Email notification for fail2ban events

So I’ve configured my fail2ban installation and I’m also able to send emails. But wouldn’t it be awesome if I’ll get notified via email about any fail2ban event?

We start with editing the /etc/fail2ban/jail.local file. Look for the destemail and action parameters and change them accordingly:

mta = sendmail
destemail = recipient@domain.name
senderemail = sender@domain.name
action = %(action_mwl)s

The action can be one of these, whereby I’ve chosen action_mwl:

  • action_: ban only the IP
  • action_mw: ban the IP and send email with whois information about the banned IP
  • action_mwl: ban the IP and send email with whois information about the banned IP and add relevant log lines to the email
  • action_cf_mwl: notify Cloudfare about the offending IP, ban the IP and send email with whois information about the banned IP

Do a restart of fail2ban:

sudo systemctl restart fail2ban

You’ll receive a lot of emails from fail2ban. This also includes any starts and stops of fail2ban as well as the ban notifications. You can limit this behavior by adding following content to the file /etc/fail2ban/action.d/mail-buffered.local:

[Definition]

# Option:  actionstart
# Notes.:  command executed once at the start of Fail2Ban.
# Values:  CMD
#
actionstart =

# Option:  actionstop
# Notes.:  command executed once at the end of Fail2Ban
# Values:  CMD
#
actionstop =

Now copy this file a few times with different file names:

sudo cp /etc/fail2ban/action.d/mail-buffered.local /etc/fail2ban/action.d/mail.local
sudo cp /etc/fail2ban/action.d/mail-buffered.local /etc/fail2ban/action.d/mail-whois-lines.local
sudo cp /etc/fail2ban/action.d/mail-buffered.local /etc/fail2ban/action.d/mail-whois.local
sudo cp /etc/fail2ban/action.d/mail-buffered.local /etc/fail2ban/action.d/sendmail-buffered.local
sudo cp /etc/fail2ban/action.d/mail-buffered.local /etc/fail2ban/action.d/sendmail-common.local

Do a restart of fail2ban:

sudo systemctl restart fail2ban

You should now only receive emails for ban events.

Protect SSH services with fail2ban

If you’ll open SSH on a server to the open internet, you’ll notice a lot of bots trying to login. You certainly should setup certificate based login, but banning offending IPs is also an important security measure.

I’ve installed fail2ban on my Raspbian installations and want to explain the installation and configuration. Its quite easy and the benefits are huge!

sudo apt-get install fail2ban

Create a copy of the original configuration file so that it won’t be overwritten by any updates:

sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Search for a block for [default]. You should set:

bantime = 10m
findtime = 10m
maxretry = 5

These are the general settings. The settings for sshd should be a little bit stricter. Search a block for [sshd]. You should set:

enabled = true
maxretry = 3

You can enable and start fail2ban now using systemctl:

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Verify its up and running:

sudo systemctl status fail2ban.service
sudo fail2ban-client status
sudo fail2ban-client status sshd

If you end up being locked out, you can unlog an offending IP address using this command:

sudo fail2ban-client set sshd unbanip <offenders IP>

Banned connections will be dropped immediately by the firewall and should be visible with a „connection refused“.

Configure mail transport agent on Raspbian with external SMTP server

I want to get email notifications for actions on my Raspberry Pi using Raspbian. You could setup a separate mail server for that action but that seems to be a little bit overkill.

msmtp is a mail transfer agent which uses a configured smtp server for email transfer. This allows you to send emails via a configured smtp server (in my case from my webspace provider All-Inkl.com – by creating a new account using this link you’ll support the costs for running this blog).

Upgrade your raspbian:

sudo apt-get update && sudo apt-get upgrade

Install msmtp:

sudo apt-get install msmtp msmtp-mta mailutils

Get the location of the configuration files:

> msmtp --version
msmtp version 1.6.6
Platform: arm-unknown-linux-gnueabihf
TLS/SSL library: GnuTLS
Authentication library: GNU SASL
Supported authentication methods:
plain scram-sha-1 external gssapi cram-md5 digest-md5 login ntlm
IDN support: enabled
NLS: enabled, LOCALEDIR is /usr/share/locale
Keyring support: none
System configuration file name: /etc/msmtprc
User configuration file name: /home/pi/.msmtprc

Copyright (C) 2016 Martin Lambers and others.
This is free software.  You may redistribute copies of it under the terms of
the GNU General Public License <http://www.gnu.org/licenses/gpl.html>.
There is NO WARRANTY, to the extent permitted by law.

Configure the system configuration:

sudo vi /etc/msmtprc

The content of my configuration file (note the necessary changes for servers and email addresses):

# Set default values for all following accounts.
defaults

# Use the mail submission port 587 instead of the SMTP port 25.
port 465

# Always use TLS.
tls on
tls_starttls off

# Set a list of trusted CAs for TLS. The default is to use system settings, but
# you can select your own file.
tls_trust_file /etc/ssl/certs/ca-certificates.crt

# If you select your own file, you should also use the tls_crl_file command to
# check for revoked certificates, but unfortunately getting revocation lists and
# keeping them up to date is not straightforward.
#tls_crl_file ~/.tls-crls

# Mail account
# TODO: Use the users username, e.g. root for system and pi for your raspbian user
account root

# Host name of the SMTP server
# TODO: Use the host of your own mail account
host <your Username provided by KAS>.kasserver.com

# As an alternative to tls_trust_file/tls_crl_file, you can use tls_fingerprint
# to pin a single certificate. You have to update the fingerprint when the
# server certificate changes, but an attacker cannot trick you into accepting
# a fraudulent certificate. Get the fingerprint with
# $ msmtp --serverinfo --tls --tls-certcheck=off --host=smtp.freemail.example
#tls_fingerprint 00:11:22:33:44:55:66:77:88:99:AA:BB:CC:DD:EE:FF:00:11:22:33

# Envelope-from address
# TODO: Use your own mail address
from user@domain.name

# Authentication. The password is given using one of five methods, see below.
auth on

# TODO: Use your own user name fpr the mail account
user <The username of the email account you use for sending emails>

# Password method 1: Add the password to the system keyring, and let msmtp get
# it automatically. To set the keyring password using Gnome's libsecret:
# $ secret-tool store --label=msmtp \
#   host smtp.freemail.example \
#   service smtp \
#   user joe.smith

# Password method 2: Store the password in an encrypted file, and tell msmtp
# which command to use to decrypt it. This is usually used with GnuPG, as in
# this example. Usually gpg-agent will ask once for the decryption password.
#passwordeval gpg2 --no-tty -q -d ~/.msmtp-password.gpg

# Password method 3: Store the password directly in this file. Usually it is not
# a good idea to store passwords in plain text files. If you do it anyway, at
# least make sure that this file can only be read by yourself.
# TODO: Use the password of your own mail account
password <The password of the email account you use for sending emails>

# Password method 4: Store the password in ~/.netrc. This method is probably not
# relevant anymore.

# Password method 5: Do not specify a password. Msmtp will then prompt you for
# it. This means you need to be able to type into a terminal when msmtp runs.

# Set a default account
# TODO: Use the same account you've configured under account, e.g. root or pi
account default: root

# Map local users to mail addresses (for crontab)
aliases /etc/aliases

This file contains a username and password. Therefore limit its access to only root:

sudo chmod 600 /etc/msmtprc

Duplicate the config file to ~/.msmtprc if you want to provide email configuration for your user as well. Don’t forget to update the accounts accordingly.

Now configure the recipients for your systems users by setting the recipients in /etc/aliases. Make sure, that you don’t have trailing spaces behind the email addresses:

root: user@domain.name
default: user@domain.name

Let your computer now that msmtp should be used as replacement for sendmail by adding this content to /etc/mail.rc

set sendmail="/usr/bin/msmtp -t"

Test your configuration by sending an email from the terminal:

echo "Content of your mail" | mail -s "Subject" user@domain.name

Howto install InfluxDB and Grafana on a Raspberry Pi 3

Inspired by a friend I’ve decided to install InfluxDB and Grafana on my Raspberry Pi 3. InfluxDB is a database optimized for storing time related data like measurements of my recently installed particle sensor. Grafana is used to create beautiful graphs to display the stored data.

The InfluxDB installation can be done in a few simple steps:

curl -sL https://repos.influxdata.com/influxdb.key | sudo apt-key add -

echo "deb https://repos.influxdata.com/debian stretch stable" | sudo tee /etc/apt/sources.list.d/influxdb.list

sudo apt update

sudo apt install influxdb  

sudo systemctl enable influxdb

sudo systemctl start influxdb 

influx

CREATE DATABASE topics

This will install the InfluxDB without a user and any rights. You can read up further on that topic. Ideally you should setup an user for authentication but since some IoT devices do not support this I’m not going to explain it here.

The Grafana installation is similar simple:

Please make sure that you’ll get the most current version from github and replace it in the wget command:

wget https://github.com/fg2it/grafana-on-raspberry/releases/download/v5.1.4/grafana_5.1.4_armhf.deb

sudo dpkg -i grafana_5.1.4_armhf.deb

sudo systemctl enable grafana-server 

sudo systemctl start grafana-server

First login to Grafana:

Now you’re ready to configure Grafana. Go to http://<ip-of-grafana-machine>:3000 and setup a new username and password for the webinterface. The default is admin/admin

Configure InfluxDB as datasource in Grafana:

You need to configure a datasource under http://<ip-of-grafana-machine>:3000/datasources

Enter as name the name of the database you’ve created earlier. In this case it was topic.

The type of the database is InfluxDB.

The HTTP connection URL is http://localhost:8086

Hit Save & Test, once you’ve configured everything to your liking. The connection to the database should work now.

Raspberry Pi 3 with Kodi, Netflix, Spotify Connect, Hyperion and RetroArch

I’m currently using an old Mac Mini from 2009 as my media center. I’ve updated it recently with more RAM and an SSD but it has its problems with Bluetooth, regardless my used bluetooth card or USB adapter. Before this setup I’ve used a Raspberry Pi 3 with LibreElec which I’ve now reactivated successfully.

I’m using the Mac Mini for hearing Spotify, watching Netflix and Sky Go Connect, SNES Emulator with Xbox 360 and PS3 Gamepads and of course Kodi as media center in combination with Hyperion on a Raspberry Pi 1 as Ambilight clone. I’ve had to replace all this functionality with the Pi 3, but luckily it is possible!

I’ve started with LibreElec (8.0.2 stable) and installed it on the Pi 3. I had to copy the necessary Kodi files for setting the used sources and mysql database, so that I get my existing library and its viewing status.

Hyperion was easy to install via HyperionRemote. I only had to enable guest control for external resources in Kodi, so that Hyperion could properly shut down the backlight while the main menu is being displayed.

The SNES emulator can be used on LibreElec using the Kodi add-on Gamestarter. Just follow the GitHub instructions.

My Xbox 360 Gamepads where installed without problems. I just had to connect them via the USB adapter and pair them with the adapter. They are usable in Kodi as well as in Gamestarter without further configuration. I think that PS3 gamepads will probably behave similar.

The Bluetooth Mac Keyboard and Trackpad can also be paired with the Pi 3 via LibreElecs system settings. This allows a better search since you don’t need to use the onscreen Keyboard.

For Spotify I’ve just wanted the Pi 3 to appear as a Spotify connect speaker. The mobile apps and my other machines in the network are a better solution to select the music I want to hear, so I just wanted the Pi 3 to appear as a target. The Librespot provides this cool feature and also enables you to add easily Spotify connect to other rooms in your house with just a Raspberry Pi. Just search in the add-on for Librespot and install it. After a restart its active. Spotify connect is available immediately and stops automatically once a movie is started. It will be available again once the movie is really stopped (being paused is insufficient). Connecting to Librespot is really fast and works even better than with my Heos speakers!

Netflix is a completely different beast. Netflix is relying on a library called WideVine which handles the DRM. Google created a version for Chrome on ARM devices and some LibreElec and Kodi developers found a great way to integrate all this into the next version of LibreElec 9 and Kodi 18. So you need to update to  LibreElec 9 alpha. Copy the downloaded update file for Raspberry Pi 2 and 3 and put it into the update folder of your Pi 3. Now just restart and you’ll get the new version. However, be sure to make a backup of your library, just in case anything doesn’t work as expected!

You’ll now need the WideVine libs, you can install them with this command on your Pi:

curl -Ls http://nmacleod.com/public/libreelec/getwidevine.sh | bash

You’ll now only need the plugin.video.netflix add-on. Once it is started you’ll be asked for your Netflix credentials. If you enter everything correctly you’ll have all the options of Netflix displayed as nice library entries in Kodi. Really comfortable if you ask me! It even works directly with the Hyperion Ambilight which is a cool feature. I was able to use 720p without problems, 1080p is too much for the Pi 3 to decode only in software.

Now with LibreElec 9 you’ll have problems starting RetroArch via Gamestarter. Luckily there’s a version for LibreElec 9 which you can just install and update your existing add-on.

Congratulations! You’ve got now a Rasperry Pi 3 with Kodi 19, Hyperion Ambilight, RetroArch Emulator, Xbox 360 Gamepad support and Spotify Connect. Only thing not working is Sky Go Connect Ticket, due to a missing browser and probably DRM related issues. But since I’m just using it for 3 months to see Game Of Thrones I can workaround this with connecting my MacBook to the TV.