Blog

Inspired

https://obsd.solutions/en/blog/2023/01/11/minio-on-openbsd-72-install/

Requirements

• Fresh VM, running OpenBSD 7.2, fully patched

• Public IP, all Ports allowed

• FQDN pointing to your IP

run all the commands as root (or with ‘doas’ prepending …)

add Package

as usual with OpenBSD

pkg_add minio

Extend File Limits

we need some more current open files …

cat << EOF >> /etc/login.conf

# Minio, added $(date)
EOF

cat << 'EOF' >> /etc/login.conf
minio:\
  :openfiles-cur=4096:\
  :openfiles-max=8192:\
  :tc=daemon:
EOF

# Rebuild capdb
cap_mkdb /etc/login.conf

don’t forget go restart the box

About

Authelia is an open-source authentication and authorization server and portal fulfilling the identity and access management (IAM) role of information security in providing multi-factor authentication and single sign-on (SSO) for your applications via a web portal. It acts as a companion for common reverse proxies.

https://www.authelia.com/

Requirements

• Host with Public IP & Docker Running

• Port 80 & 443 Public Reachable

• FQDN pointing to your IP Adress. Best is a Wildcard Record like *.your.host.de -> 1.2.3.4

How to Build a Package on OpenBSD

Thx for the Initial Support [email protected] …!

Useful Links

• https://www.openbsd.org/faq/ports/guide.html

• https://bsd.port.mk/

Setup Build Machine on Current

• Install OpenBSD
• Upgrade to Current
• get SYS & Ports

Switch to Port to Update

cd /usr/ports/net/scapy

• Change to 2.5.0

• make makesum

• make update-plist

• make

• make test

• make install

• make package

Add your own PKG Repo

export PKG_PATH="https://your.server.de/pub/OpenBSD/7.2/packages-self/amd64/"

# Check Repo
root@host# pkg_info -Q scapy                                                                                                 
scapy-2.5.0p0

# add Repo
root@host# pkg_add -V scapy
https://your.server.de/pub/OpenBSD/7.2/packages-self/amd64/scapy-2.5.0p0.tgz: unsigned package
Couldn't install scapy-2.5.0p0

# allow unsigned, as this is build on my own
root@host# pkg_add -D unsigned scapy
scapy-2.5.0p0: ok

Todo

• Check Upgrade Path

Intro

After a Basic Setup with fix Configuration, here an example where we put some Variables in a “.env” File.

Requirements:

Linux Host with Docker see here, Public IP Adress and rechable Port 80 & 443

two FQDN pointing to your IP:

• traefik.yourdomain.de
• whoami.yourdomain.de

Env Vars

let’s run the following Commands which generates a “.env” File. It will also create a User “dashboard” and ask you twice for the Password

echo 'domain="your.domain.de"'      > .env
echo 'traefik="traefik.${domain}"'  >> .env
echo 'whoami="whoami.${domain}"'    >> .env
echo 'mail="name@${domain}"'        >> .env
echo -n 'dashboardaccount="' >> .env; echo -n $(htpasswd -nB dashboard) |sed -e s/\\$/\\$\\$/g >> .env; echo '"' >> .env

.env

and here is the Content of my .env File.

Run Simple Secure Webserver in 20 sec

assuming you have Docker Instance and wanna run a Secure Webserver in a few Seconds ? Here is an Example how todo it …

Fireup Docker

start a fresh and empty Container with Alpine Linux. Get a Shell. Docker will be removed when you leave the shell (–rm)

docker run -it --rm -p 80:80 -p 443:443 --name alpine-ssl alpine /bin/sh

Set FQDN

this should point to your ip address …

wanna tunnel IP over SSH ? give a try ? Tested for you with … OpenBSD :)

Host1

do the following as root

echo "net.inet.ip.forwarding=1" >> /etc/sysctl.conf
sysctl net.inet.ip.forwarding=1

echo "inet 10.0.0.1 255.255.255.0 10.0.0.2" >> /etc/hostname.tun0
sh /etc/netstart tun0

sed -i '/PermitTunnel .*/PermitTunnel                      yes/' /etc/ssh/sshd_config
rcctl restart sshd

ssh-copy-id root@host2

Host2

do the following as root

echo "net.inet.ip.forwarding=1" >> /etc/sysctl.conf
sysctl net.inet.ip.forwarding=1

echo "inet 10.0.0.2 255.255.255.0 10.0.0.1" >> /etc/hostname.tun0
sh /etc/netstart tun0

sed -i '/PermitTunnel .*/PermitTunnel                      yes/' /etc/ssh/sshd_config
rcctl restart sshd

ssh-copy-id root@host1

now do ifconfig tun0 on Host1 and Host2 -> tunnel should be down

How to get OpenBSD on OKdo Rock 4C+

got a new Toy and i’d like to put puffy on it

• Hardware OKDO
• Hardware Wiki
• Getting Started
• Inspired by exoticsilicon
• Serial Console

Mount SD Card on APU/existing HW

dmesg |grep sd1

sd1 at scsibus2 targ 1 lun 0: <Generic-, Multi-Card, 1.00> removable serial.0bda0309201209010309
sd1: 58911MB, 512 bytes/sector, 120649728 sectors

Speedtest

dd if=/dev/random of=/dev/rsd1c bs=1m count=512

dd: /dev/rsd1c: Device not configured

not working properly :(

do you know that you can forward Variables through SSH ?

sha256: a09f31ecd22a35832bb0a2d937c44853f1a7d754d60c6a41f38153d5e56ce84f

made a few Slides about SSH Agent & Agent Forwarding with https://slides.com. Do you like it ? I do …

sha256: dd15fd6475246beedee7f6c61924134c76248cf5e28d7092283475c97e9f2f50

Softraid

Inspired by a book from MWL - OpenBSD Mastery Filesystems, here some Notes ..

Target

build a RAID with 3 Disks, add some Data, destroy one Disk, and rebuild the Raid (and it’s Data).

Requirements

• OpenBSD 7.2 Running
• added 3 Disk with 20G each: sd0, sd1, sd2

Find Disks

root@puffy # dmesg |grep -i sec

wd0: 64-sector PIO, LBA, 20480MB, 41943040 sectors
sd0: 20480MB, 512 bytes/sector, 41943040 sectors
sd1: 20480MB, 512 bytes/sector, 41943040 sectors
sd2: 20480MB, 512 bytes/sector, 41943040 sectors

sd0, sd1, sd2 are New Disks for RAID