addrs capability of rtadvd?

2019-08-16 Thread John-Mark Gurney
I am setting up ipv6, and going through the guide at: https://www.freebsd.org/doc/handbook/network-ipv6.html#idp71931000 And noticed the addrs#1 property in the example. I checked the rtadvd.conf man page, and I do not see an entry for addrs. Should this be removed? I also did a quick check of

Re: NFSv4 without Kerberos

2019-08-16 Thread Alexander Lunev via freebsd-net
1 - setting the sysctls vfs.nfsd.enable_stringtouid=1 vfs.nfs.enable_uidtostring=1 Allows the uid/gid to be put in the Owner/Owner_group string as a number (ie "1001"). This avoids any need to run the nfsuserd if all mounts are sec=sys. This is now the default for

Re: NFSv4 without Kerberos [solved]

2019-08-16 Thread Alexander Lunev via freebsd-net
I've already tried in any order, it doesn't change anything. In any order mountd on server complain to attributes? Order in exports file don't matter, if there are no errors then any order will work. All FS on UFS? Yes. I found it: should be # mount_nfs -o nfsv4 10.101.0.1:/ /mnt and

Re: NFSv4 without Kerberos

2019-08-16 Thread Alexander Lunev via freebsd-net
In another place (11.2-R) i've already done NFSv4 mount where ubuntu mounts share from freebsd via nfsv4 with sec=sys without any problem, but here (11.3) i can't make it work - maybe the reason is that client is diskless and root mounted by NFSv3 from the same server? Are the directories you

Re: Software IPSEC AES-CTR/SHA-256 broken

2019-08-16 Thread Eugene Grosbein
16.08.2019 19:45, Eugene Grosbein wrote: Sorry for some misprints, fixes follow: > Hi! > > I used IPSEC/gif (ipencap) with static Blowfish/SHA1 keys for years for VPN > tunnels between FreeBSD routers. > > After recent Blowfish deprecation notice, I tried switching to > AES-CTR/SHA-256 instea

Re: NFSv4 without Kerberos

2019-08-16 Thread Slawa Olhovchenkov
On Fri, Aug 16, 2019 at 03:37:49PM +0300, Alexander Lunev via freebsd-net wrote: > > /NFS -maproot=root -sec=krb5i > > V4: /NFS -sec=krb5i > > > > and this work ok for nfsv4 mount (mount -t nfsv4 host:/) > > > > May be order is important? > > I've already tried in any order, it doesn't change

Re: NFSv4 without Kerberos

2019-08-16 Thread Patrick M. Hausen
i all, > Am 16.08.2019 um 14:37 schrieb Alexander Lunev via freebsd-net > : > >> /NFS -maproot=root -sec=krb5i >> V4: /NFS -sec=krb5i >> and this work ok for nfsv4 mount (mount -t nfsv4 host:/) >> May be order is important? > > I've already tried in any order, it doesn't change anything. > >

Software IPSEC AES-CTR/SHA-256 broken

2019-08-16 Thread Eugene Grosbein
Hi! I used IPSEC/gif (ipencap) with static Blowfish/SHA1 keys for years for VPN tunnels between FreeBSD routers. After recent Blowfish deprecation notice, I tried switching to AES-CTR/SHA-256 instead only to find that transit RDP TCP streams start to break often (every 20 minutes or so). I swi

Re: NFSv4 without Kerberos

2019-08-16 Thread Alexander Lunev via freebsd-net
/NFS -maproot=root -sec=krb5i V4: /NFS -sec=krb5i and this work ok for nfsv4 mount (mount -t nfsv4 host:/) May be order is important? I've already tried in any order, it doesn't change anything. In another place (11.2-R) i've already done NFSv4 mount where ubuntu mounts share from freebsd v

[Bug 239694] Some ipseclog() invocations miss newline

2019-08-16 Thread bugzilla-noreply
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=239694 Andrey V. Elsukov changed: What|Removed |Added CC||a...@freebsd.org Resol

[Bug 239694] Some ipseclog() invocations miss newline

2019-08-16 Thread bugzilla-noreply
https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=239694 --- Comment #2 from commit-h...@freebsd.org --- A commit references this bug: Author: ae Date: Fri Aug 16 12:27:19 UTC 2019 New revision: 351116 URL: https://svnweb.freebsd.org/changeset/base/351116 Log: MFC r350816: Add missing new

Re: NFSv4 without Kerberos

2019-08-16 Thread Slawa Olhovchenkov
On Fri, Aug 16, 2019 at 03:09:22PM +0300, Alexander Lunev via freebsd-net wrote: > > And add to exports: > > > > /mnt/v4share -sec=sys -network 10.101.0 -mask 255.255.255.0 > > It gives mountd error: > > bad exports list line '/mnt/v4share -sec' > > If I remove -sec=sys, then mountd errors in

Re: NFSv4 without Kerberos

2019-08-16 Thread Alexander Lunev via freebsd-net
And add to exports: /mnt/v4share -sec=sys -network 10.101.0 -mask 255.255.255.0 It gives mountd error: bad exports list line '/mnt/v4share -sec' If I remove -sec=sys, then mountd errors in /var/log/messages: can't change attributes for /mnt/v4share: netcred already exists for given addr/mas

Re: NFSv4 without Kerberos

2019-08-16 Thread Slawa Olhovchenkov
On Fri, Aug 16, 2019 at 02:44:34PM +0300, Alexander Lunev via freebsd-net wrote: > >> root@netboot_v4: ~# mount_nfs -o nfsvers=4 10.101.0.1:/mnt/v4share /var/mnt > >> [tcp] 10.101.0.1:/mnt/v4share: Permission denied > > > > try `mount_nfs -o nfsvers=4 10.101.0.1:/ /var/mnt` > > Tried, same resul

Re: NFSv4 without Kerberos

2019-08-16 Thread Alexander Lunev via freebsd-net
root@netboot_v4: ~# mount_nfs -o nfsvers=4 10.101.0.1:/mnt/v4share /var/mnt [tcp] 10.101.0.1:/mnt/v4share: Permission denied try `mount_nfs -o nfsvers=4 10.101.0.1:/ /var/mnt` Tried, same result: [tcp] 10.101.0.1:/: Permission denied In server logs: Aug 15 01:02:21 virt mountd[625]: mount re

Re: NFSv4 without Kerberos

2019-08-16 Thread Slawa Olhovchenkov
On Fri, Aug 16, 2019 at 01:05:27PM +0300, Alexander Lunev via freebsd-net wrote: > Hello everyone! > > I'm trying to build diskless system with some mounts done by NFSv4, and > i can't figure out how to mount share without kerberos, with -sec=sys > flavour. Doing all by handbook, on server i ha

NFSv4 without Kerberos

2019-08-16 Thread Alexander Lunev via freebsd-net
Hello everyone! I'm trying to build diskless system with some mounts done by NFSv4, and i can't figure out how to mount share without kerberos, with -sec=sys flavour. Doing all by handbook, on server i have: server's /etc/rc.conf (part of it): ifconfig_em1="inet 10.101.0.1/24" nfs_server_ena