GoWiki | openbsd | Monero Node

# OpenBSD Monero Node

## Build

Dependencies:

```
pkg_add git cmake gmake zeromq cppzmq libiconv boost
```

Build:

```
cd ~
git clone --recursive https://github.com/monero-project/monero
cd monero
ulimit -d 2000000
env USE_SINGLE_BUILDDIR=1 gmake release-static
```

## Chroot Script

```
#!/bin/sh

CHR="/var/xmr"
USR="_xmr"

# Create login class
cat <<EOF>> /etc/login.conf

${USR}:\\
        :datasize-max=infinity:\\
        :datasize-cur=3072M:\\
        :openfiles-max=13500:\\
        :openfiles-cur=13500:\\
        :tc=daemon:
EOF
cap_mkdb /etc/login.conf
groupadd ${USR}
useradd -L ${USR} -g ${USR} -d /var/empty -s /sbin/nologin ${USR}

# Create chroot
mkdir -p ${CHR}/{bin,data,dev,etc}
chmod 0750 ${CHR}/data
chown ${USR}: ${CHR}/data

cd ${CHR}/dev
sh /dev/MAKEDEV std random
rm ${CHR}/dev/{console,klog,kmem,ksyms,mem,tty,xf86}

# Create etc config
cp /etc/{resolv.conf,hosts,localtime} ${CHR}/etc/
chmod 0644 ${CHR}/etc/{resolv.conf,hosts,localtime}

BIN="${CHR}/bin"
cp monerod ${BIN}
chmod 0750 ${BIN}/monerod
chown root:${USR} ${BIN}/monerod
for f in $(ldd ${BIN}/monerod | awk '{print $7}' | tail +4); do
  rsync -R $f ${CHR}/
done
rsync -R /var/run/ld.so.hints ${CHR}/

cat <<EOF> /etc/rc.d/xmr
#!/bin/sh

daemon="/usr/bin/env -i /usr/sbin/chroot -u ${USR} -g ${USR} ${CHR}"

. /etc/rc.d/rc.subr

pexp="\${daemon_flags}"

rc_cmd \$1
EOF

cat <<EOF> /etc/sysctl.conf
kern.maxfiles=16384

#net.inet.tcp.recvspace=65535
#net.inet.tcp.sendspace=65535
net.inet.ip.maxqueue=2048
kern.somaxconn=2048
net.bpf.bufsize=2097152
net.bpf.maxbufsize=4194304

#net.inet.ip.portfirst=32768
#net.inet.ip.portlast=49151
#net.inet.ip.porthifirst=49152
#net.inet.ip.porthilast=65535

kern.seminfo.semmni=1024
kern.seminfo.semmns=4096
kern.shminfo.shmmax=67018864
kern.shminfo.shmall=32768

kern.bufcachepercent=70
EOF

# Apply sysctl
grep "^[^#]" /etc/sysctl.conf | xargs sysctl

chmod 0555 /etc/rc.d/xmr

rcctl enable xmr
rcctl set xmr flags "/bin/monerod --detach --restricted-rpc --data-dir /data"
rcctl start xmr
```

This document describes how to install a secure ssh shell access to monerod.

## Installation

Create chroot directory:

```
mkdir /var/xmr_tun
```

Create tunnel shell:

```
cat <<EOF> /root/tsh.c
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <signal.h>
#include <err.h>

void handler(int s) {
        if (s == SIGINT || s == SIGTERM || s == SIGHUP)
                exit(EXIT_SUCCESS);
}

int main(void) {
        if (-1 == unveil("/", "r"))
                err(EXIT_FAILURE, "unveil");
        if (-1 == pledge("stdio", NULL))
                err(EXIT_FAILURE, "pledge");
        if (0 != fclose(stdin))
                err(EXIT_FAILURE, "fclose");
        if (0 != fclose(stderr))
                err(EXIT_FAILURE, "fclose");
        signal(SIGHUP, &handler);
        signal(SIGINT, &handler);
        signal(SIGTERM, &handler);
        signal(SIGTSTP, &handler);
        (void)puts("$(hostname -s) tunnel shell");
        while(1)
                (void)sleep(100);
        return(EXIT_SUCCESS);
}
EOF
clang -static -Wall -Wextra -fret-protector -fstack-protector-strong -fPIE -Wl,-z,relro -Wl,-z,now -Wl,-z,noexecstack -Wl,-z,noexecheap -o /var/xmr_tun/tsh /root/tsh.c
```

Create user:

```
useradd -d /var/xmr_tun -s /tsh xmr
```

Set empty password:

```
chpass xmr

Replace
Encrypted password: *
with
Encrypted password:
```

SSH Config:

```
cat <<EOF>> /etc/ssh/sshd_config

# monero tunnel config
PrintLastLog no
Match User xmr
 ChrootDirectory /var/xmr_tun
 PermitEmptyPasswords yes
 PermitOpen 127.0.0.1:18081
 AllowAgentForwarding no
 AllowStreamLocalForwarding no
 PubkeyAuthentication no
 PasswordAuthentication yes
 PermitRootLogin no
 AllowTcpForwarding local
EOF
```

Restart sshd:

```
rcctl restart sshd
```

pf Config:

```
block out quick proto {tcp, udp} to any user xmr
```

Reload pf: `pfctl -f /etc/pf.conf`

## SSHFP

```
0: Reserved
1: RSA
2: DSS
3: ECDSA
4: ED25519

0: Reserved
1: SHA-1
2: SHA-256
```

Generate SSHFP records:

```
ssh-keygen -r xmr | grep -E "[14] [12]"
```

## SSH Connection

```
ssh -o "VerifyHostKeyDNS ask" -L18081:127.0.0.1:18081 xmr@xmr.giftfish.de
```

Key fingerprints:

`SSHFP` is supported.

```
(ED25519) SHA256:vRj15oX/18oVwXbez+xCxIUpAOdBZhltu71t3xITUmU
(RSA) SHA256:8BsgCx3FMSFVVDW8OJnP5kUSNqo611OmCy6hafa8wvg
```

# Block Explorer

https://github.com/moneroexamples/onion-monero-blockchain-explorer

## Prepare

Dependencies:

```
pkg_add gcc
```

Clone:

```
cd ~
git clone https://github.com/moneroexamples/onion-monero-blockchain-explorer
cd onion-monero-blockchain-explorer
git checkout devel
```

Apply patch:

```
patch -p1 <<EOF
diff --git a/CMakeLists.txt b/CMakeLists.txt
index 2833d93..402431a 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -64,7 +64,7 @@ if(APPLE)
 endif()
 
 
-if (${CMAKE_SYSTEM_NAME} MATCHES "Darwin" OR WIN32)
+if (${CMAKE_SYSTEM_NAME} MATCHES "Darwin|OpenBSD" OR WIN32)
     add_library(unbound STATIC IMPORTED)
     set_property(TARGET unbound PROPERTY IMPORTED_LOCATION ${MONERO_BUILD_DIR}/external/unbound/libunbound.a)
 endif()
@@ -142,7 +142,7 @@ else()
     set(LIBRARIES ${LIBRARIES} atomic)
 endif()
 
-if (NOT ${CMAKE_SYSTEM_NAME} MATCHES "Darwin" AND NOT WIN32)
+if (NOT ${CMAKE_SYSTEM_NAME} MATCHES "Darwin|OpenBSD" AND NOT WIN32)
     set(LIBRARIES ${LIBRARIES} unwind)
 endif()
 
@@ -154,7 +154,9 @@ if (WIN32)
             Iphlpapi
             )
 else()
-    set(LIBRARIES ${LIBRARIES} dl)
+    if (NOT ${CMAKE_SYSTEM_NAME} MATCHES "OpenBSD")
+        set(LIBRARIES ${LIBRARIES} dl)
+    endif()
 endif()
 
 find_package(HIDAPI)
EOF
```

## Compile

```
mkdir build && cd build
cmake ..
ulimit -d 2000000
make
```