Download

OgmaProtect v0.5.7

Signed for OpenBSD 7.9. Five steps, about ten minutes. Run every command on the router itself, as root — or, if you have doas(1) configured, prefix the privileged ones with doas.

Before you start

OpenBSD 7.9 installed on the router, and a root shell on it (log in as root, or su -). A stock install has no /etc/doas.conf, so the commands here do not use doas.
Network access from the router to this site and to your package mirror — the install pulls two dependencies, sqlite3 and p5-CGI, from the mirror you already use.
A browser on your laptop, for the login at the end. That is the whole client.
One shell session for steps 1 to 3: later commands use values read by earlier ones.

Before you run it

OgmaProtect is licensed under the PolyForm Small Business License 1.0.0, not open source. It is free to use for a company with fewer than 100 people and under USD 1M (2019, inflation-adjusted) revenue in the prior tax year — both conditions must hold. Beyond that it needs a commercial licence from Wireless Connect Ltd.. Downloading is unrestricted; using it is what the terms govern. See pricing & licensing.

Install in five steps

Paste each block in order. Every check prints OK or a line starting STOP — on STOP, do not go on.

Install our signing key (once per box). Read the key record:

rec=$(dig +short TXT security.ogmaconnect.com | \
  tr -d '"' | grep signer=ogmaprotect-05-pkg)
[ -n "$rec" ] && echo "$rec" || echo "STOP - no record found; check DNS"

Check its keynum against this page's, d1ea448c55bce1d6:

keynum=$(echo "$rec" | sed -n 's/.*keynum=\([^;]*\).*/\1/p')
[ "$keynum" = "d1ea448c55bce1d6" ] && echo "keynum OK" || \
  echo "STOP - keynum does not match the page"

Write the key to disk:

key=$(echo "$rec" | sed -n 's/.*key=\([^;]*\).*/\1/p')
c='untrusted comment: OgmaProtect 0.5 series package signing key public key'
f=/etc/signify/ogmaprotect-05-pkg.pub
[ -n "$key" ] && { echo "$c"; echo "$key"; } > $f && \
  echo "key written" || echo "STOP - could not write the key (are you root?)"

Confirm the file matches the record:

hash=$(echo "$rec" | sed -n 's/.*sha256=\([^;]*\).*/\1/p')
[ "$(sha256 -q $f)" = "$hash" ] && echo "key OK" || \
  echo "STOP - key does not match the record"

Download the three files you need:

mkdir -p ~/ogmaprotect && cd ~/ogmaprotect
ftp https://ogmaprotect.com/download/ogmaprotect-0.5.7.tgz
ftp https://ogmaprotect.com/download/SHA256.sig
ftp https://ogmaprotect.com/download/RELEASE-INFO

Verify them. You want OK on every file line:

signify -C -p /etc/signify/ogmaprotect-05-pkg.pub -x SHA256.sig \
  ogmaprotect-0.5.7.tgz RELEASE-INFO

Signature Verified
ogmaprotect-0.5.7.tgz: OK
RELEASE-INFO: OK

Check the package was built for this box's OpenBSD release:

b=$(sed -n 's/^built_for_openbsd: *//p' RELEASE-INFO)
[ "$b" = "$(uname -r)" ] && echo "release OK" || \
  echo "STOP - package is for OpenBSD $b, this box runs $(uname -r)"

Install the package (starts nothing yet):
```
pkg_add ./ogmaprotect-0.5.7.tgz
```
Set up and start everything (prints a one-time admin password to the console):
```
ogmaprotect-setup bootstrap
```
Then sign in as admin at https://<this-host>/ogmaprotect/ and change the password when asked.

A step says STOP, or you want to do step 1 by hand: details. Setting up by hand instead of bootstrap: Get started.

Optional: add the threat feed

Once your firewall is installed, you can buy a threat-feed subscription in the customer portal and activate it on your firewall. Follow the activation steps.

Steps 2 to 4, in one paste

Once the signing key from step 1 is on the box. Chained with &&, so it stops at the first failure rather than installing something that did not verify or was built for another OpenBSD release. It ends at an installed package — run step 5 yourself when you are ready to bring the box up.

mkdir -p ~/ogmaprotect && cd ~/ogmaprotect &&
ftp https://ogmaprotect.com/download/ogmaprotect-0.5.7.tgz &&
ftp https://ogmaprotect.com/download/SHA256.sig &&
ftp https://ogmaprotect.com/download/RELEASE-INFO &&
signify -C -p /etc/signify/ogmaprotect-05-pkg.pub -x SHA256.sig \
  ogmaprotect-0.5.7.tgz RELEASE-INFO &&
[ "$(sed -n 's/^built_for_openbsd: *//p' RELEASE-INFO)" = \
  "$(uname -r)" ] &&
pkg_add ./ogmaprotect-0.5.7.tgz

All release files

The steps above fetch only the files marked Yes. The others are here for audit and ports builds.

File	What it is	Needed to install?	Size
`ogmaprotect-0.5.7.tgz`	The OpenBSD package. This is what you install, with pkg_add.	Yes	8.7 MB
`SHA256.sig`	The signed checksum list. Used by signify -C in step 3 to verify the package.	Yes	< 1 KB
`RELEASE-INFO`	Which OpenBSD release the package was built for. Step 3 compares it with uname -r.	Yes	< 1 KB
`SHA256`	The same checksum list, unsigned, to read. SHA256.sig already contains it.	No	< 1 KB

Upgrading

Download and verify the new release with steps 1 to 3, take a snapshot, then upgrade in place:

pkg_add -r ./ogmaprotect-0.5.7.tgz

Or by name, from our package repository:

env PKG_PATH="https://ogmaprotect.com/pkg/%c/packages/%a/:installpath" \
  pkg_add -u ogmaprotect

Upgrades are forward-only: the snapshot of /var/db/ogmaprotect is your only way back.

Full sequence (stop the daemons, take the snapshot, start back up): Get started.

Details

If a step says STOP, or you want to do step 1 by hand.

Step 1 says STOP

no record found: the DNS lookup of security.ogmaconnect.com failed. Fix DNS, then start step 1 again.
keynum does not match the page: do not install. Tell us.
could not write the key: you are not root (log in as root, or su -).
key does not match the record: run step 1 again from the top, in one shell.

Step 1 by hand

Look up the TXT record for security.ogmaconnect.com and take the one with signer=ogmaprotect-05-pkg. It looks like this:

v=ogmaprotect-anchor1; signer=ogmaprotect-05-pkg; keynum=d1ea448c55bce1d6; key=<base64>; sha256=<hash>

Check its keynum= is d1ea448c55bce1d6, then, as root, write the key with the key= value on the second line:

cat > /etc/signify/ogmaprotect-05-pkg.pub <<EOF
untrusted comment: OgmaProtect 0.5 series package signing key public key
<the base64 value of key= from the TXT record>
EOF

sha256 /etc/signify/ogmaprotect-05-pkg.pub must print the record's sha256= value.

Step 1: where the key comes from

The key is published in DNS on a different domain and provider from this site, so one compromised account cannot give you both a forged package and its key. The keynum check against this page is what ties the two together; do not skip it.

Step 3 says FAIL or STOP

Signature Verified only means the checksum list is ours. Read the per-file lines: you need OK on every one. A bad download looks like this:

Signature Verified
ogmaprotect-0.5.7.tgz: FAIL

Download again. If it fails a second time, do not install; tell us.

The release check says STOP when the package was built for a different OpenBSD release than this box runs. It would install but not run; get the package for your release.

Step 4: pkg_add refuses the package

Do not use -D unsigned. Check that /etc/signify/ogmaprotect-05-pkg.pub exists and has exactly that name (step 1). If it does, the package is not one of ours.

Step 5: missed the one-time password

It is printed on the machine console only. Installed over SSH? Set a new one:

ogmaprotectctl user set-password admin

What bootstrap does, and setting up by hand instead: Get started.

An older release still verifies

Our signatures do not expire, so a genuine older package passes every check. Make sure the version you downloaded is the one the advisory told you to install. More in Security & supply chain.