I2P Bootstrap | Automatically Generate I2P Routers

Category: darknets

A 2 Minute Read

26 Jan 2014

Image By Alex

Setting up high-bandwidth I2P routers through a command line can be tricky for new users. It's not an environment most people put themselves in very often. That's why I've written a guide on how to set up a I2P router. But for new users who don't want to tediously tinker in a command line, or for experienced users who just want to throw up a router quickly, I've created a script which does it for you. I was inspired by Micah's Tor Relay Bootstrap Script and decided to whip up my own for I2P. KillYourTV (killyourtv.i2p) helped a lot in editing and drastically improving my original script, so a major thank-you should go out to him. I'll also say that I could have just forked Micah's script, and probably should have as his Tor bootstrap is fantastic, but I wanted to learn some Bash so that's why I started from scratch.

This script was tested on a fresh Digital Ocean Debian Wheezy server and worked perfectly. If you plan on using this on an existing server, definitely read through the script and understand the changes that will be made, as it will adjust your SSH settings as well as your firewall rules, among other things. Lastly, don't blame me if this somehow borks your machine, as it's meant to go on a fresh Debian 7 server. You will also need to create a separate user with sudo privileges before running this script, or you'll be locked out of the machine (it disables root login).

To use it just SSH into your server, then either copy and paste the script into a new text file, or use wget to download it:

wget https://raw.githubusercontent.com/TheTinHat/i2pbootstrap/master/i2p_bootstrap.sh

Then execute it:

bash i2p_bootstrap.sh

You can also visit the project page on Github

#!/bin/sh



TMPFILE=$(mktemp)



# This isn't strictly necessary, but wth.

wait_until() {

local timeout check_expr delay timeout_at

timeout="${1}"

check_expr="${2}"

delay="${3:-1}"

timeout_at=$(expr $(date +%s) + ${timeout})

until eval "${check_expr}"; do

if [ "$(date +%s)" -ge "${timeout_at}" ]; then

return 1

fi

sleep ${delay}

done

return 0

}



#Check Root

if [ `id -u ` -ne 0 ]; then

echo "This script must be run as root" >&2

exit 1

fi



#Disclaimers

echo "Warning: Ensure that a separate user account has been created already.">&2

echo "This account CANNOT be called i2psvc. This script will disable logging in">&2

echo "as the root user via ssh. Without another user, you will be locked out">&2

echo "of this machine.">&2

echo>&2

echo "Ensure that either the root password or sudo have been configured">&2

echo "Any errors, downtime, or other generally negative outcome is your">&2

echo "own responsibility.">&2

echo>&2

echo "The following changes will be made:">&2

echo "--Add the I2P Repositories">&2

echo "--Update the system's packages">&2

echo "--Install I2P, Fail2ban, UFW, Lynx">&2

echo "--Change the SSH port to 2121">&2

echo "--Disable Root Login">&2

echo "--Configure I2P to automatically start at boot">&2

echo "--Start I2P">&2

echo "--Configure Firewall to Only Allow I2P and SSH">&2

echo "--Enable Fail2ban and SSH">&2

echo

echo -n "Are you sure you wish to continue? (y/n) "

read ans

case $ans in

y*|Y*|t*|T*)

# The user /probably/ wants to continue...

;;

*)

exit 0

;;

esac



#Edit Repos, Update System

cat > /etc/apt/sources.list.d/i2p.list << EOF

deb http://deb.i2p2.no/ stable main

#deb-src http://deb.i2p2.no/ stable main

EOF



# Add the I2P repo key if apt doesn't know about it yet

if ! apt-key fingerprint | fgrep -q "7840 E761 0F28 B904 7535 49D7 67EC E560 5BCF 1346" > /dev/null 2>&1; then

if wget --quiet https://geti2p.net/_static/i2p-debian-repo.key.asc -O $TMPFILE; then

apt-key add $TMPFILE

rm -f $TMPFILE

else

# Since fetching with wget failed, let's try getting it from a keyserver

apt-key adv --keyserver hkp://pool.sks-keyservers.net --recv-key 0x67ECE5605BCF1346

fi

fi



apt-get update

# preseed debconf to set I2P to start at boot

echo "i2p i2p/daemon boolean true" | debconf-set-selections



# The 'i2psvc' user is created by the 'i2p' package and is set

# to start I2P by default. You can set another user here but you

# must ensure that it exists, e.g.

#if ! getent passwd i2p; then

# adduser --system --quiet --group --home /home/i2p i2p > /dev/null 2>&1

#fi

echo "i2p i2p/user string i2psvc" | debconf-set-selections

apt-get --yes upgrade

apt-get --yes install fail2ban ufw i2p i2p-keyring lynx





#Configure SSH

if [ -e /etc/ssh/sshd_config.backup ]; then

echo "SSH already configured during a previous run."

else

sed -i.backup -e 's/^\(Port\).*/\1 2121/;s/^\(PermitRootLogin\).*/\1 no/' /etc/ssh/sshd_config

fi



# If we end up here, I2P should be installed, running, and configured to start at boot.

# ..but let's make sure.

if service i2p status > /dev/null 2>&1; then :; else

# Since we're here, I2P was not running. We'll make sure the initscript is enabled,

# then start I2P

sed -i.bak -e 's/^.*\(RUN_DAEMON\).*/\1="true"/' /etc/default/i2p

service i2p start

fi



# Get the configured user from the debconf db

I2PUSER=$(debconf-show i2p |sed -e '/i2p\/user/!d' -e 's/.*:\s\+//')



if [ $I2PUSER != 'i2psvc' ]; then

I2PHOME=$(getent passwd $I2PUSER | awk -F: '{print $6}')

else

I2PHOME="/var/lib/i2p/i2p-config"

fi



#Check to ensure config file has generated before setting firewall rules

# Wait up to 10 seconds for router.config to be created.

wait_until 10 "test -e /var/lib/i2p/i2p-config/router.config"

i2pport=$(awk -F= '/i2np\.udp\.port/{print $2}' $I2PHOME/router.config)



if [ x$i2pport = 'x' ]; then

echo "Error determining I2P's UDP port" >&2

exit 1

else

echo "The I2P port is $i2pport"

fi



#Set firewall rules to allow SSH and I2P

ufw default deny

ufw allow 2121

ufw allow $i2pport



#Reload Fail2ban and SSH

cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

/etc/init.d/fail2ban restart

/etc/init.d/ssh reload



#Enable Firewall

echo 'Done! The firewall is about to be activated. The next time that you' >&2

echo 'connect via ssh, you will need to use port 2121 on a non-root user.' >&2

sleep 5

ufw enable

echo



#Open Lynx For Bandwidth Configuration

echo "Lynx will open so that I2P's bandwidth settings can be configured." >&2

echo '(385KBps will be about 1TB per month)' >&2

echo -n "Press y when ready: "

read ans

case $ans in

y*|Y*|t*|T*)

lynx -accept_all_cookies http://127.0.0.1:7657/config

;;

*)

exit 0

;;

esac



