# 計算機系統管理 SA HW5 2021
###### tags: `NYCU SA`

## references
> [參考](https://people.freebsd.org/~rodrigc/doc/data/doc/en_US.ISO8859-1/books/handbook/firewalls-pf.html)
> [參考2](https://www.cyberciti.biz/faq/how-to-set-up-a-firewall-with-pf-on-freebsd-to-protect-a-web-server/)
> [參考3(log)](https://www.openbsd.org/faq/pf/logging.html)
> [疑似往年參考](https://yilianwu.io/posts/sa-nis-nfs-firewall-freebsd/)
> [blacklistd reference](https://cryptomonkeys.com/2018/05/freebsd-blacklistd/)

## 題目
> [link](https://nasa.cs.nctu.edu.tw/sa/2021/slides/HW5.pdf)

## autostart wireguard
1. 執行`sudo crontab -e`
2. 新增這一行: `@reboot wg-quick up wg0`
## NFS
### NFS server
1. exports table: `sudo vim /etc/exports`

   V4: /
   /vol/stu130 -maproot=nobody -network 10.113.0.130 -mask 255.255.255.255
   /vol/public1 /vol/public2 -ro -maproot=nobody -network 10.113.0.0 -mask 255.255.255.0

2. 強制使用至少v4的nfs
`sudo vim /etc/sysctl.conf`
新增這一行 `vfs.nfsd.server_min_nfsvers=4`
4. 編輯/etc/rc.conf，插入

   nfs_server_enable="YES"
   nfs_server_flags="-u -t -n 10"
   rpcbind_enable="YES"
   nfsv4_server_enable="YES" # nfs version=4
   nfsuserd_enable="YES" # nfs version=4
   nfs_reserved_port_only="YES" # reserve port
   mountd_enable="YES"
   mountd_flags="-r -p 87" # bind port=87

5. 建立資料夾

   sudo mkdir /vol
   cd /vol
   sudo chmod o+w public1 public2 stu130
   sudo chmod g+w public1 public2 stu130

### NFS client
1. 編輯/etc/rc.conf，插入

   nfs_client_enable="YES"
   nfsuserd_enable="YES" # nfs version=4
   autofs_enable="YES" # nfs version=4
   nfscbd_enable="YES" # nfs version=4

2. 修改 /etc/auto_master(把/net註解，加上最後一行)
將/net註解是因為等等要mount在他的子資料夾

    # $FreeBSD$
    #
    # Automounter master map, see auto_master(5) for details.
    #
    #/net           -hosts          -nobrowse,nosuid,intr
    # When using the -media special map, make sure to edit devd.conf(5)
    # to move the call to "automount -c" out of the comments section.
    #/media         -media          -nosuid,noatime,autoro
    #/-             -noauto
    /-          /etc/auto.map   -intr,nosuid,rw,nfsv4

3. 編輯/etc/auto.map: `sudo vim /etc/auto.map`

    /net/data/stu130        -rw      10.113.254.130:/vol/stu130
    /net/data/public1       -ro      10.113.254.130:/vol/public1
    /net/data/public2       -ro      10.113.254.130:/vol/public2   

## firewall
### enable pf
1. 編輯 `/etc/rc.conf`
新增下面這幾行

    pf_enable="YES"                 # Enable PF (load module if required)
    pf_rules="/etc/pf.conf"         # rules definition file for pf
    pf_flags=""                     # additional flags for pfctl startup
    pflog_enable="YES"              # start pflogd(8)
    pflog_logfile="/var/log/pflog"  # where pflogd should store the logfile
    pflog_flags=""                  # additional flags for pflogd startup

:::info
:bulb: **Hint:** 因為log是packet header，不是printable。可以使用 `sudo tcpdump -n -e -ttt -r /var/log/pflog` 讀log file。如果想即時查看log可執行 `tcpdump -n -e -ttt -i pflog0`
2. 參考 `/usr/share/examples/pf/*` 再編輯 `/etc/pf.conf`

    block out log proto {icmp, icmp6} all
    pass out proto icmp from any to 10.113.0.254
    pass in proto tcp from any to any port {80,443}

### 自動block ssh
1. enable blacklistd
>a. 在 `/etc/pf.conf`新增`anchor "blacklistd/*" in`這一行
>b. 編輯`/etc/blacklistd.conf`達到自動鎖SSH 1分鐘
> ```conf=
># $FreeBSD$
> #
># Blacklist rule
># adr/mask:port type proto owner name nfail disable
>[local]
>ssh stream * * * 3 1m
>ftp stream * * * 3 24h
>smtp stream * * * 3 24h
>submission stream * * * 3 24h
>#6161 stream tcp6 christos * 2 10m
>* * * * * 3 60
>
># adr/mask:port type proto owner name nfail disable
>[remote]
>#129.168.0.0/16 * * * = * *
>#6161 = = = =/24 = =
>#* stream * * * 3 1m
> ```
2. 編輯/etc/rc.conf，插入

   blacklistd_enable="YES"
   blacklistd_flags="-r"

3. 讓SSH有blacklistd:

   sudo sysrc sshd_flags="-o UseBlacklist=yes"
   sudo service sshd restart

4. iamgoodguy command解除block
`sudo vim /usr/local/bin/iamgoodguy`

    #!/bin/sh
    pfctl -a blacklistd/22 -t port22 -T delete "$1"

    sudo chmod u+x /usr/local/bin/iamgoodguy
    sudo chmod o+x /usr/local/bin/iamgoodguy
    sudo chmod g+x /usr/local/bin/iamgoodguy

5. `sudo reboot` :arrow_right: 套用`/etc/rc.conf`

## 使用vscode 編輯FreeBSD的檔案
### linux
1. 安裝sshfs
`sudo apt install sshfs`
2. mkdir freebsd
3. mount freebsd
`sshfs -p [SSH_port] [freeBSD_USER]@[freeBSD_IP]:[freeBSD_dir]`
EX: `sshfs -p 12345 yourname@localhost:/`
這樣會把freeBSD的'/'mount到linux的freebsd資料夾
freeBSD的ip,port已經透過前面virtualbox NAT到localhost, port=12345
4. code freebsd
### windows
1. 開啟WSL的terminal
2. 安裝sshfs
`sudo apt install sshfs`
3. mkdir freebsd
4. 取得windows IP
`awk 'NR==4{print $2}' /etc/resolv.conf`
5. mount freebsd
`sshfs -p [SSH_port] [freeBSD_USER]@[windows_IP]:[f5reeBSD_dir]`
EX: `sshfs -p 12345 yourname@172.24.112.1:/`
這樣會把freeBSD的'/'mount到wsl的freebsd資料夾
freeBSD的ip,port已經透過前面virtualbox NAT到windows IP, port=12345
4. code freebsd