Sunday, July 26, 2015

Home Monitoring with a Raspberry Pi 2 Model B and ZoneMinder

Overview

I had been thinking about setting up a camera system in my place for a while. My plan was to set up two cameras with motion detection; one to monitor the patio for deliveries and another to monitor the living room in case there was a break in. This plan stayed in the back burner for a long time until my colleague's house got burglarized just a couple of weeks ago. He was in a different state at the time; however, as soon as he received an alarm, the police department was called and one of the intruders got caught right after he left the house. Suddenly, I had a good reason to implement my own system.

My design requirements could be described as simplicity. I just needed two cameras with wireless connectivity to minimize cable clutter. The first camera would be monitoring my living room and needed to be PTZ capable. My idea was to disable monitoring while I was at home and I needed a camera with this capability to provide a visual indication. During the initial setup, I also found an old Logitech webcam which I had completely forgotten about. I decided use that for monitoring my office. In addition, the last thing I wanted was to expose my cameras to the internet so I was also looking for a central control system. At the end, my configuration boiled down to a Raspberry Pi 2 Model B running ZoneMinder controlling a Foscam FI8918W and a Logitech webcam. I still haven't decided on the camera to monitor my patio.

Initial Setup

  • Copy the Raspbian image to your micro SD card. Instructions are at: https://www.raspberrypi.org/documentation/installation/installing-images/README.md
  • Type root and hit enter after powering on your Pi
  • Get the MAC address for your Pi
  • Configure DHCP service on router to assign a static address to your Pi
  • Change hostname by editing /etc/hostname
  • Fix keyboard setup in /etc/default/keyboard
  • Fix timezone
    • rm /etc/localtime
    • ln -s /usr/share/zoneinfo/US/Pacific /etc/localtime
  • Update /etc/profile
    • export TZ=America/Los_Angeles
  • Reboot

Securing the Pi

  • Create a local user
    • groupadd buraks78
    • useradd -g buraks78 -m buraks78
    • passwd buraks78
  • Create an .ssh folder for this user and copy your public key in authorized_keys.
    • su - buraks78
    • mkdir /home/buraks78/.ssh
    • chown buraks78:buraks78 /home/buraks78/.ssh
    • chmod 0700 /home/buraks78/.ssh
    • cat /tmp/id_rsa.pub > /home/buraks78/.ssh/authorized_keys
    • rm /tmp/id_rsa.pub
    • chown buraks78:buraks78 /home/buraks78/.ssh/authorized_keys
  • Add user to sudoers using visudo
    • buraks78 ALL=(ALL) ALL
  • Update sshd configuration in /etc/ssh/sshd_config and restart sshd
    • Protocol 2
    • LoginGraceTime 30
    • PermitRootLogin no
    • PermitEmptyPasswords no
    • PasswordAuthentication no
    • X11Forwarding no
  • Setup iptables (DON'T LOCK YOURSELF OUT!) (This will break aptitude obviously)
    • aptitude install iptables
    • /tmp/iptables.txt
      *filter
      :INPUT DROP [45:2307]
      :FORWARD ACCEPT [0:0]
      :OUTPUT ACCEPT [1571:4260654]
      -A INPUT -p tcp -i lo -j ACCEPT
      -A INPUT -p tcp --dport 22 -j ACCEPT
      -A INPUT -p tcp --dport 80 -j ACCEPT
      -A INPUT -m state --state ESTABLISHED,RELATED -j ACCEPT
      -P INPUT DROP
      -A OUTPUT -o lo -j ACCEPT
      -A OUTPUT -o eth0 --destination X.X.X.X/24 -j ACCEPT
      -A OUTPUT -o eth0 -p tcp --dport 587 -j ACCEPT
      -P OUTPUT DROP
      COMMIT
    • iptables-save > /tmp/iptables.txt
    • iptables-restore < /tmp/iptables.txt
    • iptables-apply
  • Change zm password for MySQL
    • myqsl -u root -p
      • GRANT USAGE ON *.* TO 'zmuser'@'localhost' IDENTIFIED BY 'XXX';
      • FLUSH PRIVILEGES;
    • vi /etc/zm/zm.conf
      • Update ZM_DB_PASS to XXX
    • Restart ZoneMinder
  • Secure Apache installation
    • Implement directory restrictions.
    • TODO: Server SSL setup
    • TODO: Client SSL setup

Component Setup

  • Install ZoneMinder
    • Instructions are here: https://github.com/ZoneMinder/ZoneMinder
    • Well, the version in the Raspian repo is old. Simply check out the master branch and build (I tried to build v1.28.1 and release-1.28.2 and both of them failed)
  • Enable zm.conf for Apache
    • Add the following line to Apache configuration: SetEnv TZ America/Los_Angeles
    • Ensure /etc/profile is updated as described previously
    • Update /usr/bin/zmpkg.pl to add: $ENV{TZ} = America/Los_Angeles;
      • Otherwise filters do not email/message properly
  • Setup Foscam
    • Static dhcp reservation on the router
    • Shut down all unnecessary features like motion detection and alarms
  • Introduce Foscam to ZoneMinder
  • Introduce Logitech webcam to ZoneMinder
    • Add www-data user to video group to video group: usermod -G video www-data
    • Restart ZoneMinder
  • Configure ssmtp for sending emails 
  • Configure ZoneMinder
    • Enable OPT_USE_AUTH and update AUTH_HASH_SECRET
    • Enable OPT_CONTROL
    • Set EVENT_CLOSE_MODE to alarm
    • Enable LOG_DEBUG during setup

Performance Optimization


Automation

  • Implemented a simple cronjob to disable alarms when I am at home and enable them after I leave by pinging my phone IP. The last preset for the Foscam is directed at the ceiling to provide a visual clue that no monitoring is taking place.
#!/bin/bash USER=admin PASS=XXX ping -l 5 -c 5 -q  X.X.X.X &> /dev/null if [ "$?" -eq 0 ] then   # Foscam   zmu -m 1 --noalarm --username $USER --password $PASS   zmcontrol.pl --id 1 --command=presetGoto --preset 8   # Logitech   zmu -m 2 --noalarm --username $USER --password $PASS   logger -t zonemaster "ZoneMinder is now DISARMED" else   # Foscam   zmcontrol.pl --id 1 --command=presetGoto --preset 2   sleep 10   zmu -m 1 --noalarm --username $USER --password $PASS   zmu -m 1 --cancel --username $USER --password $PASS   # Logitech   zmu -m 2 --noalarm --username $USER --password $PASS   zmu -m 2 --cancel --username $USER --password $PASS   logger -t zonemaster "ZoneMinder is now ARMED" fi

Conclusion

  • First of all, stick to the defaults. I can not stand Debian... So, I installed CentOS on the Pi but quickly realized how deep the rabbit hole went after seeing how many packages I had to build to get ZoneMinder working. Just put down the CentOS image and step back slowly. It is not worth it.
  • These cameras all suck... The ones that don't are extremely expensive so better get used to the crap.
  • While researching for this project, I thought about using power line adapters instead of wireless. That idea was thrown to the retarded bin when I realized I needed an additional PoE injector. There is not even one power line adapter with built-in PoE injection capability. At least, I could not find one on Amazon.
  • Central control unit... I even thought about getting an ITX motherboard for processing power. A single Raspberry Pi 2 Model B is not going to cut it if you have a lot of cameras. Horizontal scaling would be nice. I am still reading/learning about Raspberry Pi clustering.
  • About micro SD lifespan. Shut down your Raspberry, remove the card, and make a copy of it using dd. You will need it.






5 comments:

  1. I've been thinking of using some Pi A+ boards with camera modules as cameras for a Pi 3 central unit. Do you think the Pi 3 running Zoneminder could handle 4 or 5 of these?

    ReplyDelete
    Replies
    1. Depending on the configuration, you may be able to. If you keep resolution low that would help. Function mode (modetect vs record) would play a significant role as well.

      With two cameras, 320x240 resolution, and 8bit grayscale, I am seeing around 10% cpu utilization under normal operating conditions. In alarm state, utilization spikes obviously (around 50% - 60%).

      Here is what I am seeing in terms of memory usage:

      total used free shared buffers cached
      Mem: 948016 928668 19348 71948 146484 437820
      -/+ buffers/cache: 344364 603652
      Swap: 102396 28 102368
      obviously
      There seems to be ample memory considering the disk cache.

      Storage is slow and MySQL performance is horrible however. This could pose a problem with a lot of data and logs coming in.

      Good luck.

      Delete
  2. Hey,
    I made some effort on speeding up motion detection on ARM processors by utilizing Neon. Already ready for AArch32, still in progress for AArch64:
    https://github.com/ZoneMinder/ZoneMinder/pull/1823#issuecomment-294340284
    The Raspberry Pi 2 and 3 have Neon.

    ReplyDelete
  3. These are fireplace screens that are simple and classic in design. These are usually clean to look at and can work with any interior theme decoration. indoor tabletop fireplaces

    ReplyDelete
  4. Not all homes are safe as they lack all the essential security devices that make a home secure. Also, the crime rate is on rise and many people worry about their family members, kids, and pets when they are out of the home.amcrest review

    ReplyDelete