openbsd　で　ｄｈｃｐｄ　＋　firewall

2015年10月14日水曜日

openbsd & UEFI

install openbsd into  USB harddisk .

1) boot linux  fdisk /dev/sdb

fdisk -l /dev/sdb
Device     Boot   Start     End Sectors  Size Id Type
/dev/sdb1          2048 1050623 1048576  512M  b W95 FAT32 <-----
/dev/sdb4       1050624 3915775 2865152  1.4G a6 OpenBSD

mkfs.vfat /dev/sdb1 <----


2)boot PC by openbsd CD op  install58(amd64 snapshots)
install openbsd by ordinal procedure .

when [make dev] ends , # appers .

then
mount /dev/sd1i /mnt2
mkdir -p /mnt2/efi/boot
cp /mnt/usr/mdec/BOOT* /mnt2/efi/boot

boot by CD

very important process
mount /dev/sda1 /mnt2--->needless command, only my mis-typing

power on PC , and push F1

set EFI

UEFI boot, look display

nomarl openbsd boot state

http://openbsd-akita.blogspot.jp/2015/10/openbsd-uefi_15.html
is the easy method to install to hard disk .

https://www.youtube.com/watch?v=bqmWOSV--mE&spfreload=10

Korean soldier when the Vietnam War was added to the sexual assault

against Vietnamese women .

But there is no apology from South Korea to Vietnam for this thing.

https://en.wikipedia.org/wiki/Phong_Nh%E1%BB%8B_and_Phong_Nh%E1%BA%A5t_massacre

https://www.youtube.com/watch?v=2oLmlYSJEy0

The term Lai Dai Han is a Vietnamese term for a mixed ancestry person

born to a South Korean father

and

a Vietnamese mother (including the victims of Korean soldiers)

during the Vietnam War.

 Lai Dai Han often live at the margins of Vietnamese society.

The South Korean government has not released an official statement

regarding the sexual violence that took place during the Vietnam War.

2015年10月3日土曜日

１）まずは

internet
|
run0
openbsd
fxp0 fxp1 em0

と　openbsd　に

一枚のwifi: run0
三枚のNIC： fxp0 fxp1 em0
の場合です。


$ cat /etc/hostname.fxp0
up

$ cat /etc/hostname.fxp1
up

$ cat /etc/hostname.em0
up

して

# cat /etc/hostname.vether0
inet 192.168.1.1 255.255.255.0 192.168.1.255
up

して

# cat /etc/hostname.bridge0
add vether0
add fxp0
add fxp1
add em0
up

します。

すると　DHCPDサーバーは

$ cat /etc/dhcpd.interface
vether0

$ cat /etc/dhcpd.conf
option domain-name-servers 8.8.8.8;

subnet 192.168.1.0 netmask 255.255.255.0 {
        option routers 192.168.1.1;
        filename "pxelinux.0";
        range 192.168.1.32 192.168.1.127;
        }

pfつまりfirewallは

# cat /etc/pf.conf

    ext_if="run0"
    int_if="vether0"

tcp_services="{ 22, 80, 143, 587 }" # submisson port
icmp_types="echoreq"
set block-policy return
set loginterface $ext_if
set skip on lo
match out on $ext_if inet from !($ext_if:network) to any nat-to ($ext_if:0)
set reassemble yes no-df
block in log
pass out quick
antispoof quick for { lo $int_if }
pass in on $ext_if   inet proto tcp from any to ( $ext_if:0 ) port $tcp_services
pass in inet proto icmp all icmp-type $icmp_types
pass in on $int_if

です。

以上にて ifconfigは　以下です -a
lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 32768
        priority: 0
        groups: lo
        inet6 fe80::1%lo0 prefixlen 64 scopeid 0x5
        inet6 ::1 prefixlen 128
        inet 127.0.0.1 netmask 0xff000000

em0: flags=8b43<UP,BROADCAST,RUNNING,PROMISC,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:e0:81:2a:bd:0f
        priority: 0
        media: Ethernet autoselect (none)
        status: no carrier
fxp0: flags=8b43<UP,BROADCAST,RUNNING,PROMISC,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:a0:c9:6d:3f:83
        priority: 0
        media: Ethernet autoselect (100baseTX full-duplex)
        status: active
fxp1: flags=8b43<UP,BROADCAST,RUNNING,PROMISC,ALLMULTI,SIMPLEX,MULTICAST> mtu 1500
        lladdr 00:a0:c9:27:dc:91
        priority: 0
        media: Ethernet autoselect (none)
        status: no carrier

enc0: flags=0<>
        priority: 0
        groups: enc
        status: active

run0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
        lladdr dc:fb:02:58:a7:cd
        priority: 4
        groups: wlan egress
        media: IEEE802.11 autoselect (DS1 mode 11g)
        status: active
        ieee80211: nwid URoad-662EA0 chan 2 bssid 00:1d:93:66:2e:a0 41dBm wpakey 0x80d48807c087a4cacbbc320ae43060ea4968c557eb3617f79938b64814467a82 wpaprotos wpa1,wpa2 wpaakms psk wpaciphers tkip,ccmp wpagroupcipher tkip
        inet 192.168.100.101 netmask 0xffffff00 broadcast 192.168.100.255

vether0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
        lladdr fe:e1:ba:d0:49:8f
        priority: 0
        groups: vether
        media: Ethernet autoselect
        status: active
        inet 192.168.1.1 netmask 0xffffff00 broadcast 192.168.1.255

bridge0: flags=41<UP,RUNNING>
        groups: bridge
        priority 32768 hellotime 2 fwddelay 15 maxage 20 holdcnt 6 proto rstp
        vether0 flags=3<LEARNING,DISCOVER>
                port 7 ifpriority 0 ifcost 0
        fxp0 flags=3<LEARNING,DISCOVER>
                port 2 ifpriority 0 ifcost 0
        fxp1 flags=3<LEARNING,DISCOVER>
                port 3 ifpriority 0 ifcost 0
        em0 flags=3<LEARNING,DISCOVER>
                port 1 ifpriority 0 ifcost 0

pflog0: flags=141<UP,RUNNING,PROMISC> mtu 33144
        priority: 0
        groups: pflog

2015年8月24日月曜日

無線を有線に変換　（TVをインターネットにつなげる）　NAT

(TV)
nic
|
fxp0
(libretto:OpenBSD)
rum0
｜
電波
｜
wifi router
というふうに　お蔵入りしているlibrettoを仲介して
TVをインターネットにつなげます。

0)余分なこと（openbsd の　pxe install）

/tftp

bsd.rd

pxeboot

etc

cat etc/boot.conf

boot tftp:/bsd.rd

1)まず予備実験です。

(hp PC)
nic
|
HUB
|
fxp0
(libretto:OpenBSD)
rum0
|
wireless
|
(fon)
nic
|
nic
router

openbsd

./comment-out.bat /etc/hostname.fxp0
inet 192.168.200.1 255.255.255.0

./comment-out.bat /etc/hostname.rum0
nwid MyPlace
wpakey 702446
dhcp

# ./comment-out.bat/etc/dhcpd.interfaces
fxp0

# ./comment-out.bat /etc/dhcpd.conf
option domain-name-servers 8.8.8.8;
subnet 192.168.200.0 netmask 255.255.255.0 {
    option routers 192.168.200.1;
    range 192.168.200.200 192.168.200.209;
}

# ./comment-out.bat tv.bat
/home/tuyosi/wifi.bat　　＜ーー＞代わりに sh /etc/netstart でもいいかも
ifconfig -a| grep 192
echo 'dhcpd------------'
/etc/rc.d/dhcpd -f restart
cp /etc/resolv.conf-127 /etc/resolv.conf
echo 'unbound----------'
/etc/rc.d/unbound -f restart
sysctl net.inet.ip.forwarding=1
pfctl -f /etc/pf.tv
pfctl -sr
ping -c 3 www.google.com

./comment-out.bat wifi.bat
ifconfig   rum0 down
ifconfig   rum0 nwid "MyPlace" wpakey "70846" up
dhclient rum0

２）本格運用
予備実験との大きな差は　DNS つまり　unbound を動かさないといけません。

(TV)
nic
|
fxp0
(libretto:OpenBSD)
rum0
｜
電波
｜
wifi router

１）ｄｈｃｐ　サーバー
./comment-out.bat /etc/hostname.fxp0
inet 192.168.12.1 255.255.255.0

# ./comment-out.bat /etc/dhcpd.interfaces                                                                                    fxp0

# ./comment-out.bat /etc/dhcpd.conf
option domain-name-servers 8.8.8.8;
subnet 192.168.12.0 netmask 255.255.255.0 {
        option routers 192.168.12.1;
filename "pxelinux.0";
        range 192.168.12.10 192.168.12.15;
}

２）unbound
# ./comment-out.bat /etc/resolv.conf
nameserver 127.0.0.1

# ./comment-out.bat /var/unbound/etc/unbound.conf
server:
        interface: 127.0.0.1
        interface: ::1
        access-control: 0.0.0.0/0 refuse
        access-control: 127.0.0.0/8 allow
        access-control: ::0/0 refuse
        access-control: ::1 allow
        hide-identity: yes
        hide-version: yes
        interface: 192.168.12.1
        access-control: 192.168.12.0/24 allow
        local-zone: "home." static
        local-data: "server.home. IN A 192.168.12.1"
        local-data: "kerai.home. IN A 192.168.12.50"
        local-data-ptr: "192.168.12.1   server.home."
        local-data-ptr: "192.168.12.10   kerai10.home."
        local-data-ptr: "192.168.12.11   kerai11.home."
local-data: "home. IN MX 10 server.home."
local-data-ptr: "192.168.12.1   server.home."

3)シェルスクリプトなど
# ./comment-out.bat /home/tuyosi/wifi.bat-rum0
ifconfig rum0 down
ifconfig rum0 nwid "URoad-662EA0" wpakey "04271" up
dhclient rum0

でrum0を　wifi routerにつなげます・

# ./comment-out.bat /etc/resolv.conf-127

nameserver 127.0.0.1

これは　unboundを動かすためです。

# ./comment-out.bat /etc/pf.tv-rum0
ext_if="rum0"
int_if="fxp0"
match out on $ext_if inet from ($int_if:network) to any nat-to ($ext_if:0)
pass in   on $int_if
pass out on $int_if
pass in   on $ext_if
pass out on $ext_if

./comment-out.bat tv.bat
/etc/rc.d/syslogd stop
/etc/rc.d/pflogd stop
/etc/rc.d/smtpd   stop
/etc/rc.d/sndiod stop
/etc/rc.d/cron    stop

/home/tuyosi/wifi.bat-rum0

cp /etc/resolv.conf-127 /etc/resolv.conf
echo 'unbound----------'
/etc/rc.d/unbound -f restart

sysctl net.inet.ip.forwarding=1
pfctl -f /etc/pf.tv-rum0

で起動します。

2015年5月27日水曜日

simple mail server ( postfix & dovecot )

how to buid mail server
using postfix and dovecot

thanks for
Thomas Bohl ,Edgar Pettijohn, Edgar Pettijoh, Craig Skinner.
if there is not their helps , i cannot achieve this .

internet
|
wifi router
192.168.100.254
|
run0 192.168.100.101
openbsd PC1 mailserver which also runs dnsmasq
bge0 192.168.11.1
|
fxp0
openbsd PC2

pkg_add postfix-2.11.4 dovecot-2.2.15p0

A) about wifi router
port forward

システム上の仮想サーバ
No.	IPアドレス	ポート範囲	プロトコル	ステータス
1	192.168.100.101	22 - 22	TCP&UDP	有効 (effective)
2	192.168.100.101	80 - 80	TCP&UDP	有効 (effective)
3	192.168.100.101	143 - 143	TCP&UDP	有効 (effective)
4	192.168.100.101	587 - 587	TCP&UDP	有効 (effectibv)
5	192.168.100.101	993 - 993	TCP&UDP	有効 (effective)

B) about PC1

real name is not a.mydns.jp but ao????? .mydns.jp.

1)
/etc/myname
------------------
a.mydns.jp

/etc/hosts
-------------
127.0.0.1         localhost
::1                  localhost
192.168.100.101 a.mydns.jp

/etc/resolv.conf
---------------------
nameserver 192.168.100.254   #<-192.168.100.254 do internet dns server
lookup file bind

/etc/dnsmasq.conf       : consists dhcpd server of intranet
---------------------------
listen-address=192.168.11.1    # Example IP
interface=bge0
dhcp-range=192.168.11.10,192.168.11.12,12h
bind-interfaces

/etc/dovecot/dovecot.conf
---------------------
protocols = imap
listen = *
!include conf.d/*.conf

/etc/dovecot/conf.d/10-mail.conf
---------------------------------------------
mail_location = maildir:~/Maildir
namespace inbox {
inbox = yes
}
mmap_disable = yes
first_valid_uid = 1000
mail_plugin_dir = /usr/local/lib/dovecot
mbox_write_locks = fcntl

2) /etc/dovecot/conf.d/10-ssl.conf
------------------------------------------------
ssl = yes
ssl_cert = </etc/ssl/dovecotcert.pem
ssl_key = </etc/ssl/private/dovecot.pem

to deal with dovecot fails with too many open files
http://comments.gmane.org/gmane.os.openbsd.misc/207288

/etc/login.conf
------------------------------------------
auth-defaults:auth=passwd,skey:
auth-ftp-defaults:auth-ftp=passwd:
default:\
        :path=/usr/bin /bin /usr/sbin /sbin /usr/X11R6/bin /usr/local/bin /usr/local/sbin:\
        :umask=022:\
        :datasize-max=512M:\
        :datasize-cur=512M:\
        :maxproc-max=256:\
        :maxproc-cur=128:\
        :openfiles-cur=512:\
        :stacksize-cur=4M:\
        :localcipher=blowfish,8:\
        :ypcipher=old:\
        :tc=auth-defaults:\
        :tc=auth-ftp-defaults:
daemon:\
        :ignorenologin:\
        :datasize=infinity:\
        :maxproc=infinity:\
        :openfiles-cur=128:\
        :stacksize-cur=8M:\
        :localcipher=blowfish,9:\
        :tc=default:
staff:\
        :datasize-cur=512M:\
        :datasize-max=infinity:\
        :maxproc-max=512:\
        :maxproc-cur=128:\
        :ignorenologin:\
        :requirehome@:\
        :tc=default:
authpf:\
        :welcome=/etc/motd.authpf:\
        :shell=/usr/sbin/authpf:\
        :tc=default:
bgpd:\
        :openfiles-cur=512:\
        :tc=daemon:
unbound:\
        :openfiles-cur=512:\
        :tc=daemon:
dovecot:\
        :openfiles-cur=2048:\
        :openfiles-max=4096:\
        :tc=daemon:

my address is not fixed address ,so i　meet
Outbound port 25 Blocking problem.

namely my wifi router (=　provider　、not dynamic dns ) prohibits
　　 port 25 forwarding . so i cannot use relay ,so can't send mail to X@google.com)

but with this limit . i will write how to solve it .

and i receive verous report(for example , crontave ) via mail ,so it is convinient .

X-1) dynamic dns' mx problem

see http://www.mhserv.info/co5/mydns.php

domain -> a.mydns.jp
mx-------->a.mydns.jp
*            A

X-3)

/etc/pf.conf
---------------------
ext_if="run0"
int_if="bge0"
tcp_services="{ 22, 80, 143, 587 }" # submisson port
icmp_types="echoreq"
set block-policy return
set loginterface $ext_if
set skip on lo
match out on $ext_if inet from ($int_if:network) to any nat-to
($ext_if:0)
set reassemble yes no-df
block in log
pass out quick
antispoof quick for { lo $int_if }
pass in on $ext_if   inet proto tcp from any to ( $ext_if:0 ) port
$tcp_services
pass in inet proto icmp all icmp-type $icmp_types
pass in on $int_if

X4)
follow http://vine.1-max.net/postfix-OP25B.html

namely
/etc/postfix/main.cf
--------------------------------
myhostname = a.mydns.jp
mydomain = mydns.jp
myorigin = $myhostname
inet_interfaces = all
mydestination = $myhostname localhost.$mydomain
home_mailbox = Maildir/
mynetworks = 192.168.100.0/24, 127.0.0.0/8
queue_directory = /var/spool/postfix
command_directory = /usr/local/sbin
daemon_directory = /usr/local/libexec/postfix
data_directory = /var/postfix
mail_owner = _postfix
inet_protocols = all
unknown_local_recipient_reject_code = 550
debug_peer_level = 2
debugger_command =
         PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
         ddd $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/local/sbin/sendmail
newaliases_path = /usr/local/sbin/newaliases
mailq_path = /usr/local/sbin/mailq
setgid_group = _postdrop
html_directory = /usr/local/share/doc/postfix/html
manpage_directory = /usr/local/man
sample_directory = /etc/postfix
readme_directory = /usr/local/share/doc/postfix/readme
relayhost = [smtp.gmobb.jp]:587 <-regretably relay ,so use personally
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/isp_auth
smtp_sasl_security_options = noanonymous

X-5) /etc/postfix/isp_auth
---------------------
[smtp.gmobb.jp]:587 t?????@ki.gmobb.jp:S?????

and
postmap /etc/postfix/isp_auth

X-6)
/etc/postfix/master.cf
--------------------------
smtp      inet n       -       -       -       -       smtpd
submission inet n       -       -       -       -       smtpd
pickup    unix n       -       -       60      1       pickup
cleanup   unix n       -       -       -       0       cleanup
qmgr      unix n       -       -       300     1       qmgr
tlsmgr    unix -       -       -       1000?   1       tlsmgr
rewrite   unix -       -       -       -       -       trivial-rewrite
bounce    unix -       -       -       -       0       bounce
defer     unix -       -       -       -       0       bounce
trace     unix -       -       -       -       0       bounce
verify    unix -       -       -       -       1       verify
flush     unix n       -       -       1000?   0       flush
proxymap unix -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix -       -       -       -       -       smtp
relay     unix -       -       -       -       -       smtp
showq     unix n       -       -       -       -       showq
error     unix -       -       -       -       -       error
retry     unix -       -       -       -       -       error
discard   unix -       -       -       -       -       discard
local     unix -       n       n       -       -       local
virtual   unix -       n       n       -       -       virtual
lmtp      unix -       -       -       -       -       lmtp
anvil     unix -       -       -       -       1       anvil
scache    unix -       -       -       -       1       scache

then do script

mail-server.bat
/etc/rc.d/dnsmasq restart
/etc/rc.d/dovecot restart
/etc/rc.d/postfix restart

to make coment out ,
commentout.bat
awk '$1 !~ "#"{print}' $1 | awk 'NF >0 {print}' -

2015年5月13日水曜日

nginx 5.7

5.7 で　pkg_add nginx はうまく動かない。

しょうがないので
http://wiki.nginx.org/OnOpenBSD
のとおりにする。

http://nginx.org/download/nginx-1.9.0.tar.gz

$ ./configure --sbin-path=/usr/local/sbin/nginx --conf-path=/etc/nginx/nginx.conf --pid-path=/var/run/nginx.pid --with-http_ssl_module --http-log-path=/var/log/nginx.log --error-log-path=/var/log/nginx-error.log --http-fastcgi-temp-path=/var/tmp/fastcgi_tmp --http-proxy-temp-path=/var/tmp/proxy_tmp --http-client-body-temp-path=/var/tmp/client_body_temp --with-http_stub_status_module --user=www --group=www

Compile and install

$ make && sudo make install

後は　以下の用にした。

ls -l /var/www/                                                                                                      
total 28
drwx------  2 www  wheel  512 Apr 11 00:06 0
drwx------  2 www  wheel  512 May 13 01:42 1
drwx------  2 www  wheel  512 Apr 11 00:06 11
drwx------  2 www  wheel  512 Apr 11 00:06 12
drwx------  2 www  wheel  512 Apr 11 00:06 2
lrwxr-xr-x  1 www  wheel    8 May 13 02:06 d0 -> /SAVE/d0
lrwxr-xr-x  1 www  wheel    8 May 13 02:05 d1 -> /SAVE/d1
lrwxr-xr-x  1 www  wheel    9 May 13 02:06 d11 -> /SAVE/d11
lrwxr-xr-x  1 www  wheel    9 May 13 02:06 d12 -> /SAVE/d12
lrwxr-xr-x  1 www  wheel    8 May 13 02:06 d2 -> /SAVE/d2
drwxr-xr-x  3 www  wheel  512 May 12 20:55 htdocs
drwxr-xr-x  2 www  wheel  512 May 13 02:20 logs

ls -l /SAVE/                                                                                                         
total 3892264
drwx------   2 www  wheel          512 Apr 11 00:06 0
drwx------   2 www  wheel          512 May 13 01:42 1
drwx------   2 www  wheel          512 Apr 11 00:06 11
drwx------   2 www  wheel          512 Apr 11 00:06 12
drwx------   2 www  wheel          512 Apr 11 00:06 2
drwxr-xr-x   3 www  wheel          512 Apr 24 18:25 d0
drwxr-xr-x   5 www  wheel          512 May 11 08:58 d1
drwxr-xr-x   2 www  wheel          512 Apr  9 05:33 d11
drwxrwxr--   8 www  tuyosi         512 May  2 10:24 d12
drwxr-xr-x   3 www  wheel          512 Dec 31 03:46 d2

/etc/nginx/nginx.conf

 worker_processes  1;
worker_rlimit_nofile 1024;
events {
    worker_connections  800;
       }
http {
    include       mime.types;
    default_type  application/octet-stream;
    index         index.html index.htm;
    keepalive_timeout  65;
    server_tokens off;

server {
        listen       80;
        server_name  localhost;    #<-for test
        root         /var/www/d0;
          }

 server {
        listen       80;
        server_name  a.mydns.jp;
        root         /var/www/d0;
          }

server {
        listen       80;
        server_name  s.sun.ddns.vc;
        root         /var/www/d1;
auth_basic "Restricted";
auth_basic_user_file /var/www/1/.htpasswd;
          }

server {
        listen       80;
        server_name  k.sun.ddns.vc;
        root         /var/www/d2;
auth_basic "Restricted";
auth_basic_user_file /var/www/2/.htpasswd;
          }

server {
        listen       80;
        server_name  m.planex.ddns.vc;
        root         /var/www/d11;
auth_basic "Restricted";
auth_basic_user_file /var/www/11/.htpasswd;
          }

server {
        listen       80;
        server_name  n.luna.ddns.vc;
        root         /var/www/d12;
auth_basic "Restricted";
auth_basic_user_file /var/www/12/.htpasswd;
          }
    }

2015年4月30日木曜日

openbsd autoinstall ; dillo 少しだけ日本語化

1)まず手動では
openbsdで　PXEサーバーをたちあげて openbsdを　インストール

internet
|
sis0
openbsd PXE server
ne3 :192.168.11.1
|
|
PC ( openbsd will be installed)

# cat /etc/hostname.ne3
inet 192.168.11.1 255.255.255.0

# cat /etc/dhcpd.interfaces
ne3

# cat /etc/dhcpd.conf

            option domain-name "example.com";
            option domain-name-servers 8.8.8.8;

            subnet 192.168.11.0 netmask 255.255.255.0 {
                    option routers 192.168.11.1;
                    filename "pxeboot";
                    range 192.168.11.30 192.168.11.31;
                    default-lease-time 86400;
                    max-lease-time 90000;
            }

# ./comment-out.bat /etc/rc.conf.local
dhcpd_flags="" #NO             # for normal use: ""
ntpd_flags=""   #NO             # for normal use: ""

# ls -l /tftpboot/
total 13860
-rw-r--r-- 1 root wheel 6987854 Apr 30 01:21 bsd.rd
drwxr-xr-x 2 root wheel      512 Apr 30 09:04 etc
-rw-r--r-- 1 root wheel    81108 Apr 30 01:04 pxeboot

# cat /tftpboot/etc/boot.conf
#tty com0 19200
#set tty com0
boot tftp:/bsd.rd

/etc/httpd.conf
ext_addr="192.168.11.1"
server "www.intranet.com" {
        listen on $ext_addr port 80
        root "/htdocs/5.7"
}

ls /var/www/htdocs/pub/5.7
INSTALL.i386 base57.tgz   bsd.rd
index.txt
xbase57.tgz xshare57.tgz
SHA256       bsd          comp57.tgz   man57.tgz    xfont57.tgz
SHA256.sig   bsd.mp       game57.tgz   pxeboot      xserv57.tgz

tftpd /tftpboot
でPXEサーバーが動く

もし　httpdではなくて　nginx の場合は

cat /etc/nginx/nginx.conf
worker_processes 1;
worker_rlimit_nofile 1024;
events {
    worker_connections 800;
}

http {
    include       mime.types;
    default_type application/octet-stream;
    index         index.html index.htm;
    keepalive_timeout 65;
    server_tokens off;
    server {
        listen       80;
        listen       [::]:80;
        server_name 192.168.11.1;
        root         /var/www/htdocs;
        error_page   500 502 503 504 /50x.html;
        location = /50x.html {
            root /var/www/htdocs;
        }
    }
}

1-1)dnsmasqをつかって
/etc/dnsmasq.conf
---------------------                                                           listen-address=127.0.0.1
listen-address=192.168.11.1
interface=fxp0
dhcp-range=192.168.11.10,192.168.11.12,12h
dhcp-boot=pxeboot
enable-tftp
tftp-root=/tftpboot

/etc/hosts
127.0.0.1       localhost
::1             localhost
192.168.11.1    01.net
192.168.11.1    02.net

/etc/nginx/nginx.conf
worker_processes 1;
worker_rlimit_nofile 1024;
events {
    worker_connections 800;
}
http {
    include       mime.types;
    default_type application/octet-stream;
    index         index.html index.htm;
    keepalive_timeout 65;
    server_tokens off;
    server {
        listen       80;
        listen       [::]:80;
        server_name 01.net;
        root         /var/www/htdocs;
        error_page   500 502 503 504 /50x.html;
        location = /50x.html {
            root /var/www/htdocs;
        }
    }
}

以下のシェルスクリプトで起動
ifconfig fxp0 192.168.11.1/24
ifconfig fxp0
echo '------------------------'
/etc/rc.d/dnsmasq restart
/etc/rc.d/nginx    restart
echo '127.0.0.1' > /etc/resolv.conf

ただし　wifiの時は
/etc/hostname.bge0 を前もってdhcpにしておかないと　dnsmasqサーバーからアドレスをもらえない。

２）本題のautoinstall です。

http://www.bsdnow.tv/tutorials/autoinstall　のとおりです。

cat /var/www/htdocs/install.conf

System hostname = bsdnow.tv
Password for root = ThePlaceToBe...SD
Network interfaces = em0
IPv4 address for em0 = dhcp
Setup a user = puffy
Password for user = whywasibornasafish
What timezone are you in = US/Eastern
Location of sets = http
Server = 192.168.1.1

----->8-----cut here ----->8-----
System hostname = tester
Which network interface do you wish to configure = em0
IPv4 address for em0 = 192.168.99.10
Netmask for em0 = 255.255.255.0
IPv6 address for em0 = none
Which network interface do you wish to configure = done
Default IPv4 route = 192.168.99.1
DNS domain name = example.com
DNS nameservers = none
Password for root account = insecure
Start sshd(8) by default = yes
Start ntpd(8) by default = no
Do you expect to run the X Window System = no
Do you want the X Window System to be started by xdm(1) = no
Setup a user = joe
Full name for user joe = Joe Blogs
Password for user joe = insecure
Public ssh key for user joe = none
Which disk is the root disk = wd0
Use DUIDs rather than device names in fstab = yes
Use (W)hole disk, use the (O)penBSD area, or (E)dit the MBR = whole
URL to autopartitioning template for disklabel = http://192.168.99.1/template
Location of sets = http
HTTP proxy URL = none
HTTP Server = 192.168.99.1
----->8-----cut here ----->8-----

/etc/rc.d/nginx stop　と　止めます。
apacheをいれます。

internet
|
sis0
openbsd PXE server
ne3 :192.168.11.1
|
|
fxp0
PC ( openbsd will be installed)

a) httpd

# cat /etc/hostname.ne3
inet 192.168.11.1 255.255.255.0

# cat /etc/dhcpd.interfaces
ne3

# cat /etc/dhcpd.conf
option domain-name-servers 8.8.8.8;
subnet 192.168.11.0 netmask 255.255.255.0 {
    option routers 192.168.11.1;
    filename "auto_install";
    next-server 192.168.11.1;
    range 192.168.11.8 192.168.11.25;
}

b)httpd

$ cat /etc/httpd.conf
server "default" {
        listen on ne3 port 80
        root "/htdocs"
        directory auto index
}

# ls -ltr /var/www/htdocs
total 340
-r--r--r-- 1 root bin      2220 Mar 6 2014 smalltitle.gif
-r--r--r-- 1 root bin      2063 Mar 6 2014 openssl_ics.gif
-r--r--r-- 1 root bin      3334 Mar 6 2014 openbsdpower.gif
-r--r--r-- 1 root bin      3361 Mar 6 2014 openbsd_pb.gif
-r--r--r-- 1 root bin      2007 Mar 6 2014 mod_ssl_sb.gif
-r--r--r-- 1 root bin     35570 Mar 6 2014 logo24.jpg
-r--r--r-- 1 root bin     46246 Mar 6 2014 logo23.jpg
-r--r--r-- 1 root bin      5417 Mar 6 2014 lock.gif
-r--r--r-- 1 root bin      4090 Mar 6 2014 bsd_small.gif
-r--r--r-- 1 root bin     41318 Mar 6 2014 blowfish.jpg
-r--r--r-- 1 root bin      2326 Mar 6 2014 apache_pb.gif
-r--r--r-- 1 root bin       537 Mar 6 2014 50x.html
-r--r--r-- 1 root bin      2269 Dec 26 05:35 index.html
drwxr-xr-x 2 root wheel     512 Apr 27 01:24 bgplg
drwxr-xr-x 3 root daemon    512 Apr 30 19:30 pub
lrwxr-xr-x 1 root daemon     11 Apr 30 20:49 auto_install -> 5.6/pxeboot
lrwxr-xr-x 1 root daemon     10 Apr 30 20:51 bsd -> 5.6/bsd.rd
drwxr-xr-x 2 root daemon    512 Apr 30 21:00 5.6
-rw-r--r-- 1 root daemon    263 May 1 02:09 install.conf

# ls /var/www/htdocs/5.6
INSTALL.i386 base56.tgz   bsd.rd       game56.tgz   xbase56.tgz xserv56.tgz
SHA256       bsd          comp56.tgz   man56.tgz    xetc56.tgz   xshare56.tgz
SHA256.sig   bsd.mp       etc56.tgz    pxeboot      xfont56.tgz

cp /var/www/htdocs/5.6/bsd.rd /tftpboot/bsd

# cat /var/www/htdocs/install.conf

System hostname = bsdnow.tv
Password for root = e-----------
Network interfaces = fxp0     #reserch NIC previouly
IPv4 address for fxp0 = dhcp
Setup a user = t-user
Password for user = f-----------
What timezone are you in = Asia/Tokyo
Location of sets = http
Server = 192.168.11.1

c)tftpd
# ls -l /tftpboot/
total 13600
lrwxr-xr-x 1 root wheel        7 Apr 30 19:23    auto_install -> pxeboot
-rw-r--r-- 1 root wheel 6918326 May 1 01:30    bsd
-rw-r--r-- 1 root wheel    81108 Apr 30 01:04       pxeboot

bsdは実は　bsd.rd でしたね

d）
/etc/rc.d/dhcpd -f restart
/etc/rc.d/httpd -f restart
tftpd /tftpboot

起動したら
cat /etc/kbdtype
jp

３)
http://cappesoft.blog21.fc2.com/blog-entry-1199.html
参考にして

./comment-out.bat .dillo/dillorc                     で日本語動くが、以下は奇妙

initially.
img.example.org,
font_serif="M+1P+IPAG"
font_sans_serif="M+1P+IPAG"
font_cursive="M+1P+IPAG"
font_fantasy="M+1P+IPAG"
font_monospace="M+1P+IPAG"
running
uniq").
viewport
start_page="http://www.searchdesk.com"
home="http://www.google.co.jp"
among
search_url="Google http://www.google.co.jp/search?ie=UTF-8&oe=UTF-8&q=%s"
search_url="YahooDictionary
http://dic.search.yahoo.co.jp/search?stype=0&dtype=2&ei=UTF-8&p=%s"
search_url="Wikipedia
http://ja.wikipedia.org/w/index.php?search=%s&go=Go"
www.iana.org/assignments/language-subtag-registry
http_language="ja"
proxy.
because it
that the
a
features
strings.
Firefox/7.0.1"
Windows...and
enterpress,
submits).
").

2015年4月28日火曜日

ftpd

vsftpdは導入が困難。
で　openbsd 純正ftpdを導入。

これは
http://www.openbsd.org/faq/faq10.html#vipw
をみれば　ftpdの導入は容易。

# echo /usr/bin/false >> /etc/shells

# adduser
Use option ``-silent'' if you don't want to see all warnings and questions.

Reading /etc/shells
Check /etc/master.passwd
Check /etc/group

Ok, let's go.
Don't worry about mistakes. There will be a chance later to correct any input.
Enter username []: ftp
Enter full name []: anonymous ftp
Enter shell csh false ksh nologin sh [ksh]: false
Uid [1002]: Enter
Login group ftp [ftp]: Enter
Login group is ``ftp''. Invite ftp into other groups: guest no 
[no]: Enter
Login class authpf daemon default staff [default]: Enter
Enter password []: Enter
Disable password logins for the user? (y/n) [n]: y

Name:        ftp
Password:    ****
Fullname:    anonymous ftp
Uid:         1002
Gid:         1002 (ftp)
Groups:      ftp
Login Class: default
HOME:        /home/ftp
Shell:       /usr/bin/false
OK? (y/n) [y]: Enter
Added user ``ftp''
Copy files from /etc/skel to /home/ftp
Add another user? (y/n) [y]: n
Goodbye!

# ./comment-out.bat /etc/rc.conf.local
dhcpd_flags="" #NO             # for normal use: ""
ntpd_flags=""   #NO             # for normal use: ""
ftpd_flags="-llUSA"

Users in a login class with the ftp-chroot variable set are automatically chrooted.
Additionally, you can add a username to the file /etc/ftpchroot to chroot those usernames.
だけ覚えていけばよい。

普通に　ユーザー　ftp-1をつくってここにロウロクすれば
chroot される。
IDとパスワードがついてくる。
lftp OB -i ftp-1 てかんじ。

lftp OB だと　/home/ftpにはいっていく。

問題はこれからで
opebsdをインターネットに晒すftpサーバーするには、
http://www.openbsd.org/faq/pf/ftp.html
をみないとできない。

インターネットの場合は　普通は１台のマシンだけだから
PF is running on the FTP server itself　なので

インターネット---------router------------------------------linux(実験用)
                                       |
                                     sis0 OpenBSD ne3--intraet

from linux, lftp OpenBSD -u joe

int_if="ne3"
ext="sis0"
tcp_services="{ 22, 113 }"
icmp_types="echoreq"
set block-policy return
set loginterface $ext
set skip on lo
match out on $ext inet from !($ext:network) to any nat-to ($ext:0)
block in log
pass out quick
antispoof quick for { lo $int_if }
pass in on $ext inet proto tcp from any to ($ext) port $tcp_services
pass in inet proto icmp all icmp-type $icmp_types
pass in on $int_if
pass in on $ext proto tcp to port 21
pass in on $ext proto tcp to port > 49151

くらいでできる。

登録: 投稿 (Atom)