ZeroBSD

It’s been a long time since I last played with OpenBSD and from 5.8 they decided to replace sudo with doas. But this doesn’t mean you can’t install old sudo from ports or packages, but there’s another way for us to keep typing sudo, while actually using doas: you guessed it, aliases!

Now, the default shell seems to be ksh, if I remember correctly. We need a ~/.kshrc file, to define our alias (if you don’t have it already, I presume you don’t):

cd ~ touch .kshrc echo ‘alias sudo=doas’ >> .kshrc

But that’s not enough. We need ksh to be aware of this file, upon shell launch. For this, we need to do one more thing: add the following line in your ~/.profile

export ENV=$HOME/.kshrc

That’s it. Log out, log in again and enjoy using typing sudo instead of doas for as long as you want.

P.S. I’ve read about people using the following alias:

alias bitch=doas

Does your Midnight Commander screen looks funny? That’s probably because you forgot to enable UTF-8 support in your console. It’s easy, you just have put this line in your ~/.profile:

export LC_CTYPE="en_US.UTF-8"

Ever since I've read this blog post about customizing FreeBSD, I loved the Shiki Colors appearance. Tried replicating the looks on Xfce, but wasn't very successful, due to the fact that you'll need to replace xfwm with metacity, and that will bring a lot of unwanted dependencies on your system. So we won't go on that road.

Fortunately, the guys from Debian made a package called shiki-colors-xfwm-theme and this can help us a bit. It's not the real deal, but it improves the looks of Xfce.

So first, we need to download the Debian package. For this, just a mirror from this site and you will get a .deb package. Now, we want to extract the files from this .deb archive, and we can do this by typing:

ar vx shiki-colors-xfwm-theme_4.6-1_all.deb

This command outputs three files: debian-binary and two more archives: control.tar.gz and data.tar.gz. We are only interested in the latest one (you can discard the rest), so let's go and deflate that:

tar -xzvf data.tar.gz

You will get an usr folder that contains a bunch of other folders that you have to navigate trough and finally you'll reach the ones we need: Shiki-Colors-Easy-Metacity and Shiki-Colors-Metacity. Just copy these two folders under /usr/local/share/themes. You will see here other folders with themes, so make sure you are in the right place by recognizing a few. To test them, run:

xfwm4-settings

and search the two news themes under Style tab. You'll find them among others xfwm4 themes that you may like. Now remember, this is the theme only for the xfwm, tuning your desktop appearance can be done also from Settings menu, Appearance. I settled for Rezlooks-Sydney. You can get this one by installing the following:

pkg_add -vi gtk2-rezlooks-engine

Things got pretty easy since I last tried this. There's no need to remember long lists of packages needed to be installed for the latest Xfce on the newest OpenBSD. Simply type:

# pkg_add -vi xfce

Since I moved my website on a virtual server (running Debian) and since my OpenBSD desktop project was an expected failure, this blog was dormant. Until I found a new use for OpenBSD: I've recently bought an old iMac G3 (summer 2000) and after playing with Mac OS 9 and Mac OS X Tiger on it, now it's time to install some OpenBSD. Because why not.

Getting the macppc port was easy. Installation was pretty straightforward. The only difference from any other installation was that the installer asked me if I want a MBR or a HFS partition and, since I plan to have only OpenBSD on the machine (no dual-boot for the time being), I answered MBR.

After installation, if you want to boot your newly installed OpenBSD, you'll have to enter Open Firmware by pressing Command+Option+O+F at boot, and then issue the following command:

boot hd:,ofwboot /bsd

Because OpenBSD is the only operating system on the machine, you'll probably want to boot directly into it, without manually going trough Open Firmware. To do this, enter in Open Firmware again and type this:

setenv boot-device hd:,ofwboot /bsd reset-all

Your iMac should now reset and boot directly into newly installed OpenBSD.

If you want to run X, check if machdep.allowaperture is set to 2 in /etc/sysctl.conf. This will allow X to run accelerated. More info, in here. Getting X to run is another story that will follow soon.

While reevaluating my security practices, I came up with the conclusion that my password system is a mess. For obvious reasons, I won't talk about it much, but I realized that having a handy password generator will be a good idea. While searching a few minutes for hints and solutions, I came up with two methods that works out-of-the box on a OpenBSD machine, without needing any extra package to be installed than the default base system.

Here's the first one:

dd if=/dev/urandom count=200 bs=1 2>/dev/null|tr "\n" " "|sed 's/[^a-zA-Z0-9]//g'|cut -c-16

It's a little cryptic for a newbie (due to sed), but what you have to remember is that it generates passwords with a length of 16 characters and modifying the last argument will modify your password length. It's based on /dev/urandom device, so it should be safe enough.

The second method uses OpenSSL:

openssl rand -base64 16

Careful, sometimes the last two characters would always be "==". if you use this command, but you can get rid of this by adjusting the length of it.

Now, you can use any of this commands to have a pretty secure password. But to increase the randomness of it, I use a bash script that generates a two strings, one with each method, and I've placed a special character between them (it can be "@", "#", "$", "%", anything you like). 

Here's my script:

part1=`openssl rand -base64 6` part2=`dd if=/dev/urandom count=200 bs=1 2>/dev/null|tr "\n" " "|sed 's/[^a-zA-Z0-9]//g'|cut -c-9` echo $part1%$part2

One of the strengths of OpenBSD is its documentation. I'm really glad that developers really takes it seriously, since a good manual page can save you a lot of time and troubles. Here's an example: I was trying to sort out a text file and remove duplicates. The file was above 200 MB.  My first approach was the following:

cat list.txt | sort | uniq > list_m.txt

But after a few seconds, I received the following error:

sort: /var/tmp/sort.G2bEcvsPlX: Too many open files

Let's break is down:

$ sort -o list_s.txt list.txt

Same error. So it's related to sort, not to cat or uniq. First impluse: search if other had the same error. No relevant answers in the first minutes. Should I ask this on a forum? Maybe on the mailing list? That was my second impulse. But wait, let's read the manual for sort. Tried with the following arguments:

$ sort -o list_s.txt list.txt

Same error.

Ok, let's keep reading. The last paragraph reads:

BUGS

To sort files larger than 60Mb, use sort -H; files larger than 704Mb must be sorted in smaller pieces, then merged.

For a pleasant desktop experience, it's generally a good idea to have your X server run with 96 dpi (dots per inch). Other values might work as well, but I found this to be the perfect choice for my machine. Usually, the system would set this dpi value correctly, but if it doesn't or if you want to make sure it will not miss, look at your /etc/X11/xdm/Xservers file and find the line that looks something like this:

:0 local /usr/X11R6/bin/X :0 vt05

Modify it, to look like this (basically just insert the '-dpi 96' switch, as shown):

:0 local /usr/X11R6/bin/X -dpi 96 :0 vt05

If you host a Wordpress blog, like I do, you may want to enable those pretty permalinks. Wordpress documentation will tell you what kin of .htaccess file you need in your base folder (meaning the same fodler where your index.php is located for your Wordpress webiste). That's helpful, but you still need to do a few tricks to have it running on OpneBSD, if you don't want to end up seeing 404 Errors all the time.

First of all, check if mod_rewrite is enabled for your httpd, by making sure that you have uncommented the following line from your /var/www/config/httpd.conf file:

LoadModule rewrite_module       /usr/lib/apache/modules/mod_rewrite.so

Now you need to tell httpd to let you use .htaccess files on your webiste folder. You can do this by searching for this block:

AllowOverride None

and change it to 

AllowOverride All

Make sure you are within <Directory "/var/www/htdocs"> directive when you do this.

This may be quite trivial and it can be found also in the FAQ with a simple Google search, but I've somehow missed it until now. Enabling softupdates can really boost your desktop performance. It's not something I can measure and prove it, but the general feeling is that Xfce feels faster and this time it's usable and not that laggy. There's room for speed improvements still, especially in the video card department, but I'm happy with how the things are for the time being.

Enabling softupdates is very simple, just edit /etc/fstab, by adding the softdep keyword, as in the following example:

fec2653dbd41594a.a / ffs rw,softdep 1 1

This is an example from an /etc/fstab file with UUID, but it's trivial for the other, older type:

/dev/sda0a / /ffs rw,softdep 1 1

Remember this problem I had? Well, thanks to Andrei Mureșan, it's fixed now. Apparently, cron has no idea of environmental variables when running the backup script, so I had to add the following line at the begining of my script:

PATH=$HOME/bin:/bin:/sbin:/usr/bin:/usr/sbin:/usr/X11R6/bin:/usr/local/bin:/usr/local/sbin:/usr/games:.

Works like a charm now. For future reference, he's the full, corrected and working backup script:

Not long ago I've talked about two ways of making a good IP filter with pf. The first methods involved a pf table created after failed ssh attempts, but the table was not persistent after reboot, and the second method had a static text file from where pf could load unwanted IP for filtering. Let's merge the two methods.

Let's say that we already have a text file, manually created, with a selection of unwanted IPs, called /etc/pf.blocked.ip.conf and you also want to filter the ones that keep knowcking on your ssh door. You'll have to have this in your /etc/pf.conf:

# static text file table <blockedips> persist file “/etc/pf.blocked.ip.conf” block in on bnx0 from <blockedips> to any

# not persistent pf table table <bruteforce> persist block quick from <bruteforce> pass inet proto tcp from any to any port \ ssh flags S/SA keep state (max-src-conn 5, \ max-src-conn-rate 5/30, overload <bruteforce> flush global)

Now we would like to dump the bruteforce table into the /etc/blocked.ip.conf file, to have a record of our unwated IPs. A simple dump command is this one:

# pfctl -t bruteforce -T show

but this creates unwanted spaces that must be eliminated. We'll use sed for this:

# pfctl -t bruteforce -T show | sed 's/ //g'

Now the space is gone and we have a properly formatted list of blacklisted IPs. We cannot dumped it right into /etc/blocked.ip.conf, because there might be the same IPs on different lines and we don't want to have a bloated file loaded by pf. Let's crate a temporary file with both the content of the bruteforce table and /etc/blocked.ip.conf:

# pfctl -t bruteforce -T show | sed 's/ //g' >> /tmp/ip.conf # cat /etc/blocked.ip.conf >> /tmp/ip.conf

Not we have to eliminate the IPs that are found more than one time in that list. We can do this with uniq, but for this, our list have to be ordered with sort.

sort /tmp/ip.conf | uniq >> /tmp/ip.final.conf

The file /tmp/ip.final.conf contains now a list with unique blacklisted IP form both out manual /etc/blocked.ip.conf and from what the system catched automatically. If an IP was found on both lists, at the end it will be present in our filter only once. So, after moving along some files and cleaning, we can have a nice procedure for pf IP filtering.

rm /etc/blocked.ip.conf cp /tmp/ip.final.conf /etc/blocked.ip.conf rm /tmp/ip.conf rm /tmp/ip.final.conf

After running halt command, the system shuts down nicely, but one thing bugged ever since I've first played with OpenBSD: the system did not powered down without pressing the power button. I can live with that, but it's rather frustrating and I thought that's probably because OpenBSD doesn't love my motherboard, though every modern operating systems knows how to power down my system without having me pressing the button (since my hardware is not the most recent one, it has around six years already).

After a quick online search, the solution for my problem revealed itself: it wasn't a driver problem, it was just a script, /etc/rc.shutdown with a lonely line in it that reads:

powerdown=NO   # set to YES for powerdown

So, I obviously modified that into:

powerdown=YES   # set to YES for powerdown

and voilà, my system now is powering down nicely.

And if you want to be able to restart or halt your system as normal user, without sudo, just add your user to operator group:

As part of my OpenBSD workstation project, making things pretty is a vital task. I can't work in an ugly environment, so things have to be simple, functional and more important, coherent.

One of the first things I do on a fresh OpenBSD system intended for desktop use is to install msttcorefonts pack. Probably due to license reasons, you can only install this from ports, so if you don't have ports yet, just follow the FAQ and do this:

$ cd /tmp $ ftp ftp://ftp.openbsd.org/pub/OpenBSD/5.1/ports.tar.gz $ cd /usr $ sudo tar xzf /tmp/ports.tar.gz

Now that we have the ports installed, do this:

# cd /usr/ports/fonts/msttcorefonts # make install

It's all on the FAQ, just pointing it out.

Now, for one reason or another, you may need some GTK3 application. I use Xfce and I'm actually pretty satisfied with it, but I also need gedit for reasons mentioned in another post. While gedit is a GTK3, if you don't choose the right theme, it may fallback to an ugly GTK variant which looks weird. So while your daily GTK2 theme look nice (Firefox, gFTP, XChat), the gedit will be different. There's nothing I hate most than inconsistency. You need to find themes with support for both GTK2 and GTK3 versions to have theme consistency. A good starting point is gnome-looks.com website, from where you can download them and put them in your ~/.themes folder. If you don't have it, create it and copy theme's folders, after you've extracted them from the archive. The form the Xfce menu, Setting, Appearance and you can have a look on your new themes.

These packages might be useful, before starting theme hunt:

# pkg_add -vi gtk-engines2 # pkg_add -vi gtk2-murrine-engine

I've settled for Clearwaita from the Clearlooks-Phenix package, it looks simple, clean and fresh on both GTK2 and GTK3 applications (I love the old Clearlooks for GTK2 back in the days).

I was surprised to see that a TeX Live meta-package is missing for FreeBSD, but there is one for OpenBSD. And it also installs nicely as a dependency for gedit-latex, a plugin for gedit that is probably the best LaTeX editor I could find in GTK.

The magic of gedit-latex plugin is that it adds cite-autocompletion and it's beyond me why this feature is not available in every other LaTeX editor, considering what an excruciating pain dealing with biography is and how much a simple feature like this can help. I think there is only one more editor with cite-autocompletion, namely TexStudio, but it won't compile on OpenBSD nor FreeBSD and it's Qt4 and too bloated for my taste. Also, gedit is a nice, clean, simple design application that integrates well in my Xfce's GTK medium.

FreeBSD 9 has binaries of Gnome 2 while OpenBSD 5.1 got Gnome 3 already. Hence, the ugliness of gedit in OpenBSD, but some theme tweaking I guess could make it better, that's the only annoyance of my current setup. gedit 2 looked way better in FreeBSD's Xfce with GTK2 themes, but I'll dig for some beauty tips in the following days. The gedit 3 is the way to go anyway, no reason to look back.

Although installing TeX Live from official ports in FreeBSD is not possible, there is an alternate solution but I find it convoluted and I prefer the OpenBSD way: installing it from packages. Just type:

pkg_add -vi gedit-latex

and the rest will follow automatically, the system will fetch and install texlive_texmf-minimal package with all the necessary dependencies and you'll have a nice TeX environment on your OpenBSD 5.1 machine. Sweet. It took me a while to find out about this, as I thought there are no binary packages for TeX Live (don't ask why I didn't just look into the ports directory), so I compile it from ports not a few day ago.

gedit-latex package texlive_texmf-minimal and this could be enough for some tasks, but trying to compile my .tex files spilled out a lot of errors concerning special characters like ăîșțâ, so I knew that I needed ut8x and ucs package, which wasn't in the installed Tex Live distribution. To fix this, we can install the following:

pkg_add -vi texlive_texmf-full

Now we'll have utf8x, ucs (I know it's not recommended to use ucs, but it's the only way to type spcial characters directly in editor and not having to wrapt my fingers for LaTeX codes in each and every word) and mchem package for easily typing chemical symbols.

I use the proposed auto-layout of my OpenBSD disk that is suggested during install. The problem is that, while /home partition is generous enough, /usr might be to small for some operations. For example, on a 20 GB hard-disk drive, the OpenBSD installer thinks that 2 GB is enough for /usr. Well, probably it is for some stuff, but when trying to compile TexLive from ports I've noticed that those 2 GB gets filled up near the end, making impossible to complete install the needed packages. The probem can be overcome simply and the process is described in OpenBSD FAQ, section 15.3.3. All we have to do to ease the stress on the /usr partition is to move the package handling operations to a partition with plenty of space, say /home. So edit your /etc/mk.conf like I did (if the file doesn't exist, create it and add the following lines):

WRKOBJDIR=/home/john/ports/obj/ports DISTDIR=/home/john/ports/distfiles PACKAGE_REPOSITORY=/home/john/ports/packages

Don't worry if you don't have the /home/<user>/ports directory, the scripts will create it for you.

After playing with FreeBSD for a few days, I'm back on my OpenBSD. First time I tried installing Xfce I gave up, due to some mouse problems and window manager issues. Now I'm back on track for installing this simple desktop environment, ready to fix all the problems.

The mouse problem arise probably due to the fact that my moue is a PS2 mouse, but it connect to my PC trough a PS2-to-USB adapter. I needed that so that my OS X could run on my system, since Apple's operating system doesn't had drivers for PS2 mouses. In OpenBSD, everytime I exited Xorg, my mouse would disconnect and stayed that way. Frustrating. So I removed the adapter and plugged my mouse in it's intended location. Problem solved.

So let's get on installing Xfce. I've used this website as a guide, but with some modifications (some packages couldn't be found and some of them have different name now). If you already have a clean OpenBSD installed, just run this commands to have your Xfce desktop ready (there is no meta-package for Xfce, so we have to manually install everything):

# pkg_add -vi xfce4-session

# pkg_add -vi gtk-xfce-engine

# pkg_add -vi xfdesktop

# pkg_add -vi xfce4-appfinder

# pkg_add -vi xfce4-battery

# pkg_add -vi xfce4-clipman

# pkg_add -vi xfce4-dict

# pkg_add -vi xfce4-diskperf

# pkg_add -vi xfce4-fsguard

# pkg_add -vi xfce4-genmon

# pkg_add -vi xfce4-mailwatch

# pkg_add -vi xfce4-modemlights

# pkg_add -vi xfce4-mount

# pkg_add -vi xfce4-mpc

# pkg_add -vi xfce4-netload

# pkg_add -vi xfce4-notes

# pkg_add -vi xfce4-notifyd

# pkg_add -vi xfce4-places

# pkg_add -vi xfce4-quicklauncher

# pkg_add -vi xfce4-screenshooter

# pkg_add -vi xfce4-smartbookmark

# pkg_add -vi xfce4-systemload

# pkg_add -vi xfce4-taskmanager

# pkg_add -vi xfce4-time-out

# pkg_add -vi xfce4-verve

# pkg_add -vi xfce4-wavelan

# pkg_add -vi xfce4-weather

# pkg_add -vi xfce4-wmdock

# pkg_add -vi xfce4-xkb

# pkg_add -vi xfce-utils

# pkg_add -vi xfce4-terminal

# pkg_add -vi mousepad

# pkg_add -vi orage

# pkg_add -vi xfce4-mixer

# pkg_add -vi xfwm4 # pkg_add -vi xfwm4-themes

My initial problem with window bars missing was caused by failing to install xfwm4. Now it works, beautifully.

Don't forget to modify your .initrc file accordingly (and comment any other lines, if necessary):

$ echo 'exec startxfce4' > .xinitrc

$ chmod +x .xinitrc

I haven't installed a login manager yet, but this operation should be trivial and I'll let it as an exercise for the reader :)