vedetta-com/vedetta

OpenBSD Router Boilerplate

vedetta's Issues

scripts referenced in root crontab

/usr/local/bin/adhosts.sh
/usr/local/bin/malware.sh
/usr/local/bin/dnsblock.sh

Are not explicitly linked in the readme.md file, however browsing the src tree finds them.
Perhaps a link in the readme will help?

httpd: OCSP stapling is not used

httpd bug in OpenBSD 6.3

• Verify OCSP response file:

ocsptool -e --no-nonce \
            --load-signer /etc/ssl/acme/letsencryptauthorityx3.pem \
            --load-response /etc/ssl/acme/example.com.ocsp.resp.der

Verifying OCSP Response: Success.

• Verify httpd OCSP response:

echo \
| openssl s_client -connect example.com:443 -tlsextdebug -status \
| grep OCSP

OCSP response: no response sent

TLS inspection (MITM) with relayd

Add tftpd and tftp-proxy for autoinstall

Finish autoinstall:

• Add tftpd
• Add tftp-proxy
• Update dhcpd.conf
• Update httpd.conf
• Update pf.conf
• Add autoinstall example

Transparent HTTP proxy (with filters) using relayd

switchctl from hostname.switch0 fails

From my router:

starting network
em0: no link .... got link
em0: bound to 192.168.0.8 from 192.168.0.1 (XX:XX:XX:XX:XX:XX)
switchctl: connect: /var/run/switchd.sock: Connection refused

I guess this is because switchd doesn’t start until later in the boot process:

starting network daemons: sshd switchd dhcpd smtpd sndiod.

Clients work correctly for me if I run switchctl from rc.local instead.

rebound has been replaced by unwind

New OpenBSD 6.6 is no longer compatible with this.

Can we expect an update for this?

relayd supports SNI and OCSP in OpenBSD 6.6

Namaste,

The Caveats section in README mentions the following:
...
relayd does not support CRL, SNI, nor OCSP (yet)
...

It seems relayd now (OpenBSD 6.6+) does support SNI and OCSP [1].

We may want to update the configurations in this repository to reflect the SNI and OCSP support in relayd.

Dhanyavaad.

[1] - https://www.openbsd.org/plus66.html

Disable ciphers with DHE as Key Exchange

The commit a38ea0b disables DHE for key exchange. If I am not wrong, perhaps we may want to disable ciphers which have DHE for key exchange.

Currently, there is one cipher present in the configuration which has DHE as its key exchange - DHE-RSA-CHACHA20-POLY1305.