Gleefully Malicious Books
Get PuTTY 0.61 at http://www.chiark.greenend.org.uk/~sgtatham/putty/download.html. Or you can get the PuTTY suite installer here.
The new PuTTY release has turned off SSHv1. My previous rant on the subject is now obsolete. I am well pleased. (Of course, had I waited a month to write that rant, I wouldn’t have needed to.)
Lots of bug fixes. Lots faster. New features. Get it now.
I’m at a publishing workshop, learning how to write pitches, blurbs, and promotions. That drove home that my SSH book title might not be the best choice.
I’ve been planning to use the title “OpenSSH: Your Next Steps.” The book will take you to SSH competence, making sure that you use basic security precautions, master using keys for authentication, SSH tunneling, and so on. That title’s fine. As far as it goes.
But I think I can do better. I’m pondering calling it “SSH with OpenSSH and PuTTY” instead. The first title, I’d have to rely on keyword search to bring up SSH. This title brings all the key words into plain sight.
I learned with PGP and GPG that a title is important. If I had called that book “Email Encryption for Everyone,” I would have sold a lot more copies.
So, what do you lot think?
You can find me on Google Plus. The short link is http://gplus.to/mwlucas.
No real content there yet. No idea what if anything I will do with it. But I’ve put a blanket down on my little patch of park, at least.
Today, I learned that FreeNAS 8.0’s SNMP isn’t quite all one could hope for. The good news is, the bugs will be fixed in 8.0.1. I’m posting this in the hope of saving others the annoyances I had.
To SNMP query a FreeNAS 8.0 host, you must force the client to use SNMPv2.
# snmpwalk -c public -v 2c freenashost
Additionally, you can’t change the community name (at least on the amd64 version). You must use public.
This is fixed in 8.0.1. Still, it makes me glad I hacked a firewall into my FreeNAS box.
I now have all the reviewers I can manage, and am not looking for more. I’d make an exception if you’re, say, an OpenSSH or PuTTY developer, but other than I’m not accepting any more. I’d like to thank everyone who has volunteered to review this book.
I won’t put any system on the Internet without some sort of packet filter or firewall. Especially not a file server containing important data. While I have a FreeNAS 8 box, it doesn’t come with a firewall. FreeBSD includes three firewalls, IPFW, IPF, and PF. Any one of these would do, but I’m most comfortable with PF, so I decided to add PF to my FreeNAS install.
This will not add a firewall to the GUI. You must manage your rules remotely. The FreeNAS backup will not back up your rules. The good news is, once your firewall works the rules don’t change very frequently.
First, get the appropriate kernel module. You’ll need the ISO for the version of FreeBSD that your FreeNAS is based on. FreeNAS 8.0 is based on FreeBSD 8.2. I’m running the amd64 version of FreeNAS, so I need the amd64 version of FreeBSD 8.2. The version must match as exactly as possible: your 8-stable amd64 desktop might work, but it might make your FreeNAS box crash and die.
Mount the ISO.
$ mdconfig -a -t vnode -f $HOME/FreeBSD-8.2-RELEASE-amd64-livefs.iso
md0
$ mount -t cd9660 /dev/md0 /mnt
I previously installed FreeNAS on a 2GB USB stick. For this process, I shut down my FreeNAS box and mounted the USB drive on my FreeBSD machine. You could work directly on the FreeNAS image and re-install it on the USB drive, or even work directly on the live FreeNAS box. I’m assuming you’re working on a USB stick.
$ mount /dev/da0s1 /mnt
Start by getting the PF kernel module from the ISO onto your USB drive.
$ cp /media/boot/kernel/pf.ko /mnt/boot/kernel/
Now for the tricky bit. FreeNAS is based on the FreeBSD diskless system. (Obligatory plug: I did half a chapter on diskless operation in Absolute FreeBSD.) It uses the /conf directory to create a series of memory-based filesystem overlays, creating a MFS /tmp, /etc, and so on. This means that any changes you make to, say, /etc/pf.conf will not survive a reboot. You must edit the original versions of these files, in /conf/base/etc.
In /conf/base/etc/rc.conf, add
pf_enable=YES
Put your pf.conf in the same directory. Configuring PF is left as an exercise for the reader.
Any firewall changes made to a running system must appear in /etc/pf.conf and in /conf/base/etc/pf.conf. I suggest changing the base file, and copying changes to /etc.
The boss snagged an Intel SS4200 NAS as part of the corporate “redundant array of inexpensive crap” strategy. Basically, it’s a small, headless amd64 machine with 512MB RAM, four SATA ports, plus eSATA and USB. Add four 1TB hard drives, and you have a decent small storage device. I decided to try FreeNAS 8, so I could get ZFS, NFS, and iSCSI.
FreeNAS 8 installs on a USB drive. I got a 2GB USB from Micro Center checkout counter, and escaped the store without purchasing anything else.
Start by getting the FreeNAS full install, aka FreeNAS-8.0-RELEASE-i386.Full_Install.xz. Verify the checksum, then decompress the image.
$ unxz FreeNAS-8.0-RELEASE-i386.Full_Install.xz
Use file(1) to check it.
$ file FreeNAS-8.0-RELEASE-i386.Full_Install
FreeNAS-8.0-RELEASE-i386.Full_Install: x86 boot sector; partition 1: ID=0xa5, active, starthead 1, startsector 63, 953505 sectors; partition 2: ID=0xa5, starthead 1, startsector 953631, 953505 sectors; partition 3: ID=0xa5, starthead 0, startsector 1907136, 3024 sectors; partition 4: ID=0xa5, starthead 0, startsector 1910160, 41328 sectors, code offset 0x31
My USB drive is available as /dev/da0. Copy the image to the drive.
$ dd if=FreeNAS-8.0-RELEASE-i386.Full_Install of=/dev/da0 bs=5k
While that’s running, console into the SS4200. The serial console connector seems to be a standard DB9 connector, so you can just pull one off of an old motherboard. If your null-modem cable doesn’t seem to work, try reversing the connector on the motherboard. I connected with 115200 8n1, no flow control.
Go into the BIOS. Select Advanced, then go down to USB. Set your USB emulation type to “hard disk.” Then go into the boot order and have it boot from hard drives. Go to the Hard Disk Drives menu beneath that and make your USB device first on the list.
If you don’t have the console connection, boot the SS4200 from USB by holding down the reset button (tiny black dot by the rear USB port) for about 2 seconds while powering on. The light will turn amber to show that it’s booting from USB. This will work for home use, although you’ll need to do this every time you reboot the NAS. You’re really better off setting the BIOS properly.
Once dd finishes, plug the USB drive into the SS4200 and power up. The default FreeNAS IP is 192.168.1.250, but if you have a DHCP server it will grab a proper local IP. Check your DHCP server logs for a host called “freeNAS,” and point your browser at that address.
Once I was in, I easily added data storage, creating two 931-GB ZFS mirrors.
I successfully created group for my new account. I couldn’t create a user, but it’s a known problem with workarounds.
Lastly I enabled the serial console by going to System->Settings. Oddly, there’s no setting to set the console speed. You can change the SS4200 serial port to 9600 in the BIOS, but that seems less than optimal. It’s a petty issue, however, as I can reconfigure my serial connection trivially.
I found a FreeNAS 7/SS4200 tutorial buried inside the FreeNAS forums. While all the FreeNAS stuff has changed, it was quite helpful for setting up the SS4200 hardware and BIOS.
Overall, FreeNAS 8 looks pretty. The real test will start when I put a bunch of diskless NFS and iSCSI clients on it and watch for stuff to break. It must have better iSCSI than the Iomega NAS’s I’ve been arguing with…
UPDATE: I have all the reviewers I can handle.
I have about half of the OpenSSH book written. I can start getting feedback on the manuscript. If you’re interested in providing feedback, first read the review process article on my web site.
If you’re still interested after reading that article, send me an email with the subject “OpenSSH review” and tell me that a) you won’t share the review manuscript, and b) why you’d be a good reviewer. I can only manage so many reviewers, so I try to pick readers of every experience level. My email address is m w lucas at black helicopters dot org.
And before you ask: four chapters of the OpenBSD book are finished. Not enough to solicit reviewers. It is proceeding apace, though. I usually work on multiple projects simultaneously, so this is not unusual.
I’ve received quite a few questions about how I do community-based tech reviews on forthcoming books, as well as offers for one or both of the projects I have underway. I’ve put up a public Web page about the process I follow. I expect to request community reviewers for one book later this week.
Realistically, my brain is limited. I can only manage about 20 prepub reviewers for a given project. I choose the best people from the pool of volunteers.
I hope that all of them will return useful comments. I expect that about 10 of them will return nothing. Another 5 will drop out halfway through.
So, if you volunteer and I don’t pick you, you can feel superior in knowing that you would have been one of the 25% to stay all the way through, except that I wasn’t smart enough to know that beforehand.
I have an OpenBSD 4.9/i386 desktop sitting naked on the Internet, and found people poking at my TCP ports. While PF is enabled by default, it’s configured to permit everything except remote X11. I need a policy that will block incoming traffic from everywhere except a few key IP addresses, while allowing me to make any outbound connections I desire.
mgmt="{192.0.2.0/24, 192.168.8.0/24}"
set skip on lo
block
pass proto icmp
pass from $mgmt to self
pass from self to any
block in on ! lo0 proto tcp to port 6000:6010
Disabling ICMP globally is a bad idea. Lots of stuff will break. I could specify permitted ICMP types, but that would be a lot of work and probably break my connectivity to random in a really obscure but educational manner.
I retained the X11 block, even for those known-good addresses, because if I’m trying to open an X11 connection to my home desktop without forwarding it over SSH, I am clearly solving the wrong problem.
If I permit password-based SSH connections from “known good” hosts, such as my house and the office, then if one of those machines is penetrated, the intruder will be able to get into my machine. I protect my desktop by requiring SSH public key auth, even from trusted IP addresses. An intruder could be savvy enough to hijack my agent forwarding, but in that case it’s someone specifically targeting me.
The current PF syntax is as close to painless as a firewall can be.