source: hybrid/branches/releng-10/nanobsd/cfg/nanobsd.wleiden@ 13424

Last change on this file since 13424 was 13424, checked in by rick, 10 years ago

Secured serial access requiring no password.

We hardly use the root password since all uses SSH keys, how-ever when
sometimes requires to use the serial console the password requirement is a
large inconvience. Since all location have a physically secured serial access I
would consider this access 'safe' not needing to type an password.

File size: 12.1 KB
Line 
1## Dit is een NanoBSD configuratie-template voor WirelessLeiden.
2## Instellingen weergegeven binnen dit bestand gelden als
3## standaard binnen de organisatie.
4
5# Little hack to allow proper secify of KERNL/PKG location
6if [ -n "$NANO_CFG_FILE" ]; then
7 NANO_CONF_DIR=$(cd $(dirname $NANO_CFG_FILE); pwd -P)
8else
9 NANO_CONF_DIR=$(cd $(dirname $2); pwd -P)
10fi
11
12# object naam in /usr/obj/nanobsd.{obj}
13NANO_NAME=wleiden-hybrid
14NANO_SRC=/usr/src # nanobsd source tree
15NANO_TOOLS=$(pwd)
16NANO_KERNEL=$NANO_CONF_DIR/kernel.wleiden # naam van het kernel configuratiebestand
17NANO_IMAGES=2 # aantal nanobsd code slices/installs (1/2)
18
19NANO_CONFSIZE=20480 # Volume van de config slice (10MB) in 512bs
20NANO_DATASIZE=0 # volume van de data slice, 0 = not configured
21NANO_CODESIZE=0 # Let buildscript the operating system slice as large as posible
22NANO_RAM_TMPVARSIZE=102400 # Volume of combined var & tmp slice (50MB) in 512bs
23
24NANO_LABEL=WLIMG
25NANO_NEWFS="-b 4096 -f 512 -i 8192" # Overwrite the default stettings to disable Soft-updates
26
27
28#XXX: Eeks, fixed packages, needs building a hook to allow building the package
29# of the shelfs if needed, copy to right directory, done. With only input needed
30# a list of ports in the format like net/net-snmp
31NANO_PACKAGE_DIR=$NANO_CONF_DIR/../pkg/All
32NANO_PACKAGE_LIST="*"
33
34
35# Wireless Leiden ports from $WL_PORTSDIR are copied OVER $PORTSDIR
36PORTSDIR='/usr/ports'
37WL_PORTSDIR="$NANO_CONF_DIR/../ports/"
38
39# Dirty quirk to allow comments in part below
40PACKAGE_LIST=`cat <<EOF | sed -e 's/#.*$//g' | xargs
41benchmarks/iperf
42devel/py-yaml
43editors/vim-lite
44dns/dnsmasq
45dns/nsd
46dns/unbound
47ftp/curl
48lang/python2
49lang/python
50net/ladvd
51net-mgmt/iftop
52net-mgmt/net-snmp
53net/mtr
54net/isc-dhcp42-server
55net/pen
56ports-mgmt/pkg
57security/sudo
58security/ca_root_nss
59sysutils/screen
60sysutils/ucspi-tcp
61www/apache24
62www/tinyproxy
63
64# Extra WL ports
65net/lvrouted
66`
67# Package target
68PKG_MAKE_ARGS="PACKAGES=$(dirname $NANO_PACKAGE_DIR) BATCH=yes PACKAGE_BUILDING=yes"
69
70PKG_MAKE_CONF="
71# www/py-cherrypy - include apache templating
72# net-mgmt/net-snmp - no perl please (size)
73# net-mgmt/nagios-plugins - no threading (single CPU)
74# shells/bash-static - logging via syslog
75# net/mtr - no X11 (no screen)
76# lang/ocaml - no TK support (requires X11)
77# devel/ocaml-findlib - no TOOLBOX support (requires ocaml with TK support)
78OPTIONS_SET= APACHE FPING SYSLOG
79OPTIONS_UNSET= PERL PERL_EMBEDDED X11 TK TOOLBOX
80"
81
82##NANO_PACKAGE_LIST=
83
84# Warning: set to 1 to debug make build errors
85# Number of recurrent parrallel make builds
86if `grep -q 'acpi0: <PRLS PRLS_OEM> on motherboard' /var/run/dmesg.boot`; then
87 # Mac OS X Parallels virtual machine
88 NANO_PMAKE="make -B"
89else
90 # Default 2 times number of CPU's inside machine
91 NANO_PARALLEL_MAKE=`expr $(sysctl -n hw.ncpu) \* 2`
92 NANO_PMAKE="make -j ${NANO_PARALLEL_MAKE}"
93fi
94
95# Starting from soekris bios version 1.31 upwards boot0sio does not seems work
96# anymore, but boot0 does (weird)
97NANO_BOOTLOADER="boot/boot0"
98
99# Strip down to a more acceptable size
100# hints from http://people.freebsd.org/~phk/nanobsd/soekris_4x26/make.soekris_4x26.conf (46MB)
101NANO_PRUNE="$NANO_PRUNE usr/share/examples"
102NANO_PRUNE="$NANO_PRUNE usr/share/syscons"
103NANO_PRUNE="$NANO_PRUNE usr/share/calendar"
104# NB! usr/share/misc contains termcap, vi(1) etc fails to work without it.
105# NANOBSD_PRUNE += usr/share/misc
106NANO_PRUNE="$NANO_PRUNE usr/share/pcvt"
107NANO_PRUNE="$NANO_PRUNE usr/share/me"
108NANO_PRUNE="$NANO_PRUNE usr/share/doc"
109
110
111
112
113
114# Opties parsed gedurende build & install world
115# Also check man 3 src.conf for details
116# Some flags are misleading, e.g. could only be installworld (e.g.), for details:
117# http://phk.freebsd.dk/misc/build_options/
118# For details on make options also check:
119# /usr/src/share/mk/bsd.own.mk
120CONF_COMMON='
121# Specific enabled options
122#WITHOUT_ACPI=YES # geen advanced configuration power interface
123#WITHOUT_BIND=YES # geen bind tools, dns/named geinstalleerd
124#WITHOUT_CXX=YES # Set to not build g++(1) and related libraries.
125#WITHOUT_GROFF=YES # Set to not build groff(1).
126#WITHOUT_INET6=YES # geen ondersteuning inet versie 6 architectuur
127#WITHOUT_INFO=YES # geen info bestanden, readable online docs
128#WITHOUT_IPFILTER=YES # geen ip filtering geinstalleerd
129#WITHOUT_KLDLOAD=YES # do not allow loading of kernel modules
130#WITHOUT_MAILWRAPPER=YES # geen mailwrapper bij gebruik sendmail
131#WITHOUT_MAN=YES # geen handleidingen gecompileerd
132#WITHOUT_MISC=YES # geen misc sub directory
133#WITHOUT_MODULES=YES # geen ondersteuning toevoegen modules
134#WITHOUT_PAM=YES # geen ondersteuning pa modules
135#WITHOUT_PF=YES # geen packet filtering geinstalleerd
136#WITHOUT_SHARE=YES # geen share sub directory
137#WITHOUT_USB=YES # geen ondersteuning usb modules
138# Specific disabled options
139WITHOUT_ATM=YES # geen ondersteuning Asynchronous Transfer Mode
140WITHOUT_AUDIT=YES # geen event auditing / audit trails
141WITHOUT_AUTHPF=YES # geen authenticating gateway user shell
142WITHOUT_BLUETOOTH=YES # geen ondersteuning Bluetooth modules
143WITHOUT_CALENDAR=YES # geen calendar reminder service gecompileerd
144WITHOUT_CDDL=YES # Set to not build code licensed under Sun CDDL. (also ZFS)
145WITHOUT_CPP=YES # Set to not build cpp(1).
146WITHOUT_CVS=YES # geen cvs tools geinstalleerd
147WITHOUT_DICT=YES # geen dictionary ondersteuning
148WITHOUT_EXAMPLES=YES # geen voorbeeld configuratiebestanden
149WITHOUT_FORTRAN=YES # geen ondersteuning fortran compilers
150WITHOUT_GAMES=YES # geen games gecompileerd
151WITHOUT_GCOV=YES # geen gcov test coverage program
152WITHOUT_GDB=YES # geen gnu debugger gecompileerd
153WITHOUT_GPIB=YES # geen ondersteuning gpib kaarten
154WITHOUT_HTML=YES # geen html help bestanden gecompileerd
155WITHOUT_I4B=YES # geen ondersteuning voor isdn
156WITHOUT_IPX=YES # geen ondersteuning ipx protocols
157WITHOUT_KERBEROS=YES # geen ondersteuning Kerberos authenticatie
158WITHOUT_LOCALES=YES # geen ondersteuning lokalisatie
159WITHOUT_LPR=YES # geen ondersteuning print services
160WITHOUT_NIS=YES # geen ondersteuning network information system
161WITHOUT_PROFILE=YES # Set to avoid compiling profiled libraries.
162WITHOUT_RCMDS=YES # geen ondersteuning rcmds,
163WITHOUT_RESCUE=YES # geen rescue bestanden gecompileerd
164WITHOUT_SENDMAIL=YES # geen sendmail geinstalleerd
165WITHOUT_SHAREDOCS=YES # geen share/docs directories
166WITHOUT_SYSCONS=YES # geen syscon devices gecompileerd
167WITHOUT_UNBOUND=YES # Port version will be used if any is used
168'
169
170CONF_BUILD="
171${CONF_COMMON}
172"
173
174CONF_INSTALL="
175${CONF_COMMON}
176WITHOUT_TOOLCHAIN=YES # geen freebsd toolchain
177"
178
179
180# Flash disks arrived, sandisk 1g seems to match the geometry of the (blanc) cards
181#FlashDevice sandisk 1g # nanobsd flashdevice entry
182#FlashDevice sandisk 512mb # nanobsd flashdevice entry
183#FlashDevice transcend 2g # nanobsd flashdevice entry
184# Calculated value of PEAK hardware 1GB CF card
185# C/H/S phys 1954/16/63, logical 977/32/63
186# Mediasize is calculated as C*H*S*512
187
188# Using logical values reported by ALIX board
189# values for PCEngines blanc 1 GB cards
190# C/H/S phys 1966/16/63, logical 983/32/63
191NANO_MEDIASIZE=`expr 1008451584 / 512`
192NANO_HEADS=32
193NANO_SECTS=63
194
195
196# Version tagging
197cust_version_tag() (
198 VERSION_FILE="${NANO_WORLDDIR}/tools/wl-release.txt"
199 (
200 echo "Generated by `id -un`@`hostname -f` at `date`"
201 echo ""
202 echo "=== CONFIG specifics ==="
203 svn info ${NANO_CONF_DIR}/../ || exit 0
204 svn diff ${NANO_CONF_DIR}/../ || exit 0
205 echo "=== BEGIN CONFIG specifics ==="
206 ) > $VERSION_FILE
207)
208
209# Takes a very long time (10+) minutes to generate this file on an ALIX board,
210# not practical for quick debugging and configuration.
211cust_openvpn_dhparam() (
212 DHFILE=${NANO_WORLDDIR}/etc/easy-rsa-keys/dh1024.pem
213 mkdir -p `dirname $DHFILE`
214 openssl dhparam -out $DHFILE 1024
215)
216
217
218
219# Assuming we are running a safe envirionment where snooping could occur during or after the build
220cust_set_root_password() (
221 if [ -n "${CFG_ROOT_PASSWORD}" ]; then
222 pprint 2 "Set root password using CFG_ROOT_PASSWORD variable"
223 chroot ${NANO_WORLDDIR} sh -c "echo '${CFG_ROOT_PASSWORD}' | pw usermod -h 0 -n root"
224 else
225 pprint 2 "Root password is <blank>, no password provided at variable CFG_ROOT_PASSWORD"
226 fi
227)
228
229
230
231# EXPERIMENTAL patch like envirionment
232# Using '*-nanobsd.patch' files to only specify the bare differences between the base/default file to
233# keep us as close as possible to the base OS
234# Patches are applied to the directory they live in
235#cust_apply_nanobsd_patches() (
236# for PATCHFILE in `find ${NANO_WORLDDIR} -regex '.*-nanobsd\.patch$'`; do
237# cd `dirname ${PATCHFILE}`
238# patch -t -N -p0 -i `basename ${PATCHFILE}`
239# #XX: What to with installed patch files? Delete them for the time beeing
240# rm -v ${PATCHFILE}
241#done
242
243
244
245#)
246
247
248
249# Customize ntpd
250cust_ntpd() (
251 chroot ${NANO_WORLDDIR} sh -c "ln -fs /usr/local/etc/ntp.drift /var/db/ntp.drift"
252)
253
254
255# Enable Serial TTYs
256cust_serial_ttys() (
257 chroot ${NANO_WORLDDIR} sed -i '' -e '/ttyv[0-9]/s/on /off/' -e '/ttyu0/s/off/on/' -e '/ttyu0/s/dialup/ansi/' /etc/ttys
258
259 # Serial login is consided to be phycically secured, so no credentials are required
260 chroot ${NANO_WORLDDIR} sed -i '' -e '/ttyu0/s/std.9600/al.9600/' /etc/ttys
261)
262
263# Customize sudoers files
264cust_sudo_rules() {
265 chroot ${NANO_WORLDDIR} find /usr/local/etc/sudoers.d/ -type f -exec chmod 0640 {} \+
266}
267
268
269
270# Install files from specific relative location
271cust_install_files () (
272 cd ${NANO_CONF_DIR}/../files
273 find . -print | grep -v -e /CVS -e .svn | cpio -dumpv ${NANO_WORLDDIR}
274)
275
276
277# Make tools available for root by default
278cust_root_bin_to_tools() {
279 ln -s /tools ${NANO_WORLDDIR}/root/bin
280}
281
282
283# Prune no needed directories of image
284cust_nano_prune () (
285 cd ${NANO_WORLDDIR}
286 for ENTRY in ${NANO_PRUNE}; do
287 rm -vfR ${ENTRY}
288 done
289)
290
291# We actually do need an seperate /tmp, so undo the symlinking done in
292# setup_nanobsd()
293late_cust_unset_common_var_and_tmp() (
294 cd ${NANO_WORLDDIR}
295 rm tmp
296 mkdir -m 1777 tmp
297)
298
299
300# Fill /cfg wmth custom files, based on 'create_i386_diskimage ( )'
301last_nano_fill_cfg () (
302 # Variables to be used
303 IMG=${NANO_DISKIMGDIR}/${NANO_IMGNAME}
304 MNT=${MAKEOBJDIRPREFIX}/_.mnt
305
306 # Mount '/cfg' slize in image
307 MD=`mdconfig -a -t vnode -f ${IMG}`
308 mount /dev/${MD}s3 ${MNT}
309
310 # Location of '/cfg' directory
311 cd ${NANO_CONF_DIR}/../cfg-files
312 find . -print | grep -v -e /CVS -e .svn | cpio -dumpv ${MNT}
313
314
315 # Leave in nice end state
316 umount ${MNT}
317 mdconfig -d -u ${MD}
318) > ${MAKEOBJDIRPREFIX}/_.fc 2>&1
319
320last_nano_disk_usage () (
321 # Variables to be used
322 IMG=${NANO_DISKIMGDIR}/${NANO_IMGNAME}
323 MNT=${MAKEOBJDIRPREFIX}/_.mnt
324
325 # Mount root slize
326 MD=`mdconfig -a -t vnode -f ${IMG}`
327 mount /dev/${MD}s1a ${MNT}
328
329 # Show disk usage (percent free) inc header
330 pprint 2 $(df -h | head -1)
331 pprint 2 "$(df -h | grep /dev/${MD})"
332
333 # Leave in nice end state
334 umount ${MNT}
335 mdconfig -d -u ${MD}
336)
337
338last_orders () (
339 last_nano_fill_cfg
340 last_nano_disk_usage
341)
342
343# Ugly hack to 'escaping' pprint from inside a customize_cmd to output
344# instead of a file
345exec 3>/dev/stdout
346# Progress Print
347# Print $2 at level $1
348pprint() {
349 if [ "$1" -le $PPLEVEL ]; then
350 printf "%.${1}s %s\n" "#####" "$2" 1>&3
351 fi
352}
353
354# Cust macro`s gestart in onderstaande volgorde
355# XXX: Determine size before installing all find of additions to see how much
356# base we are actually using ## du -h -d 0
357customize_cmd cust_pkgng
358customize_cmd cust_install_files
359customize_cmd cust_ntpd
360customize_cmd cust_serial_ttys
361customize_cmd cust_version_tag
362customize_cmd cust_root_bin_to_tools
363customize_cmd cust_allow_ssh_root
364customize_cmd cust_openvpn_dhparam
365customize_cmd cust_nano_prune
366customize_cmd cust_set_root_password
367customize_cmd cust_sudo_rules
368#customize_cmd cust_apply_nanobsd_patches
369late_customize_cmd late_cust_unset_common_var_and_tmp
370
371# Standard overwrite
372if [ -r "$NANO_CONF_DIR/nanobsd.local" ]; then
373 . $NANO_CONF_DIR/nanobsd.local
374fi
375
376# Extra config if existing is not suffient
377if [ -n "$EXTRA_NANOBSD_CONFIG" ]; then
378 for FILE in $EXTRA_NANOBSD_CONFIG; do
379 # File relative to config directory
380 if [ "`echo $FILE | cut -c1`" != "/" ]; then
381 FILE=$NANO_CONF_DIR/$FILE
382 fi
383 pprint 1 "Loading $FILE"
384 . $FILE || exit 1
385 done
386fi
Note: See TracBrowser for help on using the repository browser.