Friday, December 5, 2014

Secure Foscam IP Cameras with SSL on Raspberry PI and NGINX

Foscam + Raspberry Pi = SSL

When my first kid was born, my wife and I wanted a convenient, cheap, but externally accessible way to monitor our daughter. Thus, the usual baby monitors wouldn't do the trick. We ended up getting a really handy and super cheap Foscam FI8910W IP Camera.

Everything about it is pretty great … except security. For that reason, I never poked a hole through my firewall so that friends and family could peek in on Piper from time to time. I could always access the camera over VPN, but nobody else could ('cause I'm stingy with my network access).

When I found out I had another one on the way, I decided that not only did I need another camera, but I needed a more convenient way to securely access my cameras from outside my house. I decided I to pick up a Raspberry Pi and expose an https endpoint that could reverse proxy requests to my ip camera. This way, I have a secure connection into my house. It's still plain text between the camera and the pi, but that's inside my network and I'm less concerned about it there.

In any case, I picked up a Raspberry Pi Starter Kit which I recommend for your first pi. It'll come with the components you'll need to get set up. The second time I did this (for the sake of recording the steps to write this blog, I just formatted my own noobs card and I used the wifi dongle from the previous pi kit.

I tried to install noobs lite on an 8gb microsd card I got from the Raspberry Pi Downloads page, but noobs lite didn't work with the wifi dongle so I recommend plain old noobs. For the second time around, I just downloaded Raspbian and used dd to image the microsd. Again, I recommend noobs (and I recommend the starter kit) unless you feel pretty comfortable with command line utilities. If you are, use the instructions for installing operating system images from the raspberry pi site.

Pi

That being said, with noobs, you just format your micro SD card with FAT and copy the contents of the noobs zip to the sd card root. Put the SD card in the pi, connect the mouse and keyboard, connect ethernet or the wifi dongle, connect some video output, etc. Then, plug in the device.

The first thing to do is get connected to wifi. It's easier to do in the GUI so run startx, configure your wifi network, and log out.

Enable SSH in sudo raspi-config.

Using SSH to administer a box is kind of a pain without tmux so get that. Also, vim is awesome so get that too. Finally, we're going to be using nginx as our reverse proxy so install that as well.

sudo apt-get update && sudo apt-get install tmux vim nginx
To make SSH even easier, scp your public key to your pi's ~/.ssh folder and cat it into authorized_keys.

If you are using wifi, you'll find that wifi is disable after rebooting until the dongle is removed and re-inserted. You can change this behavior by executing

sudo vim /etc/network/interfaces
and changing
iface wlan0 inet manual
wpa-roam /etc/wpa_supplicant/wpa_supplicant.conf
to
auto wlan0
iface wlan0 inet dhcp
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

You'll want nginx to start automatically on reboot too probably so execute

sudo update-rc.d nginx defaults

Router

Give your pi a static ip address. My router lets me map static ips to mac addresses. DD-WRT lets you do that too. If you can't with your router, configure a static ip address following the Debian Network Configuration Instructions.

Give your router a static ip as well.

Forward port 443 (the default SSL port) to 443 on the pi's IP address

Get a dynamic DNS account that's supported by your router. If your router doesn't do dynamic DNS (and you can't install a decent firmware that does, you can use ddclient on your pi instead.

Domain

You'll need a domain name that you own to get an SSL certificate. Register one.

In your domain's DNS configuration, create a subdomain with a CNAME record pointing to your dynamic DNS domain.

SSL

Get your SSL certificate from Start SSL (the free certificate will be fine). You'll have to validate your domain. The process is pretty straightforward.

Download your certificate, key, and the intermediate certificates and make a unified certificate:

wget http://www.startssl.com/certs/ca.pem
wget http://www.startssl.com/certs/sub.class1.server.ca.pem
cat ssl.crt sub.class1.server.ca.pem ca.pem > ssl-unified.crt

SCP the key and the unified certificate to the pi's /etc/nginx folder (I like putting my certs in a subfolder)

Configure nginx

Create a configuration file called /etc/nginx/sites-available/ipcams

server {
  listen 80;

  server_name your.domain.com;
  server_name your.pi.ip.address;

  return 301 https://$host$request_uri;
}

server {
  listen 443 ssl;

  ssl_certificate /etc/nginx/certs/ssl-unified.crt;
  ssl_certificate_key /etc/nginx/certs/ssl.key;

  server_name your.domain.com;
  server_name your.pi.ip.address;

  location /front_porch/ {
    proxy_pass http://your.porch_cam.ip.address:80/;
  }

  location /baby_room/ {
    proxy_pass http://your.baby_cam.ip.address:80/;
  }
}

Remove the default symlink from /etc/nginx/sites-enabled and add new symlink

cd /etc/nginx/sites-enabled
sudo ln -s ../sites-available/ipcams ./ipcams

Restart nginx:

sudo service nginx restart

Summary

So, now https requests to your subdomain are resolved by your dynamic DNS to point to your IP where your Pi is. Your Pi gets an https request and forwards it inside your well protected network (in plain text) to your camera. I keep my Pi wired to cut back on the wireless traffic that happens in plain text. In any case, this way you can get from outside your house to inside your house over an encrypted ssl connection.

78 comments:

  1. Imprnt are engaged in offering a quality range of Access Control System. Due to their efficient performance, minimum maintenance and high identification speed, the systems are highly appreciated by our clients.
    This post is very helpful .Thanks a lot for this post that share with us . You can get more information here:
    ip camera
    goedkope ip camera
    ip camera kopen
    bewakingscamera
    bewakingscamera kopen
    goedkope bewakingscamera

    ReplyDelete
  2. Excellent post! Pretty much what I was looking for :) Do you have port forwarding setup for the Pi to the router? Does the video quality suffer?


    I am looking at BlueIris, but I am worried if I expose a windows machine, the attack surface would be more.( It does have recording capabilities though)

    Cheers,
    Ben


    ReplyDelete
  3. The post is very good because it gives many useful information about Power supply for Vilar IP camera which is a great product. ip camera .

    ReplyDelete
  4. Shard’s IP Camera Installation, wireless cameras and cloud cameras allow you set up a security system without the need to run wires around your home or business.

    And

    We provide Phone Systems to businesses across the UK, working with world-class manufacturers to offer a full range of telephony systems that can be tailored to your needs. We cater for businesses of any size, and offer a diverse product range from basic two-user phone systems through to multi-feature systems.

    ReplyDelete
  5. I am having a problem with this setup. Everything works right until the plugin starts and then it times out.

    ReplyDelete

  6. شرکت هوشمند افزار آسیا یکی از قدرتمند ترین شرکت های حوزه سیستم های امنیتی و نظارت تصویری و دوربین های مداربسته
    نماینده فروش دوربین های مداربسته هایک ویژن در کرج و تهران

    نصب دوربین مداربسته
    نماینده فروش دوربین های مداربسته هایک ویژن در کرج و تهران
    نماینده فروش دوربین های مداربسته هایک ویژن در کرج و تهران

    مجله تخصصی دوربین مداربسته و سیستم های حفاظتی و امنیتی
    02634216001-02634216002

    ReplyDelete
  7. As you start your search for security cameras you will see security cameras that cost $100 and security cameras that cost $3500. In addition, all camera manufacturers will state their cameras produce the best picture quality under any circumstance. The truth is, just like everything else in life, you get what you pay for. Dash Cameras

    ReplyDelete
  8. This article provides the readers with useful tips that can help them in purchasing new home security alarms for their Melbourne Hikvision It details the important points that need to be remembered when buying a new security alarm system.

    ReplyDelete
  9. There are few places in today's 'Big Brother' world you can go without encountering CCTV cameras. For good or bad, they are here to stay. There is no doubt that covert and overt Serious Security CCTV cameras play an important part in reducing crime and enhancing safety but do we need so many?

    ReplyDelete
  10. Hey! Nice stuff, do tell us when you post something like that! camworks 2019 sp3

    ReplyDelete
  11. Starting a business in Australia can be either simple or complex, depending on the way you choose to structure your enterprise. There are four basic structures that you can choose from. These are Sole Trader, Partnership, Company or Trust. cad cam cnc software for sale

    ReplyDelete
  12. SEO provides you opportunity to make your site visible in search engines. There are many SEO packages available in market but you have choose which SEO packages suites your business needs. high da backlinks

    ReplyDelete
  13. SEO provides you opportunity to make your site visible in search engines. There are many SEO packages available in market but you have choose which SEO packages suites your business needs. how to get dofollow backlinks

    ReplyDelete
  14. SEO provides you opportunity to make your site visible in search engines. There are many SEO packages available in market but you have choose which SEO packages suites your business needs. buy seo services online

    ReplyDelete
  15. Once I initially commented I clicked the -Notify me when new comments are added- checkbox and now each time a comment is added I get four emails with the same comment. Is there any method you can take away me from that service? Thanks! 먹튀검증

    ReplyDelete
  16. I visited a lot of website but I conceive this one holds something special in it in it 먹튀검증업체

    ReplyDelete
  17. I can understand that this is life during wartime, but many other films of this genre manage to squeeze in some hot babe scenes. 먹튀

    ReplyDelete
  18. My California Weight Loss diet invariably is an cost effective and versatile staying on your diet tv show made for people who find themselves planning to drop extra pounds and furthermore ultimately keep a much healthier habits. la weight loss 안전놀이터검증

    ReplyDelete
  19. You are about to learn about a review tip offered to a local business CEO about who was assassinating their reputation and possibly causing the business to lose profits right from the businesses bottom line, which could possibly be happening in your business? I was going to wait for the CEO to reply after my initial contact but I knew this person was busy so I wanted to give the CEO all the facts up front to make any decisions on in this matter that had to be made. quitmasturbating

    ReplyDelete
  20. ??? ??? ???? ?????? ?? ????? ????? ????? ?? ?????? ?????? ????? . ????? ??????? ????? ?????? ????? ??????? ?????? ??????? ???? ????? ?????? ??????? ??? ?????? ??? ?? ??????? money ????? ????????. 우리카지노계열

    ReplyDelete
  21. Although my area of expertise is in the Internet Marketing niche, as I was writing this article, I noticed the information would also work for traditional start up businesses as well. You will notice there are no references to Internet Marketing, etc. This is because I also wanted to share this information with anyone who is planning on starting a "traditional, brick and mortar" business. But the information contained here also applies to my friends who opt to go with the trend of online marketing as well. In this article, we focus on the initial planning steps of getting your business up and ready to open. Local News Feed New York

    ReplyDelete
  22. After examine just a few of the blog posts on your website now, and I actually like your approach of blogging. I bookmarked it to my bookmark web site record and will likely be checking back soon. Pls try my web site as effectively and let me know what you think. 먹튀

    ReplyDelete
  23. After examine just a few of the blog posts on your website now, and I actually like your approach of blogging. I bookmarked it to my bookmark web site record and will likely be checking back soon. Pls try my web site as effectively and let me know what you think. Mega888 android and ios

    ReplyDelete
  24. Wonderful goods from you, man. I’ve understand your stuff previous to and you’re just extremely magnificent. I actually like what you have acquired here, really like what you are saying and the way in which you say it. You make it entertaining and you still take care of to keep it wise. I can not wait to read much more from you. This is actually a wonderful web site. 먹튀

    ReplyDelete
  25. A very awesome blog post. We are really grateful for your blog post. combat, law enforcement You will find a lot of approaches after visiting your post. I was exactly searching for. Thanks for such post and please keep it up. Great work. 먹튀검증

    ReplyDelete
  26. It was nice to be on the website here. I will come back often in the future. Good day!서울출장안마

    ReplyDelete
  27. 이 블로그는 정말 훌륭합니다. 여기에있는 정보는 확실히 저에게 도움이 될 것입니다. 감사 ! 먹튀검증

    ReplyDelete
  28. I invite you to the page where you can read       with interesting information on similar topics 먹튀신고

    ReplyDelete
  29. I invite you to the page where you can read       with interesting information on similar topics 먹튀신고

    ReplyDelete
  30. With the US economy continues to pick up steam from the Great Recession, businesses are looking for growth capital and as a result, commercial banks are beginning to be IN STYLE once again. If anything we can be sure of both as consumers and producers in the US, business cycles are a given reality that requires wisdom and discipline to foresee and adequately prepare for.. 출장안마

    ReplyDelete
  31. I like viewing web sites which comprehend the price of delivering the excellent useful resource free of charge. I truly adored reading your posting. Thank you! 먹튀신고

    ReplyDelete
  32. The post is written in very a good manner and it contains many useful information for me 안전놀이터

    ReplyDelete
  33. ❤ I favor the idea, such a good deal buy traffic

    ReplyDelete
  34. ❤ I favor the idea, such a good deal 토토

    ReplyDelete
  35. Personally I think overjoyed I discovered the blogs. 먹튀폴리스

    ReplyDelete
  36. Choosing a technology partner should not be made lightly with all of the money and time invested in a project. For this reason you have to do your homework and find out which company will be the best fit for your team, company, and project. You have to be willing to ask questions, get references and referrals, and take the time to consider the compatibility of teams. Be open and receptive to the things that different companies have to offer and align those with the things you are looking for. In the end taking the time to find a technology partner that you can trust will pay off and could lead to future collaborations. Greenhouse Gas

    ReplyDelete
  37. Business is a tough game. Continually we need to operate in three areas to ensure we produce consistent outcomes. The businesses we work with are challenged to: Additional reading

    ReplyDelete
  38. Decent data, profitable and phenomenal outline, as offer well done with smart thoughts and ideas, bunches of extraordinary data and motivation, both of which I require, on account of offer such an accommodating data her 사설토토

    ReplyDelete
  39. I am always searching online for articles that can help me. There is obviously a lot to know about this. I think you made some good points in Features also. Keep working, great job! seo tijuana

    ReplyDelete
  40. This is very useful, although it will be important to help simply click that web page link: used motorcycles for sale

    ReplyDelete
  41. wow muy impresionante, nunca he visto algo así antes Seo Ottawa

    ReplyDelete
  42. Thats really a nice and worthy post, this Stiglitz topic is very interesting. Keep it up with the good work, thanks for sharing this article polaris dealer

    ReplyDelete
  43. Thanks for a wonderful share. Your article has proved your hard work and experience you have got in this field. Brilliant .i love it reading Auto Shop Reading

    ReplyDelete
  44. I think this is a sublime article, and the content published is fantastic. This content will help me to complete a paper that I've been working on for the last 2 weeks. It was a difficult 2 weeks, but I am glad the work is done now. Used Audi Reading

    ReplyDelete
  45. I invite you to the page where you can read       with interesting information on similar topics. Transfer From Airport

    ReplyDelete
  46. Such a very useful article. Very interesting to read this article. I would like to thank you for the efforts you had made for writing this awesome article. 검증업체

    ReplyDelete
  47. I definitely enjoying every little bit of it and I have you bookmarked to check out new stuff you post. 먹튀폴리스

    ReplyDelete
  48. this is really good website, coolest I have ever visit thank you so much, i will follow and stay tuned much appriciated 먹튀검증

    ReplyDelete
  49. I invite you to the page where you can read       with interesting information on similar topics. 안전놀이터

    ReplyDelete
  50. Your substance is completely splendid from various perspectives. I think this is drawing in and educational material. Much obliged to you such a great amount for thinking about your substance and your perusers. Buy Klonopin Online

    ReplyDelete
  51. Electrical power dissertation web-sites on-line when you likewise be given clearly advertised with your web page. voyance

    ReplyDelete
  52. men and women think.
    Also, many thanks for allowing for me to comment! 토토사이트검증

    ReplyDelete
  53. Good article! We are linking to this particularly great post on our site. Keep up the great writing.토토먹튀

    ReplyDelete
  54. First of all, thank you for letting me see this information. I think this article can give me a lot of inspiration. I would appreciate 바둑이사이트 if you could post more good contents in the future.

    ReplyDelete
  55. Hello! Nice to meet you, I say . The name of the community I run is 안전놀이터, and the community I run contains articles similar to your blog. If you have time, I would be very grateful if you visit my site .

    ReplyDelete
  56. It is perfect time to make some plans for the future and it is time to be happy. 토토사이트 I've read this post and if I could I desire to suggest you some interesting things or suggestions. Perhaps you could write next articles referring to this article. I want to read more things about it!

    ReplyDelete
  57. Promptly your blog might irrefutably typically possibly be visible related to each one of blog site people today, on account of diligent studies and as well lab tests. top explainer video companies near me

    ReplyDelete
  58. Your article was very impressive to me. It was unexpected information,but after reading it like this 바둑이사이트, I found it very interesting.

    ReplyDelete
  59. My curiosity was solved by looking at your writing. Your writing was helpful to me.카지노사이트I want to help you too.

    ReplyDelete
  60. I'm writing on this topic these days, 먹튀검증, but I have stopped writing because there is no reference material. Then I accidentally found your article. I can refer to a variety of materials, so I think the work I was preparing will work! Thank you for your efforts.

    ReplyDelete
  61. Your post is very helpful to get some effective tips to reduce weight properly. You have shared various nice photos of the same. I would like to thank you for sharing these tips. Surely I will try this at home. Keep updating more simple tips like this.해선커뮤니티

    ReplyDelete
  62. I haven't seen anything interesting in a long time, and I'm writing on this form, so I hope to see you.토토사이트

    ReplyDelete
  63. I got a web site from where I be capable of really obtain valuable information regarding my study and knowledge.
    Great Article… Good Job… Thanks For Sharing…

    Website:풀싸롱

    ReplyDelete
  64. wonderful points altogether,Perfect. I'll come often. Great work! 토토존보증업체

    ReplyDelete
  65. That's a really good piece of data. Amazing.Thank you. I'll be back every day 안전사이트

    ReplyDelete
  66. Wow, superb blog layout! How long have you been blogging for? you made blogging look easy. The overall look of your website is excellent, as well as the content! 먹튀검증

    ReplyDelete
  67. thing needs to happen! Simply letting the quota happen isn’t acceptable. This will help you stay above the curve 먹튀폴리스

    ReplyDelete
  68. IE nonetheless is the market leader and a huge component to other people will leave out your great writing because of this problem 메이저사이트

    ReplyDelete
  69. carried out right here. The sketch is tasteful, 보증업체 your authored subject Thank you for doing my research for me

    ReplyDelete
  70. Thank you. I'll be back every day. Guess I will just bookmark this site 먹튀검증커뮤니티

    ReplyDelete
  71. Every time you have this place like this,Guess I will just bookmark this site. 해외안전공원

    ReplyDelete
  72. As I am looking at your writing, 온라인바둑이 I regret being unable to do outdoor activities due to Corona 19, and I miss my old daily life. If you also miss the daily life of those days, would you please visit my site once? My site is a site where I post about photos and daily life when I was free.

    ReplyDelete
  73. Bank turned you down for a business loan? Did you know that there may be another local financial institution that is more likely to say yes? Fortune best cryptocurrency

    ReplyDelete