Friday, December 5, 2014

Secure Foscam IP Cameras with SSL on Raspberry PI and NGINX

Foscam + Raspberry Pi = SSL

When my first kid was born, my wife and I wanted a convenient, cheap, but externally accessible way to monitor our daughter. Thus, the usual baby monitors wouldn't do the trick. We ended up getting a really handy and super cheap Foscam FI8910W IP Camera.

Everything about it is pretty great … except security. For that reason, I never poked a hole through my firewall so that friends and family could peek in on Piper from time to time. I could always access the camera over VPN, but nobody else could ('cause I'm stingy with my network access).

When I found out I had another one on the way, I decided that not only did I need another camera, but I needed a more convenient way to securely access my cameras from outside my house. I decided I to pick up a Raspberry Pi and expose an https endpoint that could reverse proxy requests to my ip camera. This way, I have a secure connection into my house. It's still plain text between the camera and the pi, but that's inside my network and I'm less concerned about it there.

In any case, I picked up a Raspberry Pi Starter Kit which I recommend for your first pi. It'll come with the components you'll need to get set up. The second time I did this (for the sake of recording the steps to write this blog, I just formatted my own noobs card and I used the wifi dongle from the previous pi kit.

I tried to install noobs lite on an 8gb microsd card I got from the Raspberry Pi Downloads page, but noobs lite didn't work with the wifi dongle so I recommend plain old noobs. For the second time around, I just downloaded Raspbian and used dd to image the microsd. Again, I recommend noobs (and I recommend the starter kit) unless you feel pretty comfortable with command line utilities. If you are, use the instructions for installing operating system images from the raspberry pi site.

Pi

That being said, with noobs, you just format your micro SD card with FAT and copy the contents of the noobs zip to the sd card root. Put the SD card in the pi, connect the mouse and keyboard, connect ethernet or the wifi dongle, connect some video output, etc. Then, plug in the device.

The first thing to do is get connected to wifi. It's easier to do in the GUI so run startx, configure your wifi network, and log out.

Enable SSH in sudo raspi-config.

Using SSH to administer a box is kind of a pain without tmux so get that. Also, vim is awesome so get that too. Finally, we're going to be using nginx as our reverse proxy so install that as well.

sudo apt-get update && sudo apt-get install tmux vim nginx
To make SSH even easier, scp your public key to your pi's ~/.ssh folder and cat it into authorized_keys.

If you are using wifi, you'll find that wifi is disable after rebooting until the dongle is removed and re-inserted. You can change this behavior by executing

sudo vim /etc/network/interfaces
and changing
iface wlan0 inet manual
wpa-roam /etc/wpa_supplicant/wpa_supplicant.conf
to
auto wlan0
iface wlan0 inet dhcp
wpa-conf /etc/wpa_supplicant/wpa_supplicant.conf

You'll want nginx to start automatically on reboot too probably so execute

sudo update-rc.d nginx defaults

Router

Give your pi a static ip address. My router lets me map static ips to mac addresses. DD-WRT lets you do that too. If you can't with your router, configure a static ip address following the Debian Network Configuration Instructions.

Give your router a static ip as well.

Forward port 443 (the default SSL port) to 443 on the pi's IP address

Get a dynamic DNS account that's supported by your router. If your router doesn't do dynamic DNS (and you can't install a decent firmware that does, you can use ddclient on your pi instead.

Domain

You'll need a domain name that you own to get an SSL certificate. Register one.

In your domain's DNS configuration, create a subdomain with a CNAME record pointing to your dynamic DNS domain.

SSL

Get your SSL certificate from Start SSL (the free certificate will be fine). You'll have to validate your domain. The process is pretty straightforward.

Download your certificate, key, and the intermediate certificates and make a unified certificate:

wget http://www.startssl.com/certs/ca.pem
wget http://www.startssl.com/certs/sub.class1.server.ca.pem
cat ssl.crt sub.class1.server.ca.pem ca.pem > ssl-unified.crt

SCP the key and the unified certificate to the pi's /etc/nginx folder (I like putting my certs in a subfolder)

Configure nginx

Create a configuration file called /etc/nginx/sites-available/ipcams

server {
  listen 80;

  server_name your.domain.com;
  server_name your.pi.ip.address;

  return 301 https://$host$request_uri;
}

server {
  listen 443 ssl;

  ssl_certificate /etc/nginx/certs/ssl-unified.crt;
  ssl_certificate_key /etc/nginx/certs/ssl.key;

  server_name your.domain.com;
  server_name your.pi.ip.address;

  location /front_porch/ {
    proxy_pass http://your.porch_cam.ip.address:80/;
  }

  location /baby_room/ {
    proxy_pass http://your.baby_cam.ip.address:80/;
  }
}

Remove the default symlink from /etc/nginx/sites-enabled and add new symlink

cd /etc/nginx/sites-enabled
sudo ln -s ../sites-available/ipcams ./ipcams

Restart nginx:

sudo service nginx restart

Summary

So, now https requests to your subdomain are resolved by your dynamic DNS to point to your IP where your Pi is. Your Pi gets an https request and forwards it inside your well protected network (in plain text) to your camera. I keep my Pi wired to cut back on the wireless traffic that happens in plain text. In any case, this way you can get from outside your house to inside your house over an encrypted ssl connection.

55 comments:

  1. Imprnt are engaged in offering a quality range of Access Control System. Due to their efficient performance, minimum maintenance and high identification speed, the systems are highly appreciated by our clients.
    This post is very helpful .Thanks a lot for this post that share with us . You can get more information here:
    ip camera
    goedkope ip camera
    ip camera kopen
    bewakingscamera
    bewakingscamera kopen
    goedkope bewakingscamera

    ReplyDelete
  2. Excellent post! Pretty much what I was looking for :) Do you have port forwarding setup for the Pi to the router? Does the video quality suffer?


    I am looking at BlueIris, but I am worried if I expose a windows machine, the attack surface would be more.( It does have recording capabilities though)

    Cheers,
    Ben


    ReplyDelete
  3. The post is very good because it gives many useful information about Power supply for Vilar IP camera which is a great product. ip camera .

    ReplyDelete
  4. Shard’s IP Camera Installation, wireless cameras and cloud cameras allow you set up a security system without the need to run wires around your home or business.

    And

    We provide Phone Systems to businesses across the UK, working with world-class manufacturers to offer a full range of telephony systems that can be tailored to your needs. We cater for businesses of any size, and offer a diverse product range from basic two-user phone systems through to multi-feature systems.

    ReplyDelete
  5. I am having a problem with this setup. Everything works right until the plugin starts and then it times out.

    ReplyDelete

  6. شرکت هوشمند افزار آسیا یکی از قدرتمند ترین شرکت های حوزه سیستم های امنیتی و نظارت تصویری و دوربین های مداربسته
    نماینده فروش دوربین های مداربسته هایک ویژن در کرج و تهران

    نصب دوربین مداربسته
    نماینده فروش دوربین های مداربسته هایک ویژن در کرج و تهران
    نماینده فروش دوربین های مداربسته هایک ویژن در کرج و تهران

    مجله تخصصی دوربین مداربسته و سیستم های حفاظتی و امنیتی
    02634216001-02634216002

    ReplyDelete
  7. As you start your search for security cameras you will see security cameras that cost $100 and security cameras that cost $3500. In addition, all camera manufacturers will state their cameras produce the best picture quality under any circumstance. The truth is, just like everything else in life, you get what you pay for. Dash Cameras

    ReplyDelete
  8. This article provides the readers with useful tips that can help them in purchasing new home security alarms for their Melbourne Hikvision It details the important points that need to be remembered when buying a new security alarm system.

    ReplyDelete
  9. There are few places in today's 'Big Brother' world you can go without encountering CCTV cameras. For good or bad, they are here to stay. There is no doubt that covert and overt Serious Security CCTV cameras play an important part in reducing crime and enhancing safety but do we need so many?

    ReplyDelete
  10. Hey! Nice stuff, do tell us when you post something like that! camworks 2019 sp3

    ReplyDelete
  11. Starting a business in Australia can be either simple or complex, depending on the way you choose to structure your enterprise. There are four basic structures that you can choose from. These are Sole Trader, Partnership, Company or Trust. cad cam cnc software for sale

    ReplyDelete
  12. SEO provides you opportunity to make your site visible in search engines. There are many SEO packages available in market but you have choose which SEO packages suites your business needs. high da backlinks

    ReplyDelete
  13. SEO provides you opportunity to make your site visible in search engines. There are many SEO packages available in market but you have choose which SEO packages suites your business needs. how to get dofollow backlinks

    ReplyDelete
  14. SEO provides you opportunity to make your site visible in search engines. There are many SEO packages available in market but you have choose which SEO packages suites your business needs. buy seo services online

    ReplyDelete
  15. Once I initially commented I clicked the -Notify me when new comments are added- checkbox and now each time a comment is added I get four emails with the same comment. Is there any method you can take away me from that service? Thanks! 먹튀검증

    ReplyDelete
  16. I visited a lot of website but I conceive this one holds something special in it in it 먹튀검증업체

    ReplyDelete
  17. I can understand that this is life during wartime, but many other films of this genre manage to squeeze in some hot babe scenes. 먹튀

    ReplyDelete
  18. My California Weight Loss diet invariably is an cost effective and versatile staying on your diet tv show made for people who find themselves planning to drop extra pounds and furthermore ultimately keep a much healthier habits. la weight loss 안전놀이터검증

    ReplyDelete
  19. You are about to learn about a review tip offered to a local business CEO about who was assassinating their reputation and possibly causing the business to lose profits right from the businesses bottom line, which could possibly be happening in your business? I was going to wait for the CEO to reply after my initial contact but I knew this person was busy so I wanted to give the CEO all the facts up front to make any decisions on in this matter that had to be made. quitmasturbating

    ReplyDelete
  20. ??? ??? ???? ?????? ?? ????? ????? ????? ?? ?????? ?????? ????? . ????? ??????? ????? ?????? ????? ??????? ?????? ??????? ???? ????? ?????? ??????? ??? ?????? ??? ?? ??????? money ????? ????????. 우리카지노계열

    ReplyDelete
  21. Although my area of expertise is in the Internet Marketing niche, as I was writing this article, I noticed the information would also work for traditional start up businesses as well. You will notice there are no references to Internet Marketing, etc. This is because I also wanted to share this information with anyone who is planning on starting a "traditional, brick and mortar" business. But the information contained here also applies to my friends who opt to go with the trend of online marketing as well. In this article, we focus on the initial planning steps of getting your business up and ready to open. Local News Feed New York

    ReplyDelete
  22. After examine just a few of the blog posts on your website now, and I actually like your approach of blogging. I bookmarked it to my bookmark web site record and will likely be checking back soon. Pls try my web site as effectively and let me know what you think. 먹튀

    ReplyDelete
  23. After examine just a few of the blog posts on your website now, and I actually like your approach of blogging. I bookmarked it to my bookmark web site record and will likely be checking back soon. Pls try my web site as effectively and let me know what you think. Mega888 android and ios

    ReplyDelete
  24. Wonderful goods from you, man. I’ve understand your stuff previous to and you’re just extremely magnificent. I actually like what you have acquired here, really like what you are saying and the way in which you say it. You make it entertaining and you still take care of to keep it wise. I can not wait to read much more from you. This is actually a wonderful web site. 먹튀

    ReplyDelete
  25. A very awesome blog post. We are really grateful for your blog post. combat, law enforcement You will find a lot of approaches after visiting your post. I was exactly searching for. Thanks for such post and please keep it up. Great work. 먹튀검증

    ReplyDelete
  26. It was nice to be on the website here. I will come back often in the future. Good day!서울출장안마

    ReplyDelete
  27. 이 블로그는 정말 훌륭합니다. 여기에있는 정보는 확실히 저에게 도움이 될 것입니다. 감사 ! 먹튀검증

    ReplyDelete
  28. I invite you to the page where you can read       with interesting information on similar topics 먹튀신고

    ReplyDelete
  29. I invite you to the page where you can read       with interesting information on similar topics 먹튀신고

    ReplyDelete
  30. With the US economy continues to pick up steam from the Great Recession, businesses are looking for growth capital and as a result, commercial banks are beginning to be IN STYLE once again. If anything we can be sure of both as consumers and producers in the US, business cycles are a given reality that requires wisdom and discipline to foresee and adequately prepare for.. 출장안마

    ReplyDelete
  31. I like viewing web sites which comprehend the price of delivering the excellent useful resource free of charge. I truly adored reading your posting. Thank you! 먹튀신고

    ReplyDelete
  32. The post is written in very a good manner and it contains many useful information for me 안전놀이터

    ReplyDelete
  33. ❤ I favor the idea, such a good deal buy traffic

    ReplyDelete
  34. ❤ I favor the idea, such a good deal 토토

    ReplyDelete
  35. Personally I think overjoyed I discovered the blogs. 먹튀폴리스

    ReplyDelete
  36. Choosing a technology partner should not be made lightly with all of the money and time invested in a project. For this reason you have to do your homework and find out which company will be the best fit for your team, company, and project. You have to be willing to ask questions, get references and referrals, and take the time to consider the compatibility of teams. Be open and receptive to the things that different companies have to offer and align those with the things you are looking for. In the end taking the time to find a technology partner that you can trust will pay off and could lead to future collaborations. Greenhouse Gas

    ReplyDelete
  37. Business is a tough game. Continually we need to operate in three areas to ensure we produce consistent outcomes. The businesses we work with are challenged to: Additional reading

    ReplyDelete
  38. Decent data, profitable and phenomenal outline, as offer well done with smart thoughts and ideas, bunches of extraordinary data and motivation, both of which I require, on account of offer such an accommodating data her 사설토토

    ReplyDelete
  39. I am always searching online for articles that can help me. There is obviously a lot to know about this. I think you made some good points in Features also. Keep working, great job! seo tijuana

    ReplyDelete
  40. This is very useful, although it will be important to help simply click that web page link: used motorcycles for sale

    ReplyDelete
  41. wow muy impresionante, nunca he visto algo así antes Seo Ottawa

    ReplyDelete
  42. Thats really a nice and worthy post, this Stiglitz topic is very interesting. Keep it up with the good work, thanks for sharing this article polaris dealer

    ReplyDelete
  43. Thanks for a wonderful share. Your article has proved your hard work and experience you have got in this field. Brilliant .i love it reading Auto Shop Reading

    ReplyDelete
  44. I think this is a sublime article, and the content published is fantastic. This content will help me to complete a paper that I've been working on for the last 2 weeks. It was a difficult 2 weeks, but I am glad the work is done now. Used Audi Reading

    ReplyDelete
  45. I invite you to the page where you can read       with interesting information on similar topics. Transfer From Airport

    ReplyDelete
  46. Such a very useful article. Very interesting to read this article. I would like to thank you for the efforts you had made for writing this awesome article. 검증업체

    ReplyDelete
  47. I definitely enjoying every little bit of it and I have you bookmarked to check out new stuff you post. 먹튀폴리스

    ReplyDelete
  48. this is really good website, coolest I have ever visit thank you so much, i will follow and stay tuned much appriciated 먹튀검증

    ReplyDelete
  49. I invite you to the page where you can read       with interesting information on similar topics. 안전놀이터

    ReplyDelete
  50. Your substance is completely splendid from various perspectives. I think this is drawing in and educational material. Much obliged to you such a great amount for thinking about your substance and your perusers. Buy Klonopin Online

    ReplyDelete