Gateway building with OpenBSD

I just completed the setup of ASSERT's gateway under OpenBSD.

Things I had to do which are worth noting:

- During OpenBSD installation, you must remove the 'a' partition (d a)
  and create 'a' and 'b' (swap).
- pkg_add https://..../bash_3.1.tgz
- vi .bashrc (alias, exports)
- vi .bash_login (. .bashrc)
- mkdir .ssh ; cat > .ssh/authorized_keys (id_dsa.pub)
- vi /etc/ssh/sshd_config (PermitRoot, PubkeyAuthentication)
- kill -1 "the pid of SSH"
- vi /etc/rc.conf (httpd_flags="-u") (I can't work with chroot 
  since the CGIs call python, perl, etc - which don't exist under
  /var/www/ (the new ch(root))

- cat > /usr/local/bin/dos2unix <<OEF
#!/usr/local/bin/bash
if [ $# -ne 1 ] ; then
        echo Usage: $0 file
        exit 1
fi
cat "$1" | tr -d '\r' > /tmp/ole
mv /tmp/ole "$1"
OEF

- vi /etc/rc (PATH= ... - add /usr/local/bin, since I put dos2unix
  there, and the scripts need it!)
- oh, also add /usr/lib/ccache to the PATH (in front) (and either
  fetch or recompile ccache into 
  three symlinks under /usr/lib/ccache/{gcc,cc,g++}
- httpd runs under user www, who has no HOME. ccache needs
  $HOME/.ccache, so change the asn2aadlPlus.py to invoke gcc
  as "CCACHE_DIR=/tmp/.ccache gcc"
- htpasswd -cm /etc/ASSERT-auth-file jerome
- vi /var/www/conf/httpd.conf

Find the <Directory "/var/www/htdocs">
and remove Indexes from Options
and add

  AuthType Basic
  AuthName "ASSERT gateway"
  AuthUserFile /etc/ASSERT-auth-file
  Require valid-user
 
- chown  root.wheel /etc/ASSERT-auth-file
- makeCertificates.sh (e.g. for 192.168.0.145)

cat > makeCertificates.sh <<OEF
#!/bin/bash
if [ $# -ne 1 ] ; then
        echo Usage: $0 www.domain.com
        exit 1
fi
# use this to encrypt your keys - but Apache2 (at startup) wants passphrase
#openssl genrsa -des3 -out $1.key 1024
openssl genrsa -out $1.key 1024
echo GR
echo Attiki
echo Athens
echo Semantix Information Technologies
echo Software Development
echo $1
echo ttsiodras@semantix.gr
openssl req -new -key $1.key -out $1.csr
openssl x509 -req -days 3650 -in $1.csr -signkey $1.key -out $1.cert
chmod 400 $1.key
echo Now copy $1.key to /etc/ssl/private
echo and $1.cert to /etc/ssl/certs
OEF

- cp 192.168.0.145.cert /etc/ssl/
- cp 192.168.0.145.key /etc/ssl/private/
- vi /var/www/conf/httpd.conf

ServerName 192.168.0.145
SSLCertificateFile    /etc/ssl/192.168.0.145.cert
SSLCertificateKeyFile  /etc/ssl/private/192.168.0.145.key

Edit /etc/rc.conf and set httpd_flags to "-u -DSSL"

Make sure that CGIs permissions are -r-xr-xr-x
and that the owner is root.bin (not www, so that even if someone
hacks httpd he can't rewrite stuff...)
In fact, if it is ELFs and not scripts, you can set to ---x--x--x

Enjoy the security...

---

Index

CV

Updated: Sat Oct 8 12:33:59 2022