Skynet Software Wiki:Setup Pi

Setting up a Raspberry Pi

1. Put the Pi together.
2. Connect to WiFi / Cable.
3. Select "Raspberry Pi OS Lite"
4. user pi, password raspberry
5. Note the IP address
6. sudo apt-get update
7. sudo apt-get upgrade
8. sudo apt-get dist-upgrade
9. passwd - and note the new password.
10. sudo raspi-confi
    1. Interface Options
       • P1, P3, P4, P5, P7, P8 - All "No".
       • P6 - Set to "No" then "No" again.
       • P2 - Set to "Yes"
    2. Localisation Options
       • Timezone - set to "Europe" then "London".
       • WLAN Country - set to "GB".
       • Locale - set to "en_GB.UTF-8"

Setting up a new internal user

1. sudo adduser skynet - note the new password.
2. sudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,gpio,i2c,spi skynet
3. "sudo su - skynet" - double check this works fine.
4. Logout of SSH and re-login as skynet.
5. sudo pkill -u pi

Securing SSH and setting up the UFW firewall

For further reference, see https://www.cups.org/doc/firewalls.html

1. sudo nano /etc/ssh/sshd_config
   • Add "AllowUsers skynet"
2. sudo systemctl restart ssh
3. sudo apt install ufw
4. sudo ufw allow ssh
5. sudo ufw allow 631
6. sudo ufw allow 5353
7. sudo ufw allow 53
8. sudo ufw enable
9. sudo ufw limit ssh/tcp
10. sudo ufw allow from 84.92.64.163 to any port 22 - Plusnet
11. sudo ufw allow from 212.140.134.122 to any port 22 - Lea House
12. sudo ufw allow from 217.182.136.107 to any port 22 - Recon
13. sudo ufw allow from 192.168.0.0/16 to any port 22
14. sudo ufw allow from 84.92.64.163 to any port 631
15. sudo ufw allow from 212.140.134.122 to any port 631
16. sudo ufw allow from 217.182.136.107 to any port 631
17. sudo ufw allow from 192.168.0.0/16 to any port 631
18. sudo ufw allow from 84.92.64.163 to any port 5353
19. sudo ufw allow from 212.140.134.122 to any port 5353
20. sudo ufw allow from 217.182.136.107 to any port 5353
21. sudo ufw allow from 192.168.0.0/16 to any port 5353
22. sudo ufw allow from 84.92.64.163 to any port 53
23. sudo ufw allow from 212.140.134.122 to any port 53
24. sudo ufw allow from 217.182.136.107 to any port 53
25. sudo ufw allow from 192.168.0.0/16 to any port 53

Setting up fail2ban for SSH

1. sudo apt install fail2ban
2. sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
3. sudo nano /etc/fail2ban/jail.local - and add the following:

[ssh]
enabled  = true
port     = ssh
filter   = sshd
logpath  = /var/log/auth.log
maxretry = 3
bantime  = -1

Make the Raspberry Pi Static

1. sudo nano /etc/dhcpcd.conf

interface wlan0 (or eth0 if ethernet)
static ip_address=192.168.1.155/24 (or as required)
static routers=192.168.1.254 (or as required)
static domain_name_servers=192.168.1.254 (or as required)

1. sudo nano /etc/hostname
   • Change the hostname to something - and keep track of it.

Setup CUPS

1. sudo apt install cups
2. sudo usermod -a -G lpadmin pi
3. sudo usermod -a -G lpadmin skynet
4. sudo cupsctl --remote-any
5. https://{internal_ip}:631 -> "Edit Configuration" and add this line to the bottom:

MaxJobs 0

1. Location "Location /" and "Location /admin" and replace the content with:

Order allow,deny
Allow from localhost
Allow from 84.92.64.163
Allow from 212.140.134.122
Allow from 217.182.136.107
Allow from 192.168.1.*

1. Once saved, make sure "Allow printing from the internet" is ticked.

Add printer to CUPS - Zebra GK420d (USB)

1. https://{internal_ip}:631 (change IP as required, user/pass is the skynet one)
2. Administration -> Add Printer
   1. Select "Zebra Technologies ZTC GK420d (Zebra Technologies ZTC GK420d)" from the "Local Printers" list and "Continue".
   2. Change "Name" to something simple - e.g. customer01, Description/Location as required and tick "Share This Printer" -> "Continue".
   3. Model - Select "Zebra ZPL Label Printer (en)" and "Add Printer"
3. Administration" -> "Manage Printers" -> click the new printer -> "Administration" -> "Set Default Options"
   • Media Size -> "4.00x6.00" -> "Set Default Options"

Customer Firewall Setup

Now make sure the following ports are forwarded to the printer from the external firewall (change as required) - if any of these are changed, you will need to change the above steps as well.

1. 631 for cups
2. 22 for ssh

Add Printer to Spitfire (Recon)

Now add the printer via Recon:

1. https://recon.spitfire-ams.co.uk:631/
2. "Administration" -> "Add Printer" -> "Internet Printing Protocol (ipp)"
3. ipp://skynet:{password}@{public_ip_address}:631/printers/{name}
4. "Administration" -> "Manage Printers" -> click the new printer -> "Administration" -> "Set Default Options"
   1. Resolution to 300 dpi
   2. Override A4 with Letter to "No"
   3. "Set Default Options"

Setting up Pi as a Kiosk

1. sudo apt-get install --no-install-recommends xserver-xorg x11-xserver-utils xinit openbox
2. sudo apt-get install --no-install-recommends chromium-browser
3. sudo nano /etc/xdg/openbox/autostart

xset -dpms
xset s noblank
xset s off
sed -i 's/"exited_cleanly":false/"exited_cleanly":true/' ~/.config/chromium/'Local State'
sed -i 's/"exited_cleanly":false/"exited_cleanly":true/; s/"exit_type":"[^"]\+"/"exit_type":"Normal"/' ~/.config/chromium/Default/Preferences
chromium-browser --noerrdialogs --disable-infobars --kiosk $KIOSK_URL

1. sudo nano /etc/xdg/openbox/environment

export KIOSK_URL=https://sams.spitfire-ams.co.uk/tablet_scan.php

1. ls -la ~/.bash_profile
   1. if doesn't exist:
   2. touch ~/.bash_profile
2. sudo nano ~/.bash_profile

-z $DISPLAY && $XDG_VTNR -eq 1  && startx -- -nocursor

1. source ~/.bash_profile
2. sudo reboot

After Testing

Once all of the above has been completed, you can test a print locally. Before sending it off to the customer, make sure to comment out the settings from "/etc/dhcpcd.conf" under "Make the Raspberry Pi Static" are commented out, as then it'll be easier to locate it on the customers network and repeat any firewall steps.