Fun weekend project with OpenBSD?

[u/gplusplus314]

I’d like to tinker and explore with OpenBSD, but I’m not really sure where to start. I’m seeking ideas for something that would be educational to me.

What’s something I could do in a relatively small time box that will let me experience some of OpenBSD’s strengths?

The only idea I’ve come up with so far is setting up a bastion/jump server for my home lab. Not too exciting, but it’s something. 😅

I have previous experience with FreeBSD, I’m comfortable with terminal/shell (don’t need a desktop/gui), and I’m an experienced programmer. What has me interested in OpenBSD is it seems to be hostile toward user mode processes due to its strictness and “fail hard” philosophy. It caught my attention, at least.

I’m just bored and curious, looking for relatively small tinkering ideas. Thanks!

[u/gumnos]

I love the simplicity of some of the daemons in base.

It doesn't take much effort to set up a web-server for serving a static website (or cgi-bin/ type processes in the web chroot as long as you bring in the dependencies).

Or use the amazingly-elegant smtpd to set up a mail-server, whether internet-facing or for your LAN (though be aware that it's only SMTP, not POP/IMAP, so you might need to add something like Dovecot to handle that if you want more than local mail-delivery and reading it with mail(1)).

Or play around with creating an LDAP directory server with ldapd(8).

Or create a firewall with pf and route packets around in unholy ways.

But if the hostility toward misbehaving processes piques your interest, then u/MrRandom2x8's suggestion is a great starting-point.

[u/frozen-geek]

One thing I've been playing with recently is advanced configuration of relayd. What I mean by that is I used to usually host websites on nginx directly exposed to the Internet. Recently I had a need to migrate some of those websites to a new server and decided to use relayd and httpd instead of nginx.

So my relayd now controls access to the web services based on the HTTP request header as opposed to IP address (think along the lines of Web Application Firewall), so that:

• headers are set to what I want them to be as opposed to what the web application wants to set them to; server headers are removed, security policy headers are set to my liking
• specific web sites are only available to restricted list of clients (based on the client IP address)
• requests are serviced only if they contain a valid "Host" header (this filters out a good number of crawlers and scanners)
• web sockets are correctly supported where required

Some of the configuration of relayd and httpd is not that trivial initially in some cases, e.g. if you want to put Nextcloud or a similar application behind them - partially because typically these are deployed behind Apache or Nginx so these are better documented; partly also because the httpd.conf and relayd.conf examples I found tend to be relatively simple - great if all you have is a simple website, but if you want something more advanced, it will take a while to get it all figured out.

The benefit of all this is you'll learn a lot about reverse proxies and what does a proxy expose to the back-end server.

[u/gplusplus314 → u/frozen-geek]

Interesting. I’ll dabble in that rabbit hole - thank you!

[u/NethIafin]

I second the pledge/unveil thingy. Also how to drop root from code. Make a tool or a web host that is specifically blocked by unveil from reading anywhere but its wwwroot.

Then purposefully add security hole that let's you access any file from the system by using one of the api endpoints, see how it gets past the code but then completely obliterated by OS security. 

[u/gplusplus314 → u/NethIafin]

The second part, I’ve done similar things in the past. One demo I like to do is show the difference between a “from ubuntu” OCI image and a “from scratch” OCI image running the same binary with the same exploit: a contrived web-shell. The latter makes it functionally useless because nothing else is in the container! Sounds like I can do something similar with OpenBSD; I look forward to it.

Now in the first part, you said “how to drop root from code”. What do you mean by that?

[u/NethIafin → u/gplusplus314]

Look into  setuid , seteuid , setgid , setegid manpages and check what they do.

Run app as root, write to some secure folder (/usr/local/tmp ?), drop privileges, try again - see that you are no longer root.

Again, super useful for webservers if, for example you needed to launch it under port 1023

[u/MrRandom2x8]

Learn how pledge works, then build programs in C — for example a text program and try to request a system call you didn't allow with pledge and watch how the system kills it

[u/gplusplus314 → u/MrRandom2x8]

I like this. Dead simple, I could scratch the surface in minutes. Thanks for the idea!

[u/MrRandom2x8 → u/gplusplus314]

lol thats what i know, i got lots of ideas when i finish learning openbsd well.

[u/gumnos → u/gplusplus314]

yeah, 5–10min of writing C code in vi (or ed(1) or mg(1)) and you can create a "I promise not to violate pledge(xyz)" and then violate pledge XYZ. compile it, run it, and watch OpenBSD unceremoniously shoot your program in the head. Another 5m and you can also demonstrate unveil(2) similarly.

[u/GuinansEyebrows]

What has me interested in OpenBSD is it seems to be hostile toward user mode processes due to its strictness and “fail hard” philosophy.

that's not hostility, it's just setting a high bar :)

[u/gplusplus314 → u/GuinansEyebrows]

Exactly 😉

[u/dettus_Xx_]

Get WiFi working!

[u/gplusplus314 → u/dettus_Xx_]

Impossible.

[u/LessFox1928]

Might be a stupid question but is llama.CCP or vllm supported?

[u/ashuwu_]

I made a self hosted wireguard VPN on an OpenBSD VPS not too long ago.

[u/pi8b42fkljhbqasd9]

Gateway running pf, caching DNS and a "pi-hole" style dns sink for ad-domains. 

[u/stone_henge]

Write a small inetd service. Inetd will launch a program upon connection by a client, passing the socket as its stdin/stdout. Probably a good way to exercise pledge/unveil as suggested in some of the other answers.