Setting up seafile with encrypted disk on a Raspberry Pi on eduroam

seafile-raspberry.md

Setting up seafile on a Raspberry Pi with stretch and an encrypted external drive

Install Raspbian stretch

• download the image here
• put the rasbian stretch image on an SD-card with Etcher
• put a ssh file in the /boot folder by doing: cd /Volumes/boot/ and touch ssh
• connect the Raspberry Pi to your router and ssh into it
• run ssh-copy-id pi@<ip here>
• change password with passwd
• Expand file system, change hostname, set timezone, change Wi-Fi country, and set locale in sudo raspi-config
• run sudo apt-get update && sudo apt-get upgrade and then sudo reboot
• (optional) set a static IP with sudo nano /etc/dhcpcd.conf and modify the IPs under # Example static IP configuration:

Connect to Wi-Fi at home

• From RPI documentation: Connect to Wi-Fi via sudo nano /etc/wpa_supplicant/wpa_supplicant.conf and add:

network={
    ssid="<network name>"
    psk="<password>"
}

Setup Wi-Fi with eduroam

• Similar to above
• Download this certificate (found on here) with wget http://www.personal.reading.ac.uk/~vis09n/eduroam/AddTrustExternalCARoot.crt and convert to crt, with openssl x509 -in AddTrustExternalCARoot.crt -out AddTrust_External_Root.pem -outform PEM, then move sudo mv AddTrust_External_Root.pem /etc/ssl/certs/AddTrust_External_Root.pem.

network={
    ssid="eduroam"
    scan_ssid=1
    key_mgmt=WPA-EAP
    eap=TTLS
    anonymous_identity="[email protected]"
    ca_cert="/etc/ssl/certs/AddTrust_External_Root.pem"
    phase2="auth=PAP"
    identity="<username>@tudelft.nl"
    password="<password>"
}

• If you don't want to put your password there use wpa_passphrase "eduroam" "<put your password here>" and replace password=<password> by psk=<returned string>

Encrypt your external disk

• Connect external hard drive
• Follow this guide, I did:
• sudo apt-get install cryptsetup
• Find your disk name with sudo fdisk -l in my case /dev/sda1
• (optional: first I remove all partitions from the disk with dd if=/dev/zero of=/dev/sda bs=512 count=1 conv=notrunc)
• sudo cryptsetup luksFormat /dev/sda1
• sudo cryptsetup open /dev/sda1 encrypted
• sudo mkfs.ext4 /dev/mapper/encrypted

Mount

• sudo cryptsetup --type luks open /dev/sda1 encrypted
• sudo mount -t ext4 /dev/mapper/encrypted /media/usb

Unmount

• sudo umount /media/usb
• sudo cryptsetup close encrypted

Extra sources:

• https://medium.com/@amritanshu16/how-to-mount-luks-encrypted-disk-in-raspbian-821b0a56c18e
• https://github.com/NicoHood/NicoHood.github.io/wiki/Raspberry-Pi-Encrypt-Root-Partition-Tutorial

Setup seafile

• Follow the Deploying Seafile with SQLite guide for Debian
• Follow the Config Seahub with Nginx guide