AZiT

Interfaces and VLANs

SSH locked down, one file per network, then online and patched.

Why Networks, on the tour

On this page 4 sections

On OpenBSD, each interface is configured by a file called /etc/hostname.<interface>. From here on, files are copied from your laptop with scp to /tmp on the firewall, then installed.

1. SSH with your key#

If you have no SSH key yet, make one with ssh-keygen -t ed25519. Then copy it to the firewall:

laptop
ssh-copy-id @ADMIN_USER@@192.168.1.1

Check

laptop
ssh @ADMIN_USER@@192.168.1.1 'echo key works'

key works, without the firewall asking for a password.

Give the firewall a short name on your laptop, so the guides can say ssh fw and scp file fw:/tmp/:

laptop
cat >> ~/.ssh/config <<'EOF'
Host fw
  HostName 192.168.1.1
  User @ADMIN_USER@
EOF

Check

laptop
ssh fw 'echo alias works'

alias works.

2. Lock SSH down#

SSH listens only on the admin networks, accepts only your user, and only with a key. The Wi-Fi address in the file does not exist until step 3; sshd only logs a warning about it.

/etc/ssh/sshd_configDownload
# /etc/ssh/sshd_config - fw.internal
ListenAddress 192.168.1.1
ListenAddress 192.168.10.1
PermitRootLogin no
AllowUsers @ADMIN_USER@
AuthenticationMethods publickey
PasswordAuthentication no
KbdInteractiveAuthentication no
MaxAuthTries 3
LoginGraceTime 30
ClientAliveInterval 300
ClientAliveCountMax 2
X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding no
Subsystem sftp /usr/libexec/sftp-server
  • Keep one SSH session open while you restart sshd. If the new configuration locks you out, you can fix it from there.
laptop
scp sshd_config fw:/tmp/
firewall
doas install -o root -g wheel -m 0644 /tmp/sshd_config /etc/ssh/sshd_config
doas sshd -t && doas rcctl restart sshd

Check

laptop
ssh -o PasswordAuthentication=yes -o PubkeyAuthentication=no @ADMIN_USER@@192.168.1.1
ssh fw 'echo still in'

Permission denied (publickey) for the first: passwords are refused. still in for the second.

3. One file per network#

The WAN takes an address from your provider by DHCP. In chapter 6 it moves into a routing domain of its own.

/etc/hostname.igc0Download
description "WAN"
inet autoconf
/etc/hostname.igc1Download
description "ADMIN"
inet 192.168.1.1 255.255.255.0
/etc/hostname.igc2Download
description "APMGMT"
inet 192.168.2.1 255.255.255.0
/etc/hostname.igc3Download
description "PS5"
inet 192.168.3.1 255.255.255.0
/etc/hostname.igc4Download
description "MEDIA"
inet 192.168.4.1 255.255.255.0
/etc/hostname.igc5Download
description "SERVERS"
inet 192.168.5.1 255.255.255.0

The access point's cable carries four networks: its own management network untagged, and three Wi-Fi networks as tagged VLANs on the same port.

/etc/hostname.vlan10Download
description "TRUSTED"
vnetid 10 parent igc2
inet 192.168.10.1 255.255.255.0
/etc/hostname.vlan20Download
description "IOT"
vnetid 20 parent igc2
inet 192.168.20.1 255.255.255.0
/etc/hostname.vlan30Download
description "GUEST"
vnetid 30 parent igc2
inet 192.168.30.1 255.255.255.0
laptop, in the folder with the files
scp hostname.* fw:/tmp/
firewall
doas install -o root -g wheel -m 0640 /tmp/hostname.* /etc/
doas sh /etc/netstart

The SSH session may freeze for a second while igc1 is set up again. If it drops, connect again.

Check

firewall
ifconfig igc1 | grep inet
ifconfig vlan10 | grep -E 'vnetid|inet'
ifconfig igc0 | grep -E 'description|status'

inet 192.168.1.1 netmask 0xffffff00; for the VLAN vnetid 10 parent igc2 with inet 192.168.10.1; and igc0 with its description and status: no carrier.

4. Online, and patched#

SSH now listens only on the admin networks, so the WAN can go in. Connect igc0 to your internet connection; it picks up an address within a few seconds. Until chapter 4 the firewall uses your provider's DNS servers.

Check

firewall
ifconfig igc0 | grep inet
route -n show -inet | grep default
ping -c 2 cdn.openbsd.org

An address on igc0, a default route, and replies.

Install the security patches and any firmware the hardware needs:

firewall
doas syspatch
doas fw_update

Check

firewall
doas syspatch -c

No output: no patches left to install. If syspatch updated the kernel, reboot (doas reboot) and run it once more.