Mikrotik RB2011 OpenWRT Installation Procedure

RouterBoard RB2011 Install Tips Steak Electronics

\textbf{Mikrotik RB2011 Routerboard Install}
Contents
Contents
1.  Overview

4.  Pitfalls

1. Overview To install Openwrt on a Rack Mount server. One of the options is the Mikrotik RB2011 series of routers.

\textbf{EDIT: 11/28/19 Since this has been written, 19.01 RC has been released, and I would recommend people use that for the RB2011, as it should address issues with installation (SPI Flash write / RAM ECC errors covered in Troubleshooting section) which can occur on ‘some’ RB2011 models. }

\textbf{EDIT: 10/2020, Some of these models have a habit of marking their flash as bad blocks, making them unusable. For more details see openwrt rb2011 page. Also, these devices have Routerboot, which is proprietary…}

2. Procedure This paper will not be a record of my work (though it took about 3 nights to compile this info). What it will be is a guide for others, or myself to install Openwrt on this router in the future. Let’s begin.

The general process will be the following:
\begin{verbatim}
1.) Run dnsmasq command which will start a DHCP server with
TFTP boot enabled
2.) Power off RB2011, Hold reset button, and power on.
Continue holding reset button until you see the DNSMasq
window report it has sent the file.
to the 64M or 128M (huge) mikrotik image. (Depending on how many flash chips you have – 1 or 2).
\end{verbatim}
Sounds simple? It should be! Millions of hours of engineering and manpower have gone into this, it better damn well be. But don’t be surprised if something unexpected occurs. I will cover some troubleshooting as well.

2.1. Run DHCP server with TFTP boot enabled I tend to make a shell command for the dhcp server command. It’s just one command, and will do all the gymnastics for you. Here we go:

\begin{verbatim}
//
#/bin/bash
#ifconfig eth0 192.168.1.10 up
sudo dnsmasq -i eth0 –dhcp-range=192.168.1.100,192.168.1.200 \
–dhcp-boot=openwrt-ar71xx-mikrotik-vmlinux-initramfs.elf \
–enable-tftp –tftp-root=~/directory/where/file/is/ \
)
{
/sites/ -> $(SEC_CRIT); } \end{verbatim} Now we will init, type \begin{verbatim} sudo tripwire –init sudo twadmin -m P /etc/tripwire/twpol.txt sudo tripwire –init \end{verbatim} to reconfigure twcfg.txt run \\ \textbf{/usr/sbin/twadmin –create-cfgfile -S site.key /etc/tripwire/twcfg.txt} if you get: \begin{verbatim} root@site:~# /usr/sbin/twadmin –create-cfgfile -S site.key /etc/tripwire/twcfg.txt # Error: File could not be opened. # Filename: /root/site.key # No such file or directory # Exiting… \end{verbatim} You must cd to /etc/tripwire directory. 2.2. Configuring SSMTP SSMTP is a program you configure once, and can reuse the configuration everywhere[3]. For starters, I’d recommend you install SSMTP according to this guide here: \begin{verbatim} https://wiki.zoneminder.com/How_to_get_ssmtp_working_with_Zoneminder \end{verbatim} This is a thorough guide that explains debugging. Some steps are superfluous (given that the instructions pertain to different software) but the general directions are sound. And afterwards sending an email is as easy as \\ \\ \textbf{echo “Hello, World” \textbar mail -s “My email check” user@email.com} \\ \\ This guide assumes you have configured SSMTP according to this guide correctly, tested it, and are able to mail from the command line. Once you’ve setup SSMTP once, you can reproduce this setup on other computers, simply by copying over the revaliases and ssmtp.conf of a valid configuration. So let’s do that. Copy over revaliases, and ssmtp.conf. test the configuration from the command line using the above echo and mail. Once that works, test out tripwire. \\ \\ \textbf{tripwire –test –email user@email.com} \\ \\ Done. 1. For a full walkthrough of this process see this URL:https://www.howtoforge.com/tutorial/how-to-monitor-and-detect-modified-files-using-tripwire-on-ubuntu-1604/ This process includes most, but not all of what you need to know. 2. This script appears to be required in this setup. 3. This is a strength of FOSS and let it remain that way. / Multiple Switches Can Slow a Network’s Internet Down 1. Overview A question is, can multiple network switches, slow down either the network or the WAN. The answer is yes. Let’s discuss a working example today. 2. The Previous IT Guys Today I was working at an office. They had a firewall connected to a Verizon FIOS modem. They had a gigabit [1]switch immediately downstream, and then a network cable ran about 50-75 feet to their office. Here they had another Gigabit switch, and then the cables went off to either computers or other switches. Let’s forget about what was downstream of that last switch except for the computers. 2.1. Internet Speeds The internet speed from the two computers in the office was about 10Mbps down and roughly the same upload. However, I tested the speed directly from the IT closet, and found 100Mbps down and 100Mbps up. At this point, it was a simple case of following the signal path and seeing where things slowed down. At least, I knew that they should be getting 100/100Mbps. 2.2. The Tests What I found is that as soon as I had two switches after the firewall [2]the speed would drop to 10/10. It was not dependent upon any brand of switch. I tried swapping from one other model that was available. The slowdown appeared to be switch independent. So in summary: • Firewall – computer – 100/100 • Firewall – switch – computer – 100/100 • Firewall – switch – 50 foot wire – computer – 100/100 • Firewall – switch – 50 foot wire – Switch A- computer – 10/10 • Firewall – switch – 50 foot wire – Switch B- computer – 10/10 What I did was remove the switch at the outside of the firewall. Now I had only Firewall – 50 foot wire – Switch – Computer – 100/100 3. Additional Background I’ve heard an IT person mention that he didn’t like multiple switches in network deployments, due to speed issues. On the other hand, I’ve setup Video Recording Networks with multiple switches all connecting serially to each other without issue. It seems that this is not a simple black and white issue. With the right hardware you may get away with it. Or if you avoid WAN access. In any case, the only way to know, is to test. 4. Conclusion If you are going to put > 1 switches downstream of the firewall, make sure to double check the WAN speed tests from just after the firewall, to at the very last switch. 1. Actually, all switches were gigabit, but it didn’t make a difference. 2. which has its own internal switch / Remove Domain on Windows Server and IIS doesn’t work I recently took down the domain from a server, and an application running on the same server’s IIS failed afterwards. One possible cause of this is due to the application running as a domain user. The solution: In application pools of IIS manager, change domain\user to a local account. Here, identity would have been one of Domain\user. / AutoSSH – a Reverse Proxy Alternative This document is best read printed out on paper. 1 Overview I recently added another apache server to an existing infrastructure, and I wanted it to be accessible under a similar IP as another server. Due to the complexity of the website, it was not possible to simply do a reverse proxy without knowing the correct settings (e.g. X-Forwarded for). Instead, AutoSSH was used. In the end, I accessed a new port on the existing IP. 2 Work Log Ok, I’m going to get right to the configs that I used. You want the tool, you don’t need to know all the details. 2.1 Crontab Here is the crontab script I used. I put this in /etc/crontab, so it has root after the times. I only use /etc/crontab, as it’s easier to manage. * * * * * root pgrep autossh > /dev/null || \ /usr/local/bin/autosshzm/autosshzm.sh A few notes about this. Pgrep will search for autossh. If it doesn’t find it, then it will try the next command. (—— is an OR). Put the bash script wherever you want. 2.2 Bash Script This script is obviously what the crontab calls. #!/bin/bash logger ” /usr/local/bin/autosshzm script started.” #source$HOME/.bash_profile #not needed.
source $HOME/.keychain/$HOSTNAME-sh
logger ” /usr/local/bin/autosshzm sourced.”
autossh
-L 0.0.0.0:2:localhost:80 -f user@ipaddress sleep 31536000
&> /var/log/autosshzm/autosshzm.log
1#autossh -M 0 -o “ServerAliveInterval 30” -o “ServerAliveCountMax 3”
/var/log/autosshzm/autosshzm.log
logger “auto ssh ran”

Note that the second autossh does not work, as it’s missing the sleep and
the -f command. 1 In order for this to work, you’ll also need the following
commands:

apt-get install keychain autossh

There were some more setup steps required for keychain… From stackex-
change:

25
keychain
solves this in a painless way. It’s in the repos for Debian/Ubuntu:
sudo apt-get install keychain
and perhaps for many other distros (it looks like it originated
from Gentoo).
This program will start an ssh-agent if none is running, and
provide shell scripts that can be sourced and connect the current
shell to this particular ssh-agent.
For bash, with a private key named id_rsa, add the following to
keychain –nogui id_rsa
This will start an ssh-agent and add the id_rsa key on the first
login after reboot. If the key is passphrase-protected, it will
also ask for the passphrase. No need to use unprotected keys
anymore! For subsequent logins, it will recognize the agent
and not ask for a passphrase again.
1
Figuring this kind of stuff out can take about an hour.
2. ~/.keychain/$HOSTNAME-sh This will let the shell know where to reach the SSH agent managed by keychain. Make sure that .bashrc is sourced from .profile. However, it seems that cron jobs still don’t see this. As a remedy, include the line above in the crontab, just before your actual command: * * * * * . ~/.keychain/$HOSTNAME-sh; your-actual-command

The only thing that I needed to do here was
keychain –nogui id rsa
The rest of it (notes about crontab) was not required.

3
What Did NOT Work
Here’s some things I tried that did not work.

• https://github.com/obfusk/autossh-init – This init script, didn’t do
much for me. Remember, I’m stuck with systemd in Ubuntu 19.04… 2
• Reverse proxy with Apache – As I said, my website 3 was too complex,
and I didn’t want to go down that rabbit hole.
• Starting AutoSSH in rc.local. Didn’t work.

2
The scourge of deleting software history. Keep backwards compatibility at ALL COSTS, developers.
3
Some people might call it a web application. I will not.
3

/

How to Factory Reset Polycom VVX 300 VOIP Phones

This is from memory and my notes, and may be incomplete, or have errors, but regardless…

Power Cycle the phone.

Hit Cancel on Boot screen (you will see an option to cancel by hitting one of the menu buttons while it’s booting).

Press 1+3+5, hold them down. NOTE: there is also a function where you can hit 3+5+7. One of these is the right one. I think it’s 1+3+5, but if that doesn’t bring you to a password prompt, try 3+5+7.

The password is the mac address. That is the easy part. The mac is on the phone on a sticker. The hard part is that you must enter letters in lower case. You can’t preview the letters, and since you have only a number pad, you have to understand how these interfaces typically work.

What there is, is a small icon on the menu that lets you change from numbers to upper case letters, to lower case letter, then back to numbers. So in order to change from number to lower case, you have to hit that button on the screen. And also, if you change back to numbers, you must hit the button again. So sometimes you might have to blindly hit a few keys. E.g. cat would be 1+1+1 (for c), a short pause, then 1 (for a), then whatever t is. But you can’t see the a going from a to b to c. It’s all hidden behind hashmarks for “security”. So you are blind and must press the buttons in the correct sequence. Horrible design, but the idea must be that only IT guys will ever work with the interface. They should be used to getting the short end of the administration stick, so will not be surprised. I was not be surprised, to be honest, just disappointed.

Configuration for Verizon VOIP

After you put the password in, you can factory reset, or possibly it does a factory reset automatically. Now the VOIP phone is back to its base mode. When it reboots you can now access the admin section, with the password “456”. For Verizon’s voip, the settings are:
Go somewhere in the network menus (I didn’t note where).

Enable ZTP
Server type - HTTPS
https://plcm.sipflash.com


Then I believe a reboot.

/

PrestaShop, Docker, SSL, Nginx Reverse Proxy

This is a common problem for Prestashop as viewed on the https://github.com/PrestaShop/docker and Prestashop forums. Here’s some configurations I found necessary to handle this. I was able to get it working. First off, there are a few files you need to keep in mind: The DB has two tables: ps_shop_url, ps_ssl_enabled, which must be edited manually. The nginx.conf must have the right settings (they can be the same as a wordpress reverse proxy, so start there). And it was necessary to set $_SERVER[‘HTTPS’] = ‘on’; in the prestashop_root/config/ folder under one of the defines. I used defines_custom.inc.php. I understand this is not best practice, but I got it to work. Interested users should research where it’s best to put custom edits for Prestashop. Here’s quickly some more notes: nginx.conf:# shopping site redirectserver {#server tokens hides the nginx identifying itselfserver_tokens off;server_name shop.mysite.com;listen 80; location ^~ /.well-known {alias /var/www/html/.well-known/;#autoindex on;}location / {##** nginx redirect ALL http requests to https ** ##return 301 https://$server_name$request_uri;#from gist mentioned below#rewrite ^ https://$host$request_uri? permanent;}}server {#server tokens hides the nginx identifying itselfserver_tokens off;server_name shop.mysite.com;#listen 80;listen 443 ssl;ssl_certificate /etc/letsencrypt/live/mysite.com/fullchain.pem;ssl_certificate_key /etc/letsencrypt/live/mysite.com/privkey.pem;location / {proxy_redirect off;proxy_pass http://prestashop;#these were from wp, but not usable here, according to:#https://gist.github.com/chroriginal/8d8ea7d284bcc42055a6ba18c04aeccfproxy_set_header X-Real-IP$remote_addr;proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;proxy_set_header Host$host;#this was from gist, but doesn't work.#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;#proxy_set_header Host$http_host;#proxy_set_header X-Forwarded-Proto https;#from git issues trackerproxy_connect_timeout 300;proxy_send_timeout 300;proxy_read_timeout 300;send_timeout 300;}}

Here is the docker-compose.yml:

version: '3'

services:
nginx:
image: nginx:latest
container_name: production_nginx
volumes:
- ./nginx.conf:/etc/nginx/nginx.conf
- /etc/letsencrypt/:/etc/letsencrypt/
- ./webroot/:/var/www/html/
ports:
#be careful with these. Port 80 on container side must match nginx listen port. the host side port, is only for the docker proxy.
- 80:80
- 443:443

restart: always
#    command: [nginx-debug, '-g', 'daemon off;']

db_prestashop:
image: mysql:5.7
environment:
- MYSQL_USER=xxxxxx
- MYSQL_DATABASE=prestashop
volumes:
- ./db_data_presta:/var/lib/mysql
- ./db_conf_presta:/etc/mysql/
restart: always

prestashop:
depends_on:
- db_prestashop
image: 'prestashop/prestashop'
volumes:
- ./presta_root:/var/www/html/
environment:
- DB_SERVER=db_prestashop
- VIRTUAL_HOST=https://URLHERE
- VIRTUAL_PORT=80
- PS_DOMAIN=https://URLHERE
- DB_NAME=prestashop
- DB_USER=xxxxxx
- DB_PASSWD=xxxxxx
restart=always


I don’t believe the DB_NAME or DB_USER variable is used in docker for prestashop. DB config is done at installation. Virtual host likewise, may not be necessary.

use prestashopSELECT NAME, VALUE FROM ps_configuration WHERE NAME IN ('PS_SSL_ENABLED', 'PS_SSL_ENABLED_EVERYWHERE');UPDATE ps_configuration SET VALUE = '1' WHERE NAME IN ('PS_SSL_ENABLED', 'PS_SSL_ENABLED_EVERYWHERE');SELECT NAME, VALUE FROM ps_configuration WHERE NAME IN ('PS_SSL_ENABLED', 'PS_SSL_ENABLED_EVERYWHERE');

Also, one other change on the DB. You should ensure that your shop URL is set to be something like URL.com
You do NOT want https://URL.com in either domain or domain\_ssl in ps\_shop\_url

mysql> select * from ps_shop_url;
+-------------+---------+--------------------------+--------------------------+--------------+-------------+------+--------+
| id_shop_url | id_shop | domain                   | domain_ssl               | physical_uri | virtual_uri | main | active |
+-------------+---------+--------------------------+--------------------------+--------------+-------------+------+--------+
|           1 |       1 | shop.steaky.com | shop.steaky.com | /            |             |    1 |      1 |
+-------------+---------+--------------------------+--------------------------+--------------+-------------+------+--------+
1 row in set (0.00 sec)

/

Firejail and MuPDF permissions error: “X Error of failed request: GLXBadContext”

Was setting up Firejail and MuPDF on Funtoo 1.3…

$firejail mupdf sample.pdf Reading profile /etc/firejail/mupdf.profile Reading profile /etc/firejail/disable-common.inc Reading profile /etc/firejail/disable-devel.inc Reading profile /etc/firejail/disable-interpreters.inc Reading profile /etc/firejail/disable-passwdmgr.inc Reading profile /etc/firejail/disable-programs.inc Reading profile /etc/firejail/disable-xdg.inc Reading profile /etc/firejail/whitelist-var-common.inc Parent pid 31753, child pid 31754 Private /etc installed in 82.08 ms Blacklist violations are logged to syslog Child process initialized in 235.06 ms libGL error: failed to open drm device: Permission denied libGL error: failed to load driver: i965 libGL error: unable to load driver: swrast_dri.so libGL error: failed to load driver: swrast X Error of failed request: GLXBadContext Major opcode of failed request: 150 (GLX) Minor opcode of failed request: 6 (X_GLXIsDirect) Serial number of failed request: 36 Current serial number in output stream: 35 Parent is shutting down, bye... After searching around online with other MuPDF issues (issues tracker, etc. I had some other ideas. $strace firejail mupdf sample.pdf

setresuid(-1, 0, -1) = -1 EPERM (Operation not permitted)
setresgid(-1, 0, -1) = -1 EPERM (Operation not permitted)
unlink("/run/firejail/bandwidth/31761-bandwidth") = -1 ENOENT (No such file or directory)
unlink("/run/firejail/network/31761-netmap") = -1 ENOENT (No such file or directory)
unlink("/run/firejail/name/31761") = -1 ENOENT (No such file or directory)
unlink("/run/firejail/x11/31761") = -1 ENOENT (No such file or directory)
unlink("/run/firejail/profile/31761") = -1 ENOENT (No such file or directory)
setresuid(-1, 1000, -1) = 0
setresgid(-1, 1000, -1) = 0
getppid() = 31759
setresuid(-1, 0, -1) = -1 EPERM (Operation not permitted)
setresgid(-1, 0, -1) = -1 EPERM (Operation not permitted)
openat(AT_FDCWD, "/proc/31759/comm", O_RDONLY) = 3
close(3) = 0
setresuid(-1, 1000, -1) = 0
setresgid(-1, 1000, -1) = 0
getuid() = 1000
geteuid() = 1000
getuid() = 1000
geteuid() = 1000
getuid() = 1000
geteuid() = 1000
openat(AT_FDCWD, "/etc/firejail/firejail.config", O_RDONLY) = 3
fstat(3, {st_mode=S_IFREG|0644, st_size=4395, ...}) = 0
read(3, "# This is Firejail system-wide c"..., 4096) = 4096
read(3, " third dimension is\n# color dept"..., 4096) = 299
close(3) = 0
getuid() = 1000
geteuid() = 1000
getuid() = 1000
geteuid() = 1000
getuid() = 1000
geteuid() = 1000
getuid() = 1000
stat("/bin/bash/", 0x7ffe9b611270) = -1 ENOTDIR (Not a directory)
stat("/bin/bash", {st_mode=S_IFREG|0755, st_size=926688, ...}) = 0
access("/bin/bash", X_OK) = 0
getuid() = 1000
geteuid() = 1000
openat(AT_FDCWD, "/home/farm/.config/firejail", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = -1 ENOENT (No such
file or directory)
getuid() = 1000
geteuid() = 1000
openat(AT_FDCWD, "/etc/firejail", O_RDONLY|O_NONBLOCK|O_CLOEXEC|O_DIRECTORY) = 3
fstat(3, {st_mode=S_IFDIR|0755, st_size=32768, ...}) = 0
getdents(3, /* 566 entries */, 32768) = 22808
getuid() = 1000
geteuid() = 1000
stat("/etc/firejail/mupdf.profile/", 0x7ffe9b60f0d0) = -1 ENOTDIR (Not a directory)
access("/etc/firejail/mupdf.profile", R_OK) = 0
openat(AT_FDCWD, "/etc/firejail/mupdf.profile", O_RDONLY) = 4
getpid() = 31761
setresuid(-1, 0, -1) = -1 EPERM (Operation not permitted)
setresgid(-1, 0, -1) = -1 EPERM (Operation not permitted)
openat(AT_FDCWD, "/run/firejail/profile/31761", O_WRONLY|O_CREAT|O_TRUNC, 0666) = -1 EACCES (Permission denied)
write(2, "Error: cannot create /run/fireja"..., 49Error: cannot create /run/firejail/profile/31761
) = 49
setresuid(-1, 0, -1) = -1 EPERM (Operation not permitted)
setresgid(-1, 0, -1) = -1 EPERM (Operation not permitted)
getpid() = 31761
unlink("/run/firejail/bandwidth/31761-bandwidth") = -1 ENOENT (No such file or directory)
unlink("/run/firejail/network/31761-netmap") = -1 ENOENT (No such file or directory)
unlink("/run/firejail/name/31761") = -1 ENOENT (No such file or directory)
unlink("/run/firejail/x11/31761") = -1 ENOENT (No such file or directory)
unlink("/run/firejail/profile/31761") = -1 ENOENT (No such file or directory)
exit_group(1) = ?
+++ exited with 1 +++

It looks like the error is:
write(2, “Error: cannot create /run/fireja”…, 49Error: cannot create /run/firejail/profile/31761
) = 49

Solution

In gentoo, the mupdf profile  in /etc/firejail/has

# Firejail profile for mupdf
# Description: Lightweight PDF viewer
# This file is overwritten after every install/update
# Persistent local customizations
include /etc/firejail/mupdf.local
# Persistent global definitions
include /etc/firejail/globals.local

noblacklist ${DOCUMENTS} include /etc/firejail/disable-common.inc include /etc/firejail/disable-devel.inc include /etc/firejail/disable-interpreters.inc include /etc/firejail/disable-passwdmgr.inc include /etc/firejail/disable-programs.inc include /etc/firejail/disable-xdg.inc include /etc/firejail/whitelist-var-common.inc caps.drop all machine-id net none nodbus nodvd nogroups nonewprivs noroot nosound notv novideo protocol unix seccomp # seccomp.keep access,arch_prctl,brk,clone,close,connect,execve,exit_group,fchmod,fchown,fcntl,fstat,futex,getcwd,getpeername,getrlimit,getsock$
shell none
tracelog

# private-bin mupdf,sh,tempfile,rm
private-dev
private-etc fonts
private-tmp

# mupdf will never write anything
read-only ${HOME} However, the private-etc fonts will cause this error. This was found by brute force troubleshooting (delete entries from profile, until it works). Comment it out, and MuPDF should display correctly. now you will get:$ firejail mupdf sample.pdf
libGL error: failed to load driver: i965