goSecure Documentation Current version 18.8.11

1. Prerequisites
   • Hardware
     • A laptop, desktop, or server with 2 network interfaces. In this example we will be using a laptop that has only 1 ethernet port on it and an external USB to Ethernet adapter (like the SIIG JU-NE0211-S1 USB 3.0 to Gigabit Ethernet or Apple USB 2.0 to Ethernet) to add a second port.
   • Software
     • CentOS 6.8 64-bit (minimal): http://isoredirect.centos.org/centos/6.8/isos/x86_64/


2. Install OS
   1. Install CentOS 6.8 64-bit (minimal)
3. Configure Networking
   1. Configure external (Internet) facing interface and update the OS:
      1. vi /etc/sysconfig/network-scripts/ifcfg-eth0
      2. Change ONBOOT=no to ONBOOT=yes in the file.
      3. service network restart
      4. sudo yum install -y wget
   Note: If you have the exact same SIIG USB-to-Ethernet adapter as described in the x86 computing device (Laptop/Desktop/Server) section, please follow the instruction in the "Install eth1 (SIIG) driver" section. Otherwise, please skip the next section and follow the instructions that were provided by the manufacturer of your USB-to-Ethernet device to install the driver.
   2. Install eth1 (SIIG) driver:
      1. Ensure the SIIG USB-to-Ethernet adapter is plugged in.
      2. wget http://www.siig.com/media/files/drivers/0010/02-1634d-linux-v1.13.0.zip
      3. unzip 02-1634d-linux-v1.13.0.zip
      4. cd Linux
      5. tar -xf AX88179_178A_LINUX_DRIVER_v1.13.0_SOURCE.tar
      6. cd AX88179_178A_LINUX_DRIVER_v1.13.0_SOURCE
      7. make && make install
      8. Unplug the SIIG USB-to-Ethernet adapter and plug it back in.
   3. Configure internal (Enterprise) facing interface:
      1. cp /etc/sysconfig/network-scripts/ifcfg-eth0 /etc/sysconfig/network-scripts/ifcfg-eth1
      2. vi /etc/sysconfig/network-scripts/ifcfg-eth1
      3. Change DEVICE=eth0 to DEVICE=eth1
      4. Change the HWADDR=<eth0 MAC address> to HWADDR=<eth1 MAC address>
      Note: Use the same format for the MAC address, i.e. 00:00:BA:XX:XX:XX. The MAC address for eth1 can be found on the back of the SIIG USB-to-Ethernet adapter.
      5. Delete the "UUID" line.
      6. Change BOOTPROTO=dhcp to BOOTPROTO=static in the file.
      7. Add IPADDR=172.16.166.1 and NETMASK=255.255.255.0 to the bottom of the file.
      8. service network restart
4. Run the goSecure Server Install Script
   1. cd ~
   2. wget https://davedittrich.github.io/goSecure/files/install_scripts/gosecure_server_install.py
   Note: replace the 2 arguments in the command below with your values. (i.e. sudo python gosecure_server_install.py client1@d2.local "mysupersecretpsk")
   3. sudo python gosecure_server_install.py <client_id (i.e. client1@d2.local)> <client_psk (i.e. "atleast16characterswithinquotes")>

1. Prerequisites
• AWS SSH Key
• Log in to the AWS console.
• In the top menu bar, select the region of your choice. (Instructions for changing the region here).
• Create your own SSH key pair using these instructions: http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-key-pairs.html#having-ec2-create-your-key-pair


2. Deploy template using AWS CloudFormation
1. Download the goSecure Proxy CloudFormation template from here: https://davedittrich.github.io/goSecure/files/install_scripts/aws_proxy.template
2. Log in to the AWS console.
3. In the top menu bar, select the region for which you created the SSH key. (Instructions for changing the region here).
4. In the top menu bar, click on Services and then click on CloudFormation.
5. Click on the Create Stack button.
6. Under the Choose a template heading, select Upload a template to Amazon S3 and then click on the Choose File button.
7. Select the aws_proxy.template that you downloaded.
8. Click on the Next button.
9. Type in goSecureProxyStack in the Stack name textbox.
10. Type in the first client's pre-shared key (PSK) in the Client0Psk textbox. The PSK must be at least 16 characters. The PSK must also be surrounded in double quotes and cannot contain a double quote within.
11. Type in the first client's client ID in the ClientId textbox.
12. Select your instance type for the InstanceType dropdown menu.
13. Select the existing SSH key pair in the KeyName dropdown menu.
14. Click on the Next button.
15. Click on the Next button.
16. Click on the Create button.
17. Wait until the Stack Status changes to CREATE_COMPLETE and then wait another 5 minutes for the goSecure Server to initialize for the first time.


18. In the top menu bar, click on Services and then click on EC2.
19. In the left menu bar, click on Instances.
20. Right click on the instance with the name goSecure_Proxy-Server, hover over Networking, and then click on Manage Private IP Addresses.
21. Note the IP address in the Public “IP” column. Your goSecure Client will connect to this IP address.

1. Prerequisites
   • Hardware
     • Raspberry Pi 3 Model B or B+, or Raspberry Pi 2 Model B
     • 4GB (minimum size) SD Card
     • Ensure an external USB to Ethernet adapter (like the SIIG JU-NE0211-S1 USB 3.0 to Gigabit Ethernet or Apple USB 2.0 to Ethernet) is plugged in an recognized (run ifconfig -a and ensure you see a eth1).
   • Software
     • HypriotOS (run make hypriot-img to download and validate an OS image for later steps)
2. Install OS
   1. Insert an SD card and make sure you know its associated device name.
   2. Ensure the Hypriot OS image is ready.
   3. Run make server-sd.
   4. Turn on the Raspberry Pi with the SD Card installed.

   When the Raspberry Pi first boots, it will execute the commands defined in the cloud-config.server.j2 These initial steps including firmware updating and downloading of the gosecure_server_install_pi.py script. Be patient. Depending on your network speed, this can take a long time.

   Note: you now have the option to SSH into the goSecure client through eth1 (the USB to Ethernet adapter).

3. Run the goSecure Server Install Script

   Log in to the pi account using the password you generated in Step 0.

   1. wget https://davedittrich.github.io/goSecure/files/install_scripts/gosecure_server_install_pi.py
   2. sudo python gosecure_server_install_pi.py
4. Clean up
   1. sudo rm /home/pi/gosecure_server_install_pi.py
   2. Unplug the HDMI cable and SSH into the goSecure Server
   3. sudo reboot
   4. SSH into the goSecure Server
   5. sudo systemctl disable ssh
   6. sudo /sbin/shutdown -h now

1. Prerequisites
   • Hardware
     • Raspberry Pi 3 Model B or B+, or Raspberry Pi 2 Model B
     • 4GB (minimum size) SD Card
     • Ensure an external USB to Ethernet adapter (like the SIIG JU-NE0211-S1 USB 3.0 to Gigabit Ethernet or Apple USB 2.0 to Ethernet) is plugged in an recognized (run ifconfig -a and ensure you see a eth1).
   • Software
     • Raspbian Lite Latest Image: https://downloads.raspberrypi.org/raspbian_lite_latest


2. Install OS
   1. Install Raspbian Lite Latest onto a SD Card using the instructions under the "WRITING AN IMAGE TO THE SD CARD" section from here.
   2. Turn on the Raspberry Pi with the SD Card installed.
   3. Log in to the pi account using the password you generated in Step 0.


3. Configure OS
   1. sudo raspi-config
   2. Select 2 Change User Password and press the Enter key.
      
      1. Press the Enter key when you receive a message stating You will now be asked to enter a password for the pi user
      
      2. A new command line prompt stating Enter new UNIX password: will appear on the bottom of the screen. Type in your new password and press the Enter key.
      
      3. A new command line prompt stating Retype new UNIX password: will appear on the bottom of the screen. Type in your new password again and press the Enter key.
      4. A new prompt stating Password changed successfully will appear. Press the Enter key to continue.
      
   3. Select 5 Internationalisation Options and press the Enter key.
   
   1. Select I2 Change Timezone and press the Enter key.
   
   2. Select America (or the Country you reside in) and press the Enter key.
   
   3. Select New_York (or the location you reside in) and press the Enter key.
   
   4. Select 5 Internationalisation Options and press the Enter key.
   
   1. Select I3 Change Keyboard Layout and press the Enter key.
   
   2. Select Generic 105-key (Intl) PC and press the Enter key.
   
   3. Select Other and press the Enter key.
   
   4. Select English (US) and press the Enter key.
   
   5. Select English (US) and press the Enter key.
   
   6. Select Right Alt (AltGr) and press the Enter key.
   
   7. Select No compose key and press the Enter key.
   
   5. Select 5 Internationalisation Options and press the Enter key.
   
   1. Select I4 Change Wi-fi Country and press the Enter key.
   
   2. Select US United States (or the Country you reside in) and press the Enter key.
   
   3. A new prompt stating Wi-fi country set to US will appear. Press the Enter key to continue.
   
   6. Press the Tab key 2 times to select <Finish> and press the Enter key.
   
   7. A new prompt stating Would you like to reboot now? will appear. Press the Enter key to continue.
   
   8. After reboot, on log in prompt, log in.


4. Configure Networking
   1. sudo vi /etc/network/interfaces

      # interfaces(5) file used by ifup(8) and ifdown(8)
      
      # Please note that this file is written to be used with dhcpcd
      # For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf'
      
      # Include files from /etc/network/interfaces.d:
      source-directory /etc/network/interfaces.d
      
      auto lo
      iface lo inet loopback
      
      auto eth0
      allow-hotplug eth0
      iface eth0 inet dhcp
      
      auto eth1
      allow-hotplug eth1
      iface eth1 inet static
      address 192.168.166.1
      netmask 255.255.255.0
      
      allow-hotplug wlan0
      iface wlan0 inet manual
          wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

   2. sudo service networking restart

      Wait 30 seconds for eth0 to obtain an IP Address.

   Note: you now have the option to SSH into the goSecure client through eth1 (the USB to Ethernet adapter). Copying and pasting the commands and configuration files is recommended. Be sure to change variables where specified.

5. Update OS and Raspberry Pi Note: These commands will run for a long time.
   
   
   1. sudo apt-get update
   2. sudo apt-get upgrade -y
   3. sudo apt-get dist-upgrade -y
   4. sudo apt-get install rpi-update
   5. sudo rpi-update
   6. sudo reboot
   7. After reboot, on log in prompt, log in.


6. Run the goSecure Server Install Script

   Note: These commands will run for a long time.

   1. cd ~
   2. wget https://davedittrich.github.io/goSecure/files/install_scripts/gosecure_server_install_pi.py

   Note: replace the 2 arguments in the command below with your values. (i.e. sudo python gosecure_server_install_pi.py client1@d2.local "mysupersecretpsk")

   3. sudo python gosecure_server_install_pi.py <client_id (i.e. client1@d2.local)> <client_psk (i.e. "atleast16characterswithinquotes")>
7. Clean up

   [Note: These cleanup steps are being cleaned up. They should have been scripted to begin with.]

   1. sudo rm /home/pi/gosecure_server_install_pi.py
   2. Unplug the HDMI cable and SSH into the goSecure Server
   3. sudo reboot
   4. SSH into the goSecure Server
   5. sudo systemctl disable ssh
   6. sudo /sbin/shutdown -h now

Note: The following instructions are to build the client in mode 1 (see introduction section for mode definitions).

1. Prerequisites
   • Hardware
     • Raspberry Pi 3 Model B or B+ or Raspberry Pi 2 Model B (and a USB Wifi adapter like the Edimax EW-7811Un)
     • 8GB (minimum size) SD Card
     • Ensure nothing is plugged into the ethernet port.
   • Software
     • HypriotOS (run make hypriot-img to download and validate an OS image for later steps)
2. Install OS
1. Insert an SD card and make sure you know its associated device name.
2. Ensure the Hypriot OS image is ready.
3. Run make client-sd.
4. Turn on the Raspberry Pi with the SD Card installed.

When the Raspberry Pi first boots, it will execute the commands defined in the cloud-config.client.j2 These initial steps including firmware updating and downloading of the gosecure_client_install.py script. Be patient. Depending on your network speed, this can take a long time.

Note: after a few moments, you have the option to SSH into the goSecure client through eth0 (192.168.50.1), or wlan0 if your computer is on the same Wifi network. Verify the SSH host key using the information output by the cloud-init process.

3. Run the goSecure Client Install Script

   Log in to the pi account using the password you generated in Step 0.

   1. If the gosecure_client_install.py script is not present, you can download it using the command:
      wget https://davedittrich.github.io/goSecure/files/install_scripts/gosecure_client_install.py
   2. Run the script with: sudo python gosecure_client_install.py
      (Again, this will take a very long time to complete.)
4. Clean up

   [Note: These cleanup steps are being cleaned up. They should have been scripted to begin with.]

   1. sudo rm /home/pi/gosecure_client_install.py
   2. sudo rm -rf /usr/share/doc/* /opt/vc/src/hello_pi/
   3. sudo find /usr/share/locale/* -maxdepth 0 -type d | grep -v en | xargs sudo rm -rf
   4. sudo find /usr/share/man/* -maxdepth 0 -type d | grep -Pv 'man\d' | xargs sudo rm -rf
   5. sudo find / -type f -name "*-old" | xargs sudo rm -rf
   6. sudo rm -rf /var/backups/* /var/lib/apt/lists/* ~/.bash_history
   7. sudo find /var/log/ -type f | xargs sudo rm -rf
   8. sudo cp /dev/null /etc/resolv.conf
   9. Unplug the HDMI cable and SSH into the goSecure Client
   10. sudo reboot
   11. SSH into the goSecure Client
   12. sudo systemctl disable ssh
   13. sudo /sbin/shutdown -h now

Note: The following instructions are to build the client in mode 1 (see introduction section for mode definitions).

1. Prerequisites
   • Hardware
     • Raspberry Pi 3 Model B or B+, or Raspberry Pi 2 Model B (and a USB Wifi adapter like the Edimax EW-7811Un)
     • 4GB (minimum size) SD Card
     • Ensure nothing is plugged into the ethernet port.
   • Software
     • Raspbian Lite Latest Image: https://downloads.raspberrypi.org/raspbian_lite_latest
2. Install OS
1. Install Raspbian Lite Latest onto a SD Card using the instructions under the "WRITING AN IMAGE TO THE SD CARD" section from here.
2. Turn on the Raspberry Pi with the SD Card installed.
3. Log in to the pi account using the password you generated in Step 0.
3. Configure OS
1. sudo raspi-config
2. Select 2 Change User Password and press the Enter key.
   
   1. Press the Enter key when you receive a message stating You will now be asked to enter a password for the pi user
   
   2. A new command line prompt stating Enter new UNIX password: will appear on the bottom of the screen. Type in your new password and press the Enter key.
   
   3. A new command line prompt stating Retype new UNIX password: will appear on the bottom of the screen. Type in your new password again and press the Enter key.
   4. A new prompt stating Password changed successfully will appear. Press the Enter key to continue.
   
3. Select 5 Internationalisation Options and press the Enter key.

1. Select I2 Change Timezone and press the Enter key.

2. Select America (or the Country you reside in) and press the Enter key.

3. Select New_York (or the location you reside in) and press the Enter key.

4. Select 5 Internationalisation Options and press the Enter key.

1. Select I3 Change Keyboard Layout and press the Enter key.

2. Select Generic 105-key (Intl) PC and press the Enter key.

3. Select Other and press the Enter key.

4. Select English (US) and press the Enter key.

5. Select English (US) and press the Enter key.

6. Select Right Alt (AltGr) and press the Enter key.

7. Select No compose key and press the Enter key.

5. Select 5 Internationalisation Options and press the Enter key.

1. Select I4 Change Wi-fi Country and press the Enter key.

2. Select US United States (or the Country you reside in) and press the Enter key.

3. A new prompt stating Wi-fi country set to US will appear. Press the Enter key to continue.

6. Press the Tab key 2 times to select <Finish> and press the Enter key.

7. A new prompt stating Would you like to reboot now? will appear, press the Enter key to continue.

8. After reboot, on log in prompt, log in.


4. Configure Networking
1. sudo vi /etc/network/interfaces

# interfaces(5) file used by ifup(8) and ifdown(8)

# Please note that this file is written to be used with dhcpcd
# For static IP, consult /etc/dhcpcd.conf and 'man dhcpcd.conf'

# Include files from /etc/network/interfaces.d:
source-directory /etc/network/interfaces.d

auto lo
iface lo inet loopback

auto eth0
allow-hotplug eth0
iface eth0 inet static
address 192.168.50.1
netmask 255.255.255.0

auto wlan0
allow-hotplug wlan0
iface wlan0 inet manual
    wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

2. sudo vi /etc/wpa_supplicant/wpa_supplicant.conf

Note: replace the <YOUR_WIFI_SSID> with your WIFI SSID and <YOUR_WIFI_PASSWORD> with your WIFI Password.


country=US
ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
update_config=1
network={
    ssid="<YOUR_WIFI_SSID>"
    psk="<YOUR_WIFI_PASSWORD>"
}

3. sudo service networking restart
4. sudo ifdown wlan0 && sudo ifup wlan0

Wait 30 seconds for the Wifi to obtain an IP Address.

Note: you now have the option to SSH into the goSecure client through eth0 or wlan0 if your computer is on the same Wifi network. Copying and pasting the commands and configuration files is recommended. Be sure to change variables where specified.


5. Update OS and Raspberry Pi
Note: These commands will run for a long time.


1. sudo apt-get update
2. sudo apt-get upgrade -y
3. sudo apt-get dist-upgrade -y
4. sudo apt-get install rpi-update
5. sudo rpi-update
6. sudo reboot
7. After reboot, on log in prompt, log in.


6. Run the goSecure Client Install Script
Note: These commands will run for a long time.


1. cd ~
2. wget https://davedittrich.github.io/goSecure/files/install_scripts/gosecure_client_install.py
3. sudo python gosecure_client_install.py


7. Clean up
1. sudo rm /home/pi/gosecure_client_install.py
2. sudo rm -rf /usr/share/doc/* /opt/vc/src/hello_pi/
3. sudo find /usr/share/locale/* -maxdepth 0 -type d |grep -v en |xargs sudo rm -rf
4. sudo find /usr/share/man/* -maxdepth 0 -type d |grep -Pv 'man\d' |xargs sudo rm -rf
5. sudo find / -type f -name "*-old" |xargs sudo rm -rf
6. sudo rm -rf /var/backups/* /var/lib/apt/lists/* ~/.bash_history
7. sudo find /var/log/ -type f |xargs sudo rm -rf
8. sudo cp /dev/null /etc/resolv.conf


9. Unplug the HDMI cable and SSH into the goSecure Client
10. sudo reboot
11. SSH into the goSecure Client
12. sudo systemctl disable ssh
13. sudo /sbin/shutdown -h now