Document

Purpose and audience

This post aims to give a high-level introduction to the installation and configuration of FreeBSD and RANCID.
The tutorial is intended for newbies in the world of FreeBSD/RANCID.

Disclaimer

I’m myself fairly new to FreeBSD, as the content of this post will reflect.

Installing FreeBSD

Hardware

For my intallation I have choosen a very minimal configuration and it seems to work fine. If the server is supposed to perform several functions besides RANCID, you may want to scale accordingly.
And yes – this is a virtual machine. =)
Disk: 10GB
RAM: 512MB
CPU: Intel(R) Xeon(R) CPU X5650 @ 2.67GHz

Installation of FreeBSD

Just a quick tip before get started: When configuring usernames, hostnames, file names and the like – use ONLY lower case. The reason for this is that UNIX differentiate between, e.g., “Filename” and “filename”, whereas Microsoft consider them the same file. And by using only lower cases, you never run into such problems. =)

Now – onto the actual installation:

Fairly straight forward. I myself opted for installing SSH and NTP for remote management and time sync.
Although one thing to keep in mind is using FQDN as your hostname and configuring a DNS-server. RANCID uses sendmail to send you the configuration difference of your devices and sendmail require DNS to function properly.

Configuring IPFW

Locking down any box, especially systems your are somewhat unfamiliar with, might be worthwhile to increase the overall security.
From the resources I’ve used, it seems the appropriate way to configure your ipfw ruleset, is by running a script which is defined in /etc/rc.conf.

Word of advice – before enabling the firewall and messing about, make sure the configuration file (/etc/ipfw.sh) is complete and that you have physical access to the server in case you lock yourself out. =)

Create the /etc/ipfw.sh. I used a sample script and edited for my own purpose. We will edit the file shortly.

touch /etc/ipfw.sh
chmod 700 /etc/ipfw.sh

Edit rc.conf to enable the FW and to instruct it to run the script

firewall_enable=”YES”
firewall_script=”/etc/ipfw.sh”

My complete etc/rc.conf now looks like this:

hostname=”srv-rancid.mydomain.local”
keymap=”norwegian.iso.kbd”
ifconfig_em0=” inet 172.32.10.10 netmask 255.255.255.0″
defaultrouter=”172.32.10.1″
sshd_enable=”YES”
ntpd_enable=”YES”
firewall_enable=”YES”
firewall_script=”/etc/ipfw.sh”
# Set dumpdev to “AUTO” to enable crash dumps, “NO” to disable
dumpdev=”NO”
root@srv-rancid:/usr/home/rancid #

Edit the /etc/ipfw.sh-script with appropriate ruleset. I edited the sample configuration so it looks like this:

root@srv-rancid:/usr/home/rancid # cat /etc/ipfw.sh
#!/bin/sh
#
# flush existing rules
ipfw -q flush
# allow established connections
ipfw -q add 1 check-state
# allow loopback traffic
ipfw -q add 2 allow all from any to any via lo0
# allow previously established TCP connections
ipfw -q add 3 allow tcp from any to any established
#
# public services inbound: 22/tcp (SSH)
ipfw -q add 100 set 1 allow tcp from any to 172.32.10.10 22 in setup keep-state
#
# allow all traffic going out
ipfw -q add 200 set 1 allow udp from 172.32.10.10 to any out keep-state
ipfw -q add 201 set 1 allow tcp from 172.32.10.10 to any out setup keep-state
#
# allow common ICMP types in and out
ipfw -q add 400 set 1 allow icmp from 172.32.10.10 to any icmptypes 0,3,8,11,12,13,14
ipfw -q add 401 set 1 allow icmp from any to 172.32.10.10 icmptypes 0,3,8,11,12,13,14
#
# deny everything else coming in
ipfw -q add 999 set 1 deny all from any to any

Handy commmands with regards to IPFW

/etc/rc.d/ipfw restart # Restarts the IPFW and loads the rule set from ipfw.sh
ipfw list # Lists IPFWs ruleset.

My complete ipfw ruleset looks like this:

root@srv-rancid:/usr/home/rancid # ipfw list
00001 check-state
00002 allow ip from any to any via lo0
00003 allow tcp from any to any established
00100 allow tcp from any to 172.32.10.10 dst-port 22 in setup keep-state
00200 allow udp from 172.32.10.10 to any out keep-state
00201 allow tcp from 172.32.10.10 to any out setup keep-state
00400 allow icmp from 172.32.10.10 to any icmptypes 0,3,8,11,12,13,14
00401 allow icmp from any to 172.32.10.10 icmptypes 0,3,8,11,12,13,14
00999 deny ip from any to any
65535 deny ip from any to any

Appearantly you can not remove entry 65535 (not by the command ipfw -q flush anyway), so the script will include two rules denying all other traffic than those explicity allowed.
I still feel safer having the drop rule in the script file, rather than leaving it out.

Logging of firewall

Firewall logging is feasible for many installations, but I have choosen not to log anything in order to conserve hardware resources.
To enable firewall logging the /etc/rc.conf also needs the following parameter

firewall_logging=”YES”

Firewall rules with the “log” keyword will be written to syslog.
For more information on the matter I refer to the FreeBSD handbook: http://www.freebsd.org/doc/handbook/firewalls-ipfw.html

Resources IPFW

1) http://www.freebsd.org/doc/en/articles/linux-users/firewall.html
2) https://manage.rootbsd.net/knowledgebase/30/IPFW-sample-configuration.html
3) http://www.freebsd.org/doc/handbook/firewalls-ipfw.html
Plenty of information for you there. =)

Administration

Webmin is a webbased administration tool for unix-like systems. Although not covered here, I found it worthwhile to mention it in case you would like some graphical interface.
A quick google search of freebsd webmin produced several tutorials on the subject. =)

RANCID

Introduction to RANCID

RANCID is a tool which runs various commands on your network equipment and keeps track of changes using CVS.
Personally I find RANCID very neat for two reasons;

1. It provides historical records for changes to the network equipment
2. It keeps an up-to-date configuration of your network equipment. And not only that, it also takes down information regarding software versions, hardware information (serial numbers, modules, etc), vlans and more.

 

Installing RANCID

Installation of RANCID was, to be honest, dead simple when I followed a guide I found online (see resouces further down) and since the authors steps worked quite brilliantly I’ll more or less repeat them here.


And I will repeat the tip I previously mentioned: When configuring usernames, hostnames, file names and the like – use ONLY lower case. The reason for this is that UNIX differentiate between “Filename” and “filename”, whereas Microsoft consider them the same file. And by using only lower cases, you never run into such problems. =)


Onwards to the steps!

1. Add a new user called rancid and add it to the wheel group. A membership in the wheel group allows you to execute the command “su” and obtain root privileges.
Issue the command and follow onscreen instructions

# adduser

2. Update your port-collection, which essentially is the make files for various applications.

# portsnap fetch update

3. Install RANCID from the abeforementioned port-collections

# cd /usr/ports/net-mgmt/rancid/
make install clean

The installation did take quite some time for me, as it needed to download a truck load of different files.
During the installation of the different packages I left all choices in default.

4. Copy /usr/local/etc/rancid/rancid.conf.sample to /usr/local/etc/rancid/rancid.conf.

# cp /usr/local/etc/rancid/rancid.conf.sample /usr/local/etc/rancid/rancid.conf

5. Edit rancid.conf. Change and uncomment the following line.

LIST_OF_GROUPS=”CiscoDevices”

You may choose a more granular approach if you have alot of devices. E.g. CiscoDevicesHQ and CiscoDevicesSateliteoffices.
But I will use one group for all my devices.

6. Login as user “rancid” and create the devices password file

$ touch /home/rancid/.cloginrc

Q: Am I going to store username and passwords in a plain text file?
A: Yes. Take appropriate steps in order to ensure the box is locked down as tight as possible. =)

7. Edit your .cloginrc – This file will include usernames, passwords and login methods for your equipment. I will try to explain how this works using my own file as an example.

$ vi /home/rancid/.cloginrc

add user 172.10.1.8 admin
add user 172.20.1.5 admin
add password 172.10.1.8 MyAdminPASSWORD MyEnablePASSWORD
add password 172.20.1.5 MyAdminPASSWORD MyEnablePASSWORD
add password * MyTelnetPassword MyEnablePassword

add method 172.10.1.8 ssh
add method 172.20.1.5 ssh
add method * telnet

I have a mixture of devices where I require SSH-login to some and telnet to others. In this example you will notice the following:

• I have added a username for two specific devices.
• I have added passwords for two specific devices.
• I have added passwords for all (asterisk) devices.
• I have added SSH as login method for two specific devices.
• I have added telnet as login method for all (asterisk) devices.

This means RANCID will log onto 172.20.1.8 and 172.20.1.5 using SSH with username admin and MyAdminPASSWORD, then getting to enable-mode using password MyEnablePASSWORD.
It also means all other devices will be logged onto using telnet with telnet-password MyTelnetPassword and then getting to enable-mode using password MyEnablePassword.

Tips’n’tricks

• The asterisk works as a wildcard, which means I could also write “add method 172.10.1.* ssh” if I wanted SSH as the login method for all switches on this particular network.
• You can also use hostnames rather than IP-addresses. This requires your network equipment to be present in DNS or manually configured in your RANCID servers “/etc/hosts”-file

I hope this was understandable. =)

8. Make the .cloginrc-file writable only by your rancid user

$ chmod 600 /home/rancid/.cloginrc

9. The installation may have created /usr/local/var/rancid/ directory. We want to remove that and re-create it with the user rancid.
In order to enable our rancid-user to create the directory, we will have to change the directory permissions as well

$ su
Password:
# rm –r /usr/local/var/rancid
# chmod 775 /usr/local/var
# exit
$ mkdir /usr/local/var/rancid

10. Now you will create the initial directory structure and then data directories

$ /usr/local/bin/rancid-run
$ /usr/local/bin/rancid-cvs

11. The structure should be in place with the group name you configured in step 5.

$ cd /usr/local/var/rancid/CiscoDevices

12. In this directory you should find a file called router.db – edit this file and enter your network devices.
As you may understand, the first parameter is the device IP/hostname, the second is which device type we are talking about and the third parameter defines wether the device is up or down and should be scanned.

vi router.db

172.10.1.5:cisco:up
172.10.1.6:cisco:up
172.10.1.8:cisco:up
172.10.1.10:cisco:up
172.10.1.11:cisco:up
172.10.1.12:cisco:up
172.10.1.13:cisco:up
172.20.1.5:cisco:up
172.20.1.6:cisco:up
172.20.1.7:cisco:up

 

13. Now we will configure some parameters with regards to e-mail – that is if you want the configuration changes sent to you and/or your IT-network e-mail.
Edit /etc/aliases and add your e-mail

$ su
Password:
# vi /etc/aliases

rancid-CiscoDevices: gos@networkoc.net
rancid-admin-CiscoDevices: gos@networkoc.net

If you used a different group name (or several for that matter) you need to add those to the file.

14. Assuming you are running FreeBSD in default and therefore using sendmail, you now issue the follow command which moves/convertes/does something with /etc/aliases.

# newaliases

15. Run rancid again – as the user rancid. Do not run rancid as root.

# exit
$ /usr/local/bin/rancid-run

If everything is ok, you should receive an e-mail shortly with configuration changes (which is the whole config as it will be the intial configuration).
Note: Because your rancid server will act as a SMTP-server, an entry for your server needs to be present on your DNS-server. I tried fooling it by editing /etc/hosts and so on, but landed squarely on using DNS rather than a hack.

16. Since everything went smoothly and you received an e-mail and the directories was populated with configuration files, you probably want RANCID to run automatically. Cron will aid you with this.
Configure cron with the rancid-user

$ crontab -e

1 * * * * /usr/local/bin/rancid-run

$ crontab -l
# Run config differ hourly
1 * * * * /usr/local/bin/rancid-run

I run RANCID hourly (note the 1 means one minute past every hour 22:01, 23:01) – you will only receive e-mail if there is a configuration change, so your inbox won’t be cluttered by RANCID. =)

Directories and files of particular interest

“CiscoDevices” is a parameter during installation, so if you use a different group name when configuring RANCID, the directory will also change accordingly.

# The flatfile where you enter the IP/hostname of network equipment you wish to backup
/usr/local/var/rancid/CiscoDevices/router.db

# Your network equipments initial configuration and subsequent changes
/usr/local/var/rancid/CVS/CiscoDevices/configs/

# Current configuration of your network equipment
/usr/local/var/rancid/CiscoDevices/configs/

# RANCID Log files
/usr/local/var/rancid/logs/

# Log file – sendmail
/var/log/maillog

# Log file – cron
/var/log/cron

Commands

# Manually run RANCID
/usr/local/bin/rancid-run

Resources RANCID

Guide to installing and configuring RANCID by Bruco: http://uberbruco.wordpress.com/2009/07/09/rancid-on-freebsd/
RANCID home page: http://www.shrubbery.net/rancid/


Hope this guide helps you getting started with your RANCID-installation!