habe ich erklärt, wie man die Linux Software dump1090 dafür verwendet. Der seit dem von mir verwendete Fork auf GitHub von MalcolmRobb wird allerdings seit Jahren nicht mehr weiterentwickelt. Nach einiger Recherche bin ich auf den Fork dump1090-mutability gestoßen, welcher sich von MalcolmRobbs ableitet. “It adds new functionality and is designed to be built as a Debian/Raspbian package.”

Tatsächlich lässt sich dieses Tool sehr einfach installieren, was ich nachfolgend gerne erläutern möchte. Die erweiterten Funktionlitäten sind z.B: die Logging-Möglichkeiten, mit denen sich Statistiken erzeugen lassen. Hierüber wird es einen extra Blogpost geben.

Continue reading ADS-B am Raspberry Pi: dump1090-mutability

DNSSEC Validation with Unbound on a Raspberry

To overcome the chicken-or-egg problem for DNSSEC (“I don’t need a DNSSEC validating resolver if there are no signed zones”), let’s install the DNS server Unbound on a Raspberry Pi for home usage. Up then, domain names are DNSSEC validated. I am listing the commands to install Unbound on a Raspberry Pi as well as some further commands to test and troubleshoot it. Finally I am showing a few Wireshark screenshots from a sample iterative DNS capture. Here we go:

Continue reading DNSSEC Validation with Unbound on a Raspberry

Stromzähler mit S0-Schnittstelle vom Raspberry Pi auswerten

Endlich ist es soweit: Ich lese den Stromverbrauch von unserer Wohnung mit einem Raspberry Pi aus und lasse mir von meinem Monitoring Server (MRTG + Routers2) schöne Graphen malen. Hierfür verwende ich einen Stromzähler mit einer S0-Schnittstelle, welchen ich direkt in der Unterverteilung eingebaut habe. Die Impulse des “Smart Meters” wertet eine Interruptroutine am Pi aus. Der Monitoring Server wiederum fragt den Pi per SNMP ab. Viele kleine Schritte also, die ich in diesem Blogpost ausführlich erläutern möchte. Viel Spaß damit!

Continue reading Stromzähler mit S0-Schnittstelle vom Raspberry Pi auswerten

Weiterer VRS-Feed: ADS-B Stick am Raspberry Pi

Ich hatte bei meinem aufgebauten Virtual Radar Server (VRS) bis jetzt nur mäßigen Empfang, da ich bei mir zu Hause die Antenne nicht aufs Dach platzieren konnte. Deswegen habe ich einen zweiten DVB-T Stick gekauft, ihn an einen Raspberry Pi (Raspbian Linux) gehängt, an einem Ort südlich des Frankfurter Flughafens aufs Dach gebaut und schließlich den Feed zu meinem vorhandenen Server hinzugefügt. Dadurch konnte ich die Abdeckung im Raum Frankfurt deutlich verbessern.

Im Folgenden beschreibe ich die Inbetriebnahme eines DVB-T Sticks am Raspberry Pi zum Empfang von ADS-B Flugzeugsignalen, sowie die Einbindung dieses Empfängers an einen zentralen Virtual Radar Server.

Continue reading Weiterer VRS-Feed: ADS-B Stick am Raspberry Pi

Measuring Temperatures with PCsensor’s TEMPerHUM Sensor

I am always interested in capturing real values via hardware devices in order to generate the appropriate graphs with my monitoring system. Of course, the outside temperature in our city was at the pole position for such a project. Therefore I ordered a few temperature/humidity sensors from PCsensor (via eBay), plugged them via USB on my Raspberry Pi (Raspbian Linux), and queried them via SNMP from my MRTG/Routers2 monitoring server. Here is the whole story:

Continue reading Measuring Temperatures with PCsensor’s TEMPerHUM Sensor