Upgrade BastilleBSD jails from source (offline/src.txz)
Posted on February 15, 2021
| 1 minutes
| 200 words
| hackacad
Upgrade BastilleBSD jails from source Using bastille upgrade 12.1-RELEASE 12.2-RELEASE is the prefered way of upgrading. If you need to do that air-gapped or with a special release (like -HEAD) you can use this tutorial.
before you start: make sure your host system is not behind the jails release svnlite checkout https://svn.freebsd.org/base/head /usr/src If you want to fetch a special branch you can svnlite checkout one of the following branches: ‘release/12.
[Read More]
Create an Ubuntu Linux jail on FreeBSD 12.2
Posted on January 21, 2021
| 2 minutes
| 315 words
| hackacad
Create a jailed Ubuntu Linux with Bastille on FreeBSD 12.2 Make sure Bastille is installed an configured. If not click here
This is not offically supported, so don’t use it in production! update 2021/02/11: Auto Installer You could try the following POC for automated jail creation:
DO NOT USE THIS IN PRODUCTION!
THIS MIGHT BREAK YOUR RUNNING INSTALLATION
git clone -b linux_compat https://github.com/hackacad/bastille cd bastille && make install bastille bootstrap bionic bastille create -L linuxjail bionic (ipaddress) (interface) bastille console linuxjail Manual installation This how-to is based on
[Read More]
Easy and lightweight jails with BastilleBSD
Posted on January 18, 2021
| 2 minutes
| 231 words
| hackacad
HowTo create jails with Bastille 0.8 TDLR of https://github.com/BastilleBSD/bastille/ (updated for Bastille 0.8.20210115) install bastille Bastille is very active so make sure you switch to latest pkg mirror
vim /etc/pkg/FreeBSD.conf FreeBSD: { url: "pkg+http://pkg.FreeBSD.org/${ABI}/latest", mirror_type: "srv", signature_type: "fingerprints", fingerprints: "/usr/share/keys/pkg", enabled: yes } enable bastille
sysrc bastille_enable=YES create virtual network bridge
sysrc cloned_interfaces+=lo1 sysrc ifconfig_lo1_name="bastille0" service netif cloneup edit /etc/pf.conf (add the lines without #)
ext_if="em0" set block-policy return scrub in on $ext_if all fragment reassemble set skip on lo table <jails> persist nat on $ext_if from <jails> to any -> ($ext_if:1) ## Enable dynamic rdr (see below) bastille 0.
[Read More]
How to create a FreeBSD pkg mirror using bastille and poudriere
Posted on January 15, 2021
| 3 minutes
| 532 words
| hackacad
This a short how-to for creating a FreeBSD pkg mirror using BastilleBSD and Poudriere.
on the jail host: Bastille is very active so make sure you switch to latest pkg mirror
change pkg mirror to “latest”
vim /etc/pkg/FreeBSD.conf FreeBSD: { url: "pkg+http://pkg.FreeBSD.org/${ABI}/latest", mirror_type: "srv", signature_type: "fingerprints", fingerprints: "/usr/share/keys/pkg", enabled: yes } enable bastille
sysrc bastille_enable=YES create virtual network bridge
sysrc cloned_interfaces+=lo1 sysrc ifconfig_lo1_name="bastille0" service netif cloneup Create the following pf.
[Read More]
Add password authentication to Elasticsearch 7.10 on FreeBSD 12.2
Posted on January 8, 2021
| 2 minutes
| 218 words
| hackacad
If you want/need to add password authentication to your FreeBSD Elasticsearch cluster (this should work on any FreeBSD with elasticsearch7)
TLDR; (again)
Add the following lines to your /usr/local/etc/elasticsearch/elasticsearch.yml:
xpack.security.enabled: true xpack.security.transport.ssl.enabled: true and restart elasticsearch.
service elasticsearch restart Make sure curl is installed:
pkg install curl Link the installed Java into the bundled directory (this is neither recommended nor supported but it does the trick)
mkdir -p /usr/local/lib/elasticsearch/jdk/bin ln -s /usr/local/bin/java /usr/local/lib/elasticsearch/jdk/bin/java And run the password setup utility (this might take up to 2 minutes)
[Read More]
How to secure your Saltstack Salt Master using spiped
Posted on May 6, 2020
| 2 minutes
| 363 words
| hackacad
This is a short how-to for securing Saltstack communication via spiped.
(most of it is based on the how-to I wrote on securing Elasticsearch with spiped)
At first: install spiped FreeBSD pkg install spiped Debian/Ubuntu apt install spiped CentOS (fo those who haven’t migrated yet) vim /etc/yum.repos.d/spiped.repo [lsde-spiped] name=spiped repo baseurl=https://copr-be.cloud.fedoraproject.org/results/lsde/spiped/epel-7-$basearch/ type=rpm-md skip_if_unavailable=True gpgcheck=1 gpgkey=https://copr-be.cloud.fedoraproject.org/results/lsde/spiped/pubkey.gpg repo_gpgcheck=0 enabled=1 enabled_metadata=1 install spiped
yum clean all yum install spiped generate symmetric encryption key dd if=/dev/urandom of=/root/saltpipe.
[Read More]
Using FIDO2 Auth Keys (Yubikey, Solokeys) with MacOS and FreeBSD
Posted on March 27, 2020
| 2 minutes
| 272 words
| hackacad
OpenSSH 8.2p1 with FIDO2 support was recently added to MacOS (via Homebrew) and FreeBSD (via ports/pkg). Here’s a short how-to securely login to your FreeBSD servers via FIDO2 (Yubikey, Solokey et. al.).
On your MacOS client: Open your terminal and install libfido2 and openssh (8.2p1)
brew install openssh libfido2 Generate you ecdsa key with libfido2.
Insert your FIDO2 usb stick and run (push the auth button on your key when prompted):
[Read More]
How-to migrate your FreeBSD jails from iocage to bastille
Posted on March 26, 2020
| 1 minutes
| 89 words
| hackacad
Stop the running jail and export it:
iocage stop jailname iocage export jailname Move the backup files (.zip and .sha256) into Bastille backup dir (default: /usr/local/bastille/backups/):
mv /iocage/images/jailname_2020-03-26.* /usr/local/bastille/backups/ for remote systems you could use rsync: rsync -avh /iocage/images/jailname_2020-03-26.*
[email protected]:/usr/local/bastille/backups/ Import the iocage backup file (use zip file name) bastille import jailname_2020-03-26.zip ```</pr```e> Set your new ip address and interface: vim /usr/local/bastille/jails/jailname/jail.conf interface = bastille0; ip4.addr = "192.168.0.1"; You can use you primary network interface instead of the virtual bastille0 interface as well if you know what you’re doing.
[Read More]
Easy and lightweight jails with BastilleBSD
Posted on January 31, 2020
| 1 minutes
| 166 words
| hackacad
Go to 2021 version HowTo create jails with Bastille TDLR of https://github.com/BastilleBSD/bastille/ install bastille Bastille is very active so make sure you switch to latest pkg mirror
vim /etc/pkg/FreeBSD.conf FreeBSD: { url: "pkg+http://pkg.FreeBSD.org/${ABI}/latest", mirror_type: "srv", signature_type: "fingerprints", fingerprints: "/usr/share/keys/pkg", enabled: yes } enable bastille
sysrc bastille_enable=YES create virtual network bridge
sysrc cloned_interfaces+=lo1 sysrc ifconfig_lo1_name="bastille0" service netif cloneup edit /etc/pf.conf (add the lines without #)
ext_if="em0" set block-policy return scrub in on $ext_if all fragment reassemble set skip on lo table <jails> persist nat on $ext_if from <jails> to any -> ($ext_if) block in all pass out quick modulate state antispoof for $ext_if inet pass in inet proto tcp from any to any port ssh flags S/SA keep state add ZFS support (check zpool with “zpool list”)
[Read More]
Install Redmine 3.4 on FreeBSD 11.2 with Apache, Passenger and MySQL
Posted on March 1, 2019
| 2 minutes
| 336 words
| hackacad
TLDR for Redmine on FreeBSD 11.2 install redmine and a bunch of dependencies
UPDATE 2019/03/11 redmine pkg is currently not available on quaterly mirror (make sure you use latest branch in /etc/pkg/FreeBSD.conf) pkg install redmine apache24 mysql56-server mysql56-client rubygem-passenger-apache vim /usr/local/etc/apache24/httpd.conf add the following lines to your httpd.conf or Inlcudes/redmine.conf
LoadModule passenger_module /usr/local/lib/ruby/gems/2.4/gems/passenger-6.0.0/buildout/apache2/mod_passenger.so
PassengerRoot /usr/local/lib/ruby/gems/2.4/gems/passenger-6.0.0
PassengerRuby /usr/local/bin/ruby24
to use ssl uncomment the following lines and set Listen port to 443
LoadModule ssl_module libexec/apache24/mod_ssl.
[Read More]