Optware, the Right Way

From DD-WRT Wiki

(Difference between revisions)
Jump to: navigation, search
Revision as of 14:06, 16 April 2010 (edit)
Masterman (Talk | contribs)
m (Executing the Script)
← Previous diff
Revision as of 14:19, 16 April 2010 (edit) (undo)
Masterman (Talk | contribs)
m (Service Explanations/Configuration Examples)
Next diff →
Line 312: Line 312:
Once the start command is issued, you will see the service scanning IP range subnets from various countries around the world that are a potential threat to your network security. Once they are downloaded, you will now have enhanced security that is configurable to your specific demands. Once the start command is issued, you will see the service scanning IP range subnets from various countries around the world that are a potential threat to your network security. Once they are downloaded, you will now have enhanced security that is configurable to your specific demands.
 +
 +Countries that are blocked by default are:
 +
 +# cn = China
 +# af = Afghanistan
 +# au = Australia
 +# pk = Pakistan
 +# in = India
 +# my = Malaysia
 +# ua = Ukrain
 +# ng = Nigeria
 +# kh = Cambodia
 +# li = Liechtenstein
 +
 +You can also add or remove countries by editing the Asiablock Script using VIM. To do this, shutdown Asiablock with the '''stop''' and '''off''' parameters, then type '''vi /opt/etc/init.d/S95asiablock'''
 +
 +It is wise to know what you are doing before you do this though. Search the forums or the net for instructions.
 +
To further enhance this service, you will need to add the following to your rc_firewall in Administration->Commands: To further enhance this service, you will need to add the following to your rc_firewall in Administration->Commands:

Revision as of 14:19, 16 April 2010

Contents

Frater's no hassle, newbie friendly Optware

This is the latest, greatest and easiest way to enable Optware on your Router. It is recommended that you have a router with USB capable storage (Harddisks (must be self-powered), flash-drives etc.) and the LATEST build! (preferably freshly flashed)

For BrainSlayer builds. Common routers use broadcom or broadcom k26. Choose the appropriate newest build, then navigate the directories.

For Eko Builds, K26 here All Others Here

The SD/MMC Method is working thanks to DHC Darkshadow. For USB users, you wont be needing JFFS2, so DISABLE it! Another aspect to note is that some of these services (i.e Twonky) consume alot of CPU resources, so make sure you check your resource consumptions.

UPDATE For everyone using K26 builds or builds that were compiled in December, you will no longer need a startup or shutdown script. Use the Automount feature in Services->USB and mount to /opt in the drop down menu.

Default Services that will be installed:

  • Bash instead of shell in busybox - (LFS support)
  • Automounting, Unmounting and Hotmounting of storage devices - Automatically mounts all recognized partitions and filesystem formats (including NTFS in K26).
  • Network printing with Watchprinter - Plug a USB printer into your router and let anyone on the LAN (or even WAN) print.
  • Torrent transmission with watchdog - Including Bittorrent transmission with Web Administration
  • Pre-configured Samba share - Samba provides file and print services for various Microsoft Windows clients and can integrate with a Windows Server domain, either as a Primary Domain Controller (PDC) or as a domain member. http://www.samba.org/
  • Xinetd - A replacement for inetd, the internet services daemon. Controls user defined network services such as printing and SWAT (Samba Web Administration Tool) http://www.xinetd.org/
  • Pound - A lightweight open source reverse proxy program suitable to be used as a web server load balancing solution. http://www.apsis.ch/pound/
  • Vlighttpd - Allows you to get a 2nd IP on your system and run virtual hosting there.
  • Pixelserv - A super minimal webserver, it's one and only purpose is serving a 1x1 pixel transparent gif file. Using some creative firewalling (netfilter/iptables) rules you can redirect some webrequests (for adds for example) to pixelserv. http://proxytunnel.sourceforge.net/pixelserv.php
  • AsiaBlock - A custom iptables firewall that is configurable to block certain countries from accessing your Webserver, FTP or just general Web surfing.
  • Vim with proper terminal support - Vim is an advanced text editor that seeks to provide the power of the de-facto Unix editor 'Vi', with a more complete feature set. http://www.vim.org/about.php
  • Service tool - Control all of these services. (Usage explained below)
  • Services running as other users than root
  • Other various useful tools such as net and storage diagnostics..

In my opinion, Everyone with a router that has storage device capabilities should take advantage of this! You will NOT regret it, even if it can be a time consuming process! If you are worried about formatting to a Linux filesystem and it's compatibility with windows, check out this thread from the forum on using the Windows NT Filesystem (NTFS)!

Getting Started

If starting from scratch, you will need to first format and partition your harddisk, flashdrive or SD card to an EXT2 or EXT3 Linux filesystem. It is much easier than you think, and can be accomplished via a Linux Live boot-CD. There will be NO changes to your PC whatsoever, and it is very simple to implement.

Drive Preparation and Prerequisites

Before you can utilize this extremely beneficial addition to your USB capable router, you must follow these important instructions:


How to - Format and Partition External Storage Device


This must be done for Optware to work correctly!

Connecting the Drive to your Router

NOTE:

For users with small /opt partitions (Less than 256MB, such as flashdrives and SD/MMC cards) use this as your start-up script:


mount -o noatime -t ext3 /dev/scsi/host0/bus0/target0/lun0/part1 /opt

For external HardDrives, use the following method:



1. In the DD-WRT web GUI screen, on the Services USB tab enable the options for:

  • Core USB support
  • USB 2.0 support (Asus WL520gU routers must use USB 1.1 drivers only!)
  • USB storage support
  • Printer Support (optional)
  • ext2/ext3 File System support
  • FAT File system support (optional)
  • Automatic Drive Mount
  • In the Disk Mount Point drop-down menu, mount to /opt

2. From the DD-WRT web GUI screen, click on Apply Settings. This will reboot the router.

3. If everything was done correctly, this should appear on your Services -> USB Tab:

Image:Drivemount2.jpg

Executing the Script

Start a terminal session using telnet or SSH

To do this in Windows, go to Start -> Run and type the following:

telnet 192.168.1.1

Enter the following at the telnet prompt:

login:root

password: router's admin password to the web interface.


NOTE When entering your password, the characters will not show up. This is normal for security. If it doesn't work the first time, make sure you don't make a typo or that the caps lock is not on when entering it.

NOTE Sometimes Microsoft security updates will disable telnet. If you cannot get a prompt to open using the above method, go to Start -> Run and type services.msc . Browse down until you see Telnet and right-click it to access its properties. Set it to Manual, then click Start. Apply and Save.

See also: Telnet/SSH_and_the_Command_Line

In Windows, telnet can be accessed from a command prompt... Start ->Run, while a program like PuTTY will allow for either telnet or SSH sessions and is a much more flexible and secure shell prompt. It does not even need to be installed..


NOTE - Can't login via SSH


If you find that you can't log in to SSH after installation, check that you're using a build greater than, and including 12827. The reason is that bash is used as shell after installation, but older firmware builds don't allow for shells other than /bin/sh to be used in SSH.

Once logged in:

Issue the command mount to ensure /opt is mounted (K24 and K26 have different Device paths, observe the following; #1 is K24 #2 is K26):

root@DD-WRT:~#mount
rootfs on / type rootfs (rw)
/dev/root on / type squashfs (ro)
none on /dev type devfs (rw)
proc on /proc type proc (rw)
ramfs on /tmp type ramfs (rw)
devpts on /proc/bus/usb type usbfs (rw)
/dev/scsi/host0/bus0/target0/lun0/part1 on /opt type ext3 (rw)
root@DD-WRT:~#


root@DD-WRT:~# mount
rootfs on / type rootfs (rw)
/dev/root on / type squashfs (ro)
none on /dev type devfs (rw)
proc on /proc type proc (rw)
ramfs on /tmp type ramfs (rw)
sysfs on /sys type sysfs (rw)
devpts on /dev/pts type devpts (rw)
devpts on /proc/bus/usb type usbfs (rw)
/dev/discs/disc0/part1 on /opt type ext3 (rw)
root@DD-WRT:~#

Make sure you are able to connect to the internet through the router. Pinging a domain is a good example:

ping yahoo.com (or any other domain of your choice)

You should get a multi-line response along the lines of:

PING yahoo.com (72.30.2.43): 56 data bytes
64 bytes from 72.30.2.43: icmp_seq=0 ttl=52 time=106.551 ms
64 bytes from 72.30.2.43: icmp_seq=1 ttl=52 time=102.864 ms
64 bytes from 72.30.2.43: icmp_seq=2 ttl=52 time=101.219 ms
64 bytes from 72.30.2.43: icmp_seq=3 ttl=52 time=100.507 ms
64 bytes from 72.30.2.43: icmp_seq=4 ttl=52 time=96.661 ms

Once you see a few lines of that, hit CTRL+C to return to a root prompt.

If you do NOT see output as mentioned above, you need to troubleshoot to establish an internet connection first. Some possibilities:

A) Reboot the router. (this alone may help. If not, continue to suggestion B)

B) Power off your cable modem, then the router.
Wait 30 seconds, then power on the cable modem.
Wait 30 seconds and power on the router.
Wait 30 seconds, then telnet back into the router and repeat the ping test demonstrated above.

Now you should have a connection. If so, continue with the following steps.

Enter the following commands into Busybox/Telnet:

wget -O /tmp/prep_optware http://wd.mirmana.com/prep_optware 

sh /tmp/prep_optware


This will load all the necessary Optware and supporting scripts that Frater wrote from the ground up.

This will take about 10-20 mins depending on your connection and your router CPU clock. Close your Web Interface as this consumes precious memory and CPU resources

Once everything has completed, wait you will be returned to a root prompt. Wait a minimum of 1 minute, then type reboot into either the BusyBox/Telnet Shell (why not, your right there) or reboot via Web Interface.

Important After rebooting, wait again at least another minute before logging back into the Telnet/SSH session!

Ensure Partitions are mounted

In either telnet or SSH, enter the command mount , if everything is working properly, it should look like this:




Important To keep track of your drives free space, issue the command df -h


You will get an output like this:


root@Asus:~# df -h
Filesystem            Size  Used Avail Use% Mounted on
rootfs                5.7M  5.7M     0 100% /
/dev/root             5.7M  5.7M     0 100% /
/dev/discs/disc0/part1
                     756M  215M  534M  29% /opt
/dev/sda4             293G  173G  117G  60% /mnt
/dev/sda3             504M   17M  483M   4% /tmp/c
root@Asus:~#



Using PuTTy to enable/disable Services



BusyBox/Telnet Commands for services:

service - show all services (enabled/disabled)
service <service name> - if "status" parameter is supported, will show service status, otherwise will show whether specified service is running
service <service name> on - Enable the script, allowing execution (chmod +x  /opt/etc/init.d/S<servicescript>)
service <service name> off - Disable the script, disallowing execution (chmod -x  /opt/etc/init.d/S<servicescript>)
service <service name> start - Start/execute the script, as long as service is enabled (i.e. permissions allow execution)
service <service name> stop Stop/kill the script, if the service is running
service <service name> restart Stop/kill the script, if the service is running, and then start/execute the script, as long as service is enabled
service <service name> <parameter> - Run the script with the parameter.

For a service to work it must be first switched on*, and then told to start.

service <service name> on
service <service name> start
  • Once you enable a service with the on parameter, the service is set to allow execution, and will run the next time you restart your router. You will need to issue a start directly proceeding it to initiate the service if you wish to start the service without restarting your router. A service must be set to on before it can be started.


Examples:

service xinetd status
service xinetd off
service xinetd on
service xinetd start
service xinetd stop
service xinetd restart

NOTE Xinetd will need to be started after the optware has been installed and the router has rebooted.

Issue:

service xinetd on
service xinetd start

This service MUST be enabled for services such as Network Printing, SWAT (web admin/config for samba) and OpenVPN


Turning off Twonky

Twonky Media Server (google it) may be enabled by default. It is a massive resource hog and can bog down even the most powerful routers. It is recommended to disable it unless you require its services.

service twonky stop
service twonky off


Automount

service automount start - mount all partitions
service automount stop - umount all partitions instead of the one to /opt
service automount status - show all partitions
service automount umount <partition|mountpoint> - unmount that partition and remove it fromautomount
service automount nomount <partition> - Do not automount this partition
service automount nonomount <partition> - remove this partition from the nomount list


NOTE

Many people seem to be confused between the services automount and usbmount. automount is enabled by default and is used for automatically mounting drive partitions. usbmount is disabled by default and is used for mounting usbfs (only needed for USB printers).


See NOTES at the bottom of this page for important/useful commands



Service Explanations/Configuration Examples

Asiablock - This service is perhaps the single most valuable tool for your network. Whether you are just a normal user, or you are running an FTP/Web-server, this will add vital security to your data and peripheral devices.

By default it is not enabled. To enable it, open up either a telnet/SSH prompt, login, and enter service asiablock on followed by service asiablock start.

Once the start command is issued, you will see the service scanning IP range subnets from various countries around the world that are a potential threat to your network security. Once they are downloaded, you will now have enhanced security that is configurable to your specific demands.

Countries that are blocked by default are:

  1. cn = China
  2. af = Afghanistan
  3. au = Australia
  4. pk = Pakistan
  5. in = India
  6. my = Malaysia
  7. ua = Ukrain
  8. ng = Nigeria
  9. kh = Cambodia
  10. li = Liechtenstein

You can also add or remove countries by editing the Asiablock Script using VIM. To do this, shutdown Asiablock with the stop and off parameters, then type vi /opt/etc/init.d/S95asiablock

It is wise to know what you are doing before you do this though. Search the forums or the net for instructions.


To further enhance this service, you will need to add the following to your rc_firewall in Administration->Commands:

wanf=`nvram get wan_iface`
iptables -I INPUT 2 -p tcp -i $wanf --dport 21 -j logdrop
iptables -I INPUT 2 -p tcp -i $wanf --dport 21 -m state --state NEW -m limit --limit 3/min -j logaccept
iptables -I INPUT 2 -p tcp -i $wanf -j asia
iptables -I FORWARD 1 -i $wanf -p tcp --dport 20:1024 -j asia 
iptables -D FORWARD `iptables --line-numbers -nL FORWARD | grep ESTABLISHED | tail -n1 | awk '{print $1}'`
iptables -I FORWARD -m state --state RELATED,ESTABLISHED -j ACCEPT


This happens to be my personal firewall that provides excellent security from Asian and other hackers/bots. The limit 3/min flag on my FTP WAN access is an invaluable ruleset as it will block a hacker/bot for 5 minutes if they try to guess my username and password 3 times per minute.

The dport 20:1024 -j asia rule prevents IP subnets dictated by asiablock from performing a portscan in order to hack either my FTP, SSH, Telnet, SNMP etc.


Here is a logged event of just such an attempt (notice the DROP and the attempted port 22):


Apr 15 12:28:52 Asus user.warn kernel: [asia DROP] : IN=vlan2 OUT=  MAC=00:0c:41:bd:f3:0c:00:01:5c:24:73:41:08:00:45:00:00:30 SRC=58.68.226.251 DST=173.16x.2x.1x  LEN=48 TOS=0x00 PREC=0x00 TTL=113 ID=36382 PROTO=TCP SPT=42506 DPT=22 WINDOW=65535  RES=0x00 SYN URGP=0
root@Asus:~#

Firewall and Iptables command scripts/tutorials can be obtained in many locations, including this sites Forum and Wiki.


Another useful trick included into Asiablock is the spam-list and ham-list. For instance, if you wanted to "add" a IP subnet to Asiablock (could be an angry co-worker or friend) use the following command (The 94.76.128.0/18 is the CIDR IP subnet range you want to block.):

echo 94.76.128.0/18>>/opt/etc/asia.spam


That is just an example, but you can obtain your specified IP subnet you want to block by using the whois command for the IP that is a potential threat (the 0.0.0.0 shall be replaced by the IP):

whois 0.0.0.0


To ensure that it took effect, first type service asiablock start (restarts the firewall) then issue the following command which will list all Asiablock IP bans:

cat /var/log/messages | grep asia | grep -o "SRC=.* DST" | sort -u

Another useful command that will display your firewall integrity is:

iptables -nvL | more

Hit enter to continue with the readout


As the Asiablock script is still in the experimental stage and subject to change due to either build bug fixes or for enhanced usability, it is wise to update it periodically. (once every 2 weeks should suffice)

To do this, simply insert the following into a shell prompt and type service asiablock start)


wget -O /opt/etc/init.d/S95asiablock http://wd.mirmana.com/S95asiablock
chmod +x /opt/etc/init.d/S95asiablock 


For more information or questions, visit this thread:

http://www.dd-wrt.com/phpBB2/viewtopic.php?t=61346&postdays=0&postorder=asc&start=0

Accessing services in web browser

You can also turn a service on or off through the web interface command line in Administration-> Commands (for people who don't like the hassle of SSH):

Examples:

/opt/usr/sbin/service transmission-daemon on
/opt/usr/sbin/service transmission-daemon start
/opt/usr/sbin/service xinetd on
/opt/usr/sbin/service xinetd start

Choose the service(s) you wish to execute and click Run Commands in the Administration->Commands box.

You are ready to go! It is also wise to wait at least 30 seconds after enabling these services before accessing them.

Some services have their own web interface:

SD/MMC Method

After and including build 13309

  1. Make sure you have 13309 or higher on your router. Start with a fresh system 30/30/30 reset.
  2. Partition the card - partition1 data, partition2 opt, partition3 jffs,partition4 swap reference How to - Format and Partition External Storage Device.
  3. Boot router.
    1. Enable SD support. The firmware will automount the first partition to /mmc.
    2. Enable jffs.
    3. Setup your internet connection.
    4. Save the following script to Startup in Administration->Commands.
      1. mount /dev/mmc/disc0/part2 /opt
    5. automount will do the rest
  4. Log into the router via Putty (SSH) and run fraters script below. This will take a while. It will tell you when it's finished.
    1. wget -O /tmp/prep_optware http://wd.mirmana.com/prep_optware
    2. sh /tmp/prep_optware
  5. When the script is done, it will tell you so and advise a reboot. (it is wise to wait ~1-2 mins after completion before rebooting)
  6. Reboot

Before build 13309

First off credit goes to frater for the optware script and the driver script credit goes to aszu and the startup script for the driver goes to phuzi0n. My hats off to you guys.

An update on my situation. The SD cards speeds were too slow and were overwhelming the router. I have steps for anyone using SD. It uses the new driver for the install. I have tested this 4 times on 2 different sd cards.

Start with a fresh system 30/30/30 reset, a Clean formatted SD card in either ext2 or ext3 with a /jffs directory, then create /opt inside of /jffs. Ex. /jffs/opt.

For some reason the later builds have a problem with formatting a card on setup, it screws the partition making the card invisible to the router. The above remedies this, and a service ticket has been submitted to fix this.


Continuing:

1.

  • Boot router.
  • Enable and setup GPIO's in the GUI for the SD Mod, because in the later builds auto GPIO is broken. Also setup your internet connection.
  • Enable jffs.
  • Copy the SDHC driver from HERE to the root directory of the MMC card via WinSCP
  • Save the following script to Startup in Administration->Commands. This Startup script will run the new SDHC driver all the time. It is only necessary until the release of a build with it all ready ported.


Code:

cp /mmc/sdhc-gpio2.o /tmp
umount /mmc
rmmod mmc
insmod /tmp/sdhc-gpio2.o
mount /dev/mmc/part1 /mmc/
mount --bind /mmc/jffs /jffs
mount -o bind /mmc/jffs/opt /opt


2. Log into the router via Putty (SSH) and run fraters script below. This will take a while. It will tell you when it's finished.


Code:

wget -O /tmp/prep_optware http://wd.mirmana.com/prep_optware
sh /tmp/prep_optware


3. Reboot (it is wise to wait ~1-2 mins after completion before rebooting)

Notes

Useful scripts

mount - Shows what disks/partitions are mounted
fdisk -l - Shows disk information
blkid - Shows disk information
df -h - Shows disk usage and available space.  Very important
lsusb - Shows devices in /dev/usb/ like printers, USB hubs etc.
top - Shows all running processes and resources as well as swap file usage and CPU-Memory usage.
htop - A more user friendly application that allows you to kill processes, change their "nice" value, etc.
netstat -lnp - Shows which ports are open and what services are using them.
cat /tmp/fdisk
cat /tmp/blkid
cat /opt/etc/automount
cat /opt/etc/nomount


  • To remove this optware completely (which should be done after a build upgrade, or if you don't need all of these services) do the following:
cd /opt
rm -r *


  • When using USB storage (or maybe other form of storage as well), in order to automount the remaining partitions, the packages 'util-linux-ng' and 'grep' should be installed as well:
ipkg-opt install util-linux-ng
ipkg-opt install grep


Many more exciting packages are in the works, so be sure to follow This forum thread and further help is always available on the forums.

Enjoy!

Kernel 2.6 Problems! [READ!]

Currrently (As of Build 13972), Media Servers (Twonky, Mediatomb, UShare, Etc) are not working under the 2.6 Kernel! If you want to use these services, use the 2.4 Kernel!