Changes between Initial Version and Version 1 of FreeBSD12_Guide

Timestamp:

Feb 6, 2019, 8:49:15 PM (5 years ago)

Author:

rick

Comment:

--

FreeBSD12_Guide

@@ +1 @@
+[[PageOutline]]
+
+= Nodefactory based on FreeBSD 11-RELEASE =
+
+This guide is last updated for use with FreeBSD 11.2-RELEASE
+
+----
+
+== Scope ==
+
+We intend to implement a number of changes/improvements.
+
+Done:
+- implement new package management (pkgng)
+- cleanup packages that are no longer required: nrpe, vim, bash-static, pftop, nmap, python-Jinja2, sixxs-aiccu, openvpn
+- implement latest version of lvrouted (auto update default route)
+- add [https://code.google.com/p/ladvd/ net/ladvd]
+- add inet check in snmpd.conf
+- update scripts to use 'drill' instead of 'dig'
+- remove the "rcvar='set_rcvar'" statement from startup scripts in /etc/rc.d/ and /usr/local/etc/rc.d
+- based on FreeBSD-11.2-RELEASE
+- [http://unbound.net/ unbound] replaces bind; recursive dns server on standard-node; authorative server for wleiden.net domain on two special servers in the network; [https://calomel.org/unbound_dns.html unbound tutorial]. Unbound optimizes forwarders automatically, so nameservershuffle is no longer needed. Use unbound from ports, not local_unbound.
+- replaced thttpd by [http://httpd.apache.org/ apache-2.4] 
+- no longer soft-updates
+- update captive portal to increase speed: use of static html landing page 
+- merged APU specifics into generic configuration (we do not use X64, MIPS or ARM)
+- correction of dhcpd.conf for aliased interfaces (no 'shared-networks')
+- use [wiki:Poudriere] for package building
+- correct /tools/wl-config external fetch url (wirelessleiden.nl/config/)
+- use of nsd for wleiden.net local domain authorative nameserver
+- use monit for node-based monitoring and watch dog functionality (https://mmonit.com/monit/)
+
+
+Pending:
+- use ipfw instead of pf in order to make usb-lan adapter work, see ticket #206 for problem description.  Functionality:
+{{{
+  Requirements:
+    direct new user to the Captive Portal page (rdr, blocking acl) on node.
+    only allow http/https traffic to internet (gateway setup).
+    NAT on gateways.
+    Incoming RDR/NAT voor (webcam) services on gateways. 
+  Nice-to-have features:
+    Bandwidth limiting (FUP).
+    Bad traffic detection and blocking. 
+}}}
+- add 'welcome back' page to captive portal (activated when connection interrupted)
+- bsnmp may replace net-snmp (low priority)
+- wl-web page redesign for local users / maintainance
+- add ssh-guard or no password-login, only keys
+- gformat should include ssh-redirect rule in pf.hybrid.conf.local for the gateways.
+{{{
+# Redirect SSH on internetport 1022 to 22 because of ssh spam, block external port 22: 
+rdr on $ext_if inet proto tcp from any to $ext_if port 1022 tag SRV -> 172.17.87.1 port 22
+}}}
+- captive portal: allow some (specified) external IP's (such as the sponsor website or to allow browsing the WirelessLeiden website e.g. for support information online). Also the captive portal page could provide node specific information that would be maintained through a website (CMS).
+- captive portal (enhancement): For user support it might be helpful to provide technical user-related information on the bottom of the captive portal; maybe a comment field and button to allow the user to send input to support@wirelessleiden.nl. 
+
+Will keep
+ - ucspi-tcp-0.88_2 for redirect captive portal
+ - mtr, curl, screen, sudo 
+ - dnsmasq (for Soekris hardware and possibly dhcpd service)
+ - pen
+ - tinyproxy
+
+
+Gradually we are implementing the various changes, starting from the present software configuration (9.0-RELEASE) on 11.2-RELEASE with the next generation package management system (pkgng). The procedure to build this 'work-in-progress' nodefactory-host is described below.
+
+A [http://svn.wirelessleiden.nl/svn/node-config/genesis/nodes/TestTienThuis/wleiden.yaml test-node-configuration] is available in svn. 
+This wleiden.yaml file can be used to test the image by installing on an Alix-board with connection to the local network. We are also evaluating the new APU-board, see the [wiki:AlixAPU wiki-page].
+
+==  A. Setup a FreeBSD host ==
+
+Setup is tested in a high performance [https://www.virtualbox.org/ VirtualBox] environment, running 4 x Core i7 CPU, 4096MB RAM and SSD disk (20GB). Timing estimates are based on this system:
+
+  
+ * Make sure ''/usr'' is '''at least 12 GB''' but better is '''20 GB''' in size, as building images requires quite some space. 
+ * Make sure you install the 32bit '''i386''' release of FreeBSD also when your system does support amd64, as cross compiling can give some nasty surprises.
+ * Internet connection is required for initial building phase. Ones completed succesfully no internet connection is required anymore.
+
+Tip: Use an SSD disk to speed up the compilation process. Do NOT use a separate hard disk mounted on /usr/obj as this will cause cross-device link errors.
+
+Get yourself a fresh i386 FreeBSD host installed as follows:
+
+=== A.1. Run the basic CD installer  ===
+The procedure below has been tested with 11.2 (standard developer install - no ports -, e.g. with default partitioning will fit our needs). Installing FreeBSD is outside the scope of this document, take a look into [http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/bsdinstall.html the FreeBSD handbook Chapter 2 Installing FreeBSD] if you do not know the details. 
+
+
+=== A.2. After first boot ===
+
+Warning: Because of the many mounts and unmounts done in various phases running as root is required. Do NOT use a production machine as WL build environment, because it will fail at some point in time! 
+
+Allow SSH root login, since all commands below need to be executed as root:
+{{{PermitRootLogin yes}}} in file:/etc/ssh/sshd_config
+
+Set correct date/time and make sure it is kept up2date:
+build# ntpdate 0.nl.pool.ntp.org
+build# echo 'ntpd_enable="YES"' >> /etc/rc.conf
+
+=== A.3 Set some useful variables ===
+Alter the shell configuration file:/root/.cshrc:
+
+Ensure ftp is set to passive mode, to avoid potential firewall issues:
+build# echo 'setenv FTP_PASSIVE_MODE YES' >> /root/.cshrc
+
+Set a default password for the images that you will produce:
+build# echo 'setenv CFG_ROOT_PASSWORD DefaultPassword12!' >> /root/.cshrc
+
+Define your nanobsd (svn) working directory:
+build# echo 'setenv R /root/nanobsd' >> /root/.cshrc
+
+Enable SSL for fetch:
+build# echo 'setenv SSL_NO_VERIFY_PEER 1' >> /root/.cshrc
+
+Next load your file (or login again):
+build# source /root/.cshrc
+
+=== A.4. Development tools ===
+Bootstrap development packages:
+build# env ALWAYS_ASSUME_YES=1 pkg install vim-console sudo screen ca_root_nss subversion p5-ack
+
+Tip: screen can be a handy tool if you are working on a remote host. 
+{{{
+With 'screen' you can open a virtual terminal, in which you can do everything like in the normal terminal. 
+But you can detach it if you want to do other things in the main terminal and reattach it later. It even works after you quit your main terminal.
+
+Common screen commands:
+1. Start a new terminal:
+build# screen
+2. Type CTRL+A and D to detach this new terminal
+3. Reattach it:
+build# screen -R
+}}}
+
+=== A.5. get latest sources ===
+build# svn co -q https://svn.FreeBSD.org/base/releng/11.2 /usr/src
+
+=== A.6 set up Poudriere ===
+Setting up of Poudriere is taken care off by the package-build.sh script see section B.2 below.
+For details refer to separate page [wiki:Poudriere]
+
+== B. Build environment ==
+
+=== B.1 Download the environment from the Wireless Leiden svn repository ===
+
+build# svn checkout https://svn.wirelessleiden.nl/svn/code/hybrid/branches/releng-11/nanobsd $R
+build# cd $R
+
+
+=== B.2. Compile all required packages ===
+
+First time use requires the required packages are installed, ports are updated, port trees are merged and the Poudriere jail is setup and loaded:
+
+Set up Poudriere environment by running [15 min]:
+
+build# screen $R/tools/package-build.sh initenv
+
+Now build all packages, this will take quite some time [90 min]:
+build# $R/tools/package-build.sh build
+
+Listing of packages:
+
+{{{
+GeoIP-1.6.12                   Find the country that any IP address or hostname originates from
+apache24-2.4.34                Version 2.4.x of Apache web server
+apr-1.6.3.1.6.1_1              Apache Portability Library
+bash-static-4.4.23             GNU Project's Bourne Again SHell
+ca_root_nss-3.39               Root certificate bundle from the Mozilla Project
+curl-7.61.0_1                  Command line tool and library for transferring data with URLs
+daemontools-0.76_18            Service monitoring and logging utilities by djb
+db5-5.3.28_7                   Oracle Berkeley DB, revision 5.3
+dnsmasq-2.79,1                 Lightweight DNS forwarder, DHCP, and TFTP server
+expat-2.2.6_1                  XML 1.0 parser written in C
+gdb-8.1.1                      GNU GDB of newer version than comes with the system
+gdbm-1.13_1                    GNU database manager
+gettext-runtime-0.19.8.1_1     GNU gettext runtime libraries and programs
+gmp-6.1.2                      Free library for arbitrary precision arithmetic
+iftop-1.0.p4                   Display bandwidth usage on an interface by host
+indexinfo-0.3.1                Utility to regenerate the GNU info page index
+iperf-2.0.12                   Tool to measure maximum TCP and UDP bandwidth
+isc-dhcp44-server-4.4.1_3      ISC Dynamic Host Configuration Protocol server
+ladvd-1.1.1                    Minimal LLDP/CDP/EDP/FDP/NDP sender daemon
+ldns-1.7.0_1                   Library for programs conforming to DNS RFCs and drafts
+libevent-2.1.8_2               API for executing callback functions on events or timeouts
+libiconv-1.14_11               Character set conversion library
+libidn2-2.0.5                  Implementation of IDNA2008 internationalized domain names
+libnghttp2-1.33.0              HTTP/2.0 C Library
+libunistring-0.9.10            Unicode string library
+libxml2-2.9.7                  XML parser library for GNOME
+lvrouted-13830                 Lvrouted is a very simple shortest-path routing daemon
+monit-5.25.2                   Unix system management and proactive monitoring
+mpfr-4.0.1                     Library for multiple-precision floating-point computations
+mtr-0.92                       Traceroute and ping in a single network diagnostic tool
+net-snmp-5.7.3_18              Extendable SNMP implementation
+nettle-3.4                     Low-level cryptographic library
+nsd-4.1.24                     Authoritative only non-recursive name server
+pcre-8.42                      Perl Compatible Regular Expressions library
+pen-0.34.1                     Load balancer for UDP and TCP based protocols
+perl5-5.26.2                   Practical Extraction and Report Language
+pkg-1.10.5_2                   Package manager
+readline-7.0.3_1               Library for editing command lines as they are typed
+screen-4.6.2                   Multi-screen window manager
+sudo-1.8.25                    Allow others to run commands as root
+thttpd-2.29                    Tiny/turbo/throttling HTTP server with CGI support
+tinyproxy-1.8.4,1              Small, efficient HTTP proxy server
+ucspi-tcp-0.88_2               Command-line tools for building TCP client-server applications
+unbound-1.7.3                  Validating, recursive, and caching DNS resolver
+vim-console-8.1.0342           Improved version of the vi editor (console only)
+wait_on-1.1.2                  Enable shell scripts to monitor for changes on directories and files
+}}}
+
+(list updated Sep, 2018 using {{{$R/tools/image edit => pkg info}}})
+
+=== B.4  Build nanobsd  aka make sure to prepare some coffee ;-) ===
+Start the build process [2 hours]:
+build# screen $R/tools/image build
+
+Tip: Save some power and use an [http://rickvanderzwet.nl/svn/personal/misc/power-saver power-saver script] to shut-down the machine ones not being using any-more. 
+Tip: The geometry of a default image is based on a 1GB CF card, changes file:$R/cfg/nanobsd.wleiden
+
+
+== C. Fetch node configuration onto image, write to CF disk or remotely update ==
+
+=== C.1. Fetch node-configuration ===
+Apply [//svn.wirelessleiden.nl/svn/node-config/genesis/nodes/ Wireless Leiden 'genesis' database] configuration:
+build# $R/tools/image config for <Nodename>
+
+
+You can inspect the image bij mounting as memory disk:
+build# $R/tools/image edit
+
+Tip: For the time being you have to adjust the permissions of monitrc:
+{{{
+chmod 0700 /usr/local/etc/monitrc
+chmod 0700 /conf/base/etc/local/monitrc
+}}}
+
+=== C.2. Write the correct image to CF === 
+Tip: Media based on SLC and not MLC flash seem to perform much better
+
+Write new image to CF disk inserted into an USB card reader [15min]:
+build# $R/tools/write-image.sh
+ 
+
+
+== F. Notes ==
+
+=== F.1 Total refresh in case of change in build configuration ===
+
+To start from scratch:
+{{{  
+  svn up $R
+  $R/tools/package-build.sh distclean
+  $R/tools/package-build.sh initenv
+  $R/tools/package-build.sh build 
+}}}
+
+=== F.2 Update lvrouted port (ONLY) if necessary ===
+
+Warning: Skip the following steps unless you want to update the current lvrouted version (13830) and know what you are doing:
+
+Checkout latest version of lvrouted (i.e. beyond 13830):
+build# svn checkout http://svn.wirelessleiden.nl/svn/node-config/other/lvrouted/trunk /tmp/lvrouted
+
+Produce the tar release archive:
+build# ./tools/release.sh
+build# cd /tmp/lvrouted
+
+Upload the file:lvrouted-uvwxyz.tar.gz to the [https://webfolder.wirelessleiden.nl/lvrouted/ webfolder] directory.
+
+Update PORTVERSION to match current release:
+build# vim  $R/ports/net/lvrouted/Makefile
+
+Update the hash values:
+build# make makesum -C $R/ports/net/lvrouted
+
+Commit changes:
+build# svn ci $R/ports/net/lvrouted
+
+=== F.3 Existing image on node, remote update (slice 2) ===
+
+Note: network connection to node 172.x.y.z is required.
+
+For remotely updating an existing node software configuration use the image script:
+build# $R/tools/image deploy on <node> [and reboot]
+    
+
+Tip: You may adjust the block size to make the transfer more efficient (additionally ssh -C is possible) and you can use Ctrl-T to check progress.
+