Following the ‘not enough time on my hands’ FreeBSD dive with a Power Mac, I decided to continue on BSD tourbus to OpenBSD. A good friend recommended it to me in the middle of my FreeBSD install and I’d of like to heard about it alot sooner. OpenBSD turned out to be a really great os, particularly for a router/firewall. I now have OpenBSD running successfully and it’s running good. The install does take a bit of work but the results are b-e-a-utiful.
OpenBSD is a shootoff of NetBSD (Berkly Software Distribution) that focuses on security – the code that is in OpenBSD is carefully audited. This guide will walk you through a basic install of OpenBSD (a few parts are macppc specific) and adds parts if you’d like to make OpenBSD a router.
Dual Boot MacOS?
The OpenBSD installer only has support for fdisk and not mac-fdisk so if you plan to dual-boot MacOS you should partition either with mac-fdisk (see the FreeBSD install link above), or with a Mac OS util like Disk Setup. Create one partition for Mac OS and another for OpenBSD. However, this install focuses on a whole disk install of OpenBSD.
Beginning with the installer
You might want to use OpenBSD’s Installation Guide as a companion guide along with this.
Put in the CD on a mac – you’ll have to start the cd from the Open Firmware prompt. Hold (Apple + option + O + F). at boot and at the OF prompt, type:
The release cd will allow you to install, upgrade or use the shell:
If you say no, you will be taken to fdisk where all you’ll be able to do is to type and label partitions. OpenBSD uses a two layer disk partitioning system: ‘fdisk’ and ‘disklabel’. If you are using the whole disk fdisk will be automatically configured.
‘disklabel’ is a tool to create partitions.
You’ll be shown available Network Interface Cards (NIC)s. If you’re building a router, you’ll have two. The first one will get it’s address via the ISP DHCP server. On the second one assign a LAN address like 192.168.111.7.
If you choose dhcp, OpenBSD install will try to get a lease from the DHCP server. I didn’t bother connecting the cables because InstallerCD’s are notably insecure and the installer doesn’t need it anyway.
Enter your Domain Name Servers (separated by a space) and password for root account. Choose your install sets, the defaults will give you a basic system.
Enter timezone, and then your done with the basics.
Reboot and start the Open Firmware prompt and boot OpenBSD by:
There are a few tasks that need to be done to finish the install following the afterboot manpage.
If a reliability or security issue effects you, you will have to patch your system – a detailed proposition which I will detail in another post.
check ‘date’, ‘hostname’, networking will be done in a bit.
Add new user
Set-mailserver aliases in
Run ‘newaliases’ to update sendmail aliases.
A sendmail-configuration file will need to be built, from papamike:
Sendmail configuration files are built with a macro-processor. A macro-processor is basically a program that scans text looking for defined symbols, which it replaces by other text — or other symbols. The one used with Sendmail is called m4… So m4 inputs a macro configuration file, with extension .mc, and outputs a sendmail configuration file to standard output. Typically we redirect this output to a file, with extension .cf
Luckily there are some examples. If not planning to use sendmail externally (i.e. to the internet) use openbsd-localhost.cf.
Then test it:
A valid config will give no output. Now tell the the sendmail daemon to load the configuration file at boot in
The -C/ is necessary, it’s not a typo.
Daily, weekly, monthly scripts
Run the daily and weekly scripts to make sure they run alright.
Rebuilding locate database:
Not installing locate database; zero size
vi /var/db/locate.database“, put a space in, save it “:x”, and run the weekly script again.
Tighten up security
OpenBSD doesn’t have a journaled file-system, meaning that you could lose critical disk data in event of a crash. Rather OpenBSD has incorporated soft updates a userland program that performs a likewise task that also improves disk performance by utilizing a cache. Adding the softdep option to each ffs partition in
/etc/fstab will enable soft updates at next boot.
CD/DVD define mount point
Following the Network FAQ. The installer will have created
/etc/hostname.<NIC> for each device you have. Make sure they are correct:
For a router, ip-forwarding will need to be enabled in
Enter your DNS servers in
If you are planning to be testing a firewall and disconnecting your internet-connection from time to time, its good to up dhclients timeout. ‘dhclient’ rechecks it’s connection to the DHCP server on an exponential scale if it is unable to locate it it will take down the WAN NIC. Add to
dhclient.conf and get larger timeouts as time goes by:
To be able to connect the LAN PC to the network this guide uses dnsmasq (a good solution for small networks) but first it is a good idea to setup firewall and close unused ports.
Enabling a Firewall
Building a firewall is a necessary evil, even on the most secure of systems networking will be the greatest security-hole. Here are a few tips for working with PF:
Enable PF at Boot:
‘ftp-proxy’ will need to be enabled to ftp past a firewall, first enable it at boot:
Enable ftp-proxy in the NAT section of your pf.conf:
And in the filter section, anchor ftp and allow pass out:
Another good idea is when writing block-rules to log them to be able to test the firewall and to see if there are any attempts to attack the firewall:
To check your PF configuration for errors, run:
A couple other commands:
To test the firewall in real time, run ‘pflogd’ then:
To have pflog load at boot:
You may have to reboot to have pflog0 show up in ifconfig. Now that the firewall is up you can start (or restart) the network:
Adding a Package
OpenBSD has two ways to add software: package and ports. Packages are pre-built binaries that can be downloaded and quickly installed onto your system and are the recommended way to add software to your system. OpenBSD also has a port system that contains information necessary to build packages and their dependencies from source.
Those are back ticks BTW. `uname -r` adds your release version of OpenBSD you are using and `machine -a` will be your architecture. To source (reload) your .profile so the variable is known to the korn shell:
Then add a package:
A couple other package commands:
Configure the LAN
Now that you can add a package you can add dnsmasq and get your router going. It is possible to define a static-route and not to have to use a DHCP server to define an address and route, but using a DHCP server makes the job tons easier. dnsmasq is a great lightweight application that will provide a route to and from the LAN machine. dnsmasq is also provides a DNS cacher to make resolving of domain names very very fast.
If planning on creating a LAN of > 50 machines you should use the pre-installed dhcpd.
dhclient.conf will need to be edited again to know that dnsmasq is handing dns requests. Redirect dhclient to localhost and dnsmasq will take it from there.
dhclient by default appends to
/etc/resolv.conf details to use the pre-installed BIND name server assuming people are going to use it. BIND isn’t enabled by default and since dnsmasq is handling this, comment out “lookup file bind” in
/etc/resolv.conf.tail and restart the network:
Now you can start dnsmasq:
To load at boot put in rc.local:
To have your LAN computer connect to your router set it to dhcp and connect.
Test DNS caching:
Do it again and you’ll notice a faster lookup.
Many NTP configurations default to pool.ntp.org which is great for a whole list to choose from from the entire world, but it’s better to use something local ;). Add to
Because ntpd slowly adjusts the clock if it’s off you can add to crontab entry to get it fixed daily:
Securing the Network
A good firewall will close ports but some applications may try to open them again. Best to close any ports you don’t need. Run netstat and get a good idea of what’s open:
Shows open ports:
TCP – 13 37 22 113
UDP – 514
To find out what these ports do:
daytime, time, ssh, auth, and syslog (udp). You can find more infomation about the port (like the program that opened it) with:
Most people don’t use daytime, time, auth anymore and can be safely disabled in
The Syslog port can not be turned off in inetd. It is invoked in rc.conf with no “-u” flag meaning that it is listening on UDP port 514 but that incoming packets are ignored, it is only used to send. You’ll will also see a couple ports open for tcp6 (ipv6) like ::1.587 or ::1.25 these are loopbacks (local) for ipv6 and will be secure from the outside world.
Using nmap is an ever more reliable way to test for open ports. Now that the firewall is up, you might want to add nmap and test it.
SSH opens port 22 to world by default, If you don’t plan on accessing from outside you can bind it to your LAN computer in
Also root login is a bad idea, since the regular user is able to su this is a good idea to define:
Add a key so trusted computers can connect:
Use a password that is not your login password. Name the output something useful like powermac-dsa-key. These keys by default are generated into the local
~/.ssh/ directory but belong in the accessee’s
~/.ssh directory. Move them to the LAN computer
~/.ssh to be a trusted computer.
That should get you a good start.