Novice Unix Questions

[npumcrisz]

I'm trying to setup up a multi-wan (multi-port) router with WAP capabilities.
Completed

• Assembled a micro-ATX with an Intel dual core processor using 1GB DRR memory and an 8GB sata flash module.
• In addition to an embedded Gbit ethernet port included a micro-PCI 3 Gbits ports.
• Using a riser card installed a DWA-552 card for WAP
• Installed zeroshell 1.0beta16 and used it successfully with the exception of WAP whereby the wireless card isn't recognized.

NOW the real deal or tough part!!

• Repartition the flash module by installing OpenBSD 5.0 install50.iso
• Rebooted successfully with a static ipv4 address assigned to re0(10.0.0.0/8)

Incomplete

• Assign network ids to the remaining 3 wired ports.
• Assign the DWA-552 in master mode for WAP services.
• Configure PF I really need this because it has support for IPv6.
• Install and configure DNS and DHCP.
• Enable remote access with a web based GUI.

My problem is with the incomplete portion of my task.
*I don't know how to get access to the port/package collection! I think it may be on the install50.iso CD but alias how do I install what is needed?

*Only myself would have access to the router. I thought webmin (unless there is some other freeware out there that can do better) would do a great job. Alias all I read is security problems with webmin!! So what do I do?

* If I have to download webmin (unless other). I could download it on my windows 7 computer to a usb flash drive but how do I install the package/port then on the openbsd machine?

[ocicat]

Originally Posted by npumcrisz

*I don't know how to get access to the port/package collection!

Welcome!

Section 15 of the project's official FAQ gives a solid overview of the packages/ports system. The number of available packages are too many to put on the downloadable ISO images, but the FAQ will point you towards the list of accessible mirror sites.

Assign network ids to the remaining 3 wired ports.

Section 6 of the FAQ will get you started on network-related issues.

Configure PF

The PF User's Guide provides a solid introduction. Reading the pf(4) manpage is also advised. One of the few documents recommended which is not formally affiliated with the OpenBSD project is Hansteen's online manuscript.

Enable remote access with a web based GUI.

You will find that the command-line tools to be well documented & highly recommended. Web-based tools have not had a stellar track record for stability or security.

Take some time to study this information. If after digesting it, you have more focused questions, feel free to post again.

[daemonfowl]

Hi Npumcrisz !
I'm a newbie like you but I can help ... :-)

*I don't know how to get access to the port/package collection!

the OpenBSD Team encourage the use of packages rather than ports

IMPORTANT NOTE: The ports tree is meant for advanced users. Everyone is encouraged to use the pre-compiled binary packages

choose the closest mirror from ftplist .. here
http://openbsd.org/ftp.html#ftp
if you are in n Germany for instance , do this :

  $ export PKG_PATH=ftp://ftp.spline.de/pub/OpenBSD/5.0/packages/'machine -a'/

then .. to install bash , for example ..

$ sudo pkg_add bash

you can make the PKG_PATH permanent by putting it in your ~/.profile

[npumcrisz]

Originally Posted by ocicat

Welcome!

You will find that the command-line tools to be well documented & highly recommended. Web-based tools have not had a stellar track record for stability or security.

Take some time to study this information. If after digesting it, you have more focused questions, feel free to post again.

Ocicat would I be able remotely configure the openbsd machine?

If I could, will that possibly be via an utility such as "VNC"? I'm still trying to get my head around VNC. That includes how to install and or use it!!

If not via utility such as VNC, which do u recommend? I'm coming from a GUI environment so anything close to that l wouldn't mind if not then sadly no problem.

As for me if l dare to say, remote is a must.

[jggimi]

OpenSSH is the tool of choice to use for remote shell access, remote file transfers, remote command execution, and the tunneling of network connections for security. It has many different capabilities.

For remote commands and file transfers, start with the man pages for the client tools: ssh(1), sftp(1), scp(1). See the man page for the server daemon sshd(8), and you will also want to review the man pages for the configuration files, config_sshd(5) and config_ssh(5).

Michael W. Lucas has just published a book, SSH Mastery. See www.openbsd.org/books.html for more information.

[ocicat]

Originally Posted by npumcrisz

Ocicat would I be able remotely configure the openbsd machine?

There are a number of available options.

If I could, will that possibly be via an utility such as "VNC"?

This is a graphical third-party application option -- which means that the bandwidth requirements will be higher than other options I will mention later. Nevertheless, there are a number of third-party VNC (Virtual Network Computing) applications available in the packages/ports system:

http://openports.se/search.php?so=vnc

Wikipedia has a generalized article on VNC here.

As for other options, there is the SSH protocol. OpenSSH (ssh(1)) is part of OpenBSD's base installation. SSH clients can be found on virtually operating systems including Windows (PuTTY).

VPN (Virtual Private Network) solutions also exist. OpenVPN has been ported to OpenBSD:

http://openports.se/net/openvpn

OpenVPN is also an application which has been ported to other Unix-like operating systems. You will also find several books available on use/configuration.

Wikipedia also has an article here.

IPsec is also part of OpenBSD's base installation. A number of manpages will need to be studied; starting at ipsec(4) is a good beginning. Configuring IPsec is perhaps more challenging than OpenVPN, but IPsec (as a protocol) is integrated into OpenBSD's kernel. OpenVPN is a userland third-party application.

Wikipedia has an article on IPsec here.

One of the values of VPN solutions is that this addresses "road warriors" who may be connecting to servers from any IP address. With SSH, you will need to decide how port 22 (or whatever port you choose to use...) will be exposed to the Internet.

As for me if l dare to say, remote is a must.

This is not a problem. While you are free to use graphical environments, they require more network resources. There also have been occasional security issues in the past. The other options I have mentioned are based on fundamental protocols, & may give you more latitude in terms of how you connect remotely.

[denta]

I would also suggest using ssh/sshd for remote access. I mean, what would the typical VNC usage be? VNC in, and then open a terminal to to the admin tasks? If thats the case, you might aswell just stick with ssh/sshd.

[npumcrisz]

Originally Posted by ocicat

There are a number of available options.

As for other options, there is the SSH protocol. OpenSSH (ssh(1)) is part of OpenBSD's base installation.

VPN (Virtual Private Network) solutions also exist.

OpenVPN is also an application which has been ported to other Unix-like operating systems.

IPsec is also part of OpenBSD's base installation. A number of manpages will need to be studied; starting at ipsec(4) is a good beginning. Configuring IPsec is perhaps more challenging than OpenVPN, but IPsec (as a protocol) is integrated into OpenBSD's kernel. OpenVPN is a userland third-party application.

One of the values of VPN solutions is that this addresses "road warriors" who may be connecting to servers from any IP address. With SSH, you will need to decide how port 22 (or whatever port you choose to use...) will be exposed to the Internet.

The other options I have mentioned are based on fundamental protocols, & may give you more latitude in terms of how you connect remotely.

ssh protocol
Alright I installed putty-0.62-installer.exe but is openssh enabled by default? I understand it may be install in the base installation but is it enabled?

vpn protocol
I installed securepointsslvpn_rc4.exe but is openvpn enabled by default?

IPsec
Am lost, how do l use this to remotely configure the openbsd server? Is this enabled in the base installation?

[ocicat]

Originally Posted by npumcrisz

I understand it may be install in the base installation but is it enabled?

This depends upon whether what choice you made during installation. Section 4.5.2 of the FAQ discusses where:

Start sshd(8) by default? [yes] _

I installed securepointsslvpn_rc4.exe but is openvpn enabled by default?

securepointsslvpn_rc4.exe is a Windows executable which you would install on Windows. You would not install it on OpenBSD. OpenVPN is a third-party application available in packages. It is not installed by default on OpenBSD. After installation, you will need to configure it yourself.

Is this enabled in the base installation?

IPsec is integrated into OpenBSD's kernel, however, you will have to configure it yourself if this is your choice of VPN.

In general, we do not recommend documentation found on the Internet which was not published by the OpenBSD project. Frequently, it is out of date, incorrect, or incomplete. However, since you are still wrapping your head around IPsec, the following may give you some perspective:

http://www.kernel-panic.it/openbsd/vpn/

Yet, note that this document was written for OpenBSD 4.6. It is not guaranteed to work with OpenBSD 5.0. My recommendation is to read the article, followed by reading the manpages installed on OpenBSD 5.0. Again, ipsec(4) is a good beginning point.

Just to clarify, my previous message mentioned two separate technologies for remote access:

• SSH.
• VPN.

If you decide to configure a VPN, OpenVPN is one choice, IPsec is another. Both do not need to be configured.