glow.li: Android

Encrypt Termux filesystem with LUKS

Mon, 10 May 2021 00:00:00 +0000

People sometimes store sensitive information within Termux, like SSH Keys or PGP Keys. Within Android, this is fairly secure. No other app can access the Termux storage without explicit user consent. But our phones aren't secure devices for most people. Most people have a really short pin or password (or even none at all). So if our devices get stolen or seized, this data can easily be extracted. This short tutorial will show you a way to encrypt the whole Termux filesystem, so this data cannot be extracted once the phone has turned off or the filesystem is unmounted and closed again.

Procedure
Requirements
Create filesystem
Entering the encrypted Termux
- Find your su binary
Restore your existing installation
Unmounting your filesystem
Accessing your unencrypted Termux while in the encrypted environment
Caveats
- Termux:Tasker
- SELinux

Procedure

We're creating a separate filesystem in an encrypted image file, which we're then mounting at /data/data/com.termux/files, which contains all of Termux' data.

Requirements

Rooted phone

Unfortunately, this only works with a rooted device, as you need access to cryptsetup and mount

Blank Termux

It is recommended to start out with a freshly installed Termux. This is the host Termux, that will only be used to mount the encrypted Termux. You can do it on an existing Termux installation, but be aware that all data that is already in your Termux installation, will not be encrypted. If you want encrypt an existing installation you need to make a backup of it now and then reset your Termux.

rsync -a /data/data/com.termux/files /data/data/com.termux/files-backup

Make sure to delete this backup at the end.

After that you can delete /data/data/com.termux/files to reset your Termux (restart after doing so). Beware that this will delete all your files. Make sure you've backed them up.

Packages

Install the root repo:

pkg install root-repo

Install required packages:

pkg install util-linux cryptsetup tsu e2fsprogs rsync

Create filesystem

Step 1: Create a blank image file

To create an encrypted filesystem you need to first create a blank '.img' file. Adjust the size to your preference. Beware that it will use up this space on your device instantly.

fallocate -l 16G /data/data/com.termux/termux-fs.img

Step 2: Encrypt image file using LUKS

Next we are encrypting this '.img' using LUKS.

sudo cryptsetup luksFormat /data/data/com.termux/termux-fs.img

Answer the first prompt with YES and then enter a passphrase twice:


WARNING!
========
This will overwrite data on /data/data/com.termux/termux-fs.img irrevocably.

Are you sure? (Type 'yes' in capital letters): YES
Enter passphrase for /data/data/com.termux/termux-fs.img:
Verify passphrase:

Step 3: Temporarily open image file

To format the image file we need to temporarily open it.

sudo cryptsetup open /data/data/com.termux/termux-fs.img termux-fs-tmp

You will be prompted to enter your passphrase

Step 4: Format the image file

Create a ext4 filesystem inside the encrypted volume.

sudo mkfs.ext4 /dev/mapper/termux-fs-tmp

Step 5: Close the image file again

sudo cryptsetup close termux-fs-tmp

Entering the encrypted Termux

Now that we created the encrypted disk we simply need to mount it. Since we need to do this every time we boot our device, it's best we create a script for that. Use this script to enter your new filesystem:

#!/usr/bin/env bash
u=$(whoami)
export LD_PRELOAD=
/sbin/su -c "cryptsetup luksOpen /data/data/com.termux/termux-fs.img termux-fs"
/sbin/su -c "mount /dev/mapper/termux-fs /data/data/com.termux/files"
/sbin/su -c "/system/bin/chown $u.$u /data/data/com.termux/files"

You will be prompted your passphrase. This will mount your filesystem to /data/data/com.termux/files. After you've run this script, exit your Termux App and open it again. The first time you do this the Termux App will reinstall your base system inside your encrypted dist.

Congratulations you are now in your encrypted filesystem. You will need to run this script again after a restart.

Find your su binary

Since mounting a filesystem at /data/data/com.termux/files will cause all Termux command to temporarily break, we need to make sure we're not running any Termux commands in this script. Therefore you need to specify your su binary with an absolute path. In most cases this is /sbin/su, so you can use the script as is. If your su is somewhere else, check these paths and replace the command in the script accordingly:

/sbin/su
/system/sbin/su
/system/bin/su
/system/xbin/su
/su/bin/su
/magisk/.core/bin/su

Restore your existing installation

If you've created a backup of your existing installation (described here) you can restore that backup now.

rsync -a --delete /data/data/com.termux/files-backup/ /data/data/com.termux/files/

If everything worked, remember to delete this unencrypted backup.

rm /data/data/com.termux/files-backup -rf

Unmounting your filesystem

Unmounting your encrypted Termux is a bit annoying. Since it is always in-use you need to specify (-l) lazy mode.

sudo umount /data/data/com.termux/files -l

After that can restart your Termux again to be in the unencrypted filesystem again. Your encrypted filesystem is still open however, so you need to close it now.

sudo cryptsetup close termux-fs

If there are any processes still accessing your encrypted Termux, this will fail. You need to either find and close these processes, or restart your device.

Accessing your unencrypted Termux while in the encrypted environment

It is sometimes necessary to do maintenance (updates for example) on the unencrypted Termux. Unmounting your filesystem is one possibility, but is quite annoying. You can however use unshare and chroot to access your unencrypted Termux while the encrypted Termux is still running. I created this script to do that:

#!/usr/bin/env bash
OPTIND=1
UNSHARED=false
while getopts ":U" opt; do
    case "$opt" in
        U)
            UNSHARED=true
            ;;
        *) ;;

    esac
done

shift $((OPTIND - 1))
if [ ! "$UNSHARED" == "true" ]; then
    user="$(whoami)"
    vars=""
    vars+=" HOME=$HOME"
    vars+=" PATH=$PREFIX/bin"
    vars+=" PREFIX=$PREFIX"
    vars+=" TMPDIR=$TMPDIR"
    vars+=" SHELL=$PREFIX/bin/login"
    vars+=" exec $PREFIX/bin/login"
    args=""
    if [ -n "$1" ]; then
        args="-c '$@'"
    fi
    $PREFIX/bin/sudo unshare -m $0 -U "$user" "$HOME" "$vars $args"
else
    mount --bind /data/data/com.termux /data/data/com.termux
    user="$1"
    user_home="$2"
    vars="$3"
    cd $user_home
    groups=${user},inet,everybody,${user}_cache,all_$(echo $user | cut -d "_" -f 2)
    exec chroot --skip-chdir --userspec=$user:$user --groups=$groups / sh -c "$vars"
fi

Running this will drop you inside your unencrypted Termux. Since we used unshare this only applies to this process. Other sessions remain unaffected. To return to your encrypted Termux simply exit this process.

Caveats

Termux:Tasker

If you install the Termux:Tasker add-on, Tasker will not be able to execute the tasks in ~/.termux/tasker, because it checks your for these files in your unencrypted Termux. If you want to use this functionality you need to create blank executable files in your unencrypted Termux with the same name as the ones in your encrypted Termux. It will actually execute the scripts in your encrypted environment.

I think this is a really interesting bug. I wrote a detailed bug report here: https://github.com/termux/termux-tasker/issues/45

SELinux

I've run into issues using SELinux. It may be necessary to run this command after mounting:

/sbin/su -c "/system/bin/restorecon -R /data/data/com.termux/files"

If you run into continuing issues, add this to your mounting script (edit the path to su as described here)

Android notifications for Profanity in Termux

Thu, 10 Nov 2016 00:00:00 +0000

Just like with weechat you can now receive Android notifications on Termux when you receive a message in Profanity. I wrote a small plugin to achive exactly that. You can download it from GitHub and install it with /plugins install ./profanity-termux-notification/termuxnotify.py. Read more about the installation requirements and configuration options on GitHub.

Access Termux via USB

Tue, 20 Sep 2016 00:00:00 +0000

I've been using Termux over SSH for quite a while now. I've always done so over WiFi. This works reasonably well at home, where I control the IP Addresses. In other networks it was more annoying, because I always had to run ifconfig first, to get my IP. But the big annoyances start when you want to use it in a place that has no WiFi network available. Previously, I used an Android tablet and a keyboard. With this I set up a WiFi direct connection between my phone. It's wonky and sometimes requires to restart both devices before working again, but it works.

Then I got a laptop. Installed a proper Linux on it and tried to connect to Termux. I tried setting up WiFi Direct. But after an hour or so of messing around wpa_supplicant I concluded that it's just too much of a hassle. But somewhere in the GitHub issues I came across the mention of connecting to Termux via ADB. The ADB shell is bad. I didn't actually manage to launch Termux programs via the ADB shell, but I heard that it's possible. But, and this is the point of this article, you can create port forwarding via ADB. This means that you can map a local port on your computer to a port on your Android device. Then you can open the 8022 port to access Termux via SSH over USB. This is awesome, when you're on the train, in a coffee shop or otherwise in a place with wonky or nonexistent WiFi.

Here is how you do it

1. You need ADB

Most operating systems have an ADB package. On my one I was simply able to install it with:

sudo apt install adb

For other platforms you can check this site here.

2. Create your port forward

This part is really simple as well, and that's key. I don't want to do 500 things every time I want to connect to my phone.

adb forward tcp:8022 tcp:8022

This is really all it takes. The first instance of tcp:8022 is the local port you want to bind the remote port to. The second one is the port from your Android device. Because Termux' SSHD runs on port 8022 by default, this is what you want.

3. Connect to it

Now that your local port is bound to your Android device you can simply connect to localhost on your computer:

ssh localhost -p 8022
#This is were you put the local port
#(ie. the first one)

This will connect you to your SSH Server. If you haven't set this up yet read this.

You will need to run the ADB command after every restart or after you've unplugged your device. I set up an alias for myself for the following command sequence:

adb forward tcp:8022 tcp:8022 && adb forward tcp:8080 tcp:8080&& ssh localhost -p 8022
# This will also setup the port 8080, which is used by the httpd webserver on termux

Pass variables from Termux to Tasker

Sun, 03 Apr 2016 00:00:00 +0000

I figured out that you can pass variables from Termux to a Tasker task. This example sets Android's volume to a value specified in Termux.

Step 1: Creating the script

volume.sh

#!/data/data/com.termux/files/usr/bin/sh
#am broadcast --user 0 -a net.dinglish.tasker.[task name] -e [variable name] "[value]" > /dev/null
am broadcast --user 0 -a net.dinglish.tasker.volume -e volume "$1" > /dev/null

Step 2: Create a Tasker profile

Create a new profile
Choose "Event"
In the "Select Event Category" dialog choose "System"->"Intent Received"
As Action define net.dinglish.tasker.volume

This profile will now be called whenever it receives the "volume" intent.

Step 3: Create the Task

Tap "New Task" and give it a name
Tap + to add a new Action
Choose "Audio"->"Media Volume"
Under "Level" tap the icon with the crossing arrows to switch to text mode.
Enter %volume as a value
You need to exit Tasker for the changes to take effect.

Step 4: Run the script

You can now run the script. It will send an intent to Tasker. It will put the first argument as new volume, which has to be an integer from 0-15.

./volume.sh 4

This is only a simple example of what you can do with variables. Let me know what you come up with.

Display output of a bash script on a widget

Tue, 16 Feb 2016 00:01:00 +0000

I managed to build a bridge between Termux and Minimalistic Text using Tasker. I use it to display the last 20 lines of the #termux irc channel as you can see in the picture. I've done it without having Tasker check a file every two minutes. The Task is directly called from the script.

This tutorial is not Termux specific and should work with any terminal emulator

Step 1: Creating the script

All you have to do is write your output to a file in /sdcard/. In this example I am grabbing the last 20 lines of log of the #termux irc channel from my server.

while true; do
  # You can basically add your own commands here. They just have to write
  # their output to `/sdcard/widget`

  # For maximum battery and bandwidth efficiency tail and cut are
  # executed on the server
  # the cut command removes the timestamps
  #
  # for this to work you need to have placed your public key on the server.
  # Otherwise you will need to enter your password every two minutes
  ssh user@example.com "cat ~/.weechat/logs/irc.freenode.#termux.weechatlog |tail -n 20 | cut -c 21-">/sdcard/widget

  # This sends an Intent. This is how we'll call the Tasker task which
  # updates the widget. "net.dinglish.tasker" has to be there every
  # time for tasker to receive the intent. The last part is the name
  # of the intent which you can change if you want more than one.
  # This normally produces a bit of useless output. I am removing #
  #that with `>/dev/null`
  am broadcast -a net.dinglish.tasker.updatewidget --user 0 >/dev/null

  # sleep for 120 seconds. How often it should update the widget.
  sleep 120
done

If you run this it will download the last 20 lines of the log from a server, paste it into /sdcard/widget and call Tasker with an Intent.

You should also create the file /sdcard/widget now. Simply do touch /sdcard/widget. { .right}

Step 2: Create a Tasker profile

Create a new profile
Choose "Event"
In the "Select Event Category" dialog choose "System"->"Intent Received"
As Action define net.dinglish.tasker.updatewidget

This profile will now be called whenever it recieves the "updatewidget" intent. This is a usefull way to extend the functionality of Termux. I also use it to kick of some Foldersync jobs from the terminal.

Step 3: Create the Task

Tap "New Task" and give it a name
Tap + to add a new Action
Choose "File"->"Read File"
Tap 🔍 and choose /sdcard/widget.
Under "To Var" enter %Widget
Tap + again to add another new Action
Choose "Plugin"->"Minimalistic Text"->"Minimalistic Text"
Click the pen to edit the configuration
Enter %Widget for both variable name and variable content

Step 4: Configure Minimalistic Text

Add a Minimalistic Text widget to your homescreen
Choose any preset
In the "layout" tab remove remove all rows. Now you have a blank widget
Add a new element with +
Switch "Misc" Tab and tick "Locale variable"
Tap "OK"
Click on the new "Locale variable" element
In the popup enter %Widget as a the "Variable name"
"OK" and Save

Step 5: Run the script

Now you can run the script in Termux. Your widget should get updated right away.

Use your current location for wego in Termux

Tue, 16 Feb 2016 00:00:00 +0000

Wego is a pretty cool weather client for the terminal.

You also need termux-api and the jq package.

Now you can run the following command to display the weather report for your current location.

loc=$(termux-location -p network)&&wego "$(echo $loc | jq .latitude),$(echo $loc | jq .longitude)"

Wego on termux

For wego to work you must set the WEGORC environment variable. You probably want to do this in your shells startup script.

export WEGORC=$HOME/.wegorc

Otherwise it installs just fine if you follow the instructions.

Wttr.in

If you don't want to go through the hassle of installing wego, you can just use wttr.in instead. Wttr.in is an implementation of wego that can be called with just curl wttr.in to get the current weather. If you don't want to rely on IP Geo location you can also use the same script for wttr.in instead of wego.

loc=$(termux-location -p network)&&curl wttr.in/$(echo $loc | jq .latitude),$(echo $loc | jq .longitude)

Compile aclock on Termux

Sun, 17 Jan 2016 00:00:00 +0000

Aclock is a another clock program, but this time it's an analog clock.

To compile it on Termux you'll need to downloaded the source.

wget https://raw.githubusercontent.com/tenox7/aclock/master/sources/aclock-unix-curses.c

You'll also need the ncurses-dev package.

apt install ncurses-dev

Now you simply have to compile it.

gcc aclock-unix-curses.c -o aclock -lncurses -lm

After that you can simply run it with ./aclock.

Compile Stag on Termux

Sat, 16 Jan 2016 00:00:00 +0000

This post is now obsolete. You can install stag from the repository.

Stag is a cool little programm that generates a bar graph.

To compile it on Termux you'll need to downloaded the sources from GitHub.

git clone https://github.com/seenaburns/stag.git

To compile you need to install the ncurses-dev package.

apt install ncurses-dev

Open the stag.c file and change line 90 from char opt to signed char opt, otherwise it will throw an error during compilation. You'll also need to make a change to the Makefile, so that the right compiler is used. Change line 1 from CC ?= gcc to cc = gcc. After that you can simply use make to compile and install it.

make
make install

Examples

CPU usage statisitc

while true; do top -bn1 | grep "CPU:" -m 1 | cut -f1 -d"." | cut -f2 -d" " ;sleep 1; done | stag -t "CPU"

Android battery status

while true; do termux-battery-status | jq .percentage;sleep 60; done | stag -t "Battery Stats"

Compile tty-clock on Termux

Sat, 16 Jan 2016 00:00:00 +0000

This post is now obsolete. You can install tty-clock from the repository.

Tty-clock is a small program that displays a digital clock.

To compile it on Termux you'll need to download the sources from GitHub.

git clone https://github.com/xorg62/tty-clock.git

You'll also need the ncurses-dev package.

apt install ncurses-dev

Sadly, compiling with make doesn't really work with this one, I managed to compile it with the following command.

gcc -Wall -Werror -Wextra -std=c99 -pedantic -Wno-unused-parameter -lncurses -o tty-clock ttyclock.c

You can then install it with make install.

Android notifications for WeeChat in Termux

Tue, 05 Jan 2016 12:30:59 +0000

I figured out how to have WeeChat in Termux create a notification on your android device whenever someone mentions your username or you receive a private message.

You need to have Termux:API installed for this. All you need to do is type following command into WeeChat:

/set trigger.trigger.beep.command "/print -beep;/exec -bg termux-notification -t 'IRC Notification' -c "${tg_tag_nick}: ${tg_message_nocolor}";/exec -bg termux-vibrate"

Explanation

Normal WeeChat behavior is to send a BEL character to the terminal whenever someone mentions you or sends you a private message. This extends that with the commands termux-notification and termux-vibrate found in the Termux:API. The content of the notification is ${tg_tag_nick} (which is the user who sent you the message) and ${tg_message_nocolor} (which is the message without coloring). Here you can find more available variables.

Run an SSH server on your Android with Termux

Fri, 06 Nov 2015 17:48:05 +0000

With the brilliant Termux terminal emulator app you can run an SSH server on your Android.

Previously I used SSHDroid (which is no longer available) to achieve this, but with Termux is much nicer because you have access to a working package manager.

Run the service

You need to install the OpenSSH package

    apt install openssh

and use following command to start the ssh server.

    sshd

And there you go. Your ssh service is now running on port 8022.

    ssh localhost -p 8022

Adding your Public key

You can't do password authentication in Termux, therefore you need to put your OpenSSH public key into the ~/.ssh/authorized_keys file.

This file will need to be created and permissions set to 600.

    touch ~/.ssh/authorized_keys
    # Set Permissions to the file
    chmod 600 ~/.ssh/authorized_keys
    # Make sure the folder .ssh folder has the correct permissions
    chmod 700 ~/.ssh

If you do not have a OpenSSH key pair yet, you can generate one with the following command:

    ssh-keygen

You may or may not enter a passphrase and if you don't specify otherwise, your key pair will have been saved under ~/.ssh/id_rsa and ~/.ssh/id_rsa.pub. You can then add it to the ~/.ssh/authorized_keys with

    cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys
    chmod 600 ~/.ssh/authorized_keys

Then you can test it by connecting to your ssh service

    # -i $PATH_TO_FILE/filename is only required if the id_rsa file is not ~/.ssh/id_rsa
    ssh localhost -p 8022 -i %PATH_TO_KEY-FILE%/%NAME_OF_KEY%

You can now use your private key (~/.ssh/id_rsa) to login to your Termux SSH Server. Simply copy it to your computer (by copying it to internal storage first cp ~/.ssh/id_rsa /sdcard) and use it in your ssh client.

OpenSSH

If you're using OpenSSH (on Linux or Cygwin) you can use it directly:

    # -i $PATH_TO_FILE/filename is only required if the id_rsa file is not ~/.ssh/id_rsa
    ssh $IP -p 8022 -i %PATH_TO_KEY-FILE%/%NAME_OF_KEY%

PuTTY

If you're using PuTTY you will need to convert it to the PuTTY Private Key format first.

Download and run PuTTYgen
Load the private key (id_rsa)
Save the private key as a *.ppk file.
Download and run PuTTY
Enter the IP address of your Android device and use port 8022
Under Connection>SSH>Auth you can browse for the *.pkk file
Click open
You can leave "login as:" blank

You should now be connected to your Android device via SSH.

If it still doesn't work

    killall sshd
    sshd -d

If it is still prompts you for a password you can enter sshd's debug mode with the above command and see exactly why your key has been rejected. The reason usually are bad permission on either your home directory, your .ssh folder or your authorized_keys file.

The correct permissions are:

    chmod 700 ~
    chmod 700 ~/.ssh
    chmod 600 ~/.ssh/*

I hope in the future Termux will allow us to register sshd as a proper service which would automatically start on system boot. Right now I have the 'sshd' command in my .bashrc file and I am using Tasker to launch Termux after boot. You can also use the Termux widget to quickly start sshd with a widget.

Display Swatch Internet Time (beats) in Zooper

Fri, 30 Oct 2015 18:17:50 +0000

Did you ever want Zooper to display Time in .beats? Probably not. Here's how anyway:

@$(floor(((#Dss#)+(#Dmm#*60)+((#DH#+1)*3600))/86.4))$

This does the math. Just add a Text or Rich Text module, "Edit text manually" and insert this.

You will have to also tap "Override widget Locality" add a location, enter any city and manually set the timezone to UTC. This is because it Swatch Internet Time doesn't have time zones but can be calculated from Biel Meantime (BMT). @0 is midnight in Biel, where the Swatch headquarters is located.

You can also download this as a template: Swatch Internet Time.zw