Python plugin: Presence detection from wireless router

[EscApe]

Update December 9, 2019: Version 2.0 has been released
For more information see https://github.com/d-EScape/Domoticz_iDetect

This plugin will use information from your wireless router to detect if devices (phones) are present or absent. I believe this is the most efficient way, since other methods like geo-fencing (gps) or pinging phones might drain their batteries.
You can configure multiple devices to look for by their MAC addresses. A Domoticz Device will be created for each one. Additionally a single "Anyone home" device will be created, which will be 'On' if any of the monitored devices is present.

The detection is performed through a SSH connection to your router. It supports several types and brands of routers, by detecting commands it can utilize, but probably not al. A accessible ssh service on the router is required.

Please let me know if the plugin works for your router by leaving a message in the forum containing your router brand and model. If it doesn't work, then please include a relevant portion of the Domoticz log (after enabling debug mode on the plugin's configuration page).

Instructions and files have been moved to GitHub:
https://github.com/d-EScape/Domoticz_iDetect
----

devices-idetect02.jpg (72.93 KiB) Viewed 31139 times

[hjzwiers]

I like the concept of the plugin.

I have installed this plugin, can ssh (from /home/PI/ ) with user@ip_adress to the router (also a AC68U) without password, but in the Domoticz logging I only see the plugin start, no errors. On the router log I see the connection open en close, no errors.

Attention point. At first the plug failed because the MAC adres is case sensitive, use the same case as the router sends. Now working fine!

[EscApe]

@hjzwiers
Glad you like it. Thanks for pointing out the need to put mac addresses in the right case (upper or lower). Upper case will probably be the right case for all broadcom based routers.

Since the work around (always put mac addresses in capitals) is easy i will not create a new version, but i will certainly take it into account when i do make some other modifications.

[blauwebuis]

Just to be sure: if someone has access to my Pi and grabs the keyfile, they would theoretically have access to a root SSH shell on my router?

[emme]

Got install it... it runs with no error (except I had to fight a bit with the RSA key )
this is an amazing work! I was looking for a solution like this but I was unable to find a way to achieve it

but I still unable to get the devices list...
I got this error:

Code: Select all

2018-02-05 21:02:59.481 Error: (net_Presence) Error getting data from router: b'DD-WRT v3.0-r34320M kongac (c) 2017 NewMedia-NET GmbH\nRelease: 01/03/18\n'
2018-02-05 21:02:59.481 Error: (net_Presence) No list of connected WLAN devices from router

but if I manually ssh to my router with user pi (yes, if someone steal access to the PI user he will also gain access to the router) the 2 commands
wl -i eth1 assoclist
assoclist xx:xx:xx:xx:xx:xx
assoclist xx:xx:xx:xx:xx:xx
assoclist xx:xx:xx:xx:xx:xx
wl -i eth2 assoclist
assoclist xx:xx:xx:xx:xx:xx


I'm not skilled enough to debug this.... is there something you can help me with?
thanks
M

[EscApe]

I don’t have a dd-wrt router to test this myself. However, the most likely cause is the key based authentication. As you already experienced it’s a bit complicated to set up correctly. More so if you use it with a system service. Even if you got it working from the command line it might not work for Domoticz.
Is Domoticz running as the same user as your command line test?

The rights to the key file should be set to 600, so only the owner can read/use it. Otherwise ssh might not accept it and you still get a login prompt. The owner should be the same user that runs de Domoticz service. If Domoticz is running under the root user account then the key file should also be owned by root and be accessible only by root (chown root:root filename and chmod 600 filename).

Any ddwrt users out there that can confirm this plugin even works with ddwrt? Theoretically it should work on any router that has the wl command (Broadcom in general), but I can only test it against my own asuswrt router.

[EscApe]

@blauwebuis

That’s correct. Anyone with acces to the username and keyfile would be able to access your router. Same as with any other form of credentials. The file however will be as safe as your Pi

[hjzwiers]

I have moved my hardware setup to a NUC for a better performance (I had this plugin running before from a PI)

I set up the keys from my home directory (/home/user/). Domoticz runs from /home/user/domoticz.

I can ssh my router (AC68u) from the home directory without errors, no problem with the keys or the router.

All keys are in ~/.ssh/. I set the location in th ehardware settings to /home/user/.ssh/id_rsa.

I keep getting errors in the logging:

2018-02-07 08:42:23.774 Error: (Phone_detect) Error getting data from router: b'Host key verification failed.\r\n'
2018-02-07 08:42:23.774 Error: (Phone_detect) No list of connected WLAN devices from router

I thought I would try to change permissions, I did the command chmod 600 id_rsa, and also tried to move the id_rsa to another folder. Nothing helps.

Any idea's???

[EscApe]

With key authentication the most important thing is the user profile that is running the ssh command. The location of the file doesn't really matter. Even if the Domoticz binary is located in the /home/user folder it could still be started by the root userprofile (by default!).

Can you check:

Code: Select all

ps -eo uname:20,pid,cmd | grep 'domoticz'

If it says root, than you could change the ownership of the key file to root (still 600). It would be safer to run Domoticz as 'user', but then you might also have to change some other authorization or ownerships to keep domoticz running.

[hjzwiers]

Thanks for your help. I ran the command, this is the result

root 1947 /home/hjz/domoticz/domoticz -daemon -www 8080 -sslwww 443
hjz 19448 grep --color=auto domoticz

I also made an overview of the file permissions

hjz@domoticz:~/domoticz/plugins$ ls -la
total 44
drwxrwxr-x 6 hjz hjz 4096 Feb 7 07:10 .
drwxrwxr-x 31 hjz hjz 4096 Feb 6 22:01 ..
drwxrwxr-x 3 hjz hjz 4096 Jan 28 22:18 AwoxSMP
drwxrwxr-x 2 hjz hjz 4096 Jan 28 22:18 examples
-rwxr-xr-x 1 600 root 1675 Feb 7 07:10 id_rsa
drwxrwxr-x 3 hjz hjz 4096 Nov 18 20:03 __MACOSX
drwx------ 3 hjz hjz 4096 Feb 6 21:01 Presence
-rw-rw-r-- 1 hjz hjz 15863 Feb 6 19:58 Presence.zip

Hope it helps

[hjzwiers]

Also the permissions of the stored id_rsa

hjz@domoticz:~/.ssh$ ls -la
total 20
drwx------ 2 hjz hjz 4096 Feb 6 22:28 .
drwxr-xr-x 10 hjz hjz 4096 Feb 6 07:16 ..
-rwx------ 1 600 root 1675 Jan 30 21:42 id_rsa
-rw-r--r-- 1 hjz hjz 394 Jan 30 21:42 id_rsa.pub
-rw-r--r-- 1 hjz hjz 314 Feb 6 22:29 known_hosts

[EscApe]

Since the Domoticz process in your setup is running as root the key file should also be owned by root.

The file properties (ls -al) should look like this:
-rw------- 1 root root 1675 Jan 30 21:42 id_rsa

Your's says:
-rwx------ 1 600 root 1675 Jan 30 21:42 id_rsa

Which means the file is owned by a user called '600' and group 'root'. The file is executable (x). I think you mixed up the chmod and chown commands at some point while testing.

Could you test this:

Code: Select all

sudo chmod 600 id_rsa
sudo chown root:root id_rsa

The 'sudo' is only necessary if you are not logged in as root.

[hjzwiers]

I did the commands but it has not been succesful, and this is the new ls -la

drwx------ 2 hjz hjz 4096 Feb 8 21:22 .
drwxr-xr-x 10 hjz hjz 4096 Feb 6 07:16 ..
-rw------- 1 root root 1675 Jan 30 21:42 id_rsa
-rw-r--r-- 1 hjz hjz 394 Jan 30 21:42 id_rsa.pub
-rw-r--r-- 1 hjz hjz 0 Feb 8 21:22 known_hosts

I now get this error:
Error getting data from router: b'Warning: Identity file /root/.ssh/id_rsa not accessible: No such file or directory.\nPermission denied (publickey).\r\n'

Now also ssh from the command line fails ...... Permission denied (publickey)

Changed the file location to /home/hjz/.ssh/id_rsa, now it finds teh key but I get the following error.

Error getting data from router: b'sh: wl: not found\nsh: wl: not found\n'

Does this have anything to do with the know hosts permission? With the last permission with the first ssh from command the know_hosts was filled.

[EscApe]

It looks like you have got the key permissions and path problem figured out. If the known hosts file is an issue you could try to ssh into the router from the root account (sudo su, and then manually ssh router). If you can get into the router from the root account (which Domoticz is also using) then the key based login stuff should ok.

Am assuming you didn’t replace the router with another model, that might not know the wl command(?)

[hjzwiers]

In the end I made a new key from root, deleted the old ons. That worked fine.

The new error is because I flashed the router to AsusWRT, not Merlin, because I want to use the new AImesh functionality which is not supported in the Merlin release. It seems to be the cause.

Is there a way the wl command can be used with Asus firmware?

[EscApe]

Sorry, i can’t offer you any help on specific routers and firmwares i don’t own or know. I thought the wl command was in the standard ASUS firmware as well (not specific to Merlin).

Maybe someone else can offer some insights if you post the details of your router and firmware(?)

You could investigate if wl is available thru optware/entware.

[hjzwiers]

Thanks for your help.

My router is also the Asus AC68u running the latest firmware 3.0.0.4.384_20308 (with AImesh support)

Error "User HJZ executing 'wl -i eth1 assoclist;wl -i eth2 assoclist' ", it seems it does not support the wl command.

[EscApe]

Could you try to logon to the router by ssh manually (with same HJZ account) and running the wl command from the command line? Maybe that will give you a more useful error message.

[hjzwiers]

I did a full reinstall of the server

From root I generated the command in a ssh session to the router: wl -i eth1 assoclist;wl -i eth2 assoclist
(after installing the correct keygen in the root)

root@domoticz:~# ssh [email protected]
HJZ@RT-AC68U:/tmp/home/root# wl -i eth1 assoclist;wl -i eth2 assoclist
assoclist 9C:D3:5B:04:8A:68
assoclist 94:9A:A9:62:49:EF
assoclist 00:04:20:F1:B9:4A
assoclist 00:60:34:0D:1C:8E
assoclist 94:E9:6A:3F:7A:3B
assoclist 2C:9E:FC:93:A0:DA
assoclist 9C:D3:5B:04:89:12
assoclist F0:24:75:B7:D4:87

The command after sudo -i gives the assoclist !!!

From within idect I receive the same error
Error: (Detection_phones) Error getting data from router: b'sh: wl: not found\nsh: wl: not found\n'

Strange .......

[EscApe]

Well, that's one success at least The wl command is available.

I still suspect this is an issue with the key authentication. It is pretty hard to set it up so the right user is authenticating with the right key file on both sides. One thing you could do to make sure the plugin is using the right key file is to put the full path of the file in the plugin configuration (not ~/.shh etc). Make sure it contains the key for the correct user profile on the routers side and the user name in the plugin config. You probably did that already, but i know from experience that a mistake is easily made. Sometimes it helps to just start from scratch. Did you copy the right key to the router after you reinstalled stock asuswrt?

There's not much more i can think of. I hope you find the solution for your setup.

I am considering rewriting the plug to use a python based ssh client, so it can authenticate with username/password. But right now the plugin system doesn't always work very well with imported libraries. That will have to wait until the python plugin system gets out of beta and i have a bit more time.