port 1194
proto udp
dev tun

dh dh1024.pem
server 10.8.0.0 255.255.255.0
ifconfig-pool-persist ipp.txt
comp-lzo

ca /etc/ssl/certs/cacert.crt
cert /etc/ssl/certs/my.crt
key /etc/ssl/private/my.key

plugin /usr/lib/openvpn/openvpn-auth-pam.so common-auth
client-cert-not-required

The root.crt file contains the CAcert.org root certificate. The server certificate that has to be signed through CAcert.org is stored in my.crt and the private portion in my.key. The last two lines enable password authentication for clien

The client configuration is straight forward:

client
dev tun
proto udp
comp-lzo

remote [server hostname] 1194
resolv-retry infinite
ca /etc/ssl/certs/cacert.crt

auth-user-pass
tls-remote "/CN=[certificate common name]..."
tls-exit

During the first attempts to connect I repeatedly ran into error messages about failed certificate authentication on the client:

VERIFY ERROR: depth=1, error=unable to get issuer certificate: /O=CAcert_Inc./OU=http://www.CAcert.org/CN=CAcert_Class_3_Root
TLS_ERROR: BIO read tls_read_plaintext error: error:14090086:SSL routines:SSL3_GET_SERVER_CERTIFICATE:certificate verify failed

It turned out that the CAcert class 3 certificate is signed with the CAcert class 1 certificate and both need to be stored in root.crt:

cat root.crt class3.crt > /etc/ssl/certs/cacert.crt

By default clients will only see the VPN server. In order to have them also see the rest of the network IP forwarding needs to be enabled on the server a NAT rule needs to be added:

iptables -t nat -I POSTROUTING -s 10.8.0.0/24 -j SNAT --to [IP]

Supported Hardware Components

• CPU: Intel LV7500 Core2 Duo, 1.6 Ghz.
• Chipset: Intel Corporation 82801H (ICH8 Family)
• Graphics: Intel Corporation Mobile Integrated Graphics Controller (rev 0c)
• Harddrive: SATA 160 GB (see notes below)
• Sound: Intel HDA, AD1984 codec (see notes below)
• Network: Intel Corporation 1000 MBit
• Bluetooth: Broadcom Corp BCM2045B
  
• WLan: Intel 4965 a/b/g/n (see notes below)
• SD-Card/MMC reader
• Thinkpad Hotkeys (see notes below)

Untested

• Firewire

Installing Debian GNU/Linux

Resizing the Windows Vista partition without a DVD drive

In order to install Linux without deleting the pre-installed Vista I resized the Vista partition. If booting from an external CD/DVD drive is not an option it is also possible to create a bootable USB stick to resize the pre-installed Windows Vista partition. I used install-mbr from the mbr package (using ms-sys did not work for me) to create a bootable SystemResuceCd distribution on a spare USB stick. It ships with gparted which is capable of resizing NTFS partitions.

The first partition contains the rescue system and should be left untouched whereas the second partition is the Windows Vista partition which can be shrunken. It contained about 20 GB of data with the default factory setup. Please note that resizing the partition will break the Vista boot. See below how to fix it.

Fixing the Windows Vista boot record

After the Vista partition is resized Vista will no longer boot. This can either be fixed with by using system repair from a Vista install CD or by using this workaround:

1. Boot into the rescue system by pressing the ThinkVantage button on startup
2. Select Open Web Browser
3. Type X:\Windows\System32\cmd.exe as the URL
4. Select Open to get a console
5. Type bootrec /rebuildbcd

I also tried 'bootsect /fixboot' and 'bootrec /fixmbr' without success but these commands might be required as well. There is also bcdedit to modify the Vista boot sequence.

GRUB

I installed grub as the boot loader in the master boot record (MBR) to either boot Linux or Vista.

Configuration

Sound

If you are using Linux 2.6.22 or earlier (or Alsa 1.0.14) the sound card is not supported properly, see this bug report for more information. Using the python script attached to the bug report with the Alsa kernel driver worked for me.

A better solution is to upgrade to Linux 2.6.23 that includes the hda-intel Alsa driver which works without requiring any tweaks.

WLan

After installing the kernel the mac80211 and iwlwifi driver needs to be installed.  I have tested the wireless card in b and g mode using using an access point and WPA2. As of version 1.1.21 the wireless led does not work.

Hotkeys

Compared to other Thinkpad models the X61s handles more function keys in software. I installed powersaved and modified /usr/lib/powersave/scripts/thinkpad_acpi_events to handle the backlight keys (Fn+Home and Fn+End). See this page for more details. The page also has instructions on how get the volume keys to work by using a modified X11 Xmodmap and KDE input actions.

Bluetooth

The UHCI driver that is part of the standard kernel works. The card can be enabled/disabled using these commands when the acpi-thinkpad module is loaded (see Hotkeys section):

echo enabled/disabled > /proc/acpi/ibm/bluetooth

Suspend

Powersaved refused to enable Suspend-to-RAM and Suspend-to-Disk forcing these changes to /etc/powersafe/sleep:

DISABLE_USER_SUSPEND2RAM="no"
SUSPEND2RAM_FORCE="yes"
DISABLE_USER_STANDBY="no"

java.io.ByteArrayOutputStream out = new java.io.ByteArrayOutputStream(); this.printStackTrace(new java.io.PrintStream(out));
return new String(out.toByteArray());

After changing the kernel configuration connections to the STUN server and calls failed intermittently. Removing the ip_nat_sip kernel module resolved the problems.

Settings

1. The sipgate.de phone number is used for the user and authentication name:
   
   
   
   
   
2. The SIP server is sipgate.de:
   
   
   
   
3. RFC 2833 DTMF signaling seems to be unsupported by sipgate.de but Out-of-band mode works:
   
   
   
   

4. Connecting to the internet through a NAT router requires stun.sipgate.de:10000 as a STUN server:
   
   
   
   

Incoming calls

Unfortunately Twinkle rejected all incoming calls with 404 Not found since it could not match the user ids transmitted in invite messages. Sipgate.de strangely appends sipgate.net instead of sipgate.de as the domain prefix: 'INVITE sip:1234567@sipgate.net SIP/2.0'. In case of using a proxy the user id is composed of the id, domain and proxy ip: 'INVITE sip:1234567_sipgate_de@217.10.79.9:5060 SIP/2.0'. Twinkle expects '1234567@sipgate.de' and rejects the call.

Here is a patch that works around this by modifying t_phone_user::match() to accept any incoming call (a similar patch is available at Twinkle's homepage):

--- twinkle-1.0~beta/src/phone_user.cpp 2006-12-28 11:28:26.000000000 -0500
+++ twinkle-1.0~beta-patched/src/phone_user.cpp 2007-01-14 16:54:10.000000000 -0500
@@ -1010,7 +1010,8 @@
return true;
}
- return false;
+ //return false;
+ return true;
}
bool t_phone_user::match(StunMessage *r, t_tuid tuid) const {

The solution I came up with basically runs a second Linux distribution in a chroot environment on top of the one installed on the box. I chose OpenWrt for its Debian like ease of use, the numerous packages that are available and for its sparing use of system ressources. The distribution fits easily on a 32 MB USB stick and is straight forward to install.

Please be aware that you may void your warranty modifying the Fritz!Box. Use these instruction at your own risk!

Getting OpenWrt

On the first attempt I downloaded the OpenWrt image builder and ran make. This will create a file build_mipsel/linux-2.4-ar7/root.tar.gz which contains a complete OpenWrt base system that can be used as a chroot environment.

On the second attempt I got brave and used buildroot-ng from the OpenWrt svn to build the image. The advantage lies in the possibility to customize the image. Busybox which is used by OpenWrt and combines most unix system utilities in a single binary needs to be configured during compile time. Particularly the list of tools contained in the busybox binary has to be chosen then. The OpenWrt busybox binary is fairly complete (as is the one running on the Fritz!Box) but it lacks a few utilities such as adduser and swapon that I wanted to have.

Building the root image from source takes only a few steps provided that your work station has the necessary build tools installed (see openwrt.org for documentation):

svn co https://svn.openwrt.org/openwrt/branches/buildroot-ng/openwrt
cd openwrt
make menuconfig
  * Target Images -> tgz
  * Base system -> busybox -> Configuration
make

The generated image is located in bin/openwrt-rootfs.tgz.

Starting the chroot environment

The Fritz!Box kernel does not have support for ext2 which is needed to mount the partition that will contains the OpenWrt chroot environment. Since the kernel is able to load modules that can be fixed but a FAT16 partition is needed to do that boot strap. This partition is automatically mounted by the box when the usb stick is attached and contains:

• ext2 module (ext2.o)
• chroot executable (chroot)
• start and stop scripts (start-chroot.sh, stop-chroot.sh)

The startup script loads the module and mounts the required file systems:

#!/bin/sh -e

SELF=/var/media/ftp/MassStorageDevice-Partition-0-1
ROOT=/var/chroot

mkdir $ROOT

insmod $SELF/ext2.o || true

mount /dev/scsi/host0/bus0/target0/lun0/part6 $ROOT
mount -t devfs none $ROOT/dev
mount -t proc none $ROOT/proc
mount -t usbdevfs none $ROOT/proc/bus/usb

$SELF/chroot $ROOT /bin/sh /etc/init.d/chroot start

The chroot executable and ext2 module can be obtained here:

wget www.spblinux.de/fbox/ext2.o
wget www.spblinux.de/fbox/chroot

Putting it all together

I created 3 partitions on the USB stick. The FAT16 partition for boot strapping, a swap partition and the ext2 root partition that contains the OpenWrt system:

# fdisk -l /dev/sda

Disk /dev/sda: 32 MB, 32112640 bytes
2 heads, 32 sectors/track, 980 cylinders
Units = cylinders of 64 * 512 = 32768 bytes

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1               1          31         976    6  FAT16
/dev/sda2              32         980       30368    5  Extended
/dev/sda5              32         519       15600   82  Linux swap / Solaris
/dev/sda6             520         980       14736   83  Linux

The scripts used in these instructions expect exactly that disk layout.

Extract scripts.tar.gz to /dev/sda1 and root.tar.gz to /dev/sda6.

The root image has a few modifications compared to the one from the OpenWrt ImageBuilder:

• Busybox commands (run busybox for full list): adduser, addgroup, hostname, swapon, swapoff…
• Pre-installed packages (run ipkg list_installed for full list): strace, tcpdump, samba, bind-host…
• These files have been edited:
  • /etc/init.d/chroot: commands run on startup
  • /etc/hosts: fritz has been added
  • /etc/ipkg.conf: downloads.openwrt.org/people/nbd/ar7/packages has been added as a source
  • /etc/passwd: an empty password has been set for root
  • /etc/resolv.conf: 127.0.0.1 has been set as nameserver
  • /etc/samba/smb.conf: samba configuration with user security

Starting the chroot environment

With the latest firmware AVM offers a convenient way to access the Fritz!Box. Just dial #96*7* from a phone directly connected to the box to start a telnet daemon (the daemon can be deactivated by dialing #96*8*).

Connect the USB stick to your Fritz!Box and telnet the box. The first partition on the stick should have been mounted to /var/media/ftp/MassStorageDevice-Partition-0-1. You can check that by running mount.

Start the chroot environment with this command:

/var/media/ftp/MassStorageDevice-Partition-0-1/start-chroot.sh

Use ps ax to check if dropbear, the ssh daemon, is running. Now have fun logging into your Fritz!Box using ssh!

$ ssh root@192.168.11.254
root@192.168.11.254's password:
sh: /usr/X11R6/bin/xauth: not found


BusyBox v1.2.1 (2006.08.27-01:41+0000) Built-in shell (ash)
Enter 'help' for a list of built-in commands.

  _______                     ________        __
 |       |.-----.-----.-----.|  |  |  |.----.|  |_
 |   -   ||  _  |  -__|     ||  |  |  ||   _||   _|
 |_______||   __|_____|__|__||________||__|  |____|
          |__| W I R E L E S S   F R E E D O M
 KAMIKAZE (bleeding edge, r4681) -------------------
  * 10 oz Vodka       Shake well with ice and strain
  * 10 oz Triple sec  mixture into 10 shot glasses.
  * 10 oz lime juice  Salute!
 ---------------------------------------------------
root@fritz:~#

The root password is empty by default. Make sure you change it using passwd.

In order to initialize the chroot environment when the Fritz!Box is restarted I modified the /var/flash/debug.cfg file which is run by /etc/init.d/rc.S (never use vi to edit files in /var/flash, always use nvi, cp, echo…):

echo "[ -f /var/media/ftp/MassStorageDevice-Partition-0-1/start-chroot.sh ] && . /var/media/ftp/MassStorageDevice-Partition-0-1/start-chroot.sh" > /var/flash/debug.cfg

More fun

• Run ipkg list for a list of available OpenWrt packages
• Run Samba to share files in your local network
• Run OpenVPN for remote access to your local network
• Edit /etc/init.d/chroot to modify the commands that are run on startup

See this post for Photoshow in action.

• The milestone page now show time tracking progress bars for "Ticket status by x"
• The commit hook can now handle different spent/remaining values for multiple tickets
• Tooltips have been added to the time tracking progress bars

Here is a screenshot of the configuration dialog: