• Install groovy gorilla: Ubuntu 20.10 on RPi 4

https://ubuntu.com/download/raspberry-pi

• Download Hashicorp Vault

wget https://releases.hashicorp.com/vault/1.6.2/vault_1.6.2_linux_arm.zip

• Install unzip & Unzip

unzip vault_1.6.2_linux_arm.zip

• Move vault to /usr/bin

sudo mv vault /usr/bin

• Confirm all good

vault -v

• Set Linux capability flags which let vault perform memory locking without elevating its privileges:

sudo setcap cap_ipc_lock=+ep /usr/bin/vault

• Create vault data folder

sudo mkdir ~/hashicorp/vault-data

#(make sure folder hashicorp already exists)

• Create startup vault user:

sudo useradd -r -d ~/hashicorp/vault-data -s /bin/nologin vault

• Set /vault-data ownership to vault user and group exclusively:

sudo install -o vault -g vault -m 750 -d ~/hashicorp/vault-data

• Create Vault configuration file

sudo nano /etc/vault.hcl

ui = true

storage "file" {

path = "/home/ubuntu/hashicorp/vault-data"

}

listener "tcp" {

address = "192.168.1.79:8200"

tls_min_version = "tls12"

tls_cert_file = "/etc/letsencrypt/live/black-pearl/fullchain.pem"

tls_key_file = "/etc/letsencrypt/live/black-pearl/privkey.pem"

tls_disable_client_certs = true

}

• Change ownership of file:

sudo chown vault:vault /etc/vault.hcl

sudo chmod 640 /etc/vault.hcl

• Launch Vault as a service

sudo nano /etc/systemd/system/vault.service

[Unit]

Description=HashiCorp Vault to manage secrets

Documentation=https://vaultproject.io/docs/

After=network-online.target

ConditionFileNotEmpty=/etc/vault.hcl

[Service]

User=vault

Group=vault

ExecStart=/usr/bin/vault server -config=/etc/vault.hcl

ExecReload=/usr/bin/kill -1 $MAINPID

Restart=on-failure

KillMode=process

CapabilityBoundingSet=CAP_SYSLOG CAP_IPC_LOCK

AmbientCapabilities=CAP_IPC_LOCK

SecureBits=keep-caps

NoNewPrivileges=yes

KillSignal=SIGINT

[Install]

WantedBy=multi-user.target

• Get the service running:

systemctl daemon-reload

systemctl start vault.service

systemctl status vault.service

• Let's get ready to rumble!! Set you env variables for Vault

export VAULT_ADDRESS=http://192.168.1.79:8200

echo "export VAULT_ADDR=http://192.168.1.79:8200" >> ~/.bashrc

• Initialise Vault

vault operator init

Unseal Key 1: b199iVYvYNwvOEUCFVk6fv7lfGYgnlcxxxxxxxxxqgSC

Unseal Key 2: qQ0ogSS6oM0hm8nbAvxFFRakbBxxxxxxxxxxFYY+k9

Unseal Key 3: UMi3HKQwxxxxxxxxxxX2mdmEbO/WHfMSvLfOI93

Unseal Key 4: aREgLDE8c+oxxxxxxxxxxV4Kd2+x68xqYxax2qjSfnw/

Unseal Key 5: t/3kKShdtxxxxxxxxxxomb4c8Ho2hY5i21C8ZRpAgilq

Initial Root Token: s.aVnfOxFMxxxxxxxxx5Fe4flz7vp9Fo

• Use the unseal keys to unseal vault

vault operator unseal b199iVYvYNwvOEUCFVk6fv7lfGYgnlcxxxxxxxxxqgSC

vault operator unseal qQ0ogSS6oM0hm8nbAvxFFRakbBxxxxxxxxxxFYY+k9

vault operator unseal UMi3HKQwxxxxxxxxxxX2mdmEbO/WHfMSvLfOI9

• This should result in an unsealed Vault as shown below:

Key Value

--- -----

Seal Type shamir

Initialized true

Sealed false

Total Shares 5

Threshold 3

Version 1.6.2

Storage Type file

Cluster Name vault-cluster-ebcec4ba

Cluster ID bb776d03-25c3-966a-c0c8-9a336b73bc9e

HA Enabled false

• The vault UI can also be accessed at the IP or hostname on server certificate

https://192.168.1.79:8200/ui/

• The certificates distributed to vault come from an internal CA also running on a RPi
• These certs have a validity period of 2hrs so need to rotate them. We use certbot & systemd for this.
• Create certbot service

sudo nano /etc/systemd/system/certbot.service

# /etc/systemd/system/certbot.service
[Unit]
Description=certbot renewal service
Documentation=https://certbot.eff.org/#ubuntuxenial-nginx
After=network-online.target

[Service]
Environment=”REQUESTS_CA_BUNDLE=/home/ubuntu/.step/certs/root_ca.crt” \
“STEPPATH=/home/ubuntu/.step” \
“CERT_LOCATION=/etc/letsencrypt/live/<servername>/cert.pem” \
“KEY_LOCATION=/etc/letsencrypt/live/<servername>/key.pem”

ExecCondition=/usr/bin/bash -c \
‘step certificate inspect $CERT_LOCATION — format json — roots “$STEPPATH/certs/root_ca.crt” | \
jq -e “(((.validity.start | fromdate) + \
((.validity.end | fromdate) — (.validity.start | fromdate)) * 0.66) \
 — now) <= 0” > /dev/null’
ExecStart=/snap/bin/certbot -q renew
ExecStartPost=/bin/systemctl reload vault.service
Type=oneshot

• Create timer service that triggers certbot service:

sudo nano /etc/systemd/system/certbot.timer

[Unit]

Description=Ongoing renewal of certificates

[Timer]

OnCalendar=*:0/15

RandomizedDelaySec=10

Persistent=true

[Install]

WantedBy=timers.target

• Reload the service daemon:

sudo systemctl daemon-reload

• Enable the timer service:

sudo systemctl enable certbot.timer

• Start the timer service:

sudo systemctl start certbot.timer

This should get Vault running and functional in your home lab with short-lived TLS certificates working in the mix.

• Addendum:
  You may need to modify the permissions on /etc/letsencrypt/live/ and /etc/letsencrypt/archive/ with:

chmod 755 /etc/letsencrypt/live/
chmod 755 /etc/letsencrypt/archive/
(https://github.com/certbot/certbot/issues/5257)

Enjoy!!

I was up by 7am to make sure The Boss was not without the Internet only to find it still disconnected. A slight panic now set in as this was most unusual.

Long story short, I called ISP and help desk reset something at their end and I was told to reboot the router. Part of the information I was also given was that my router was 6 years old! Six years!! They offered to send me a replacement at some cost but I declined the offer.

Well, after the reboot, the Internet was restored but I realised I had a serious problem: A six year old Internet router is a significant security risk to my home network. I checked the firmware on the router and the last time it was updated was 2016, four years ago! And it was no longer supported. Yikes!!

I had to do something about this, I thought. With most of the UK now working from home, our home networks are significantly more attractive to malicious actors who may be after any high value assets connected to them like company/business computers.

Accentuating the threat is the number of Internet connected devices the average household now has. I have 52 Internet connected devices in my 2 person household (Ring, temp & humidity sensors, Alexa devices, mobile phones, TVs, Smart this, Smart that). Any one of these devices, if breached, could be the launchpad for lateral movement.

Working from home is going nowhere soon so I came up with a plan to better protect and segment my home network.

I invested in an OpenWRT router, a pfSense firewall and used VLANs to segment the network: IoT and other devices can talk to the Internet but not my “secure subnet’ and I can manage the network from the secure subnet.

The layout now looks something like this:

I’ve been running the firewall for a few days now and, believe it or not, what we suspected will happen is happening already. But not from the expected or ‘usual suspects’.

Also what I see on my network is unlikely to be specific to me. My external IP address, to all intents and purposes, is ‘dead’ to external scrutiny (grc scan). So, what I see must be random scanning of subscriber IP networks looking for easy takings.

So where do these scans and potentially malicious probes come from? This is what I’ve observed so far:

Over half the malicious scans, 57%, can be attributed to nodes from the US and Russia. China is a “distant” 4th, contributing 8% of malicious traffic.

It seems like the US and Russia are the folk we need to be worried about! :)

I can only imagine these probes will get more intense with time and will probably get more clever too. No device is hack-proof and part of surviving in this “new way of life” is to take better ownership of your home network.

Checking your Internet router is up to date with firmware and software versions is a good place to start.