Projet

Général

Profil

Openbsd apu » Historique » Révision 4

Révision 3 (sacha, 11/11/2020 21:37) → Révision 4/5 (sacha, 11/11/2020 21:37)

> > {{\>toc}} 

 # Firewall OpenBSD on PCEngines APU 

 **DISCLAIMER: DISCLAIMER: This is not a step by step guide.** guide. 

 This is a toolbox on various config files, scripts (like prometheus startup scripts, sounds on boot...) and various tips (adding hardware power button). 


 ## Install an OpenBSD image 


 ### Getting the OpenBSD image  

 The list of the mirrors is here: https://www.openbsd.org/ftp.html 
 Get the last version, here 6.5 

 ~~~ 
 wget ftp://ftp.irisa.fr/pub/mirrors/OpenBSD/6.5/amd64/install65.fs 
 ~~~ 

 ### Write the image to an USB Key 

 My usb key is on /dev/sde 

 ~~~ 
 dd if=install65.fs of=/dev/sde bs=1M 
 ~~~ 

 ### Boot USB & install 

 Select the tty output in 115200 on com0 

 ~~~ 
 SeaBIOS (version rel-1.12.0.1-0-g393dc9c) 

 Press F10 key now for boot menu 

 Booting from Hard Disk... 
 Using drive 0, partition 3. 
 Loading...... 
 probing: pc0 com0 com1 com2 com3 mem[639K 1918M a20=on]  
 disk: hd0+ hd1+* 
 >> OpenBSD/amd64 BOOT 3.43 
 boot> stty com0 115200 
 boot> set tty com0 
 switching console to com>> OpenBSD/amd64 BOOT 3.43 
 boot> 
 ~~~ 

 Replying to answears 
 ~~~ 
 Welcome to the OpenBSD/amd64 6.5 installation program. 
 (I)nstall, (U)pgrade, (A)utoinstall or (S)hell? I 

 Terminal type? [vt220] 
 System hostname? (short form, e.g. 'foo') cerbere 
 Password for root account? (will not echo)  
 Password for root account? (again)  
 Start sshd(8) by default? [yes]  
 Change the default console to com0? [yes]  
 Available speeds are: 9600 19200 38400 57600 115200. 
 Which speed should com0 use? (or 'done') [115200]  
 Setup a user? (enter a lower-case loginname, or 'no') [no]  
 Since no user was setup, root logins via sshd(8) might be useful. 
 WARNING: root is targeted by password guessing attacks, pubkeys are safer. 
 Allow root ssh login? (yes, no, prohibit-password) [no] yes 

 Available disks are: sd0 sd1. 
 Which disk is the root disk? ('?' for details) [sd0]  
 No valid MBR or GPT. 
 Use (W)hole disk MBR, whole disk (G)PT or (E)dit? [whole]  
 ~~~ 

 80% / 
 10% swap 
 10% /var/log 

 ### Configuration 


 #### /etc/sysctl.conf        
                                                                                                                                   
 ~~~ 
 net.inet.ip.forwarding=1 
 net.inet.gre.allow=1 

 ~~~ 

 #### /root/.profile 

 ~~~ 
 export PS1="\H|\t|:\w\\$"                                                                                                                                                

 umask 022 

 #export LS_OPTIONS='--color=auto' 
 alias ls='/usr/local/bin/colorls -G' 
 alias ll='ls -l' 
 alias l='ls -lA' 
 alias d="du --max-depth=1 -h" 
 #alias carp='ifconfig carp |grep -e "MASTER" -e "BACKUP" && ifconfig -g carp' 

 # Some more alias to avoid making mistakes: 
 alias rm='rm -i' 
 alias cp='cp -i' 
 alias mv='mv -i' 
 alias df='df -h' 
 alias b='echo "\n IP BLACKLISTED\n========================================================";pfctl -t BLACKLIST -T show;echo "\n TOP 10 states\n========================================================";pfctl -sS |sort -nrk4 |head -n 10 ' 
 echo 
 echo "________________________________________________________________________" 
 echo 
 who 
 echo "________________________________________________________________________" 
 echo 
 last -n 20 
 echo "________________________________________________________________________" 
 echo 
 uptime 
 echo "________________________________________________________________________" 
 ~~~ 

 #### /home/sacha/.profile 

 ~~~ 
 # $OpenBSD: dot.profile,v 1.5 2018/02/02 02:29:54 yasuoka Exp $ 
 # 
 # sh/ksh initialization 

 PATH=$HOME/bin:/bin:/sbin:/usr/bin:/usr/sbin:/usr/X11R6/bin:/usr/local/bin:/usr/local/sbin:/usr/games 
 export PATH HOME TERM 

 export PS1="\H|\t|:\w\\$" 

 alias ls='colorls -G' 
 alias ll='ls -l' 
 alias l='ls -lA' 
 alias d="du --max-depth=1 -h" 

 # Some more alias to avoid making mistakes: 
 alias rm='rm -i' 
 alias cp='cp -i' 
 alias mv='mv -i' 
 alias df='df -h' 

 echo " _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _" 
 echo 
 echo -n "       " && uname -a 
 echo 
 echo " _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _" 
 echo 
 w 
 echo " _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _" 
 echo && echo 


 ~~~ 

 #### /etc/ssh/sshd_config 

 ~~~ 
 Port 55555 
 PasswordAuthentication no 
 ChallengeResponseAuthentication no 
 ~~~ 

 + Ajouter le réseau local sur em2 sour la forme 10.10.département/24 

 #### /etc/dhcpd.conf 

 En fonction du réseau local, exemple: 

 ~~~ 
 subnet 10.10.79.0 netmask 255.255.255.0 { 
   range 10.10.79.100 10.10.79.199; 
   default-lease-time 600; 
   max-lease-time 7200; 
   option subnet-mask 255.255.255.0; 
   option broadcast-address 10.10.79.255; 
   option routers 10.10.79.254; 
   option domain-name-servers 10.10.79.254, 185.233.100.100; 
   option domain-name "niort.rosedor.fr"; 
 } 
 ~~~ 

 ~~~ 
 echo 'dhcpd_flags="em2"' >>/etc/rc.conf.local 
 ~~~ 


 #### /etc/resolv.conf  

 ~~~ 
 search brest.openlux.fr  
 nameserver 10.10.79.254 
 lookup file bind 
 ~~~ 


 #### /etc/ntpd.conf 

 ~~~ 
 # $OpenBSD: ntpd.conf,v 1.14 2015/07/15 20:28:37 ajacoutot Exp $ 
 # 
 # See ntpd.conf(5) and /etc/examples/ntpd.conf 

 #listen on 172.16.1.254  
 servers fr.pool.ntp.org 

 ~~~ 

 #### boot sound 

 * Exemples: 

 ~~~ 
 echo -e "l4mn<b.>e8a2mspg+e8c+f+8b2" > /dev/speaker 
 echo -e "<cd<a#~<a#>f" > /dev/speaker 
 echo "o2 AAA ml o2l8F P16 o3l16C o2 l4A    l8F o3P16l16C o2 l4A p4 o3 EEE ml l8F P16 o3l16C o2 l4A- l8F o3P16l16C o2 l4A"    > /dev/speaker 
 echo -e "ec" > /dev/speaker 
 echo -e "t255l8c.f.afc~c.f.afc~c.f.afc.f.a..f.~c.f.afc~c.f.afc~c.f.afc~c.f.." > /dev/speaker 
 echo -e "<cd<a#~<a#>f" > /dev/speaker 
 echo -e "t240<cfcfgagaa#b#>dc<a#a.~fg.gaa#.agagegc.~cfcfgagaa#b#>dc<a#a.~fg.gga.agfgfgf.">/dev/speaker 
 echo -e "t255cf8f8edc<a>~cf8f8edd#e~ce8cdce8cd.<a>c8c8c#def8af8" > /dev/speaker 
 echo -e "olcega.a8f>cd2bgc.c8dee2" > /dev/speaker 
 echo -e "msl16oldcd4mll8pcb-agf+4.g4p4<msl16dcd4mll8pa.a+f+4p16g4" > /dev/speaker 
 echo -e "l2b.f+.p16a.c+.p l4mn<b.>e8a2mspg+e8c+f+8b2" > /dev/speaker 

 Beatles 
 "T255O3< < L2 A > > > L4 C# < A B > L2 C#.L2 N0 L4 C# < L2 B A F#A B A F# L1 E.< < L2 A > > > L4 C# < A B > L2 C#.L2 N0 L4 C# < L2 B A L2 F#.> L4 C# < L2 B A L1 B B L1 N0< < L2 A > > > L4 C# < L2 B > L2 C# < L2 A.> L4 C# < A B > L2 C#.< < L2 A > > > L4 C# < L2 B > C# < L2 A.L4 N0 A L2 B AL2 N0 > L2 C# < B A N0L4 F# A B E A B D A B A G# F# E" 

 sw 
 "t136 mn o3 l8 ddgfe-dc o2 b-ag o3 d2. l12 ddd l8 g4 p4 p2 p2 t236 l6 o2 ddd l2 ml g o3 dd mn l6 c o2 ba l2 o3 ml gdd mn l6 c o2 ba ml l2 o3 gdd mn l6 c o2 b o3 c l2 ml o2 a1a4 p4 mn t236 l6 o2 ddd l2 ml g o3 dd mn l6 c o2 ba l2 o3 ml gdd mn l6 c o2 ba ml l2 o3 gdd mn l6 c o2 b o3 c l2 ml o2 a1a4 p4 mn t136 mn o3 l8 p4 mn o2 l8 d4 e4.e o3c o2 bag l12 gab l8 a8. e16f+4d8. d e4.e o3 c o2 bag o3 d8.o2     a16 ml a4a4 mn d4 e4.e O3 c o2 bag l12 gaba8. e16 f+4 o3 d8. d16 l16     g8. fe-8. d c8. o2 b-a8. g o3 d2 t236 l6 o2 ddd l2 ml g o3 dd mn l6 c o2 ba l2 o3 ml gdd mn l6 c o2 ba ml l2 o3 gdd mn l6 co2 b o3c l2 ml o2a1a4 p4 mn t236 l6 o2 ddd l2 ml g o3 dd mn l6 c o2 ba l2 o3 ml gdd mn l6 c o2ba ml l2 o3gdd mn l6 co2bo3c l2 ml o2a1a4 p4 mn l6 o3 mn ddd ml l1 gggg4 p4 p4 mn l12 dddg2" 



 Reveille: t255l8c.f.afc~c.f.afc~c.f.afc.f.a..f.~c.f.afc~c.f.afc~c.f.afc~c.f.. 
 Close Encounters: <cd<a#~<a#>f 
 Lord of the Dance (aka Simple Gifts): t240<cfcfgagaa#b#>dc<a#a.~fg.gaa#.agagegc.~cfcfgagaa#b#>dc<a#a.~fg.gga.agfgfgf. 
 Loony Toons theme: t255cf8f8edc<a>~cf8f8edd#e~ce8cdce8cd.<a>c8c8c#def8af8 
 standard villain's entrance music: mst200o2ola.l8bc.~a.~>l2d# 
 a trope from 'The Right Stuff' score by Bill Conti: olcega.a8f>cd2bgc.c8dee2 
 opening bars of Bach's Toccata and Fugue in D Minor": msl16oldcd4mll8pcb-agf+4.g4p4<msl16dcd4mll8pa.a+f+4p16g4 
 opening bars of the theme from Star Trek Classic: l2b.f+.p16a.c+.p l4mn<b.>e8a2mspg+e8c+f+8b2 


 ~~~ 

 ~~~ 
 echo 'echo -e "<cd<a#~<a#>f" > /dev/speaker' >> /etc/rc.local 
 echo '"O3L30cO4L30cO5L30cO5L30g" > /dev/speaker' >> /etc/rc.local 
 ~~~ 

 #### Unbound 

 ~~~ 
 ln -s /var/unbound/etc/unbound.conf /etc/unbound.conf 
 ~~~ 

 ~~~ 
 # $OpenBSD: unbound.conf,v 1.14 2018/12/16 20:41:30 tim Exp $ 

 server: 
         interface: 127.0.0.1 
         interface: 172.16.1.254 
         #interface: 127.0.0.1@5353        # listen on alternative port 
 #         interface: ::1 
         do-ip6: no 

         # override the default "any" address to send queries; if multiple 
         # addresses are available, they are used randomly to counter spoofing 
         #outgoing-interface: 192.0.2.1 
         #outgoing-interface: 2001:db8::53 

         access-control: 0.0.0.0/0 refuse 
         access-control: 127.0.0.0/8 allow 
         access-control: 172.16.1.254/16 allow  
         access-control: ::0/0 refuse 
         access-control: ::1 allow 

         hide-identity: yes 
         hide-version: yes 

         # Uncomment to enable DNSSEC validation. 
         # 
         #auto-trust-anchor-file: "/var/unbound/db/root.key" 
         #val-log-level: 2 

         # Uncomment to synthesize NXDOMAINs from DNSSEC NSEC chains 
         # https://tools.ietf.org/html/rfc8198 
         # 
         #aggressive-nsec: yes 

         # Serve zones authoritatively from Unbound to resolver clients. 
         # Not for external service. 
         # 
         #local-zone: "local." static 
         #local-data: "mycomputer.local. IN A 192.0.2.51" 
         #local-zone: "2.0.192.in-addr.arpa." static 
         #local-data-ptr: "192.0.2.51 mycomputer.local" 

         # UDP EDNS reassembly buffer advertised to peers. Default 4096. 
         # May need lowering on broken networks with fragmentation/MTU issues, 
         # particularly if validating DNSSEC. 
         # 
         #edns-buffer-size: 1480 

         # Use TCP for "forward-zone" requests. Useful if you are making 
         # DNS requests over an SSH port forwarding. 
         # 
         #tcp-upstream: yes 

 remote-control: 
         control-enable: yes 
         control-interface: /var/run/unbound.sock 

 # Use an upstream forwarder (recursive resolver) for some or all zones. 
 # 
 #forward-zone: 
 #         name: "."                                 # use for ALL queries 
 #         forward-addr: 192.0.2.53                  # example address only 
 #         forward-first: yes                        # try direct if forwarder fails 
 ~~~ 

 ~~~ 
 rcctl enable unbound 
 rcctl start unbound 
 ~~~ 

 #### Install Prometheus    node exporter 

 ~~~ 
 pkg_add go git gmake python-3.6 colorls gnuwatch mtr pftop curl bash  
 ln -s /usr/local/bin/python3 /usr/local/bin/python 
 cd /home/sacha 
 go get github.com/prometheus/node_exporter 
 cd /home/sacha/go/src/github.com/prometheus/node_exporter 
 gmake 
 mv node_exporter /usr/local/bin/ 
 ~~~ 

 ##### script de démarage: /etc/rc.d/node_exporter 

 ~~~ 
 vim /etc/login.conf 
 (...) 
 node_exporter:\ 
   :tc=daemon: 
 ~~~ 

 ~~~ 
 cap_mkdb /etc/login.conf 
 groupadd -g 2222 _node_exporter 
 useradd -u 2222 -g 2222 -c "Prometheus Node Exporter agent" -d /var/empty -s /sbin/nologin -L node_exporter _node_exporter 
 ~~~ 

 * /etc/rc.d/node_exporter 

 ~~~ 
 #!/bin/sh 
 # 

 daemon="/usr/local/bin/node_exporter" 
 node_exporter_textfile_dir="/var/node_exporter" 
 daemon_flags="--collector.textfile.directory==${node_exporter_textfile_dir}" 
 daemon_user="_node_exporter" 
 daemon_group="_node_exporter" 

 . /etc/rc.d/rc.subr 

 pexp="${daemon}.*" 
 rc_bg=YES 
 rc_reload=NO 

 rc_pre() {  
     if ! id ${daemon_user}; then 
         groupadd _node_exporter 
         useradd -g _node_exporter -c "Prometheus Node Exporter agent"\ 
         -d /var/empty -s /sbin/nologin -L node_exporter _node_exporter 
     fi 
     if [ ! -d ${node_exporter_textfile_dir} ]; then 
         install \ 
             -d \ 
             -o ${daemon_user} \ 
             -g ${daemon_group} \ 
             -m 1755 \ 
             ${node_exporter_textfile_dir} 
     fi 
 } 

 rc_start() { 
     ${rcexec} "${daemon} ${daemon_flags} < /dev/null 2>&1" 
 } 

 rc_cmd $1 
 ~~~ 


 ~~~ 
 chmod 0755 /etc/rc.d/node_exporter 
 chown root:wheel /etc/rc.d/node_exporter 

 rcctl enable node_exporter 
 rcctl start node_exporter 
 ~~~ 

 --- 

 ## Firewall 


 ~~~ 
 touch /etc/BLACKLIST 
 vi /etc/WHITELIST 
 ~~~ 


 ### Standard: 1 ADSL 

 ~~~ 
 ####################################################### 
 #           Firewall PF - OpenBSD -                       # 
 # -=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=- # 
 # V1.0 - 20190612                                       # 
 ####################################################### 


 #-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-# 
 #                 MACROS                    # 
 #-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-# 

 #-----------------------------------------# 
 #                 Interfaces                  # 
 #-----------------------------------------# 
 #=====----> ADSL 
 ADSL         = "pppoe0" 


 #=====----> LAN 
 LAN               = "em2" 
 LAN_VoIP          = "em3" 

 #-----------------------------------------# 
 #                 Hosts                       # 
 #-----------------------------------------# 


 #-----------------------------------------# 
 #         W H I T E    L I S T                  # 
 #-----------------------------------------# 
 table <WHITELIST> persist file "/etc/WHITELIST" 

 #-----------------------------------------# 
 #         B L A C K    L I S T                  # 
 #-----------------------------------------# 
 table <BLACKLIST> counters persist file "/etc/BLACKLIST" 

 #-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-# 
 #                 OPTIONS                   # 
 #-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-# 
 set loginterface $ADSL 

 #set optimization aggressive 
 set block-policy drop 

 set skip on lo0  


 #-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-# 
 #                 LOG                       # 
 #-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-# 
 match log all 


 #-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-# 
 #                 NORMALISATION             # 
 #-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-# 

 # Nettoyer les paquets entrant 
 match in scrub (reassemble tcp random-id) 

 #-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-# 
 #                  NAT                      # 
 #-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-# 
 match out on $ADSL inet from ($LAN:network) to any nat-to ($ADSL) 

 #-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-# 
 #                 FILTRAGE                  # 
 #-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-# 
 block log all 

 #-----------------------------------------# 
 #                 Anti-Flood                  # 
 #-----------------------------------------# 
 #NOFLOOD ="synproxy state (source-track rule max-src-conn 500, max-src-conn-rate 50/10, overload <BLACKLIST> flush global)" 
 NOFLOOD ="keep state (source-track rule, max-src-states 100)" 

 block in log quick on $ADSL from no-route to any 
 block out log quick on $ADSL from no-route to any 
 block in log quick on $ADSL from any to 255.255.255.255 

 #-----------------------------------------# 
 #                 Blacklists                  # 
 #-----------------------------------------# 
 block in quick from <BLACKLIST> 

 block in log quick on $ADSL inet proto icmp from any to any icmp-type redir 
 block in log quick on $ADSL inet6 proto icmp6 from any to any icmp6-type redir 

 #-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-# 
 #                 Anti-spoof                    # 
 #-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-# 
 antispoof log quick for $ADSL label "antispoof" 

 #---------------------------------------# 
 #                 ICMP                      # 
 #---------------------------------------# 
 pass inet proto icmp all icmp-type { echorep, echoreq, timex, unreach } 

 #---------------------------------------# 
 #                 Trace Route               # 
 #---------------------------------------# 
 pass in on { $LAN } proto udp from any to any port 33433 >< 33626 keep state 

 #---------------------------------------# 
 #                 WHITELIST                 # 
 #---------------------------------------# 
 pass in quick on $ADSL proto tcp from <WHITELIST> to any port 55555  

 #---------------------------------------# 
 #                   LAN                     # 
 #---------------------------------------# 

 #=====----> Firewall to Lan 
 pass out on $LAN inet to $LAN:network 

 
 #=====----> ssh LAN 
 pass in quick on $LAN proto tcp from $LAN:network to $LAN port 55555 
 #pass in quick proto tcp from any to port 55555 

 #=====----> dns 
 pass in quick on $LAN proto udp from $LAN:network to $LAN port 53  

 #=====----> dhcp 
 pass in quick on $LAN inet from $LAN:network to 255.255.255.255  

 #=====----> Permit Lan to output 
 pass in on $LAN inet from $LAN:network to any 

 pass out on $LAN inet from $LAN:network to any 

 
 #---------------------------------------# 
 #              ACCEPT OUTGOING              # 
 #---------------------------------------# 
 pass out on $ADSL 
 ~~~