From 30fc4e8f74315a92aaec36dfb9a8d4efa0a21791 Mon Sep 17 00:00:00 2001 From: Paul Buetow Date: Fri, 7 Apr 2023 00:49:19 +0300 Subject: exact style --- .../2022-10-30-installing-dtail-on-openbsd.html | 167 ++++++++++++++------- 1 file changed, 116 insertions(+), 51 deletions(-) (limited to 'gemfeed/2022-10-30-installing-dtail-on-openbsd.html') diff --git a/gemfeed/2022-10-30-installing-dtail-on-openbsd.html b/gemfeed/2022-10-30-installing-dtail-on-openbsd.html index feebd9fd..53bd9b1c 100644 --- a/gemfeed/2022-10-30-installing-dtail-on-openbsd.html +++ b/gemfeed/2022-10-30-installing-dtail-on-openbsd.html @@ -8,8 +8,10 @@ -

Installing DTail on OpenBSD

Published at 2022-10-30T11:03:19+02:00

Installing DTail on OpenBSD

+
+Published at 2022-10-30T11:03:19+02:00
+

        ,_---~~~~~----._
  _,,_,*^____      _____``*g*\"*,
@@ -46,18 +48,29 @@
                             /   `._____V_____V'
                                        '     '

This will be a quick blog post, as I am busy with my personal life now. I have relocated to a different country and am still busy arranging things. So bear with me :-)

In this post, I want to give a quick overview (or how-to) about installing DTail on OpenBSD, as the official documentation only covers Red Hat and Fedora Linux! And this blog post will also be used as my reference!

-https://dtail.dev
-

I am using Rexify for my OpenBSD automation. Check out the following article covering my Rex setup in a little bit more detail:

-Let's Encrypt with OpenBSD and Rex
-

I will also mention some relevant Rexfile snippets in this post!

Compile it

First of all, DTail needs to be downloaded and compiled. For that, git, go, and gmake are required:

+
+This will be a quick blog post, as I am busy with my personal life now. I have relocated to a different country and am still busy arranging things. So bear with me :-)
+
+ In this post, I want to give a quick overview (or how-to) about installing DTail on OpenBSD, as the official documentation only covers Red Hat and Fedora Linux! And this blog post will also be used as my reference!
+
+https://dtail.dev
+
+I am using Rexify for my OpenBSD automation. Check out the following article covering my Rex setup in a little bit more detail:
+
+Let's Encrypt with OpenBSD and Rex
+
+I will also mention some relevant Rexfile snippets in this post!
+
+

Compile it

+
+First of all, DTail needs to be downloaded and compiled. For that, git, go, and gmake are required:
+

 $ doas pkg_add git go gmake

I am happy that the Go Programming Language is readily available in the OpenBSD packaging system. Once the dependencies got installed, clone DTail and compile it:

+
+I am happy that the Go Programming Language is readily available in the OpenBSD packaging system. Once the dependencies got installed, clone DTail and compile it:
+

 $ mkdir git
 $ cd git
@@ -65,32 +78,44 @@ $ git clone https://github.com/mimecast/dtail
 $ cd dtail
 $ gmake

You can verify the version by running the following command:

+
+You can verify the version by running the following command:
+

 $ ./dtail --version
  DTail  4.1.0  Protocol 4.1  Have a lot of fun!
 $ file dtail
  dtail: ELF 64-bit LSB executable, x86-64, version 1

Now, there isn't any need anymore to keep git, go and gmake, so they can be deinstalled now:

+
+Now, there isn't any need anymore to keep git, go and gmake, so they can be deinstalled now:
+

 $ doas pkg_delete git go gmake

One day I shall create an official OpenBSD port for DTail.

Install it

Installing the binaries is now just a matter of copying them to /usr/local/bin as follows:

+
+One day I shall create an official OpenBSD port for DTail.
+
+

Install it

+
+Installing the binaries is now just a matter of copying them to /usr/local/bin as follows:
+

 $ for bin in dserver dcat dgrep dmap dtail dtailhealth; do
   doas cp -p $bin /usr/local/bin/$bin
   doas chown root:wheel /usr/local/bin/$bin
 done

Also, we will be creating the _dserver service user:

+
+Also, we will be creating the _dserver service user:
+

 $ doas adduser -class nologin -group _dserver -batch _dserver
 $ doas usermod -d /var/run/dserver/ _dserver

The OpenBSD init script is created from scratch (not part of the official DTail project). Run the following to install the bespoke script:

+
+The OpenBSD init script is created from scratch (not part of the official DTail project). Run the following to install the bespoke script:
+

 $ cat <<'END' | doas tee /etc/rc.d/dserver
 #!/bin/ksh
@@ -112,8 +137,11 @@ rc_cmd $1 &
 END
 $ doas chmod 755 /etc/rc.d/dserver

Rexification

This is the task for setting it up via Rex. Note the . . . ., that's a placeholder which we will fill up more and more during this blog post:

+
+

Rexification

+
+This is the task for setting it up via Rex. Note the . . . ., that's a placeholder which we will fill up more and more during this blog post:
+

 desc 'Setup DTail';
 task 'dtail', group => 'frontends',
@@ -136,14 +164,19 @@ task 'dtail', group => 'frontends',
       service 'dserver', ensure => 'started';
    };

Configure it

Now, DTail is fully installed but still needs to be configured. Grab the default config file from GitHub ...

+
+

Configure it

+
+Now, DTail is fully installed but still needs to be configured. Grab the default config file from GitHub ...
+

 $ doas mkdir /etc/dserver
 $ curl https://raw.githubusercontent.com/mimecast/dtail/master/samples/dtail.json.sample |
     doas tee /etc/dserver/dtail.json

... and then edit it and adjust LogDir in the Common section to /var/log/dserver. The result will look like this:

+
+... and then edit it and adjust LogDir in the Common section to /var/log/dserver. The result will look like this:
+

   "Common": {
     "LogDir": "/var/log/dserver",
@@ -154,8 +187,11 @@ $ curl https://raw.githubusercontent.com/mimecast/dtail/master/samples/dtail.jso
     "LogLevel": "Info"
   }

Rexification

That's as simple as adding the following to the Rex task:

+
+

Rexification

+
+That's as simple as adding the following to the Rex task:
+

 file '/etc/dserver',
   ensure => 'directory';
@@ -167,9 +203,13 @@ file '/etc/dserver/dtail.json',
   mode => '755',
   on_change => sub { $restart = TRUE };

Update the key cache for it

DTail relies on SSH for secure authentication and communication. However, the system user _dserver has no permission to read the SSH public keys from the user's home directories, so the DTail server also checks for available public keys in an alternative path /var/run/dserver/cache.

The following script, populating the DTail server key cache, can be run periodically via CRON:

+
+

Update the key cache for it

+
+DTail relies on SSH for secure authentication and communication. However, the system user _dserver has no permission to read the SSH public keys from the user's home directories, so the DTail server also checks for available public keys in an alternative path /var/run/dserver/cache.
+
+The following script, populating the DTail server key cache, can be run periodically via CRON:
+

 $ cat <<'END' | doas tee /usr/local/bin/dserver-update-key-cache.sh
 #!/bin/ksh
@@ -209,13 +249,18 @@ echo 'All set...'
 END
 $ doas chmod 500 /usr/local/bin/dserver-update-key-cache.sh

Note that the script above is a slight variation of the official DTail script. The official DTail one is a bash script, but on OpenBSD, there's ksh. I run it once daily by adding it to the daily.local:

+
+Note that the script above is a slight variation of the official DTail script. The official DTail one is a bash script, but on OpenBSD, there's ksh. I run it once daily by adding it to the daily.local:
+

 $ echo /usr/local/bin/dserver-update-key-cache.sh | doas tee -a /etc/daily.local
 /usr/local/bin/dserver-update-key-cache.sh

Rexification

That's done by adding ...

+
+

Rexification

+
+That's done by adding ...
+

 file '/usr/local/bin/dserver-update-key-cache.sh',
   content => template('./scripts/dserver-update-key-cache.sh.tpl'),
@@ -225,9 +270,13 @@ file '/usr/local/bin/dserver-update-key-cache.sh',
 
 append_if_no_such_line '/etc/daily.local', '/usr/local/bin/dserver-update-key-cache.sh';

... to the Rex task!

Start it

Now, it's time to enable and start the DTail server:

+
+... to the Rex task!
+
+

Start it

+
+Now, it's time to enable and start the DTail server:
+

 $ sudo rcctl enable dserver
 $ sudo rcctl start dserver
@@ -249,7 +298,9 @@ INFO|1022-090739|86050|stats.go:53|2|11|7|||MAPREDUCE:STATS|currentConnections=0
 .
 Ctr+C

As we don't want to wait until tomorrow, let's populate the key cache manually:

+
+As we don't want to wait until tomorrow, let's populate the key cache manually:
+

 $ doas /usr/local/bin/dserver-update-key-cache.sh
 Updating SSH key cache
@@ -261,9 +312,13 @@ Caching /home/paul/.ssh/authorized_keys -> /var/cache/dserver/paul.authorized
 Caching /home/rex/.ssh/authorized_keys -> /var/cache/dserver/rex.authorized_keys
 All set...

Use it

The DTail server is now ready to serve connections. You can use any DTail commands, such as dtail, dgrep, dmap, dcat, dtailhealth, to do so. Checkout out all the usage examples on the official DTail page.

I have installed DTail server this way on my personal OpenBSD frontends blowfish, and fishfinger, and the following command connects as user rex to both machines and greps the file /etc/fstab for the string local:

+
+

Use it

+
+The DTail server is now ready to serve connections. You can use any DTail commands, such as dtail, dgrep, dmap, dcat, dtailhealth, to do so. Checkout out all the usage examples on the official DTail page.
+
+I have installed DTail server this way on my personal OpenBSD frontends blowfish, and fishfinger, and the following command connects as user rex to both machines and greps the file /etc/fstab for the string local:
+

 ❯ ./dgrep -user rex -servers blowfish.buetow.org,fishfinger.buetow.org --regex local /etc/fstab
 CLIENT|earth|WARN|Encountered unknown host|{blowfish.buetow.org:2222 0xc0000a00f0 0xc0000a61e0 [blowfish.buetow.org]:2222 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9ZnF/LAk14SgqCzk38yENVTNfqibcluMTuKx1u53cKSp2xwHWzy0Ni5smFPpJDIQQljQEJl14ZdXvhhjp1kKHxJ79ubqRtIXBlC0PhlnP8Kd+mVLLHYpH9VO4rnaSfHE1kBjWkI7U6lLc6ks4flgAgGTS5Bb7pLAjwdWg794GWcnRh6kSUEQd3SftANqQLgCunDcP2Vc4KR9R78zBmEzXH/OPzl/ANgNA6wWO2OoKKy2VrjwVAab6FW15h3Lr6rYIw3KztpG+UMmEj5ReexIjXi/jUptdnUFWspvAmzIl6kwzzF8ExVyT9D75JRuHvmxXKKjyJRxqb8UnSh2JD4JN [23.88.35.144]:2222 ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC9ZnF/LAk14SgqCzk38yENVTNfqibcluMTuKx1u53cKSp2xwHWzy0Ni5smFPpJDIQQljQEJl14ZdXvhhjp1kKHxJ79ubqRtIXBlC0PhlnP8Kd+mVLLHYpH9VO4rnaSfHE1kBjWkI7U6lLc6ks4flgAgGTS5Bb7pLAjwdWg794GWcnRh6kSUEQd3SftANqQLgCunDcP2Vc4KR9R78zBmEzXH/OPzl/ANgNA6wWO2OoKKy2VrjwVAab6FW15h3Lr6rYIw3KztpG+UMmEj5ReexIjXi/jUptdnUFWspvAmzIl6kwzzF8ExVyT9D75JRuHvmxXKKjyJRxqb8UnSh2JD4JN 0xc0000a2180}
@@ -275,24 +330,34 @@ CLIENT|earth|INFO|Added hosts to known hosts file|/home/paul/.ssh/known_hosts
 REMOTE|blowfish|100|7|fstab|31bfd9d9a6788844.h /usr/local ffs rw,wxallowed,nodev 1 2
 REMOTE|fishfinger|100|7|fstab|093f510ec5c0f512.h /usr/local ffs rw,wxallowed,nodev 1 2

Running it the second time, and given that you trusted the keys the first time, it won't prompt you for the host keys anymore:

+
+Running it the second time, and given that you trusted the keys the first time, it won't prompt you for the host keys anymore:
+

 ❯ ./dgrep -user rex -servers blowfish.buetow.org,fishfinger.buetow.org --regex local /etc/fstab
 REMOTE|blowfish|100|7|fstab|31bfd9d9a6788844.h /usr/local ffs rw,wxallowed,nodev 1 2
 REMOTE|fishfinger|100|7|fstab|093f510ec5c0f512.h /usr/local ffs rw,wxallowed,nodev 1 2

Conclusions

It's a bit of manual work, but it's ok on this small scale! I shall invest time in creating an official OpenBSD port, though. That would render most of the manual steps obsolete, as outlined in this post!

Check out the following for more information:

-https://dtail.dev
-https://github.com/mimecast/dtail
-https://www.rexify.org
-

Conclusions

+
+It's a bit of manual work, but it's ok on this small scale! I shall invest time in creating an official OpenBSD port, though. That would render most of the manual steps obsolete, as outlined in this post!
+
+Check out the following for more information:
+
+https://dtail.dev
+https://github.com/mimecast/dtail
+https://www.rexify.org
+
+Other related posts are:
+
+2022-10-30 Installing DTail on OpenBSD (You are currently reading this)
+2022-03-06 The release of DTail 4.0.0
+2021-04-22 DTail - The distributed log tail program
+
+E-Mail your comments to hi@paul.cyou :-)
+
+Back to the main site