2021-10-19

Hardware with Raspberry Pi OS
Draft of the fouth part of a projected multi-part guide
This is part 4 of the series of posts about installing a home automation system around Domoticz on a Raspberry Pi. It covers installing additional hardware.
Table of Contents
- Raspberry Pi GPIO
- Debug Serial Connection
<
- Real-Time Clock
- Hardware Watchdog
- Reboot and Shutdown Switch
- Temperature and Humidity Sensor
- Light Level Sensor
- Infrared Receiver
- Infrared Transmitter
- The Raspberry Pi Camera Module
- Auditing the System with Lynis
Older RaspberryPi models had a 26 pin header along the right edge of the board. Newer Raspberry Pi models also have a header along the same edge but it has 40 pins as shown with the model 4 B below on the left. In both cases, pin 1 is at the top, pin 2 is to the right, pin 3 is below pin 1 and so on. A few pins are connected to the system ground and to power (3.3 and 5 volts). Others were connected to some of the input/output (GPIO) pins of the Broadcom system on a chip (SOC) as can be seen on the schematic of the different Raspberry Pi models: Schematics and Mechanical Drawings.
As can be seen on the following figure, GPIO pins are not all the same. Some implement communications protocol in hardware (I2C, 1-wire, Serial...) while others are simple input or output connections.
Some of the sections that follow describe various hardware additions that are
connected to the Raspberry Pi GPIO. In some cases, there is some latitude in choosing the GPIO pins to connect to the device, but in other cases,
there is no choice or it is limited to certain sets of pins.
If you have a USB to Serial adapter that operates on 3.3V and you know how to use a terminal program such as
then it is relatively simple to connect to a Rapsberry Pi. Here is the pinout.
| Raspberry Pi | USB Serial AdapterConnection |
| Pin | GPIO | Function |
| 6, 9 or 14 | Ground | Ground pin |
| 8 | 14 | UART0_TXD | RX pin |
| 10 | 15 | UART0_RXD | TX pin |

Make sure to shutdown the Pi correctly.
and then turn off all power to it before
If the Raspberry Pi is an older model without built-in Bluetooth, then
there is no further preparation needed, because the single true hardware UART is brought out to the
header pins in these models. Go on to Using the Serial Port.
In newer Raspberry Pi models the UART is used to communicate with the Bluetooth chip. So a serial connection on these newer models involves making a choice.
- Keep Bluetooth capabilities and connect the less capable mini-UART to the serial port and accept a reduced cpu core frequency.
- Disable Bluetooth and connect the hardware UART to the serial port.
- Use the mini-UART to communicate with Bluetooth and connect the hardware UART to the serial port.
Option 2 will make sense in my case because my automation server will be moved to a remote corner of the basement with no real use for wireless communication. Option 3 does not appeal to me, if Bluetooth is needed then it probably involves the user directly, such as using an input device (a mouse or keyboard for example) or streaming audio, and a less than optimal experience would not be acceptable. To be honest, I have not tested this option and I am just trying to justify the use of option 1. Besides, debugging whicj is presumably a short term operation may very well involve looking at the Bluetooth service.
nestor@domus:~ $ sudo nano /boot/config.txt
Add the following line at the end of the file, making sure that it is in the [all] section and not in a [piXX] section that would apply to only one model of the Pi.
...
[all]
#dtoverlay=vc4-fkms-v3d
gpu_mem=16
start_x=1
enable_uart=1
In addition to enabling the mini-UART, this will lock the core frequency at 250Mhz disabling turbo mode. In older versions of the OS, pre 2016, it was necessary to explicitely do this with the core_freq=250 directive. If we were to reboot at this point, we would see that mini-UART has been assigned to /dev/serial0 which is brought out to the header pins.
nestor@domus:~ $ ls -l /dev/serial*
lrwxrwxrwx 1 root root 5 Oct 29 14:37 /dev/serial0 -> ttyS0 the mini-UART
lrwxrwxrwx 1 root root 7 Oct 29 14:37 /dev/serial1 -> ttyAMA0 the hardware UART
Many tutorials recommend removing console=serial0,115200 at the start of /boot/cmdline.txt. I have found that if I do that I cannot reach a login. Perhaps because the baud rate is no longer set to 115200? Something to look into. So leaving the file unchanged, I find that it is possible to open a session over the serial port without problem. However, when rebooting the system, every message is lost until the reboot starts.
nestor@domus:~$ sudo reboot
�
l���cp���
��|c�no��
�ls��B��c�n��|�s���ol[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 5.10.63-v7+ (dom@buildbot) (arm-linux-gnueabihf-gcc-8 (Ubuntu/Linaro 8.4.0-3ubuntu1) 8.4.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #1459 SMP Wed Oct 6 16:41:10 BST 2021
[ 0.000000] CPU: ARMv7 Processor [410fd034] revision 4 (ARMv7), cr=10c5383d
However if I get rid of the console=tty1 command in /boot/cmdline.txt, so that the start of that one line file is
console=serial0,115200 root=PART...
instead of
console=serial0,115200 console=tty1 root=PART...
then all messages to the standard output as the system shuts down are visible.
nestor@domus:~$ sudo reboot
[ OK ] Stopped target Graphical Interface.[ OK ] Stopped Daily apt download activities.
Unmounting RPC Pipe File System...
[ OK ] Stopped Daily rotation of log files.
[ OK ] Stopped Daily man-db regeneration.
[ OK ] Closed Load/Save RF Kill Switch Status /dev/rfkill Watch.
[ OK ] Stopped target Sound Card.
...
[ OK ] Reached target Shutdown.
[ OK ] Reached target Final Step.
[ OK ] Started Reboot.
[ OK ] Reached target Reboot.
�
�|l
l
ll2�|B�nn��
�ls��C��c�o��|�r���nl[ 0.000000] Booting Linux on physical CPU 0x0
cd /media/michel/boot
michel@hp:/media/michel/boot$
nano config.txt
List the USB serial devices on the desktop machine before connecting the USB to serial (tty) adapter to it.
michel@hp:~$ ls /dev/ttyUSB*
ls: cannot access '/dev/ttyUSB*': No such file or directory
Now connect the serial end of the the USB to Serial adapter to the
Raspberry Pi which should not be under power and then connect it to the
desktop USB port. List serial devices to find the newly added adapter, start
up the terminal program connecting to that port and then apply power to the
Raspberry Pi. You should then see the Linux boot
messages which end with a login prompt.
michel@hp:~$ ls /dev/ttyUSB*
/dev/ttyUSB0
michel@hp:~$ kermit -l /dev/ttyUSB0 -b 115200 -C "set carrier-watch off, connect"
Connecting to /dev/ttyUSB0, speed 115200
Escape character: Ctrl-\ (ASCII 28, FS): enabled
Type the escape character followed by C to get back,
or followed by ? to see other options.
----------------------------------------------------
power up the Raspberry Pi...
[ 0.000000] Booting Linux on physical CPU 0x0
[ 0.000000] Linux version 4.19.75-v7+ (dom@buildbot) (gcc version 4.9.3 (crosstool-NG crosstool-ng-1.22.0-88-g8460611)) #1270 SMP Tue Sep 24 18:45:11 BST 2019
[ 0.000000] CPU: ARMv7 Processor [410fd034] revision 4 (ARMv7), cr=10c5383d
...
[ 6.342423] systemd[1]: Starting Set the console keyboard layout...
[ 6.356465] systemd[1]: Listening on Journal Socket (/dev/log).
[ 6.375402] systemd[1]: Mounting Kernel Debug File System...
Raspbian GNU/Linux 10 raspberrypi ttyS0
raspberrypi login: pi
Password: raspberry not echoed to screen
Linux raspberrypi 4.19.75-v7+ #1270 SMP Tue Sep 24 18:45:11 BST 2019 armv7l
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
pi@raspberrypi:~$
If using Screen the terminal should be launched with the following
command on the desktop.
michel@hp:~$ screen /dev/ttyUSB0 115200
If using cu the terminal should be launched with the following
command on the desktop.
michel@hp:~$ cu -l /dev/ttyUSB0 -s 115200
michel@hp:~$ picocom /dev/ttyUSB0 -b 1500000
If you are here, then ignore the ssh commands such as
michel@hp:~$ ssh pi@192.168.1.101
C:\Users\michel> ssh pi@192.168.1.101
that you may see later on in this post unless you have connected to the
Raspberry Pi over the local area network, which is not necessary when there
is a direct serial connection with the Pi. Skip ahead to the Basic Configuration section.
Many devices in the Domoticz home automation
system are scheduled to turn on or off at defined times of the
day. Other scheduled tasks have been relegated to the cron
daemon. The system is also a log server which typically adds timestamps to
all incoming messages. All this requires relatively accurate time which can
be a problem on a Raspberry Pi which has is no real-time clock (RTC) and
which therefore relies on timestamps obtained from Simple Network Time
Protocol servers. Unfortunately, on more than one occasion we have een without Internet access
for a few days following a power outage because of a bad storm. In such circumstances the
time kept by the Raspberry Pi can be quite incorrect because, on start up, it will use
the last time saved in a system file before the power went off and that will
not be updated until an NTP server can be reached. A cheap real-time hardware clock
with an independant power source such as the two shown below can be used to restore the correct
time automatically in those situations. Both of these I²C modules use the DS3231 chip, but many other modules using different chips can be used.

As explained by
Gus (Angus Young) in Raspberry Pi RTC: Adding a Real Time Clock (April 12, 2019)
and Lady Ada (Limor Fried) in Adding a Real Time Clock to Raspberry Pi (last updated October 25, 2021)
a simple modification of the boot configuration file is all that is needed to
load the RTC drivers and activate the I2C bus used by the hardware clock.
woopi@goldserver:~ $ sudo nano /boot/config.txt
...
ds1307 Select the DS1307 device
ds1339 Select the DS1339 device
ds3231 Select the DS3231 device
...
Find the three lines beginning with #dtparam= and add
the dtoverlay line after.
...
# Uncomment some or all of these to enable the optional hardware interfaces
#dtparam=i2c_arm=on
#dtparam=i2s=on
#dtparam=spi=on
dtoverlay=i2c-rtc,ds3231
...
What if the RTC is not based on the DS3231? Well the i2c-rtc
overlay supports quite a few chips. The following command will provide
the complete list of the more than 25 supported devices and the list of options that can
be passed on to the overlay.
woopi@goldserver:~ $ dtoverlay -h i2c-rtc
Reboot the system and then, after opening a new session, check that the
real time clock device has been created by the kernel and that the
real time clock can be accessed.
nestor@domus:~ $ ls -l /dev/rt*
lrwxrwxrwx 1 root root 4 Oct 24 12:12 /dev/rtc -> rtc0
crw------- 1 root root 252, 0 Oct 24 12:12 /dev/rtc0
woopi@goldserver:~ $ sudo hwclock --verbose
hwclock from util-linux 2.33.1
System Time: 1573672406.546382
Trying to open: /dev/rtc0
Using the rtc interface to the clock.
Assuming hardware clock is kept in UTC time.
Waiting for clock tick...
ioctl(3, RTC_UIE_ON, 0): Invalid argument
Waiting in loop for time from /dev/rtc0 to change
...got clock tick
Time read from Hardware Clock: 2019/11/13 19:13:28
Hw clock time : 2019/11/13 19:13:28 = 1573672408 seconds since 1969
Time since last adjustment is 1573672408 seconds
Calculated Hardware Clock drift is 0.000000 seconds
2019-11-13 15:13:27.408018-04:00
There is only one hardware clock connected to the Pi and it shows up as device /dev/rtc0 in the OS. The dev/rtc is a symbolic link to the "preferred" clock device, which of course in our case must be the only clock device. As far as I know, /dev/rtc is never used.
By default the systemd-timesyncd or chronyd service will synchronize the system time at regular intervals and update the real time clock at the same time. Unfortunately, there is no default provision to update the system time from the real time clock when the system boots. That means that should the Pi not have access to the Internet after booting, the system time will not be correctly updated even if the real time clock does have a valid date and time. One could always do that by entering a command in a terminal.
nestor@domus:~ $ sudo hwclock --hctosys --verbose
hwclock from util-linux 2.33.1
System Time: 1635182330.902467
Trying to open: /dev/rtc0
Using the rtc interface to the clock.
Assuming hardware clock is kept in UTC time.
Waiting for clock tick...
ioctl(4, RTC_UIE_ON, 0): Invalid argument
Waiting in loop for time from /dev/rtc0 to change
...got clock tick
Time read from Hardware Clock: 2021/10/25 17:18:51
Hw clock time : 2021/10/25 17:18:51 = 1635182331 seconds since 1969
Time since last adjustment is 1635182331 seconds
Calculated Hardware Clock drift is 0.000000 seconds
Calling settimeofday(1635182331.000000, 180)
The hwclock utility cannot be run without administrative privileges, so the sudo is necessary. The --hctosys (or -s) option stands for hardware clock to system clock which does what we want. If the -verbose (or -v)) option is not present, then the system time will be udpated but the command will not send any output to the terminal.
In Real Time Clock, DS3231, for Domoticz on the Raspberry Pi, I added the command to the root control script, rc.local which is executed by, wait for it... root just before multiple users are enabled in the boot process.
nestor@domus:~ $ sudo nano /etc/rc.local
#!/bin/sh -e
#
# rc.local
#
# This script is executed at the end of each multiuser runlevel.
# Make sure that the script will "exit 0" on success or any other
# value on error.
#
# In order to enable or disable this script just change the execution
# bits.
#
# By default this script does nothing.
# Print the IP address
_IP=$(hostname -I) || true
if [ "$_IP" ]; then
printf "My IP address is %s\n" "$_IP"
fi
hwclock --hctosys
exit 0
Note the abscense of the sudo prefix, because as stated it is root that runs that script.
Instead of doing that, Gus, Lady Ada, and many others included myself staring in 2019, levearage a udev rule that runs a hwclock-set script when the rtc0 device is created. Here is the rule.
woopi@goldserver:~ $ cat /lib/udev/rules.d/85-hwclock.rules
# Set the System Time from the Hardware Clock and set the kernel's timezone
# value to the local timezone when the kernel clock module is loaded.
KERNEL=="rtc0", RUN+="/lib/udev/hwclock-set $root/$name"
I did write "levearage" because the script is modified to do something other than what it was intended to do.
woopi@goldserver:~ $ sudo nano /lib/udev/hwclock-set
#!/bin/sh
# Reset the System Clock to UTC if the hardware clock from which it
# was copied by the kernel was in localtime.
dev=$1
if [ -e /run/systemd/system ] ; then
exit 0
fi
...
Look carefully at the comment: the script is meant to fixup any problem that could be caused by having the RTC set to local time, whereas the system clock must be set to UTC (coordinated universal time, the successor to GMT or Zulu time if you have a military background). And look further, the script stops if the system manager is systemd. In other words, the script does nothing as is in Raspberry Pi Os, other Debian based distributions and many more Linux systems. The first change is to disable this test.
...
#if [ -e /run/systemd/system ] ; then
# exit 0
#fi
...
Gus, Lady Ada and others then go on and disable half of commands executed by the script.
...
if [ yes = "$BADYEAR" ] ; then
# /sbin/hwclock --rtc=$dev --systz --badyear
/sbin/hwclock --rtc=$dev --hctosys --badyear
else
# /sbin/hwclock --rtc=$dev --systz
/sbin/hwclock --rtc=$dev --hctosys
fi
...
I have never bothered to comment out the hwclock --rtc=$dev --systz, with and without --badyear, lines and have not had detected problems so far.
Why is that? Reading the manual ($ man hwclock), suggests to me that running that option would not do much harm as it does not read the hardware clock but merely makes sure that the system clock is set to UTC.
There is more to this topic, and it may result in another post on the subject.
In the previous post in this series, a software watchdog was installed
that will reboot the computer if Domoticz no longer
feeds it. For even better protection for a headless server, I have been
looking at adding a hardware watchdog that, as a last resort, will restart
the Raspberry Pi in the hope that it will recover.
Right now I am using a Cheap Of-the-Shelf Raspberry Pi Hardware Watchdog but I
hope to replace that with something more sophisticated that tries to reboot a
non responsive Pi before performing a hard reset. However, I have made significant progress in replacing this less than optimal
watchdog with something more appropriate. See Rethinking the Raspberry Pi Hardware Watchdog.
A lot of things have been added to the operating system. This would be a good time to perform an overview.
nostra@damus:~ $ sudo systemctl --type=service
UNIT LOAD ACTIVE SUB DESCRIPTION
alsa-restore.service loaded active exited Save/Restore Sound Card State
alsa-state.service loaded active running Manage Sound Card State (restore and store)
avahi-daemon.service loaded active running Avahi mDNS/DNS-SD Stack
bluetooth.service loaded active running Bluetooth service
bthelper@hci0.service loaded active exited Raspberry Pi bluetooth helper
chrony.service loaded active running chrony, an NTP client/server
console-setup.service loaded active exited Set console font and keymap
cron.service loaded active running Regular background program processing daemon
dbus.service loaded active running D-Bus System Message Bus
dhcpcd.service loaded active running dhcpcd on all interfaces
domoticz.service loaded active running domoticz_service
dphys-swapfile.service loaded active exited dphys-swapfile - set up, mount/unmount, and delete a swap file
fake-hwclock.service loaded active exited Restore / save the current clock
getty@tty1.service loaded active running Getty on tty1
ha-bridge.service loaded active running HA Bridge
hciuart.service loaded active running Configure Bluetooth Modems connected by UART
ifupdown-pre.service loaded active exited Helper to synchronize boot up for ifupdown
keyboard-setup.service loaded active exited Set the console keyboard layout
kmod-static-nodes.service loaded active exited Create list of required static device nodes for the current kernel
mosquitto.service loaded active running Mosquitto MQTT v3.1/v3.1.1 Broker
networking.service loaded active exited Raise network interfaces
nginx.service loaded active running A high performance web server and a reverse proxy server
radicale.service loaded active running A simple CalDAV (calendar) and CardDAV (contact) server
raspi-config.service loaded active exited LSB: Switch to ondemand cpu governor (unless shift key is pressed)
rc-local.service loaded active exited /etc/rc.local Compatibility
rng-tools.service loaded active running rng-tools.service
rpi-eeprom-update.service loaded active exited Check for Raspberry Pi EEPROM updates
rsyslog.service loaded active running System Logging Service
ssh.service loaded active running OpenBSD Secure Shell server
syncthing@nestor.service loaded active running Syncthing - Open Source Continuous File Synchronization for nestor
systemd-fsck-root.service loaded active exited File System Check on Root Device
systemd-fsck@dev-disk-by\x2dpartuuid-0d0427ee\x2d01.service loaded active exited File System Check on /dev/disk/by-partuuid/0d0427ee-01
systemd-journal-flush.service loaded active exited Flush Journal to Persistent Storage
systemd-journald.service loaded active running Journal Service
systemd-logind.service loaded active running Login Service
systemd-modules-load.service loaded active exited Load Kernel Modules
systemd-random-seed.service loaded active exited Load/Save Random Seed
systemd-remount-fs.service loaded active exited Remount Root and Kernel File Systems
systemd-sysctl.service loaded active exited Apply Kernel Variables
systemd-sysusers.service loaded active exited Create System Users
systemd-tmpfiles-setup-dev.service loaded active exited Create Static Device Nodes in /dev
systemd-tmpfiles-setup.service loaded active exited Create Volatile Files and Directories
systemd-udev-trigger.service loaded active exited udev Coldplug all Devices
systemd-udevd.service loaded active running udev Kernel Device Manager
systemd-update-utmp.service loaded active exited Update UTMP about System Boot/Shutdown
systemd-user-sessions.service loaded active exited Permit User Sessions
triggerhappy.service loaded active running triggerhappy global hotkey daemon
user-runtime-dir@1000.service loaded active exited User Runtime Directory /run/user/1000
user@1000.service loaded active running User Manager for UID 1000
watchdog.service loaded active running watchdog daemon
wg-quick@wg0.service loaded active exited WireGuard via wg-quick(8) for wg0
wpa_supplicant.service loaded active running WPA supplicant
LOAD = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB = The low-level unit activation state, values depend on unit type.
52 loaded units listed. Pass --all to see loaded but inactive units, too.
To show all installed unit files use 'systemctl list-unit-files'.
That's 52 services none of which have failed, thankfully. As can be seen some services are no longer running, so limiting the list to running services would be more informative.
nostra@damus:~ $ sudo systemctl --type=service --state=running
UNIT LOAD ACTIVE SUB DESCRIPTION
alsa-state.service loaded active running Manage Sound Card State (restore and store)
avahi-daemon.service loaded active running Avahi mDNS/DNS-SD Stack
bluetooth.service loaded active running Bluetooth service
chrony.service loaded active running chrony, an NTP client/server
cron.service loaded active running Regular background program processing daemon
dbus.service loaded active running D-Bus System Message Bus
dhcpcd.service loaded active running dhcpcd on all interfaces
domoticz.service loaded active running domoticz_service
getty@tty1.service loaded active running Getty on tty1
ha-bridge.service loaded active running HA Bridge
hciuart.service loaded active running Configure Bluetooth Modems connected by UART
mosquitto.service loaded active running Mosquitto MQTT v3.1/v3.1.1 Broker
nginx.service loaded active running A high performance web server and a reverse proxy server
radicale.service loaded active running A simple CalDAV (calendar) and CardDAV (contact) server
rng-tools.service loaded active running rng-tools.service
rsyslog.service loaded active running System Logging Service
ssh.service loaded active running OpenBSD Secure Shell server
syncthing@nestor.service loaded active running Syncthing - Open Source Continuous File Synchronization for nestor
systemd-journald.service loaded active running Journal Service
systemd-logind.service loaded active running Login Service
systemd-udevd.service loaded active running udev Kernel Device Manager
triggerhappy.service loaded active running triggerhappy global hotkey daemon
user@1000.service loaded active running User Manager for UID 1000
watchdog.service loaded active running watchdog daemon
wpa_supplicant.service loaded active running WPA supplicant
LOAD = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB = The low-level unit activation state, values depend on unit type.
25 loaded units listed. Pass --all to see loaded but inactive units, too.
To show all installed unit files use 'systemctl list-unit-files'.
Some of these could be removed on a headless system
- avahi-daemon.service
The When first booting the Raspberry Pi,
- alsa-state.service
- bluetooth.service
- hciuart.service
- triggerhappy.service
Only very recently have I become aware of the
nostra@damus:~ $ wget https://github.com/CISOfy/lynis/archive/refs/heads/master.zip -O lynis.zip
--2021-10-13 17:20:52-- https://github.com/CISOfy/lynis/archive/refs/heads/master.zip
Resolving github.com (github.com)... 140.82.112.4
Connecting to github.com (github.com)|140.82.112.4|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://codeload.github.com/CISOfy/lynis/zip/refs/heads/master [following]
--2021-10-13 17:20:53-- https://codeload.github.com/CISOfy/lynis/zip/refs/heads/master
Resolving codeload.github.com (codeload.github.com)... 140.82.113.9
Connecting to codeload.github.com (codeload.github.com)|140.82.113.9|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/zip]
Saving to: ‘lynis.zip’
lynis.zip [ <=> ] 418.70K 1.45MB/s in 0.3s
2021-10-13 17:20:54 (1.45 MB/s) - ‘lynis.zip’ saved [428746]
nostra@damus:~ $ ls
domoticz domoticz-sh downloads ha-bridge image.jpg lynis.zip mjpg-streamer Sync syncthing.gpg
nostra@damus:~ $ unzip lynis.zip
Archive: lynis.zip
798c1054d7ac5ee6df6a2cbbdbb100545a3892f7
creating: lynis-master/
creating: lynis-master/.github/
creating: lynis-master/.github/ISSUE_TEMPLATE/
inflating: lynis-master/.github/ISSUE_TEMPLATE/bug_report.md
inflating: lynis-master/.github/ISSUE_TEMPLATE/feature_request.md
extracting: lynis-master/.gitignore
inflating: lynis-master/.travis.yml
inflating: lynis-master/CHANGELOG.md
inflating: lynis-master/CODE_OF_CONDUCT.md
inflating: lynis-master/CONTRIBUTING.md
inflating: lynis-master/CONTRIBUTORS.md
inflating: lynis-master/FAQ
inflating: lynis-master/HAPPY_USERS.md
inflating: lynis-master/INSTALL
inflating: lynis-master/LICENSE
inflating: lynis-master/README
inflating: lynis-master/README.md
inflating: lynis-master/SECURITY.md
inflating: lynis-master/TODO.md
creating: lynis-master/db/
inflating: lynis-master/db/fileperms.db
inflating: lynis-master/db/hints.db
extracting: lynis-master/db/integrity.db
creating: lynis-master/db/languages/
inflating: lynis-master/db/languages/az
linking: lynis-master/db/languages/br -> pt
inflating: lynis-master/db/languages/cn
inflating: lynis-master/db/languages/da
inflating: lynis-master/db/languages/de
linking: lynis-master/db/languages/de-AT -> de
inflating: lynis-master/db/languages/en
linking: lynis-master/db/languages/en-GB -> en
linking: lynis-master/db/languages/en-US -> en
inflating: lynis-master/db/languages/es
inflating: lynis-master/db/languages/fi
inflating: lynis-master/db/languages/fr
inflating: lynis-master/db/languages/gr
inflating: lynis-master/db/languages/he
inflating: lynis-master/db/languages/hu
inflating: lynis-master/db/languages/it
inflating: lynis-master/db/languages/ja
inflating: lynis-master/db/languages/ko
inflating: lynis-master/db/languages/nb-NO
inflating: lynis-master/db/languages/nl
linking: lynis-master/db/languages/nl-BE -> nl
linking: lynis-master/db/languages/nl-NL -> nl
inflating: lynis-master/db/languages/pl
inflating: lynis-master/db/languages/pt
inflating: lynis-master/db/languages/ru
inflating: lynis-master/db/languages/se
inflating: lynis-master/db/languages/sk
inflating: lynis-master/db/languages/tr
inflating: lynis-master/db/malware-susp.db
inflating: lynis-master/db/malware.db
extracting: lynis-master/db/sbl.db
inflating: lynis-master/db/software-eol.db
inflating: lynis-master/db/tests.db
inflating: lynis-master/default.prf
inflating: lynis-master/developer.prf
creating: lynis-master/extras/
inflating: lynis-master/extras/README
creating: lynis-master/extras/bash_completion.d/
inflating: lynis-master/extras/bash_completion.d/lynis
inflating: lynis-master/extras/build-lynis.sh
inflating: lynis-master/extras/check-lynis.sh
inflating: lynis-master/extras/files.dat
inflating: lynis-master/extras/lynis.spec
creating: lynis-master/extras/openbsd/
inflating: lynis-master/extras/openbsd/+CONTENTS
creating: lynis-master/extras/systemd/
inflating: lynis-master/extras/systemd/lynis.service
inflating: lynis-master/extras/systemd/lynis.timer
creating: lynis-master/extras/travis-ci/
extracting: lynis-master/extras/travis-ci/before_script.sh
creating: lynis-master/include/
inflating: lynis-master/include/binaries
inflating: lynis-master/include/consts
inflating: lynis-master/include/data_upload
inflating: lynis-master/include/functions
inflating: lynis-master/include/helper_audit_dockerfile
inflating: lynis-master/include/helper_configure
inflating: lynis-master/include/helper_generate
inflating: lynis-master/include/helper_show
inflating: lynis-master/include/helper_system_remote_scan
inflating: lynis-master/include/helper_update
inflating: lynis-master/include/osdetection
inflating: lynis-master/include/parameters
inflating: lynis-master/include/profiles
inflating: lynis-master/include/report
inflating: lynis-master/include/tests_accounting
inflating: lynis-master/include/tests_authentication
inflating: lynis-master/include/tests_banners
inflating: lynis-master/include/tests_boot_services
inflating: lynis-master/include/tests_containers
inflating: lynis-master/include/tests_crypto
inflating: lynis-master/include/tests_custom.template
inflating: lynis-master/include/tests_databases
inflating: lynis-master/include/tests_dns
inflating: lynis-master/include/tests_file_integrity
inflating: lynis-master/include/tests_file_permissions
inflating: lynis-master/include/tests_filesystems
inflating: lynis-master/include/tests_firewalls
inflating: lynis-master/include/tests_hardening
inflating: lynis-master/include/tests_homedirs
inflating: lynis-master/include/tests_insecure_services
inflating: lynis-master/include/tests_kernel
inflating: lynis-master/include/tests_kernel_hardening
inflating: lynis-master/include/tests_ldap
inflating: lynis-master/include/tests_logging
inflating: lynis-master/include/tests_mac_frameworks
inflating: lynis-master/include/tests_mail_messaging
inflating: lynis-master/include/tests_malware
inflating: lynis-master/include/tests_memory_processes
inflating: lynis-master/include/tests_nameservices
inflating: lynis-master/include/tests_networking
inflating: lynis-master/include/tests_php
inflating: lynis-master/include/tests_ports_packages
inflating: lynis-master/include/tests_printers_spoolers
inflating: lynis-master/include/tests_scheduling
inflating: lynis-master/include/tests_shells
inflating: lynis-master/include/tests_snmp
inflating: lynis-master/include/tests_squid
inflating: lynis-master/include/tests_ssh
inflating: lynis-master/include/tests_storage
inflating: lynis-master/include/tests_storage_nfs
inflating: lynis-master/include/tests_system_integrity
inflating: lynis-master/include/tests_time
inflating: lynis-master/include/tests_tooling
inflating: lynis-master/include/tests_usb
inflating: lynis-master/include/tests_virtualization
inflating: lynis-master/include/tests_webservers
inflating: lynis-master/include/tool_tips
inflating: lynis-master/lynis
inflating: lynis-master/lynis.8
creating: lynis-master/plugins/
inflating: lynis-master/plugins/README
inflating: lynis-master/plugins/custom_plugin.template
inflating: lynis-master/plugins/plugin_pam_phase1
inflating: lynis-master/plugins/plugin_systemd_phase1
finishing deferred symbolic links:
lynis-master/db/languages/br -> pt
lynis-master/db/languages/de-AT -> de
lynis-master/db/languages/en-GB -> en
lynis-master/db/languages/en-US -> en
lynis-master/db/languages/nl-BE -> nl
lynis-master/db/languages/nl-NL -> nl
nostra@damus:~ $ ls
domoticz domoticz-sh downloads ha-bridge image.jpg lynis-master lynis.zip mjpg-streamer Sync syncthing.gpg
nostra@damus:~ $ ls lynis-master
CHANGELOG.md CONTRIBUTING.md db developer.prf FAQ include LICENSE lynis.8 README SECURITY.md
CODE_OF_CONDUCT.md CONTRIBUTORS.md default.prf extras HAPPY_USERS.md INSTALL lynis plugins README.md TODO.md
nostra@damus:~ $ mv lynis.zip downloads/
nostra@damus:~ $ ls -l
total 2340
drwxr-xr-x 7 nostra nostra 4096 Oct 13 11:50 domoticz
-rwxr-xr-x 1 root root 4434 Sep 16 00:32 domoticz-sh
drwxr-xr-x 3 nostra nostra 4096 Oct 13 17:21 downloads
drwxr-xr-x 3 nostra nostra 4096 Sep 23 16:19 ha-bridge
-rw-r--r-- 1 nostra nostra 2358866 Sep 27 13:20 image.jpg
drwxr-xr-x 7 nostra nostra 4096 Jul 30 03:17 lynis-master
drwxr-xr-x 4 nostra nostra 4096 Sep 27 13:38 mjpg-streamer
drwxr-xr-x 3 nostra nostra 4096 Sep 25 16:30 Sync
-rw-r--r-- 1 nostra nostra 1769 Sep 25 16:17 syncthing.gpg
nostra@damus:~ $ ls downloads
domoticz lynis.zip
nostra@damus:~ $ mv lynis-master lynis
nostra@damus:~ $ cd lynis
nostra@damus:~/lynis $ ./lynis audit system --quiet
[WARNING]: Test PLGN-0010 had a long execution: 10.016210 seconds
[WARNING]: Test PKGS-7345 had a long execution: 10.906893 seconds
[WARNING]: Test CRYP-7902 had a long execution: 30.470371 seconds
Running test as root
nostra@damus:~ $ sudo su
root@damus:/home/nostra/lynis# cd ..
root@damus:/home/nostra# chown -R 0:0 lynis
root@damus:/home/nostra# cd lynis
root@damus:/home/nostra/lynis# ./lynis audit system --quiet
[WARNING]: Test PKGS-7345 had a long execution: 10.763354 seconds
[WARNING]: Test PKGS-7392 had a long execution: 14.889131 seconds
[WARNING]: Test PHP-2211 had a long execution: 12.111933 seconds
[WARNING]: Test CRYP-7902 had a long execution: 35.552021 seconds