Building Firewalls With OpenBSD And PF, 2nd Edition (2003)

Logging as root is disabled, when the following entry is present /etc/ssh/sshd_conŒg:

#PermitRootLogin yes

If you ever need to enable it (always a bad idea), remove the hash character (#) from that line and restart the sshd(8) daemon with:

# kill -HUP `cat /var/run/sshd.pid'

Adding a new user is simple, use adduser(8) and answer the questions you see on the screen. The Œrst time you use it, the system will ask you a few questions related to the general settings that will be applied to all newly created accounts. Your answers are stored in /etc/adduser.conf and can be changed at any time.

4.1.2 Letting Users Do As Root Does (su)

How does an ordinary user become root? With su(1), but access to that command is limited to those users who belong to the wheel group. To add a user to wheel either type wheel when adduser(8) asks you about the groups you'd like to invite the newly created user to. Another way is to edit

/etc/group:

# vi /etc/group

and (assuming the name of the new user is joe) change:

wheel:*:0:root

to:

wheel:*:0:root,joe

To save changes, press the Esc key, then type :x, and hit the Enter/Return key. Afterwards, when you want to become root, type:

$ su

Hit the Enter/Return key and type in the root password you gave during installation. Congratulations! You are now the superuser root, with all of the powers and the responsibilities. To drop back to ordinary user status, type exit and hit the Enter/Return key. For more information, read the su(1) manual and remember not to give access to su(1) to anyone who asks. Ideally, you should only give it to the administrator that takes over the management of your machine. Junior administrators who are helping you, should only be given access to a few essential commands via sudo(8) discussed later in this chapter.

4.1.3 Changing the User Password

Users and administrators can change passwords with passwd(1). You can only change your own password, unless you have root privileges, in which case you can change passwords for anyone on the system. The new password will need to be given twice:

# passwd joe

4.1.4 Giving Users Limited Access to Root Privileges (sudo)

Adding a user to wheel lets him or her become root, but that still doesn't prevent stupid mistakes. A better way to do it is through sudo(8), which limits access to commands owned by root via settings stored in /etc/sudoers. Unlike other system conŒguration Œles, /etc/sudoers ought to be edited with a special tool, called visudo(8). Only users with root privileges can use that command.

For example, to let joe run pfctl(8), add the following line to /etc/sudoers:

joe firewall = /sbin/pfctl

To save changes, press Esc, then type :x, and hit the Enter/Return key. Then, to use pfctl(8), type something like this:

$ sudo pfctl -s rules

You will be asked to type your password (for user joe, not root).

If you want to be 100% sure that the Œrewall exposes no unwanted services to the outside world, use the nmap(1) port scanner (available in OpenBSD ports and packages) and aim it at your Œrewall host. Be careful with this tool and never install it on the Œrewall itself. Also, watch out who you are aiming it at. Port scanning can get you in trouble if you do it on hosts that you do not control, so don't try it outside of your network or you may encounter serious legal problems. Not every administrator has time to Œnd out who is scanning her or his network.

4.2.2 Patching

Patching the system is something that any OpenBSD administrator ought to do as soon as patches are available, because leaving your system unpatched is simply asking for trouble.

Applying patches to a Œrewall running OpenBSD is a bit different than doing the same on a workstation, because the Œrewall must not be loaded with the compiler toolbox (comp34.tgz) or the source code. There is just too much possible risk. The solution is to keep a separate machine for compiling modiŒed binaries, which will later be transferred to the production machine. What is usually done be hand or by a custom script, may soon be automated by debardage, a very promising tool from sysŒve.com:

Patch announcements are posted to announce and security-announce mailing lists. If you do not yet subscribe to these lists, do it now. Doing this will help you track patches released from the moment you subscribe, but you also need to check if there were any patches released before you subscribed. Also, the announcements are just thatŠannouncements; you need to download the patches yourself. The list of patches for the current and previous releases of OpenBSD can be found on the Errata page:

The OpenBSD team only supports the latest two releases of the system. For example, after OpenBSD 3.4 was released, patches are only issued for OpenBSD 3.4 and 3.3, but not for OpenBSD 3.2 or earlier releases. This policy forces you to upgrade, which a good thing if you really are serious about security.

To apply patches, you will need to install the OpenBSD compiler tools (comp34.tgz) and the OpenBSD sources for the same release as the one you are running on the Œrewall, not the machine you are building patches on. These are the same as the sources that have been used to build that particular release of OpenBSD, not the CURRENT sources held in CVS. For the 3.4 release, you need to to get the OPENBSD_3_4 branch of the source code repository. Strictly speaking, the patches are in CVS, but extracting them from there would take uninitiated users too much time and effort.

The ofŒcial archives of sources for each release are available on the original OpenBSD CD-ROMs or online from many OpenBSD FTP mirror servers (see Chapter 3, Installing OpenBSD). If you are downloading them with ftp(1), they are always available in the top directory for the release you are using. For OpenBSD 3.4, descend into pub/OpenBSD/3.4 and download these Œles:

XF4.tar.gz

ports.tar.gz

src.tar.gz

sys.tar.gz

Next, move the source archives to the /usr/src directory:

#mv XF4.tar.gz /usr/src

#mv ports.tar.gz /usr/src

#mv src.tar.gz /usr/src

#mv sys.tar.gz /usr/src

#cd /usr/src

and unpack them with:

# tar -zxvf *.tar.gz

Once you have the OpenBSD sources, you will need to download the patches. The latest set of patches is always available on the FTP mirror servers in the subdirectories of the pub/OpenBSD/patches directory. For example, if you are looking for patches for OpenBSD 3.4, you will Œnd them in pub/OpenBSD/patches/3.4. Download the 3.4.tar.gz archive into your home directory and unpack it:

# tar -zxvf 3.4.tar.gz

You will now have a directory named 3.4 with the following subdirectories:

alpha/

amiga/

common/

hp300/

i386/

m68k/

mac68k/

macppc/

mvme68k/

ports/

sparc/

sparc64/

vax/

Out of these subdirectories, only three are of interest to us: common (contains patches for all hardware platforms), ports (contains patches for the ports collection, applicable to all hardware platforms), and the subdirectory containing patches applicable to the hardware platform you use. For Intel x86 machines, you need the patches from i386.

As you can see, when you list them, they are numbered in the order they are released, and that's the order you should apply them in. This is important, because the same Œle may be patched more than once.

Every patch comes with detailed instructions on how you should apply it, so the Œrst step is reading them:

Note that the author is using patches for OpenBSD 3.1 in this example, because there were no patches for Open-