Hi folks,

Don't know if it could be interesting or not, even useful, but past days i was spending my time trying to use an old gsm motorola v150 mobile phone to get access to my host from my palm device with pssh (http://www.sealiesoftware.com/pssh/), these are the steps i did to accomplish it, feel free to suggest or improve it, anyway i found it usefull.

First, this motorolla has an usb interface to the host, it's quite simple to attach the phone to the host running CentOs, i dont like very much usb 'things' but things are like this... anyway, if you do so you'll notice in syslog:

<...> Aug 8 20:54:13 spoolbox kernel: cdc_acm 1-2:1.0: ttyACM0: USB ACM device <...>

Don't know other mobile phones with an usb interface but it could be similar in others with an operational modem (i have to admit that im not an expert in GSM neither telephony...)

Anyway, if you inspect the usb line, you can see:

[root@spoolbox crash]# cat /proc/bus/usb/devices ...> T: Bus=02 Lev=01 Prnt=01 Port=01 Cnt=01 Dev#= 9 Spd=12 MxCh= 0 D: Ver= 1.10 Cls=02(comm.) Sub=00 Prot=00 MxPS= 8 #Cfgs= 1 P: Vendor=22b8 ProdID=3802 Rev= 0.01 S: Manufacturer=Motorola Inc. S: Product=Motorola Phone (V150) C:* #Ifs= 2 Cfg#= 1 Atr=c0 MxPwr= 20mA I: If#= 0 Alt= 0 #EPs= 1 Cls=02(comm.) Sub=02 Prot=01 Driver=cdc_acm --------------- !!!!! E: Ad=89(I) Atr=03(Int.) MxPS= 16 Ivl=10ms I: If#= 1 Alt= 0 #EPs= 2 Cls=0a(data ) Sub=00 Prot=00 Driver=cdc_acm --------------- !!!!! E: Ad=01(O) Atr=02(Bulk) MxPS= 16 Ivl=0ms E: Ad=82(I) Atr=02(Bulk) MxPS= 16 Ivl=0ms ...>

Then, in /dev you will have:

[root@spoolbox crash]# l /dev/ttyACM0 crw------- 1 root root 166, 0 ago 8 20:54 /dev/ttyACM0

In my case, i wasn't sure about this phone modem facilities, and i start playing with init secuences to discover the modem with 'minicom' tool, without success. Finally i decided to use 'wvdialconf' utility to check out my lack of kwlg. :

[root@spoolbox crash]# wvdialconf newconffile Scanning your serial ports for a modem.

Port Scan*1>: S0 S1 S2 S3 S4 S5 S6 S7 ttyACM0*1>: ATQ0 V1 E1 -- OK ttyACM0*1>: ATQ0 V1 E1 Z -- OK ttyACM0*1>: ATQ0 V1 E1 S0=0 -- OK ttyACM0*1>: ATQ0 V1 E1 S0=0 &C1 -- OK ttyACM0*1>: ATQ0 V1 E1 S0=0 &C1 &D2 -- OK ttyACM0*1>: ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 -- OK ttyACM0*1>: Modem Identifier: ATI -- 144 ttyACM0*1>: Speed 4800: AT -- OK ttyACM0*1>: Speed 9600: AT -- OK ttyACM0*1>: Speed 19200: AT -- OK ttyACM0*1>: Speed 38400: AT -- OK ttyACM0*1>: Speed 57600: AT -- OK ttyACM0*1>: Speed 115200: AT -- OK ttyACM0*1>: Speed 230400: AT -- OK ttyACM0*1>: Speed 460800: AT -- OK ttyACM0*1>: Max speed is 460800; that should be safe. ttyACM0*1>: ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 -- OK ttyUSB0*1>: ATQ0 V1 E1 -- failed with 2400 baud, next try: 9600 baud ttyUSB0*1>: ATQ0 V1 E1 -- failed with 9600 baud, next try: 115200 baud ttyUSB0*1>: ATQ0 V1 E1 -- and failed too at 115200, giving up.

Found an USB modem on /dev/ttyACM0. Modem configuration written to newconffile. ttyACM0Info>: Speed 460800; init "ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0"

[root@spoolbox crash]# l newconffile -rw-r----- 1 root root 232 jul 30 18:11 newconffile

[root@spoolbox crash]# cat newconffile

[Dialer Defaults] Modem = /dev/ttyACM0 Baud = 460800 Init1 = ATZ Init2 = ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 ISDN = 0 Modem Type = USB Modem ; Phone = Target Phone Number> ; Username = Your Login Name> ; Password = Your Password>

With this information, i updated the init sequence in 'minicom' parameters:

[root@spoolbox crash]# LANG=C; minicom Welcome to minicom 2.00.0

OPTIONS: History Buffer, F-key Macros, Search History Buffer, I18n Compiled on Feb 21 2005, 19:32:30.

Press CTRL-A Z for help on special keys

ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0 OK

┌──────[Modem and dialing parameter setup]────────────────┐ │ │ │ A - Init string .. ~^M~ATQ0 V1 E1 S0=0 &C1 &D2 +FCLASS=0^M │ │ B - Reset string . ^M~ATZ^M~ │ <...>

I did an AT command and i get the correspoding OK, cool :)

AT OK ATZ OK ATD <phone-number>

And my other mobile phone was ringing with an incomming data call.

Up to here fine since the old motorola phone was able to perform calls, that's not the point unless you want a dial-out line (56k).

What i needed was a dial-in facilities, go on with 'mgetty-sendfax':

First change the /etc/inittab to start using the line:

[root@spoolbox crash]# cat /etc/inittab <...> # Modem back line listen # Data only and two tones b4 connect T1:2345:respawn:/sbin/mgetty ttyACM0 -D /dev/ttyACM0 <...>

To enable dial-in uncomment the corresponding line at '/etc/mgetty +sendfax/login.config' file with the previously created profile:

[root@spoolbox crash]# cat /etc/mgetty+sendfax/login.config

<...> /AutoPPP/ - - /usr/sbin/pppd file /etc/ppp/options.server <...>

You can even trim more for incomming calls using the corresponding features at '/etc/mgetty+sendfax/dialin.config', in my case i left it untouched without restrictions.

And config the line in '/etc/mgetty+sendfax/mgetty.config':

<...> # Motorola V150/Usb connected to ttyACM0/1: don't do fax, less logging # port ttyACM0 debug 9 data-only y speed 460800 <...>

Up to here, you have the line preset correctly, now you have to use it to dial-in.

Create a ppp profile file to use in dial-in whatever the line will be:

[root@spoolbox crash]# cat /etc/ppp/options.server

# Do not fork to become a background process -detach # To allow pppd to work over a rlogin/telnet connection asyncmap 0 # Use the modem control lines modem # Use hardware flow control crtscts # Specifies that pppd use the UUCP-style lock on the serial device lock # Adds an entry into the ARP table with the IP address of the client and the IP address of the NIC proxyarp # # Auth: # PAP (Password Authentication Protocol) is one of the two protocols that PPP uses to authenticate # peers. # The other is CHAP (Challenge Handshake Authentication Protocol). # CHAP is a more secure protocol, but is not as widely supported as PAP require-pap refuse-chap #require-chap #refuse-pap # if 'login' option (follows) is used, the file /etc/ppp/pap-secrets need not exist. In fact, it # might interfere with the proper functioning of PAP. You can remove the file, or it can contain # the following line: # * * "" # The advantage of maintaining /etc/ppp/pap-secrets with this line is that it leaves you the option # of denying PPP access to individual accounts that have entries in /etc/passwd. To do so, below # the above line, enter the following line: # username * - # where "username" is the username of the account you wish to deny PPP access. Example: # #user server secret addrs # * * "" * # jdoe * - * # #login # The first DNS server IP address for this network. ms-dns 192.168.0.1 # The second DNS server IP address for this network. ms-dns 62.42.230.24

Third, create the specific profile for /dev/ttyACM0 line, where our phone is:

[root@spoolbox crash]# cat /etc/ppp/options.ttyACM0 # The first IP address is the servers IP address, the second IP address is # the free static IP address that can be assigned to the computer dialing # in on the modem. This number cannot be in use. 192.168.0.3:192.168.0.69 # The net mask of the LAN the server is connected to. netmask 255.255.255.0

And since we are using PAP to auth, create the password at /etc/ppp/pap.secrets:

[root@spoolbox crash]# cat /etc/ppp/pap-secrets # Secrets for authentication using PAP # client server secret IP addresses sm0ketst * password *

Now, let's see what's happeninig with all of this stuff:

# telinit q

And check out the syslog:

<...> Aug 8 21:25:49 spoolbox init: Re-reading inittab <...>

And check also '/var/log/mgetty.log.ttyACM0':

[root@spoolbox ~]# tail -F /var/log/mgetty.log.ttyACM0 <...> -- 08/08 20:58:28 CM0 mgetty: experimental test release 1.1.31-Jul24 08/08 20:58:28 CM0 check for lockfiles 08/08 20:58:28 CM0 checklock: no active process has lock, will remove 08/08 20:58:28 CM0 locking the line 08/08 20:58:28 CM0 makelock(ttyACM0) called 08/08 20:58:28 CM0 do_makelock: lock='/var/lock/LCK..ttyACM0' 08/08 20:58:28 CM0 lock made 08/08 20:58:29 CM0 tio_get_rs232_lines: status: RTS CTS DTR 08/08 20:58:29 CM0 WARNING: DSR is off - modem turned off or bad cable? 08/08 20:58:29 CM0 lowering DTR to reset Modem 08/08 20:58:29 CM0 tss: set speed to 460800 (10004) 08/08 20:58:29 CM0 tio_set_flow_control( HARD ) 08/08 20:58:29 CM0 waiting for line to clear (VTIME=1), read: 08/08 20:58:30 CM0 send: \dATQ0V1H0[0d] 08/08 20:58:30 CM0 waiting for ``OK'' 08/08 20:58:30 CM0 got: ATQ0V1H0[0d] 08/08 20:58:30 CM0 CND: ATQ0V1H0[0d][0a]OK ** found ** 08/08 20:58:30 CM0 send: ATS0=0Q0&D3&C1[0d] 08/08 20:58:30 CM0 waiting for ``OK'' 08/08 20:58:30 CM0 got: [0d] 08/08 20:58:30 CM0 CND: OK[0a]ATS0=0Q0&D3&C1[0d] 08/08 20:58:30 CM0 CND: ATS0=0Q0&D3&C1[0d][0a]OK ** found ** 08/08 20:58:30 CM0 waiting for line to clear (VTIME=3), read: [0d][0a] 08/08 20:58:30 CM0 removing lock file 08/08 20:58:30 CM0 waiting...

Up to here, the hard part is done except the netfilter part i'll show later, but from now we can ring our motorola to get access from 'pssh' in our palm device (in my case i use a bluetooth conn with a Nokia 6600).

If we also want to get access the network from palm device, you have to tweak the /etc/sysconfig/iptables file in the host where the phone is connected in the following way:

a) At the top of the file, add the following lines:

# Firewall configuration written by system-config-securitylevel # Manual customization of this file is not recommended. *filter :INPUT ACCEPT [0:0] :FORWARD ACCEPT [0:0] :OUTPUT ACCEPT [0:0] :RH-Firewall-1-INPUT - [0:0]

# Rule for sharing eth0 with ppp0/ttyACM0 <------- ADD -A FORWARD -i ppp0 -j ACCEPT <------- ADD

-A INPUT -j RH-Firewall-1-INPUT -A FORWARD -j RH-Firewall-1-INPUT <...>

b) At the end of the file, add the following lines:

<...> # Rest -A RH-Firewall-1-INPUT -j REJECT --reject-with icmp-host-prohibited COMMIT

# Rule for dial-in network sharing # Remark: Remember to update the /etc/sysctl.conf # Controls IP packet forwarding # net.ipv4.ip_forward = 1 # or # echo 1 > /proc/sys/net/ipv4/ip_forward *nat :PREROUTING ACCEPT [0:0] :POSTROUTING ACCEPT [0:0] :OUTPUT ACCEPT [0:0] -A POSTROUTING -o eth0 -j MASQUERADE COMMIT

And as you can see, enable packet forwarding by hand or in '/etc/sysctl.conf'

After that restart iptables

[root@spoolbox ~]# service iptables restart

And check out the 'whole thing':

1st- enable bluetooth on phone, 2nd- enable bluetooth on palm, and connect

[root@spoolbox ~]# tail -F /var/log/mgetty.log.ttyACM0 <...> -- 08/08 21:38:50 CM0 select returned 1 08/08 21:38:50 CM0 checking lockfiles, locking the line 08/08 21:38:50 CM0 makelock(ttyACM0) called 08/08 21:38:50 CM0 do_makelock: lock='/var/lock/LCK..ttyACM0' 08/08 21:38:50 CM0 lock made 08/08 21:38:50 CM0 wfr: waiting for ``RING'' 08/08 21:38:50 CM0 got: [0d][0a]RING[0d] 08/08 21:38:50 CM0 CND: RING 08/08 21:38:50 CM0 wfr: rc=0, drn=0 08/08 21:38:50 CM0 CND: check no: 'none' 08/08 21:38:50 CM0 send: ATA[0d] 08/08 21:38:50 CM0 waiting for ``CONNECT'' 08/08 21:38:50 CM0 got: ATA[0d] 08/08 21:38:50 CM0 CND: OKATA[0d][0a]CONNECT ** found ** 08/08 21:39:03 CM0 send: 08/08 21:39:03 CM0 waiting for ``_'' 08/08 21:39:03 CM0 got: [0d] 08/08 21:39:03 CM0 CND: CONNECT[0a] ** found ** 08/08 21:39:03 CM0 waiting for line to clear (VTIME=3), read: 08/08 21:39:03 CM0 looking for utmp entry... (my PID: 14150) 08/08 21:39:03 CM0 utmp + wtmp entry made 08/08 21:39:04 CM0 tio_set_flow_control( HARD ) 08/08 21:39:04 CM0 print welcome banner (/etc/issue) 08/08 21:39:04 CM0 getlogname (AUTO_PPP), read:~[ff]}#[c0]! 08/08 21:39:05 CM0 input finished with '\r', setting ICRNL ONLCR 08/08 21:39:05 CM0 tio_get_rs232_lines: status: RTS CTS DSR DTR DCD RI 08/08 21:39:05 CM0 login: use login config file /etc/mgetty +sendfax/login.config 08/08 21:39:05 CM0 match: user='/AutoPPP/', key='' 08/08 21:39:05 CM0 match: user='/AutoPPP/', key='' 08/08 21:39:05 CM0 match: user='/AutoPPP/', key='/AutoPPP/'*** hit! 08/08 21:39:05 CM0 calling login: cmd='/usr/sbin/pppd', argv[]='pppd file /etc/ppp/options.server' 08/08 21:39:05 CM0 setenv: 'CALLER_ID=none' 08/08 21:39:05 CM0 setenv: 'CONNECT=' 08/08 21:39:05 CM0 setenv: 'DEVICE=ttyACM0' 08/08 21:39:05 ##### data dev=ttyACM0, pid=14150, caller='none', conn='', name='', cmd='/usr/sbin/pppd', user='/AutoPPP/'

And in syslog:

<...> Aug 8 21:39:05 spoolbox mgetty[14150]: data dev=ttyACM0, pid=14150, caller='none', conn='', name='', cmd='/usr/sbin/pppd', user='/AutoPPP/' Aug 8 21:39:05 spoolbox pppd[14150]: pppd 2.4.2 started by LOGIN, uid 0 Aug 8 21:39:05 spoolbox pppd[14150]: Using interface ppp0 Aug 8 21:39:05 spoolbox pppd[14150]: Connect: ppp0 <--> /dev/ttyACM0 Aug 8 21:39:10 spoolbox pppd[14150]: PAP peer authentication succeeded for sm0ketst Aug 8 21:39:13 spoolbox pppd[14150]: found interface eth0 for proxy arp Aug 8 21:39:13 spoolbox pppd[14150]: local IP address 192.168.0.3 Aug 8 21:39:13 spoolbox pppd[14150]: remote IP address 192.168.0.69

When disconnected syslog will show: <...> Aug 8 21:40:38 spoolbox pppd[14150]: IPCP terminated by peer Aug 8 21:40:39 spoolbox pppd[14150]: LCP terminated by peer Aug 8 21:40:42 spoolbox pppd[14150]: Connection terminated. Aug 8 21:40:42 spoolbox pppd[14150]: Connect time 1.6 minutes. Aug 8 21:40:42 spoolbox pppd[14150]: Sent 98 bytes, received 86 bytes. Aug 8 21:40:42 spoolbox pppd[14150]: Connect time 1.6 minutes. Aug 8 21:40:42 spoolbox pppd[14150]: Sent 98 bytes, received 86 bytes. Aug 8 21:40:42 spoolbox pppd[14150]: Exit.

And the mgetty log (/var/log/mgetty.log.ttyACM0) <...> -- 08/08 21:40:42 CM0 mgetty: experimental test release 1.1.31-Jul24 08/08 21:40:42 CM0 check for lockfiles 08/08 21:40:42 CM0 checklock: no active process has lock, will remove 08/08 21:40:42 CM0 locking the line 08/08 21:40:42 CM0 makelock(ttyACM0) called 08/08 21:40:42 CM0 do_makelock: lock='/var/lock/LCK..ttyACM0' 08/08 21:40:42 CM0 lock made 08/08 21:40:43 CM0 tio_get_rs232_lines: status: RTS CTS DSR DTR DCD RI 08/08 21:40:43 CM0 WARNING: DCD line still active, check modem settings (AT&Dx) 08/08 21:40:43 CM0 lowering DTR to reset Modem 08/08 21:40:43 CM0 tss: set speed to 460800 (10004) 08/08 21:40:43 CM0 tio_set_flow_control( HARD ) 08/08 21:40:43 CM0 waiting for line to clear (VTIME=1), read: [0a][0a]NO CARRIER[0a][0a] 08/08 21:40:43 CM0 send: \dATQ0V1H0[0d] 08/08 21:40:44 CM0 waiting for ``OK'' 08/08 21:40:44 CM0 got: ATQ0V1H0[0d] 08/08 21:40:44 CM0 CND: ATQ0V1H0[0d][0a]OK ** found ** 08/08 21:40:44 CM0 send: ATS0=0Q0&D3&C1[0d] 08/08 21:40:44 CM0 waiting for ``OK'' 08/08 21:40:44 CM0 got: [0d] 08/08 21:40:44 CM0 CND: OK[0a]ATS0=0Q0&D3&C1[0d] 08/08 21:40:44 CM0 CND: ATS0=0Q0&D3&C1[0d][0a]OK ** found ** 08/08 21:40:44 CM0 waiting for line to clear (VTIME=3), read: [0d][0a] 08/08 21:40:44 CM0 removing lock file 08/08 21:40:44 CM0 waiting...

Now you can get shell access from your palm, use your favourite www palm browser and send-receive emails, etc... with some tweaks from your palm, all of this using your host as your gateway.

I think that's all and i didn't forget anything, feel free to knock the door on me if something fails... but since phone companies are providing no-cost for certain calls, i found it usefull to get a shell on my palm to launch certain commands on the host at 0-cost, yes, at 56K, but it's free :)

Jose.