No More Beeping

*NIX Quick Tip

Beep, beep, beep,
If your like me and don't like auditory reminders, you can turning off the beeping quickly and easily:

X Windows
If you want to disable beeps in X11 (X Windows), you can turn them off with the command:
# xset b off
*Note: you will need to login as root or use sudo.

csh and tcsh
You can disable csh and tcsh shell terminal beep if you put `set nobeep' (no quotes) in your ~/.cshrc file.

This options will work on most *nix systems (using csh/tcsh or X windows), including Ubuntu, FreeBSD, and OpenBSD, however I tested this solution using FreeBSD.

7 Must Read OpenBSD man pages

In OpenBSD the manual pages are very important, well written documents. They comprise most of the written documentation for OpenBSD. Countless hours of work has gone into making them easy to read, and follow.

If you are new OpenBSD there a number of man pages which are a must read. These man pages can can explain much of the way that OpenBSD works, and many things that you can achieve using the system. Giving you a clearer perspective on your system.

1. man(1): To view the manual pages you will need to use: man(1). The man(1) program displays a manual page in your terminal for you to read. For more information see: man(1).
2. apropos(1): When your new to a system it can be difficult to know what manual page you need to read to achieve a task, enter: apropos(1). The apropos(1) program will locate and display all the commands containing a user specified keyword.
3. hier(7): If your new to OpenBSD, or *nix systems make sure to check out the hier(7) manual page. This page details how the filesystem works, and gives you a good understanding of how the system is laid out.
4. afterboot(8): When you first install an OpenBSD system you should check out the afterboot(8) man page. This well written man page, will tell you all the things that you should check/do after installing your system.
5. packages(7): Once you have your system installed and configured you may want to add some software. If you would like to install binary packages check out the packages(7) man page.
6. ports(7): If you would prefer to install software from source here is an overview of the ports(7) system.
7. intro: If you would like to know what the numbers after the commands are, there is an explanation in the man(1) manual page, also you can read an introduction to each section here: intro(1), (2), (3), (4), (5), (6), (7), (8), (9).

Have fun Using OpenBSD :-)

Protecting Your Terminal

BSD Quick Tip
When ssh across my systems I often need to step away from the keyboard for a few minutes. This can pose a massive security threat to the system, therefore I think it's important to lock the terminal, this way I don't need to log in/out, nor leave the system insecure.

In all of the BSD's you can use a built-in utility called lock(8). When you use:$ lockwithout any options you will be asked to enter a key twice. Then your terminal will be locked for 15 mins, after that time it will become available again.

Options:
To keep your terminal locked until you return, (no 15 minute timeout), use:$ lock -n
To use your normal user password instead of a key you enter use:$ lock -p
Personally I like to use these options all of the time, therefore I add an alias so I only have to type lock.
To Alias `lock -np` to `lock` in csh or tcsh:$ edit ~/.cshrcadd:alias lock lock -np
To Alias lock -np to lock in sh:$ edit ~/.shrcadd:alias lock='lock -np'

Humanise the output of OpenBSD's root mail

OpenBSD Quick Tip
I've discussed how to humanise the output of FreeBSD's root mail, and the same can be achieved in OpenBSD by running the following commands:# vi /etc/daily
change:df -klto:df -hikl

Adding OpenBSD to Grub

I added OpenBSD to my GRUB menu.lst config file today. After a bit of messing around, it still didn't boot. So I did a Google search and came across this file: GRUB's menu.lst config file, with examples for various OSes.

This file details where I was going wrong, and how to boot OpenBSD using GRUB. I have placed the relative information here for future reference:
# The OpenBSD section of the menu.lst config file, for GRUB.
#
## You would like to use:
# root (hd1,1,a)
# kernel --type=openbsd /bsd
#
# But OpenBSD passes bios & kernel parameters with its own bootloader,
# the first stage of which is installed in the partition boot record,
# and in turn calls /boot, which in turn loads kernel /bsd. So just
# use the GRUB chainloader instead:
#
## OpenBSD
title OpenBSD
root (hd1,1)
makeactive
chainloader +1

OpenBSD: From Release to Stable

Upon installing OpenBSD I like to update it from a release to a stable, which gives me all of the security patches since the release.
There are a number of ways of updating, yet I personally like to rebuild the system from source. That way I don't have to go through each patch and apply it. For more information please see: Building the System from Source

There are a number of different "flavours" of OpenBSD:

• -release -- The version which is released on CD every 6 months
• -stable -- Release plus security patches
• -current -- The development branch

There are three steps we need to take to update the system:

1. Download the latest Source code
2. Compiling and installing a GENERIC kernel
3. Rebuilding the system

Download the latest Source code
There are a number of ways to get the latest source, yet I use cvs.
First I need to find a anoncvs mirror: Available Anonymous CVS Servers
Once I've decided on a server I export the mirror path to CVSROOT and download the source, e.g.:
# export CVSROOT=anoncvs@anoncvs.openbsd.org:/cvs
# cd /usr; cvs checkout -P -rOPENBSD_4_1 src

Note: the CVSROOT variable will not be kept after next boot. To keep this setting add it to your /root/.profile file, e.g.:
# vi /root/.profile
adding:
export CVSROOT=anoncvs@anoncvs.openbsd.org:/cvs

Compiling and installing a GENERIC kernel
First backing up current kernel
# cp /bsd /bsd.old

Then configure the kernel
# cd /usr/src/sys/arch/i386/conf
# config GENERIC

Now Compile and Install the new Kernel
# cd /usr/src/sys/arch/i386/compile/GENERIC
# make clean && make depend && make && make install

Lastly reboot and test the new kernel
# reboot

Rebuilding the system
Now I just rebuild the system:
# rm -rf /usr/obj/*
# cd /usr/src; make obj
# cd /usr/src; make build

Now reboot
# reboot
When I first log back in the first thing I notice that my system name now says OpenBSD4.1-stable.

Now I have a stable system with all of the important security updates on it.

Dreaming about Blowfish and Daemons

I've had a moment with Ubuntu, yes one of those moments where your eye develops a twitch. So I quietly and calmly backed-up my files, rebooted and wiped my hard drive, a few times :)

I decided to reinstall OpenBSD 4.1, and so far I'm loving it. The freedom and the experience of the command line is unlike any other. After all the command line is why I wanted to learn a Unix based system in the first place.

I'd forgotten how excited I feel working with the commandline. I'm actually looking forward to using my computer again.
My servers don't have GUI's yet it's been a while since my desktop was a command line.
Everything is very fast, I almost don't know myself. I feel as though I'm flying along.

I think I'll be dreaming about blowfish and daemons tonight ;) If I ever get to bed that is.

Installing Wordpress on OpenBSD

To install Wordpress in OpenBSD you need to have a web server, (e.g. Apache) with PHP and a MySQL database.
OpenBSD already comes with Apache. Therefore we only need to install and configure MySQL, PHP and Wordpress.

Starting the Apache (httpd) server
To start Apache from boot edit /etc/rc.conf and change this line:
httpd_flags=NO
To read:
httpd_flags=""
For more information see my tutorial how to start the Apache (httpd) server.

Now reboot then test that Apache is working.
NOTE: I don't like moving on to the next step until each step works. Then if there is a problem I know what was working last, and where the problem is likely to be.

Installing MySQL Database Server
To learn how to install, and configure MySQL to work inside of chrooted Apache please see my tutorial: Installing MySQL Database Server.

Now test that MySQL is working.

Creating a Database in MySQL for Wordpress
After installing, and configuring MySQL we need to create a database and a database user for Wordpress.
I will call my Wordpress database: wordpressdb, My user: kris and my password: new-password. Please change these to suit your situation.
# mysql -u root -h localhost -p
Enter password:
Welcome to the MySQL monitor. Commands end with ; or \g.

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> CREATE DATABASE wordpressdb;
Query OK, 1 row affected (0.04 sec)

mysql> GRANT ALL ON wordpressdb.* TO kris@localhost IDENTIFIED BY 'new-password';
Query OK, 0 rows affected (0.02 sec)

mysql> SHOW DATABASES;
+-------------+
| Database ---|
+-------------+
| wordpressdb |
| mysql ------|
| test -------|
+-------------+
5 rows in set (0.02 sec)

mysql> \q
Bye

Installing Wordpress
Once you have finished creating a MySQL database we can install Wordpress. I'm going to use pkg_add(1)'s interactive mode (-i) so that I can choose which version of wordpress I want to install:
# export PKG_PATH=ftp://ftp.nara.wide.ad.jp/pub/OpenBSD/4.1/packages/i386/
# pkg_add -i wordpress
Ambiguous: choose package for wordpress
0:
1: wordpress-2.0.7
2: wordpress-2.2.1
Your choice: 2
wordpress-2.2.1:libiconv-1.9.2p3: complete
wordpress-2.2.1:expat-2.0.0: complete
wordpress-2.2.1:gettext-0.14.6: complete
wordpress-2.2.1:libxml-2.6.26p0: complete
wordpress-2.2.1:php5-core-5.1.6p1: complete
wordpress-2.2.1:php5-mysql-5.1.6p2: complete
wordpress-2.2.1: complete

Configuring php5
Before we can use Wordpress we need to configure php for use inside of the chrooted Apache: in /var/www/. To do this I ran the following commands:
# /usr/local/sbin/phpxs -s
# cp /usr/local/share/examples/php5/php.ini-recommended /var/www/conf/php.ini
# chown root:www /var/www/conf/php.ini
# chmod 640 /var/www/conf/php.ini
# mkdir /var/www/tmp

Now enable the php MySQL module:
# /usr/local/sbin/phpxs -a mysql

Lastly we need to inform Apache that we have PHP installed, by editing the httpd.conf file and add the following:
# vi /var/www/conf/httpd.conf
LoadModule php5_module /usr/lib/apache/modules/libphp5.so

AddType application/x-httpd-php .php .php4 .php3 .htm .html
AddType application/x-httpd-php-source .phps

Now edit the DirectoryIndex line in httpd.conf to read:
DirectoryIndex index.html index.htm index.php index.php5 index.php4 index.php3

Testing php5
# vi /var/www/htdocs/phptest.html
adding
<?php phpinfo() ?>
Now in your browser open the phptest page, e.g. http://www.yoursever.tld/phptest.html

NOTE: It is a really good idea to remove this page once you have tested php, as it could be a security risk.

Configuring Wordpress
WordPress has been installed into /var/www/wordpress, which is not the document root.

You could point this to the DocumentRoot of your web-server:
# ln -s ../wordpress /var/www/htdocs/wordpress
(make sure you use a relative symlink since Apache is chrooted)

However I want to create two blogs. Therefore I shall copy the contents of the wordpress directory into /var/www/htdocs/

Creating blog one
# cp -rp /var/www/wordpress /var/www/htdocs/one
Creating blog two
# cp -rp /var/www/wordpress /var/www/htdocs/two

Now I need to edit wp-config.php in both blog directories, and add the database information in each.
# vi /var/www/htdocs/one/wp-config.php
// ** MySQL settings ** //^M
define('DB_NAME', 'wordpressdb'); // The name of the database^M
define('DB_USER', 'kris'); // Your MySQL username^M
define('DB_PASSWORD', 'new-password'); // ...and password^M
define('DB_HOST', 'localhost'); // 99% chance you won't need to change this value^M

With the second blog I will also change the $table_prefix option, so that I can use the database created above for both blogs:
# vi /var/www/htdocs/two/wp-config.php
// ** MySQL settings ** //^M
define('DB_NAME', 'wordpressdb'); // The name of the database^M
define('DB_USER', 'kris'); // Your MySQL username^M
define('DB_PASSWORD', 'new-password'); // ...and password^M
define('DB_HOST', 'localhost'); // 99% chance you won't need to change this value^M
define('DB_CHARSET', 'utf8');
define('DB_COLLATE', '');

// You can have multiple installations in one database if you give each a unique prefix
$table_prefix = '2wp_'; // Only numbers, letters, and underscores please!

Now in your browser go to: http://your-server.address.tld/one/wp-admin/install.php. This should set-up the database tables needed for your blog.
NOTE: If there is an error, double check your wp-config.php file, and try again.

Then follow each of the steps on the page. Make sure you note the password given to you.
The install script should then send you to the login page. Sign in with the username: admin, and the password generated during the installation. You can then click on 'Profile' to change the password.

Have fun with your new Wordpress blog.

OpenBSD Tip: Installing MySQL Database Server

Installing the MySQL Database Server, in OpenBSD is needed for a number of different applications. Including Wordpress, which is what I have been playing with today.

Installing MySQL
First if you don't have PKG_PATH set then set this first, then install mysql-server. For a package server near you please see: FTP mirrors
# export PKG_PATH=ftp://ftp.openbsd.org/pub/OpenBSD/4.1/packages/i386/
# pkg_add mysql-server
mysql-server-5.0.33:mysql-client-5.0.33: complete
mysql-server-5.0.33:p5-Net-Daemon-0.39: complete
mysql-server-5.0.33:p5-PlRPC-0.2018p0: complete
mysql-server-5.0.33:p5-DBI-1.53: complete
mysql-server-5.0.33:p5-DBD-mysql-3.0008: complete
mysql-server-5.0.33: complete

Configuring MySQL
The mysql-server package doesn't initialize a default database. The following command will create one:
# /usr/local/bin/mysql_install_db

Now we need to temporarily start mysql to set the root access password for the database. Changing 'new-password' to a password of your choosing.
# /usr/local/bin/mysqld_safe &
# /usr/local/bin/mysqladmin -u root password 'new-password'
# /usr/local/bin/mysqladmin -u root -p -h Your-server.name.tld password 'new-password'

Verify the server is running by using the 'fstat' in the following example:
# fstat | grep "*:" | grep mysql
_mysql mysqld 29321 15* internet stream tcp 0xd6121af4 *:3306

To start MySQL from boot, edit /etc/rc.conf.local:
# vi /etc/rc.conf.local
adding:
mysql=YES
Then edit: /etc/rc.local:
# vi /etc/rc.local
After the 'starting local daemons' and before the following echo '.' Insert the following into the /etc/rc.local file:

if [ X"${mysql}" == X"YES" -a -x /usr/local/bin/mysqld_safe ]; then

echo -n " mysqld"; /usr/local/bin/mysqld_safe --user=_mysql --log --open-files-limit=256 &

for i in 1 2 3 4 5 6; do
if [ -S /var/run/mysql/mysql.sock ]; then
break
else
sleep 1
echo -n "."
fi
done
#
# Apache chroot Settings

mkdir -p /var/www/var/run/mysql
sleep 2
ln -f /var/run/mysql/mysql.sock /var/www/var/run/mysql/mysql.sock

#
# Postfix chroot Settings
if [ "X${postfix_flags}" != X"NO" ]; then
mkdir -p /var/spool/postfix/var/run/mysql
sleep 2
ln -f /var/run/mysql/mysql.sock /var/spool/postfix/var/run/mysql/mysql.sock
fi

fi
Now every time you restart; the machine will check to see whether you have enabled mysql in the rc.conf (rc.conf.local) file then start the mysql daemon. To disable mysql we can simply change mysql=YES to mysql=NO

After restarting verify the server is running again:
# fstat | grep "*:" | grep mysql
_mysql mysqld 29321 15* internet stream tcp 0xd6121af4 *:3306

Once the above startup script has worked you can change the mysqld_safe line to something like:
/usr/local/bin/mysqld_safe --user=_mysql --log --open-files-limit=1000 > /dev/null 3>&1 2>&1 &

For more information, and different configurations please see:

• MySQL
• http://nomoa.com/bsd/mysql.htm
• http://www.openbsdsupport.org/mysql.htm
• Tell me about this chroot(2) Apache?

Using MySQL

• Tutorial Introduction
• MySQL Databases and the SQL Language
• Getting Started with MySQL
• SQL Fundamentals
• MySQL command to show list of databases on server
• How to: Connect to my MySQL Database server using command line and php

MySQL security
Remove history
The MySQL history file ( /.mysql history), contains all executed SQL commands, even passwords, (which are stored as plain text). We can easily clear the contents of this file:
# cat /dev/null > /.mysql_history

Disable remote access
If you are only going to use MySQL on this server, (i.e. the database will be used only by locally installed applications) then you can disable remote access. MySQL listens on tcp port 3306, we can disable listening on the port by doing the following:

# vi /etc/my.cnf
add:
skip-networking

Improve local security
The next change is to disable the use of LOAD DATA LOCAL INFILE command, which will help to prevent against unauthorized reading from local files.
# vi /etc/my.cnf
add:
set-variable=local-infile=0

Change admin name
It is also recommended to change the default name of administrator’s account (root), to a different, and harder to guess one.

mysql> UPDATE USER SET user='dbadmin' WHERE user='root';
mysql> FLUSH PRIVILEGES;

Now you should have MySQL up and running on your OpenBSD server. Good luck, and have fun.

OpenBSD Tip: Starting Apache

Apache is included in a basic install of OpenBSD. However it is not running by default. Starting Apache in OpenBSD is really easy. You can start the server manually or automatically.

Automatic: To start Apache every time the computer starts/restarts you need to do the following:

Edit /etc/rc.conf and change this line:
httpd_flags=NO
To read:
httpd_flags="" # note the use of two double-quotes
Then save the changes. When the computer is restarted, the Apache server (httpd) will automatically start.

Manual: To start Apache manually you need to run the following command:
# /usr/sbin/apachectl start
/usr/sbin/apachectl start: httpd started

Testing your Web Server: To test your webserver point your web browser to your servers IP address, or use lynx on the webserver like this:
# lynx localhost

[ lynx displays the following ...]
[OpenBSD]
Apache
It Worked!

If you can see this page, then the people who own this host have just
activated the Apache Web server software included with their OpenBSD
System. They now have to add content to this directory and replace this
placeholder page, or else point the server at their real content.
[ ... cut ... ]

The Document Root directory (the directory where all of the server's web pages are stored) is /var/www/htdocs. You can now place your web pages in this directory.

Happenings

I've been very busy lately, but I haven't fallen off the face of the planet yet...
I haven't been doing very geeky things though, mostly life shit. Hopefully I will have some more time from now on. I have so many things that I want to do, I just have to prioritize my work.

OpenBSD 4.1
I have decided to give OpenBSD 4.1 a spin, it has been out since the 1st May. I haven't had a chance to try it yet. I just finished creating and burning the ISO to CD. I followed the steps in this post: Creating an OpenBSD 4.0 bootable install CD, Changing "4.0" to "4.1". Also in this post, I say to test it on a CD-rw which isn't a very good suggestion because some CD players wont boot from a CD-rw. So please be careful!

Init and BSD
I have been reading three posts by Dru Lavigne talking about the differences in controlling and initiating programs at boot time in the BSD's:

• When inittab doesn't exist
• rc scripts without runlevels
• No runlevels??!!

I think they are worth a read, especially if you coming from a Linux background.

VMware Workstation, 6.0 Beta

I have been having a look at VMware Workstation, 6.0 Beta, for about a week now. After reading: Desktop Virtualization with VMware Player and Workstation, I decided that I would give it a try. I have used VMware server many times, but not Workstation.
I have been quite impressed with it. There are many very good features. Unfortunately the FreeBSD 6-Branch doesn't preform well as a guest. Yet OpenBSD runs very well as a guest, and so do many linux, and Windows operating systems.
Figure 1. The image is of OpenBSD running as a guest OS, in VMware Workstation 6 Beta.

Features
There are many features in workstation which I really like, and are very functional. Some of the new features in this release are:

• Full support for Ubuntu 6.10 as both a guest and a host. I have tested Ubuntu 6.10 as both and it preforms very well. I was impressed.
• There is multiple Monitor support, in which you can specify how guests see the monitors.
• There is now support for the VIX API (formerly known as the Programming API), the API allows the writing of scripts and programs to automate virtual machines.
• New IDE plug-ins, to Visual Studio (Windows) or Eclipse (Windows or Linux).
• You can now run Virtual machines in the background, with Workstation closed. I really loved this feature, very handy.
• If the guest installed supports VMware tools, then there are many features involving file transfer, and peripherals. However I was mainly testing server operation.
• There is increased RAM support.
• USB 2.0 Support, this works really well! I was so happy to see there there was finally 2.0 support, well done!
• There is also support for many new guest and host operating systems, including Solaris 10 Update 3, Windows Vista, and Novel Netware 6.5 SP5, as well as many Linux OS's.

For more information on new features please see: VMware Workstation 6.0 Beta Release Notes.

Performance
I was really impressed with Workstation as a whole. It was very stable running under Ubuntu, both 6.06 and 6.10 as hosts. Most of the features that I tried worked just fine, except I could not get VNC connections to guest Operating systems to work. As I mentioned before it bothers me that FreeBSD doesn't work, but what can you do? I Love that you can create teams, I had a four computer OpenBSD cluster running inside a team, and it worked so nicely. I enjoyed playing with these features. It is a pity that the server addition doesn't have teams. I also loved being able to clone a virtual machine.

Overall Look and Feel
I always find the VMware GUI's easy to use, and simple to find my way around. The general look and feel is very comfortable. Some more complicated features are a little confusing at first but after using them you get the idea. A good knowledge of networking comes in hand with some of the more advance setups. Overall I have certainly enjoyed my experience in Workstation Beta 6.

Conclusion.
I have enjoyed working with Workstation, and I certainly think that it is worth a look if you are a developer of any sort. Or if you would like to try Virtualization on the desktop. I have to say one thing that I will certainly give VMware over some over forms of Virtualization I have tried and that is it is simple to use. Plus I really love VMware's Virtual Appliances; which are: "pre-built, pre-configured and ready-to-run software application packaged with the operating system inside a virtual machine." They are very useful, and I really appreciate the work which has been put into many of them.

Setting up OpenBSD as a Gateway/Firewall

Today I setup and tested my first OpenBSD firewall/gateway. I was really fun. Before today I had completed bits and pieces of the setup but not the entire process.
These where the steps I took:

# 1. Install:

Partitions =
Filesystem Size Mounted on
/dev/wd0a 150.1M /
/dev/wd0b 383.9M swap
/dev/wd0d 511.9M /tmp
/dev/wd0e 99.9M /var
/dev/wd0f 5120.2M /usr
/dev/wd0g 2048.0M /home

Sets =
bsd - This is the Kernel. Required
base40.tgz - Contains the base OpenBSD system
etc40.tgz - Contains all the files in /etc

# 2. Filtering and Firewalling OpenBSD:

First I Prepared pf: by starting it in rc.conf.local. (I will need to reboot for this to take effect)
# echo "#Start PF" >> /etc/rc.conf.local
# echo pf=YES >> /etc/rc.conf.local
Now I need to configure pf.conf:
# vi /etc/pf.conf

If you need help creating a pf ruleset please have a look at the following: PF User's Guide, pf(4), pfctl(8), pf.conf(5), pf.os(5), pflog(4), pfsync(4), altq(9).

# 3. Setting up your OpenBSD box as a Gateway
Allow IP forwarding by adding this line to /etc/sysctl.conf configuration file:
# echo "net.inet.ip.forwarding=1" >> /etc/sysctl.conf

Now modify the routes on the other hosts on both sides.
Routes can be controlled with routed(8) or OpenBGPD, in the base OpenBSD install.

# 4. DHCP Server

# Configuring the DHCP server, dhcpd
# echo "#Start dhcpd" >> /etc/rc.conf.local
# echo 'dhcpd_flags=""' >> /etc/rc.conf.local
# Put the interfaces that you want dhcpd to listen on in /etc/dhcpd.interfaces:
# echo rl1 > /etc/dhcpd.interfaces
# Then, edit /etc/dhcpd.conf
# vi /etc/dhcpd.conf

# 5. Configuration:

Su'd to root, create /etc/profile and add the content below.
# Configuring profiles:
# echo "alias su='su -l'" > /etc/profile
# echo "alias rm='rm -P'" >> /etc/profile
# echo 'if [ "$USER" = root ]; then' >> /etc/profile
# echo 'PATH=/sbin:/usr/sbin:/bin:/usr/bin:/usr/X11R6/bin:/usr/local/bin:/usr/local/sbin' >> /etc/profile
# echo 'PS1="\`hostname -s\`:\`pwd\`# "' >> /etc/profile
# echo 'else' >> /etc/profile
# echo 'PATH=/bin:/usr/bin:/usr/X11R6/bin:/usr/local/bin:/usr/local/sbin:/usr/games:.' >> /etc/profile
# echo 'PS1="\`hostname -s\`:\`pwd\`$ "' >> /etc/profile
# echo 'fi' >> /etc/profile

Then I rebooted the system, so that all of the above could take effect. I attached a couple of nodes to the switch, which worked perfectly.
Now I am testing the setup. So far everything is working well :)

I'm not sure how I went, I think I did ok for a first try. If anyone has any suggestions I would be more than willing to hear them. Thank you!

Creating an OpenBSD 4.0 bootable install CD

I needed to make an OpenBSD bootable install CD yesterday. I normally use the boot-only CD, then ftp install, the sets I need. Yet this was impossible on this particular system. So I needed to create an install CD.

Note: You can purchase the Official OpenBSD CD's from here: Orders. The sale of the CD's and other products go to fund the project, so please support them where you can.

Creating an OpenBSD 4.0 bootable install CD

First I needed a program to make the ISO image: mkisofs. To ensure mkisofs is installed I did the following:
# mkisofs -version
mkisofs 2.01.01a03-unofficial-iconv (i686-pc-linux-gnu)

So far so good.
Next I made the CD file system hierarchy, You can make these directories anywhere you would like:
# mkdir -p OpenBSD/4.0/i386
# cd OpenBSD/4.0/i386/

Then I downloaded the entire i386 directory from an OpenBSD ftp mirror: ftp mirrors.
# wget --passive-ftp ftp://ftp.it.net.au/mirrors/OpenBSD/4.0/i386/*

Now I can make the ISO image using mkisofs. I am going to use the cdrom40.fs as my boot image. Please see man mkisofs for instructions on use.
# cd ../../
# mkisofs -vrTJV "OpenBSD40" -b 4.0/i386/cdrom40.fs -c boot.catalog -o OpenBSD40.iso /home/kris/OpenBSD/

Now I have a ISO image named "OpenBSD40.iso" in my OpenBSD directory. I burnt it to a CD-rw to test it. Then after it proved itself, I burnt the image to a CD-r.

For more information on how to do this for yourself please see here: How to make an OpenBSD bootable install CD.

OpenBSD LiveCD Firewall

Over the past couple of weeks all of my research and experimentation has been leading towards a project. I have been learning how to create my own livecd firewall. Currently I am preparing an environment to create this livecd in.

First I installed a basic version of OpenBSD 4.0. Then I Downloaded the source code using cvsup:
# export PKG_PATH=ftp://ftp.openbsd.org/pub/OpenBSD/4.0/packages/i386/
# pkg_add -v cvsup-16.1h-no_x11.tgz
# vi /root/.configs/cvsup-file
added:

# Defaults that apply to all the collections
*default release=cvs
*default delete use-rel-suffix
*default umask=002
*default host=cvsup.jp.OpenBSD.org
*default base=/usr
*default prefix=/usr
*default tag=OPENBSD_4_0
# If your network link is a T1 or faster, comment out the following line.
*default compress
#OpenBSD-ports
#OpenBSD-all
OpenBSD-src
#OpenBSD-www
#OpenBSD-x11
#OpenBSD-xf4

# cvsup -g -L 2 cvsup-file

Once I had done that I made a partition in which to create the livecd in. First I edited the disklabel, then formatted the new partition:
# disklabel -e wd0
# newfs /dev/wd0h

Now create the directory to mount on the new partition:
# mkdir /bootcd
then edit /etc/fstab so that the partition would be mounted at boot time:
# vi /etc/fstab
added:

/dev/wd0h /bootcd ffs rw 1 2

then rebooted

Once the system had rebooted and everything was OK I cd into /bootcd and downloaded base40.tgz and etc40.tgz and unpacked them into /bootcd:
# cd /bootcd
# tar -xZf base40.tgz
# tar -xZf etc40.tgz

At the moment I am waiting for my new kernel to compile with my needed options:
# cd /usr/src/sys/arch/i386/conf/
# cp RAMDISK_CD BOOTCD
# vi BOOTCD
commented out this line:

#config bsd root on rd0a swap on rd0b and wd0b and sd0b

added this line:

config bsd root on cd0a

# config BOOTCD
# cd ../compile/BOOTCD/
# make clean && make depend && make

I can't wait to see how it works. This is so exciting. I am such a geek...

Reading and Writing

I finally answered all my e-mail today, I haven't had a chance to go through it for a couple of days. I got an e-mail from my little brother he is arriving back in Australia today, he and his girlfriend have been traveling around Laos and Cambodia. It will be really good to see him. Although I will have to wait a couple of weeks, as he lives a few hours away from me.

Also I have been reading a few articles from: OpenBSD Support, Kernel-Panic.it and INETDAEMON.com

Tonight I started to write my first pf.conf file for my firewall. I think that it should go well. I will have to finish it tomorrow though because I'm exhausted. Goodnight all...

Packet Filter

Today I have been going over all of the documents on Packet Filter (pf). The following are the notes which I made while reading (The notes are not complete, just my reference):

Activation from boot:
Edit /etc/rc.conf.local adding:
pf=YES

Activation using pfctl(8):
The pfctl program allows us to activate pf using:
# pfctl -e
And deactivate pf using:
# pfctl -d

*Note that this just enables or disables PF, it doesn't actually load a ruleset. The ruleset must be loaded separately, either before or after PF is enabled.

Configuration
At boot time pf reads /etc/pf.conf for it's configuration. The file has several parts:

• Macros: User-defined variables that can hold IP addresses, interface names, etc.
• Tables: A structure used to hold lists of IP addresses.
• Options: Various options to control how PF works.
• Scrub: Reprocessing packets to normalize and defragment them.
• Queuing: Provides bandwidth control and packet prioritization.
• Translation: Controls Network Address Translation and packet redirection.
• Filter Rules: Allows the selective filtering or blocking of packets as they pass through any of the interfaces.

Lists
Lists allow one rule to contain multiple items, e.g. multiple IP addresses, port numbers etc. Lists are defined by specifying items within { } brackets. e.g:
block out on rl0 from ( 192.168.0.1, 10.0.0.1 } to any

When loading a ruleset and a list is encountered by the pfctl(8) program multiple rules are created. e.g. If pfctl found the above rule it would expand that to:
block out on rl0 from 192.168.0.1 to any
block out on rl0 from 10.0.0.1 to any
*Note that the commas between list items are optional.

Macros
Macros are user-defined variables. They can hold port numbers, IP addresses etc.
Macro names must start with a letter and may contain letters, digits, and underscores. e.g.:
int_if = "sis0"
pass in on $int_if from any to any
Macros can also contain lists.

Tables
Tables hold a groups of IP addresses. Tables are different from lists in that the lookups use less memory and processor and therefore are very fast.

Tables can be used in the following ways:

• source and/or destination address in filter, scrub, NAT, and redirection rules.
• translation address in NAT rules.
• redirection address in redirection rules.
• destination address in route-to, reply-to, and dup-to filter rule options.

To create a table in pf.conf the table directive is used. There are two attributes that can be specified for each table:

• const - Once the table has been created the contents can not be changed. If this attribute is not specified; address can be added or removed using pfctl.
• persist - Keep table in memory even if no rules are referring to it.

For Example:
table <MyNet> { 172.16.2.0/16, !172.16.2.100 }
table <rfc1918> const { 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }
table <spammers> persist file "/etc/spammers"

block in on vr0 from { <rfc1918>, <spammers> } to any
pass in on vr0 from <MyNet> to any

The file /etc/spammers would contain a list of IP addresses and/or CIDR network blocks, one per line. Any line beginning with # is treated as a comment and ignored.

Tables can also be manipulated with pfctl, see: pfctl(8).

Packet Filter
A highly simplified syntax for filter rules is:
action [direction] [log] [quick] [on interface] [af] [proto protocol] \
[from src_addr [port src_port]] [to dst_addr [port dst_port]] \
[flags tcp_flags] [state]

Default Deny
In a default deny filter policy, the first filter rules are:
block in all
block out all
Now traffic has to passed by the firewall other wise it will be dropped.

quick
If a packet matches a rule which is using the quick keyword, then no other processing is needed, and the specified action is taken.

Keeping State
Keeping state or stateful inspection allows pf to keep track of network connection. Information is stored about each connection in a state table, and pf then determines if a passing packet belongs to an established connection, if it does the packet is passed.

When a rule has the keep state option, the first packet matching the rule creates a "state" between the sender and receiver. Now, not only do packets going from the sender to receiver match the state entry and bypass ruleset evaluation, but so do the reply packets from receiver to sender. For example:
pass out on fxp0 proto tcp from any to any keep state

Stateful filtering has a number of options:

• max number: The max number of state entries the rule can create.
• source-track: Track number of states created per IP.
• max-src-nodes number: limit the number of source IP addresses that can simultaneously create state.
• max-src-states number: When the source-track option is used, max-src-states will limit the number of simultaneous state entries that can be created per source IP address.

If a connection has completed the 3-way handshake, then other restrictions can apply to stateful connections:

• max-src-conn number: The maximum number of simultaneous TCP connections which a single host can make.
• max-src-conn-ratenumber / interval: Limit the rate of new connections to a certain amount per time interval.
• overload <table>: Put an offending host's IP address into the named table.
• flush [global]: Kill any other states that match this rule and that were created by this source IP. When global is specified, kill all states matching this source IP, regardless of which rule created the state.

TCP Flags

• F : FIN - Finish; end of session
• S : SYN - Synchronize; indicates request to start session
• R : RST - Reset; drop a connection
• P : PUSH - Push; packet is sent immediately
• A : ACK - Acknowledgement
• U : URG - Urgent
• E : ECE - Explicit Congestion Notification Echo
• W : CWR - Congestion Window Reduced

In a rule flags are specified using the following syntax: flags check/mask
The mask tells pf to only inspect the specified flags.
The check specified which flag must be "on" in the header for a match

TCP SYN Proxy
Proxy the handshake; pf will complete a client handshake, initiate a server handshake, then pass the packets between the two. e.g.:
pass in on $ext_if proto tcp from any to $web_server port www flags S/SA synproxy state
synproxy state also includes the same functionality as keep state and modulate state

Blocking Spoofed Packets
pf uses the antispoof keyword to protect against spoofing.:
antispoof [log] [quick] for interface [af]

Unicast Reverse Path Forwarding
An uRPF check compares the source IP of a packet with the routing table, to see if the outbound interface in the routing table is the same as the packet.
This check is performed using the urpf-failed keywords in filter rules:
block in quick from urpf-failed label uRPF

OS finger Printing
Using the os keyword in a rule, can detect the operating system of a remote host.

IP Options
To allow packets with IP options set which are block by default you need to use the allow-opts keyword.

NAT - Network Address Translation
A highly simplified syntax for a NAT rule is:
nat [pass [log]] on interface [af] from src_addr [port src_port] to dst_addr [port dst_port] -> ext_addr [pool_type] [static-port]

Example: (tl0 is external, dc0 internal):
nat on tl0 from dc0:network to any -> (tl0)
This rule says to perform NAT on the tl0 interface for any packets coming from the dc0 interfaces network and to replace the source IP with the current address of the tl0 interface.

Bidirectional Mapping (1:1 mapping)
A bidirectional mapping can be established by using the binat rule. A binat rule establishes a one to one mapping between an internal IP address and an external address.

Rule Exceptions
Exceptions can be made to translation rules by using the no keyword. e.g.:
no nat on tl0 from 192.168.1.208 to any
nat on tl0 from 192.168.1.0/24 to any -> 24.2.74.79
The entire 192.168.1.0/24 network would have its packets translated to the external address 24.2.74.79 except for 192.168.1.208.
The no keyword can be used with nat, binat and rdr rules.

NAT Status
To view the active NAT translations pfctl(8) is used with the -s state option.

Redirection (Port Forwarding)
Redirection allows
incoming traffic to be sent to a machine behind the NAT gateway.e.g.:
rdr on tl0 proto tcp from any to any port 80 -> 192.168.1.20
This line redirects TCP port 80 (web server) traffic to a machine inside the network at 192.168.1.20. So, even though 192.168.1.20 is behind your gateway and inside your network, the outside world can access it.

Back to Ubuntu

I am back to Ubuntu for a while. I have some work to do, and I need to focus. I had trouble finding gnome tools for OpenBSD, and I am thinking of going back to FreeBSD as my desktop.
I used to have FreeBSD a while back, it was a wonderful desktop, then I started having troubles after updating to 6.1 so I decided to try something different for a while. I think I will enjoy going back to it though. I would just be better off making my own system from a FreeBSD base, that way I'll have everything I want when I want it. It should be fun.

But first I need to finish my firewall. I wrote my notes, diagrams and configurations for my network today. Now I just need to write my firewall & NAT rules, and then install everything, including the proxies, overall it shouldn't take to long. If I get off my but and do it. I have been a little preoccupied lately. I need to get my head back in to it.

At the moment I am sitting and reading the pf users guide, which is a really excellent reference.
If anyone knows of any good links they are willing to share please let me know :) Thank you. Have a good one.

OpenBSD Desktop

After backing up my data, and rebooting yesterday I decided to go for an OpenBSD Desktop.
It should be fun, and it will help me to learn heaps more about the system.
So I am sitting her at the moment in lynx. Which works quite well in blogger beta.
I am really enjoying OpenBSD so far, I feel comfortable, even though I have a lot to learn. I am finding answers to my problems very quickly.

I know that there are probably much faster and more effiecent ways of operating OpenBSD, but these are all things that I need to learn.
I miss the mouse in the commandline. Sounds strange I know, yet I got really used to it in FreeBSD
I am currently Installing gnome and playing around with other settings.
My aim is to try to get a nice easy to use desktop environment, I may need to add a few little gui tools, I will see how I go. For now I am having fun learning.
Have a good day :)

Learning Networking, OpenBSD style

I have only been learning OpenBSD for the past couple of weeks, so I am still eagerly learning how the Networking side of things works.
Until today I have never looked much into pf. I have used IPFW2 and IPF many times, and iptables a bit, but never pf. I started out with the information in the OpenBSD FAQ. I always find that this is a good place to start. Then the man pages available on the subject

Reading: I started out with the OpenBSD FAQ Networking section:
http://openbsd.org/faq/faq6.html
As well as investigating the following pages:
lo(4);
The loop interface is a software loopback mechanism which may be used for performance analysis, software testing, and/or local communication.
pflog(4);
The pflog interface is a pseudo-device which makes visible all packets logged by the packet filter, pf(4). Logged packets can easily be monitored in real time by invoking tcpdump(8) on the pflog interface, or stored to disk using pflogd(8).
sl(4);
The sl interface allows serial lines to be used as network interfaces using the slip protocol
ppp(4);
The ppp interface allows serial lines to be used as network interfaces using the Point-to-Point Protocol (PPP).
tun(4);
The tun driver provides a network interface pseudo-device. Packets sent to this interface can be read by a userland process and processed as desired.
enc(4);
The enc interface is a software loopback mechanism that allows hosts or firewalls to filter ipsec(4) traffic using pf(4).
bridge(4);
The bridge device creates a logical link between two or more Ethernet interfaces or encapsulation interfaces
vlan(4);
The vlan Ethernet interface allows construction of virtual LANs when used in conjunction with IEEE 802.1Q-compliant Ethernet devices.
gre(4);
The gre network interface allows tunnel construction using the Cisco GRE or the Mobile-IP (RFC 2004) encapsulation protocols.
gif(4);
The gif interface is a generic tunnelling pseudo-device for IPv4 and IPv6.
carp(4);
The carp interface is a pseudo-device which implements and controls the CARP protocol. carp allows multiple hosts on the same local network to share a set of IP addresses.
tcpdump(8);
tcpdump prints out the headers of packets on a network interface that match the boolean expression.
pflogd(8);
pflogd is a background daemon which reads packets logged by pf(4) to a pflog(4) interface, normally pflog0, and writes the packets to a logfile (normally /var/log/pflog) in tcpdump(8) binary format.
pf(4);
Packet filtering takes place in the kernel. A pseudo-device, /dev/pf, allows userland processes to control the behaviour of the packet filter through an ioctl(2) interface.
ioctl(2);
The ioctl() function manipulates the underlying device parameters of special files. In particular, many operating characteristics of character special files (e.g., terminals) may be controlled with ioctl() requests.
pf.conf(5);
The pf(4) packet filter modifies, drops or passes packets according to rules or definitions specified in pf.conf.
altp(9);
altq - kernel interfaces for manipulating output queues on network interfaces