ThousandEyes Pi4 Wi-fi Deployment at Black Hat USA

Spread the love


A deployment information for wi-fi ThousandEyes brokers deployed to watch the Black Hat 2023 convention by Adam Kilgore & Ryan MacLennan

ThousandEyes (TE) Black Hat 2023 Deployment Information

This information paperwork the setup and set up procedures used to deploy ThousandEyes at Black Hat 2023. This doc covers configuration of the TE agent on Raspberry Pi 4, together with each wired and wi-fi configurations. Wanted {hardware} for the assorted setup features are additionally listed.

Limitations of Deploying ThousandEyes Enterprise Brokers on Raspberry Pi

Please notice that TE Enterprise Brokers will solely present information for layer 3 hops, and won’t present wi-fi entry level information. This is applicable to deploying the TE Enterprise Agent on the Raspberry Pi and configuring it for wi-fi. The one TE agent that may present wi-fi AP information is the TE Endpoint Agent, which is meant to be put in on laptops and private units.

{Hardware} Guidelines for the Convention

There are a number of completely different {hardware} contingencies that should be accounted for earlier than convention setup can happen.

  1. A keyboard that may connect with the USB port on the Raspberry Pi
  2. Laptops that may connect with the Pi Micro SD for TE agent provisioning. We used a number of completely different options for this:
    • An SD card to Micro SD adapter, which linked to the SD reader on a Mac laptop computer (the SD reader shouldn’t be accessible on all fashions)
    • A Vivitar Micro SD to USB-C adapter, which linked to the USB-C port on a Mac laptop computer
    • A Micro SD to USB adapter that got here with the Raspberry Pi 4 Cana Package. This was linked to a USB to USB-C Mac adapter
  3. Screens that may connect with the Raspberry Pi Micro HDMI port. This may be so simple as a standard HDMI monitor that connects to the Pi by way of HDMI to Micro HDMI, however these weren’t accessible through the setup days of the convention. We used two options:
    • A conveyable monitor that linked to the Pi by way of an HDMI to Micro HDMI cable
    • An adapter that linked to the Pi by way of Micro HDMI, linked to a Mac HDMI adapter, with the Mac HDMI adapter linked to a USB-C port on the Mac laptop computer

Pi {Hardware} Meeting

Black Hat 2023 Pi 4 Kits

10x Raspberry Pi 4 Cana Kits, every with the next:

  • 32GB Micro SD card
  • Micro SD to USB adapter
  • Case
  • Heatsink
  • Fan

Instance of constructed Pi with heatsinks and fan hooked up:

Word that we had overheating points with the fan set to tug air out of the case. Orienting the fan to blow into the Pi case was simpler for our deployment.

Provision the ThousandEyes Picture onto the Pi Micro SD

The Raspberry Pi can learn Micro SD playing cards. The set up process is to obtain the TE Pi installer from the TE GUI, join the Micro SDs to the provisioning laptops, after which use balenaEtcher to put in the TE picture to the Micro SD.

Retrieving the TE Agent Picture & Documentation

From the ThousandEyes GUI, navigate to Cloud & Enterprise Brokers > Agent Settings.

Click on on Add New Enterprise Agent.

Find the entry for Raspberry Pi 4 and click on the Obtain – IMG button. The Set up Information for the Pi set up can be accessible from this web page.

Join the Micro SD(s) to Provisioning Laptops

If the provisioning laptops shouldn’t have a Micro SD card reader then adapter options will probably be wanted to put in the TE picture to the Micro SD. For Black Hat 2023, we used a mixture of the next {hardware} with Mac laptops.

2x Vivitar Mac USB-C to Micro SD adapter

1x Mac USB-C to USB adapter + 1x USB Micro SD Card Reader (included with some Pi bundles—the USB has a further slot for the Micro SD card, which then plugs right into a USB port—on this case, the Mac adapter proven).

1x Micro SD to SD adapter

Set up the TE Picture to Micro SDs

We used balenaEtcher to jot down the TE photos to Micro SD, as lined within the TE Pi deployment information.

Word that Etcher can write a number of photos to a number of Micro SDs directly, your solely restrict is the variety of Micro SD playing cards that may be linked to the provisioning laptops (USB-C, Micro SD card reader, USB port, and so forth.) directly.

Optionally available: Use Scripts to Provision Wi-fi that may Persist Throughout Reboots

Creating the wi-fi configuration for the Pi can happen both earlier than or after booting the Pi for the primary time with the Micro SD picture that was configured within the prior part. If you need to create the wi-fi configuration earlier than booting the Pi, please comply with the steps on this part. Alternatively, if wi-fi shouldn’t be getting used or wi-fi configuration can happen after booting the Pi, this part can safely be skipped. Please notice that configuring wi-fi after booting the Pi would require enabling SSH on the TE agent, together with any requisite firewall guidelines to succeed in the Pi over port 22.

Additionally notice that this part requires particular {hardware} and software program, as lined within the subsequent paragraphs. If the wanted {hardware} and software program shouldn’t be accessible, the wi-fi configuration can nonetheless be achieved utilizing guide procedures given in later sections.

Earlier than starting the configuration, notice that the SSID and SSID password should be laborious coded. If the TE agent can’t connect with the hardcoded SSID after reboot, the wi-fi connection will fail. If the hardcoded SSID and password must be modified after the preliminary setup, it is going to be essential to (re)allow SSH on the TE agent.

Additionally notice that the TE agent file system should be mounted onto a laptop computer to carry out these steps. At Black Hat 2023, we have been solely in a position to accomplish this step utilizing a Linux OS. Makes an attempt to mount the Micro SD on Mac didn’t appropriately mount the TE agent partitions.

  • Log in to a Linux system and join a Micro SD with the TE agent put in (this process was lined within the prior part). Use the Micro SD connection methodology supplied at the beginning of the information.
  • Run the df command to confirm the mounted partitions. The under screenshot exhibits the df output earlier than and after connecting the Micro SD card, with the 2 mounted partitions seen after working the twond df command. Word the partition paths highlighted in crimson, as they are going to be wanted to create the doit.sh script in Step 5.

  • Create a file named rc.native in a selected listing. The particular identify ‘rc.native’ is important for the script to run through the TE agent bootup course of.
  • Create the script file:

# vim rc.native

  • Sort ‘i’ to edit, and sort or paste the next:

#!/bin/bash
/configure_te_pi.sh
exit 0

  • Sort ‘:’ then ‘wq!’ to avoid wasting the modifications and exit the file.
  • Create the configure_te_pi.sh script in the identical listing because the rc.native file. Exchange the <SSID> and <SSID password> fields within the under script with the SSID and PSK that the Pi will connect with. The SSID and PSK can be modified later, however this may require enabling SSH on the TE agent after which connecting to it.
  • Create the script file:

# vim configure_te_pi.sh

  • Sort ‘i’ to edit, and sort or paste the next:

#!/bin/bash
apt-get replace -y
apt-get set up te-va-unlock -y
apt-get set up net-tools ifmetric wireless-tools -y
ifconfig wlan0 up
wpa_passphrase <SSID> <SSID password> > /and so forth/wpa_supplicant.conf
wpa_supplicant -B -i wlan0 -c /and so forth/wpa_supplicant.conf -D wext
ifmetric eth0 200
sed -i ‘1iauto wlan0niface wlan0 inet dhcp’ /and so forth/community/interfaces
dhclient wlan0
systemctl masks apt-news.service
systemctl masks esm-cache.service

  • Sort ‘:’ then ‘wq!’ to avoid wasting the modifications and exit the file.
  • Create the doit.sh script in the identical listing because the prior two scripts. Word that the paths to the /writeable and /system-boot mounts will must be stuffed in with the paths collected in Step 1.
  • Create the script file:

# vim doit.sh

  • Sort ‘i’ to edit, and sort or paste the next, modifying the paths to match the output in Step 1:

#!/bin/bash
cp rc.native /media/<username>/writeable/and so forth
cp configure_te_pi.sh /media/<username>/writeable/and so forth
chmod +x /media/<username>/writeable/configure_te_pi.sh
chmod +x / media/<username>/writeable/and so forth/rc.native
umount /media/<username>/system-boot
umount /media/<username>/writable

  • Sort ‘:’ then ‘wq!’ to avoid wasting the modifications and exit the file.

An instance of the script created for the output in Step 1 is supplied under.

#!/bin/bash
cp ~iredden/rc.native /media/iredden/writable/and so forth
cp ~iredden/configure_te_pi.sh /media/iredden/writable
chmod +x /media/iredden/writable/configure_te_pi.sh
chmod +x /media/iredden/writable/and so forth/rc.native
umount /media/iredden/system-boot
umount /media/iredden/writable

  • Run the doit.sh script. The doit.sh script will carry out the configuration after which unmount the partitions, as proven under.

With the above steps full, the Micro SD card might be faraway from the laptop computer and linked to the Raspberry Pi. The Pi will execute the scripts throughout bootup and connect with wi-fi, if the SSID configured is reachable and the PSK is right. Please see the subsequent part for setup directions and different issues.

Additionally notice {that a} wired connection to the Pi continues to be really helpful for preliminary setup. Though the Pi TE agent can efficiently pull a wi-fi IP deal with throughout preliminary bootup, the TE agent is not going to show a wi-fi IP deal with on a linked monitor, solely a wired one.

Preliminary Setup of TE Agent

The Provision the ThousandEyes (TE) Picture onto the Pi Micro SD part of this information lined provision TE brokers onto Micro SD playing cards. An elective part masking script wi-fi functionality onto the TE agent picture was additionally supplied within the Use Scripts to Configure Wi-fi that may Persist Throughout Reboots part. This part will cowl use the TE agent on the Micro SD card to carry out preliminary setup.

Join Micro SD to Raspberry Pi

As soon as the TE picture has been put in on the Micro SD, join the Micro SD to the Raspberry Pi.

Join an Ethernet Cable to the Pi

It’s essential to know the IP deal with assigned to a TE agent after preliminary boot with a purpose to full preliminary registration. Whereas a Pi with a wi-fi configured TE agent can pull a wi-fi IP throughout its preliminary bootup, it is not going to show the wi-fi IP on a linked monitor, solely a wired IP deal with. For that reason, it’s nonetheless really helpful to attach an ethernet cable to a wi-fi Pi earlier than preliminary energy on and use the assigned eth0 IP to carry out preliminary setup. The one various to a wired connection on preliminary boot is to establish the wi-fi IP deal with of the TE agent by means aside from a linked monitor, reminiscent of by way of direct entry to the wi-fi AP that the TE agent connects to.

Join Keyboard and Monitor to Raspberry Pi

Two items of {hardware} are used to carry out the preliminary setup of the Raspberry Pi TE agent: (1) a keyboard that may connect with the Pi by way of USB, and (2) a display that may connect with the Pi by way of Micro HDMI. Preliminary setup might be carried out with out the keyboard if (a) an IP deal with is assigned to the TE agent by way of DHCP, and (b) the DHCP deal with might be recognized by way of the linked display or by different means. Equally, preliminary setup might be accomplished with out the display if there may be one other approach to establish the DHCP IP deal with assigned to the TE agent, reminiscent of admin entry to the change linked to the TE agent.

Regardless of the above options, a linked keyboard and monitor are really helpful for ease of deployment and any wanted troubleshooting.

For the keyboard, we used a Bluetooth keyboard with a indifferent USB fob, however any keyboard that may connect with the Pi by way of USB will work.

For the display, we used two separate {hardware} options.

The primary answer is a Kenowa transportable monitor with an HDMI to Micro HDMI cable. The HDMI facet of the cable connects to the Kenowa, and the Micro HDMI facet of the cable connects to the Raspberry Pi.

The second answer we used is an Elgato adapter that sits between the Raspberry Pi and a Mac laptop computer. The Pi connects to the Elgato by way of a micro HDMI to HDMI cable. The Elgato makes use of an everyday HDMI cable to connect with the HDMI facet of a Mac HDMI to USB-C adapter, with the USB-C facet of the Mac adapter connecting on to a Mac laptop computer.

Verify Pi {Hardware} Connections

With the {hardware} configurations within the prior sections full (i.e. the Pi is linked to an ethernet port, monitor, and keyboard), join the Pi energy adapter to start preliminary boot.

Hook up with the TE Agent GUI

As soon as the Pi is powered on, the TE agent set up will take a couple of minutes to run (extra if web entry shouldn’t be accessible). As soon as the bootup is full, the Pi will show a message if an IP deal with was assigned to the ethernet port by way of DHCP.

If no IP deal with was assigned to the ethernet port by way of DHCP, the TE agent will show a special message stating no IP deal with is configured. If that is so, it is going to be essential to both manually assign an IP deal with to the ethernet port utilizing a keyboard, or establish the IP deal with of the wi-fi interface utilizing admin entry to the linked wi-fi AP.

  • As soon as the IP deal with of the TE agent is thought, connect with the IP by way of HTTPS and sign up with username admin and password welcome.

  • Change the default password to one thing safer and click on Change Password.

  • The GUI ought to mechanically take you to Agent within the left menu.

  • Maintaining the ThousandEyes Bodily Equipment GUI open, create a brand new tab in your browser and connect with the ThousandEyes internet GUI, then click on on Cloud Enterprise Brokers > Agent Settings.

  • Click on on the Add New Enterprise Agent

  • Copy the Entry Group Token. Word: the Copy button could not work, wherein case click on the attention icon to point out the token and duplicate it manually.

  • Return to the TE agent GUI and paste the Account Group Token into the Agent Click on Proceed.

  • The GUI will mechanically load the Evaluation Equipment Standing and Diagnostics fields ought to change to inexperienced because the registration completes. Click on the Full button.

  • Click on on the Community tab.

  • Configure the hostname for the agent.

  • Scroll right down to the DNS configuration and enter the interior and Exterior DNS servers. By Default, the agent will use the 208.67.222.222 and 208.67.222.220 exterior Umbrella DNS servers. These might be moved to DNS server 3 and 4 if inside DNS servers are most popular.

Handbook Wi-fi Config Observe

The Raspberry Pi TE agent can solely join by way of a wired connection utilizing the default set up. If wi-fi is required for the deployment however the needed {hardware}/software program was not accessible for the Optionally available: Use Scripts to Configure Wi-fi that may Persist Throughout Reboots part, or if the TE agent has already been deployed, the sequence of guide configuration steps beginning on this part can be utilized to configure persistent wi-fi on a Pi TE agent.

Handbook Wi-fi Config Observe: Hook up with the TE Agent by way of SSH

Documentation for connecting to a Pi TE agent by way of SSH might be discovered on this information.

Handbook Wi-fi Config Observe: Jailbreak the TE Agent (to permit Wi-fi config)

Jailbreaking the TE agent is important for escalating to root and performing the instructions needed to construct the scripts for the wi-fi configuration.

We must always replace the Ubuntu OS earlier than working the jailbreak command. Hook up with the TE agent by way of SSH, then run the next two instructions to first replace the OS after which jailbreak the set up:

$ sudo apt-get replace
$ sudo apt-get set up te-va-unlock

With the TE agent efficiently jailbroken, we will now escalate to root and carry out the remainder of the configuration.

Handbook Wi-fi Config Observe: Configure Wi-fi that may Persist Throughout Reboots utilizing solely the Pi

Earlier than starting this part, notice that the SSID and SSID password should be laborious coded. If the TE agent can’t connect with the hardcoded SSID after reboot, the wi-fi connection will fail. If the hardcoded SSID and password must be modified after the preliminary setup, it is going to be essential to (re)allow SSH on the TE agent and connect with it over SSH.

  • Escalate to root and create a file named rc.native within the /and so forth listing. The identify is important for the script to run through the TE agent bootup course of.

Create the script file:

$ sudo su
# cd /and so forth
# vim rc.native

  • Sort ‘i’ to edit, and sort or paste the next:

#!/bin/bash
/configure_te_pi.sh
exit 0

  • Sort ‘:’ then ‘wq!’ to avoid wasting the modifications and exit the file. 
  • Run the next to set the script permissions:

# chmod +x /and so forth/rc.native

  • Create the configure_te_pi.sh script within the prime stage / listing. Exchange the <SSID> and <SSID password> fields within the under script with the right values. The SSID and password can be modified later, however this may require a later SSH connection to the agent.
  • Create the script file:

# cd /
# vim configure_te_pi.sh

  • Sort ‘i’ to edit, and sort or paste the next, changing the <SSID> and <SSID password> fields with the right values:

#!/bin/bash
apt-get replace -y
apt-get set up te-va-unlock -y
apt-get set up net-tools ifmetric wireless-tools -y
ifconfig wlan0 up
wpa_passphrase <SSID> <SSID password> > /and so forth/wpa_supplicant.conf
wpa_supplicant -B -i wlan0 -c /and so forth/wpa_supplicant.conf -D wext
ifmetric eth0 200
sed -i ‘1iauto wlan0niface wlan0 inet dhcp’ /and so forth/community/interfaces
dhclient wlan0
systemctl masks apt-news.service
systemctl masks esm-cache.service

  • Sort ‘:’ then ‘wq!’ to avoid wasting the modifications and exit the file.
  • Run the next to set the script permissions:

# chmod +x /configure_te_pi.sh
Reboot the Pi and take a look at to substantiate that the wi-fi NIC can connect with the ThousandEyes internet account.

Validate Wi-fi Interface within the ThousandEyes Internet GUI

Verify Wired and Wi-fi IPs

  • From the ThousandEyes internet GUI, navigate to Cloud & Enterprise Brokers > Agent Settings.

  • Determine a registered TE agent with a wi-fi interface, then click on on it.

  • Find the Common Info The personal IP deal with of the TE agent will probably be displayed, which is the IP deal with that the TE agent used to connect with the ThousandEyes internet supervisor. If the TE agent has each an ethernet and wi-fi port, you’ll be able to click on the System Info hyperlink to substantiate which IP deal with is assigned to every interface.

Verify Wired and Wi-fi Interfaces for Checks

  • Navigate to Cloud & Enterprise Brokers > Take a look at Settings.

  • Increase one of many exams after which increase the Brokers

  • Click on on the Enterprise button and increase the dropdown subsequent to an agent with wi-fi enabled. If the agent has each a wired and a wi-fi interface enabled, they’ll each be displayed as within the screenshot under.

About Black Hat

For 26 years, Black Hat has supplied attendees with the very newest in info safety analysis, improvement, and developments. These high-profile international occasions and trainings are pushed by the wants of the safety group, striving to deliver collectively the most effective minds within the trade. Black Hat evokes professionals in any respect profession ranges, encouraging development and collaboration amongst academia, world-class researchers, and leaders in the private and non-private sectors. Black Hat Briefings and Trainings are held yearly in the US, Europe and USA. Extra info is obtainable at: BlackHat.com. Black Hat is dropped at you by Informa Tech.

Appendix

GitHub with scripts

ThousandEyes Wi-fi Setup GitHub

ThousandEyes Ports and Protocols

For TE brokers to function appropriately, they might want to each connect with ThousandEyes over the web and have firewall ACL entry to carry out any configured exams. Check with the next doc for lists of ports and protocols per area.

https://docs.thousandeyes.com/product-documentation/global-vantage-points/enterprise-agents/configuring/firewall-configuration-for-enterprise-agents

Script Features Defined

Scripts to allow wi-fi performance of the Raspberry Pi TE agent on startup are included within the Optionally available: Use Scripts to Provision Wi-fi that may Persist Throughout Reboots and Handbook Wi-fi Config Observe sections of this information. This appendix part explains the script performance line by line.

rc.native – this script will run as a part of the TE agent startup course of.

#!/bin/bash – initialize the script to run utilizing bash
/configure_te_pi.sh – run the configure_te_pi.sh script
exit 0 – exit

configure_te_pi.sh – this script will configure the TE agent for wi-fi performance

#!/bin/bash – initialize the script
apt-get replace -y – replace the underlying Ubuntu OS
apt-get set up te-va-unlock -y – jailbreak the TE agent to permit extra sudo entry
apt-get set up net-tools ifmetric wireless-tools -y – set up instruments to permit wi-fi performance
ifconfig wlan0 up – deliver up a wi-fi LAN interface
wpa_passphrase <SSID> <SSID password> > /and so forth/wpa_supplicant.conf – configure SSID and PSK values for the wi-fi connection and write them to the wpa_supplicant.conf file
wpa_supplicant -B -i wlan0 -c /and so forth/wpa_supplicant.conf -D wext – imports the wpa_supplicant file and configures the wi-fi LAN interface to make use of the wext driver
ifmetric eth0 200 – set the wired interface to have a decrease precedence than the wi-fi interface
sed -i ‘1iauto wlan0niface wlan0 inet dhcp’ /and so forth/community/interfaces – configure DHCP for the wi-fi interface
dhclient wlan0 – allow DHCP for the wi-fi interface
systemctl masks apt-news.service – stop apt-news.service from working. See the Wi-fi TE Agent Replace Failure part for extra info
systemctl masks esm-cache.service – stop the esm-cache.service from working. See the Wi-fi TE Agent Replace Failure part for extra info

Wi-fi TE Agent Replace Failure

Throughout testing of the wi-fi TE agent for Raspberry Pi, it was seen that the brokers misplaced connectivity with the ThousandEyes internet supervisor after a variable period of time. Troubleshooting a number of failed brokers recognized logs related to updates to the apt-news.service and esm-cache.service processes instantly earlier than failure of the wlan:

syslog

Aug  6 02:17:04 registration-wireless systemd[1]: Began PackageKit Daemon.
Aug  6 02:17:20 registration-wireless systemd[1]: Beginning Replace APT Information
Aug  6 02:17:20 registration-wireless systemd[1]: Beginning Replace the native ESM caches
Aug  6 02:17:21 registration-wireless systemd[1]: apt-news.service: Succeeded.
Aug  6 02:17:21 registration-wireless systemd[1]: Completed Replace APT Information.
Aug  6 02:17:22 registration-wireless systemd[1]: esm-cache.service: Succeeded.
Aug  6 02:17:22 registration-wireless systemd[1]: Completed Replace the native ESM caches.
Aug  6 02:18:38 registration-wireless systemd-networkd[667]: wlan0: Misplaced service

Extra info on the 2 providers might be discovered right here:

https://askubuntu.com/questions/1452519/what-are-the-services-apt-news-and-esm-cache-and-how-do-i-disable-them

Masking the providers so they aren’t run by systemd resolved the failure of wlan0:

$ sudo systemctl masks apt-news.service
$ sudo systemctl masks esm-cache.service

The above instructions have been then added to the startup scripts.


We’d love to listen to what you assume. Ask a Query, Remark Under, and Keep Linked with Cisco Safe on social!

Cisco Safe Social Channels

Instagram
Fb
Twitter
LinkedIn

Share:



Leave a Reply

Your email address will not be published. Required fields are marked *