How to Create Bootable USB Stick for OpenBSD

OpenBSD

Download “install66.fs”

Open balenaEtcher on OSX

Proceed

-> seems not to work :(

build USB Stick with DD

mount
/dev/disk4s1 on /Volumes/Ohne Titel (hfs, local, nodev, nosuid, journaled, noowners)

Open DiskUtils

Unmount “Ohne Titel”

DD

osx$ sudo dd if=install66.fs of=/dev/disk4s1 bs=1m

wait 10min

done

Any Comments ?

sha256: 82aedd94540efdd5f343399a0d3d67cab01c64cb5ee70f441427fd5cbfa136da

OpenBSD 6.x Diskusage

OpenBSD

How much Disk is used with Default Partitioning

puffy66# df -h
Filesystem     Size    Used   Avail Capacity  Mounted on
/dev/sd0a     1005M   96.1M    858M    10%    /
/dev/sd0k      9.6G    2.0K    9.1G     0%    /home
/dev/sd0d      1.8G   12.0K    1.7G     0%    /tmp
/dev/sd0f      2.5G    955M    1.4G    39%    /usr
/dev/sd0g     1005M    202M    752M    21%    /usr/X11R6
/dev/sd0h      4.2G    218K    3.9G     0%    /usr/local
/dev/sd0j      5.8G    2.0K    5.5G     0%    /usr/obj
/dev/sd0i      1.7G    2.0K    1.6G     0%    /usr/src
/dev/sd0e      2.8G    5.9M    2.7G     0%    /var

Example with 32 GB

puffy66# df -h
Filesystem     Size    Used   Avail Capacity  Mounted on
/dev/sd0a      3.9G   96.1M    3.6G     3%    /
/dev/sd0g      7.8G    2.0K    7.4G     0%    /home
/dev/sd0d      2.0G   12.0K    1.9G     0%    /tmp
/dev/sd0f      7.9G    1.1G    6.4G    15%    /usr
/dev/sd0e      7.9G    5.9M    7.5G     0%    /var

Partition Proposal for 16GB

/dev/sd0a 2G  /
/dev/sd0b 1G  swap
/dev/sd0d 1G  /tmp
/dev/sd0e 4G  /var
/dev/sd0f 4G  /usr
/dev/sd0g 4G  /home

Partition Proposal for 20GB

/dev/sd0a 2G  /
/dev/sd0b 1G  swap
/dev/sd0d 1G  /tmp
/dev/sd0e 6G  /var
/dev/sd0f 6G  /usr
/dev/sd0g 4G  /home

Partition Proposal for 32GB

/dev/sd0a 4G  /
/dev/sd0b 2G  swap
/dev/sd0d 2G  /tmp
/dev/sd0e 8G  /var
/dev/sd0f 8G  /usr
/dev/sd0g 8G  /home

Partition Proposal for 64GB

/dev/sd0a 4G  /
/dev/sd0b 2G  swap
/dev/sd0d 2G  /tmp
/dev/sd0e 8G  /var
/dev/sd0f 8G  /usr
/dev/sd0g 8G  /home
/dev/sd0h 32G /data

Templates APU 16GB

cat << 'EOF' > autodisklabel
/       2G
swap    0.5G
/tmp    1G
/usr    4G
/var    4G
/home   4G
EOF

Templates APU 120GB

cat << 'EOF' > autodisklabel
/       4G
swap    4G
/tmp    4G
/usr    8G
/var    8G
/home   16G
/data   64G
EOF

Quick and Dirty APU 120GB

a 4G /root
a 4G swap
a 4G /tmp
a 8G /usr
a 8G /home
a *  /var

-> which results in:

apu-120GB# df -h
Filesystem     Size    Used   Avail Capacity  Mounted on
/dev/sd0a      3.9G   75.0M    3.6G     2%    /
/dev/sd0f      7.8G    2.0K    7.4G     0%    /home
/dev/sd0d      3.9G   16.0K    3.7G     0%    /tmp
/dev/sd0e      7.8G    1.2G    6.1G    17%    /usr
/dev/sd0g     81.1G    7.0M   77.1G     0%    /var
Any Comments ?

sha256: 8b0fa0f79f422c4d4ed8eb1ee67cda1d67470ff8aec34f18bb7715b6ea4291f0

BasicAuthentication with Nginx

Web

NOT YET WORKING …

Install NGINX

pkg_add -v nginx

rcctl enable nginx
rcctl restart nginx

Enable BasicAuth

server {
    ...
    auth_basic           "Administrator’s Area";
    auth_basic_user_file conf/htpasswd;

    location /public/ {
        auth_basic off;
    }
}

Create File and User

htpasswd -c /etc/apache2/.htpasswd user1

Restart Service

rcctl restart nginx

Source

https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/

Any Comments ?

sha256: b0311dad9186b4e2f8cd9730688c8e75c09a3ff687259cccc132810a706cb2f6

BasicAuthentication with httpd

Web

Enable Auth

server "default" {
  listen on * port 80
  authenticate "secure area" with "/htpasswd.conf"
}

create htpasswd file

htpasswd /var/www/htpasswd.conf user-x
Password:
Retype Password:

chown www /var/www/htpasswd.conf
chmod 600 /var/www/htpasswd.conf

Restart Service

rcctl restart httpd
Any Comments ?

sha256: b934f5b05de5100f7a6f13e4e93003740ca9704b37a4302abe51f0b8d9a1f7b3

how to create a bootable usb stick for catalina (MacOS 10.15)

Blog

stick: 16 GB

format with GUID, name it USB

cli: sudo /Applications/Install\ macOS\ Catalina.app/Contents/Resources/createinstallmedia –volume /Volumes/USB/ –nointeraction

wait about 20min

Any Comments ?

sha256: 01b5e44e316946854669173480af11682adf6a20f659711acf203473a601d253

how to move on the cli

OpenBSD

Any Comments ?

sha256: 92b20e0a803b2e3c9a987fe89c259ac9bd069b22732d93f80d0626fae15e733b

Ansible tricks

Blog

Show Hostvars

ansible -m debug -a "var=hostvars['puffy']" localhost

Build Encrypted Variable

echo -n 'letmein' | ansible-vault encrypt_string --stdin-name 'vault_my_var'
vault_my_var: !vault |
          $ANSIBLE_VAULT;1.1;AES256
          31366161316337383034303536623932613436333530333435366132383637643366333931663732
          3761653137313030323036336435633134663861313939380a663939393263383934323864663265
          34353632646137356535323536643565616561376133313936313763386164333234663233643561
          6364396632663133380a356132343239386632356562333538633236646665653531333438653165
          6465

Ansible Loops Overview

https://chromatichq.com/blog/untangling-ansibles-loops

Anstom Log

Source: https://github.com/octplane/ansible_stdout_compact_logger/commit/d8effb3c85d1b9364d3efab9360f8470bc76fc26

Any Comments ?

sha256: eeb8c85d2b71a4b18ec1d57d131234a75ecfd47c140a6bba3a058c6a68da5bc1

Multicast

OpenBSD

/etc/mrouted.conf

name LOCAL 239.255.0.0/16
phyint em1 disable

forward multicast

sysctl.conf
net.inet.ip.mforwarding=1

enable and start Service

rcctl enable multicast
rcctl start multicast
rcctl enable mrouted
rcctl start mrouted

useful commands

netstat -g
map-mbone
mrinfo
mtrace

https://felix-kling.de/blog/2019/sonos-dedicated-vlan.html

Any Comments ?

sha256: 8f43d20c9f3186346dfab5fb16a3de63b780d414c608ce12f0d096089fbf9642

Dualstack

OpenBSD

DualStack & Prefix Delegation with OpenBSD

OS: OpenBSD 6.5

Hint: wide-dhcpv6-20080615p9 was not working fine. So, i gave a try with dhcpcd

Install Package

pkg_add dhcpcd-7.1.1p4

Configure dhcpcd

/etc/dhcpcd.conf
ipv6only
noipv6rs
duid
persistent
option rapid_commit
require dhcp_server_identifier

# disable running any hooks; not typically required for simple DHCPv6-PD setup
script ""

# List interfaces explicitly so that dhcpcd doesn't touch others
allowinterfaces em1 vlan108 vlan110 vlan112

interface em1
    # the following two lines tell dhcpcd to do router solicitation
    # itself. don't use them if using "inet6 autoconf" (slaacd)
    ipv6rs
    ia_na 1

    # request prefixes from the provider to use for downstream networks
    ia_pd 2 vlan108/1 vlan110/2 vlan112/3

Enable and Start Service

rcctl enable dhcpcd
rcctl restart dhcpcd

You sould now get a ip address on your public interface. adjust the pf.conf accordingly for ipv6 !

Netbox

Network

How to Install Netbox on Debian 10.1

URL: https://github.com/netbox-community/netbox

install postgresql

apt-get install -y postgresql libpq-dev sudo
pg_ctlcluster 11 main start

create database

# sudo -u postgres psql
psql (9.4.5)
Type "help" for help.

postgres=# CREATE DATABASE netbox;
CREATE DATABASE
postgres=# CREATE USER netbox WITH PASSWORD 'streng-geheim-und-so';
CREATE ROLE
postgres=# GRANT ALL PRIVILEGES ON DATABASE netbox TO netbox;
GRANT
postgres=# \q

psql -U netbox -W -h localhost netbox
streng-geheim-und-so
netbox=> quit

install application

apt-get install -y python3 python3-pip python3-dev build-essential libxml2-dev libxslt1-dev libffi-dev graphviz libpq-dev libssl-dev redis-server zlib1g-dev git

install a release (we skip that)

# wget https://github.com/netbox-community/netbox/archive/vX.Y.Z.tar.gz
# tar -xzf vX.Y.Z.tar.gz -C /opt
# cd /opt/
# ln -s netbox-X.Y.Z/ netbox
# cd /opt/netbox/

install via github

mkdir -p /opt/netbox/ && cd /opt/netbox/
git clone -b master https://github.com/netbox-community/netbox.git .

set permission

chown -R netbox:netbox /opt/netbox/netbox/media/

install python packages

pip3 install -r requirements.txt
pip3 install napalm

configure netbox

cd netbox/netbox/
cp configuration.example.py configuration.py

vim configuration.py
#ALLOWED_HOSTS = ['netbox.example.com', '192.0.2.123']
ALLOWED_HOSTS = ['*']

DATABASE = {
    'NAME': 'netbox',                   # Database name
    'USER': 'netbox',                   # PostgreSQL username
    'PASSWORD': 'streng-geheim-und-so', # PostgreSQL password
    'HOST': 'localhost',                # Database server
    'PORT': '',                         # Database port (leave blank for default)
}

SECRET_KEY = 'a+V4_H@O0U9GYz#E(IB5csp8CJNide^lMyZgj)1rqRLf*&WSQ$'

generate secret key

netbox/generate_secret_key.py

database migration

cd /opt/netbox/netbox/
python3 manage.py migrate
Operations to perform:
  Apply all migrations: dcim, sessions, admin, ipam, utilities, auth, circuits, contenttypes, extras, secrets, users
Running migrations:
  Rendering model states... DONE
  Applying contenttypes.0001_initial... OK
  Applying auth.0001_initial... OK
  Applying admin.0001_initial... OK
  ...

create superuser

# python3 manage.py createsuperuser
Username: admin
Email address: mail@gott.welt
Password: 12345678
Password (again): 12345678
Superuser created successfully.

Collect Static Files

python3 manage.py collectstatic --no-input

You have requested to collect static files at the destination
location as specified in your settings:

    /opt/netbox/netbox/static

This will overwrite existing files!
Are you sure you want to do this?

Type 'yes' to continue, or 'no' to cancel: yes

Load Initial Data (Optional)

python3 manage.py loaddata initial_data

Test the Application

python3 manage.py runserver 0.0.0.0:8000 --insecure
Performing system checks...

System check identified no issues (0 silenced).
November 28, 2018 - 09:33:45
Django version 2.0.9, using settings 'netbox.settings'
Starting development server at http://0.0.0.0:8000/
Quit the server with CONTROL-C.

install nginx

apt-get install -y nginx

vim /etc/nginx/sites-available/netbox
server {
    listen 80;
    listen [::]:80;

    server_name netbox.example.com;

    client_max_body_size 25m;

    location /static/ {
        alias /opt/netbox/netbox/static/;
    }

    location / {
        proxy_pass http://127.0.0.1:8001;
        proxy_set_header X-Forwarded-Host $server_name;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;
        add_header P3P 'CP="ALL DSP COR PSAa PSDa OUR NOR ONL UNI COM NAV"';
    }
}

cd /etc/nginx/sites-enabled/
rm default
ln -s /etc/nginx/sites-available/netbox

service nginx restart

Install gunicorn

pip3 install gunicorn

vim /opt/netbox/gunicorn_config.py
command = '/usr/bin/gunicorn'
pythonpath = '/opt/netbox/netbox'
bind = '127.0.0.1:8001'
workers = 3
user = 'www-data'

install supervision

apt-get install -y supervisor

vim /etc/supervisor/conf.d/netbox.conf
[program:netbox]
command = gunicorn -c /opt/netbox/gunicorn_config.py netbox.wsgi
directory = /opt/netbox/netbox/
user = www-data

[program:netbox-rqworker]
command = python3 /opt/netbox/netbox/manage.py rqworker
directory = /opt/netbox/netbox/
user = www-data

restart server and test

http://ip.addr.of.server