💬 Security & Signing

[pepson]

Any help ?

[sineverba]

@pepson no need to remove. Simply, in your sketches, don't use signing at all.

[pepson]

@sineverba said in 💬 Security & Signing:

no need to remove. Simply, in your sketches, don't use signing at all.

ok but if on gateway it was generate and setup keys and when in skethces i dont use keys will nody connect? and what the purpose of the signature is then ?
I thought that if the gate has a set of keys and will try to connect noda without a key that it will not connect ....

[sineverba]

@pepson you can use a special flag define to "downgrade/reduce" security MY_WEAK_SECURITY

[pepson]

@sineverba

Ok summary
When i have setup on Raspberry Gateway , generate keys.

When i write in node all keys with sketches.... Node connect ok.

But when write to node only sketches without keys.,... node connect to gateway or not connect to gateway ?

[sineverba]

@pepson you need to setup gateway with weak security.

You need generate keyes and set in gateway.

You need to personalize nodes with the sketch and set keyes on Arduino EEPROM.

From now, you have two ways: Your node need security? Set use security bla-bla on top with other define(s).

Don't Need security? Don't define use security.

Simpler than ever.

[Anticimex]

@pepson if you find the security setup to be too complicated, I highly recommend sticking with the simple password flags. The documentation has it all.

[pepson]

@sineverba said in 💬 Security & Signing:

setup gateway with weak security.

But when configure my gateway without flag setup gateway with weak security i can only use nodes with setup in sketches keys. yes ?

[pepson]

@anticimex

Can you share me this document when is describe how define only pass ? I want also read this.

[sineverba]

@pepson

Let's summarize. Last time.

1. compile gateway with weak security (make your research, also in my github guide, there is ;) )
2. create the 3 keyes for gateway
3. set the 3 keyes for gateway.
4. clean your EEPROM arduinos with the sketch present in my guide and in examples of library
5. set the keyes in EEPROM arduinos.

Stop. End. Fin. Fine. These steps are MANDATARY. You NEED to do.

You will have in EEPROM the keyes (arduino) and in gateway.

From now, you select:

a) Do I need security? Perfect, in sketch arduino add #define bla bla bla on top with security and other stuff.
b) Do I NOT need security? Perfect, in sketch arduino DON'T ADD #define bla bla related to security.

[sineverba]

@pepson And, last all, you can use the mysensors debug options. Try. Try. Try! This is the best option offered to you to learn. Try!
At max, nothing works ;)

[pepson]

@sineverba
ok all is very good.

But what give me this if i can connect nodes also with defines bla bla bla in skethc and also without define bla bla bla in sketch?
But Do I think right ? In each of these accidents in the eeprom I need to have the keys loaded?

[sineverba]

@pepson only one word. Try. Really, you are lost in 1 cm of water. Try. And if it doesn't work, open your topic, showing exactly your sketches and what have you done.

[pepson]

ok thanks

[pepson]

Ok i build my gateway on RPI on MySensors 2.2.0 with this configuration:

./configure --my-transport=rfm69 --my-rfm69-frequency=868 --my-is-rfm69hw --my-gateway=ethernet --my-port=5003 --my-signing=software --my-signing-request-signatures

Then generate 3 key and setup it on gateway.

Then clear_epprom on Arduino MIni Pro, and then send sketch security with add serial, HMAC, and AES. Then put sketch with add this on top sketch with my SERIAL generated on gateway RPI.

#define MY_SIGNING_SOFT
#define MY_SIGNING_SOFT_RANDOMSEED_PIN 7
#define MY_SIGNING_REQUEST_SIGNATURES
#define MY_SIGNING_NODE_WHITELISTING {{.nodeId = GATEWAY_ADDRESS,.serial = {0X2C,0X61,0X17,0X2E,0XEE,0XDD,0XCC,0XBB,0XAA}}} // got from gateway setup

After that i run HA and he not found my nodes...
WHat is wrondg ?

[Anticimex]

@pepson well for starters, don't start out with whitelisting unless you know exactly what you are doing. First you have to verify that your network is stable enough to handle the security protocol. The simplest option is to only enable encryption, or use the simple password flag options. Once you have established that your gw and nodes are capable of communicating securely you can move on to personalization and whitelisting.

[pepson]

@anticimex
What you mean white list?

Before adding all security my nodes and gateway works perfect.

[Anticimex]

@pepson you define whitelisting so I presume you use it. But I don't see your gw flags specifying it so of course it does not work. So get rid of that flag from your config unless you know what it mean so that you set it up properly.

[pepson]

@anticimex

What flag i must remove ?
This :
#define MY_SIGNING_NODE_WHITELISTING {{.nodeId = GATEWAY_ADDRESS,.serial = {0X2C,0X61,0X17,0X2E,0XEE,0XDD,0XCC,0XBB,0XAA}}} // got from gateway setup

But on GW i setup this:
sudo mysgw --set-soft-serial-key=2C61172EEEDDCCBBAA && sudo mysgw --set-aes-key=9D2AD43CF909875C4C77111111111111 && sudo mysgw --set-soft-hmac-key=A2A64C48EA6765C5DAEFA12A1E41E2F038515A9CAED9FED73D11111111111111

[Anticimex]

@pepson please just read the documentation. And more importantly, follow it.
Isn't it obvious that it is the flag that mention whitelisting that is supposed to be removed unless you intend to use whitelisting, in which case you ought to know how to set it up properly at both ends?