Skynet Software Wiki:Setup Pi

Setting up a Raspberry Pi

1. Insert a 16GB or larger MicroSD Card into your computer.
2. Download and open the Raspberry Pi Imager software. (Latest version as of the last edit of this Wiki: 1.8.5)
   1. Raspberry Pi Device - Choose the correct Raspberry Pi Device from the drop down
   2. Operating System - If the Raspberry Pi is being used as a:
      • Clocking In / Dispatch device, choose "Raspberry Pi OS (32-bit)".
      • Print Server, choose "Raspberry Pi OS Lite (32-bit)" under 'Raspberry Pi OS (Other)'.
   3. Storage: ensure you choose the MicroSD Card to install to from the drop down list.
3. Click 'NEXT'.
   1. The Imager should offer to 'use OS customisation' - click 'EDIT SETTINGS'. (if it doesn't, close the Imager software and try again)
   2. General Tab
      1. Tick 'Set hostname:' and input the hostname into the box.
      2. Tick 'Set username and password'.
      3. Set the Username as 'skynet'.
      4. Set a password and keep a note of it.
   3. If the Raspberry Pi will be connected to WiFi and you have the details:
      1. Tick 'Configure wireless LAN'.
      2. Enter the 'SSID'.
      3. Enter the 'Password'.
      4. Leave Wireless LAN country as 'GB'.
      5. Tick 'Set locale settings'.
   4. Services Tab
      1. Tick 'Enable SSH'.
      2. Click 'Use password authentication'.
4. Click 'SAVE'.
5. Click 'YES', then assuming you have the correct MicroSD Card selected, click 'YES' again.
6. The Imager software will then download & install the Raspberry Pi OS to the MicroSD Card. This may take a few minutes.
7. Once it's installed, remove the MicroSD Card from the computer and insert it into the Raspberry Pi.
8. Plug the Raspberry Pi into its PSU and plug an Ethernet Cable into it (or wait for the WiFi to connect).
9. Username: skynet, Password: as set above.
10. Note the IP address of the Raspberry Pi (run "ifconfig" if it doesn't show).
11. Run the following commands:
    1. sudo su
    2. apt purge wolfram-engine scratch nuscratch sonic-pi idle3 smartsim java-common libreoffice* -y
    3. apt clean
    4. apt autoremove -y
    5. apt update -y
    6. apt full-upgrade -y
    7. apt dist-upgrade -y
    8. apt install xdotool unclutter sed ufw fail2ban cups -y
12. Then run command 'raspi-config' - Only change the following options:
    1. 1 System Options
       1. S5 - Boot / Auto Login - If the Raspberry Pi is being used as a:
          • Print Server: Choose "B1 Console"
          • Clocking In or Dispatch device: Choose "B4 Desktop Autologin"
       2. S6 Network at Book
          1. Set to "Yes"
       3. S7 Splash Screen (ignore this if the Raspberry Pi is being used as a Print Server)
          1. Set to "No"
    2. 3 Interface Options
       1. I2
          1. Set to "Yes"
       2. I1, I3, I4, I5, I7, I8
          1. Set all to "No"
       3. I6
          1. Set to "No" then "No" again
    3. 6 Advanced Options
       1. A1 Expand Filesystem
          1. Run this

The Raspberry Pi should then ask if you want to reboot - choose "Yes". If it doesn't, run command "shutdown -r now" and wait for it to reboot.

Securing SSH and setting up the UFW firewall

For further reference, see CUPS UFW Firewall page

1. sudo su
2. nano /etc/ssh/sshd_config
   • Add "AllowUsers skynet"
3. Hold Ctrl and press X
4. Press Y
5. Press Enter
6. systemctl restart ssh
7. ufw allow from 51.68.205.35 proto tcp to any port 22,53,631,5353 (Xenon)
8. ufw allow from 145.239.254.22 proto tcp to any port 22,53,631,5353 (Concorde)
9. ufw allow from 81.137.221.179 proto tcp to any port 22,53,631,5353 (Office)
10. ufw allow from 20.162.248.196 proto tcp to any port 22,53,631,5353 (Nathan Virtual PC)
11. ufw allow from 217.155.89.132 proto tcp to any port 22,53,631,5353 (Matt Home)
12. ufw allow from 20.26.237.137 proto tcp to any port 22,53,631,5353 (Matt Virtual PC)
13. ufw allow from 192.168.0.0/16 proto tcp to any port 22,53,631,5353 (Local)
14. ufw allow from Customer's IP Address proto tcp to any port 22,53,631,5353
15. ufw limit ssh/tcp (This will block attackers who have connected more than 5 times in 30 seconds)
16. ufw enable

Setting up fail2ban for SSH

1. cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
2. nano /etc/fail2ban/jail.local
3. find:

# "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban
# will not ban a host which matches an address in this list. Several addresses
# can be defined using space (and/or comma) separator.
#ignoreip =  127.0.0.1/8::1

1. Remove the # before #ignoreip
2. Remove 127.0.0.1/8 - leave the "::1" at the end
3. Add 51.68.205.35 145.239.254.22 81.137.221.179 meadowview.zapto.org 192.168.0.0/16 - leave the "::1" at the end
4. Then find:

# "bantime" is the number of seconds that a host is banned.
bantime  = 10m

1. Change 10m to 1y
2. Then find:

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 10m

1. Change 10m to 1y
2. Then find:

# "maxretry" is the number of failures before a host get banned.
maxretry = 5

1. Change 5 to 3
2. Then find:

#
# JAILS
#

#
# SSH servers
#

[sshd]

# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
# normal (default), ddos, extra or aggressive (combines all).
# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
#mode   = normal
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

Add the following below it:

[ssh]
 enabled  = true
 port     = ssh
 filter   = sshd
 logpath  = /var/log/auth.log
 maxretry = 3
 bantime  = 1y

1. Hold Ctrl and press X
2. Press Y
3. Press Enter

Fail2Ban must be restarted to load the new settings:

1. service fail2ban restart

Setup CUPS

1. usermod -a -G lpadmin skynet
2. cupsctl --remote-any
3. https://{internal_ip}:631 -> "Edit Configuration" and add this line to the bottom:

MaxJobs 0

1. Find "<Location />" and "<Location /admin>" and replace the content inside both areas with (don't remove "</Location />" and "</Location /admin>"):

Order allow,deny
Allow from localhost
Allow from 51.68.205.35
Allow from 145.239.254.22
Allow from 81.137.221.179
Allow from 20.162.248.196
Allow from 217.155.89.132
Allow from 20.26.237.137
Allow from 192.168.*
Allow from <Customers' IP Address>

1. Further below find "<Location /admin/log>" and add the following below "Require user @SYSTEM" (don't remove "</Location /admin/log>"):

Order allow,deny
Allow @LOCAL
Allow from localhost
Allow from 51.68.205.35
Allow from 145.239.254.22
Allow from 81.137.221.179
Allow from 20.162.248.196
Allow from 217.155.89.132
Allow from 20.26.237.137
Allow from 192.168.*
Allow from <Customers' IP Address>

1. Click "Save Changes".

Add label printer to CUPS on the Raspberry Pi - Zebra GK420d

USB

1. https://{Raspberry Pi IP}:631 (change IP as required, user/pass is the skynet one)
2. Click "Administration" then "Add Printer".
   1. Select "Zebra Technologies ZTC GK420d (Zebra Technologies ZTC GK420d)" from the "Local Printers" list then click "Continue".
   2. Change "Name" to something simple - e.g. customer01, Description/Location as required and tick "Share This Printer" then click "Continue".
   3. Model - Select "Zebra ZPL Label Printer (en)" then click "Add Printer".
3. On Default Options:
   1. Media Size -> "4.00x6.00"
   2. Resolution -> "203dpi"
   3. "Set Default Options".

If you need to change the Default Options:
"Administration" -> "Manage Printers" -> click the printer -> "Administration" -> "Set Default Options"

Ethernet

1. https://{Raspberry Pi IP}:631 (change IP as required, user/pass is the skynet one)
2. Click "Administration" then "Add Printer".
   1. Select "AppSocket/HP JetDirect" from the "Other Network Printers:" list then click Continue.
   2. Put "socket://<IP Address of printer> into the "Connection:" box then click "Continue".
   3. Change "Name" to something simple - e.g. customer01, Description/Location as required, tick "Share This Printer" then click "Continue".
   4. Make - Select "Zebra".
   5. Model - Select "Zebra ZPL Label Printer (en)" and click "Add Printer".
3. On Default Options:
   1. Media Size -> "4.00x6.00"
   2. Resolution -> "203dpi"
   3. "Set Default Options".

If you need to change the Default Options:
"Administration" -> "Manage Printers" -> click the printer -> "Administration" -> "Set Default Options"

Add A4 printer to CUPS on the Raspberry Pi

Ethernet

1. https://{Raspberry Pi IP}:631 (change IP as required, user/pass is the skynet one)
2. Click "Administration" then "Add Printer".
   1. Find the printer in the "Discovered Network Printers" list then click Continue.
   2. Change "Name" to something simple - e.g. customer01, Description/Location as required, tick "Share This Printer" then click "Continue".
   3. Make should be pre-selected to the make of the printer.
   4. Model - The top option should be the correct one and match the make & model of the printer. If it also shows as "CUPS+Gutenprint vx.x.x (en)" that's the best one.
3. On Default Options:
   1. Media Size -> "A4"
   2. Resolution -> "Automatic"
   3. 2-Sided Printing -> If the customer wants this on, set it as "Long Edge (Standard)" otherwise set it to "Off".
   4. "Set Default Options".

If you need to change the Default Options:
"Administration" -> "Manage Printers" -> click the printer -> "Administration" -> "Set Default Options"

File Change To Stop Right Side of Page Being Cut Off

1. cd /etc/cups/ppd
2. nano printer_name.ppd
3. Find "*DefaultImageableArea: A4"
4. Find "*ImageableArea A4/A4: "10.000 12.000 585.000 830.000"" a few lines down from the above line.
5. Change the numbers to "18.000 20.000 593.000 838.000".
6. Hold Ctrl and press X
7. Press Y
8. Press Enter

Customer Firewall Setup

Now make sure the following ports are forwarded to the printer from the external firewall (change as required) - if any of these are changed, you will need to change the above steps as well.

1. 631. 53. 5353 for cups (TCP and UDP)
2. 22 for ssh (TCP)

Add Printer to Skynet (Xenon)

Normal ZPL Driver

1. http://xenon.genisys-systems.co.uk:631/
2. "Administration" -> "Add Printer" -> "Internet Printing Protocol (ipp)"
3. ipp://skynet:{password}@{public_ip_address}:631/printers/{name}
4. Name - Use our standard naming convention.
5. Make - Select "Generic".
6. Model - Select "Generic PDF Printer (en)".
7. On Default Options:
   1. Resolution to 300 dpi
   2. Override A4 with Letter to "No"
   3. "Set Default Options"

If you need to change the Default Options:
"Administration" -> "Manage Printers" -> click the printer -> "Administration" -> "Set Default Options"

EPL Driver (for DPD/UPS)

1. http://xenon.genisys-systems.co.uk:631/
2. "Administration" -> "Add Printer" -> "Internet Printing Protocol (ipp)"
3. ipp://skynet:{password}@{public_ip_address}:631/printers/{name}
4. Name - as above but with "_dpd" on the end of it.
5. Make - Select "Raw".
6. Model - Select "Raw Queue".

You will experience messages such as PPD errors, semi-colon errors etc. but this is normal for a RAW printer. No further setup is required.

After Testing

Once all of the above has been completed, you can test a print locally.

Setting up the Raspberry Pi as a Kiosk

1. sudo nano /home/skynet/kiosk.sh

#!/bin/bash
export DISPLAY=:0
xset s noblank
xset s off
xset -dpms
unclutter -idle 0.5 -root &
sed -i 's/"exited_cleanly":false/"exited_cleanly":true/' /home/skynet/.config/chromium/Default/Preferences
sed -i 's/"exit_type":"Crashed"/"exit_type":"Normal"/' /home/skynet/.config/chromium/Default/Preferences
/usr/bin/chromium-browser --noerrdialogs --disable-infobars --kiosk http://{company}.genisys-systems.co.uk/tablet_scan.php &

1. Hold Ctrl and press X
2. Press Y
3. Press Enter
4. sudo nano /lib/systemd/system/kiosk.service

 [Unit]
 Description=Chromium Kiosk
 Wants=graphical.target
 After=graphical.target

 [Service]
 Environment=DISPLAY=:0.0
 Environment=XAUTHORITY=/home/skynet/.Xauthority
 Type=simple
 ExecStart=/bin/bash /home/skynet/kiosk.sh
 Restart=on-abort
 User=skynet
 Group=skynet

 [Install]
 WantedBy=graphical.target

1. Hold Ctrl and press X
2. Press Y
3. Press Enter
4. sudo systemctl enable kiosk.service
5. sudo systemctl start kiosk.service
6. sudo nano /home/skynet/.config/autostart/kiosk.desktop

[Desktop Entry]
Type=Application
Name=Kiosk
Exec=/home/skynet/kiosk.sh
X-GNOME-Autostart-enabled=true

1. Hold Ctrl and press X
2. Press Y
3. Press Enter
4. sudo chmod 755 kiosk.sh
5. sudo chown skynet:skynet kiosk.sh

Debugging

Found by Ncroker:

This page has some cool debugging stuff: https://wiki.ubuntu.com/DebuggingPrintingProblems
It's for Ubuntu, but still seems to work on Xenon/The Raspberry Pi.