Messages

For most of these, you shouldn't use Suricata at all but use firewall aliases and rules to block these IPs directly, as it is (said to be) a lot more performant.

In Suricata, only use the following:
   
    abuse.ch/SSL Fingerprint Blacklist


Not sure if this is a rules or IP based list:
    abuse.ch/ThreatFox
   

Is it worth a clean upgrade just to get on ZFS

Absolutely.

Being able to do snapshots and backup boot environments (bectl) prior to upgrades is a god-send.

The thing that holds me back is recreating all the "custom" stuff that isn't backed up normally e.g. I have scripts that execute speed tests against 5 servers, some custom commands for Unbound and who know how many other tweaks I have probably forgotten about. I'd be installing to a new drive so getting anything back shouldn't be too difficult, just a pain, also fully reverting will be simple.

You could try to run a "diff" (compare directories etc.) between the two filesystems to find esp. custom scripts, config files etc.

Also, is it just a case of backing up the current installation, copying that to a USB drive then pointing the installer to that file?

Basically yes. You may have issues initially e.g. having to reinstall plugins  / repos but those can usually be sorted out pretty easily.

[pls disregard]

I noticed that the standard installation of the chrony plugin may not work as an NTS server. Can't tell for sure as I am not using a clean install. So putting this out here in case (1) it helps someone and/or (2) someone can help me improve / simplify my setup.

my issues:
chrony clients could not connect because of certificate errors.
1. the chrony plugin in server mode needs read access to the certificate and key. Without it, I got the following error:

Code Select Expand

# chronyd -Q -t 3 'server [myserver] iburst nts maxsamples 1'
...
... TLS handshake with [myserver] failed : The TLS connection was non-properly terminated.
...

2. the certificate needs to be the full chain. Without it, I got

Code Select Expand

# chronyd -Q -t 3 'server [myserver] iburst nts maxsamples 1'
...
... TLS handshake with [myserver] failed : Error in the certificate verification. The certificate is NOT trusted. The certificate issuer is unknown....

3. the standard OPNsense certificate & key at /var/etc/cert.pem / ..key.pem are read root only. I did not want to grant chrony access to it or include chrony in the "wheel" group.

What did I do?

1. set up a DNS alias for time.MYDOMAIN.TLD
2. set up a separate letsencrypt certificate for time.MYDOMAIN.TLD
3. set up an automation to have the certificate (full chain + key) be copied over to /var/lib/chrony and chmod those to chronyd and restart chrony:
a) set up the following backend action (https://docs.opnsense.org/development/backend/configd.html):

Code Select Expand

[NTS_renewal]
command:cp /var/etc/acme-client/home/time.XXXXX/fullchain.cer /var/lib/chrony/chrony.fullchain.cer && cp /var/etc/acme-client/home/time.XXXXX/time.XXXXX.key /var/lib/chrony/chrony.key && cp /var/etc/acme-client/home/time.XXXXX/time.XXXXX.cer /var/lib/chrony/chrony.cer && chown chronyd /var/lib/chrony/chrony.key /var/lib/chrony/chrony.cer /var/lib/chrony/chrony.fullchain.cer && /usr/local/etc/rc.d/chronyd stop && /usr/local/etc/rc.d/chronyd start
type:script
message: copy NTS certificates into chrony directory and make them readable
description: Renew NTS certificate & restart chrony (all in one go)
b) enable it:

Code Select Expand

service configd restart
c) setup an automation using this action in the ACME client for the NTS certificate.
4. Point chrony to his certificate and key:

Code Select Expand

ntsservercert /var/lib/chrony/chrony.fullchain.cer
ntsserverkey /var/lib/chrony/chrony.key
(not sure this will persist an update of the plugin though ...)

Now it seems to work. Hooray!  :D

resources:
- https://docs.opnsense.org/development/backend/configd.html
- https://unix.stackexchange.com/questions/712784/chrony-fails-to-sync-with-nts-enabled

pinging @mimugmail in case some of this could be intregrated into the plugin itself (as it purports to create a working NTS server which it _may_ not do).

Especially, it seems that the manual edits to the config file - specifically the "ntsservercert" / "ntsserverkey" part -- seem to be over-written ...

PS: https://forum.opnsense.org/index.php?topic=30993.0

Thanks!

Thank you both - I'll set up a .local on my system too to enable trim, scrub and snapshots.

You should add a permanent backend job as per https://docs.opnsense.org/development/backend/configd.html

Great - thank you for the pointer (and apologies for not RTFM).

Here is a very simple action for ZFS scrub and ZFS trim:

Code Select Expand

[trim]
command:zpool trim
parameters: %s
type:script_output
message: Run ZFS trim on specified pool
description: zpool trim [zpool]

[scrub]
command:zpool scrub
parameters: %s
type:script_output
message: Run ZFS scrub on specified pool
description: zpool scrub [zpool]

Is it possible to permanently save a script like zrep, zrepl, znapzend or syncoid/sanoid to the OPNsense system to enable periodic snapshots (and automatic pruning thereof)?

Or would it be possible to use and persistently configure the FreeBSD periodic.conf system?

I can connect but cannot upload to my ESXi server. IIRC, it was an issue with a filesystem command that SFTP wanted to run that ESXi didn't recognise/implement.  (manual scp from opnsense works)

config changes -> could this be an update / re-loading of DNSBL or a DCHP registration update?

For me, experience is different:

22.7.5 - all good
22.7.6 - high CPU temperatures, higher load
22.7.7 - all good, back to 22.7.5 levels

I used Adguard Settings/Client Settings to segregate lists of clients IP's and MAC addresses that bypass the global Adguard settings and get passed through directly to unbound

This would be my recommendation as well.

...you need to stop / start agh after update manually

This fixed my issue with the update from .15 to .16 - I had updated the plug-in but not restarted AGH.

Similar issue with the new update to .16 unfortunately...

Das hier wäre ein ziemlich guter deal: https://www.ebay-kleinanzeigen.de/s-anzeige/qotom-q335g4-mini-nano-pc-4-lan/2169711317-228-1776

Modell: Q335G4

Der PC ist gebraucht, voll funktionsfähig und ist technisch wie optisch einwandfrei.

CPU: Intel I3 5005U 2.0GHz (2 Kerne)

RAM: 8GB

SSD: 220GB

Netzwerk: 4 x Intel I211-AT- 1000 Controller

IDS needs a lot of performance, IPS even more so.

However, my 5250u can push a gigabit with IDS enabled. So you may need to tune your rules (less, and moving IP Blocklists to the firewall alias+rules) and configuration.