###########################################################################
\nHardening toon (complete exclusion of Eneco, for non-Eneco users only)
\n###########################################################################<\/p>\n
Requirements:<\/p>\n
1: toon with dropbear installed
\n2: connection with private network (no WAN)<\/p>\n
When toon is set up completely, in the tab \u201cInternet\u201d toon states to
\nbe connected to the service center. The service center consist of a
\nbunch of websites and other services, accessed through a VPN tunnel,
\nmanaged by Quby, under the flag of Eneco. Each toon connects to the
\nservice center through an OpenVPN tunnel, with TLS security
\nenhancement. Even if you do not have an Eneco account, toon will send
\ndata to Eneco on a regular basis. According to Eneco, no energy usage
\n(gas and electricity) data are uploaded \u2013which is true\u2013 but boiler
\nsettings are transmitted every hour. No idea why, by the way. Besides
\nthrough the OpenVPN connection mentioned earlier, toon phones home
\nwith ping and the chrony daemon.<\/p>\n
##### Disabling OpenVPN: #####<\/p>\n
The OpenVPN connection is disabled by simply not starting OpenVPN,
\nthrough commenting out the openvpn line in \/etc\/inittab:<\/p>\n
#ovpn:2345:respawn:\/usr\/sbin\/openvpn \u2013config \/etc\/openvpn\/vpn.conf \u2013verb 0 >\/dev\/null 2>&1<\/p>\n
This shuts off openvpn effectively. In the internet tab you will now
\nget the message \u201cConnected to the internet\u201d or something along these
\nlines. You will also get a warning message that internet has not been
\nset up correctly or setup has not yet been completed. You can safely
\nignore these warnings.<\/p>\n
After toon has been rebooted (don\u2019t do that yet!), if you have a toon
\nwith qt-gui, you can suppress the warnings issues by toon, about not
\nbeing able to reach the service center, as follows (thank you, al_n!):<\/p>\n
Locate the file
\n\/HCBv2\/qml\/apps\/internetSettings\/InternetSettingsApp.qml, and look for
\nthe following code (line 365 or thereabouts):<\/p>\n
onNotificationReceived : {
\nvar statemachine = message.getArgument(\u201cstatemachine\u201d);
\nif (statemachine) {
\nvar prevSmStatus = smStatus;
\nsmStatus = parseInt(statemachine);
\n\/\/ add the following two lines of code:
\n\/\/ added by al_n (20151220):
\nif(smStatus == _ST_INTERNET) {
\nsmStatus = _ST_TUNNEL;
\n}
\n\/\/
\n\/\/ continuation of original file:
\n\/\/ Trigger the internetStateChange signal, used by the internet settings overview screen
\ninternetStateChange(smStatus);<\/p>\n
\u2026. etc.<\/p>\n
This will interpret a working internet connection as a connection to
\nthe service center, and thus warnings are suppressed.<\/p>\n
##### Disabling the time service access to time.quby.nl: #####<\/p>\n
Toon keeps track of time through the chrony daemon. To set the clock
\nat startup, and to keep it synchronized with the rest of the world,
\ntoon uses the time server of quby: time.quby.nl. This server name is
\nset in \/etc\/chrony.conf
\nLocate the following two lines in chrony.conf:<\/p>\n
server time.quby.nl minpoll 8
\nand
\ninitstepslew 30 time.quby.nl<\/p>\n
and replace the server name by another time server. I use<\/p>\n
wwv.nist.gov instead of time.quby.nl<\/p>\n
since it has the same (short) server name length (you never know if
\nand how the chrony code was hacked by quby), is accessed by many clients
\nacross the globe, and has proven to have a good level of stability
\nover many years of service.<\/p>\n
Note: the time protocol (tcp\/udp port 37) is something else than the
\nnetwork time protocol (ntp, udp port 123). You will need a time
\nserver, not an ntp-server.<\/p>\n
##### Disabling pinging quby.nl: #####<\/p>\n
Toon pings the quby ping server every so many seconds. This is done in
\n\/HCBv2\/sbin\/hcb_netcon. The ping server address is unfortunately
\nhard-coded in hcb_netcon, so to disable this, you will need to reroute
\nping requests to another machine. You can\u2019t switch it off easily.<\/p>\n
To reroute, edit the file \/etc\/hosts.template and add the line<\/p>\n
127.0.0.1 ping.quby.nl<\/p>\n
at the end of the file, and save it.<\/p>\n
Test whether your rerouting works by pinging quby:<\/p>\n
eneco-001-xxxxxx:\/# ping ping.quby.nl
\nPING ping.quby.nl (127.0.0.1): 56 data bytes
\n64 bytes from 127.0.0.1: seq=0 ttl=64 time=1.108 ms
\n64 bytes from 127.0.0.1: seq=1 ttl=64 time=0.738 ms
\n64 bytes from 127.0.0.1: seq=2 ttl=64 time=0.658 ms<\/p>\n
This indicates that the ping requests for quby are redirected to
\nlocalhost (IP 127.0.0.1). Thanks, RDNZL, for pointing this out!<\/p>\n
Reboot toon for good measure. Now you can go edit the service
\nInternetSettingsApp.qml file, as explained above.<\/p>\n
All done. You have now severed all connections between toon and Eneco
\n(quby), and can safely connect it to your wireless network again.<\/p>\n","protected":false},"excerpt":{"rendered":"
########################################################################### Hardening toon (complete exclusion of Eneco, for non-Eneco users only) ########################################################################### Requirements: 1: toon with dropbear installed 2: connection with private network (no WAN) […]<\/a><\/p>\n<\/div>","protected":false},"author":1,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"_links":{"self":[{"href":"https:\/\/einstein.amsterdam\/index.php?rest_route=\/wp\/v2\/pages\/1868"}],"collection":[{"href":"https:\/\/einstein.amsterdam\/index.php?rest_route=\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/einstein.amsterdam\/index.php?rest_route=\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/einstein.amsterdam\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/einstein.amsterdam\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1868"}],"version-history":[{"count":2,"href":"https:\/\/einstein.amsterdam\/index.php?rest_route=\/wp\/v2\/pages\/1868\/revisions"}],"predecessor-version":[{"id":1912,"href":"https:\/\/einstein.amsterdam\/index.php?rest_route=\/wp\/v2\/pages\/1868\/revisions\/1912"}],"wp:attachment":[{"href":"https:\/\/einstein.amsterdam\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1868"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}