Notes on Setting up a Cambium 850C PTP

Posted on May 23, 2023 by admin

These are set up a bit weird compared to normal WISP radio equipment. The default IP address is 192.0.2.1 for the radio. So you need to set a 192.0.2.3 with a subnet of 255.255.255.240. Looks like it is usually only accessible via the management port and you need to make or buy a special patch cable.

https://community.cambiumnetworks.com/t/physical-reset-on-ptp850c/88884/2

The User Guide is available here

https://www.cambiumnetworks.com/wp-content/uploads/2021/07/PTP-850-C-E-S-User-Guide-11.5.pdf

You can download the Installation Guide from here

https://support.cambiumnetworks.com/file/5034c6e4b584c5d40429a163cef0d7a6257f8dc3

Both those documents show how to install and get into the device.

Obtain and Decrypt Cambium WiFi Router Password

Posted on December 1, 2021 by admin

By default the passwords are “encrypted” so you can not tell what the password is.

No way to view cnPilot WiFi password in the Web UI

We covered decrypting the passwords from the config file from cambium cloud. But what about a local router that is not connected to the cloud. What then?

Thankfully everything you need is on the router. We’ll need to use the command line tools.

1. Enable SSH

First verify that SSH is enabled.

2. SSH into router

You may need to specify the “diffie-hellman-group1” option if it throws an error.

ssh admin@192.168.11.1 -o KexAlgorithms=+diffie-hellman-group1-sha1

3. Extract Encrypted WiFi Password from config

The config file is stored in “etc/cambium/bkup-config.txt”

cat etc/cambium/bkup-config.txt | grep

This should dump the encrypted password(s).

Example Output.

WPAPSK1=[c760ba8ffe65c669]
RTDEV_WPAPSK1=[c760ba8ffe65c669]

4. Decrypt WiFi Password

Now we can decrypt the password. Replace the string at the end with the encrypted string

3des_hex -d c760ba8ffe65c669

It should now display the decrypted password

# 3des_hex -d c760ba8ffe65c669
12345678#

Note that it puts the # symbol after the password and if you try to type something in, it clears the line. you can use the following to have cleaner output.

echo $(3des_hex -d c760ba8ffe65c669 )

That will print the password on it’s own line

# echo $(3des_hex -d c760ba8ffe65c669 )
12345678
#

Decrypting Cambium router config passwords

Posted on October 19, 2021 by admin

In the cambium cloud you can retrieve a config from a router, modify it and reapply it or make a template from it. All the passwords are “encrypted” so you can’t read what the WiFi password is for example.

Example config line looks like

WPAPSK1=[c760ba8ffe65c669]

Looks like it uses some sort of des3 hex encryption.

Fortunately there is a utility on the routers we can use to decrypt the encrypted string.

First we need a router that we can SSH into.

Info on the encryption

The Cambium router uses the 3des_hex utility to decrypt and encrypt strings

It is located /sbin/3des_hex

Decrypting a password

Decrypting is super easy.

3des_hex -d "c760ba8ffe65c669"

Replace the key with the key you want to decrypt.

Encrypting a password

Not really sure if this would ever be needed, but you can use the -e option to encrypt a string

3des_hex -e "12345678"

More info.

It looks like it needs the lib file “/lib/libuClibc-0.9.33.2.so”

/sbin/3des_hex is where the main file is stored though.

The config_manager.sh script in /sbin has the functions that encrypt and decrypt the config lines.

TMP_FILE="/tmp/tmp_cfg"
TMP_FILE2="/tmp/tmp_cfg2"
TMP_FILE_DECRYPT="/tmp/tmp_cfg_decrypt"
TMP_MFK_FILE="/tmp/multi_function_key.cfg"
decrypt_key="asdfghjkl";
SNMP_DECRYPT_FILE="/etc/cambium/cambium_default.decrypt"
DotFactoryFile="/etc_ro/DoNotFactory.name"

# when security encrypt enable , decrypt.
handle_file_dec()
{
        local enc_enable=`dev_manage_stat_get has_config_enc`
        if [ "$enc_enable" != "1" ]; then
                return 0
        fi
        SecParamListFile="/etc_ro/ConfigFileSecParam"
        [ -x "/sbin/3des_hex" ] || return 0
        [ -f $SecParamListFile ] || return 0
        [ -z "$1" ] && return 1
        awk -F '=' 'ARGIND==1{pname[$0]}ARGIND>1&&($1 in pname){print $0}' $SecParamListFile $1 > $1.tmp
        awk '{if($0~/.+\=\[.*\]/){sub("\=","\|");print $0;}else{print $0}}' $1.tmp > $1.tmp1
        rm -f $1.tmp
        awk -F'|' '{if($2~/\[.*\]/){len=length($2);value=substr($2,2,len-2);while(("3des_hex -d \""value"\""|getline line)>0){printf("%s=%s\n",$1,line);}close("3des_hex -d \""value"\"");}else{print $0}}' $1.tmp1 > $1.tmp2
        rm -f $1.tmp1
        echo "" >> $1
        cat $1.tmp2 >> $1
        rm -f $1.tmp2
}

Cambium 450 Bandwidth PLL lock lost

Posted on November 4, 2020 by admin

Had a radio briefly showing an error in red on the web page saying “Bandwidth PLL lock lost” The radio seems to operate so not sure if it is an actual issue or maybe an ongoing bug.

These entries are from the cambium 16.1.1 Release Notes
https://community.cambiumnetworks.com/t/450-platform-series-release-16-1-1-is-now-available/65335

A very few 450i/450b SMs having “Bandwidth PLL lock lost” and being unable to register to AP on 20 and 30 MHz after upgrade to 16.1.
Occasional false positive of 450 radios was showing “Bandwidth PLL lock Lost” but operating normally.

https://community.cambiumnetworks.com/t/pmp450-sm-v16-1-error-bandwidth-pll-lock-lost/63243

Cambium R195W cnPilot Routers Randomly Dropping

Posted on August 20, 2020 by admin

The Problem

We have been experiencing a problem with our Cambium routers where they randomly drop and are unresponsive till a reboot. They’ll also stop handing out addresses on the LAN side.

A reboot “fixes” the problem, until it does it again. You can trigger the behavior by running a port scan against the router. Wondering if the CPU/Memory get overloaded?

nmap -T4 -A -v 192.168.11.1

While running a scan on the LAN side, the web interface slows down, but doesn’t seem to take it down as fast as a scan on the WAN side.

goahead.sh is a script that may be maxing out the cpu, but could be completely unrelated.

Resolution

Configuring the “Allowed Remote IP(IP1;IP2;)” to limit WAN access effectively blocks port scans and resolves the issue. Setting is under Administration -> Management -> Web Settings. You can add multiple ranges with

10.0.0.0/8;172.16.0.0/12;192.168.0.0/16

Configure Allowed Remote IP cnPilot R195W

It looks like the public ip ranges are limited to /24’s so if you you have a block of public IP addresses larger than a /24, you’ll need to break it down into 24’s to work properly.

Template for cnMaestro

You can also create a template in the Cambium Cloud so you can apply the change to multiple routers fairly easily.

Go to Configuration -> Templates and add a new template.

WebRemoteLegalIP=10.0.0.0/8;192.168.0.0/16;172.16.0.0/12

And then you can go to your device -> Configuration and apply your new config.

Do note that if you run a scan from an allowed range, it still seems to cause problems. But at least setting the Allowed Remote IPs will keep others from scanning your network and causing problems on your R195’s.

Cambium Routers Command Line Info

Posted on April 16, 2020 by admin

Helpful commands. Maybe?

nvram_set
nvram_get
nvram_get 2860 Password

Looks like most of the configuration scripts are in /sbin

Web from the /etc_ro/web/admin/managment.php

                                                                                                                                                                                     <fieldset>                                                                                                                                                                                                                                           <legend><script type="text/javascript">Capture(management.Web_Access)</script></legend>                                                                                                                                                      <table class="setting_block">                                                                                                                                                                                                                        <tr>                                                                                                                                                                                                                                                 <td class="head" id="remoteWebLogin"><script>Capture(management.Remote_Web_Login)</script></td>                                                                                                                                              <td>                                                                                                                                                                                                                                                 <select name="remote_web_login">                                                                                                                                                                                                             <option value="0" <% getCfgSelected("DBID_LAN_LOGIN_ONLY", "1"); %>><script>Capture(share.disable)</script></option>                                                                                                                         <option value="1" <% getCfgSelected("DBID_LAN_LOGIN_ONLY", "0"); %>><script>Capture(share.enable)</script></option>                                                                                                                          </select>                                                                                                                                                                                                                            </td>                                                                                                                                                                                                                                </tr>                                                                                                                                                                                                                                        <tr id="WirelessHostLogin_tr">                                                                                                                                                                                                                       <td class="head" id="WirelessHostLogin"><script>Capture(management.wireless_access_web)</script></td>                                                                                                                                        <td>                                                                                                                                                                                                                                                 <select name="wireless_access_web">                                                                                                                                                                                                          <option value="0" <% getCfgSelected("wireless_access_web", "0"); %>><script>Capture(share.disable)</script></option>                                                                                    <option value="1" <% getCfgSelected("wireless_access_web", "1"); %>><script>Capture(share.enable)</script></option>                                                                                                                          </select>                                                                                                                                                                                                                            </td>                                                                                                                                                                                                                                </tr>                                                                                                                                                                                                                                        <tr  id="web_login_access">                                                                            <td class="head" id="WebLoginWay"><script>Capture(management.way_access_web)</script></td>                                                                                                                                                   <td>                                                                                                                                                                                                                                                 <select name="way_access_web">                                                                                    <!--                                                                                    <option value="https" selected = "selected" <% getCfgSelected("way_access_web", "https"); %>><script>Capture(management.https)</script></option>                                                                                             -->                                                                                                                                                                                                                                          <option value="http" <% getCfgSelected("way_access_web", "http"); %>><script>Capture(management.http)</script></option>                                                                                                                      <option value="http&https" <% gethttphttpsSelected("way_access_web", "http&https"); %>><script>Capture(management.http_https)</script></option>                                                                                              </select>                                                                                                                                                                                                                            </td>                                                                                                                                                                                                                                </tr>                                                                                                                                                                                                                                        <tr id="localport_tr">                                                                                                                                                                                                                               <td class="head"><script>Capture(management.localWeb_Port)</script></td>

nvram_
 nvram_get  nvram_set
 nvram_get
 Usage:
   nvram_get  [] []
 command:
   rt2860_nvram_show - display rt2860 values in nvram
   rtdev_nvram_show   - display 2nd ralink device values in nvram
   show    - display values in nvram for 
   gen     - generate config file from nvram for 
   renew   - replace nvram values for  with 
   clear   - clear all entries in nvram for 
 platform:
   2860    - rt2860
   rtdev    - 2nd ralink device
 file:
           - file name for renew command
 nvram_get show
 2860
 nvram_get show 2860

Trying to read data

nvram_get gen file tmp.txt
 Usage:
         nvram_get 2860 lan_ipaddr
 nvram_get 2860 lan_ipaddr
 192.168.11.1
 nvram_get 2860 http_wanport
 nvram_get 2860 http
 nvram_get 2860 httpd
 nvram_get 2860 remote_mgt_https
 nvram_get 2860 remote_mgt
 nvram_get 2860 telnet
 nvram_get 2860 remote_mgt
 nvram_get 2860 remote_ip
 nvram_get 2860 wan_ip

grep “nvram_get 2860” * | grep -i web

grep "nvram_get 2860" * | grep -i web
 check_goahead.sh:DBID_WEB_PORT=nvram_get 2860 DBID_WEB_PORT
 common_lib.sh:  local webport=nvram_get 2860 DBID_WEB_PORT
 common_lib.sh:  local webhttpsport=nvram_get 2860 DBID_WEB_SSL_PORT
 common_lib.sh:  local web_remote_ip=nvram_get 2860 WebRemoteLegalIP
 common_lib.sh:  wireless_access_web=nvram_get 2860 wireless_access_web
 common_lib.sh:  wanwebport=nvram_get 2860 DBID_WEB_PORT
 common_lib.sh:  local webhttpsport=nvram_get 2860 DBID_WEB_SSL_PORT
 common_lib.sh:  lanwebport=nvram_get 2860 lan_webport
 common_lib.sh:  local webport=nvram_get 2860 DBID_WEB_PORT
 common_lib.sh:  local webhttpsport=nvram_get 2860 DBID_WEB_SSL_PORT
 common_lib.sh:  local web_remote_ip=nvram_get 2860 WebRemoteLegalIP
 common_lib.sh:            local teluserpwd=nvram_get 2860 DBID_SUPER_WEB_PASSWORD
 global.sh:webinit=nvram_get 2860 WebInit
 internet.sh:    pass=nvram_get 2860 DBID_SUPER_WEB_PASSWORD
 lan.sh:lan_gw=nvram_get 2860 lan_gateway #for debug, so remote host can access web route from another device in lan port
 nat.sh:webport=nvram_get 2860 DBID_WEB_PORT
 set_ping_rule.sh:       local pinglegaip=nvram_get 2860 WebAclList
 storage.sh:     admPW=nvram_get 2860 DBID_SUPER_WEB_PASSWORD
 storage.sh:     admPW=nvram_get 2860 DBID_SUPER_WEB_PASSWORD
 storage.sh:     admPW=nvram_get 2860 DBID_NORMAL_WEB_PASSWORD
 storage.sh:             admPW=nvram_get 2860 DBID_SUPER_WEB_PASSWORD
 storage.sh:             admPW=nvram_get 2860 DBID_NORMAL_WEB_PASSWORD
 updown_make.sh:         url=nvram_get 2860 websURLFilters
 updown_make.sh:         host=nvram_get 2860 websHostFilters

SSH

Not exactly sure if this does work, but seems like it should.

nvram_get SSH_SERVER_REMOTE_ENABLE

Default status

Enable

nvram_set SSH_SERVER_REMOTE_ENABLE 1

After running above command

Commit changes

nvram_get commit

Reboot

reboot

Change password

Seems like I am missing a step. Seems to change the password in the nvram, but does not actually change it permanently

Get current password

nvram_get 2860 Password
admin

Set Password

nvram_set Password newpassword

Commit Changes and reboot

nvram_set commit
reboot

Helpful links

https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=29181

Uses some of the commands (i.e. nvram_get 2860 HostName )
https://github.com/jameshilliard/hlk-rm04-squashfs-root-1.78/blob/master/sbin/lan.sh

no matching key exchange method found. Their offer: diffie-hellman-group1-sha1

Posted on December 5, 2019 by admin

Work around is to use the -o option and specify KexAlgorithms with the correct option.

ssh -o KexAlgorithms=+diffie-hellman-group1-sha1 admin@192.168.11.1

https://unix.stackexchange.com/questions/340844/how-to-enable-diffie-hellman-group1-sha1-key-exchange-on-debian-8-0#340853

List of errors from devices

The following are errors that are returned when trying to ssh to a device.

Cambium 450i PMP Equipment

Unable to negotiate with 192.168.0.1 port 22: no matching key exchange method found. Their offer: diffie-hellman-group1-sha1,diffie-hellman-group14-sha1

cnMaestro template for setting Username and Passwords for PMP gear

Posted on May 22, 2019 by admin

The following template can be used to set the user name and passwords for cambium pmp gear. Create a new template in cnMaestro, past in the following, change the passwordEncrypted to the hash of your password and run the config.

You can get the hashed password by pulling it out of a current radio config.

{
"userParameters": {
  "authenticationConfig": {
    "accounts": [ 
      { 
        "userName": "admin", 
        "level": 3, 
        "readOnly": false, 
        "passwordEncrypted": "188a934e0246ae248da19400fed83107a" 
      }, 
      { 
        "userName": "root", 
        "level": 3, 
        "readOnly": false, 
        "passwordEncrypted": "188a934e0246ae248da19400fed83107a" 
      } 
    ]
  }
 }
}

cnMaestro configuration for SNMPv3

Posted on May 18, 2019 by admin

The following works for setting the snmpv3 configuration on cambium 450i 900’s. Once applied it’ll run change the SNMP settings and reboot the radio.

You’ll need to find the hashed password which can be found in a config backup.
Change the SNMP username/community as needed.

{
     "userParameters": {
         "snmpConfig": {
             "user2Group": 0,
             "snmpv3EngineId": "007000a9840a003e464e7a",
             "rwAuthPasswordEncrypted": "3e5h24a694a515e81abb6b25986cea91",
             "commStringROnly": "rocommunitystring2",
             "user2PrivPassword": "",
             "user1AuthPassword": "",
             "snmpv3AuthProt": 0,
             "snmpv3TrapEnable": 0,
             "snmpv3PrivProt": 0,
             "snmpMibPerm": 1,
             "roAuthPasswordEncrypted": "3e5h24a694a515e81abb6b25986cea91",
             "commStringRW": "communitystring",
             "userGroup1": 0,
             "user1Enable": 0,
             "snmpv3SecLvl": 2,
             "user2Enable": 0,
             "rwUserName": "Canopy",
             "roUserName": "snmpv3user",
             "roPrivPasswordEncrypted": "3e5h24a694a515e81abb6b25986cea91",
             "userName1": "",
             "snmpPort": 161,
             "rwUserEnable": 0,
             "trapDomainNameAppend": 0,
             "rwPrivPasswordEncrypted": "3e5h24a694a515e81abb6b25986cea91",
             "user1PrivPassword": "",
             "userName2": "",
             "user3PrivPassword": "",
             "user2AuthPassword": "",
             "userName3": "",
             "user3Enable": 0,
             "snmpTrapPort": 162,
             "user3AuthPassword": "",
             "user3Group": 0,
             "trapDelayAfterBootup": 5,
             "snmpIpAccessFilter": [
                 {
                     "address": "192.168.0.0",
                     "netmask": 24
                 },
                 {
                     "address": "10.0.1.0",
                     "netmask": 24
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 },
                 {
                     "address": "0.0.0.0",
                     "netmask": 0
                 }
             ],
             "snmpTrapAddresses": [
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0",
                 "0.0.0.0"
             ]
         },
 }

Incredigeek

Tag Archives: cambium