What happened to HaaS?

Software SW tweaks
1

I wonder what happened to HaaS - even though HaaS is running (as checked each time when I connect to TO router via SSH - HaaS proxy PID found, task is running) - last entry in HaaS sessions on haas.nic.cz site for my device is more than month old, e.g.:

Time IP Address Commands Username Password Success Actions
2025-04-09 23:50:39 45.135.193.100 0 admin admin no
2025-04-09 23:50:37 45.135.193.100 0 admin admin no
2025-04-09 23:50:35 45.135.193.100 0 admin admin no
2025-04-09 23:16:18 84.217.17.218 1 root root yes

I didn’t find any message regarding HaaS (except those of HaaS check while connecting via SSH) in syslog. Is there any problem?

TO 2016, HBS branch, 2 GB, SSD 256 GB (logs etc.), 2x WiFi, HaaS, RIPE Atlas, Sentinel, lxc (test), simple config, all seems OK.

2 Likes
2

Check token if its the same on the website and in the configuration

3

Yes, I’ve checked it - it’s the same.

But, maybe problem is not in HaaS, but with Sentinel: there are no data for month May (except May 14th :wink: )

BTW:
root@TOjp:~# /etc/init.d/haas-proxy status
running
root@TOjp:~# sentinel-status
Server Connection: RUNNING
FWLogs: RUNNING
Minipot: RUNNING
Turris Survey: RUNNING

One more note: AFAIK I didn’t change Sentinel & Haas configuration for long long time…

1 Like
4

/etc/init.d/haas-proxy status is not enough.
I already had situation, when this command returned “running”, but process was not running.
Check ps -ef | grep haas, you should see something like this:

root@turris:~# ps -ef | grep haas
root     20393     1  0 May29 ?        00:03:54 python3 -m haas_proxy --pidfile=/var/run/haas-proxy.pid --nodaemon haas_proxy --log-level=warning --device-token=xxxxxxxxxxxxxx --port=2525
1 Like
5

I used /etc/init.d/haas-proxy status only to display more information… in reality I’m checking whether there exist HaaS PID by testing if there exist file /var/run/haas-proxy.pid (and if it doesn’t exist, I’m restarting haas-proxy), and, moreover, I’m checking whether there exist HaaS process (and if it doesn’t exist, I’m restarting haas-proxy)…

6

Got an idea that Sentinel (and/or HaaaS) could be somehow damaged. Thus I removed Sentinel from installed packages, run update, rebooted, added back Sentinel to packages, run update, rebooted…
Waited 2 hours to see if anything was catched in HaaS and Sentinel sessions. Unfortunately, there was no change - no new data.
Note - both Sentinel and HaaS ID (token) are the same before and after this excersize (probably they are produced from TO serial number).

7

They are just saved in /etc/config file that is preserved even if you uninstall package

8

I have no HaaS data since 2025-05-15. I’ve updated to 7.2.0 today (I was waiting to see if there were some critical issues).

I see this in logs; I don’t know since when it this like this.

root@turris:~# cat /var/log/messages
Jun 20 15:40:02 turris haas-proxy-start[10959]: 2025-06-20T17:40:02 CRITICAL twisted 'channel open failed, direct-tcpip is not allowed'
9

This message is normal.
Do you have the same “token” in /etc/config/haas and in Honeypot as a Service - Login to HaaS?
Is “haas” process running?

ps -ef | grep ‘haas’

Or you can check to connect to WAN address of your router at https://sshcheck.com/.
SSH Honeypot is reported like “SSH-2.0-Twisted” (normal SSH is “SSH-2.0-OpenSSH")

10

Yes, HaaS process is running:

root@TOjp:~# ps -ef | grep ‘haas’
root 8093 1 0 Jun10 ? 00:00:02 python3 -m haas_proxy --pidfile=/var/run/haas-proxy.pid --nodaemon haas_proxy --log-level=error --device-token=d3e7b62af9ec4ca58ddf70f39623461c --port=2525 --log-file=/srv/log/haas.log

Token in config and on HaaS devices page is the same (comments in config were removed):

root@TOjp:~# cat /etc/config/haas
config haas ‘settings’
option log ‘/srv/log/haas.log’
option log_level ‘error’
option token ‘d3e7b62af9ec4ca58ddf70f39623461c’

haas.nic.cz/device/4924/detail:
Podrobnosti o TOjp
Typ Linux
Token d3e7b62af9ec4ca58ddf70f39623461c

11

I have some other options in /etc/config/haas:

Blockquote
config haas ‘settings’
option local_port ‘2525’
option setup_fw ‘1’
option token ‘XXXXXXXXXX’
option log ‘/var/log/haas.log’

But it seems that HaaS really stopped working even on my Turris OS 7.1.4:.

Connection to WAN port 22 is refused everytime.

Connection to my router from LAN on port 2525 sometimes refused:

login as: root
root@192.168.2.1's password:
ssh: connect to host haas-app.nic.cz port 10003: Connection refused

but sometime accepted:

login as: root
root@192.168.2.1's password:
The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
root@svr04:~# Connection to haas-app.nic.cz closed by remote host.

When “iptables” was used for firewall I was able to see forwarding port 22 from WAN to port 2525 on LAN.
But I cannot see anything like this in “nftables” - in nft list ruleset or in http://<LAN_address>/cgi-bin/luci/admin/status/nftables..

12

Thanks for reporting. I’ve tested haas on clean omnia with hbs branch, and confirming the issue. It’s on server’s side and we are investigating it.

2 Likes
13

We have made some changes related to the management of HaaS worker processes. So HaaS should be more stable now.

14

Thanks. Shall I do anything to re-enable HaaS/Sentinel?

Edit: please advise @ljelinek @TomasZak - in the morning it was still not working :frowning:

15

I did not changed anything and HaaS is working again since today afternoon.

  • rule for port 2525 is visble in nftables

root@turris:~# nft list ruleset | grep 2525
meta nfproto { ipv4, ipv6 } tcp dport 22 meta mark set 0x00000072 redirect to :2525 comment “!sentinel: HaaS proxy port redirect”

16

Please re-check locally with:

# python3 -m haas_proxy --version
twistd (the Twisted daemon) 24.7.0
Copyright (c) 2001-2024 Twisted Matrix Laboratories.
See LICENSE for details.

Should be 24.7.0 as it got updated in some recent release to fix CVE I reported. On which version of TOS are you on?

There were server side changes so I guess that helped. But you should make sure to update your TOS

17

To be sure I checked twistd version as well - it’s 24.7.0 as well.

Unfortunately, it is still not working. :-((