Actions

Historique

Openbsd apu » Historique » Révision 4

« Précédent | Révision 4/5 (diff) | Suivant »
sacha, 11/11/2020 21:37

Contenu
Firewall OpenBSD on PCEngines APU
Install an OpenBSD image
Getting the OpenBSD image
Write the image to an USB Key
Boot USB & install
Configuration
/etc/sysctl.conf
/root/.profile
/home/sacha/.profile
/etc/ssh/sshd_config
/etc/dhcpd.conf
/etc/resolv.conf
/etc/ntpd.conf
boot sound
Unbound
Install Prometheus node exporter

Firewall
Standard: 1 ADSL

Firewall OpenBSD on PCEngines APU¶

DISCLAIMER: This is not a step by step guide.

This is a toolbox on various config files, scripts (like prometheus startup scripts, sounds on boot...) and various tips (adding hardware power button).

Install an OpenBSD image¶

Getting the OpenBSD image¶

The list of the mirrors is here: https://www.openbsd.org/ftp.html
Get the last version, here 6.5

wget ftp://ftp.irisa.fr/pub/mirrors/OpenBSD/6.5/amd64/install65.fs

Write the image to an USB Key¶

My usb key is on /dev/sde

dd if=install65.fs of=/dev/sde bs=1M

Boot USB & install¶

Select the tty output in 115200 on com0

SeaBIOS (version rel-1.12.0.1-0-g393dc9c)

Press F10 key now for boot menu

Booting from Hard Disk...
Using drive 0, partition 3.
Loading......
probing: pc0 com0 com1 com2 com3 mem[639K 1918M a20=on] 
disk: hd0+ hd1+*
>> OpenBSD/amd64 BOOT 3.43
boot> stty com0 115200
boot> set tty com0
switching console to com>> OpenBSD/amd64 BOOT 3.43
boot>

Replying to answears

Welcome to the OpenBSD/amd64 6.5 installation program.
(I)nstall, (U)pgrade, (A)utoinstall or (S)hell? I

Terminal type? [vt220]
System hostname? (short form, e.g. 'foo') cerbere
Password for root account? (will not echo) 
Password for root account? (again) 
Start sshd(8) by default? [yes] 
Change the default console to com0? [yes] 
Available speeds are: 9600 19200 38400 57600 115200.
Which speed should com0 use? (or 'done') [115200] 
Setup a user? (enter a lower-case loginname, or 'no') [no] 
Since no user was setup, root logins via sshd(8) might be useful.
WARNING: root is targeted by password guessing attacks, pubkeys are safer.
Allow root ssh login? (yes, no, prohibit-password) [no] yes

Available disks are: sd0 sd1.
Which disk is the root disk? ('?' for details) [sd0] 
No valid MBR or GPT.
Use (W)hole disk MBR, whole disk (G)PT or (E)dit? [whole]

80% /
10% swap
10% /var/log

Configuration¶

/etc/sysctl.conf¶

net.inet.ip.forwarding=1
net.inet.gre.allow=1

/root/.profile¶

export PS1="\H|\t|:\w\\$"                                                                                                                                               

umask 022

#export LS_OPTIONS='--color=auto'
alias ls='/usr/local/bin/colorls -G'
alias ll='ls -l'
alias l='ls -lA'
alias d="du --max-depth=1 -h"
#alias carp='ifconfig carp |grep -e "MASTER" -e "BACKUP" && ifconfig -g carp'

# Some more alias to avoid making mistakes:
alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'
alias df='df -h'
alias b='echo "\n IP BLACKLISTED\n========================================================";pfctl -t BLACKLIST -T show;echo "\n TOP 10 states\n========================================================";pfctl -sS |sort -nrk4 |head -n 10 '
echo
echo "________________________________________________________________________"
echo
who
echo "________________________________________________________________________"
echo
last -n 20
echo "________________________________________________________________________"
echo
uptime
echo "________________________________________________________________________"

/home/sacha/.profile¶

# $OpenBSD: dot.profile,v 1.5 2018/02/02 02:29:54 yasuoka Exp $
#
# sh/ksh initialization

PATH=$HOME/bin:/bin:/sbin:/usr/bin:/usr/sbin:/usr/X11R6/bin:/usr/local/bin:/usr/local/sbin:/usr/games
export PATH HOME TERM

export PS1="\H|\t|:\w\\$"

alias ls='colorls -G'
alias ll='ls -l'
alias l='ls -lA'
alias d="du --max-depth=1 -h"

# Some more alias to avoid making mistakes:
alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'
alias df='df -h'

echo " _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _"
echo
echo -n "     " && uname -a
echo
echo " _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _"
echo
w
echo " _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _"
echo && echo

/etc/ssh/sshd_config¶

Port 55555
PasswordAuthentication no
ChallengeResponseAuthentication no

Ajouter le réseau local sur em2 sour la forme 10.10.département/24

/etc/dhcpd.conf¶

En fonction du réseau local, exemple:

subnet 10.10.79.0 netmask 255.255.255.0 {
  range 10.10.79.100 10.10.79.199;
  default-lease-time 600;
  max-lease-time 7200;
  option subnet-mask 255.255.255.0;
  option broadcast-address 10.10.79.255;
  option routers 10.10.79.254;
  option domain-name-servers 10.10.79.254, 185.233.100.100;
  option domain-name "niort.rosedor.fr";
}

echo 'dhcpd_flags="em2"' >>/etc/rc.conf.local

/etc/resolv.conf¶

search brest.openlux.fr 
nameserver 10.10.79.254
lookup file bind

/etc/ntpd.conf¶

# $OpenBSD: ntpd.conf,v 1.14 2015/07/15 20:28:37 ajacoutot Exp $
#
# See ntpd.conf(5) and /etc/examples/ntpd.conf

#listen on 172.16.1.254 
servers fr.pool.ntp.org

boot sound¶

Exemples:

echo -e "l4mn<b.>e8a2mspg+e8c+f+8b2" > /dev/speaker
echo -e "<cd<a#~<a#>f" > /dev/speaker
echo "o2 AAA ml o2l8F P16 o3l16C o2 l4A  l8F o3P16l16C o2 l4A p4 o3 EEE ml l8F P16 o3l16C o2 l4A- l8F o3P16l16C o2 l4A"  > /dev/speaker
echo -e "ec" > /dev/speaker
echo -e "t255l8c.f.afc~c.f.afc~c.f.afc.f.a..f.~c.f.afc~c.f.afc~c.f.afc~c.f.." > /dev/speaker
echo -e "<cd<a#~<a#>f" > /dev/speaker
echo -e "t240<cfcfgagaa#b#>dc<a#a.~fg.gaa#.agagegc.~cfcfgagaa#b#>dc<a#a.~fg.gga.agfgfgf.">/dev/speaker
echo -e "t255cf8f8edc<a>~cf8f8edd#e~ce8cdce8cd.<a>c8c8c#def8af8" > /dev/speaker
echo -e "olcega.a8f>cd2bgc.c8dee2" > /dev/speaker
echo -e "msl16oldcd4mll8pcb-agf+4.g4p4<msl16dcd4mll8pa.a+f+4p16g4" > /dev/speaker
echo -e "l2b.f+.p16a.c+.p l4mn<b.>e8a2mspg+e8c+f+8b2" > /dev/speaker

Beatles
"T255O3< < L2 A > > > L4 C# < A B > L2 C#.L2 N0 L4 C# < L2 B A F#A B A F# L1 E.< < L2 A > > > L4 C# < A B > L2 C#.L2 N0 L4 C# < L2 B A L2 F#.> L4 C# < L2 B A L1 B B L1 N0< < L2 A > > > L4 C# < L2 B > L2 C# < L2 A.> L4 C# < A B > L2 C#.< < L2 A > > > L4 C# < L2 B > C# < L2 A.L4 N0 A L2 B AL2 N0 > L2 C# < B A N0L4 F# A B E A B D A B A G# F# E"

sw
"t136 mn o3 l8 ddgfe-dc o2 b-ag o3 d2. l12 ddd l8 g4 p4 p2 p2 t236 l6 o2 ddd l2 ml g o3 dd mn l6 c o2 ba l2 o3 ml gdd mn l6 c o2 ba ml l2 o3 gdd mn l6 c o2 b o3 c l2 ml o2 a1a4 p4 mn t236 l6 o2 ddd l2 ml g o3 dd mn l6 c o2 ba l2 o3 ml gdd mn l6 c o2 ba ml l2 o3 gdd mn l6 c o2 b o3 c l2 ml o2 a1a4 p4 mn t136 mn o3 l8 p4 mn o2 l8 d4 e4.e o3c o2 bag l12 gab l8 a8. e16f+4d8. d e4.e o3 c o2 bag o3 d8.o2   a16 ml a4a4 mn d4 e4.e O3 c o2 bag l12 gaba8. e16 f+4 o3 d8. d16 l16   g8. fe-8. d c8. o2 b-a8. g o3 d2 t236 l6 o2 ddd l2 ml g o3 dd mn l6 c o2 ba l2 o3 ml gdd mn l6 c o2 ba ml l2 o3 gdd mn l6 co2 b o3c l2 ml o2a1a4 p4 mn t236 l6 o2 ddd l2 ml g o3 dd mn l6 c o2 ba l2 o3 ml gdd mn l6 c o2ba ml l2 o3gdd mn l6 co2bo3c l2 ml o2a1a4 p4 mn l6 o3 mn ddd ml l1 gggg4 p4 p4 mn l12 dddg2"



Reveille: t255l8c.f.afc~c.f.afc~c.f.afc.f.a..f.~c.f.afc~c.f.afc~c.f.afc~c.f..
Close Encounters: <cd<a#~<a#>f
Lord of the Dance (aka Simple Gifts): t240<cfcfgagaa#b#>dc<a#a.~fg.gaa#.agagegc.~cfcfgagaa#b#>dc<a#a.~fg.gga.agfgfgf.
Loony Toons theme: t255cf8f8edc<a>~cf8f8edd#e~ce8cdce8cd.<a>c8c8c#def8af8
standard villain's entrance music: mst200o2ola.l8bc.~a.~>l2d#
a trope from 'The Right Stuff' score by Bill Conti: olcega.a8f>cd2bgc.c8dee2
opening bars of Bach's Toccata and Fugue in D Minor": msl16oldcd4mll8pcb-agf+4.g4p4<msl16dcd4mll8pa.a+f+4p16g4
opening bars of the theme from Star Trek Classic: l2b.f+.p16a.c+.p l4mn<b.>e8a2mspg+e8c+f+8b2

echo 'echo -e "<cd<a#~<a#>f" > /dev/speaker' >> /etc/rc.local
echo '"O3L30cO4L30cO5L30cO5L30g" > /dev/speaker' >> /etc/rc.local

Unbound¶

ln -s /var/unbound/etc/unbound.conf /etc/unbound.conf

# $OpenBSD: unbound.conf,v 1.14 2018/12/16 20:41:30 tim Exp $

server:
        interface: 127.0.0.1
        interface: 172.16.1.254
        #interface: 127.0.0.1@5353      # listen on alternative port
#       interface: ::1
        do-ip6: no

        # override the default "any" address to send queries; if multiple
        # addresses are available, they are used randomly to counter spoofing
        #outgoing-interface: 192.0.2.1
        #outgoing-interface: 2001:db8::53

        access-control: 0.0.0.0/0 refuse
        access-control: 127.0.0.0/8 allow
        access-control: 172.16.1.254/16 allow 
        access-control: ::0/0 refuse
        access-control: ::1 allow

        hide-identity: yes
        hide-version: yes

        # Uncomment to enable DNSSEC validation.
        #
        #auto-trust-anchor-file: "/var/unbound/db/root.key"
        #val-log-level: 2

        # Uncomment to synthesize NXDOMAINs from DNSSEC NSEC chains
        # https://tools.ietf.org/html/rfc8198
        #
        #aggressive-nsec: yes

        # Serve zones authoritatively from Unbound to resolver clients.
        # Not for external service.
        #
        #local-zone: "local." static
        #local-data: "mycomputer.local. IN A 192.0.2.51"
        #local-zone: "2.0.192.in-addr.arpa." static
        #local-data-ptr: "192.0.2.51 mycomputer.local"

        # UDP EDNS reassembly buffer advertised to peers. Default 4096.
        # May need lowering on broken networks with fragmentation/MTU issues,
        # particularly if validating DNSSEC.
        #
        #edns-buffer-size: 1480

        # Use TCP for "forward-zone" requests. Useful if you are making
        # DNS requests over an SSH port forwarding.
        #
        #tcp-upstream: yes

remote-control:
        control-enable: yes
        control-interface: /var/run/unbound.sock

# Use an upstream forwarder (recursive resolver) for some or all zones.
#
#forward-zone:
#       name: "."                               # use for ALL queries
#       forward-addr: 192.0.2.53                # example address only
#       forward-first: yes                      # try direct if forwarder fails

rcctl enable unbound
rcctl start unbound

Install Prometheus node exporter¶

pkg_add go git gmake python-3.6 colorls gnuwatch mtr pftop curl bash 
ln -s /usr/local/bin/python3 /usr/local/bin/python
cd /home/sacha
go get github.com/prometheus/node_exporter
cd /home/sacha/go/src/github.com/prometheus/node_exporter
gmake
mv node_exporter /usr/local/bin/

script de démarage: /etc/rc.d/node_exporter¶

vim /etc/login.conf
(...)
node_exporter:\
  :tc=daemon:

cap_mkdb /etc/login.conf
groupadd -g 2222 _node_exporter
useradd -u 2222 -g 2222 -c "Prometheus Node Exporter agent" -d /var/empty -s /sbin/nologin -L node_exporter _node_exporter

/etc/rc.d/node_exporter

#!/bin/sh
#

daemon="/usr/local/bin/node_exporter"
node_exporter_textfile_dir="/var/node_exporter"
daemon_flags="--collector.textfile.directory==${node_exporter_textfile_dir}"
daemon_user="_node_exporter"
daemon_group="_node_exporter"

. /etc/rc.d/rc.subr

pexp="${daemon}.*"
rc_bg=YES
rc_reload=NO

rc_pre() { 
    if ! id ${daemon_user}; then
        groupadd _node_exporter
        useradd -g _node_exporter -c "Prometheus Node Exporter agent"\
        -d /var/empty -s /sbin/nologin -L node_exporter _node_exporter
    fi
    if [ ! -d ${node_exporter_textfile_dir} ]; then
        install \
            -d \
            -o ${daemon_user} \
            -g ${daemon_group} \
            -m 1755 \
            ${node_exporter_textfile_dir}
    fi
}

rc_start() {
    ${rcexec} "${daemon} ${daemon_flags} < /dev/null 2>&1"
}

rc_cmd $1

chmod 0755 /etc/rc.d/node_exporter
chown root:wheel /etc/rc.d/node_exporter

rcctl enable node_exporter
rcctl start node_exporter

Firewall¶

touch /etc/BLACKLIST
vi /etc/WHITELIST

Standard: 1 ADSL¶

#######################################################
#         Firewall PF - OpenBSD -                     #
# -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- #
# V1.0 - 20190612                                     #
#######################################################


#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#
#               MACROS                  #
#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#

#-----------------------------------------#
#               Interfaces                #
#-----------------------------------------#
#=====----> ADSL
ADSL       = "pppoe0"


#=====----> LAN
LAN             = "em2"
LAN_VoIP        = "em3"

#-----------------------------------------#
#               Hosts                     #
#-----------------------------------------#


#-----------------------------------------#
#       W H I T E  L I S T                #
#-----------------------------------------#
table <WHITELIST> persist file "/etc/WHITELIST"

#-----------------------------------------#
#       B L A C K  L I S T                #
#-----------------------------------------#
table <BLACKLIST> counters persist file "/etc/BLACKLIST"

#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#
#               OPTIONS                 #
#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#
set loginterface $ADSL

#set optimization aggressive
set block-policy drop

set skip on lo0 


#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#
#               LOG                     #
#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#
match log all


#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#
#               NORMALISATION           #
#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#

# Nettoyer les paquets entrant
match in scrub (reassemble tcp random-id)

#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#
#                NAT                    #
#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#
match out on $ADSL inet from ($LAN:network) to any nat-to ($ADSL)

#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#
#               FILTRAGE                #
#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#
block log all

#-----------------------------------------#
#               Anti-Flood                #
#-----------------------------------------#
#NOFLOOD ="synproxy state (source-track rule max-src-conn 500, max-src-conn-rate 50/10, overload <BLACKLIST> flush global)"
NOFLOOD ="keep state (source-track rule, max-src-states 100)"

block in log quick on $ADSL from no-route to any
block out log quick on $ADSL from no-route to any
block in log quick on $ADSL from any to 255.255.255.255

#-----------------------------------------#
#               Blacklists                #
#-----------------------------------------#
block in quick from <BLACKLIST>

block in log quick on $ADSL inet proto icmp from any to any icmp-type redir
block in log quick on $ADSL inet6 proto icmp6 from any to any icmp6-type redir

#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#
#               Anti-spoof                  #
#-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-#
antispoof log quick for $ADSL label "antispoof"

#---------------------------------------#
#               ICMP                    #
#---------------------------------------#
pass inet proto icmp all icmp-type { echorep, echoreq, timex, unreach }

#---------------------------------------#
#               Trace Route             #
#---------------------------------------#
pass in on { $LAN } proto udp from any to any port 33433 >< 33626 keep state

#---------------------------------------#
#               WHITELIST               #
#---------------------------------------#
pass in quick on $ADSL proto tcp from <WHITELIST> to any port 55555 

#---------------------------------------#
#                 LAN                   #
#---------------------------------------#

#=====----> Firewall to Lan
pass out on $LAN inet to $LAN:network


#=====----> ssh LAN
pass in quick on $LAN proto tcp from $LAN:network to $LAN port 55555
#pass in quick proto tcp from any to port 55555

#=====----> dns
pass in quick on $LAN proto udp from $LAN:network to $LAN port 53 

#=====----> dhcp
pass in quick on $LAN inet from $LAN:network to 255.255.255.255 

#=====----> Permit Lan to output
pass in on $LAN inet from $LAN:network to any

pass out on $LAN inet from $LAN:network to any


#---------------------------------------#
#            ACCEPT OUTGOING            #
#---------------------------------------#
pass out on $ADSL

Fichiers (0)

Mis à jour par sacha il y a environ 4 ans · 4 révisions

Projet

Général

Profil

Aquilenet

Wiki