Da es jemand »für einen Bekannten« nachfragte und the-construct.com abgeschaltet wurde (und der Betreiber sich leider auch sich nicht mehr meldet, obwohl es Angebote gibt, den Kram weiterlaufen zu lasssen), hier kurz die Schritte und Tools, um DropBear (SSH-Server) und OpenVPN auf ‘ner FritzBox der 71er-Klasse an den Start zu bringen. Ich hab’s seinerzeit über sog. Pseudo-Images von the-contruct.com gemacht, da gab’s dann ein Webfrontend, welches ein tar zusammenpackte, welches man über’s Web-IF hochladen konnte und, welches dann über /var/flash/debug.cfg den Kram rebootfest implementierte. Idealerweise rennt der Kram vom USB-Stick, aber wenn man den nicht hat, tut’s ggf. auch der Webspace …
# cat /var/flash/debug.cfg
#!/bin/sh
LED_DEVICE=/proc/led_mod/led
if [ ! -f /proc/led_mod/led ] ; then
LED_DEVICE=/var/led
echo "set led: ${LED_DEVICE}"
fi
# start internet phone led flashing
echo "set internet phone led to blink (modul=14, state=3)"
echo 14,3 > ${LED_DEVICE}
# check kernel version
KERNEL_VERSION=`uname -r | grep 2.6`
if [ -z "${KERNEL_VERSION}" ]
then
KERNEL_VERSION="linux24"
ETHERWAKE="etherwake"
else
KERNEL_VERSION="linux26"
ETHERWAKE="ether-wake"
fi
# init busybox var
BUSYBOX="/bin/busybox"
# wait to be able to interrupt in case of emergency
sleep 15
if [ -z "$(busybox | grep telnetd)" ]
then
while !(ping -c 1 0xdecafbad.net)
do
sleep 5
done
# check if file already exists
if [ ! -f /var/tmp/busybox ]
then
wget -qO /var/tmp/busybox http://0xdecafbad.net/${KERNEL_VERSION}/busybox
# make it executable
chmod +x /var/tmp/busybox
fi
# set busybox var
BUSYBOX="/var/tmp/busybox"
fi
# start telnet deamon with password of web gui
#${BUSYBOX} telnetd -l /sbin/ar7login
# load VPN-Server (OpenVPN)
# create tun-device
mknod /var/tmp/tun c 10 200
# write 'secret.key' to file
cat > /var/tmp/secret.key << 'ENDSECRETKEY'
#
# 2048 bit OpenVPN static key
#
-----BEGIN OpenVPN Static key V1-----
[Keyfile-Daten hier her]
-----END OpenVPN Static key V1-----
ENDSECRETKEY
# write 'server.ovpn' to file
cat > /var/tmp/server.ovpn << 'ENDSERVERCONF'
dev tun0
dev-node /var/tmp/tun
ifconfig 192.0.2.1 192.0.2.6
secret /var/tmp/secret.key
proto udp
remote 192.168.178.4
port 1199
tun-mtu 1500
#keepalive 10 60
verb 4
mssfix
route 192.0.2.0 255.255.255.248
route 192.0.2.0 255.255.255.0
ping 15
ping-restart 60
resolv-retry 60
persist-tun
persist-key
daemon
ENDSERVERCONF
cat > /var/tmp/uu.ovpn << 'ENDSERVERCONF'
dev tun1
dev-node /var/tmp/tun
ifconfig 192.168.4.14 192.168.4.15
secret /var/tmp/secret.key
proto udp
remote 1.2.2.3
port 4711
tun-mtu 1500
fragment 1300
#keepalive 10 60
verb 4
mssfix
route 192.168.4.0 255.255.255.0
ping 15
ping-restart 60
resolv-retry 60
persist-tun
persist-key
daemon
ENDSERVERCONF
# try to load files from USB drive
#for f in /var/media/ftp/*
#do
# if [ -f ${f}/files/${KERNEL_VERSION}/openvpn ]
# then
# echo "copy ${f}/files/${KERNEL_VERSION}/openvpn"
# cp ${f}/files/${KERNEL_VERSION}/openvpn /var/tmp/openvpn
# fi
#done
# check if file already exists
if [ ! -f /var/tmp/openvpn ]
then
# wait for server
while !(ping -c 1 0xdecafbad.net)
do
sleep 5
done
# load files
wget -qO /var/tmp/openvpn http://0xdecafbad.net/${KERNEL_VERSION}/openvpn
fi
# make them executable
chmod +x /var/tmp/openvpn
chmod 0600 /var/tmp/server.ovpn
chmod 0600 /var/tmp/secret.key
# start OpenVPN, add route via Internet Link
/sbin/route add 1.2.2.3 dev dsl
/var/tmp/openvpn --config /var/tmp/server.ovpn
/var/tmp/openvpn --config /var/tmp/uu.ovpn
# load SSH-Server (dropbear) and etherwake
# CONFIGURATION
# SSH
# port
dropbearport="22"
# password
PASSWD='[real PW (MD5?) here]'
# Etherwake
# MAC address
wolmac="01:23:45:67:89:AB"
# interface to use for WOL
# intf = std - ata
# eth0 = LAN1 - WAN
# eth1 = LAN2 - LAN1
wolinterface="eth0"
# CONFIGURATION END
# try to load files from USB drive
#for f in /var/media/ftp/*
#do
# if [ -f ${f}/files/${KERNEL_VERSION}/dropbear ]
# then
# echo "${f}/files/${KERNEL_VERSION}/dropbear"
# cp ${f}/files/${KERNEL_VERSION}/dropbear /var/tmp/dropbear
# fi
#
# if [ -f ${f}/files/${KERNEL_VERSION}/sftp-server ]
# then
# echo "${f}/files/${KERNEL_VERSION}/sftp-server"
# cp ${f}/files/${KERNEL_VERSION}/sftp-server /var/tmp/sftp-server
# fi
#done
# check if file already exists
if [ ! -f /var/tmp/dropbear ]
then
# wait for server
while !(ping -c 1 0xdecafbad.net)
do
sleep 5
done
# load files
wget -qO /var/tmp/dropbear http://0xdecafbad.net/${KERNEL_VERSION}/dropbear
fi
# check if file already exists
if [ ! -f /var/tmp/sftp-server ]
then
# wait for server
while !(ping -c 1 0xdecafbad.net)
do
sleep 5
done
# load files
wget -qO /var/tmp/sftp-server http://0xdecafbad.net/${KERNEL_VERSION}/sftp-server
fi
if [ ! -f /var/tmp/busybox ]
then
# try to load files from USB drive
# for f in /var/media/ftp/*
# do
# if [ -f ${f}/files/${KERNEL_VERSION}/busybox ]
# then
# echo "${f}/files/${KERNEL_VERSION}/busybox"
# cp ${f}/files/${KERNEL_VERSION}/busybox /var/tmp/busybox
# fi
# done
# check if file already exists
if [ ! -f /var/tmp/busybox ]
then
# wait for server
while !(ping -c 1 0xdecafbad.net)
do
sleep 5
done
# load files
wget -qO /var/tmp/busybox http://0xdecafbad.net/${KERNEL_VERSION}/busybox
fi
fi
# make them executable
chmod +x /var/tmp/busybox
chmod +x /var/tmp/dropbear
chmod +x /var/tmp/sftp-server
# set busybox var
BUSYBOX="/var/tmp/busybox"
# change root password
${BUSYBOX} sed -e "/root:/s#^root:[^:]*:#root:${PASSWD}:#" -i /var/tmp/shadow
# create symlink for dropbearkey
ln -s /var/tmp/dropbear /var/tmp/dropbearkey
${BUSYBOX} uudecode -o /var/tmp/dropbear_rsa_host_key << 'RSA'
begin 600 /var/tmp/dropbear_rsa_host_key
[UUENCODED data here]
end
RSA
${BUSYBOX} uudecode -o /var/tmp/dropbear_dss_host_key << 'DSS'
begin 600 /var/tmp/dropbear_dss_host_key
[UUENCODED data here]
end
DSS
# start dropbear
sleep 60
/var/tmp/dropbear -p ${dropbearport} -r /var/tmp/dropbear_rsa_host_key -d /var/tmp/dropbear_dss_host_key
# create simplified WOL script
echo "${BUSYBOX} ${ETHERWAKE} -i ${wolinterface} ${wolmac}" > /var/tmp/startpc
# make it executable
chmod +x /var/tmp/startpc
# stop internet phone led flashing
echo 14,1 > ${LED_DEVICE}
# /var/tmp/busybox uname -a
Linux fritz.fonwlan.box 2.6.13.1-ohio #1 Wed Jan 27 13:20:43 CET 2010 mips unknown
# set | grep CONFIG_VERSION
CONFIG_VERSION='04.80'
CONFIG_VERSION_MAJOR='29'
#
Ja, die echten Keys, Passwörter, IPs usw. habe ich verändert :-) Ja, ich verwende hier zwei OpenVPN-Tunnel, einen initial zu einem Asterisk-Server, der hier im LAN stünde (Route über FB-Oberfläche gesetzt bzw. gleiches Netz), und einen im Internet. Und ACHTUNG: /var/flash/debug.cfg nur mit »cat« beschreiben, also »cat /var/tmp/my-file >/var/flash/debug.cfg« — standard disclaimers apply; your mileage may vary; no liability assumed; following the steps shown here might void your warranty, ruin you sex life, kill your dog or make you unhappy in other ways …
Short: works for me, credits go to the creator of the-construct.com … Alles klar? ;)
