User Tools

Site Tools


project:brmdoor:start

Differences

This shows you the differences between two versions of the page.

Link to this comparison view

Both sides previous revisionPrevious revision
Next revision
Previous revision
project:brmdoor:start [2018/06/07 21:11] – [BrmDoor Firmware] Fix github link abyssalproject:brmdoor:start [2023/09/17 20:35] (current) – [Raspberry support] pysftp dropped and changed to paramiko for SFTP abyssal
Line 32: Line 32:
     * Lock specs say 12-24V should be used, but from experience 12 V is not enough. Use 24 V.     * Lock specs say 12-24V should be used, but from experience 12 V is not enough. Use 24 V.
  
-Communication is over SPI: both SEL0 and SEL1 are shorted which turns communication to be over SPI.+Communication is over SPI: both SEL0 and SEL1 are shorted which turns communication to be over SPI. Docs say SEL1 closed, board says both closed, both closed work.
  
 Documentation of Adafruit PN532 shield (our revision is 1.2):  Documentation of Adafruit PN532 shield (our revision is 1.2): 
Line 43: Line 43:
 Source repository: https://github.com/hiviah/brmdoor_libnfc Source repository: https://github.com/hiviah/brmdoor_libnfc
  
 +===== Raspberry support =====
 +
 +Brmdoor was tried on:
 +
 +  * Raspberry 1B (very slow import, but works ok)
 +  * Raspberry 3B+
 +  * Raspberry 4B
 +
 +Tested Raspbian 9 and 10 (Raspi OS 2021-03-04). Still works on 2023-09-17, when we needed to drop ''pysftp'' and use ''paramiko'' directly, allows to use ECDSA and Ed25519 keys.
 +
 +Raspberry 1 and 2 - it's just slow, everything is slow there. Raspberry 3B+ or 4 with USB boot and USB flash instead of SDcard recommended.
 +
 +Make sure you enable SPI in device tree or ''dtparam=spi=on'' in ''/boot/config.txt'' depending on Raspi model otherwise reader won't work. Raspi 3B+ boots from USB out of the box, 4B needs enabling it manually. Latest Raspbian does not enable ssh after install put empty file named ''ssh'' in ''/boot'' directory to enable.
 ===== List of authorized cards ===== ===== List of authorized cards =====
  
Line 67: Line 80:
  
 <code> <code>
-cd brmdoor_libnfc/; ./import_jendasap_cards.py /path/to/cards.txt brmdoor.sqlite''+cd brmdoor_libnfc/; ./import_jendasap_cards.py /path/to/cards.txt brmdoor.sqlite
 </code> </code>
  
Line 82: Line 95:
 </code> </code>
  
-===== OPEN/CLOSED switch with update of topic on IRC =====+===== Adding a new Desfire with authentication to JendaSAP and import to brmdoor ===== 
 + 
 +This is similar to above, but has extra step in programming the Desfire. 
 + 
 +<note important> 
 +The Desfire needs to be programmed with correct signature first, otherwise brmdoor will reject it. 
 +</note> 
 + 
 +Writing a signature on a Desfire card (can be done on raspi or using PN532 reader that is in the lab). You must know the private Ed25519 key matching the public key in brmdoor's config to be able to program the Desfire correctly. 
 + 
 +<code> 
 +./write_signed_ndef_on_desfire.py private_key_in_hex 
 +</code> 
 + 
 +Similar to above, but you add line "desfire" instead of "card" in JendaSAP: 
 + 
 +<code> 
 +desfire 04631982cc2280 
 +</code> 
 + 
 +The parse.py mentioned above will also create ''cards_desfire.txt''. Copy the ''cards_desfire.txt'' to brmdoor and run on brmdoor raspi: 
 + 
 +<code> 
 +cd brmdoor_libnfc/; ./import_jendasap_cards.py --desfire /path/to/cards_desfire.txt brmdoor.sqlite 
 +</code> 
 + 
 +<note important> 
 +If you are using old libfreefare 0.4.x, you will need to patch the hardcoded infinte timeouts, otherwise Desfire stuff may deadlock. 
 +</note> 
 + 
 +In general, set the timeout param in ''nfc_initiator_transceive_bytes'' (last parameter) to something like 2000 (it's in milliseconds) in all libfreefare .c sources (it's 0 meaning infinite wait). Latest versions have it configurable without such hacks. 
 + 
 +So ''apt-get source libfreefare'', unpack, patch, rebuild via  
 + 
 +<code> 
 +DEB_BUILD_OPTIONS='nostrip noopt debug' dpkg-buildpackage -b -uc -us 
 +</code> 
 + 
 +==== Fixed Raspbian libfreefare .deb files ==== 
 + 
 +Link to zip with the rebuilt .deb files for current brmdoor (Raspian 9), just install with dpkg -i like usual: 
 + 
 +{{ :project:brmdoor:fixed_desfire_timouts_libfreefare.zip |}} 
 + 
 +Latest versions of libfreefare have this fixed, there is either non-infinite timeout or configurable timeout in very latest versions. 
 +==== Checking that the signature on Desfire ==== 
 + 
 +Can be done with brmdoor, PN352 reader on PC or also on mobile app that can show NFC NDEF data: 
 + 
 +<code> 
 +cd brmdoor_libnfc/; ./test_nfc.py desfire-ndef4 
 +</code> 
 + 
 +You should see something like: 
 + 
 +<code> 
 +{"brmdoorSignature": "ebb7191d3a1133e375bd4bcfe9b271b8246d086c6c93f0753a3a09c6bbc253e7fc3e2fc34f3351989c8b31bd9937747e05173f9377f57a445e7f61c74b4d7388"
 +</code> 
 +===== Restarting brmdoor remotely ===== 
 + 
 +If brmdoor stops responding for some reason, restart it using: 
 + 
 +<code> 
 +systemctl restart brmdoor.service 
 +</code> 
 + 
 +In order to get to brmdoor from outside, you'll need to find a hop server accessible from outside, like bbs.brmlab.cz 
 + 
 +Sample entry in ''~/.ssh/config'': 
 + 
 +<code> 
 +Host = bbs.brmlab.cz 
 +VerifyHostKeyDNS = yes 
 +User = root 
 +IdentityFile = ~/.ssh/your_key 
 +ForwardX11 = no 
 +UsePrivilegedPort = no 
 +Protocol 2 
 + 
 +Host = brmdoor-external 
 +ProxyCommand = ssh bbs.brmlab.cz nc %h 22 
 +Hostname = 192.168.77.30 
 +Port = 22 
 +User = root 
 +IdentityFile = ~/.ssh/your_key 
 +ForwardX11 = no 
 +UsePrivilegedPort = no 
 +Protocol 2 
 +</code> 
 + 
 +===== OPEN/CLOSED switch with update of topic on IRC and SpaceAPI format on VPS =====
  
 In ''brmdoor_nfc.config'', look at the section ''[open_switch]''. IRC must be enabled in ''[irc]'' section for status In ''brmdoor_nfc.config'', look at the section ''[open_switch]''. IRC must be enabled in ''[irc]'' section for status
Line 122: Line 225:
 until the physical switch changes the value. until the physical switch changes the value.
  
 +==== Reporting/uploading status in SpaceAPI format ====
 +
 +Currently since v 0.2 brmdoor can upload the status and information in [[http://spaceapi.net/ | SpaceAPI.net format]].
 +
 +The status JSON is mapped currently is mapped to [[https://brmlab.cz/spaceapi/status.json]]. The interesting non-static part
 +of json is in under "state" key - "open" (boolean) and "lastchange" (Unix timestamp). 
 +
 +Currently to be compatible with old URL (https://status.brmlab.cz/brmd/brmstatus.json) 
 +for the spaceAPI.net since we can't change it and can't submit new, there is alias
 +in ''/etc/apache2/sites-available/status.brmlab.cz.conf'' to directory ''/home/brmdoor-web/spaceapi-status'' where status file is
 +uploaded by brmdoor (it's over SFTP with internal-sftp chroot, ssh-key login, so that in case of compromise of brmdoor there
 +is not much the attacker could do with it (and password can't be bruteforced).
 ===== PIN assignments ===== ===== PIN assignments =====
  
 General GPIO PIN assignments are configurable, communication (SPI/I2C) must follow the definition in Raspberry Pi General GPIO PIN assignments are configurable, communication (SPI/I2C) must follow the definition in Raspberry Pi
-pinouts. Raspi pinouts for all versions: http://pi4j.com/pins/model-3b-rev1.html+pinouts. Raspi pinouts for all versions: https://pi4j.com/1.2/pins/model-2b-rev1.html 
 + 
 +(Follow whatever Rpi is installed for pinout as power sources keep killing them time to time)
  
 Numbering scheme used by brmdoor for lock and open switch (based on BCM GPIO numbering, different from P1 Numbering scheme used by brmdoor for lock and open switch (based on BCM GPIO numbering, different from P1
Line 133: Line 250:
 PIN assignemnts (physical PINs on P1 header, with BCM GPIO numbers used in config): PIN assignemnts (physical PINs on P1 header, with BCM GPIO numbers used in config):
  
-  * 5V power into Raspberry: physical #1 +  * Raspberry power - via USB
-  * Ground from power source to Raspberry: physical #9+
   * 5V power out into Adafruit PN532 reader: #4   * 5V power out into Adafruit PN532 reader: #4
   * Ground for Adafruit PN352: physical #6   * Ground for Adafruit PN352: physical #6
   * BERA-E lock open/close: physical #22, BCM GPIO #25   * BERA-E lock open/close: physical #22, BCM GPIO #25
-  * Open/close switch input PIN: physical #15, BCM GPIO #22 +  * Open/close switch input PIN: physical #15, BCM GPIO #22 (/sys/class/gpio/gpio22/value)
-  * Ground for open/close switch: physical #25+
   * SPI pins for Adafruit PN532 reader - SPI PINs on Raspberry - physical #19, #21, #23, #24   * SPI pins for Adafruit PN532 reader - SPI PINs on Raspberry - physical #19, #21, #23, #24
 +  * electrical measurement (ask Jenda) : physical #12 signal, ground physical #14
 +  * grounds not mentioned just connect to any ground
  
 +
 +===== microSD card extra vs Sandisk Extra USB experiment (2021-05-20) =====
 +
 +I'e bought a 16 GB USB flash that should theoretically be more stable than SD card.
 +
 +I've copied the 32-GB card, extended the filesystem to 16 GB (from original 4 GB). 
 +
 +The copy is available in my trezor. I benchmarked SD card and the USB boot device, did not find any significant differences. We did thought with rainbof limit the max CPU/GPU freq.
 +
 +To this day I am not sure whether that "hardened SD card" or my "hardened USB flash" will be a better choice.
 +
 +Nevertheless, we have copies of all, so in case the SD card goes down, we still have USB flash with the system.
 +
 +Jenda/Mrkva were politely asked whether they want to design a single board for all future brmdoors. Since there is like 10 parts and foundries will make the poplated boards at $10/piece.
 ===== GitHub, last commits ===== ===== GitHub, last commits =====
  
 {{rss>https://github.com/hiviah/brmdoor_libnfc/commits/master.atom 5 author date 1h }} {{rss>https://github.com/hiviah/brmdoor_libnfc/commits/master.atom 5 author date 1h }}
  
-===== Photos of cable connections of Raspi + PN532 shield (location Ke kaplicce 18) =====+===== Photos of cable connections of Raspi + PN532 shield (location Ke kaplicce 20- old Raspi 1 rev B2 - OBSOLETE =====
  
 {{:project:brmdoor:brmlab_03.jpg?400|}} {{:project:brmdoor:brmlab_03.jpg?400|}}
Line 158: Line 289:
 {{:project:brmdoor:brmdoor_08.jpg?400|}} {{:project:brmdoor:brmdoor_08.jpg?400|}}
  
 +===== Updated photos after replacing Raspi 1 rev B2 with Raspi 3B+ (18 May 2021) - OBSOLETE =====
 +
 +Power source fried the Raspi 3B+ sometimes in 2022, replaced again with Raspi 2B
 +
 +Added on left side is a stepdown that works with Raspi 3B+ power consumption.
 +
 +{{:project:brmdoor:pxl_20210518_193212168.jpg?600|}}
 +
 +{{:project:brmdoor:pxl_20210518_193216605.jpg?600|}}
 +
 +===== Updated photos after replacing fried Raspi 3B+ for old Raspi 2B and changing casing (14 Jan 2022) =====
 +
 +{{:project:brmdoor:s_pxl_20230114_182557653.jpg?600|}}
 +
 +{{:project:brmdoor:s_pxl_20230114_182625690.jpg?600|}}
 +
 +{{:project:brmdoor:s_pxl_20230114_182637328.mp.jpg?600|}}
 +
 +{{:project:brmdoor:s_pxl_20230114_183754736.jpg?600|}}
 +
 +==== Outside view of PN532 shield (14 Jan 2022) ====
 +
 +{{:project:brmdoor:s_pxl_20230114_195316653.jpg?600|}}
 +
 +{{:project:brmdoor:s_pxl_20230114_195345155.jpg?600|}}
 ===== Brmdoor HOWTO (displayed after you login as root, in /etc/motd) ===== ===== Brmdoor HOWTO (displayed after you login as root, in /etc/motd) =====
 <code> <code>
Line 222: Line 378:
   * Setting topic is not finished (python-irc has fairly bad API to retrieve topic)   * Setting topic is not finished (python-irc has fairly bad API to retrieve topic)
  
 +===== Remote access from outside brmlab =====
 +
 +Add following to your ~/.ssh/config, edit your key if necessary (the key needs to be added on brmbar and on brmdoor):
 +
 +You need to have access to ''data.brmlab.cz'' and ''brmdoor'' as well.
 +
 +You need ssh that supports ''ProxyJump'' (should not be a problem unless you have reeeeeaaaaaly old system).
 +
 +<code>
 +
 +Host data.brmlab.cz
 +User root
 +Port 22
 +IdentityFile = ~/.ssh/whatever_your_key_is
 +Protocol 2
 +
 +Host = brmdoor-via-data
 +ProxyJump = data.brmlab.cz
 +Hostname = 192.168.77.30
 +Port = 22
 +User = root
 +IdentityFile = ~/.ssh/whatever_your_key_is
 +ForwardX11 = no
 +UsePrivilegedPort = no
 +Protocol 2
 +</code>
 +
 +Then using
 +
 +<code>
 +ssh brmdoor-via-data
 +</code>
 +
 +will get proxyjump over data into brmdoor.
  
project/brmdoor/start.1528405913.txt.gz · Last modified: 2018/06/07 21:11 by abyssal