Skynet Software Wiki:Setup Pi

Setting up a Raspberry Pi

1. Plug a 16GB or larger MicroSD Card into your computer.
2. Download and open the Raspberry Pi Imager software.
   1. If the Pi is being used as a Clocking In or Dispatch device, choose "Raspberry Pi OS (32-bit)".
   2. If the Pi is being used as a Print Server, choose "Raspberry Pi OS Lite (32-bit)" under 'Raspberry Pi OS (Other)'.
3. Open the Advanced Options by clicking the cog in the bottom right hand corner.
   1. Tick 'Set hostname:' and input the hostname into the box.
   2. If connecting over SSH straight away:
      1. Tick 'Enable SSH'.
      2. Click 'Use password authentication'.
      3. Tick 'Set username and password'.
      4. Leave Username as 'pi'.
      5. Set a password and keep a note of it.
   3. If the Pi will be connected to WiFi and you have the details:
      1. Tick 'Configure wifi'.
      2. Enter the 'SSID'.
      3. Enter the 'Password'.
      4. Leave Wifi country as 'GB'.
   4. Tick 'Set locale Settings'.
4. Click 'SAVE'.
5. Click 'CHOOSE STORAGE' and ensure you choose the MicroSD Card to install to.
6. Click 'WRITE'.
7. Once it's installed, plug MicroSD Card into Pi.
8. Connect Pi to power & connect an Ethernet cable.
9. user pi, password as set above.
10. Note the IP address (run "ifconfig" if it doesn't show).
11. Run the following commands:
    1. sudo apt-get purge wolfram-engine scratch nuscratch sonic-pi idle3 smartsim java-common libreoffice* -y
    2. sudo apt clean
    3. sudo apt-get autoremove -y
    4. sudo apt-get update -y
    5. sudo apt-get upgrade -y
    6. sudo apt-get dist-upgrade -y
    7. sudo apt-get install xdotool unclutter sed -y
    8. sudo raspi-config - Only change the following options:
       1. 1 System Options
       • S5 Boot / Auto Login
       1. • If the Pi is being used as a Print Server - Choose "B1 Console"
          • If the Pi is being used as a Clocking In or Dispatch device - Choose "B4 Desktop Autologin"
       • S6 Network at Book - Set to "Yes"
       • (If the Pi is being used as a Print Server, ignore this) S7 Splash Screen - Set to "No"
    9. 3 Interface Options
       • I2 - Set to "Yes"
       • I1, I3, I4, I5, I7, I8 - Set all to "No"
       • I6 - Set to "No" then "No" again
    10. 6 Advanced Options
        • A1 Expand Filesystem - Run this

It will then ask if you want to reboot - Choose yes.

Setting up a new internal user

1. sudo adduser skynet - note the new password.
2. It will ask for a Full Name - set this as "Genisys Support" - for the other options just press Enter
3. sudo usermod -a -G adm,dialout,cdrom,sudo,audio,video,plugdev,games,users,input,netdev,gpio,i2c,spi skynet
4. "sudo su - skynet" - double check this works fine.
5. Logout of SSH and re-login as skynet.
6. sudo pkill -u pi

Securing SSH and setting up the UFW firewall

For further reference, see CUPS UFW Firewall page

1. sudo nano /etc/ssh/sshd_config
   • Add "AllowUsers skynet"
2. Ctrl X, Y, Enter
3. sudo systemctl restart ssh
4. sudo apt install ufw -y
5. sudo ufw allow from 51.68.205.35 proto tcp to any port 22,53,631,5353
6. sudo ufw allow from 145.239.254.22 proto tcp to any port 22,53,631,5353
7. sudo ufw allow from 81.137.221.179 proto tcp to any port 22,53,631,5353
8. sudo ufw allow from 217.155.89.132 proto tcp to any port 22,53,631,5353
9. sudo ufw allow from 192.168.0.0/16 proto tcp to any port 22,53,631,5353
10. sudo ufw allow from Customer's IP Address proto tcp to any port 22,53,631,5353
11. sudo ufw limit ssh/tcp (This will block attackers who have connected more than 5 times in 30 seconds)
12. sudo ufw enable

Setting up fail2ban for SSH

1. sudo apt install fail2ban -y
2. sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
3. sudo nano /etc/fail2ban/jail.local
4. find:

# "ignoreip" can be a list of IP addresses, CIDR masks or DNS hosts. Fail2ban
# will not ban a host which matches an address in this list. Several addresses
# can be defined using space (and/or comma) separator.
#ignoreip =  127.0.0.1/8::1

1. Remove the #
2. Remove 127.0.0.1/8 - leave the "::1" at the end
3. Add 51.68.205.35 145.239.254.22 81.137.221.179 217.155.89.132 meadowview.zapto.org 192.168.0.0/16 - leave the "::1" at the end
4. Then find:

# "bantime" is the number of seconds that a host is banned.
bantime  = 10m

1. Change 10m to 1y
2. Then find:

# A host is banned if it has generated "maxretry" during the last "findtime"
# seconds.
findtime  = 10m

1. Change 10m to 1y
2. Then find:

# "maxretry" is the number of failures before a host get banned.
maxretry = 5

1. Change 5 to 3
2. Then find:

#
# JAILS
#

#
# SSH servers
#

[sshd]

# To use more aggressive sshd modes set filter parameter "mode" in jail.local:
# normal (default), ddos, extra or aggressive (combines all).
# See "tests/files/logs/sshd" or "filter.d/sshd.conf" for usage example and details.
#mode   = normal
port    = ssh
logpath = %(sshd_log)s
backend = %(sshd_backend)s

Add the following below it:

[ssh]
 enabled  = true
 port     = ssh
 filter   = sshd
 logpath  = /var/log/auth.log
 maxretry = 3
 bantime  = 1y

1. Ctrl X, Y, Enter

Fail2Ban must be restarted to load the new settings:

1. sudo service fail2ban restart

Setup CUPS

1. sudo apt install cups -y
2. sudo usermod -a -G lpadmin pi
3. sudo usermod -a -G lpadmin skynet
4. sudo cupsctl --remote-any
5. https://{internal_ip}:631 -> "Edit Configuration" and add this line to the bottom:

MaxJobs 0

1. Find "<Location />" and "<Location /admin>" and replace the content inside both areas with (don't remove "</Location />" and "</Location /admin>"):

Order allow,deny
Allow from localhost
Allow from 51.68.205.35
Allow from 81.174.164.247
Allow from 145.239.254.22
Allow from 217.155.89.132
Allow from lithium.geekgalaxy.com
Allow from 192.168.*
Allow from <Customers' IP Address>

1. Further below find "<Location /admin/log>" and add the following below "Require user @SYSTEM" (don't remove "</Location /admin/log>"):

Order allow,deny
Allow @LOCAL
Allow from localhost
Allow from 51.68.205.35
Allow from 81.174.164.247
Allow from 145.239.254.22
Allow from 217.155.89.132
Allow from lithium.geekgalaxy.com
Allow from 192.168.*
Allow from <Customers' IP Address>

1. Click "Save Changes".

Add label printer to CUPS on Raspberry Pi - Zebra GK420d

USB

1. https://{Raspberry Pi IP}:631 (change IP as required, user/pass is the skynet one)
2. Click "Administration" then "Add Printer".
   1. Select "Zebra Technologies ZTC GK420d (Zebra Technologies ZTC GK420d)" from the "Local Printers" list then click "Continue".
   2. Change "Name" to something simple - e.g. customer01, Description/Location as required and tick "Share This Printer" then click "Continue".
   3. Model - Select "Zebra ZPL Label Printer (en)" then click "Add Printer".
3. On Default Options:
   1. Media Size -> "4.00x6.00"
   2. Resolution -> "203dpi"
   3. "Set Default Options".

If you need to change the Default Options:
"Administration" -> "Manage Printers" -> click the printer -> "Administration" -> "Set Default Options"

Ethernet

1. https://{Raspberry Pi IP}:631 (change IP as required, user/pass is the skynet one)
2. Click "Administration" then "Add Printer".
   1. Select "AppSocket/HP JetDirect" from the "Other Network Printers:" list then click Continue.
   2. Put "socket://<IP Address of printer> into the "Connection:" box then click "Continue".
   3. Change "Name" to something simple - e.g. customer01, Description/Location as required, tick "Share This Printer" then click "Continue".
   4. Make - Select "Zebra".
   5. Model - Select "Zebra ZPL Label Printer (en)" and click "Add Printer".
3. On Default Options:
   1. Media Size -> "4.00x6.00"
   2. Resolution -> "203dpi"
   3. "Set Default Options".

If you need to change the Default Options:
"Administration" -> "Manage Printers" -> click the printer -> "Administration" -> "Set Default Options"

Add A4 printer to CUPS on Raspberry Pi

Ethernet

1. https://{Raspberry Pi IP}:631 (change IP as required, user/pass is the skynet one)
2. Click "Administration" then "Add Printer".
   1. Find the printer in the "Discovered Network Printers" list then click Continue.
   2. Change "Name" to something simple - e.g. customer01, Description/Location as required, tick "Share This Printer" then click "Continue".
   3. Make should be pre-selected to the make of the printer.
   4. Model - The top option should be the correct one and match the make & model of the printer. If it also shows as "CUPS+Gutenprint vx.x.x (en)" that's the best one.
3. On Default Options:
   1. Media Size -> "A4"
   2. Resolution -> "Automatic"
   3. 2-Sided Printing -> If the customer wants this on, set it as "Long Edge (Standard)" otherwise set it to "Off".
   4. "Set Default Options".

If you need to change the Default Options:
"Administration" -> "Manage Printers" -> click the printer -> "Administration" -> "Set Default Options"

File Change To Stop Right Side of Page Being Cut Off

1. cd /etc/cups/ppd
2. sudo nano printer_name.ppd
3. Find "*DefaultImageableArea: A4"
4. Find "*ImageableArea A4/A4: "10.000 12.000 585.000 830.000"" a few lines down from the above line.
5. Change the numbers to "18.000 20.000 593.000 838.000".
6. Ctrl X, Y, Enter

Customer Firewall Setup

Now make sure the following ports are forwarded to the printer from the external firewall (change as required) - if any of these are changed, you will need to change the above steps as well.

1. 631. 53. 5353 for cups (TCP and UDP)
2. 22 for ssh (TCP)

Add Printer to Skynet (Xenon)

Normal ZPL Driver

1. http://xenon.genisys-systems.co.uk:631/
2. "Administration" -> "Add Printer" -> "Internet Printing Protocol (ipp)"
3. ipp://skynet:{password}@{public_ip_address}:631/printers/{name}
4. Name - Use our standard naming convention.
5. Make - Select "Generic".
6. Model - Select "Generic PDF Printer (en)".
7. On Default Options:
   1. Resolution to 300 dpi
   2. Override A4 with Letter to "No"
   3. "Set Default Options"

If you need to change the Default Options:
"Administration" -> "Manage Printers" -> click the printer -> "Administration" -> "Set Default Options"

EPL Driver (for DPD/UPS)

1. http://xenon.genisys-systems.co.uk:631/
2. "Administration" -> "Add Printer" -> "Internet Printing Protocol (ipp)"
3. ipp://skynet:{password}@{public_ip_address}:631/printers/{name}
4. Name - as above but with "_dpd" on the end of it.
5. Make - Select "Raw".
6. Model - Select "Raw Queue".

You will experience messages such as PPD errors, semi-colon errors etc. but this is normal for a RAW printer. No further setup is required.

Setting up Pi as a Kiosk

1. sudo nano /home/pi/kiosk.sh

#!/bin/bash
export DISPLAY=:0
xset s noblank
xset s off
xset -dpms
unclutter -idle 0.5 -root &
sed -i 's/"exited_cleanly":false/"exited_cleanly":true/' /home/pi/.config/chromium/Default/Preferences
sed -i 's/"exit_type":"Crashed"/"exit_type":"Normal"/' /home/pi/.config/chromium/Default/Preferences
/usr/bin/chromium-browser --noerrdialogs --disable-infobars --kiosk http://sams.spitfire-ams.co.uk/tablet_scan.php &

1. Ctrl X, Y, Enter
2. sudo nano /lib/systemd/system/kiosk.service

 [Unit]
 Description=Chromium Kiosk
 Wants=graphical.target
 After=graphical.target

 [Service]
 Environment=DISPLAY=:0.0
 Environment=XAUTHORITY=/home/pi/.Xauthority
 Type=simple
 ExecStart=/bin/bash /home/pi/kiosk.sh
 Restart=on-abort
 User=pi
 Group=pi

 [Install]
 WantedBy=graphical.target

1. Ctrl X, Y, Enter
2. sudo systemctl enable kiosk.service
3. sudo systemctl start kiosk.service
4. sudo nano /home/pi/.config/autostart/kiosk.desktop

[Desktop Entry]
Type=Application
Name=Kiosk
Exec=/home/pi/kiosk.sh
X-GNOME-Autostart-enabled=true

1. Ctrl X, Y, Enter
2. sudo chmod 755 kiosk.sh
3. sudo chown pi:pi kiosk.sh

After Testing

Once all of the above has been completed, you can test a print locally.

Debugging

Found by Ncroker:

This page has some cool debugging stuff: https://wiki.ubuntu.com/DebuggingPrintingProblems
It's for Ubuntu, but still seems to work on Xenon/Pi.