May 2, 2016

OpenBSD: After install

pf.conf

Connect to everything but block all incoming traffic

pyrrha# cat /etc/pf.conf
# $OpenBSD: pf.conf,v 1.54 2014/08/23 05:49:42 deraadt Exp $
#
# See pf.conf(5) and /etc/examples/pf.conf

# This was default
#set skip on lo
#
#block return # block stateless traffic
#pass # establish keep-state

# This is my pf.conf
block
pass from self to any
#a. Rule 1 blocks all traffic.
#b. Rule 2 passes all traffic originating on the laptop, going anywhere.

# By default, do not permit remote connections to X11
block return in on ! lo0 proto tcp to port 6000:6010

/etc/login.conf

First, make sure you belong to the class (not group) staff:

# user mod -L staff pau

Then give a bit more of RAM to programs


#
# Staff have fewer restrictions and can login even when nologins are set.
#
staff:\
#:datasize-cur=1536M:\
:datasize-cur=2048M:\
:datasize-max=infinity:\
:maxproc-max=512:\
:maxproc-cur=256:\
:ignorenologin:\
:requirehome@:\
:tc=default:

Secure screen after suspending

Use xdm: Since you do not want to leave a terminal open, do not start X with startx. This would leave open that terminal and launch X on another one. Since you are using xdm, you need a .xsession file instead of a .xinitrc. My .xsession file looks like

xmodmap -e "keycode 22 = BackSpace BackSpace BackSpace BackSpace BackSpace BackSpace"
pkill xidle
xidle -delay 5 -sw -program "/usr/X11R6/bin/xlock -mode blank" -timeout 90 &
qiv -zr $HOME/escriptori/Galicia/*
xset -b
cwm -c /home/pau/fitx_confg/cwm/cwmrc

The first line cancels the function Zap of X, which means that nobody can interrupt your X session by pressing CTRL+Alt+Backspace. xidle is necessary to launch the screensaver via xlock

Create /etc/apm/suspend and make it executable:


$ cat /etc/apm/suspend
#!/bin/sh
pkill -USR1 xidle

Make sure apm is running everytime after boot. If it is not, while your laptop will suspend, the script suspend will not be executed, and the screen will not be locked. To test if apmd is running, type zzz from the terminal. A message like zzz: cannot connect to apmd: No such file or directory Will tell you that your apmd is NOT running.

To have apmd run after boot, add a flag to rc.conf.local:

$ cat /etc/rc.conf.local
sshd_flags=NO
dbus_enable=YES
apmd_flags="-A"
xenodm_flags="YES"
mixerctl inputs.spkr.mute=on

Customize xdm

You can for instance change the background by adding an image and using qiv. For this, make a directory to store background images, e.g. /usr/local/share/backgrounds/pau and add images there. Then

# vim /etc/X11/xenodm/Xsetup_0

And change the console line to

#xconsole -geometry 480x130-0-0 -daemon -notify -verbose -fn fixed -exitOnFail
/usr/local/bin/qiv -zr /usr/local/share/backgrounds/pau/*

firefox

In about:config

Set these two options:

gfx.xrender.enabled true
layers.acceleration.force-enabled true