book

Absolute OpenBSD

by Michael W. Lucas

April 2013

Beginner to intermediate

536 pages

14h 46m

English

No Starch Press

Read now

Unlock full access

What Is Security?What Is BSD?The BSD LicenseAT&T vs. the WorldThe Birth of OpenBSDThe OpenBSD CommunityOpenBSD UsersOpenBSD ContributorsOpenBSD CommittersOpenBSD CoordinatorOpenBSD’s StrengthsPortabilityPowerDocumentationFreeCorrectnessSecurityOpenBSD and Your SecurityOpenBSD’s UsesDesktopServerNetwork ManagementAbout This BookContents Overview
OpenBSD’s Support ModelThe Code Is Fine. What’s Wrong with You?Sources of InformationMan PagesManual SectionsViewing Man PagesFinding Man PagesOverlapping Man Page NamesMan Page ContentsMan Pages on the WebThe OpenBSD WebsiteMirrorsThe OpenBSD FAQNon-Project WebsitesOpenBSD Mailing ListsUnofficial Mailing ListsRead-Only Mailing ListsUsing OpenBSD Problem-Solving ResourcesUsing the OpenBSD WebsiteUsing Man PagesUsing Internet SearchesUsing Mailing ListsCreating a Good Help RequestHow to Be IgnoredSending Your EmailResponding to Email
OpenBSD HardwareSupported HardwareProprietary Hardware, Blobs, and FirmwareProcessorsMemory (RAM)Hard DrivesVirtualizationMultiple Operating SystemsGetting OpenBSDOfficial CDsInternet DownloadsMirror Site LayoutRelease DirectoriesBoot MediaChoosing Install MediaLocal Installation ServersFile SetsPartitioningStandard OpenBSD PartitionsRoot PartitionSwap Space/tmp Directory/var Partition/usr Partition/usr/X11R6 Partition/usr/local Partition/usr/src Partition/usr/obj Partition/home PartitionCreating Other PartitionsPartition FilesystemsMultiple Hard DrivesUnderstanding PartitionsMBR PartitionsDisklabel PartitionsUnderstanding DisklabelsSectors and LiesSectors and DisklabelsOther Information
Hardware SetupBIOS ConfigurationMaking Boot MediaMaking Boot FloppiesCreating Floppies on Unix-like SystemsCreating Floppies on Microsoft SystemsMaking Boot CDsInstalling OpenBSDRunning the Installation ProgramMultiple Network CardsSetting Up Services and the First UserSetting the Time ZoneSetting Up the DiskChoosing File SetsFinishing the InstallationCustom Disk LayoutViewing DisklabelsDeleting PartitionsErasing Existing DisklabelsCreating Disklabel PartitionsWriting the New DisklabelAdding More DisksAdvanced Disklabel CommandsChanging Basic Drive ParametersModifying Existing PartitionsEntering Expert ModeGetting More Help

First StepsChecking the System ErrataSetting the Root PasswordSoftware ConfigurationTime and DateSetting the Time ZoneSetting the Date and TimeSetting the Time with ntpd(8)Setting the Date ManuallyHostnameNetworkingConfiguring Ethernet InterfacesStatic IP AddressesDynamic ConfigurationSetting a Default GatewaySetting Name Service ServersMail Aliases and Status MailKeyboard MappingInstalling Ports and Source CodeBooting to a Graphic ConsoleOnward!
Power-On and the Boot LoaderBooting in Single-User ModeMounting Disks in Single-User ModeStarting the Network in Single-User ModeBooting an Alternate KernelBooting a Different Kernel FileBooting from an Alternate Hard DiskFinding the DiskFinding the PartitionBooting the KernelMaking Boot Loader Settings PermanentSerial ConsolesOther Platform Serial ConsolesSerial Console Physical SetupSerial Console ConfigurationConfiguring the Serial Console ClientSetting Up the Serial ConsoleTesting the Serial ConfigurationChanging the Serial Console SpeedChanging the Client Serial PortSerial LoginsMultiuser StartupStartup System ScriptsThe /etc/rc ScriptThe /etc/rc.conf ScriptThe /etc/rc.conf.local ScriptThe /etc/netstart ScriptThe /etc/rc.securelevel ScriptThe /etc/rc.local ScriptThe /etc/rc.shutdown ScriptThe /etc/rc.firsttime ScriptThe /etc/fastboot ScriptThe /etc/rc.d DirectorySoftware Startup ScriptsThird-Party rc.d ScriptsForce-Starting Software
The Root AccountAdding UsersAdding Users InteractivelyConfiguring adduserCreating User AccountsAdding Users NoninteractivelyGroups in Batch ModePasswords and Batch ModeOther Batch Mode OptionsUser Account RestrictionsRemoving User AccountsEditing User AccountsLogin ClassesLogin Class DefinitionsChanging login.confLegal Values for login.conf VariablesSetting Resource LimitsModifying the Shell EnvironmentPassword and Login OptionsChanging Authentication MethodsUsing Login Classes for RADIUS AuthenticationUnprivileged User AccountsThe nobody Account_usernameCreating Unprivileged Users
The Root PasswordUsing GroupsThe /etc/group FileCreating GroupsGroups, Unprivileged Users, and Group PermissionsHiding Root with sudoWhy Use sudo?sudo DisadvantagesAn Overview of the sudo SoftwareThe visudo(8) CommandThe /etc/sudoers FileMultiple Entries in a sudoers FieldRunning Commands As Non-root UsersLong Lines/etc/sudoers AliasesUser AliasesRun as AliasesHost AliasesCommand AliasesUsing Aliases in /etc/sudoersNesting AliasesAlias Naming ConventionsChanging sudo’s Default BehaviorOverriding Defaults per HostOverriding Defaults per UserOverriding Defaults per CommandOverriding Defaults per Run Assudo and the EnvironmentUsing sudosudo Password CachingRunning Commands Under sudoRunning Commands as Other UserssudoeditThe Biggest sudo Mistake: Exclusionssudo Logs
Device NodesRaw and Block DevicesBlock DevicesRaw DevicesChoosing Your ModeDevice Attachment vs. Device NameDUIDs and /etc/fstabMBR Partitions and fdisk(8)Viewing MBR PartitionsAdding and Removing PartitionsMaking a Partition BootableExiting fdiskLabeling DisksViewing LabelsCreating Disklabel PartitionsBacking Up and Restoring DisklabelsThe Fast File SystemFFS VersionsBlocks, Fragments, and InodesBlocksInodesSuperblocksCreating FFS FilesystemsFFS Mount OptionsMount Options and /etc/fstabRead-Only MountsRead-Write MountsSynchronous MountsAsynchronous MountsSoft Update Mounts“Don’t Track Access Time” MountsNo Device Nodes Permitted MountExecution Forbidden Mountssetuid ForbiddenDo Not Automatically Mount This FilesystemFilesystem IntegrityRunning fsckBlindly Trusting fsckWhat’s Currently Mounted?Mounting and Unmounting PartitionsMounting Standard FilesystemsMounting at Nonstandard LocationsUnmounting PartitionsMounting with OptionsHow Full Is That Partition?What’s All That Stuff?Setting $BLOCKSIZEAdding New Hard DisksCreating an MBR PartitionCreating a DisklabelMoving PartitionsAdding New FilesystemsStackable Mounts
Backing Up to the /altroot PartitionMemory FilesystemsCreating MFS PartitionsMounting an MFS at BootForeign FilesystemsInodes vs. VnodesCommon Foreign FilesystemsMS-DOSNTFSext2fsCDForeign Filesystem OwnershipRemovable MediaMounting Filesystem ImagesAttaching Vnode Devices to Disk ImagesDetaching Vnode Devices from ImagesBasic NFS SetupThe OpenBSD NFS ServerExporting FilesystemsRead-Only MountsNFS and UsersPermitted ClientsMultiple Exports for One PartitionNFS ClientsSoftware RAIDRAID TypesPreparing Disks for softraidCreating softraid Devicessoftraid StatusIdentifying Failed softraid VolumesRebuilding Failed softraid VolumesDeleting softraid DevicesReusing softraid DisksBooting from a softraid DeviceEncrypted Disk PartitionsCreating Encrypted PartitionsUsing Encrypted PartitionsAutomatic Decryption
Who Is the Enemy?Script KiddiesBotnetsDisaffected UsersSkilled AttackersOpenBSD Security AnnouncementsOpenBSD Memory ProtectionW^X.rodata SegmentsGuard PagesAddress Space Layout RandomizationProPoliceAnd More!File FlagsFile Flag TypesSetting, Viewing, and Removing File FlagsSecurelevelsSetting the System SecurelevelSecurelevel DefinitionsSecurelevel -1Securelevel 0Securelevel 1Securelevel 2What Securelevel Do You Need?Securelevel WeaknessesKeeping Secure
Network LayersThe Physical LayerThe Datalink LayerThe Network LayerThe Transport LayerApplicationsThe Life and Times of a Network RequestNetwork StacksIPv4 Addresses and SubnetsCalculating a Decimal IPv4 NetmaskViewing IPv4 AddressesUnusable IPv4 AddressesSpecial IPv4 AddressesLocalhostPrivate NetworksIPv4 Addressing PitfallsIPv6 Addresses and SubnetsIPv6 BasicsUnderstanding IPv6 AddressesViewing IPv6 AddressesIPv6 SubnetsSpecial IPv6 AddresseslocalhostLink Local AddressesAssigning IPv6 AddressesRemedial TCP/IPICMPUDPTCPHow Protocols Fit TogetherTransport Protocol PortsReserved PortsWhich Ports Are Open?Using netstatUsing fstatIP RoutingIPv4 Routed Network ExampleManaging Routing with route(8)Viewing RoutesRoute FlagsAdding RoutesDeleting Routes
DNS ResolutionThe /etc/resolv.conf FileDefault Search DomainsUsing Domain and SearchName ServersLookup OrderPreferred IP ProtocolThe /etc/hosts FileResolver vs. Dynamic ConfigurationEthernetProtocol and HardwareIPv4 and ARPIPv6 and Neighbor DiscoverySpeed and DuplexConfiguring EthernetUsing ifconfig(8)Adding an IP AddressRemoving IP AddressesMultiple IP Addresses on One Ethernet CardConfiguring Default RoutesUsing Dynamic ConfigurationConfiguring the Network at BootTrunkingLink Aggregation ProtocolsTrunk ConfigurationTrunks at BootVLANsConfiguring SwitchesConfiguring VLAN DevicesConfiguring VLANs at BootIPv6 Over Tunnels
Making SoftwareSource Code and SoftwareThe Ports and Packages SystemUsing PackagesPackage Files and $PKG_PATHFinding PackagesFinding Packages on the Command LineFinding Packages on the WebInstalling PackagesWhich Files Are Installed?Verbose InstallationAmbiguous PackagesIdentifying Where Files OriginateUninstalling PackagesPackage LimitationsUsing PortsThe Ports TreeSecondary PortsRead-Only Ports TreeFinding SoftwareThe Ports IndexFinding by KeywordFinding via SQLBuilding PortsWhat a Port Installation DoesPort Build StagesThe make fetch StageThe make checksum StageThe make prepare StageThe make extract StageThe make patch StageThe make configure StageThe make build StageThe make fake StageThe make package StageThe make install StageThe make clean StageCustomizing PortsLocal Distfile MirrorsPreferred Collection MirrorsFallback MirrorsPrimary MirrorFlavorsBuilding a Flavored PortFlavors and DependenciesBuilding Multiple FlavorsUninstalling and Reinstalling Flavored PortsSubpackagesPackages and rc.d Scripts
/etc Across Unix VariantsThe /etc Files/etc/adduser.conf/etc/amd/etc/authpf/etc/bgpd.conf/etc/boot.conf/etc/changelist/etc/chio.conf/etc/csh.*/etc/daily and /etc/daily.local/etc/dhclient.conf/etc/dhcpd.conf/etc/disklabels//etc/disktab/etc/dumpdates/etc/dvmrpd.conf/etc/exports/etc/fbtab/etc/firmware/etc/fonts//etc/fstab/etc/ftpchroot/etc/ftpusers/etc/gettytab/etc/group/etc/hostapd.conf/etc/hostname.*/etc/hosts/etc/hosts.equiv/etc/hosts.lpd/etc/hotplug//etc/ifstated.conf/etc/iked/, /etc/iked.conf, /etc/ipsec.conf, and /etc/isakmpd/etc/inetd.conf/etc/kbdtype/etc/kerberosV//etc/ksh.kshrc/etc/ldap/ and /etc/ldapd.conf/etc/localtime/etc/locate.rc/etc/login.conf/etc/lynx.cfg/etc/magic/etc/mail//etc/mail.rc/etc/mailer.conf/etc/man.confAdding to the Search IndexAdding to Man Page DirectoriesDisplaying Man PagesDefining Man Sections/etc/master.passwd, /etc/passwd, /etc/spwd.db, and /etc/pwd.dbEditing /etc/master.passwdControlling Account Information Access/etc/master.passwd Fields/etc/mixerctl.conf/etc/mk.conf/etc/moduli/etc/monthly and /etc/monthly.local/etc/motd/etc/mrouted.conf/etc/mtree//etc/mygate/etc/myname/etc/netstart/etc/networks/etc/newsyslog.conf/etc/nginx//etc/nsd.conf/etc/ntpd.conf/etc/ospf6d.conf and /etc/ospfd.conf/etc/pf.conf and /etc/pf.os/etc/ppp//etc/printcap/etc/protocols/etc/rbootd.conf/etc/rc.*/etc/relayd.conf/etc/remote/etc/resolv.conf and /etc/resolv.conf.tail/etc/ripd.conf/etc/rmt/etc/rpc/etc/sasyncd.conf/etc/sensorsd.conf/etc/services/etc/shells/etc/skel//etc/sliphome//etc/snmpd.conf/etc/ssh//etc/ssl//etc/sudoers/etc/sysctl.conf/etc/syslog.conf/etc/systrace//etc/termcap/etc/ttysTerminal TypesConfiguring TerminalsMaking /etc/ttys Changes Take Effect/etc/weekly and /etc/weekly.local/etc/wsconsctl.conf/etc/X11/etc/ypldap.conf
Scheduled TasksDaily MaintenanceSecurity ChecksVital File Backup and TestingAdding Vital FilesFilesystem Integrity ChecksCopying Files with rdistSilencing /etc/dailyWeekly MaintenanceMonthly MaintenanceCustom Maintenance ScriptsSystem LogsFacilitiesPrioritySorting Messages via syslogd(8)WildcardsExcluding InformationCombining FacilitiesMarking TimeLocal FacilitiesSelecting by Program NameLog ActionsLogging to FilesLogging to a ProgramNotifying UsersLogging to a Remote HostCustomizing syslogdAdding Extra Log SocketsListening to the NetworkSyslog and Embedded SystemsLog File Maintenancenewsyslog.conf FieldsLog FileOwnerPermissionsCountSizeTimeFlagsMonitoring LogsAdding a PID FileSignal NameCommand to ExecuteSystem TimeConfiguring ntpd(8)Time RedundancyTime SourcesServing TimeUsing ntpd(8)Hardware SensorsDevice DriversSensor ConfigurationSensor TypesSettings in sensorsd.confSensors Triggering Action
The inetd Small-Server HandlerConfiguring inetdRestricting Incoming ConnectionsThe lpd Printing DaemonThe DHCP Server dhcpdHow DHCP WorksConfiguring dhcpd(8)Static IP Address AssignmentsEnabling dhcpddhcpd and FirewallsThe TFTP Daemon tftpdSpecifying a tftpd Directorytftpd and Filestftpd LoggingTesting the TFTP ServerThe SNMP Agent snmpdSNMP MIBsMIB ReferencesMIB DefinitionsSNMP SecurityConfiguring snmpdDebugging snmpdGetting snmpd InformationThe PF SNMP MIBSensorsInterface MemoryCARPOther MIBsThe SSH Server sshdDisabling sshdSSH Host Keyssshd Network Optionschrooting UsersChoosing the DirectoryPopulating the chrootchrooting Specific Users
Configuring Your Console with wsconsScreen BlankingSetting wscons Variables at BootRunning Virtual Terminals with tmuxThe tmux Status Bar and Window Namestmux Commands and Window ManagementChanging the Current WindowRenaming WindowsTerminating WindowsGetting Online HelpDisconnecting, Reconnecting, and Managing SessionsUsing tmux CommandsSetting tmux OptionsConfiguring tmuxSetting Up XConfiguring XStarting X ManuallyBooting into XEmulating a Three-Button MouseUsing the cwm Window ManagerConfiguring cwmModifier KeysChoosing a New Window ManagerBinding a Key Sequence to a CommandCreating cwm WindowsManaging WindowsLocking the ScreenConnecting to Other Machines with SSHCreating an Application MenuUsing Keyboard NavigationDecorating cwmUnmapping and Remapping Keys
What Is the Kernel?Kernel MessagesStartup MessagesDevice AttachmentsConnections and NumberingUsing dmassage to View Installed DevicesViewing and Adjusting SysctlsSysctl MIBsViewing SysctlsChanging Sysctl ValuesTypes of Sysctl ValuesNumerical SysctlsWord SysctlsTable SysctlsSetting Sysctls at BootAltering the Kernel with config(8)Making a Backup of the Default KernelDevice Drivers and the KernelEnabling DriversEditing the Kernel with configUsing the help and list CommandsFinding and Enabling DevicesChanging Kernel ConstantsCompleting ConfigurationInstalling Your Edited KernelBoot-Time Kernel Configuration
Kernel CautionsDon’t Build Custom KernelsWhy Build Custom Kernels?Problems Building Custom KernelsProblems Running Custom KernelsPreparing for Kernel CustomizationKernel ConfigurationConfiguration EntriesOptionsDevice DriversPseudo-DevicesKeywordsConfiguring GENERICMachine-Independent ConfigurationMachine-Dependent ConfigurationYour Kernel ConfigurationMinor ChangesRemoving OptionsRemoving DevicesWholesale ButcheryStripping Down the KernelGutting the KernelTesting Your Kernel Configuration with config(8)Orphaned DevicesBogus HardwareBuilding a KernelKernel Build ErrorsInstalling Your KernelIdentifying the Running Kernel
Why Upgrade?OpenBSD VersionsOpenBSD-currentOpenBSD SnapshotsOpenBSD ReleasesOpenBSD-stableWhich Version Should You Use?The OpenBSD Upgrade ProcessFollowing the Upgrade GuideInstall ProgramsRemove Programs and FilesPrepare Package UpgradesSystem ConfigurationCustomizing UpgradesUpgrading from Official MediaUpgrading Over the NetworkChoosing File SetsUpdating /etcMounting FilesystemsUsing sysmerge(8) to Compare /etc FilesEasy sysmerge Updatessysmerge and Edited FilesFinishing sysmergeUpdating Installed PackagesUpdating the Package RepositoryUsing the Upgrade CommandPackage OptionsPackage MessagesWhy Build Your Own OpenBSD?Preparations for Building Your Own OpenBSDPreparing the Base Operating SystemGetting Source CodeUpdating Source CodeSource Code Repositories and TagsCVS MirrorsUpdating to -stableUpdating to -currentBuilding OpenBSD-stableUpgrading the KernelBuilding the UserlandBuilding XenocaraBuilding a ReleaseBundling the Base SystemBundling XenocaraIndexing the ReleaseUsing the ReleaseBuilding OpenBSD-currentFollowing -currentMerging /etcUpgrading Ports
FirewallsEnabling and Configuring PFPacket-Filtering BasicsPacket-Filtering ConceptsStateful InspectionPacket ReassemblyDefault Accept vs. Default Deny“My Network Can Do No Wrong”What Packet Filtering Doesn’t DoPF ComponentsPacket Filter Control and ConfigurationInterface GroupsPF ConfigurationFiltering RulesDefault Permit or Default DenyPacket Pattern MatchingDirectionInterface MatchingAddress FamiliesNetwork ProtocolSource and Destination AddressSource and Destination VariantsInterface Main AddressSource and Destination PortA Complete RulesetActivating RulesViewing Active RulesFiltering Rules and the State TableTCP StatesUDP StatesICMP StatesPacket Filtering with Lists and MacrosUsing ListsUsing MacrosA Common Error: List Exclusions and NegationsSanitizing TrafficIllegal PacketsPacket ReassemblyPacket ModificationBlocking Spoofed PacketsPF OptionsThe set block-policy OptionThe set limit Optionfrags LimitThe src-nodes LimitThe states LimitThe tables and table-entries LimitsSetting LimitsThe set optimization OptionThe set skip Option
Packet Filtering with TablesDefining TablesUsing TablesViewing TablesSearching TablesChanging TablesTables and AutomationUsing NATPrivate NAT AddressesConfiguring NATHow NAT WorksMultiple or Specific Public AddressesBidirectional NATBidirectional NAT and SecurityPacket Filtering, Bidirectional NAT, and Rule OrderRedirectionMultiple Addresses and Interface GroupsPort Manipulation and RangesTransparent InterceptionAnchorsAdding Rules to AnchorsAnchor Rules from FilesAnchor Rules in pf.confAnchor Rules via pfctlViewing and Flushing AnchorsConditional FilteringNested Anchors: /*FTP and PFConfiguring ftp-proxy(8)PF Configuration and the FTP ProxyBandwidth ManagementQueues for Bandwidth ManagementParent Queue DefinitionsChild Queue DefinitionsQueue OptionsDefaultRandom Early DetectionExplicit Congestion NotificationborrowA CBQ RulesetAssigning Traffic to QueuesUsing the match KeywordViewing QueuesPF EdgesUsing Include FilesSkipping Matches with quickLogging PFReading PF LogsReal-Time Log AccessFiltering tcpdumpRuleset Tracing
Virtualizing OpenBSDDiskless InstallationDiskless HardwareDHCP Server SetupPer-Host or Per-Network ConfigurationPer-Network ConfigurationPer-Machine ConfigurationTFTP Server SetupCompleting Diskless InstallationRunning DisklessUsing rarpd(8) for Reverse ARPRunning bootparamd(8)Setting Up the NFS Root DirectoryExporting the Root DirectoryPopulating the Diskless UserlandPower On!USB Installation MediaUsing a Virtual MachineRunning a Diskless InstallationConverting ISO ImagesCustomizing OpenBSD InstallationsCustom File SetsPost-Install Shell ScriptsCustomizing Upgrades

Content preview from Absolute OpenBSD

Chapter 11. Overview of TCP/IP

IP version 6: All the pain of version 4, plus brand-new problems!

Securing a computer is easy: Disconnect it from all networks, remove all input and output, and lock it in a bunker. Oh, wait—did you want the system to do something? Then you’ll probably want to connect your system to the Internet.

Many system administrators have a vague familiarity with the basics of networking, but to be a truly competent sysadmin, you need a real understanding of how everything fits together. You don’t need to know when to use rapid spanning trees, how to choose between BGP and OSPF, or even what those acronyms represent. But you must ...