Setup

Markdown¶

Lets use some Hacks especially the so-called admonitions.

:warning: Warning: Do not push the big red button.

:memo: Note: Sunrises are beautiful.

:bulb: Tip: Remember to appreciate the little things in life.

Raspberry 4¶

I will use a Raspberry 4 model B with Raspian for this course as I am not an admin of my workstation and as the Oracle VM Virtualbox on my machine needs to be updated and updating it requires admin rights.

First I needed to set the date and time

sudo timedatectl set-timezone Europe/Paris

Actually I later had to reset it with

sudo apt install htpdate

To document I looked for screen capture options, the best is grim

grim

It saves the captures in the Images folder.

Connection to VM¶

I installed WireGuard

sudo apt install wireguard

I saved my config file on the Desktop and tried the following command

wg setconf wg0 Desktop/FFVPN-alinebecq.conf

I got the following error “Line unrecognized: ‘Address=192.168.81.11/32”

Maybe wg0 is not defined.

I tried the command

ip link add dev wg0 type wireguard

I got the error “RTNETLINK answers: Operation not permitted” On a forum (ipvn.net) it is suggested that the wireguard kernel might not loaded and recommand the following:

sudo modprobe wireguard

and to reboot. Let’s try!

Well this didn’t work.

I saw some mention of the command line

sudo wg-quick up Desktop/FFVPN-alinevbecq.conf

This seems to work except for line 32 resolvconf: command not found

I had a look at Wireguard commands

show
addconf
setconf
genkey
genpsk
pubkey

but didn’t succeed to call them.

I installed resolvconf as described in Step 9 of this tutorial

sudo apt install resolvconf

and redid the sudo wg-quick… command and all seemed fine.

labcyber@raspberrypi:~ $ sudo wg-quick up Desktop/FFVPN-alinebecq.conf
Warning: /home/labcyber/Desktop/FFVPN-alinebecq.conf' is world accessible
[#] ip link add FFVPN-alinebecq type wireguard
[#] wg setconf FFVPN-alinebecq /dev/fd/63
[#] ip -4 address add 192.168.81.11/32 dev FFVPN-alinebecq
[#] ip link set mtu 1420 up dev FFVPN-alinebecq
[#] resolvconf -a tun.FFVPN-alinebecq -m 0 -x
[#] ip -4 route add 192.168.81.0/24 dev FFVPN-alinebecq
[#] ip -4 route add 192.168.80.0/24 dev FFVPN-alinebecq

I checked with

sudo wg

I got:

interface: FFVPN-alinebecq
  public key: NoE4YCfB6vKzevZypk7tYsGjxLy5a24NPN94955e/jI=
  private key: (hidden)
  listening port: 52676

peer: p/grOGvtnk92Z1VrdXHHGdAXIgSfV5uorrggUVDd3Es=
  endpoint: 38.42.111.140:51825
  allowed ips: 192.168.80.0/24, 192.168.81.0/24
  latest handshake: 11 seconds ago
  transfer: 35.19 KiB received, 21.50 KiB sent
labcyber@raspberrypi:~ $

Seems like I connected my WireGuard Peer to the tunnel!

SSH¶

I then tried SSH connection:

ssh ubuntu@192.168.80.219

I got a warning about the authenticity of host. I accepted to pursue anyway and could connect.

I am now identified as “ubuntu@ff-cs-aline-becq”

### Desktop VPN

I clicked on the link http://192.168.80.219:6081/vnc.html but couldn’t connect. Took too much time. Maybe there are limitations to my connection (firewalls…). Indeed some limitations were involved as I was able to connect using a different kind of Internet access.

Let’s install TigerVNC

sudo apt install tigervnc

Could not go through but I got the recommandation to use snap install

I will try to only install the viewer as we only want the client and we don’t need to install the server.

sudo apt install tigervnc-viewer

And I worked

I then tried with the IP of my VM

vncviewer 192.168.80.219:5901

Can’t open display:

5901 is the Display 1 port.

Switching to local¶

After regularly encountering install issues I reconsidered the distant VM option.

I installed tcpdump and QEMU locally, uncertain if a Raspberry has enough ressources.

It worked.

On the QEMU download page there is a checksum to verify the authenticity of the iso.

Would be interesting to do this verification step.

The following line could perform the test

``` sha1sum image.iso ````

I did the check and the iso is the same one. But if the iso is changed I assume a hacker would be able to change the SHA1 value as well.

Some infos here here.

### What I learned