Skynet Software Wiki:Setup Pi

Setting up a Raspberry Pi

1. Put the Pi together.
2. Connect to WiFi / Cable.
3. Select "Raspberry Pi OS Lite"
4. user pi, password raspberry
5. Note the IP address
6. sudo apt-get update
7. sudo apt-get upgrade
8. passwd - and note the new password.
9. sudo raspi-confi
   1. Interface Options
      • P1, P3, P4, P5, P7, P8 - All "No".
      • P6 - Set to "No" then "No" again.
      • P2 - Set to "Yes"
   2. Localisation Options
      • Timezone - set to "Europe" then "London".
      • WLAN Country - set to "GB".
      • Locale - set to "en_GB.UTF-8"

Setting up a new internal user

1. sudo adduser skynet - note the new password.
2. sudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,gpio,i2c,spi skynet
3. "sudo su - skynet" - double check this works fine.
4. Logout of SSH and re-login as skynet.
5. sudo pkill -u pi

Securing SSH and setting up the UFW firewall

For further reference, see https://www.cups.org/doc/firewalls.html 1. sudo nano /etc/ssh/sshd_config 1a. Add "AllowUsers skynet" 2. sudo systemctl restart ssh 3. sudo apt install ufw 4. sudo ufw allow ssh 5. sudo ufw allow 631 6. sudo ufw allow 5353 7. sudo ufw allow 53 8. sudo ufw enable 9. sudo ufw limit ssh/tcp 10. sudo ufw allow from 84.92.64.163 to any port 22 - Plusnet 11. sudo ufw allow from 212.140.134.122 to any port 22 - Lea House 12. sudo ufw allow from 217.182.136.107 to any port 22 - Recon 13. sudo ufw allow from 192.168.0.0/16 to any port 22 14. sudo ufw allow from 84.92.64.163 to any port 631 15. sudo ufw allow from 212.140.134.122 to any port 631 16. sudo ufw allow from 217.182.136.107 to any port 631 17. sudo ufw allow from 192.168.0.0/16 to any port 631 18. sudo ufw allow from 84.92.64.163 to any port 5353 19. sudo ufw allow from 212.140.134.122 to any port 5353 20. sudo ufw allow from 217.182.136.107 to any port 5353 21. sudo ufw allow from 192.168.0.0/16 to any port 5353 22. sudo ufw allow from 84.92.64.163 to any port 53 23. sudo ufw allow from 212.140.134.122 to any port 53 24. sudo ufw allow from 217.182.136.107 to any port 53 25. sudo ufw allow from 192.168.0.0/16 to any port 53

Setting up fail2ban for SSH

1. sudo apt install fail2ban 2. sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local 2. sudo nano /etc/fail2ban/jail.local - and add the following:

[ssh]
enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 3
bantime  = -1

Make the Raspberry Pi Static

1. sudo nano /etc/dhcpcd.conf

interface wlan0 (or eth0 if ethernet)
static ip_address=192.168.1.155/24 (or as required)
static routers=192.168.1.254 (or as required)
static domain_name_servers=192.168.1.254 (or as required)

2. sudo nano /etc/hostname 2a. Change the hostname to something - and keep track of it.

Setup CUPS

1. sudo apt install cups 2. sudo usermod -a -G lpadmin pi 3. sudo usermod -a -G lpadmin skynet 4. sudo cupsctl --remote-any 5. https://{internal_ip}:631 -> "Edit Configuration" and add this line to the bottom:

MaxJobs 0

6. Location "Location /" and "Location /admin" and replace the content with:

Order allow,deny
Allow from localhost
Allow from 84.92.64.163
Allow from 212.140.134.122
Allow from 217.182.136.107
Allow from 192.168.1.*

7. Once saved, make sure "Allow printing from the internet" is ticked.

Add printer to CUPS - Zebra GK420d (USB)

1. https://{internal_ip}:631 (change IP as required, user/pass is the skynet one) 2. Administration -> Add Printer 3. Select "Zebra Technologies ZTC GK420d (Zebra Technologies ZTC GK420d)" from the "Local Printers" list and "Continue". 4. Change "Name" to something simple - e.g. customer01, Description/Location as required and tick "Share This Printer" -> "Continue". 5. Model - Select "Zebra ZPL Label Printer (en)" and "Add Printer" 6. "Administration" -> "Manage Printers" -> click the new printer -> "Administration" -> "Set Default Options" 7. Media Size -> "4.00x6.00" -> "Set Default Options"

Customer Firewall Setup

Now make sure the following ports are forwarded to the printer from the external firewall (change as required) - if any of these are changed, you will need to change the above steps as well. 1. 631 for cups 2. 22 for ssh

Add Printer to Spitfire (Recon)

Now add the printer via Recon: 1. https://recon.spitfire-ams.co.uk:631/ 2. "Administration" -> "Add Printer" -> "Internet Printing Protocol (ipp)" 3. ipp://skynet:{password}@{public_ip_address}:631/printers/{name} 4. "Administration" -> "Manage Printers" -> click the new printer -> "Administration" -> "Set Default Options"

a. Resolution to 300 dpi
b. Override A4 with Letter to "No"
c. "Set Default Options"

After Testing

Once all of the above has been completed, you can test a print locally. Before sending it off to the customer, make sure to comment out the settings from "/etc/dhcpcd.conf" under "Make the Raspberry Pi Static" are commented out, as then it'll be easier to locate it on the customers network and repeat any firewall steps.