2021-10-19
md
Hardware with Raspberry Pi OS
Setting up a Raspberry Pi as a Headless Computer (September 2021) (back to part I)-> <-Home Automation System on a Raspberry Pi (part II)
 Draft of the fouth part of a projected multi-part guide 

This is part 4 of the series of posts about installing a home automation system around Domoticz on a Raspberry Pi. It covers installing additional hardware.

Table of Contents

  1. Raspberry Pi GPIO
  2. Debug Serial Connection <
  3. Real-Time Clock
  4. Hardware Watchdog
  5. Reboot and Shutdown Switch
  6. Temperature and Humidity Sensor
  7. Light Level Sensor
  8. Infrared Receiver
  9. Infrared Transmitter
  10. The Raspberry Pi Camera Module
  11. Auditing the System with Lynis

Raspberry Pi GPIO toc

Older RaspberryPi models had a 26 pin header along the right edge of the board. Newer Raspberry Pi models also have a header along the same edge but it has 40 pins as shown with the model 4 B below on the left. In both cases, pin 1 is at the top, pin 2 is to the right, pin 3 is below pin 1 and so on. A few pins are connected to the system ground and to power (3.3 and 5 volts). Others were connected to some of the input/output (GPIO) pins of the Broadcom system on a chip (SOC) as can be seen on the schematic of the different Raspberry Pi models: Schematics and Mechanical Drawings.

As can be seen on the following figure, GPIO pins are not all the same. Some implement communications protocol in hardware (I2C, 1-wire, Serial...) while others are simple input or output connections.

rpi 4 B GPIO Pinout
Source: GPIO in Raspberry Pi Documentation: Usage
Click on the pinout for a larger view

Some of the sections that follow describe various hardware additions that are connected to the Raspberry Pi GPIO. In some cases, there is some latitude in choosing the GPIO pins to connect to the device, but in other cases, there is no choice or it is limited to certain sets of pins.

Debug Serial Connection toc

If you have a USB to Serial adapter that operates on 3.3V and you know how to use a terminal program such as

then it is relatively simple to connect to a Rapsberry Pi. Here is the pinout.

Raspberry PiUSB Serial Adapter
Connection
PinGPIOFunction
6, 9 or 14GroundGround pin
814UART0_TXDRX pin
1015UART0_RXDTX pin

USB cable to GPIO connection

Make sure to shutdown the Pi correctly.

and then turn off all power to it before

If the Raspberry Pi is an older model without built-in Bluetooth, then there is no further preparation needed, because the single true hardware UART is brought out to the header pins in these models. Go on to Using the Serial Port.

Serial Port on Raspberry Pi with Onboard Bluetooth toc

In newer Raspberry Pi models the UART is used to communicate with the Bluetooth chip. So a serial connection on these newer models involves making a choice.

  1. Keep Bluetooth capabilities and connect the less capable mini-UART to the serial port and accept a reduced cpu core frequency.
  2. Disable Bluetooth and connect the hardware UART to the serial port.
  3. Use the mini-UART to communicate with Bluetooth and connect the hardware UART to the serial port.

Option 2 will make sense in my case because my automation server will be moved to a remote corner of the basement with no real use for wireless communication. Option 3 does not appeal to me, if Bluetooth is needed then it probably involves the user directly, such as using an input device (a mouse or keyboard for example) or streaming audio, and a less than optimal experience would not be acceptable. To be honest, I have not tested this option and I am just trying to justify the use of option 1. Besides, debugging whicj is presumably a short term operation may very well involve looking at the Bluetooth service.

nestor@domus:~ $ sudo nano /boot/config.txt

Add the following line at the end of the file, making sure that it is in the [all] section and not in a [piXX] section that would apply to only one model of the Pi.

... [all] #dtoverlay=vc4-fkms-v3d gpu_mem=16 start_x=1 enable_uart=1

In addition to enabling the mini-UART, this will lock the core frequency at 250Mhz disabling turbo mode. In older versions of the OS, pre 2016, it was necessary to explicitely do this with the core_freq=250 directive. If we were to reboot at this point, we would see that mini-UART has been assigned to /dev/serial0 which is brought out to the header pins.

nestor@domus:~ $ ls -l /dev/serial* lrwxrwxrwx 1 root root 5 Oct 29 14:37 /dev/serial0 -> ttyS0 the mini-UART lrwxrwxrwx 1 root root 7 Oct 29 14:37 /dev/serial1 -> ttyAMA0 the hardware UART

Many tutorials recommend removing console=serial0,115200 at the start of /boot/cmdline.txt. I have found that if I do that I cannot reach a login. Perhaps because the baud rate is no longer set to 115200? Something to look into. So leaving the file unchanged, I find that it is possible to open a session over the serial port without problem. However, when rebooting the system, every message is lost until the reboot starts.

nestor@domus:~$ sudo reboot � l���cp��� ��|c�no�� �ls��B��c�n��|�s���ol[ 0.000000] Booting Linux on physical CPU 0x0 [ 0.000000] Linux version 5.10.63-v7+ (dom@buildbot) (arm-linux-gnueabihf-gcc-8 (Ubuntu/Linaro 8.4.0-3ubuntu1) 8.4.0, GNU ld (GNU Binutils for Ubuntu) 2.34) #1459 SMP Wed Oct 6 16:41:10 BST 2021 [ 0.000000] CPU: ARMv7 Processor [410fd034] revision 4 (ARMv7), cr=10c5383d

However if I get rid of the console=tty1 command in /boot/cmdline.txt, so that the start of that one line file is

console=serial0,115200 root=PART...

instead of

console=serial0,115200 console=tty1 root=PART...

then all messages to the standard output as the system shuts down are visible.

nestor@domus:~$ sudo reboot [ OK ] Stopped target Graphical Interface.[ OK ] Stopped Daily apt download activities. Unmounting RPC Pipe File System... [ OK ] Stopped Daily rotation of log files. [ OK ] Stopped Daily man-db regeneration. [ OK ] Closed Load/Save RF Kill Switch Status /dev/rfkill Watch. [ OK ] Stopped target Sound Card. ... [ OK ] Reached target Shutdown. [ OK ] Reached target Final Step. [ OK ] Started Reboot. [ OK ] Reached target Reboot. � �|l l ll2�|B�nn�� �ls��C��c�o��|�r���nl[ 0.000000] Booting Linux on physical CPU 0x0
cd /media/michel/boot michel@hp:/media/michel/boot$ nano config.txt

Using the Serial Port toc

List the USB serial devices on the desktop machine before connecting the USB to serial (tty) adapter to it.

michel@hp:~$ ls /dev/ttyUSB* ls: cannot access '/dev/ttyUSB*': No such file or directory

Now connect the serial end of the the USB to Serial adapter to the Raspberry Pi which should not be under power and then connect it to the desktop USB port. List serial devices to find the newly added adapter, start up the terminal program connecting to that port and then apply power to the Raspberry Pi. You should then see the Linux boot messages which end with a login prompt.

michel@hp:~$ ls /dev/ttyUSB* /dev/ttyUSB0 michel@hp:~$ kermit -l /dev/ttyUSB0 -b 115200 -C "set carrier-watch off, connect" Connecting to /dev/ttyUSB0, speed 115200 Escape character: Ctrl-\ (ASCII 28, FS): enabled Type the escape character followed by C to get back, or followed by ? to see other options. ---------------------------------------------------- power up the Raspberry Pi... [ 0.000000] Booting Linux on physical CPU 0x0 [ 0.000000] Linux version 4.19.75-v7+ (dom@buildbot) (gcc version 4.9.3 (crosstool-NG crosstool-ng-1.22.0-88-g8460611)) #1270 SMP Tue Sep 24 18:45:11 BST 2019 [ 0.000000] CPU: ARMv7 Processor [410fd034] revision 4 (ARMv7), cr=10c5383d ... [ 6.342423] systemd[1]: Starting Set the console keyboard layout... [ 6.356465] systemd[1]: Listening on Journal Socket (/dev/log). [ 6.375402] systemd[1]: Mounting Kernel Debug File System... Raspbian GNU/Linux 10 raspberrypi ttyS0 raspberrypi login: pi Password: raspberry not echoed to screen Linux raspberrypi 4.19.75-v7+ #1270 SMP Tue Sep 24 18:45:11 BST 2019 armv7l The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright. Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. pi@raspberrypi:~$

If using Screen the terminal should be launched with the following command on the desktop.

michel@hp:~$ screen /dev/ttyUSB0 115200

If using cu the terminal should be launched with the following command on the desktop.

michel@hp:~$ cu -l /dev/ttyUSB0 -s 115200

michel@hp:~$ picocom /dev/ttyUSB0 -b 1500000

If you are here, then ignore the ssh commands such as

michel@hp:~$ ssh pi@192.168.1.101

C:\Users\michel> ssh pi@192.168.1.101

that you may see later on in this post unless you have connected to the Raspberry Pi over the local area network, which is not necessary when there is a direct serial connection with the Pi. Skip ahead to the Basic Configuration section.

Real Time Clock toc

Many devices in the Domoticz home automation system are scheduled to turn on or off at defined times of the day. Other scheduled tasks have been relegated to the cron daemon. The system is also a log server which typically adds timestamps to all incoming messages. All this requires relatively accurate time which can be a problem on a Raspberry Pi which has is no real-time clock (RTC) and which therefore relies on timestamps obtained from Simple Network Time Protocol servers. Unfortunately, on more than one occasion we have een without Internet access for a few days following a power outage because of a bad storm. In such circumstances the time kept by the Raspberry Pi can be quite incorrect because, on start up, it will use the last time saved in a system file before the power went off and that will not be updated until an NTP server can be reached. A cheap real-time hardware clock with an independant power source such as the two shown below can be used to restore the correct time automatically in those situations. Both of these I²C modules use the DS3231 chip, but many other modules using different chips can be used.

RTC module

As explained by Gus (Angus Young) in Raspberry Pi RTC: Adding a Real Time Clock (April 12, 2019) and Lady Ada (Limor Fried) in Adding a Real Time Clock to Raspberry Pi (last updated October 25, 2021) a simple modification of the boot configuration file is all that is needed to load the RTC drivers and activate the I2C bus used by the hardware clock.

woopi@goldserver:~ $ sudo nano /boot/config.txt ... ds1307 Select the DS1307 device ds1339 Select the DS1339 device ds3231 Select the DS3231 device ...

Find the three lines beginning with #dtparam= and add the dtoverlay line after.

... # Uncomment some or all of these to enable the optional hardware interfaces #dtparam=i2c_arm=on #dtparam=i2s=on #dtparam=spi=on dtoverlay=i2c-rtc,ds3231 ...

What if the RTC is not based on the DS3231? Well the i2c-rtc overlay supports quite a few chips. The following command will provide the complete list of the more than 25 supported devices and the list of options that can be passed on to the overlay.

woopi@goldserver:~ $ dtoverlay -h i2c-rtc

Reboot the system and then, after opening a new session, check that the real time clock device has been created by the kernel and that the real time clock can be accessed.

nestor@domus:~ $ ls -l /dev/rt* lrwxrwxrwx 1 root root 4 Oct 24 12:12 /dev/rtc -> rtc0 crw------- 1 root root 252, 0 Oct 24 12:12 /dev/rtc0 woopi@goldserver:~ $ sudo hwclock --verbose hwclock from util-linux 2.33.1 System Time: 1573672406.546382 Trying to open: /dev/rtc0 Using the rtc interface to the clock. Assuming hardware clock is kept in UTC time. Waiting for clock tick... ioctl(3, RTC_UIE_ON, 0): Invalid argument Waiting in loop for time from /dev/rtc0 to change ...got clock tick Time read from Hardware Clock: 2019/11/13 19:13:28 Hw clock time : 2019/11/13 19:13:28 = 1573672408 seconds since 1969 Time since last adjustment is 1573672408 seconds Calculated Hardware Clock drift is 0.000000 seconds 2019-11-13 15:13:27.408018-04:00

There is only one hardware clock connected to the Pi and it shows up as device /dev/rtc0 in the OS. The dev/rtc is a symbolic link to the "preferred" clock device, which of course in our case must be the only clock device. As far as I know, /dev/rtc is never used.

By default the systemd-timesyncd or chronyd service will synchronize the system time at regular intervals and update the real time clock at the same time. Unfortunately, there is no default provision to update the system time from the real time clock when the system boots. That means that should the Pi not have access to the Internet after booting, the system time will not be correctly updated even if the real time clock does have a valid date and time. One could always do that by entering a command in a terminal.

nestor@domus:~ $ sudo hwclock --hctosys --verbose hwclock from util-linux 2.33.1 System Time: 1635182330.902467 Trying to open: /dev/rtc0 Using the rtc interface to the clock. Assuming hardware clock is kept in UTC time. Waiting for clock tick... ioctl(4, RTC_UIE_ON, 0): Invalid argument Waiting in loop for time from /dev/rtc0 to change ...got clock tick Time read from Hardware Clock: 2021/10/25 17:18:51 Hw clock time : 2021/10/25 17:18:51 = 1635182331 seconds since 1969 Time since last adjustment is 1635182331 seconds Calculated Hardware Clock drift is 0.000000 seconds Calling settimeofday(1635182331.000000, 180)

The hwclock utility cannot be run without administrative privileges, so the sudo is necessary. The --hctosys (or -s) option stands for hardware clock to system clock which does what we want. If the -verbose (or -v)) option is not present, then the system time will be udpated but the command will not send any output to the terminal.

In Real Time Clock, DS3231, for Domoticz on the Raspberry Pi, I added the command to the root control script, rc.local which is executed by, wait for it... root just before multiple users are enabled in the boot process.

nestor@domus:~ $ sudo nano /etc/rc.local
#!/bin/sh -e # # rc.local # # This script is executed at the end of each multiuser runlevel. # Make sure that the script will "exit 0" on success or any other # value on error. # # In order to enable or disable this script just change the execution # bits. # # By default this script does nothing. # Print the IP address _IP=$(hostname -I) || true if [ "$_IP" ]; then printf "My IP address is %s\n" "$_IP" fi hwclock --hctosys exit 0

Note the abscense of the sudo prefix, because as stated it is root that runs that script.

Instead of doing that, Gus, Lady Ada, and many others included myself staring in 2019, levearage a udev rule that runs a hwclock-set script when the rtc0 device is created. Here is the rule.

woopi@goldserver:~ $ cat /lib/udev/rules.d/85-hwclock.rules # Set the System Time from the Hardware Clock and set the kernel's timezone # value to the local timezone when the kernel clock module is loaded. KERNEL=="rtc0", RUN+="/lib/udev/hwclock-set $root/$name"

I did write "levearage" because the script is modified to do something other than what it was intended to do.

woopi@goldserver:~ $ sudo nano /lib/udev/hwclock-set #!/bin/sh # Reset the System Clock to UTC if the hardware clock from which it # was copied by the kernel was in localtime. dev=$1 if [ -e /run/systemd/system ] ; then exit 0 fi ...

Look carefully at the comment: the script is meant to fixup any problem that could be caused by having the RTC set to local time, whereas the system clock must be set to UTC (coordinated universal time, the successor to GMT or Zulu time if you have a military background). And look further, the script stops if the system manager is systemd. In other words, the script does nothing as is in Raspberry Pi Os, other Debian based distributions and many more Linux systems. The first change is to disable this test.

... #if [ -e /run/systemd/system ] ; then # exit 0 #fi ...

Gus, Lady Ada and others then go on and disable half of commands executed by the script.

... if [ yes = "$BADYEAR" ] ; then # /sbin/hwclock --rtc=$dev --systz --badyear /sbin/hwclock --rtc=$dev --hctosys --badyear else # /sbin/hwclock --rtc=$dev --systz /sbin/hwclock --rtc=$dev --hctosys fi ...

I have never bothered to comment out the hwclock --rtc=$dev --systz, with and without --badyear, lines and have not had detected problems so far. Why is that? Reading the manual ($ man hwclock), suggests to me that running that option would not do much harm as it does not read the hardware clock but merely makes sure that the system clock is set to UTC.

There is more to this topic, and it may result in another post on the subject.

Hardware Watchdog toc

In the previous post in this series, a software watchdog was installed that will reboot the computer if Domoticz no longer feeds it. For even better protection for a headless server, I have been looking at adding a hardware watchdog that, as a last resort, will restart the Raspberry Pi in the hope that it will recover.

Right now I am using a Cheap Of-the-Shelf Raspberry Pi Hardware Watchdog but I hope to replace that with something more sophisticated that tries to reboot a non responsive Pi before performing a hard reset. However, I have made significant progress in replacing this less than optimal watchdog with something more appropriate. See Rethinking the Raspberry Pi Hardware Watchdog.




A lot of things have been added to the operating system. This would be a good time to perform an overview.

nostra@damus:~ $ sudo systemctl --type=service UNIT LOAD ACTIVE SUB DESCRIPTION alsa-restore.service loaded active exited Save/Restore Sound Card State alsa-state.service loaded active running Manage Sound Card State (restore and store) avahi-daemon.service loaded active running Avahi mDNS/DNS-SD Stack bluetooth.service loaded active running Bluetooth service bthelper@hci0.service loaded active exited Raspberry Pi bluetooth helper chrony.service loaded active running chrony, an NTP client/server console-setup.service loaded active exited Set console font and keymap cron.service loaded active running Regular background program processing daemon dbus.service loaded active running D-Bus System Message Bus dhcpcd.service loaded active running dhcpcd on all interfaces domoticz.service loaded active running domoticz_service dphys-swapfile.service loaded active exited dphys-swapfile - set up, mount/unmount, and delete a swap file fake-hwclock.service loaded active exited Restore / save the current clock getty@tty1.service loaded active running Getty on tty1 ha-bridge.service loaded active running HA Bridge hciuart.service loaded active running Configure Bluetooth Modems connected by UART ifupdown-pre.service loaded active exited Helper to synchronize boot up for ifupdown keyboard-setup.service loaded active exited Set the console keyboard layout kmod-static-nodes.service loaded active exited Create list of required static device nodes for the current kernel mosquitto.service loaded active running Mosquitto MQTT v3.1/v3.1.1 Broker networking.service loaded active exited Raise network interfaces nginx.service loaded active running A high performance web server and a reverse proxy server radicale.service loaded active running A simple CalDAV (calendar) and CardDAV (contact) server raspi-config.service loaded active exited LSB: Switch to ondemand cpu governor (unless shift key is pressed) rc-local.service loaded active exited /etc/rc.local Compatibility rng-tools.service loaded active running rng-tools.service rpi-eeprom-update.service loaded active exited Check for Raspberry Pi EEPROM updates rsyslog.service loaded active running System Logging Service ssh.service loaded active running OpenBSD Secure Shell server syncthing@nestor.service loaded active running Syncthing - Open Source Continuous File Synchronization for nestor systemd-fsck-root.service loaded active exited File System Check on Root Device systemd-fsck@dev-disk-by\x2dpartuuid-0d0427ee\x2d01.service loaded active exited File System Check on /dev/disk/by-partuuid/0d0427ee-01 systemd-journal-flush.service loaded active exited Flush Journal to Persistent Storage systemd-journald.service loaded active running Journal Service systemd-logind.service loaded active running Login Service systemd-modules-load.service loaded active exited Load Kernel Modules systemd-random-seed.service loaded active exited Load/Save Random Seed systemd-remount-fs.service loaded active exited Remount Root and Kernel File Systems systemd-sysctl.service loaded active exited Apply Kernel Variables systemd-sysusers.service loaded active exited Create System Users systemd-tmpfiles-setup-dev.service loaded active exited Create Static Device Nodes in /dev systemd-tmpfiles-setup.service loaded active exited Create Volatile Files and Directories systemd-udev-trigger.service loaded active exited udev Coldplug all Devices systemd-udevd.service loaded active running udev Kernel Device Manager systemd-update-utmp.service loaded active exited Update UTMP about System Boot/Shutdown systemd-user-sessions.service loaded active exited Permit User Sessions triggerhappy.service loaded active running triggerhappy global hotkey daemon user-runtime-dir@1000.service loaded active exited User Runtime Directory /run/user/1000 user@1000.service loaded active running User Manager for UID 1000 watchdog.service loaded active running watchdog daemon wg-quick@wg0.service loaded active exited WireGuard via wg-quick(8) for wg0 wpa_supplicant.service loaded active running WPA supplicant LOAD = Reflects whether the unit definition was properly loaded. ACTIVE = The high-level unit activation state, i.e. generalization of SUB. SUB = The low-level unit activation state, values depend on unit type. 52 loaded units listed. Pass --all to see loaded but inactive units, too. To show all installed unit files use 'systemctl list-unit-files'.

That's 52 services none of which have failed, thankfully. As can be seen some services are no longer running, so limiting the list to running services would be more informative.

nostra@damus:~ $ sudo systemctl --type=service --state=running UNIT LOAD ACTIVE SUB DESCRIPTION alsa-state.service loaded active running Manage Sound Card State (restore and store) avahi-daemon.service loaded active running Avahi mDNS/DNS-SD Stack bluetooth.service loaded active running Bluetooth service chrony.service loaded active running chrony, an NTP client/server cron.service loaded active running Regular background program processing daemon dbus.service loaded active running D-Bus System Message Bus dhcpcd.service loaded active running dhcpcd on all interfaces domoticz.service loaded active running domoticz_service getty@tty1.service loaded active running Getty on tty1 ha-bridge.service loaded active running HA Bridge hciuart.service loaded active running Configure Bluetooth Modems connected by UART mosquitto.service loaded active running Mosquitto MQTT v3.1/v3.1.1 Broker nginx.service loaded active running A high performance web server and a reverse proxy server radicale.service loaded active running A simple CalDAV (calendar) and CardDAV (contact) server rng-tools.service loaded active running rng-tools.service rsyslog.service loaded active running System Logging Service ssh.service loaded active running OpenBSD Secure Shell server syncthing@nestor.service loaded active running Syncthing - Open Source Continuous File Synchronization for nestor systemd-journald.service loaded active running Journal Service systemd-logind.service loaded active running Login Service systemd-udevd.service loaded active running udev Kernel Device Manager triggerhappy.service loaded active running triggerhappy global hotkey daemon user@1000.service loaded active running User Manager for UID 1000 watchdog.service loaded active running watchdog daemon wpa_supplicant.service loaded active running WPA supplicant LOAD = Reflects whether the unit definition was properly loaded. ACTIVE = The high-level unit activation state, i.e. generalization of SUB. SUB = The low-level unit activation state, values depend on unit type. 25 loaded units listed. Pass --all to see loaded but inactive units, too. To show all installed unit files use 'systemctl list-unit-files'.

Some of these could be removed on a headless system

Auditing the System with Lynis toc

Only very recently have I become aware of the

nostra@damus:~ $ wget https://github.com/CISOfy/lynis/archive/refs/heads/master.zip -O lynis.zip
--2021-10-13 17:20:52--  https://github.com/CISOfy/lynis/archive/refs/heads/master.zip
Resolving github.com (github.com)... 140.82.112.4
Connecting to github.com (github.com)|140.82.112.4|:443... connected.
HTTP request sent, awaiting response... 302 Found
Location: https://codeload.github.com/CISOfy/lynis/zip/refs/heads/master [following]
--2021-10-13 17:20:53--  https://codeload.github.com/CISOfy/lynis/zip/refs/heads/master
Resolving codeload.github.com (codeload.github.com)... 140.82.113.9
Connecting to codeload.github.com (codeload.github.com)|140.82.113.9|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/zip]
Saving to: ‘lynis.zip’

lynis.zip                                          [  <=>                                                                                              ] 418.70K  1.45MB/s    in 0.3s

2021-10-13 17:20:54 (1.45 MB/s) - ‘lynis.zip’ saved [428746]

nostra@damus:~ $ ls
domoticz  domoticz-sh  downloads  ha-bridge  image.jpg  lynis.zip  mjpg-streamer  Sync  syncthing.gpg
nostra@damus:~ $ unzip lynis.zip
Archive:  lynis.zip
798c1054d7ac5ee6df6a2cbbdbb100545a3892f7
   creating: lynis-master/
   creating: lynis-master/.github/
   creating: lynis-master/.github/ISSUE_TEMPLATE/
  inflating: lynis-master/.github/ISSUE_TEMPLATE/bug_report.md
  inflating: lynis-master/.github/ISSUE_TEMPLATE/feature_request.md
 extracting: lynis-master/.gitignore
  inflating: lynis-master/.travis.yml
  inflating: lynis-master/CHANGELOG.md
  inflating: lynis-master/CODE_OF_CONDUCT.md
  inflating: lynis-master/CONTRIBUTING.md
  inflating: lynis-master/CONTRIBUTORS.md
  inflating: lynis-master/FAQ
  inflating: lynis-master/HAPPY_USERS.md
  inflating: lynis-master/INSTALL
  inflating: lynis-master/LICENSE
  inflating: lynis-master/README
  inflating: lynis-master/README.md
  inflating: lynis-master/SECURITY.md
  inflating: lynis-master/TODO.md
   creating: lynis-master/db/
  inflating: lynis-master/db/fileperms.db
  inflating: lynis-master/db/hints.db
 extracting: lynis-master/db/integrity.db
   creating: lynis-master/db/languages/
  inflating: lynis-master/db/languages/az
    linking: lynis-master/db/languages/br  -> pt
  inflating: lynis-master/db/languages/cn
  inflating: lynis-master/db/languages/da
  inflating: lynis-master/db/languages/de
    linking: lynis-master/db/languages/de-AT  -> de
  inflating: lynis-master/db/languages/en
    linking: lynis-master/db/languages/en-GB  -> en
    linking: lynis-master/db/languages/en-US  -> en
  inflating: lynis-master/db/languages/es
  inflating: lynis-master/db/languages/fi
  inflating: lynis-master/db/languages/fr
  inflating: lynis-master/db/languages/gr
  inflating: lynis-master/db/languages/he
  inflating: lynis-master/db/languages/hu
  inflating: lynis-master/db/languages/it
  inflating: lynis-master/db/languages/ja
  inflating: lynis-master/db/languages/ko
  inflating: lynis-master/db/languages/nb-NO
  inflating: lynis-master/db/languages/nl
    linking: lynis-master/db/languages/nl-BE  -> nl
    linking: lynis-master/db/languages/nl-NL  -> nl
  inflating: lynis-master/db/languages/pl
  inflating: lynis-master/db/languages/pt
  inflating: lynis-master/db/languages/ru
  inflating: lynis-master/db/languages/se
  inflating: lynis-master/db/languages/sk
  inflating: lynis-master/db/languages/tr
  inflating: lynis-master/db/malware-susp.db
  inflating: lynis-master/db/malware.db
 extracting: lynis-master/db/sbl.db
  inflating: lynis-master/db/software-eol.db
  inflating: lynis-master/db/tests.db
  inflating: lynis-master/default.prf
  inflating: lynis-master/developer.prf
   creating: lynis-master/extras/
  inflating: lynis-master/extras/README
   creating: lynis-master/extras/bash_completion.d/
  inflating: lynis-master/extras/bash_completion.d/lynis
  inflating: lynis-master/extras/build-lynis.sh
  inflating: lynis-master/extras/check-lynis.sh
  inflating: lynis-master/extras/files.dat
  inflating: lynis-master/extras/lynis.spec
   creating: lynis-master/extras/openbsd/
  inflating: lynis-master/extras/openbsd/+CONTENTS
   creating: lynis-master/extras/systemd/
  inflating: lynis-master/extras/systemd/lynis.service
  inflating: lynis-master/extras/systemd/lynis.timer
   creating: lynis-master/extras/travis-ci/
 extracting: lynis-master/extras/travis-ci/before_script.sh
   creating: lynis-master/include/
  inflating: lynis-master/include/binaries
  inflating: lynis-master/include/consts
  inflating: lynis-master/include/data_upload
  inflating: lynis-master/include/functions
  inflating: lynis-master/include/helper_audit_dockerfile
  inflating: lynis-master/include/helper_configure
  inflating: lynis-master/include/helper_generate
  inflating: lynis-master/include/helper_show
  inflating: lynis-master/include/helper_system_remote_scan
  inflating: lynis-master/include/helper_update
  inflating: lynis-master/include/osdetection
  inflating: lynis-master/include/parameters
  inflating: lynis-master/include/profiles
  inflating: lynis-master/include/report
  inflating: lynis-master/include/tests_accounting
  inflating: lynis-master/include/tests_authentication
  inflating: lynis-master/include/tests_banners
  inflating: lynis-master/include/tests_boot_services
  inflating: lynis-master/include/tests_containers
  inflating: lynis-master/include/tests_crypto
  inflating: lynis-master/include/tests_custom.template
  inflating: lynis-master/include/tests_databases
  inflating: lynis-master/include/tests_dns
  inflating: lynis-master/include/tests_file_integrity
  inflating: lynis-master/include/tests_file_permissions
  inflating: lynis-master/include/tests_filesystems
  inflating: lynis-master/include/tests_firewalls
  inflating: lynis-master/include/tests_hardening
  inflating: lynis-master/include/tests_homedirs
  inflating: lynis-master/include/tests_insecure_services
  inflating: lynis-master/include/tests_kernel
  inflating: lynis-master/include/tests_kernel_hardening
  inflating: lynis-master/include/tests_ldap
  inflating: lynis-master/include/tests_logging
  inflating: lynis-master/include/tests_mac_frameworks
  inflating: lynis-master/include/tests_mail_messaging
  inflating: lynis-master/include/tests_malware
  inflating: lynis-master/include/tests_memory_processes
  inflating: lynis-master/include/tests_nameservices
  inflating: lynis-master/include/tests_networking
  inflating: lynis-master/include/tests_php
  inflating: lynis-master/include/tests_ports_packages
  inflating: lynis-master/include/tests_printers_spoolers
  inflating: lynis-master/include/tests_scheduling
  inflating: lynis-master/include/tests_shells
  inflating: lynis-master/include/tests_snmp
  inflating: lynis-master/include/tests_squid
  inflating: lynis-master/include/tests_ssh
  inflating: lynis-master/include/tests_storage
  inflating: lynis-master/include/tests_storage_nfs
  inflating: lynis-master/include/tests_system_integrity
  inflating: lynis-master/include/tests_time
  inflating: lynis-master/include/tests_tooling
  inflating: lynis-master/include/tests_usb
  inflating: lynis-master/include/tests_virtualization
  inflating: lynis-master/include/tests_webservers
  inflating: lynis-master/include/tool_tips
  inflating: lynis-master/lynis
  inflating: lynis-master/lynis.8
   creating: lynis-master/plugins/
  inflating: lynis-master/plugins/README
  inflating: lynis-master/plugins/custom_plugin.template
  inflating: lynis-master/plugins/plugin_pam_phase1
  inflating: lynis-master/plugins/plugin_systemd_phase1
finishing deferred symbolic links:
  lynis-master/db/languages/br -> pt
  lynis-master/db/languages/de-AT -> de
  lynis-master/db/languages/en-GB -> en
  lynis-master/db/languages/en-US -> en
  lynis-master/db/languages/nl-BE -> nl
  lynis-master/db/languages/nl-NL -> nl
nostra@damus:~ $ ls
domoticz  domoticz-sh  downloads  ha-bridge  image.jpg  lynis-master  lynis.zip  mjpg-streamer  Sync  syncthing.gpg
nostra@damus:~ $ ls lynis-master
CHANGELOG.md        CONTRIBUTING.md  db           developer.prf  FAQ             include  LICENSE  lynis.8  README     SECURITY.md
CODE_OF_CONDUCT.md  CONTRIBUTORS.md  default.prf  extras         HAPPY_USERS.md  INSTALL  lynis    plugins  README.md  TODO.md
nostra@damus:~ $ mv lynis.zip downloads/
nostra@damus:~ $ ls -l
total 2340
drwxr-xr-x 7 nostra nostra    4096 Oct 13 11:50 domoticz
-rwxr-xr-x 1 root   root      4434 Sep 16 00:32 domoticz-sh
drwxr-xr-x 3 nostra nostra    4096 Oct 13 17:21 downloads
drwxr-xr-x 3 nostra nostra    4096 Sep 23 16:19 ha-bridge
-rw-r--r-- 1 nostra nostra 2358866 Sep 27 13:20 image.jpg
drwxr-xr-x 7 nostra nostra    4096 Jul 30 03:17 lynis-master
drwxr-xr-x 4 nostra nostra    4096 Sep 27 13:38 mjpg-streamer
drwxr-xr-x 3 nostra nostra    4096 Sep 25 16:30 Sync
-rw-r--r-- 1 nostra nostra    1769 Sep 25 16:17 syncthing.gpg
nostra@damus:~ $ ls downloads
domoticz  lynis.zip

nostra@damus:~ $ mv lynis-master lynis
nostra@damus:~ $ cd lynis
nostra@damus:~/lynis $ ./lynis audit system --quiet

[WARNING]: Test PLGN-0010 had a long execution: 10.016210 seconds


[WARNING]: Test PKGS-7345 had a long execution: 10.906893 seconds


[WARNING]: Test CRYP-7902 had a long execution: 30.470371 seconds


Running test as root

nostra@damus:~ $ sudo su
root@damus:/home/nostra/lynis# cd ..
root@damus:/home/nostra# chown -R 0:0 lynis
root@damus:/home/nostra# cd lynis
root@damus:/home/nostra/lynis# ./lynis audit system --quiet

[WARNING]: Test PKGS-7345 had a long execution: 10.763354 seconds


[WARNING]: Test PKGS-7392 had a long execution: 14.889131 seconds


[WARNING]: Test PHP-2211 had a long execution: 12.111933 seconds


[WARNING]: Test CRYP-7902 had a long execution: 35.552021 seconds


Setting up a Raspberry Pi as a Headless Computer (September 2021) (back to part I)-> <-Home Automation System on a Raspberry Pi (part II)