Help getting started #5
Comments
|
Bump, I'm in the same boat as you. I have the b22 original kickstarted lifx bulbs. Initially they were coming up as a secured SSID, which I connected to using the default "lifx1234" password. However they failed to get connected to the wifi network in the lifx app and now won't show up at all as a network in wifi list; no matter how many times I reset them (but flipped the switch which is on these first generation bulbs). So yes, any help and guidance for a dumb idiot like me would be immensely grateful. When the bulbs turn onn (after a rest); they flash red/green/blue and then apart from the slight dimming (which I think indicates they are in recovery mode), it would be nice to know how to get these rediscoverable as an SSID in the network list. Then a step by step guide on how to implement your python script would be fantastic. I'm using macOS. |
|
Unfortunately I'm not going to be able to help if the factory reset of the bulbs doesn't work. You need to get them back to a state where their own wifi AP is active, so you can onboard them. If factory reset isn't working, I'd suggest contacting LIFX directly, or maybe try their developer forum (https://community.lifx.com/). As for using this script, it shouldn't be necessary to clone the whole repo or make a package or anything. You should only need the onboard.py script itself. If you go to https://github.com/tserong/lifx-hacks/blob/master/onboard.py, over on the right, just above the script itself, are a few little buttons, one labelled "raw", then two to the right of that there's a download button. That should download the script. Once you've got the script on your laptop/desktop/whatever computer, you need to:
I don't have Mac OS, but let's pretend your downloaded files end up in a directory called Downloads. You'll want to do something like this: But replace SSID and PASSWORD with your actual wifi SSID and password. If these contain spaces you'll need to put them in quotes, e.g. 'ssid with spaces'. As an alternative to making the script executable ( |
|
Thanks Tim! I managed to reset the bulbs and get them to broadcast their Wifi AP. I followed the steps you provided, and in the terminal window I get the return command: Where PASSWORD is my actual password. Also thanks for the response, I wasn't expecting you would still be active on here. What a pleasant surprise. I should add that my password contains a special character (an asterisk). Would that be part of the reason why it's returning that command line error? |
Yeah, the '*' is probably making zsh try to treat the password as a filename to be expanded. Try sticking the password in quotes e.g. 'PASSWORD' or "PASSWORD" (this can get fiddly if your password also contains quote characters too) |
|
Ok, that seemed to do something. This is what I got back: Did it work? It's still broadcasting as a protected wifi AP: Am I suppose to run through the normal process of connecting it via the lifx app afterwards or should this step be covered by the onboard.py file and automatically appear in the lifx app under the network? |
|
No, alas, the fact that you got that error means the script failed to connect to the bulb, due to some problem making a secure connection. That the bulb's AP is still visible means it's not onboarded. I've done some further testing here and as best as I can tell newer versions of python don't allow certain older SSL ciphers / key sizes, which the Lifx bulb is presumably using. I need to experiment a bit more to see if I can "fix" (i.e. workaround) this. |
|
Let me know how I can help, if at all possible. Given your hypothesis around new python version being the limitation, would it be worth me trying to download and install a legacy version of Python on my Mac to see if I can get around this issue? If so, what version would you suggest? For reference, my lifx bulbs are around 10 years old I believe (from the original kickstarter). |
|
Let's not worry about trying to get an older python installed just yet :-) I happen to have an original bulb here, and I think I've found a way to solve this. Please try downloading this different version of the script, and use it in place of the one you downloaded before: https://github.com/tserong/lifx-hacks/blob/wip-support-ancient-bulbs/onboard.py Note lines 63-65 mention TLSv1, @SECLEVEL=0 and OP_LEGACY_SERVER_CONNECT. That's the magic that should make it talk to the original bulbs. If it works, you should see no errors, and the text "LIFX bulb probably onboarded. Best of luck ;-)". Once that's done, if you open the LIFX app, it should find the bulb and give you the option to finish setting it up. |
|
I love that you named it "support-ancient-bulbs" lol. Here is what I get back; note it comes back instantly as soon as I hit 'y' to continue: |
|
Thanks :-) I assume it doesn't like "ALL" (that worked fine for me, but then I'm testing on Linux, not Mac OS X, so there'll be some differences). If you don't mind indulging me, please try re-downloading https://github.com/tserong/lifx-hacks/blob/wip-support-ancient-bulbs/onboard.py and give it another shot. I've updated the If that works, great! If it doesn't work, please run the following commands in the terminal, and copy-and-paste their output in here, so I know exactly what openssl version and ciphers are available: Also, if it didn't work with the long list of ciphers, you might try commenting out line 65 of the script (put a '#' at the start), and un-commenting line 66 (remove the '#' at the start), so it only tries to use AES256-SHA, which appears to be the cipher used by my original Lifx bulb. |
|
Happy to indulge! When running the re-downloaded script as is: Altering the script (in Xcode, unsure if that matters) according to your instructions: 
Resulting returned error: Openssl Version: Openssl Ciphers: Also thanks for such rapid responses, especially on a weekend 😌 Is there anyway I can check what cipher is being used on my Lifx bulbs or is it trial and error? |
Hey, I'm delighted you're happy to try stuff! I'm intrigued as to why this isn't working, and I'm sure you won't be the only person to need this fixed, so here we are :-)
You can try running this from a terminal:
That will just try to open a connection to the bulb, but will otherwise do nothing. Assuming it works it'll print out a whole bunch of stuff including the server certificate and ciphers being used, then you can hit CTRL-C to kill it. Can you please paste the output of that in here too? I've also done a little more digging and it looks like libressl 3.3.6 might not understand SECLEVEL. It may be interesting to see if just dropping that bit works, e.g., try each of these variants on |
|
I connected to the Wifi AP of each bulb; ran With Result (note this is the longest I've seen it 'thinking' before returning a result): This was the exactly the same result for the other two variants you provided as well. Seeing |
|
That output is almost the same as what I get with OpenSSL 3.1.1: The difference is, with OpenSSL I can make it play nice like this: I've now built a local copy of LibreSSL 3.3.6 and I'm getting the same thing with that as you are: I still need to figure out what I need to do differently with LibreSSL to get it to work, given that version doesn't support @SECLEVEL |
|
I'm not technically minded so again forgive the dumb question. Is this a macOS issue or a Lifx Bulb issue? If macOS issue, would it be solved by updating LibreSSL? |
It's not a dumb question :-)
I'd argue it's a bit of both. The underlying problem is that the original Lifx bulbs apparently only support TLSv1 (that's a version of the protocol used for doing secure web connections, e.g. HTTPS). That protocol version was apparently officially deprecated in 2021, i.e. shouldn't be used anymore, because v1 uses older, crappier ciphers and hash algorithms than are available in the newer TLSv1.2 and v1.3. Presumably because of that deprecation, newer versions of openssl/libressl have TLSv1 turned off by default, which is what I'm trying to turn back on by messing with SECLEVEL and other options.
Maybe. I've done a quick test with libressl 3.8.0, which looks promising (at least I seem to see a connection and a certificate now). Do you know what newer versions of LibreSSL you have available to install? Alternately, if you have access to an older system (laptop, desktop, whatever) from a few years back, that might work too, as older versions would presumably still support the older TLSv1 out of the box. |
It looks like I can install LibreSSL 3.8.0 through macports. Would you suggest I do so?
I tried on a macbook pro 2014 model, running LibreSSL 2.8.3. For reference I used the latest 'onboard.py' in this issue's thread; with line 66 changed to |
|
It should complete almost instantly (think: seconds, not minutes), so you should kill it if you didn't already :-) What happens if you try I don't know if installing LibreSSL 3.8.0 will actually help or not, but if you're up for it, may as well give it a shot. Worst case I assume you can just uninstall it again if it doesn't help? |
|
hey Amazing to find this script !!! Trying to get it to work... ( it would be SO amazing to finally own the onboarding :) I didn't get the cipher to work so I added the write to disk hack..but now I'm getting this error... openssl s_client -connect 172.16.0.1:56700 < onboard.packet Any ideas ? :) ..from what I understand of the above it seems the bulb is listening...but it just sits there and don't seem to attempt using the new credentials ? |
|
Also tried this... openssl s_client -cipher @SECLEVEL=0:ALL -legacy_renegotiation -connect 172.16.0.1:56700 Connecting to 172.16.0.1 |
Hi,
I am relatively new to Linux, so please forgive my ignorance about any questions.
But I was able to clone into your repo, run
makepkg -si, and cd into/lifx-onboard-git/pkg//lifx-onboard-git/usr/bin.Then I tried to run
./onboard <ssid> <password>with my network credentials in place of "ssid" & "password".Nothing happened for a few seconds, then the output was:
I do know how to edit files with Nano. And was a little confused when saw 'lines 1342/1329' because I was like, <<hold on, there aren't even that many lines in this script? ;'D >>
Basically, I'm not sure what I should be doing, or in what order to go about doing it ^-^'
I have used Lifx bulbs in the past by connecting them to a 2GHz network via the iOS app. But have since become more concerned about privacy issues, especially in the mobile apps department. So for that reason, I haven't tried it with the Android app.
However, I did find your short play to be very entertaining & quite reflective of my own frustrations about these things (minus all the upper-level technical expertise, that I do not have! ;'D )
Is there a series of basic steps you could give on how to get the bulbs connected to a network? And am I even in the right place trying the script for that purpose?
Appreciate in advance any help or insight you might have :-)
The text was updated successfully, but these errors were encountered: