Author: Joel Serna Moreno
@JoelSernaMoreno (IoT/ICS Pentest Engineer – Titanium Industrial Security)

1.- Introduction

Since the presentation of BadUSB at Blackhat USA 2014 and, subsequently, the development of specific devices to perform these attacks, a number of tools and solutions designed to detect and block BadUSB attacks have emerged. These tools range from specialised software to physical devices that protect USB ports from malicious attacks. However, the effectiveness and reliability of these solutions vary considerably.

This article aims to show some of the security measures that these tools apply in an attempt to block BadUSB attacks, analyse them in depth to understand and identify the checks they make to decide whether a device is malicious and, consequently, show how to bypass these protection tools.

For a better understanding of the security measures implemented in the tools, we will categorise evasions into 3 levels of difficulty: low, medium and high. This categorisation is based on the possible difficulty an attacker may have in implementing and evading security tools. Free and/or open source tools will be used to explain the different existing protections. Finally, we will test the evasions implemented by the attacker against professional/commercial protection software.

Additionally, we will show the process performed to evade any anti-badUSB tool in a real environment, without the attacker knowing the type or model of USB peripheral connected to the victim’s computer or the protection software installed on the computer.

2.- Device used

We are going to implement USB protection evasions in a low-cost device called Evil Crow Cable Pro.

Evil Crow Cable Pro is a BadUSB and hardware keylogger device in mobile phone cable format. Inside it uses a RP2040 microcontroller, which, by modifying its firmware, will allow us to implement the security evasions and apply them in a real environment.

For more information and purchase links, please consult the device repository:

https://github.com/joelsernamoreno/EvilCrowCable-Pro

Figure 1 – Evil Crow Cable Pro device

3.- Bypass BadUSB restrictions (I): low level

In order to implement evasions, we must first understand how the connection between a USB device and a computer works.

When a USB device is connected to a computer, an identification process takes place. This identification is based on the information provided by the USB device regarding its interface class, interface subclass and interface protocol. These parameters help the system to understand the functionality of the device and how it should interact with it.

• Interface class: The USB interface class indicates the primary function of the device. For example, a USB storage device will have an interface class that identifies it as a Mass Storage Device, while a keyboard or mouse will have an interface class corresponding to Human Interface Device (HID). Other examples of interface classes include audio devices, printers, cameras, etc. In the case of the USB devices we are interested in, the class value that identifies an HID device in the interface descriptors is 3.

• Interface subclass: During the early development of the HID specification, subclasses were intended to identify protocols specific to the different types of HID class devices. While this reflects the model currently in use by the industry (all devices use protocols defined by similar popular devices), this approach was too restrictive. That is, devices would have to fit into defined subclasses and could not offer any functionality beyond that supported by the subclass. Consequently, the HID class does not use subclasses to define most protocols. Instead, a device of the HID class identifies its data protocol and the type of data provided within its Report descriptor. The HID class driver loads and parses the Report descriptor as soon as it detects the device. HID class devices use the Subclass part to indicate whether they support a predefined protocol for mouse or keyboard devices (e.g. the device can be used without the operating system being started).

• Interface Protocol: A field in the USB interface description that indicates the protocol used by the interface. For HID devices, common values are as follows:

  • Keyboard: 1

  • Mouse: 2

Nowadays there are many tools that allow us to block or allow USB devices on a computer. One example is USBDeview. This tool allows us to block unwanted USB devices by telling it the interface class, interface subclass and interface protocol of the USB devices we want to block. Additionally, it allows us to allow the USB devices we want to use via vendor ID (VID) and product ID (PID).

• Vendor ID: is a unique code that identifies a device’s manufacturer

• Product ID: is a unique code that identifies the product.

For the first evasion, let’s assume that the victim’s computer has software installed and configured that blocks the use of keyboards and mice except for a specific keyboard that is normally used by the victim.

If we connect a USB keyboard other than the allowed one or a BadUSB device, USBDeview will block the use of the keyboard and/or the execution of our malicious device. The following evidence shows that the allowed USB keyboard is not blocked but the malicious device is blocked:

Figure 2 – Evil Crow Cable Pro block

To bypass this protection, if an attacker knows the VID and PID, he can configure the malicious device with this data to bypass the protection. This bypass has been categorised as low level because it is very easy to modify this data on any malicious device or any Arduino-based device.

In this case, Evil Crow Cable Pro makes use of the TinyUSB stack, which allows us to easily modify the vendor ID and product ID by adding the following lines of code in the firmware:

Figure 3 – Set VID & PID

By programming the malicious device with this configuration, we managed to impersonate the allowed USB keyboard:

Figure 4 – Bypass USBDeview

Clearly, without having physical access to the allowed USB keyboard, it is quite difficult for an attacker to know the vendor ID and product ID allowed in the protection software to pre-program the malicious device. A solution to this problem will be shown throughout this article.

The following video shows the bypass of USBDeview using Evil Crow Cable Pro configured with the vendor ID and product ID allowed by the protection tool:

4.- Bypass BadUSB restrictions (II): medium level

Due to the easy evasion of tools that block/allow a USB device via vendor ID and product ID, some security researchers proposed several more secure and difficult to evade solutions that allow blocking BadUSB devices.

One of them is the «Patito Hunter» tool developed by Miguel Angel Arroyo (@miguel_arroyo76).

https://github.com/curiozity/patitohunter

The Patito Hunter tool proposes to block the famous Rubber Ducky USB device or any other BadUSB device based on the number of interfaces a USB device has.

The research carried out by Miguel Angel Arroyo summarises that an original USB keyboard will always have a minimum of two interfaces (even three interfaces if it is a keyboard with an integrated touchpad). In contrast, a BadUSB device such as the USB Rubber Ducky will only have a single interface.

The following image shows a comparison of the interfaces that Evil Crow Cable Pro or a BadUSB device and three original USB keyboards can have:

Figure 5 – Interface comparison

At a glance we can see that Evil Crow Cable Pro has a single interface while the three original keyboards have two interfaces each.

The Patito Hunter tool is open source, which allows us to look at the code to see exactly how it applies the BadUSB device blocking:

Figure 6 – BadUSB check

Briefly, the tool obtains the descriptors and the number of interfaces of the connected USB device and displays the information on the terminal. It then calls the check_for_badusb function to identify whether the connected device is a BadUSB device or a legitimate device.

If we connect Evil Crow Cable Pro to a computer where the tool is running, we can see that the tool blocks the device correctly because it has a single interface:

Figure 7 – Evil Crow Cable Pro block

To bypass this protection we can modify the Evil Crow Cable Pro firmware to have more than one interface. Evil Crow Cable Pro uses a specific library based on TinyUSB that allows you to add multiple interfaces quite easily:

Figure 8 – Set two interfaces

Patito Hunter only checks the number of interfaces that a USB device has, but does not check the type of each interface as other tools that we will see later do. So, it is not necessary to know the type of interfaces of a allowed device, by configuring our malicious device to have more than one interface is enough to bypass this tool:

Figure 9 – Bypass PatitoHunter

The following video shows Patito Hunter bypassing using Evil Crow Cable Pro configured with more than one interface:

Unlike Miguel Angel Arroyo with his Patito Hunter tool, other researchers propose to block BadUSB devices based on the typing speed of a person or a malicious device.

BadUSB devices are capable of sending keystrokes much faster than a person. According to Wikipedia and other public sources, they indicate that the average (moderate-fast) typing speed of a person is 1 keystroke every 100 milliseconds.

Tools like BadUSB-Detection or DuckHunt propose to block any USB device if it sends each keystroke with a delay of less than 30/35 milliseconds.

https://github.com/armoured-ape/BadUSB-Detection

https://github.com/pmsosa/duckhunt

If we connect a BadUSB device to any of these tools it will be blocked because the delay between each keystroke sent is less than 30/35 milliseconds:

Figure 10 – BadUSB speed block

This security measure is very interesting because BadUSB devices seek to execute malicious commands on a computer in a very fast way to prevent the victim from stopping the attack mid-execution.

Still, even though we have a much more limited attack due to the speed of command execution, it is possible to bypass this protection in several ways. In the case of bypass BadUSB-Detection, we have to configure our malicious device so that there is a 30 millisecond delay between each keystroke. In the case of the DuckHunt tool we have to configure our malicious device in the same way, but this time with a delay of 35 milliseconds between each keystroke.

Knowing this allows us to configure the malicious device specifically for each tool, but… what if the attacker does not know the keystroke delay settings of the tool installed on the computer? This is where a specific functionality of Evil Crow Cable Pro comes into play.

It was mentioned at the beginning of the article that Evil Crow Cable Pro is based on the RP2040 microcontroller. Unlike other microcontrollers such as Atmega32U4 or Attiny85, the RP2040 microcontroller has two cores that can be programmed to perform different tasks. This is why Evil Crow Cable Pro is a Hardware Keylogger as well as a BadUSB device:

Figure 11 – Evil Crow Cable Pro cores

Evil Crow Cable Pro is programmed to use the first core to identify itself as a keyboard and send keystrokes to a computer. Additionally, the second core of the RP2040 is used as a USB Host so that Evil Crow Cable Pro can be a hardware keylogger and record keystrokes made by a victim on their keyboard. In short, Evil Crow Cable Pro can act as a Man In The Middle (MITM) device between the victim’s computer and the victim’s USB keyboard. There are several ways to do this attack:

Figure 12 – Evil Crow Cable Pro MITM

To bypass the write speed protection without knowing the keystroke delay configured in the protection tool, it is possible to modify the Evil Crow Cable Pro firmware to get an approximation of the victim’s write speed by using the USB Host and the victim’s keyboard keystroke log. Evil Crow Crow Cable Pro will automatically configure itself with a specific delay based on the victim’s typing speed to bypass protection and execute a payload without being blocked:

Figure 13 – Calculate delay between keystrokes

The following video shows how Evil Crow Cable Pro records the victim’s keystrokes, calculates the write speed and executes a payload on the victim’s computer without being blocked:

5.- Bypass BadUSB restrictions (III): high level

We have seen some tools that propose to block BadUSB attacks by allowing or blocking the device according to its VID, PID, number of interfaces or write speed, and we have also seen how to bypass these protections in a fairly simple way. However, we can also find much more advanced tools that can do additional checks to identify whether a USB device is allowed or has to be blocked:

• idVendor: vendor ID, defines the vendor of the USB device

• idProduct: product ID, defines the product from a vendor

• bInterfaceClass: USB interface class

• bInterfaceSubClass: USB interface sub class

• bDeviceProtocol: USB device protocol

• bConfigurationValue: current USB configuration

• serial: serial number of the device

• manufacturer: manufacturer of device

• product: product name string

• connect_type: hotplug: external USB device, direct: internal USB device

• bcdDevice: USB protocol version

• speed: USB speed value

• bNumConfigurations: the number of available USB configurations

• bNumInterfaces: Number of available interfaces in active configuration

• bInterfaceNumber: interface number

• bNumEndpoints: number of endpoints for the interface

If in a real environment we find a tool that does all these checks, it is quite difficult for an attacker to know all this information in order to pre-program the malicious device. Additionally, we may also encounter tools that do some additional checks that have not been mentioned above.

So what can we do to bypass something like this? The first thing to know is that in the end, all protection tools have to rely on some descriptor or configuration provided by the original keyboard.

If an attacker manages to spoof 100% (or almost) the original keyboard allowed by the protection software, the attacker will be able to bypass any type of tool without needing to know which tool is installed on the victim’s computer or the checks that the tool makes.

This is where the Evil Crow Cable Pro USB Host comes into play again. The idea of the attack is to get all the information and settings that an original keyboard sends to the computer, after which Evil Crow Cable Pro will automatically configure itself to completely impersonate the original keyboard.

A basic example can be done with the USBDeview tool, let’s assume that the tool is configured to block all keyboards except a keyboard with a specific vendor ID and product ID. If an attacker wants to bypass this protection without knowing that USBDeview is installed on the victim’s machine and without knowing the vendor ID and product ID of the original allowed keyboard, he can perform the following attack:

1. The attacker tries to connect Evil Crow Cable Pro and the execution of the payload is blocked by the protection tool (in this case USBDeview).

2. The attacker disconnects the original USB allowed keyboard from the victim computer and connects it to the USB Host of the Evil Crow Cable Pro.

3. Evil Crow Cable Pro clones the original USB keyboard, then the attacker disconnects the original USB keyboard from the Evil Crow Cable Pro USB Host.

4. The attacker disconnects Evil Crow Cable Pro from the victim computer and reconnects it to apply the original keyboard spoofing.

5. The payload is executed on the victim’s computer.

The following image shows the basic information of an original USB keyboard (including vendor ID and product ID) captured by the malicious device:

Figure 14 – Basic information

Just as it is possible to get the basic information of an original USB keyboard, our malicious device can also get absolutely all the configuration of the keyboard, including number of interfaces, types and descriptors of each interface, etc; and self-configure itself to do a complete impersonation:

Figure 15 – Advanced information

By getting all the information from the USB keyboard allowed with the Evil Crow Cable Pro USB Host, we can modify the firmware to automatically configure our malicious device and impersonate the allowed USB keyboard. Now let’s look at this attack in more professional/commercial tools.

6.- Bypass BadUSB restrictions (IV): professional/commercial software

Now we are going to use keyboard impersonation to bypass some professional/commercial tools.

• 1.- Kaspersky Endpoint Security

The first tool we are going to analyze is Kaspersky Endpoint Security antivirus. This antivirus contains a specific module called BadUSB Prevention that proposes to block BadUSB attacks by asking a pin code every time a USB device is connected to the computer, it should be noted that for the USB device to be allowed, the pin code must be entered with the USB keyboard that we want to use on the computer.

Figure 16 – BadUSB Prevention module

The first weakness of this protection is that the pin code is only requested once. As soon as the user authorises the USB device, the protection software does not ask for the pin code again even if the computer is completely rebooted.

Because of this, an attacker can bypass the protection if he knows the USB device allowed in the protection software or can perform a complete impersonation of the allowed device as we have seen in the previous section. After analyzing Kaspersky’s BadUSB Prevention module, we have identified that in order to allow or block a connected USB device it performs the following checks:

• Vendor ID/Product ID

• Serial number

• Number of interfaces (checks number, but does not check type)

Additionally, Kaspersky’s protection software identifies if the connected USB device has a serial port. Original keyboards will never have a serial port like Evil Crow Cable Pro or any arduino-based device can have. So, we have to keep in mind that to bypass this tool we have to disable the serial port of our malicious device.

Considering the 3 checks it performs, making use of the keyboard cloning and spoofing method we have seen in the previous section, an attacker can easily bypass this tool due to the fact that it only asks for the pin once. This way, by spoofing the original allowed keyboard, our malicious device will be able to execute payloads on the victim machine.

In case there is no USB device allowed, Evil Crow Cable Pro is a hardware keylogger. If we use a weaponized USB keyboard and the victim plugs it into his computer, we can execute the payload after the victim has entered the security pin with our weaponized keyboard.

• 2.- CoSoSys Endpoint Protector

The second software we are going to analyse is CoSoSys Endpoint Protector. This software is very similar to USBDeview, it allows you to whitelist/blacklist to block or allow USB devices.

Figure 17 – Endpoint Protector

Like Kaspersky Endpoint Security, CoSoSys Endpoint Protector checks the Vendor ID, Product ID and the number of interfaces, but adds an additional check. In addition to checking the number of interfaces a USB device has, it also checks the device’s interface types, which makes bypass a bit more elaborate.

To bypass this tool the procedure is the same as we have seen in the previous tool, if an attacker manages to 100% impersonate the original keyboard allowed he can easily bypass the tool.

• 3.- ManageEngine Device Control Plus

Finally, let’s look at Manage Engine’s Device Control Plus software.

Figure 18 – Device Control Plus

Unfortunately this software is the least secure of all the software we have looked at in this article. Device Control Plus only checks the Vendor ID and Product ID, it does not check the number of interfaces, type or other descriptors as we have seen above.

To bypass this tool the procedure is the same, by spoofing the allowed USB keyboard it is possible to run our payload on the victim’s machine.

7.- Conclusions

In this article we have seen how to bypass some BadUSB attack protections that can be found in open source software developed by security researchers and «professional/commercial» software.

In short, most protection software allows and/or blocks a USB device by checking the «malicious» device against the allowed USB device itself. As attackers, by successfully cloning and impersonating the allowed USB device we manage to bypass most of these tools, even without knowing which protection tool is installed on the victim’s computer.

To provide a more reliable solution, there are specific hardware devices that can protect our computers from these attacks, for example the AuthUSB SafeDoor device.

Figure 19 – AuthUSB SafeDoor

This type of device has its own operating system and different protection and antivirus tools that scan any type of USB device connected to the device, blocking any direct attack on your computer.

Happy Hacking 😀

Este artículo lo ha escrito uno de los miembros de nuestro grupo de Telegram

Autor: L1Cafe
Blog: https://www.l1cafe.blog/2024/03/24/set-up-your-own-telegram-proxy.html

Configura un proxy Telegram MTProto en una Raspberry Pi con Alpine Linux y Docker en unos pocos minutos y comunícate libremente.

Si quieres evadir las restricciones impuestas a Telegram en España usando MTProxy, puedes usar este mismo procedimiento que se describe a continuación, pero debes hacerlo en un servidor que no se encuentre en España. Es recomendable que uses un VPS en algún proveedor en Internet, Digital Ocean suele ser una buena opción.

Al lío.

Vas a necesitar:

• Una Raspberry Pi, yo estoy usando un modelo 3B+, pero puedes elegir la versión que sea adecuada para tu hardware
• Una tarjeta microSD de al menos 2GB
• Un lector de tarjetas microSD
• Teclado USB
• Cable HDMI para conectar tu RPi a tu monitor
• Una fuente de alimentación adecuada
• Cable ethernet para conectar tu RPi a tu router (utilizar WiFi no es recomendable)

Antes de empezar, algunas cosas a tener en cuenta:

• Si tu país bloquea Telegram, configurar un proxy MTProto utilizando tu conexión a Internet con una Raspberry Pi no va a permitirte acceder Telegram. Esta guía está pensada para ser seguida por personas viviendo en países donde Telegram no está restringido. Aunque es posible utilizar una Raspberry Pi a través de una conexión VPN, no voy a entrar en detalles sobre cómo hacerlo en esta guía.
• La Raspberry Pi no es un dispositivo potente, y es relativamente sencillo atacarla con un ataque de denegación de servicio. Especialmente si publicas tu IP y puerto en Internet. Es mejor sólo compartir los detalles del proxy con amigos y familiares cercanos.
• Estoy utilizando una Raspberry Pi 3 Model B+, pero las instrucciones son parecidas con otros dispositivos ARM como Banana Pi u Orange Pi, o nuevas versiones de Raspberry Pi. Para un pequeño proxy que utilicen 5 o 10 personas, no necesitas demasiados recursos. Cualquier dispositivo fabricado en los últimos 10 años con al menos 1 GB de RAM debería bastar, incluyendo ordenadores de oficina antiguos o portátiles con pantallas dañadas (puntos extra de reciclaje).
• Estas instrucciones son para Alpine Linux. Creo que es mucho más simple y rápido de instalar, y más eficiente utilizar Alpine Linux para este propósito. Con otras distribuciones como Ubuntu o Debian, la configuración de red y Docker es ligeramente diferente. Consulta el manual de tu distribución si decides utilizar otra.
• Necesitas saber cómo abrir puertos. Las instrucciones varían, pero generalmente puedes buscar algo como «abrir puertos en …».  En otros casos, las instrucciones varían según tu modelo de router. Además, esta guía asume que no tienes CGNAT, en cuyo caso abrir puertos podría ser más difícil o imposible, según tu proveedor de Internet.
• Además de abrir puertos, muchos proveedores de Internet utilizan asignación de IP dinámica, lo que puede producir que tu IP cambie cuando reinicias tu router o a lo largo de los días. El enlace generado más adelante en esta guía no va a funcionar si tu dirección IP cambia. Una forma de resolver esto es utilizar servicios de dynamic DNS o DNS dinámico. Esto creará un nombre de host que no cambia, y puedes apuntar a tu dirección IP aunque sea dinámica. Entonces, será tu responsabilidad actualizar la dirección IP cada vez que cambie, y necesitarás consultar la documentación de tu proveedor de DNS dinámico para configurarlo.

Preparación

Descarga la imagen de Alpine Linux para Raspberry Pi de https://www.alpinelinux.org/downloads/. Yo he seleccionado aarch64 en formato img.gz para mi Raspberry Pi 3B+.

Inserta una tarjeta microSD en tu lector de tarjetas microSD. El método más sencillo para grabar la imagen en la tarjeta es utilizar Raspberry Pi Imager: https://www.raspberrypi.com/software/. Hay versiones para macOS, Windows, y Ubuntu. En muchos sistemas operativos basados en Linux que soportan Flatpak, como Fedora, puedes encontrarlo en tu centro de software simplemente buscando «Raspberry».

1. Selecciona tu modelo, la imagen que has descargado (importante: esta aplicación no proporciona Alpine Linux para descargar directamente, pero puedes elegir tu archivo .img.gz de todas formas), y la tarjeta microSD donde quieres grabar la imagen.
2. Cuando pregunta si deseas personalizar la imagen, debes saltar este paso, porque Alpine Linux no se puede personalizar con esta herramienta.

Inserta la tarjeta microSD preparada en tu Raspberry Pi, y conéctala a tu monitor con un cable HDMI. Conecta también un teclado USB (no necesitas ratón), y por último, conecta la fuente de alimentación microUSB, o lo que corresponda en su lugar. Tu Raspberry Pi debería arrancar automáticamente en la pantalla de inicio de sesión de Alpine Linux.

Inicia sesión con root, no necesitas escribir una contraseña. Escribe setup-alpine para comenzar el proceso de instalación, y responde a las preguntas según aparecen. La distribución de teclado española se llama es, que es una de las primeras preguntas.

Para el nombre de host, puedes introducir lo que prefieras, no tiene por qué ser idéntico al nombre de dominio que le vas a dar para compartir tu proxy.

Para la configuración de red (se recomienda ethernet), tu router proveerá un servicio DHCP, pero es mala idea utilizarlo a largo plazo, porque si la dirección IP de tu LAN cambia, cosa que puede suceder cada pocas horas o días, el redireccionamiento de puertos dejaría de funcionar. Se recomienda configurar una IP estática fuera del rango DHCP, para evitar colisiones.

Una alternativa es que algunos routers ofrecen emparejamiento de dirección MAC y dirección IP. De esta manera, el servidor DHCP de tu router recordará tu MAC y siempre asignará la dirección IP que tú configures. En cuyo caso, deberías seleccionar DHCP en el instalador. En cualquier caso, anota tu dirección IP porque la vas a necesitar más adelante.

1. Para abrir una terminal sin cancelar el proceso de instalación, pulsa Ctrl + Alt + F2.
2. Ejecuta ip a show eth0 para obtener la dirección MAC de tu Raspberry Pi. Puedes utilizar esta MAC para asignarle la dirección IP que prefieras en los ajustes de tu router. Esto se suele llamar «IP estática» o «DHCP static IP».
3. Puedes volver al instalador pulsando Ctrl + Alt + F1.

Para la zona horaria yo he elegido Europe/Amsterdam.

El cliente NTP por defecto es suficiente, pulsa intro para aceptar esta elección por defecto.

Para los espejos (mirrors), puedes usar f para seleccionar el más rápido, cercano a ti.

No necesitas configurar un usuario. Aunque no se recomienda utilizar root para actividades rutinarias, esta Raspberry Pi va a funcionar exclusivamente como una máquina proxy que configurarás una vez y te puedes olvidar de ella.

Si quieres acceder a esta Raspberry Pi remotamente sin necesidad de cable HDMI o USB, configurar SSH es buena idea. De otro modo, desactivar SSH es una mejor elección por seguridad, especialmente considerando que esta máquina va a estar expuesta a Internet.

Si quieres activar SSH, lo más sencillo es establecer una contraseña larga y compleja que puedas recordar, pero es buena práctica utilizar claves SSH. No explicar cómo funcionan las claves SSH porque hay cientos de artículos que lo explican al máximo detalle, pero incluso en este caso, seguramente quieras establecer una contraseña al menos temporalmente, y luego puedes configurar acceso con claves SSH y prohibir contraseñas. Para ello, cuando el instalador pregunta si quieres habilitar acceso root, tienes que introducir yes. De lo contrario, prohibit-password sólo permitirá acceso si has configurado claves SSH.

Como la Raspberry Pi sólo tiene una tarjeta microSD y no tiene almacenamiento interno, tendrás que sobreescribir esta tarjeta microSD. No hay ningún problema. Te sugerirá probar el medio de arranque (boot media). De otro modo, si reinicias la RPi o pierdes electricidad durante unos segundos, todos tus ajustes se borrarán y RPi arrancará de nuevo con el instalador.

Tendrá un aspecto como /media/mmcblk0. Indica yes para utilizar esta tarjeta microSD, y luego escribe mmcblk0 cuando el instalador pregunta qué disco utilizar.

Con respecto a modos de instalación, sys es lo más sencillo. Para instalaciones cifradas o configuraciones más avanzadas, por favor consulta el manual de instalación de Alpine Linux.

Por último, configura tu proxy

Reinicia, e introduce root como usuario, y tu contraseña.

Instala las herramientas básicas:

apk add vim nano

Puedes elegir otro editor de texto. Únicamente vi está disponible por defecto, pero nano es el más recomendable para principiantes.

Para instalar Docker, necesitamos activar los repositorios community. Edita /etc/apk/repositories. A mí me gusta Vim. Simplemente mueve el cursor al carácter # en frente del repositorio community, y pulsa x para borrarlo. Para guardar, pulsa :wq.

Mi lista de repositorios tiene este aspecto tras los cambios:

/media/mmcblk0/apks
http://alpine.mirror.wearetriple.com/v3.19/main
http://alpine.mirror.wearetriple.com/v3.19/community

Instala Docker:

apk update && apk add docker

Configuramos el servicio Docker:

rc-update add docker && rc-service docker start

Generamos un secreto:

docker run --rm nineseconds/mtg:2 generate-secret tgproxy.0x7.io > config.toml

Puedes elegir otro nombre de dominio, hay más detalles en la documentación: https://github.com/9seconds/mtg. Has escrito un secreto a config.toml. Ahora, puedes editar este archivo para que tenga el siguiente aspecto:

secret = "Y0uRS3cr37"

bind-to = "0.0.0.0:7104"

El secreto ya está en el archivo. Simplemente rodéalo con " dobles comillas, y puedes elegir otro puerto si prefieres. Es recomendable configurar el mismo puerto para configuración, contenedor, host, y redireccionamiento en tu router por razones de simplicidad.

Finalmente, arranca tu contenedor Docker:

docker run -d -v $PWD/config.toml:/config.toml -p 7104:7104 --name mtg-proxy --restart=unless-stopped nineseconds/mtg:2

Nótese aquí el «unless-stopped». Esto indica a Docker que este contenedor debe iniciarse a menos que se detenga manualmente. Así que tu proxy debería arrancar automáticamente siempre y cuando hayas configurado el servicio de Docker para que arranque con el sistema.

Si todo ha ido bien, puedes conectar con tu proxy utilizando cualquier cliente de Telegram. Puedes mostrar la configuración con el siguiente comando:

docker exec mtg-proxy /mtg access /config.toml

Si estás conectado a través de SSH, ahora puedes copiar esta configuración y mantenerla segura para dársela a amigos y familiares. Finalmente, reenvía el puerto 7104 en la configuración de su router al puerto 7104 en su IP Raspberry Pi (consulte la parte superior del artículo sobre cómo configurar una IP estática o configurar DHCP).

Si deseas verificar que todo funciona correctamente, reinicia tu Raspberry Pi escribiendo reboot y, si agregaste tu proxy a Telegram, debería conectarse correctamente después de unos segundos.

Si has configurado un servicio DNS dinámico, puedes reemplazar su dirección IP desde los enlaces generados con tu nombre de host DNS dinámico.

Si necesitas un proxy para Telegram, tengo uno aquí. Puede que no dure para siempre, pero siempre que esté disponible, siéntete libre de utilizarlo. Simplemente haz click en ese enlace o agrégalo a Telegram con los siguientes detalles:

• Protocol: MTPROTO
• Hostname: tgproxy.0x7.io
• Port: 6122
• Secret: 7kc85dSVjrX5aMh2gKI4VKBnb29nbGUuY29t

Autor: L1Cafe