OpenBSD - Revision history

Leo: /* Integrating with FreeIPA */

2022-05-03T07:55:10Z

Integrating with FreeIPA

← Older revision		Revision as of 07:55, 3 May 2022
Line 230:		Line 230:
	Set up the OpenBSD server to use Kerberos as an authentication mechanism. Edit <code>/etc/login.conf</code> and add <code>:auth=-krb5-or-pwd:\</code> above <code>tc=auth-defaults:\</code> . At this point, you should be able to authenticate as a user using your FreeIPA password, provided that the account exists on the local machine.		Set up the OpenBSD server to use Kerberos as an authentication mechanism. Edit <code>/etc/login.conf</code> and add <code>:auth=-krb5-or-pwd:\</code> above <code>tc=auth-defaults:\</code> . At this point, you should be able to authenticate as a user using your FreeIPA password, provided that the account exists on the local machine.

	YP LDAP uses a host keytab file for some reason. ~~You~~'ll ~~need~~ to ~~manually generate and transfer the~~ host keytab file ~~containing a host principal~~ over to the OpenBSD host.		YP LDAP uses a host keytab file for some reason (this isn't required when using sssd on Linux). Without the host keytab file, you'll see this error in <code>/var/log/authlog</code> whenever someone tries to login: <code>openbsd -krb5-or-pwd: verify: keytab /etc/heimdal/krb5.keytab open failed: No such file or directory</code>. The host keytab file will need to be generated from the FreeIPA server and transferred over to the OpenBSD host under <code>/etc/heimdal/krb5.keytab</code>.

	* On the FreeIPA server, add the host via web UI		* On the FreeIPA server, add the host via web UI

Leo at 07:51, 3 May 2022

2022-05-03T07:51:11Z

← Older revision		Revision as of 07:51, 3 May 2022
Line 43:		Line 43:
	\|<code>pkg_add -u <package></code>		\|<code>pkg_add -u <package></code>
	\|<code>pkg_add -u vim</code>		\|<code>pkg_add -u vim</code>
			\|-
			\|Remove a package
			\|<code>pkg_delete <package></code>
			\|<code>pkg_delete vim</code>
			\|-
			\|Get a list of packages installed on the system. Like <code>rpm -qa</code>
			\|<code>pkg_info -mz</code>
			\|
	\|}		\|}

Line 225:		Line 233:

	* On the FreeIPA server, add the host via web UI		* On the FreeIPA server, add the host via web UI
	* On FreeIPA server, run ipa-getkeytab -s ipa.home.steamr.com -p host/openbsd.home.steamr.com@HOME.STEAMR.COM -k ~~blah~~.keytab. If you want to do this manually, use kadmin: kadmin -p admin. Then get the keytab file by running ktadd -k /tmp/~~krb5~~.keytab host/openbsd.home.steamr.com@HOME.STEAMR.COM		* On FreeIPA server, run <code>ipa-getkeytab -s ipa.home.steamr.com -p host/openbsd.home.steamr.com@HOME.STEAMR.COM -k output.keytab</code>. If you want to do this manually, use <code>kadmin: kadmin -p admin</code>. Then get the keytab file by running <code>ktadd -k /tmp/output.keytab host/openbsd.home.steamr.com@HOME.STEAMR.COM</code>
	* Copy that keytab file into the openbsd server at /etc/heimdal/krb5.keytab		* Copy that keytab file into the openbsd server at <code>/etc/heimdal/krb5.keytab</code>
	* chown root:wheel /etc/heimdal/krb5.keytab and chmod 600 /etc/heimdal/krb5.keytab		* <code>chown root:wheel /etc/heimdal/krb5.keytab</code> and <code>chmod 600 /etc/heimdal/krb5.keytab</code>

	==== LDAP ====		==== LDAP ====

Leo at 17:20, 28 April 2022

2022-04-28T17:20:23Z

← Older revision		Revision as of 17:20, 28 April 2022
Line 222:		Line 222:
	Set up the OpenBSD server to use Kerberos as an authentication mechanism. Edit <code>/etc/login.conf</code> and add <code>:auth=-krb5-or-pwd:\</code> above <code>tc=auth-defaults:\</code> . At this point, you should be able to authenticate as a user using your FreeIPA password, provided that the account exists on the local machine.		Set up the OpenBSD server to use Kerberos as an authentication mechanism. Edit <code>/etc/login.conf</code> and add <code>:auth=-krb5-or-pwd:\</code> above <code>tc=auth-defaults:\</code> . At this point, you should be able to authenticate as a user using your FreeIPA password, provided that the account exists on the local machine.

	~~''Everything here is probably not necessary.'' You probably don't need to get a host keytab since the host principal won't be used. The~~ YP LDAP ~~server we'll be setting up~~ uses a ~~binding account and doesn't support GSSAPI with the~~ host ~~principal~~. ~~But if you do, you~~'ll need to manually generate and transfer the host keytab file over to the OpenBSD host ~~as there is no IPA client either~~. ~~To do that:~~		YP LDAP uses a host keytab file for some reason. You'll need to manually generate and transfer the host keytab file containing a host principal over to the OpenBSD host.

	* On the FreeIPA server, add the host via web UI		* On the FreeIPA server, add the host via web UI
	* On FreeIPA server, run kadmin -p admin. Then get the keytab file by running ktadd -k /tmp/krb5.keytab host/openbsd.home.steamr.com@HOME.STEAMR.COM		* On FreeIPA server, run ipa-getkeytab -s ipa.home.steamr.com -p host/openbsd.home.steamr.com@HOME.STEAMR.COM -k blah.keytab. If you want to do this manually, use kadmin: kadmin -p admin. Then get the keytab file by running ktadd -k /tmp/krb5.keytab host/openbsd.home.steamr.com@HOME.STEAMR.COM
	* Copy that keytab file into the openbsd server at /etc/heimdal/krb5.keytab		* Copy that keytab file into the openbsd server at /etc/heimdal/krb5.keytab
	* chown root:wheel /etc/heimdal/krb5.keytab and chmod 600 /etc/heimdal/krb5.keytab		* chown root:wheel /etc/heimdal/krb5.keytab and chmod 600 /etc/heimdal/krb5.keytab
Line 288:		Line 288:
	# rcctl enable portmap		# rcctl enable portmap
	# rcctl start portmap		# rcctl start portmap
	~~\| lang = terminal~~
	}}
	~~Set up the YP LDAP client~~
	~~{{Highlight~~
	~~\| code = # mkdir /etc/yp~~
	~~# echo 127.0.0.1 > /etc/yp/home.steamr.com~~
	\| lang = terminal		\| lang = terminal
	}}		}}

Leo: /* Disk partitions */

2022-04-27T06:47:57Z

Disk partitions

← Older revision		Revision as of 06:47, 27 April 2022
Line 52:		Line 52:
	The term 'partition' and 'slice' comes up when dealing with storage in BSD. To be clear, they refer to the following:		The term 'partition' and 'slice' comes up when dealing with storage in BSD. To be clear, they refer to the following:

	* A partition refers to the primary ~~MBR partitions~~		* A partition refers to the subdivisions of a primary partition (a slice)
	* A slice refers to the ~~subdivisions~~ of a ~~primary~~ MBR		* A slice refers to the primary partitions, of which there can only be a maximum of 4 per MBR disk.

	In OpenBSD, we create a primary partition of type <code>0xA6</code> (the ID for the OpenBSD disklabel) and then partition this primary partition out using the <code>disklabel</code> utility into individual partitions that are visible on the system. Partitions in OpenBSD are named with letters (such as wd0a, wd0b) ~~rather than with~~ numbers (sda1, sda2) ~~as on Linux~~. Up to 15 partitions can be created. For the disk containing the operating system, the first partition (a) must be the root partition from which the system is bootstrapped from and the second partition (b) should be used for swap. The third partition (c) overlaps the entire disk		In OpenBSD, we create a primary partition of type <code>0xA6</code> (the ID for the OpenBSD disklabel) and then partition this primary partition out using the <code>disklabel</code> utility into individual partitions that are visible on the system.

			Partitions in OpenBSD are named with letters (such as wd0a, wd0b) and differs from FreeBSD (which uses s# like ada0s1, ada0s2) or Linux (which uses numbers like sda1, sda2). Up to 15 partitions can be created. For the disk containing the operating system, the first partition (a) must be the root partition from which the system is bootstrapped from and the second partition (b) should be used for swap. The third partition (c) overlaps the entire disk

	==== Creating disk partitions and disk labels ====		==== Creating disk partitions and disk labels ====

Leo at 06:19, 27 April 2022

2022-04-27T06:19:14Z

@@ Line 3: / Line 3: @@
 ==Package management==
-https://cdn.openbsd.org/pub/OpenBSD
+See: https://cdn.openbsd.org/pub/OpenBSD
-#export PKG_PATH=scp://user@company-build-server/usr/ports/packages/%a/all:https://trusted-public-server/%m:installpath
 The common programs that you'll use to manage packages are:
 {| class="wikitable"
@@ Line 316: / Line 316: @@
 _ypldap  56692  0.0  0.1   824  1740 ??  Sp     11:19PM    0:00.02 ypldap: dns engine (ypldap)
 | lang = terminal
 }}

Leo: /* Integrating with FreeIPA */

2022-04-27T05:46:26Z

Integrating with FreeIPA

Show changes

Leo at 03:54, 27 April 2022

2022-04-27T03:54:06Z

← Older revision		Revision as of 03:54, 27 April 2022
Line 45:		Line 45:
	\|}		\|}

	== ~~Tasks~~ ==		== Storage ==

			=== Disk partitions ===
			Disk partitions are treated slightly differently on OpenBSD (or any other BSDs for that matter) compared to Linux. Recall that MBR disks can have only up to 4 primary partitions and any additional partitions can only be made as extended partitions. In OpenBSD, partitions are generally created as subdivisions of one of the primary partitions using something called a BSD disklabel.

	~~===System update===~~		The term 'partition' and 'slice' comes up when dealing with storage in BSD. To be clear, they refer to the following:
	To ~~update a OpenBSD system~~, ~~run~~:
	~~{{Highlight~~
	~~\| code = # syspatch~~
	~~# pkg_add -Uu~~
	~~# sysmerge -d~~
	~~\| lang = terminal~~
	}}

	~~=== Finding all available disks ===~~		* A partition refers to the primary MBR partitions
	~~There is no utility that does this similar~~ to ~~<code>lsblk</code>. Rather, you can find all disks using <code>sysctl \| grep disk</code>.~~		* A slice refers to the subdivisions of a primary MBR
	~~{{Highlight~~
	~~\| code = # sysctl -a {{!}} grep -i disk~~
	~~hw.disknames=wd0:94a4943e88c9a60f,wd1:,cd0:,fd0:~~
	~~hw.diskcount=4~~
	~~machdep.bios.diskinfo.128=bootdev = 0xa0000200, cylinders = 1023, heads = 255, sectors = 63~~
	~~machdep.bios.diskinfo.129=bootdev = 0xa0010200, cylinders = 1023, heads = 255, sectors = 63~~
	~~\| lang = terminal~~
	}}
	~~Disks are named either <code>wd~~~~</code> (IDE, SATA, flash devices) or <code>sd</code> (SCSI devices, USB drives via~~ the ~~ahci interface, or disks via~~ a ~~RAID controller).~~

	~~=== Partitioning and formatting disks ===~~		In OpenBSD, we create a primary partition of type <code>0xA6</code> (the ID for the OpenBSD disklabel) and then partition this primary partition out using the <code>disklabel</code> utility into individual partitions that are visible on the system. Partitions in OpenBSD are named with letters (such as wd0a, wd0b) rather than with numbers (sda1, sda2) as on Linux. Up to 15 partitions can be created. For the disk containing the operating system, the first partition (a) must be the root partition from which the system is bootstrapped from and the second partition (b) should be used for swap. The third partition (c) overlaps the entire disk
	~~Disk partitioning can be done using~~ OpenBSD~~'s version~~ of <code>~~fdisk~~</code>~~. fdisk supports both MBR~~ and ~~GPT disks. For MBR based disks, fdisk will allow you to create a~~ primary partition in ~~each of the available 4 slots~~ (as ~~shown below~~). ~~Each primary MBR partition that's set~~ to the ~~OpenBSD MBR~~ partition ~~type~~ (~~0xA6~~) ~~will have its own 16 entry~~ partition ~~table~~ which ~~can be edited with <code>disklabel</code>. These 'disk labels' outline~~ the ~~start~~ and ~~end of~~ the ~~underlying primary~~ partition ~~which can then~~ be ~~formatted with a filesystem~~.

	For more info, refer to [https://www.openbsd.org/faq/faq14.html? OpenBSD's FAQ].		==== Creating disk partitions and disk labels ====
			Primary partitions can be created using OpenBSD's version of <code>fdisk</code>. <code>fdisk</code> supports both MBR and GPT disks, but the example below is for a MBR disk. Running <code>fdisk</code> on a MBR disk will list all four primary partitions as shown below. To be able to use BSD disk labels, you will have to create a primary partition using OpenBSD's disk label type (<code>0xA6</code>). For more info, refer to [https://www.openbsd.org/faq/faq14.html? OpenBSD's FAQ].

	A blank MBR disk looks like the following:		A blank MBR disk looks like the following:
Line 87:		Line 74:
	\| lang = terminal		\| lang = terminal
	}}		}}
	To create a new primary partition, edit one of the entries and specify a start and end size. ~~Create a new partition of~~ type 0xA6 ~~which is a OpenBSD partition which allows you to further partition out the disk with disklabel~~. The start and end values can be specified in other units such as 1G for 1 gigabyte.		To create a new primary partition, edit one of the entries using the <code>edit</code> command and specify a start and end size. Specify the type as 0xA6. The start and end values can be specified in other units such as 1G for 1 gigabyte. You will typically want to make this partition span the entire disk and then partition it out further with a disk label.

	Each disk can only have one primary OpenBSD partition. If you specify more than one, you'll get a warning from fdisk when you try to write. If you do continue, the first OpenBSD partition will be used by disklabel.		Each disk can only have one primary partition of the OpenBSD partition type. If you specify more than one, you'll get a warning from fdisk when you try to write. If you do continue, the first OpenBSD partition will be used by disklabel.
	{{Highlight		{{Highlight
	\| code = ## Create a new primary partition		\| code = ## Create a new primary partition
Line 114:		Line 101:
	\| lang = terminal		\| lang = terminal
	}}		}}
	With a partition created, you can then partition out the space with <code>disklabel</code>. ~~Note~~ that the 'c~~' partition~~ always exists and ~~covers~~ the entire disk. ~~You can create up to 15 other partitions as you see fit as <code>a, b, d, ..., p</code>~~. ~~Just be aware~~ that ~~you need to make sure the partition ranges~~ do not overlap (because ~~it lets~~ you).		With the OpenBSD partition created, you can then partition out the space with the <code>disklabel</code> utility. Recall that the first partition (a) must be the root partition from which the system is bootstrapped from and the second partition (b) should be used for swap. The third partition (c) always exists and should overlap the entire disk. Leave the 'c' partition alone. Take special care that your partitions do not overlap with each other because nothing will stop you from doing so.
	{{Highlight		{{Highlight
	\| code = ## Create a new secondary partition		\| code = ## Create a new secondary partition
Line 141:		Line 128:
	\| lang = terminal		\| lang = terminal
	}}		}}

			== Tasks ==

			===System update===
			To update a OpenBSD system, run:
			{{Highlight
			\| code = # syspatch
			# pkg_add -Uu
			# sysmerge -d
			\| lang = terminal
			}}

			=== Finding all available disks ===
			There is no utility that does this similar to <code>lsblk</code>. Rather, you can find all disks using <code>sysctl \| grep disk</code>.
			{{Highlight
			\| code = # sysctl -a {{!}} grep -i disk
			hw.disknames=wd0:94a4943e88c9a60f,wd1:,cd0:,fd0:
			hw.diskcount=4
			machdep.bios.diskinfo.128=bootdev = 0xa0000200, cylinders = 1023, heads = 255, sectors = 63
			machdep.bios.diskinfo.129=bootdev = 0xa0010200, cylinders = 1023, heads = 255, sectors = 63
			\| lang = terminal
			}}
			Disks are named either <code>wd</code> (IDE, SATA, flash devices) or <code>sd</code> (SCSI devices, USB drives via the ahci interface, or disks via a RAID controller).

	=== Disabling library ASLR ===		=== Disabling library ASLR ===
	<code>rcctl disable library_aslr</code>		<code>rcctl disable library_aslr</code>

	== ~~Questions~~ ==		=== Boot into system rescue ===
			Enter the boot shell and run: <code>boot bsd.rd</code>. When given a prompt, select <code>(S)hell</code>.

	~~# Why~~ is ~~the 'c' disk label always the entire disk~~ and ~~left unused?~~		=== Integrating with FreeIPA ===
	#		There is no sssd available. You might need to set up OpenLDAP and Kerberos authentication manually...

Leo at 00:43, 27 April 2022

2022-04-27T00:43:56Z

← Older revision		Revision as of 00:43, 27 April 2022
Line 57:		Line 57:

	=== Finding all available disks ===		=== Finding all available disks ===
	There is no lsblk. Rather, you can find all disks using <code>sysctl \| grep disk</code>.		There is no utility that does this similar to <code>lsblk</code>. Rather, you can find all disks using <code>sysctl \| grep disk</code>.
	{{Highlight		{{Highlight
	\| code = # sysctl -a {{!}} grep -i disk		\| code = # sysctl -a {{!}} grep -i disk
Line 87:		Line 87:
	\| lang = terminal		\| lang = terminal
	}}		}}
	To create a new primary partition, edit one of the entries and specify a start and end size. ~~You~~ can ~~enter '~~1G' to ~~specify 1GB~~. ~~Set~~ the ~~type to <code>0xA6</code> so that you can use <code>~~disklabel~~</code> to partition out the space out further~~.		To create a new primary partition, edit one of the entries and specify a start and end size. Create a new partition of type 0xA6 which is a OpenBSD partition which allows you to further partition out the disk with disklabel. The start and end values can be specified in other units such as 1G for 1 gigabyte.

			Each disk can only have one primary OpenBSD partition. If you specify more than one, you'll get a warning from fdisk when you try to write. If you do continue, the first OpenBSD partition will be used by disklabel.
	{{Highlight		{{Highlight
	\| code = ## Create a new primary partition		\| code = ## Create a new primary partition
Line 112:		Line 114:
	\| lang = terminal		\| lang = terminal
	}}		}}
	With a partition created, you can then partition out the space with <code>disklabel</code>.		With a partition created, you can then partition out the space with <code>disklabel</code>. Note that the 'c' partition always exists and covers the entire disk. You can create up to 15 other partitions as you see fit as <code>a, b, d, ..., p</code>. Just be aware that you need to make sure the partition ranges do not overlap (because it lets you).
	{{Highlight		{{Highlight
	\| code = ## Create a new secondary partition		\| code = ## Create a new secondary partition
Line 124:		Line 126:
	\| lang = terminal		\| lang = terminal
	}}		}}
	~~Then~~, create a new filesystem on <code>wd1d</code>		With wd1d defined now, we can then go ahead and create a new filesystem on <code>wd1d</code> using <code>newfs</code>.
	{{Highlight		{{Highlight
	\| code = # newfs wd1d		\| code = # newfs wd1d
Line 131:		Line 133:
	super-block backups (for fsck -b #) at:		super-block backups (for fsck -b #) at:
	160, 25760, 51360, 76960,		160, 25760, 51360, 76960,
			\| lang = terminal
			}}We can then mount.
			{{Highlight
			\| code = # mount /dev/wd1d /mnt
			# mount
			/dev/wd1d on /mnt type ffs (local)
	\| lang = terminal		\| lang = terminal
	}}		}}
Line 136:		Line 144:
	=== Disabling library ASLR ===		=== Disabling library ASLR ===
	<code>rcctl disable library_aslr</code>		<code>rcctl disable library_aslr</code>

			== Questions ==

			# Why is the 'c' disk label always the entire disk and left unused?
			#

Leo at 00:28, 27 April 2022

2022-04-27T00:28:02Z

Show changes

Leo: Initial content

2022-04-26T23:30:34Z

Initial content

New page

OpenBSD is a UNIX-like operating system.