Enterprise OpenBSD administration?

make release

man release

Thanks for the clarification Marc. I saw a posting that niklas@ had a goal of making openbsd able to cross build on any arch for any other arch. I was hoping to merge that ability with the release capability to justify one uber fast build host...

I found the cross-tools et al in src/Makefile that led me astray. Ah well.

see http://www.deadly.org/article.php3?sid=20030109015748 for more on netbooting.

i'm using intel based nics (fxp) pxe.

Sure, it is at the bottom of this post. If the wordwrap thing comes out funny, email me and I can provide this for you via email or http post.

3 things to note:
-----------------
1) the CVS master has ssh dsa keys on all servers, including the firewall allowing for remote passwordless root access. The security implications should be clear, you want this box behind a firewall and locked up!
2) I put this script at the beginning of the script that goes out and updates the server and then put it at the end with the "off" argument to close off the firewall again.
3) The firewall has this as part of its pf.conf
--------------------------
# Current portmapped mountd ports
nfs_tcp="937"
nfs_udp="642"
nfs_server="192.168.0.22"
table { 192.168.0.1/32, ...}
[more stuff here]
# Port Forward traffic to CVS master
rdr on $ext_if proto udp from any to $external_addr port $nfs_udp -> $nfs_server port $nfs_udp
rdr on $ext_if proto tcp from any to $external_addr port $nfs_tcp -> $nfs_server port $nfs_tcp
rdr on $ext_if proto tcp from any to $external_addr port 2049 -> $nfs_server port 2049
rdr on $ext_if proto udp from any to $external_addr port 111 -> $nfs_server port 111
....
# Pass in rdr nfs traffic
pass in on $ext_if proto udp from to $nfs_server/32 port { 111, $nfs_udp } keep state
pass in on $ext_if proto tcp from to $nfs_server/32 port { 2049, $nfs_tcp } flags S/FSRPAU keep state
pass in on $ext_if proto tcp from to $nfs_server/32 port > 500 flags S/FSRPAU keep state
pass in on $ext_if proto udp from to $nfs_server/32 port > 500 keep state
---------------------------------------------


Here is the perl script I use:
----------------------------------------------
#!/usr/bin/perl

# Script to pull the current nfs portmapped ports for udp and tcp,
# then suck down the current firewall pf.conf from firewall. It
# then updates the nfs_udp and nfs_tcp ports gleaned from rpcinfo -p
# Finally, it scp the temp file back up to firewall and executes pfctl to initialize the new firewall.

# Usage: $0 [off]
# If the off argument is given, the script shuts down the port forwarding

$firewall = "firewall.yourdomain.com"; # or ip address


# Get current pf.conf from firewall
@pfconf = `ssh root@$firewall cat /etc/pf.conf`;
# Create temp pf.conf in /root/tmp/
$pf_tmp = "/root/tmp/pf.conf";
open(PF_FH, ">$pf_tmp");


# See if this is a request to turn on or off nfs on the firewall
if ($ARGV[0] eq "off") {
foreach $line (@pfconf) {
chomp($line);
if ($line =~ /^pass.+nfs_server/) {
$line=~ s/^pass/#pass/;
}
print PF_FH "$linen";
}
} else {
# Otherwise get current mountd ports and reload firewall
# Get current NFS/mountd tcp and udp ports
$rpcinfo = `rpcinfo -p`;
@rpcinfo = split(/n+/, $rpcinfo);
foreach $line (@rpcinfo) {
if ($line =~ /udp.+mountd/) {
chomp($line);
$line =~ s/.+([t|u])wws+(d+).+/$2/;
$udpport = $line;
}
if ($line =~ /tcp.+mountd/) {
chomp($line);
$line =~ s/.+([t|u])wws+(d+).+/$2/;
$tcpport = $line;
}
}

# update and print out new pf.conf
foreach $line (@pfconf) {
chomp($line);
# replace tcp port with current
if ($line =~ /^nfs_tcp/) {
$line = "nfs_tcp="$tcpport"";
}
# replace udp port with current
if ($line =~ /^nfs_udp/) {
$line = "nfs_udp="$udpport"";
}
# uncomment any commented out nfs_server lines
if ($line =~ /^#pass.+nfs_server/) {
$line =~ s/^#pass/pass/;
}
print PF_FH "$linen";
}
close(PF_FH);

}
# Send the new file back to firewall
system("scp $pf_tmp root@$firewall:/etc && ssh root@$firewall pfctl -f /etc/pf.conf");

I did not know openbsd supported netbooting.that is nice to hear.
we are a linux dev box.but I run OpenBSD on the firewalls and all production(DNS,Mail,etc) servers.
mainly because of the ports collection , security and consistency.I don't install compxx.tgz on the boxes, I do have one machine where I do the untar->configure->compile->install
cycle.I have hacked around SlackBuild scripts(yeah I know, but slack is the best of that breed) and it creates packages for Me,this have been working well for me in the last couple of years.
when it comes to kernel, I usually have 2 kernels
one for the mainstream hardware, and one specific(I got few soekris around for internal usage)
take a look at slackbuild. it would be nice to discover if something similar(or better) exists for OpenBSD.

I want to clean it up a little first, but then I'll post a link to it. I'll have it up by this weekend.

OK, since people are still interested I will release the scripts soon. :) I have actually been in the process of rewriting said perl script this past week. I need to update the documentation as well.
Send me an email if you are interested.