Christian Rotzoll
6 years ago
16 changed files with 614 additions and 85 deletions
@ -0,0 +1,231 @@ |
|||
#!/usr/bin/python3 |
|||
|
|||
import sys, subprocess, re |
|||
from pathlib import Path |
|||
|
|||
# IDEA: At the momemt its just Reverse-SSh Tunnels thats why [INTERNAL-PORT]<[EXTERNAL-PORT] |
|||
# For the future also just local ssh tunnels could be added with [INTERNAL-PORT]-[EXTERNAL-PORT] |
|||
# for the use case when a server wants to use a RaspiBlitz behind a NAT as Lightning backend |
|||
|
|||
# display config script info |
|||
if len(sys.argv) <= 1 or sys.argv[1] == "-h" or sys.argv[1] == "help": |
|||
print("forward ports from another server to raspiblitz with reverse SSH tunnel") |
|||
print("internet.sshtunnel.py [on|off|restore] [USER]@[SERVER] \"[INTERNAL-PORT]<[EXTERNAL-PORT]\"") |
|||
print("note that [INTERNAL-PORT]<[EXTERNAL-PORT] can one or multiple forwardings") |
|||
sys.exit(1) |
|||
|
|||
# |
|||
# CONSTANTS |
|||
# sudo journalctl -f -u autossh-tunnel |
|||
# |
|||
|
|||
SERVICENAME="autossh-tunnel.service" |
|||
SERVICEFILE="/etc/systemd/system/"+SERVICENAME |
|||
SERVICETEMPLATE="""# see config script internet.sshtunnel.py |
|||
[Unit] |
|||
Description=AutoSSH tunnel service |
|||
After=network.target |
|||
|
|||
[Service] |
|||
User=root |
|||
Group=root |
|||
Environment="AUTOSSH_GATETIME=0" |
|||
ExecStart=/usr/bin/autossh -M 0 -N -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -o "ServerAliveInterval 30" -o "ServerAliveCountMax 3" [PLACEHOLDER] |
|||
StandardOutput=journal |
|||
|
|||
[Install] |
|||
WantedBy=multi-user.target |
|||
""" |
|||
|
|||
# get LND port form lnd.conf |
|||
LNDPORT = subprocess.getoutput("sudo cat /mnt/hdd/lnd/lnd.conf | grep '^listen=*' | cut -f2 -d':'") |
|||
if len(LNDPORT) == 0: |
|||
LNDPORT="9735" |
|||
|
|||
# |
|||
# RESTORE = SWITCHING ON with restore flag on |
|||
# on restore other external scripts dont need calling |
|||
# |
|||
|
|||
forwardingLND = False |
|||
restoringOnUpdate = False |
|||
if sys.argv[1] == "restore": |
|||
print("internet.sshtunnel.py -> running with restore flag") |
|||
sys.argv[1] = "on" |
|||
restoringOnUpdate = True |
|||
|
|||
# |
|||
# SWITCHING ON |
|||
# |
|||
|
|||
if sys.argv[1] == "on": |
|||
|
|||
# check if already running |
|||
isRunning = subprocess.getoutput("sudo systemctl --no-pager | grep -c '%s'" % (SERVICENAME)) |
|||
if int(isRunning) > 0: |
|||
print("SSH TUNNEL ALREADY ACTIVATED - run 'internet.sshtunnel.py off' first to set new tunnel") |
|||
sys.exit(1) |
|||
|
|||
# check server address |
|||
if len(sys.argv) < 3: |
|||
print("[USER]@[SERVER] missing - use 'internet.sshtunnel.py -h' for help") |
|||
sys.exit(1) |
|||
if sys.argv[2].count("@") != 1: |
|||
print("[USER]@[SERVER] wrong - use 'internet.sshtunnel.py -h' for help") |
|||
sys.exit(1) |
|||
ssh_server = sys.argv[2] |
|||
|
|||
# genenate additional parameter for autossh (forwarding ports) |
|||
if len(sys.argv) < 4: |
|||
print("[INTERNAL-PORT]<[EXTERNAL-PORT] missing") |
|||
sys.exit(1) |
|||
ssh_ports="" |
|||
additional_parameters="" |
|||
i = 3 |
|||
while i < len(sys.argv): |
|||
|
|||
# check forwarding format |
|||
if sys.argv[i].count("<") != 1: |
|||
print("[INTERNAL-PORT]<[EXTERNAL-PORT] wrong format '%s'" % (sys.argv[i])) |
|||
sys.exit(1) |
|||
|
|||
# get ports |
|||
sys.argv[i] = re.sub('"','', sys.argv[i] ) |
|||
ports = sys.argv[i].split("<") |
|||
port_internal = ports[0] |
|||
port_external = ports[1] |
|||
if port_internal.isdigit() == False: |
|||
print("[INTERNAL-PORT]<[EXTERNAL-PORT] internal not number '%s'" % (sys.argv[i])) |
|||
sys.exit(1) |
|||
if port_external.isdigit() == False: |
|||
print("[INTERNAL-PORT]<[EXTERNAL-PORT] external not number '%s'" % (sys.argv[i])) |
|||
sys.exit(1) |
|||
if port_internal == LNDPORT: |
|||
forwardingLND = True |
|||
if port_internal != port_external: |
|||
print("FAIL: When tunneling your local LND port '%s' it needs to be the same on the external server, but is '%s'" % (LNDPORT,port_external)) |
|||
print("Try again by using the same port. If you cant change the external port, change local LND port with: /home/admin/config.scripts/lnd.setport.sh") |
|||
sys.exit(1) |
|||
|
|||
ssh_ports = ssh_ports + "\"%s\" " % (sys.argv[i]) |
|||
additional_parameters= additional_parameters + "-R %s:localhost:%s " % (port_external,port_internal) |
|||
i=i+1 |
|||
|
|||
# genenate additional parameter for autossh (server) |
|||
ssh_ports = ssh_ports.strip() |
|||
additional_parameters= additional_parameters + ssh_server |
|||
|
|||
# generate custom service config |
|||
service_data = SERVICETEMPLATE.replace("[PLACEHOLDER]", additional_parameters) |
|||
|
|||
# debug print out service |
|||
print() |
|||
print("*** New systemd service: %s" % (SERVICENAME)) |
|||
print(service_data) |
|||
|
|||
# write service file |
|||
service_file = open("/home/admin/temp.service", "w") |
|||
service_file.write(service_data) |
|||
service_file.close() |
|||
subprocess.call("sudo mv /home/admin/temp.service %s" % (SERVICEFILE), shell=True) |
|||
|
|||
# check if SSH keys for root user need to be created |
|||
print() |
|||
print("*** Checking root SSH pub keys") |
|||
ssh_pubkey="" |
|||
try: |
|||
ssh_pubkey = subprocess.check_output("sudo cat /root/.ssh/id_rsa.pub", shell=True, universal_newlines=True) |
|||
print("OK - root id_rsa.pub file exists") |
|||
except subprocess.CalledProcessError as e: |
|||
print("Generating root SSH keys ...") |
|||
subprocess.call("sudo sh -c 'yes y | sudo -u root ssh-keygen -b 2048 -t rsa -f ~/.ssh/id_rsa -q -N \"\"'", shell=True) |
|||
ssh_pubkey = subprocess.check_output("sudo cat /root/.ssh/id_rsa.pub", shell=True, universal_newlines=True) |
|||
|
|||
# copy SSH keys for backup (for update with new sd card) |
|||
print("making backup copy of SSH keys") |
|||
subprocess.call("sudo cp -r /root/.ssh /mnt/hdd/ssh/root_backup", shell=True) |
|||
print("DONE") |
|||
|
|||
# write ssh tunnel data to raspiblitz config (for update with new sd card) |
|||
print("*** Updating RaspiBlitz Config") |
|||
with open('/mnt/hdd/raspiblitz.conf') as f: |
|||
file_content = f.read() |
|||
if file_content.count("sshtunnel=") == 0: |
|||
file_content = file_content+"\nsshtunnel=''" |
|||
file_content = re.sub("sshtunnel=.*", "sshtunnel='%s %s'" % (ssh_server, ssh_ports), file_content) |
|||
if restoringOnUpdate == False: |
|||
serverdomain=ssh_server.split("@")[1] |
|||
# make sure serverdomain is set as tls alias |
|||
print("Setting server as tls alias and generating new certs") |
|||
subprocess.call("sudo sed -i \"s/^#tlsextradomain=.*/tlsextradomain=/g\" /mnt/hdd/lnd/lnd.conf", shell=True) |
|||
subprocess.call("sudo sed -i \"s/^tlsextradomain=.*/tlsextradomain=%s/g\" /mnt/hdd/lnd/lnd.conf" % (serverdomain), shell=True) |
|||
subprocess.call("sudo /home/admin/config.scripts/lnd.newtlscert.sh", shell=True) |
|||
if forwardingLND: |
|||
# setting server explicitly on LND if LND port is forwarded |
|||
print("Setting server domain for LND Port") |
|||
subprocess.call("sudo /home/admin/config.scripts/lnd.setaddress.sh on %s" % (serverdomain), shell=True) |
|||
file_content = "".join([s for s in file_content.splitlines(True) if s.strip("\r\n")]) + "\n" |
|||
print(file_content) |
|||
with open("/mnt/hdd/raspiblitz.conf", "w") as text_file: |
|||
text_file.write(file_content) |
|||
print("DONE") |
|||
|
|||
# make sure autossh is installed |
|||
# https://www.everythingcli.org/ssh-tunnelling-for-fun-and-profit-autossh/ |
|||
print() |
|||
print("*** Install autossh") |
|||
subprocess.call("sudo apt-get install -y autossh", shell=True) |
|||
|
|||
# enable service |
|||
print() |
|||
print("*** Enabling systemd service: %s" % (SERVICENAME)) |
|||
subprocess.call("sudo systemctl daemon-reload", shell=True) |
|||
subprocess.call("sudo systemctl enable %s" % (SERVICENAME), shell=True) |
|||
|
|||
# final info (can be ignored if run by other script) |
|||
print() |
|||
print("**************************************") |
|||
print("*** WIN - SSH TUNNEL SERVICE SETUP ***") |
|||
print("**************************************") |
|||
print("See chapter 'How to setup port-forwarding with a SSH tunnel?' in:") |
|||
print("https://github.com/rootzoll/raspiblitz/blob/master/FAQ.md") |
|||
print("- Tunnel service needs final reboot to start.") |
|||
print("- After reboot check logs: sudo journalctl -f -u %s" % (SERVICENAME)) |
|||
print("- Make sure the SSH pub key of this RaspiBlitz is in 'authorized_keys' of %s :" % (ssh_server)) |
|||
print(ssh_pubkey) |
|||
print() |
|||
|
|||
# |
|||
# SWITCHING OFF |
|||
# |
|||
|
|||
elif sys.argv[1] == "off": |
|||
|
|||
print("*** Disabling systemd service: %s" % (SERVICENAME)) |
|||
subprocess.call("sudo systemctl stop %s" % (SERVICENAME), shell=True) |
|||
subprocess.call("sudo systemctl disable %s" % (SERVICENAME), shell=True) |
|||
subprocess.call("sudo rm %s" % (SERVICEFILE), shell=True) |
|||
subprocess.call("sudo systemctl daemon-reload", shell=True) |
|||
print("OK Done") |
|||
print() |
|||
|
|||
print("*** Removing LND Address") |
|||
subprocess.call("sudo /home/admin/config.scripts/lnd.setaddress.sh off", shell=True) |
|||
print() |
|||
|
|||
print("*** Removing SSH Tunnel data from RaspiBlitz config") |
|||
with open('/mnt/hdd/raspiblitz.conf') as f: |
|||
file_content = f.read() |
|||
file_content = re.sub("sshtunnel=.*", "", file_content) |
|||
file_content = re.sub("\n\n", "\n", file_content) |
|||
print(file_content) |
|||
with open("/mnt/hdd/raspiblitz.conf", "w") as text_file: |
|||
text_file.write(file_content) |
|||
print("OK Done") |
|||
|
|||
# |
|||
# UNKOWN PARAMETER |
|||
# |
|||
|
|||
else: |
|||
print ("unkown parameter - use 'internet.sshtunnel.py -h' for help") |
|||
@ -0,0 +1,83 @@ |
|||
#!/bin/bash |
|||
|
|||
# INFO : Does not need to be part of update/provision, because |
|||
# all data is already on HDD ready |
|||
|
|||
# command info |
|||
if [ $# -eq 0 ] || [ "$1" = "-h" ] || [ "$1" = "-help" ]; then |
|||
echo "small config script to set a fixed domain or IP for LND" |
|||
echo "internet.dyndomain.sh [on|off] [?address]" |
|||
exit 1 |
|||
fi |
|||
|
|||
# 1. parameter [on|off] |
|||
mode="$1" |
|||
|
|||
echo "number of args($#)" |
|||
|
|||
# config file |
|||
configFile="/mnt/hdd/raspiblitz.conf" |
|||
|
|||
# lnd conf file |
|||
lndConfig="/mnt/hdd/lnd/lnd.conf" |
|||
|
|||
# check if config file exists |
|||
configExists=$(ls ${configFile} | grep -c '.conf') |
|||
if [ ${configExists} -eq 0 ]; then |
|||
echo "FAIL - missing ${configFile}" |
|||
exit 1 |
|||
fi |
|||
|
|||
# FIXED DOMAIN/IP |
|||
if [ "${mode}" = "on" ]; then |
|||
|
|||
address=$2 |
|||
if [ ${#address} -eq 0 ]; then |
|||
echo "missing parameter" |
|||
exit 1 |
|||
fi |
|||
|
|||
echo "switching fixed LND Domain ON" |
|||
echo "address(${address})" |
|||
|
|||
# setting value in raspi blitz config |
|||
sudo sed -i "s/^lndAddress=.*/lndAddress='${address}'/g" /mnt/hdd/raspiblitz.conf |
|||
|
|||
echo "changing lnd.conf" |
|||
|
|||
# lnd.conf: uncomment tlsextradomain (just if it is still uncommented) |
|||
sudo sed -i "s/^#tlsextradomain=.*/tlsextradomain=/g" /mnt/hdd/lnd/lnd.conf |
|||
|
|||
# lnd.conf: domain value |
|||
sudo sed -i "s/^tlsextradomain=.*/tlsextradomain=${address}/g" /mnt/hdd/lnd/lnd.conf |
|||
|
|||
# refresh TLS cert |
|||
sudo /home/admin/config.scripts/lnd.newtlscert.sh |
|||
|
|||
echo "fixedAddress is now ON" |
|||
fi |
|||
|
|||
# switch off |
|||
if [ "${mode}" = "off" ]; then |
|||
echo "switching fixedAddress OFF" |
|||
|
|||
# stop services |
|||
echo "making sure services are not running" |
|||
sudo systemctl stop lnd 2>/dev/null |
|||
|
|||
# setting value in raspi blitz config |
|||
sudo sed -i "s/^lndAddress=.*/lndAddress=/g" /mnt/hdd/raspiblitz.conf |
|||
|
|||
echo "changing lnd.conf" |
|||
|
|||
# lnd.conf: comment tlsextradomain out |
|||
sudo sed -i "s/^tlsextradomain=.*/#tlsextradomain=/g" /mnt/hdd/lnd/lnd.conf |
|||
|
|||
# refresh TLS cert |
|||
sudo /home/admin/config.scripts/lnd.newtlscert.sh |
|||
|
|||
echo "fixedAddress is now OFF" |
|||
fi |
|||
|
|||
echo "may needs reboot to run normal again" |
|||
exit 0 |
|||
Loading…
Reference in new issue