Taglio 23062021

TODO.md

@@ -0,0 +1,15 @@
+- arp sentinel
+
+- ``` shell
+  if [[ $# -eq 0 ]]; then
+  	print $0 "have to be used with the following options \
+  			\n \
+  			\ninstall  -> fresh install OpenBSD VPS \
+  			\nupgrade  -> upgrade OpenBSD VPS \
+  			\nreset    -> reset OpenBSD VPS \
+  			\n"
+
+  	exit 1
+  fi
+  ```
+

clean_last

@@ -0,0 +1,58 @@
+#!/bin/ksh
+
+set -o errexit
+set -o nounset
+
+PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin:/root/Bin
+BACKUPS="/root/Backups"
+
+uid=$(id -u)
+datarelease=$(date +"%d%m%Y%H%m%S")
+
+
+
+
+function backup {
+	CURRENTBACKUP="$BACKUPS/$datarelease"
+	mkdir -p "$CURRENTBACKUP/$1/"
+	case $1 in
+		"etc")
+			tar -cvf "$CURRENTBACKUP/$1/etc.tar" /etc
+		;;
+	esac
+}
+
+
+if [[ $uid -ne 0 ]]; then
+	print $0 "you've got to run $0 as UID=0 \n"
+	exit 1
+fi
+nohup backup "etc" & > /tmp/nohup
+last=$(basename $(cat /etc/iked.conf | grep "iked.conf." | tail -n 1 | awk '{print $2}' | sed 's/"//g' | sed 's/iked.conf.//'))
+publichostname=$(echo $last | cut -d . -f1)
+domainname=$(echo $last | sed "s/$publichostname.//")
+
+for a in $(dig ipsec20591.$domainname TXT +short @8.8.8.8 | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+	b=$(echo $a | cut -d : -f1)
+	if [[ "$b" -eq "$publichostname" ]]; then
+		srcid=$(echo $a | cut -d : -f2)
+	fi
+done
+
+filename=$(find /etc -name "*$last" -maxdepth 1 -type f)
+sed -i "/$last/d" /etc/iked.conf
+/bin/rm -r "$filename"
+rcctl restart iked
+for file in $(grep "$last" /etc/* | grep hostname | cut -d : -f1); do
+	interface=$(echo $file | cut -d . -f2)
+	if [[ $interface == gre? ]]; then
+		ospfinterface=$interface
+	fi
+	ifconfig $interface destroy
+	/bin/rm -r $file
+done
+pubkey="$srcid@ca.$domainname"
+sed -i "/interface $ospfinterface/,/}/d" /etc/ospfd.conf
+/bin/rm -r "/etc/iked/pubkeys/ufqdn/${pubkey}"
+nohup rcctl restart ospfd & > /tmp/nohup
+exit

console

@@ -0,0 +1,193 @@
+#!/usr/bin/bash
+
+#GLOBAL VAR
+
+uid=$(id -u)
+userna=$(id -nu $uid)
+userhome="/home/taglio"
+proghome="$userhome/Sources/Git/OpenBSD"
+
+if [[ $uid -ne 1000 ]]; then
+	echo -e $0 "you've got to run $0 as UID=1000 \n"
+	exit 1
+fi
+
+if [[ $# -eq 0 ]]; then
+	echo -e $0 "have to be used with the following options \
+			\n-I  -> local domain name [x]\
+			\n-N  -> newhost [o]\
+			\n-G  -> git pull [o]\
+			\n-S  -> scripts [o] \
+			\n-D  -> dyndnspop [o] \
+			\n-F  -> single file update [o] \
+			\n-C  -> cleanlast [o] \
+			\n-RS -> repository ssh update [o] \
+			\n-K  -> new IKED pk12 archive [o] \
+			\n-T  -> tmux and SSH to all openbsd MESH hosts [o] \
+			\n-M  -> Mikrotik RouterOS add new OpenBSD [o] \
+			\n-E  -> Ubiquiti EdgeOS add new OpenBSD [o] \
+			\n"
+
+	exit 1
+fi
+
+localdomainname=$2
+
+
+case $3 in
+	"-G")
+		for vpnc_host in $(dig openbsd.$localdomainname TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			echo -e "Connecting to $vpnc_host"
+			ssh $vpnc_host.$localdomainname git -C "$proghome" pull
+		done	
+	;;
+	"-N")
+		for vpnc_host in $(dig openbsd.$localdomainname TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			echo -e "Connecting to $vpnc_host"
+			ssh -t $vpnc_host.$localdomainname doas sh "/home/taglio/Sources/Git/OpenBSD/setup_node" -U newhost
+		done	
+	;;
+	"-S")
+		for vpnc_host in $(dig openbsd.$localdomainname TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			echo -e "Connecting to $vpnc_host"
+			ssh -t $vpnc_host.$localdomainname doas sh "/home/taglio/Sources/Git/OpenBSD/setup_node" -U scripts
+		done	
+	;;
+	"-D")
+		for vpnc_host in $(dig openbsd.$localdomainname TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			echo -e "Connecting to $vpnc_host"
+			ssh -t $vpnc_host.$localdomainname doas sh "/home/taglio/Sources/Git/OpenBSD/setup_node" -U dyndnspop
+			sleep 10
+		done	
+	;;
+	"-F")
+		for vpnc_host in $(dig openbsd.$localdomainname TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			echo -e "Connecting to $vpnc_host"
+			ssh -t $vpnc_host.$localdomainname doas sh "/home/taglio/Sources/Git/OpenBSD/setup_node" -U file
+			sleep 10
+		done	
+	;;
+	"-C")
+		for vpnc_host in $(dig openbsd.$localdomainname TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			echo -e "Connecting to $vpnc_host"
+			ssh -t $vpnc_host.$localdomainname doas sh "/home/taglio/Sources/Git/OpenBSD/setup_node" -A cleanlast
+		done	
+	;;
+	"-RS")
+		lanhost=
+		while [ -z $lanhost ]
+		do
+			echo 'Type the LAN hostname '
+			read lanhost
+		done
+		pubhost=
+		while [ -z $pubhost ]
+		do
+			echo 'Type the public hostname '
+			read pubhost
+		done
+		hash=
+		while [ -z $hash ]
+		do
+			echo 'Type the ED25519 hash '
+			read hash
+		done 	
+		if [[ $(grep -c $lanhost src/etc/ssh/remote_install/authorized_keys) -gt 0 ]]; then
+			for linenum in $(grep -n $lanhost src/etc/ssh/remote_install/authorized_keys | cut -d : -f1); do
+				sed -i "$linenum"d src/etc/ssh/remote_install/authorized_keys
+			done
+		fi
+
+		echo "ssh-ed25519 $hash root@$lanhost" >> src/etc/ssh/remote_install/authorized_keys
+		#	if [[ $(grep -c $pubhost src/etc/ssh/ssh_known_hosts) -gt 0 ]]; then
+		#		for linenum in $(grep -n $pubhost src/etc/ssh/ssh_known_hosts | cut -d : -f1); do
+		#			sed -i "$linenum"d src/etc/ssh/ssh_known_hosts	
+		#		done
+		#	fi
+		#	
+		#	echo "# $pubhost:31137 SSH-2.0-OpenSSH_8.6" >> src/etc/ssh/ssh_known_hosts
+		#	echo "[$pubhost]:31137 ssh-ed25519 $hash" >> src/etc/ssh/ssh_known_hosts
+		echo -e "remote_install/authorized_keys and ssh_known_hosts UPDATED
+		\n please use git_openbsd.sh to update the public GIT"
+	;;
+	"-K")
+		ikedpub=
+		while [ -z $ikedpub ]
+		do
+			echo 'Type the PATH to the new iked PK12 file '
+			read ikedpub
+		done
+		tmpdir=$(mktemp -d)
+		pk12=$(basename $ikedpub)
+		publichost=$(echo $pk12 | sed 's/.p12//')
+		publichostname=$(echo $publichost | cut -d . -f1)
+		domainname=$(echo $publichost | sed "s/$publichostname.//")
+
+
+		for a in $(dig ipsec20591.$domainname TXT +short @8.8.8.8 | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			b=$(echo $a | cut -d : -f1)
+			if [[ "$b" -eq "$publichostname" ]]; then
+				srcid=$(echo $a | cut -d : -f2)
+			fi
+		done
+		ssh-keygen -f "/home/riccardo/.ssh/known_hosts" -R "$publichost"
+		scp $ikedpub "taglio@$publichost:/tmp"
+		openssl pkcs12 -nodes -in $ikedpub -nocerts -passin pass:123456789 -passout pass:123456789 -out "$tmpdir/local.key"
+		openssl pkcs12 -nodes -in $ikedpub -clcerts -nokeys -passin pass:123456789 -passout pass:123456789 -out "$tmpdir/new.crt"
+		openssl x509 -pubkey -noout -passin pass:123456789 -in "$tmpdir/new.crt"  > src/etc/iked/pubkeys/ufqdn/"$srcid@ca.$domainname"
+		rm -rf $tmpdir
+		echo -e "$srcid@ca.$domainname created please update repository and all the others Openbsd hosts"		
+	;;
+	"-T")
+		echo -e "Launching TMUX"
+		tmux new-session -d -s "LOBBY"
+		for vpnc_host in $(dig openbsd.$localdomainname TXT +short | sed "s/\"//g" | tr \; '\n' | sed '$d'); do
+			echo -e "Creating $vpnc_host TMUX windows"
+			tmux rename-window "$vpnc_host"
+			tmux send -t "LOBBY:$vpnc_host" ssh SPACE "$vpnc_host.$localdomainname" ENTER
+			tmux new-window 
+		done
+		tmux rename-window "CA"
+		tmux send -t "LOBBY:CA" ssh SPACE "ca.$localdomainname" ENTER
+		tmux new-window 
+		tmux rename-window $(hostname -s)
+		tmux -2 attach-session -t "LOBBY"
+	;;
+	"-M")
+		mkhost=
+		while [ -z $mkhost ]
+		do
+			echo 'Type the Mikrotik internal hostname '
+			read mkhost
+		done
+		openbsd=
+		while [ -z $openbsd ]
+		do
+			echo 'Type the new OpenBSD internal hostname '
+			read openbsd
+		done
+		mkaddr=$(ssh admin@$mkhost /ip addr pr where dynamic | awk '{print $3}' | grep -oE "\b([0-9]{1,3}\.){3}[0-9]{1,3}\b")
+		mkpublichost=$(dig -x $mkaddr +short @8.8.8.8 | sed 's/.$//')
+		wget "http://$openbsd.$2/$mkpublichost/$mkpublichost.rsc" -O "/tmp/$mkpublichost.rsc"
+		scp "/tmp/$mkpublichost.rsc" "admin@$mkhost:/$mkpublichost.rsc"
+		ssh admin@$mkhost /import file-name=$mkpublichost.rsc
+		echo -e "Host $openbsd.$2 configured into Mikrotik $mkhost.$2"
+		ssh admin@$mkhost /sys package update check-for-updates
+	;;
+	"-E")
+		edgehost=
+		while [ -z $edgehost ]
+		do
+			echo 'Type the EdgeOS internal hostname '
+			read edgehost
+		done
+		openbsd=
+		while [ -z $openbsd ]
+		do
+			echo 'Type the new OpenBSD internal hostname '
+			read openbsd
+		done
+	;;
+	*)
+	;;
+esac

data/GRE-TABLE.sql

@@ -0,0 +1,33 @@
+CREATE TABLE [GRE] (  
+	[HOST-SRCID] NVARCHAR(30) ,  
+	[PTP] NVARCHAR(5) PRIMARY KEY,  
+	[PTP-NETWORK] NVARCHAR(16),
+	[PTP-LATENCY] INTEGER,
+	[INTERFACE] NVARCHAR(13),
+	[COST] INTEGER,
+	[HOPCOST] INTEGER
+);  
+
+INSERT INTO GRE (HOST-SRCID, PTP, PTP-NETWORK, PTP-LATENCY, INTERFACE, COST, HOPCOST)
+VALUES
+	("indra@ca.telecomlobby.com", "ES-FR", "10.10.10.252/30", 24, "tun0", 12, 0),
+	("indra@ca.telecomlobby.com", "ES-UK", "10.10.10.228/30", 35, "tun3", 17, 0),
+	("indra@ca.telecomlobby.com", "ES-US", "10.10.10.236/30", 139, "tun1", 70, 0),
+	("indra@ca.telecomlobby.com", "ES-JP", "10.10.10.232/30", 267, "tun2", 133, 0),
+	("uma@ca.telecomlobby.com", "FR-ES", "10.10.10.252/30", 24, "gre-tunnel1", 12, 0),
+	("uma@ca.telecomlobby.com", "FR-UK", "10.10.10.248/30", 6, "gre-tunnel2", 3, 13),
+	("uma@ca.telecomlobby.com", "FR-US", "10.10.10.244/30", 109, "gre-tunnel4", 55, 65),
+	("uma@ca.telecomlobby.com", "FR-JP", "10.10.10.240/30", 231, "gre-tunnel3", 115, 125),
+	("ganesha@ca.telecomlobby.com", "UK-ES", "10.10.10.228/30", 35, "gre1", 17, 0),
+	("ganesha@ca.telecomlobby.com", "UK-FR", "10.10.10.248/30", 6, "gre0", 3, 13),
+	("ganesha@ca.telecomlobby.com", "UK-US", "10.10.10.225/30", 105, "gre2", 52, 62),
+	("ganesha@ca.telecomlobby.com", "UK-JP", "10.10.10.114/30", 244, "gre3", 122, 132),
+	("shiva@ca.telecomlobby.com", "JP-ES", "10.10.10.232/30", 267, "gre12", 133, 0),
+	("shiva@ca.telecomlobby.com", "JP-FR", "10.10.10.240/30", 231, "gre0", 115, 125),
+	("shiva@ca.telecomlobby.com", "JP-US", "10.10.10.118/30", 151, "gre2", 75, 0),
+	("shiva@ca.telecomlobby.com", "JP-UK", "10.10.10.114/30", 244, "gre3", 122, 132),
+	("saraswati@ca.telecomlobby.com", "US-ES", "10.10.10.236/30", 139, "gre1", 70, 0),
+	("saraswati@ca.telecomlobby.com", "US-FR", "10.10.10.244/30", 109, "gre0", 55, 65),
+	("saraswati@ca.telecomlobby.com", "US-UK", "10.10.10.225/30", 105, "gre2", 52, 62),
+	("saraswati@ca.telecomlobby.com", "US-JP", "10.10.10.118/30", 151, "gre3", 75, 0);
+

installation/autodisklabel

@@ -0,0 +1,2 @@
+/               250M-95%
+swap            250M-5%

installation/install-vps.conf

@@ -8,24 +8,26 @@ IPv6 address for vio0 = autoconf
 Which network interface do you wish to configure = done
 Default IPv4 route = 
 DNS domain name = telecom.lobby
-Password for root = 123456789
+Password for root = $2b$10$4tPKeRmxVyffVkrQMve70.CiPmE28khH9UXiuSYpzAKbZrOfQq0Pm
 #Public ssh key for root account = ssh key stored in /root/.ssh/authorized_keys
 Start sshd(8) by default = yes
 Do you expect to run the X Window System = no
 Setup a user = taglio
 Full name for user = Riccardo Giuntoli
-Password for user = 123456789
-#Public ssh key for user = ssh key stored in ~/.ssh/authorized_keys
+Password for user = *********
+Public ssh key for user = ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKG4yMhKX37SXV8LGDuVe4r1PBSS5HOWb6jFpNiG3cvW taglio@telecom.lobby
 Allow root ssh login = no
-What timezone are you in = Europe/Sofia
+What timezone are you in = UTC
 Which disk is the root disk = sd0
 # see disklabel.min, disklabel, or disklabel.lax
-URL to autopartitioning template for disklabel = https://raw.githubusercontent.com/redeltaglio/OpenBSD/master/installation/disklabel-vps
+# URL to autopartitioning template for disklabel = https://raw.githubusercontent.com/redeltaglio/OpenBSD/master/installation/autodisklabel
 Unable to connect using https. Use http instead = yes
 Location of sets = http
 HTTP proxy URL = none
 HTTP Server = cdn.openbsd.org
-Server directory = pub/OpenBSD/6.8/amd64
-Set name(s) = -x*
+Server directory = pub/OpenBSD/6.9/amd64
+#Set name(s) = -x*
 # or minimum sets (disklabel.min)
-#Set name(s) = -comp* -game* -x*
+Set name(s) = -comp* -x*
+Continue without verification = yes
+