{"id":493,"date":"2016-05-24T00:13:35","date_gmt":"2016-05-23T16:13:35","guid":{"rendered":"https:\/\/www.techcoil.com\/blog\/?p=493"},"modified":"2018-09-03T21:04:47","modified_gmt":"2018-09-03T13:04:47","slug":"how-i-built-my-home-raspberry-pi-3-cctv-using-a-motion-eye-os-image-from-home-surveillance","status":"publish","type":"post","link":"https:\/\/www.techcoil.com\/blog\/how-i-built-my-home-raspberry-pi-3-cctv-using-a-motion-eye-os-image-from-home-surveillance\/","title":{"rendered":"How I built my Raspberry Pi 3 CCTV using a motionEyeOS image for home surveillance"},"content":{"rendered":"

When I bought my Raspberry Pi 2, I also bought the first version of the Raspberry Camera Module<\/a> just for the fun of it. After setting up my Raspberry Pi 2 as a TV box for my wife<\/a>, that camera module became an ornament. Feeling bad about such wastage, I bought another Raspberry Pi 3<\/a> to utilise the camera module in performing home surveillance.<\/p>\n

This post documents the steps that I took to build my Raspberry Pi 3 CCTV via a MotionEyeOS image for home surveillance.<\/p>\n

Getting the hardware for my Raspberry Pi 3 CCTV<\/h2>\n

I used the following hardware to realise my Raspberry Pi 3 CCTV:<\/p>\n

    \n
  1. A Raspberry Pi 3 motherboard<\/a><\/li>\n
  2. A Raspberry Pi Camera Module<\/a><\/li>\n
  3. A Raspberry Pi Model B+ Case Enclosure (Clear)<\/a><\/li>\n
  4. A SanDisk Ultra 64 GB microSDXC Micro SD<\/a><\/li>\n<\/ol>\n

    Getting the MotionEyeOS image for my Raspberry Pi 3<\/h2>\n

    After I got the hardware, I went on to download the MotionEyeOS image for my Raspberry Pi 3. Calin Crisan<\/a> had created a page for us to download different releases of MotionEyeOS<\/a> for different Single Board Computers<\/a>. I chose motioneyeos-raspberrypi3-20160410.img.gz<\/a> and saved it onto the file system of my Windows machine.<\/p>\n

    I then used 7-zip<\/a> to extract the .img file from motioneyeos-raspberrypi3-20160410.img.gz<\/code>. Once the .img file was extracted, I used Win32 Disk Imager to write the .img file<\/a> into the SanDisk microSD card<\/a> via the SD card drive on my laptop<\/p>\n

    Booting into my MotionEyeOS on my Raspberry Pi 3 CCTV<\/h2>\n

    After my Win32 Disk Imager completed writing the MotionEyeOS onto my microSD card, I inserted the microSD card into the microSD card slot on my Raspberry Pi 3 board.<\/p>\n

    I then proceeded to connect my Raspberry Pi Camera module to the Raspberry Pi 3 board<\/a> and put them inside the case enclosure<\/a>.<\/p>\n

    To have a glimpse of what will happen the first time my Raspberry Pi 3 CCTV boots up, I connected my Samsung monitor and my Logitech keyboard<\/a> to it.<\/p>\n

    I also connected my Raspberry Pi 3 with my network cable so that I could configure it via a web browser.<\/p>\n

    Lastly, I connected my Raspberry Pi 3 CCTV to my Belkin micro USB cable<\/a> which was in turned connected to my USB wall plug charger.<\/p>\n

    Key activities that MotionEyeOS did when it boots up for the first time<\/h3>\n

    When my MotionEyeOS image booted up for the first time, it performed the following:<\/p>\n

      \n
    1. Expanded the data partition to take the entire microSD card space<\/li>\n
    2. Configured a default hostname<\/li>\n
    3. Created a default password for the root user, which was empty<\/li>\n
    4. Configured the network settings of the ethernet port of my Raspberry Pi 3 to request an IP address via DHCP<\/li>\n<\/ol>\n

      Among the initial configurations, my MotionEyeOS also started syslogd, the watchdog, brownout detector, eudev, http date updater, crond, sshd, proftpd. smbd, nmbd and motioneye.<\/p>\n

      The IP address that was allocated to my MotionEyeOS was also shown before the login prompt.<\/p>\n

      Accessing my camera video stream with my browser from within my home network<\/h2>\n

      After my Raspberry Pi 3 CCTV had booted up successfully, I opened a browser from a computer that is connected to my home network and entered the IP address of the Raspberry Pi 3 CCTV in the location bar. With that, I was shown a window that showed a video stream from the camera on my Raspberry Pi 3 CCTV:<\/p>\n

      \"First<\/p>\n

      Ensuring that my Raspberry Pi 3 CCTV can only be accessed through my user account<\/h2>\n

      It felt insecure to have my Raspberry Pi 3 CCTV showing the video stream from its camera without any login prompt. As such, I proceeded to set some passwords to guard accesses to my Raspberry Pi 3.<\/p>\n

      To apply access control to my Rasberry Pi 3 CCTV, I would need to login as the admin user.<\/p>\n

      To login as the admin user, I clicked on the second button at the top left corner. I was then shown the login screen:<\/p>\n

      \"Login<\/p>\n

      At the login prompt, I entered admin<\/strong> as the username, left the password field blank and clicked on Login<\/strong>.<\/p>\n

      After that, the browser would show the video stream from my camera again.<\/p>\n

      I then clicked on the first button on the top left corner to get the following screen:<\/p>\n

      \"General<\/p>\n

      Setting a password for the admin user<\/h3>\n

      In MotionEyeOS, the admin user is given the rights to configure MotionEyeOS.<\/p>\n

      The username of the admin user cannot be changed.<\/p>\n

      To set a password for the admin user, I entered a password in the Admin Username<\/strong> text field.<\/p>\n

      Creating the surveillance user<\/h3>\n

      The surveillance user is only granted view access to the video stream from my Raspberry Pi 3 camera. Configuring a username and password for the surveillance user would ensure that the video stream from my Raspberry Pi 3 CCTV camera only displays after either the surveillance user or admin user logs in successfully.<\/p>\n

      To create a surveillance user, I entered a username in the Surveillance Username<\/strong> text field and a password in the Surveillance Password<\/strong> text field.<\/p>\n

      Applying password changes made to the admin user and the surveillance user<\/h3>\n

      After I had keyed in the details for the admin and Surveillance users, I clicked on the Apply<\/strong> button on the top to persist the changes. With that, the following prompt appeared to get me to reboot my Raspberry Pi 3 CCTV:<\/p>\n

      \"MotionEyeOS<\/p>\n

      I clicked Yes<\/strong> to make MotionEyeOS reboot itself.<\/p>\n

      After my Raspberry Pi 3 CCTV started up again, I was shown the login prompt.<\/p>\n

      I keyed in my admin user credentials to continue on with the rest of the configurations.<\/p>\n

      Changing the default timezone<\/h2>\n

      Since I do not reside in a region that is part of the UTC timezone, the timestamp reflected on my video stream was incorrect. An inaccurate time display would create inconvenience when I wanted to verify whether the deliveryman from the postal service had really attempted to come to my house at the time that they claimed in their failed delivery sms message.<\/p>\n

      To change the default timezone to the one that my region followed, I clicked on the first button on the top left corner to open up the settings drawer. Inside the settings drawer, I located the General Settings<\/strong> section and clicked on the toggle button next to Advanced Settings<\/strong>. After doing so, I was able to change the Time Zone on my Raspberry Pi 3 CCTV:<\/p>\n

      \"MotionEyeOS<\/p>\n

      To configure the Time Zone on my Raspberry Pi CCTV, I selected Asia\/Singapore<\/strong> from the Time Zone<\/strong> dropbox and clicked the Apply<\/strong> button at the top of the screen to commit the changes. I clicked Yes<\/strong> when MotionEyeOS asked to reboot itself.<\/p>\n

      After my Raspberry Pi 3 CCTV started up again, I keyed in my admin user credentials to continue on with the other configurations.<\/p>\n

      Configuring wireless connection to my home network<\/h2>\n

      Since Raspberry Pi 3 comes with wifi capability, configuring my CCTV to connect to my home network connection wirelessly would eliminate the need for another cable for network communications.<\/p>\n

      To configure wireless access, I first clicked on the first button at the top left corner to bring out the configurations drawer.<\/p>\n

      After that, I clicked on the Network<\/strong> tab to expand the network settings section:<\/p>\n

      \"MotionEyeOS<\/p>\n

      I then clicked on the toggle button for Wireless Network<\/strong> to turn on wireless network connections. This would make the Wireless Network Name<\/strong> and Wireless Network Key<\/strong> text fields appear for me to key in my home wireless network details.<\/p>\n

      Once I was done with my Wireless Network configurations, I clicked the Apply<\/strong> button and rebooted my Raspberry Pi 3 CCTV.<\/p>\n

      When my Raspberry Pi 3 CCTV started up, I keyed in my admin user credentials to continue on with the other configurations.<\/p>\n

      To get the IP address that my Raspberry Pi 3 had gotten for its wifi interface, I connected my monitor to it and looked for the status output that looked like the following:<\/p>\n

      \r\nInterface wlan0 has IP address 192.168.0.107\/24\r\n<\/pre>\n
      In this case, I would enter 192.168.0.107<\/strong> in the location bar of my browser from a computer that is connected to my home network so as to connect to my Raspberry Pi 3 CCTV via its wifi interface.<\/p>\n
      Turning off the camera LED indicator<\/h2>\n
      Seeing the video stream would be sufficient for me to determine that the camera is working. As such, I went on to turn off the camera LED indicator so that I can reduce the power consumption of my Raspberry Pi 3 CCTV.<\/p>\n
      To do so, I first clicked on the first button on the top left of the screen to bring out the configurations drawer.<\/p>\n
      I then looked for the Expert Settings<\/strong> tab and clicked on it to expand the expert settings section:<\/p>\n
      \"MotionEyeOS<\/p>\n
      To turn off the LED indicator of the camera, I clicked on the toggle button for Enable CSI Camera Led<\/strong> to switch it off.<\/p>\n
      I then click on the Apply<\/strong> button at the top and rebooted my Raspberry Pi 3 CCTV.<\/p>\n
      After my Raspberry Pi 3 CCTV booted up again, I keyed in the admin user credentials to continue with the other configurations.<\/p>\n
      Limiting the preservation of still images and movies<\/h2>\n
      By default, MotionEyeOS keeps pictures and movies for as long as it can. However, I figured out that I would only require the still images and movies be kept for one month.<\/p>\n
      As such, I went on to configure my Raspberry Pi 3 CCTV to keep pictures and movies for a maximum of 1 month.<\/p>\n
      To configure the preservation period of pictures and movies, I first clicked on the first button on the top left of the screen to bring out the configurations drawer.<\/p>\n
      I then clicked on the Still Images<\/strong> and Movies<\/strong> tabs to expand both configuration sections:<\/p>\n
      \"MotionEyeOS<\/p>\n
      I then chose the For One Month<\/strong> option for Preserve Pictures<\/strong> and Preserve Movies<\/strong> and clicked Ok<\/strong> on the prompts that appeared.<\/p>\n
      Once I was done with that, I clicked on the Apply<\/strong> button at the top to persist the configurations and rebooted my Raspberry Pi 3 CCTV.<\/p>\n
      With that, I was satisfied with the configurations that I wanted for my Raspberry Pi 3 CCTV.<\/p>\n
      Making my Raspberry Pi 3 CCTV camera accessible from outside my home network through HTTPS<\/h2>\n
      Without HTTPS, it would be insecure to access my Raspberry Pi 3 CCTV camera from outside my home network. Protecting the HTTP traffic between a web browser and my Raspberry Pi 3 CCTV camera would require a reverse proxy server<\/a>, a domain name and a SSL certificate. <\/p>\n
      Through my experience in setting up a LEMP web server on Raspberry Pi 3<\/a> and setting up a free CA signed SSL certificate to secure a WordPress site hosted on it<\/a>, I had the hardware and software resources to secure access to my Raspberry Pi 3 CCTV camera with HTTPS.<\/p>\n
      Creating a sub domain from a domain that I already owned and point that sub domain to the public IP address of my home router<\/h3>\n
      Since I own a couple of domain names, I could create a sub domain from one of the domain names. And since I am leveraging on DigitalOcean name servers to translate my domain names into IP addresses, I could create a sub domain via DigitalOcean's control panel. <\/p>\n
      To create a sub domain via DigitalOcean's control panel, I logged into my Digital Ocean<\/a> account and go to the \"Networking\" page. I then proceeded to the \"Domain\" tab to select a domain which I wanted to create a sub domain from. <\/p>\n
      At the \"Create new record\" page, I entered the sub domain that I wanted for my Raspberry Pi 3 CCTV camera and the public IP address of my home router:<\/p>\n
      \"Digital<\/p>\n
      After clicking on the \"Create Record\" button, I was able to get the IP address of my home router by sending a ping to cctv.adomainname.com<\/code>.<\/p>\n
      And being able to reach my home router will meant that I was able to reach the LEMP server running on my Raspberry Pi 3<\/a>.<\/p>\n
      Configuring nginx to facilitate the Let's Encrypt client in acquiring the SSL certificate for my sub domain<\/h3>\n
      Once I was sure that the nginx server running on my Raspberry Pi 3 could receive HTTP requests directed at my sub domain, I proceeded on with creating the nginx configurations to facilitate the Let's Encrypt client in acquiring the SSL certificate for my sub domain.<\/p>\n
      To do so, I connected to my Raspberry Pi 3 LEMP server via SSH:<\/p>\n
      \r\nssh root@192.168.0.123\r\n<\/pre>\n
      Once I got into my Raspberry Pi 3 LEMP server, I used nano to create a configuration file at \/etc\/nginx\/sites-enabled\/cctv.adomainname.com.conf<\/code>:<\/p>\n
      \r\nsudo nano \/etc\/nginx\/sites-enabled\/cctv.adomainname.com.conf\r\n<\/pre>\n
      Once inside my nano editor, I created the following nginx configuration:<\/p>\n
      \r\nserver {\r\n\tlisten 80;\r\n\tserver_name  cctv.adomainname.com;\r\n\r\n\troot \/var\/www\/cctv.adomainname.com;\r\n\r\n\tlocation ~ \/.well-known {\r\n\t\tallow all;\r\n\t}\r\n}<\/pre>\n
      After creating the nginx configurations, I saved the file and restarted my nginx server:<\/p>\n
      \r\nsudo systemctl restart nginx.service\r\n<\/pre>\n
      I also created the directory \/www\/var\/cctv.adomainname.com<\/code> for the Let's Encrypt client to use in the process of acquiring the SSL certificate for my sub domain:<\/p>\n
      \r\nsudo mkdir \/www\/var\/cctv.adomainname.com\r\nsudo chown www-data:www-data \/www\/var\/cctv.adomainname.com\r\n<\/pre>\n
      Running Let's Encrypt client to get a SSL certificate artefacts for the sub domain to my Raspberry Pi 3 CCTV camera<\/h3>\n
      Once I had the configurations necessary for the Let's Encrypt client to acquire the SSL certificate artefacts for my sub domain, I ran the following command to get the Let's Encrypt client running:<\/p>\n
      \r\n\/opt\/letsencrypt\/letsencrypt-auto certonly -a webroot --webroot-path=\/var\/www\/cctv.adomainname.com -d cctv.adomainname.com\r\n<\/pre>\n
      Generating a strong Diffie-Hellman group<\/h3>\n
      After the SSL certificate and the corresponding private key were created successfully, I went on to precompute a strong Diffie-Hellman group for my server to use for exchanging cryptographic keys with its clients:<\/p>\n
      \r\nsudo openssl dhparam -out \/etc\/ssl\/certs\/dhparam.pem 2048\r\n<\/pre>\n
      This process took a very long time to complete but it was worth the effort as it would make communicating with my server more secure.<\/p>\n
      Creating the nginx configurations for serving HTTPS on behalf of my Raspberry Pi 3 CCTV camera<\/h3>\n
      Once I had the corresponding SSL certificate artefacts for my sub domain, my nginx was ready for the corresponding configurations to serve HTTPS on behalf of my Raspberry Pi 3 CCTV camera. The following is the last set of configurations that I included in \/etc\/nginx\/sites-enabled\/cctv.adomainname.com.conf<\/code>. These set of configurations allows me to access my Raspberry Pi 3 CCTV camera over HTTPS via my sub domain:<\/p>\n
      \r\n# Redirect HTTP requests to HTTPS \r\nserver {\r\n\tlisten 80;\r\n\tserver_name  cctv.adomainname.com;\r\n\treturn 301 https:\/\/$host$request_uri;\r\n}\r\n\r\n# For ssl\r\nserver {\r\n\tssl on;\r\n\tssl_certificate \/etc\/letsencrypt\/live\/cctv.adomainname.com\/fullchain.pem;\r\n\tssl_certificate_key \/etc\/letsencrypt\/live\/cctv.adomainname.com\/privkey.pem;\r\n\tssl_protocols TLSv1 TLSv1.1 TLSv1.2;\r\n\tssl_prefer_server_ciphers on;\r\n\tssl_dhparam \/etc\/ssl\/certs\/dhparam.pem;\r\n\tssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';\r\n\tssl_session_timeout 1d;\r\n\tssl_session_cache shared:SSL:50m;\r\n\tssl_stapling on;\r\n\tssl_stapling_verify on;\r\n\tadd_header Strict-Transport-Security max-age=15768000;\r\n\t\r\n\tdefault_type  application\/octet-stream;\r\n\t\r\n\tlisten 443;\r\n\tserver_name  cctv.adomainname.com;\r\n\r\n\troot \/var\/www\/cctv.adomainname.com;\r\n\r\n\tlocation ~ \/.well-known {\r\n\t\tallow all;\r\n\t}\r\n\r\n\tlocation \/ {\r\n\t\tproxy_pass http:\/\/192.168.0.107;\r\n\t}\r\n}\r\n<\/pre>\n
      Buying your Raspberry Pi 3 CCTV camera from Amazon<\/h2>\n
      If you do not have the Raspberry Pi 3 components mentioned in this post yet, you may want to purchase them from Amazon. Simply click on the button below to add the Raspberry Pi 3 components to your cart. You may remove anything that you already have or replace some of the components with other components.<\/p>\n
      <\/p>\n

      \n<\/form>\n
      <\/center><\/p>\n
      \"How<\/p>\n\n