Secure the RTSP stream with a password about xiaomi-dafang-hacks

[kszere]

Please try:
/system/sdcard/bin/busybox nohup /system/sdcard/bin/v4l2rtspserver-master -fMJPG -U admin:pass &>/dev/null &

[wojtulab]

You can also use a md5 password :)
Password schema is: 'md5(<username>:<realm>:<password>')
in this case the realm is a hostname for example dafanghacks

it will be sth like that:
/system/sdcard/bin/v4l2rtspserver-master -A -R rbpi -U wb:f58a07f32ff7648ds8731f16a1acsdx1

[lloydwatkin]

For anyone else who tries to find this out, this is now configurable via 'video' option in the UI.

[EliasKotlyar]

Hello @rcheung81 ,

You need to edit the action.cgi and add some parameters to the v4l2rtspserver strings:

-U foo:bar -U admin:admin

Refer to:
https://github.com/mpromonet/v4l2rtspserver

[swieprecht]

Hi Elias,
Can you treat me like a complete idiot, as it seems thats what I am...
Trying to setup a password but having no luck at all.
I've got it setup to the point I can see the rtsp on VLC and on Chrome, but not password is needed.
I can SSH in, but it isnt like standard linux so can't Sudo or Nano any changes. How do I do the above?
I tried to also do the password to get in to the web interface by changing the two files in config, but once done it just gave me connection refused messages when accessing the IP.
Scott

[EliasKotlyar]

Hello @swieprecht ,

You need to change the "action.cgi" and add some parameters to the "v4l2rtspserver"-calls. Like:

v4l2rtspserver -U admin:admin

Also, its not a normal linux, cause the camera is lacking resources. However you can install some programs using the crosscompile-environment.

[swieprecht]

If I run that on Putty I get: -sh: v4l2rtspserver: not found

[link47]

Like @swieprecht I'm also looking to password protect the RTSP stream from outside access.

Just reporting @kszere's solution worked for me, thanks!

[helio58]

Hi, I see this is closed.
I have try @kszere's solution, but is not working anymore.
Is there another way ?
Thanks

[helio58]

Sorry it was my misstake . It works well 👍

[Merwenus]

What was the mistake exactly? Because using this does exactly nothing, I still can see the stream without username and password.

/system/sdcard/bin/busybox nohup /system/sdcard/bin/v4l2rtspserver-master -fMJPG -U myusername:randompassword>/dev/null &

[mixpc]

Simple question. Is @kszere solution permament? If not, how could it be made permanent? Because I tried editing rtspserver.conf but after updating resolution via webinterface, my RTSPH264OPTS="-U user:password" vanished. Thank you!

[jmtatsch]

RTSPH264OPTS is overwritten once you change the resolution. Of course you could split the OPTS and set them individually. I would gladly accept a pull request.

[nik0]

@jmtatsch my last commit add the login/password/port configuration

[jmtatsch]

Awesome, thank you @nik0

[S-P-J]

Is there any way or anywhere I can find simple instructions for a moron with one brain cell on how to hack my da fang camera as every site and instruction that I have looked at and read leaves me completely in the dark with vague instructions and words/instructions that I don't understand from the very begining?

Is the stream connection secure? ( Https) ??

[jmtatsch]

You can set a password to access it but I don't think it is encrypted.

can it be brute-forced?

[jmtatsch]

Sure

[S-P-J]

I'm just trying to to get someone to indicate what setups are available to use with our Mi Walkie Talkies to make operating a boat easier. Voice activated transmit might be helpful. Regards, Shaun. Sent from Yahoo Mail on Android On Tue, 17 Sep 2019 at 3:12, jmtatsch<[email protected]> wrote: Sure — You are receiving this because you commented. Reply to this email directly, view it on GitHub, or mute the thread.