Building PFSense Firewall appliance

Depuis quelques temps maintenant, j'utilise les appliances virtuelles pfSense, FreeBSD based, avec un grand succés: stabilité et fonctionnalité.

Je me suis lancé dans la customisation des iso pour nos usages internes.
Pour ce faire, il faut recompiler l'appliance en Embedded mais avec les packages kivonbien: arping (indispensable), openBGPD, enlever la stack OLSR et autres choses inutiles pour nous (captive portal etc...) et préconfigurer la distribution.

Une partie de tout cela ne sera pas publiée, car la configuration interne de nos réseaux n'a rien à faire sur Internet.

Par contre, à partir des indications du site www.pfsense.org, je me suis construit un script de "building from scratch" des sources pour la distribution 2.0 qui marche pas mal (un peu brouillon, mais c'est un début).

1) il faut installer un FreeBSD 8.1-RELEASE (pas envie de faire ca dans une jail, VMWare is your friend)
2) il faut ajouter dans /etc/make.conf
WITHOUT_X11=yes
BATCH=yes
NO_PROFILE=no
NO_MANCOMPRESS=no

3) lancer "sh launch_build.sh"
====================================================================
#! /bin/sh

BASEDIR=/usr/home/pfsense

test_make_conf(){
        grep -q ^$1 /etc/make.conf
        if [ $? -ne 0 ]; then
                echo $1 >> /etc/make.conf
        fi
}

safe_mkdir(){
        if [ ! -d ${BASEDIR}/$1 ]; then
                mkdir -p ${BASEDIR}/$1
        fi
}

ports_install(){
        cd /usr/ports/$1
        make check-already-installed 2>&1 > /dev/null && make install distclean
}

test_make_conf WITHOUT_X11=yes
test_make_conf BATCH=yes
test_make_conf NO_PROFILE=no
test_make_conf NO_MANCOMPRESS=no

safe_mkdir pfSenseGITREPO
safe_mkdir installer
safe_mkdir freesbie2
if [ ! -d /usr/pfSensesrc ]; then
        mkdir -p /usr/pfSensesrc
fi

echo "Updateting ports"
/usr/sbin/portsnap fetch && /usr/sbin/portsnap update
echo "Update vulnerabilities DB"
if [ ! -f /usr/local/sbin/portaudit ]; then ports_install ports-mgmt/portaudit; fi
/usr/local/sbin/portaudit -Fq
ports_install textproc/expat2
ports_install devel/git
ports_install sysutils/fastest_cvsup
rehash

cd ${BASEDIR}

echo "GIT checkout"
if [ -d tools ]; then rm -rf tools; fi
git clone http://gitweb.pfsense.org/pfsense-tools/mainline.git tools
if [ -d freesbie2 ]; then rm -rf freesbie2; fi
cd ${BASEDIR}/tools/builder_scripts && chmod a+rx *.sh

echo "Getting FreeBSD sources"
csup -h `fastest_cvsup -c tld -q` /usr/share/examples/cvsup/standard-supfile

cd ${BASEDIR}/tools/builder_scripts
./menu.sh
============================================================================
4) Choisir la version RELENG_8_1
5) lancer le build d'une image ISO pour commencer.

... à suivre

THIS IS BSD

Why BSD is dying ?

See the answer (quite old, but still good)

M0n0wall

J'ai essayé M0n0wall l'autre jour. Pas mal un système qui tiens moins de 10Mo sur une CF.

Par contre, une première approche montre une dégradation des perfs sérieuses entre mon PC et Internet. Bon, c'est pas non plus optimal, j'ai mon PC <-> m0n0wall <-> freebox (en mode routeur).

La prise en main est plutôt simple, l'interface www est simple, jolie, efficace. Manque une aide tooltip ou lien vers aide en ligne (ou alors, je ne l'ai pas vu).

La configuration de la NAT n'est pas triviale, d'ailleurs, je ne suis pas sur qu'elle fonctionne ... Je ne sais pas trop non plus si ca marche avec de l'IPv6.

Bref, c'est plutot pas mal, je pense que ca marche en terme de sécurité, mais ca manque de doc et de "tools" pour avoir une vue plus précise de ce qui se passe.

Ceci dit, avec une image disque de 5Mo on ne peut pas demander la lune. Ca marche quand même du premier coup.

Je vais continuer mes essais quand j'aurais le temps.

Web Review : 15/05/2008

25 years to fix a bug ?

yes it is possible: http://www.osnews.com/story/19731

A (french ?) postfix manager: http://www.artica.fr/index.php

It looks good ! especially if you do not want to spend hours to configure manually postifx, fetchmail and so on.

I prefer my own configuration, but I admit that sometimes, 10 minutes setup is good ;-)

FreeBSD vs Linux

Good troll ...



then ...

FreeBSD tip

Because I spent more than 5 minutes wondering why portsnap does not work correctly, I prefer to write the tip for anyone.

If you want to launch 'portsnap fetch' through an authenticated proxy, do not use:

HTTP_PROXY=http://user:passwd@ip:port/

but use

HTTP_PROXY=http://ip:port/

and

HTTP_PROXY_AUTH=basic:*:user:passwd

in your environment.

Web Review : 28/02/2008

For those who knows VOMIT (Voice Over Misconfigured Internet Telephones), take a read at RTP Break. I have not enough time to test it by myself, but if it does all that is written, It should be ... hum .. .quite interesting ! => http://xenion.antifork.org/rtpbreak/


But (for me) the most important new today is "FreeBSD 7.0 RELEASED" !! http://www.freebsd.org/releases/7.0R/announce.html

Web Review : 13/02/2008

One of my friend sent me a good article on "Who Invented the Firewall ?"
For me, I consider that M.J. Ranum is the father of firewalling as we know it today.
I have worked for 7 years on *-gw proxies, then on *-pdk (for those who know). I rewrote smap/smapd, improved http-pdk and so on.
Until now, I am still working on a firewall software editor, and MJ Ranum concepts are still up to date. I do not say that other were not doing security, but who could say "packet filtering module is a firewall module" ?
Using authentication daemon of TIS you can add a usefull value to security: "who is doing what ?"
Today, firewalling, as I can see, is not as good as it could be.
The ultimate firewall solution should be a description not of host using ports, but users using services.
It is easier to tell: "allow Alice to contact Bob over XMPP" than "allow from 10.0.0.1 to bob.domain.tld port 5222 keep-state"
NuFW/EdenWall seems great for this. It is not a finished project yet, compared with some great closed products, but the right idea is here.

During my web review, I have seen the following announce: SignServer project 4.0 is released. http://www.signserver.org/. It looks very interesting. And it shows me that apache project as its own mail server ?! James ... googlize it !

(Last week was very rich !!)
This is a interesting post about FreeBSD 4->5->6->7 releases, and why some of Linux gurus are telling "FreeBSD sucks". Well, I do not want to say that "FreeBSD is better than Linux" or "Linux is a *BSD killer" (but it is not :-). Take a look at Truth on FreeBSD 5.x releases". I am very proud of FreeBSD developers, because I love FreeBSD, much more than the hundreds of Linux distros. And Explanations given here are the real world on project management. I encountered almost every day at my own job !


Some fun: http://icanhascheezburger.com/

VoIP security news:
Sipera 5 threats in 2008: VoIP Security Threat Predictions
Let's see....

Power of jails

Discover the power to serve, and more precisely, the power of jails.
Because security is not only resolved by virtualization, you can use jails on FreeBSD. Take a look at: http://www.freebsddiary.org/jail-multiple.php