OpenBSD Monero Node

Build

Dependencies:

pkg_add git cmake gmake zeromq cppzmq libiconv boost

Build:

cd ~
git clone --recursive https://github.com/monero-project/monero
cd monero
ulimit -d 2000000
env USE_SINGLE_BUILDDIR=1 gmake release-static

Chroot Script

#!/bin/sh

CHR="/var/xmr"
USR="_xmr"

# Create login class
cat <<EOF>> /etc/login.conf

${USR}:\\
        :datasize-max=infinity:\\
        :datasize-cur=3072M:\\
        :openfiles-max=13500:\\
        :openfiles-cur=13500:\\
        :tc=daemon:
EOF
cap_mkdb /etc/login.conf
groupadd ${USR}
useradd -L ${USR} -g ${USR} -d /var/empty -s /sbin/nologin ${USR}

# Create chroot
mkdir -p ${CHR}/{bin,data,dev,etc}
chmod 0750 ${CHR}/data
chown ${USR}: ${CHR}/data

cd ${CHR}/dev
sh /dev/MAKEDEV std random
rm ${CHR}/dev/{console,klog,kmem,ksyms,mem,tty,xf86}

# Create etc config
cp /etc/{resolv.conf,hosts,localtime} ${CHR}/etc/
chmod 0644 ${CHR}/etc/{resolv.conf,hosts,localtime}

BIN="${CHR}/bin"
cp monerod ${BIN}
chmod 0750 ${BIN}/monerod
chown root:${USR} ${BIN}/monerod
for f in $(ldd ${BIN}/monerod | awk '{print $7}' | tail +4); do
  rsync -R $f ${CHR}/
done
rsync -R /var/run/ld.so.hints ${CHR}/

cat <<EOF> /etc/rc.d/xmr
#!/bin/sh

daemon="/usr/bin/env -i /usr/sbin/chroot -u ${USR} -g ${USR} ${CHR}"

. /etc/rc.d/rc.subr

pexp="\${daemon_flags}"

rc_cmd \$1
EOF

cat <<EOF> /etc/sysctl.conf
kern.maxfiles=16384

#net.inet.tcp.recvspace=65535
#net.inet.tcp.sendspace=65535
net.inet.ip.maxqueue=2048
kern.somaxconn=2048
net.bpf.bufsize=2097152
net.bpf.maxbufsize=4194304

#net.inet.ip.portfirst=32768
#net.inet.ip.portlast=49151
#net.inet.ip.porthifirst=49152
#net.inet.ip.porthilast=65535

kern.seminfo.semmni=1024
kern.seminfo.semmns=4096
kern.shminfo.shmmax=67018864
kern.shminfo.shmall=32768

kern.bufcachepercent=70
EOF

# Apply sysctl
grep "^[^#]" /etc/sysctl.conf | xargs sysctl

chmod 0555 /etc/rc.d/xmr

rcctl enable xmr
rcctl set xmr flags "/bin/monerod --detach --restricted-rpc --data-dir /data"
rcctl start xmr

This document describes how to install a secure ssh shell access to monerod.

Installation

Create chroot directory:

mkdir /var/xmr_tun

Create tunnel shell:

cat <<EOF> /root/tsh.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <signal.h>
#include <err.h>

void handler(int s) {
        if (s == SIGINT || s == SIGTERM || s == SIGHUP)
                exit(EXIT_SUCCESS);
}

int main(void) {
        if (-1 == unveil("/", "r"))
                err(EXIT_FAILURE, "unveil");
        if (-1 == pledge("stdio", NULL))
                err(EXIT_FAILURE, "pledge");
        if (0 != fclose(stdin))
                err(EXIT_FAILURE, "fclose");
        if (0 != fclose(stderr))
                err(EXIT_FAILURE, "fclose");
        signal(SIGHUP, &handler);
        signal(SIGINT, &handler);
        signal(SIGTERM, &handler);
        signal(SIGTSTP, &handler);
        (void)puts("$(hostname -s) tunnel shell");
        while(1)
                (void)sleep(100);
        return(EXIT_SUCCESS);
}
EOF
clang -static -Wall -Wextra -fret-protector -fstack-protector-strong -fPIE -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -o /var/xmr_tun/tsh /root/tsh.c

Create user:

useradd -d /var/xmr_tun -s /tsh xmr

Set empty password:

chpass xmr

Replace
Encrypted password: *
with
Encrypted password:

SSH Config:

cat <<EOF>> /etc/ssh/sshd_config

# monero tunnel config
PrintLastLog no
Match User xmr
 ChrootDirectory /var/xmr_tun
 PermitEmptyPasswords yes
 PermitOpen 127.0.0.1:18081
 AllowAgentForwarding no
 AllowStreamLocalForwarding no
 PubkeyAuthentication no
 PasswordAuthentication yes
 PermitRootLogin no
 AllowTcpForwarding local
EOF

Restart sshd:

rcctl restart sshd

pf Config:

block out quick proto {tcp, udp} to any user xmr

Reload pf: pfctl -f /etc/pf.conf

SSHFP

0: Reserved
1: RSA
2: DSS
3: ECDSA
4: ED25519

0: Reserved
1: SHA-1
2: SHA-256

Generate SSHFP records:

ssh-keygen -r xmr | grep -E "[14] [12]"

SSH Connection

ssh -o "VerifyHostKeyDNS ask" -L18081:127.0.0.1:18081 xmr@xmr.giftfish.de

Key fingerprints:

SSHFP is supported.

(ED25519) SHA256:vRj15oX/18oVwXbez+xCxIUpAOdBZhltu71t3xITUmU
(RSA) SHA256:8BsgCx3FMSFVVDW8OJnP5kUSNqo611OmCy6hafa8wvg

Block Explorer

https://github.com/moneroexamples/onion-monero-blockchain-explorer

Prepare

Dependencies:

pkg_add gcc

Clone:

cd ~
git clone https://github.com/moneroexamples/onion-monero-blockchain-explorer
cd onion-monero-blockchain-explorer
git checkout devel

Apply patch:

patch -p1 <<EOF
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 2833d93..402431a 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -64,7 +64,7 @@ if(APPLE)
 endif()
 
 
-if (${CMAKE_SYSTEM_NAME} MATCHES "Darwin" OR WIN32)
+if (${CMAKE_SYSTEM_NAME} MATCHES "Darwin|OpenBSD" OR WIN32)
     add_library(unbound STATIC IMPORTED)
     set_property(TARGET unbound PROPERTY IMPORTED_LOCATION ${MONERO_BUILD_DIR}/external/unbound/libunbound.a)
 endif()
@@ -142,7 +142,7 @@ else()
     set(LIBRARIES ${LIBRARIES} atomic)
 endif()
 
-if (NOT ${CMAKE_SYSTEM_NAME} MATCHES "Darwin" AND NOT WIN32)
+if (NOT ${CMAKE_SYSTEM_NAME} MATCHES "Darwin|OpenBSD" AND NOT WIN32)
     set(LIBRARIES ${LIBRARIES} unwind)
 endif()
 
@@ -154,7 +154,9 @@ if (WIN32)
             Iphlpapi
             )
 else()
-    set(LIBRARIES ${LIBRARIES} dl)
+    if (NOT ${CMAKE_SYSTEM_NAME} MATCHES "OpenBSD")
+        set(LIBRARIES ${LIBRARIES} dl)
+    endif()
 endif()
 
 find_package(HIDAPI)
EOF

Compile

mkdir build && cd build
cmake ..
ulimit -d 2000000
make