Adding a couple of more OpenBSD VMs from OpenBSD.Amsterdam
To do some more OpenBSD fiddling without fiddling with actual hardware, I was looking for some extra virtual machines. I asked around for other options, but not many came up, and they were not particularly more interesting than OpenBSD.Amsterdam.
So yesterday I asked Mischa to set up two now virtual machines for me and this morning I wanted to do some basic setup.
First thing I tried was using ansible. I had already used ansible in the past on some other OpenBSD machines, but apparently the code needed fixing / updating / exploded in my face. When trying to 'fix' this by updating ansible on my Mac with a 'brew update', more stuff exploded and I was kinda done with ansible on my macbook. I logged into my Linux Laptop at this stage
Sooooo... I thought about using another tool for a second, Puppet came to mind. But that needs a server, and probably a Linux server. And I was trying to play with BSD here, so not really an attractive option.
Going oldskool
When bootstrapping new stuff, there are always these catch-22 situations. To run Y, you first need Z. So I figured I would try the approach of The Ancients from the last Millennium:
Just Run A Shell Script
Sample output:
redpuffy# ksh /home/eelco/no_ansible.sh
Preparing Lutra IT baseline setup for OpenBSD 7.4
Set hostname
redpuffy.lutra.it
Set up self signed certificate
Generating a 4096 bit RSA private key
..............
..........................
writing new private key to '/etc/ssl/private/redpuffy.lutra.it.key'
-----
Install baseline packages
quirks-6.159 signed on 2023-11-17T18:34:15Z
Configure doas
Set Lutra MOTD
Set authorized keys for root user
Set authorized_keys for user eelco
Configuring sshd
sshd(ok)
sshd(ok)
Install auto update shell script
Install postfix package
quirks-6.159 signed on 2023-11-17T18:34:15Z
Setup postfix aliases
smtpd(ok)
postfix(ok)
Good enough for now, will revisit when the need arises. The only thing I really missed was a safe way to handle secrets/passwords. For now I need to protect the original script or reset my authenticated smtp password.
That Was Fun
The full script with sensitive bits removed:
#!/bin/ksh
function report
{
logger "$1"
echo "$1"
}
UNAME=`uname -r`
report "Preparing Lutra IT baseline setup for OpenBSD $UNAME"
report "Set hostname"
SHORTHOSTNAME=`hostname | awk 'BEGIN { FS="."; } { print $1; }'`
FQDN=$SHORTHOSTNAME.lutra.it
hostname -s $FQDN
hostname
report "Set up self signed certificate"
if [ ! -f /etc/ssl/private/$FQDN.key ];
then
openssl req -x509 -newkey rsa:4096 -nodes -keyout /etc/ssl/private/$FQDN.key -out /etc/ssl/$FQDN.crt -sha256 -days 3650 -nodes -subj "/C=NL/ST=ZH/L=Sommelsdijk/O=Lutra IT/OU=Operations/CN=$FQDN"
fi
report "Install baseline packages"
pkg_add python3 neofetch bash curl wget git
report "Configure doas"
cat << EOF > /etc/doas.conf
# Allow wheel by default
permit keepenv :wheel
permit keepenv nopass eelco
EOF
report "Set Lutra MOTD"
cat << EOF > /etc/motd
Lutra IT
Unauthorized access prohibited
For support and inquiries please contact
us at XXXXXXX@lutra-it.eu or via signal at
+31 XXXXXXXXX - @systeemkabouter
EOF
report "Set authorized keys for root user"
mkdir -p /root/.ssh
cat << EOF > /root/.ssh/authorized_keys
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM6zfzF3846AZ0vjKWPIAQLYtpAsym+xp6kgWTQI1viZ
EOF
chmod -R go-rwx /root/.ssh
report "Set authorized_keys for user eelco"
mkdir -p /home/eelco/.ssh
cat << EOF > /home/eelco/.ssh/authorized_keys
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIM6zfzF3846AZ0vjKWPIAQLYtpAsym+xp6kgWTQI1viZ
EOF
chmod -R go-rwx /home/eelco/.ssh
report "Configuring sshd"
cat << EOF > /etc/ssh/sshd_config
AllowTcpForwarding yes
ChallengeResponseAuthentication no
HostbasedAuthentication no
HostKeyAlgorithms ssh-ed25519-cert-v01@openssh.com,ssh-ed25519
IgnoreRhosts yes
KexAlgorithms -diffie-hellman-group1-sha1,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com
PasswordAuthentication no
PermitEmptyPasswords no
PermitRootLogin without-password
PrintLastLog yes
PrintMotd yes
Protocol 2
Subsystem sftp /usr/libexec/sftp-server
TCPKeepAlive yes
UseDNS no
X11Forwarding no
EOF
rcctl restart sshd
report "Install auto update shell script"
mkdir -p /opt/sa/bin
cat << EOF > /opt/sa/bin/openbsd_updates.sh
#!/usr/local/bin/bash
#
WAITIME=`/bin/expr $RANDOM % 600`
if [[ "X$WAITTIME" == "X" ]];
then
WAITTIME=1
fi
sleep $WAITTIME
logger "$0 autoinstalling updates "
syspatch >> /var/log/syspatch.log
exit 0
EOF
chmod 0550 /opt/sa/bin/openbsd_updates.sh
echo "/opt/sa/bin/openbsd_updates.sh" > /etc/daily.local
chmod u+x /etc/daily.local
report "Install postfix package"
if [ $UNAME == "7.4" ];
then
pkg_add postfix-3.8.20221007p11
else
report "Dont know which postfix to install on $UNAME"
fi
report "Setup postfix aliases"
cat << EOF > /etc/postfix/aliases
root:XXXXXXXXXX@lutra-it.eu
eelco:XXXXXXXXX@lutra-it.eu
mailer-daemon: postmaster
postmaster: root
nobody: root
hostmaster: root
usenet: root
news: root
webmaster: root
www: root
ftp: root
abuse: root
noc: root
security: root
logcheck: root
EOF
newaliases
cat << EOF > /etc/postfix/sasl_passwd
smtp.transip.email:465 XXXXXXXXXXXX@lutra-it.eu:XXXXXXXXXXXXX
EOF
chmod g-rwx /etc/postfix/sasl_passwd
cat << EOF > /etc/postfix/main.cf
smtpd_banner = $myhostname ESMTP $mail_name
biff = no
append_dot_mydomain = no
# See http://www.postfix.org/COMPATIBILITY_README.html -- default to 2 on
# fresh installs.
compatibility_level = 3.8
queue_directory = /var/spool/postfix
command_directory = /usr/local/sbin
daemon_directory = /usr/local/libexec/postfix
data_directory = /var/postfix
sendmail_path = /usr/local/sbin/sendmail
newaliases_path = /usr/local/sbin/newaliases
mailq_path = /usr/local/sbin/mailq
html_directory = /usr/local/share/doc/postfix/html
manpage_directory = /usr/local/man
sample_directory = /etc/postfix
readme_directory = /usr/local/share/doc/postfix/readme
shlib_directory = no
meta_directory = /etc/postfix
# TLS parameters
smtpd_tls_cert_file=/etc/ssl/$FQDN.crt
smtpd_tls_key_file=/etc/ssl/private/$FQDN.key
smtpd_use_tls=yes
smtpd_tls_session_cache_database = btree:${data_directory}/smtpd_scache
smtp_tls_session_cache_database = btree:${data_directory}/smtp_scache
mail_owner = _postfix
setgid_group = _postdrop
canonical_maps = hash:/etc/postfix/canonical
smtpd_relay_restrictions = permit_mynetworks permit_sasl_authenticated defer_unauth_destination
myhostname = $FQDN
alias_maps = hash:/etc/postfix/aliases
alias_database = hash:/etc/postfix/aliases
#myorigin = $myhostname
mydestination = $myhostname, localhost
unknown_local_recipient_reject_code = 550
relayhost = smtp.transip.email:465
mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
mailbox_size_limit = 0
recipient_delimiter = +
inet_interfaces = all
inet_protocols = ipv4
# enable SASL authentication
smtp_sasl_auth_enable = yes
# disallow methods that allow anonymous authentication.
smtp_sasl_security_options = noanonymous
# where to find sasl_passwd
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
# Enable STARTTLS encryption
smtp_use_tls = yes
smtp_tls_wrappermode = yes
smtp_tls_security_level = encrypt
EOF
/usr/local/sbin/postfix-enable
rcctl stop smtpd
rcctl disable smtpd
rcctl enable postfix
rcctl start postfix