Re: Guidance for booting NanoPi R6S?

2024-04-18 Thread Damien Miller
On Tue, 16 Apr 2024, Stephan Somogyi wrote: > Given that it appears that R6S > > https://www.mail-archive.com/ports@openbsd.org/msg123717.html > > and R6C support > > https://www.mail-archive.com/ports@openbsd.org/msg124138.html > > are in the ports version of uboot, I was interested in trying

Re: ssh: probable bug in ssh -current

2020-02-02 Thread Damien Miller
On Fri, 31 Jan 2020, Aham Brahmasmi wrote: > Bug: > When the client connects to the server, they use the ed25519-cert to > establish the connection. After the ssh session is established, the > server sends the "hostkeys...@openssh.com" message with the server's > ed25519 host public key. > > This

Re: [SUSPECTED SPAM] SSH disconnects right after accepting

2019-02-07 Thread Damien Miller
On Fri, 8 Feb 2019, Lars Bonnesen wrote: > OpenBSD 6.4 > > Putty just reports "Authenticating with public key "XXX" from agent" and > then I am disconnected. If I run sshd with -ddd, I get the following > output. I can't seem to get any error, and therefor I can't tell what is > wrong. Anyone has

pf: matching untagged traffic

2018-07-24 Thread Damien Miller
Hi, Is it possible for pf to match traffic that has not been tagged? It seems possible to match a tag, or traffic that lacks a particular tag but I can't see any way to match traffic that has no tag at all? Any clues? Context: I'd like to tag at input particular traffic for specific outbound pro

Re: OpenSSH 7.7 default ciphers

2018-04-05 Thread Damien Miller
Thanks - I just committed a fix (having missed that Otto already included a patch beyond the bottom of my xterm -- sorry) On Thu, 5 Apr 2018, Otto Moerbeek wrote: > On Thu, Apr 05, 2018 at 01:51:51PM +0200, Renaud Allard wrote: > > > Hello, > > > > The man page for openssh 7.7 for Ciphers speci

Re: openssh

2014-07-03 Thread Damien Miller
On Tue, 1 Jul 2014, Gregory Edigarov wrote: > Hello, > > Just out for curiosity. > what is the fastest and lightest in cpu terms algorithm in ssh? In recent OpenSSH, chacha20-poly1...@openssh.com is what you want. -d

Re: ED25519 SSHFP in OpenSSH & IETF

2014-04-09 Thread Damien Miller
On Wed, 9 Apr 2014, Loganaden Velvindron wrote: > Maybe the OpenSSH community needs to get involved, so that we can > get work done :-) ? I think "getting involved" will be a matter of us acting unilaterally and just committing support for the new SSHFP code point. -d

Re: snapshot ssh: ChrootDirectory sftp Connection closed

2013-04-16 Thread Damien Miller
On Wed, 17 Apr 2013, Darren Tucker wrote: > On Tue, Apr 16, 2013 at 12:25:54PM +0800, f5b wrote: > > the user share can not sftp to the server, > > but same config in Mar 1 snapshot, sftp is ok. > > it's caused by this change (feed it to patch -R to revert it), and it's > because the uid has alre

Re: vmmap: bad software everywhere

2011-05-31 Thread Damien Miller
On Wed, 1 Jun 2011, Ariane van der Steldt wrote: > > The recent trend of forking another process for a tab instead of a > > monolithic single process for the whole browser is a way of extending > > the time required to clean up this mess? Or there is no relation > > between them? > > I cannot loo

Re: Should the ecdsa fingerprint always and only be offered?

2011-05-17 Thread Damien Miller
On Tue, 17 May 2011, Kevin Chadwick wrote: > If the client has no known_hosts files and only an RSA key. Only the > ecdsa fingerprint is given to be confirmed before connection. Should > administrators make sure the ecdsa fingerprint is always given out or > posted even to already issued RSA key u

Re: Linux-2.6.36-libre: turning Linux's Free Bait into Free Software

2010-11-09 Thread Damien Miller
obvious troll is obvious. On Tue, 9 Nov 2010, Gjones wrote: > Linux-2.6.36-libre: turning Linux's Free Bait into Free Software > > http://www.fsfla.org/svnwiki/anuncio/2010-11-Linux-2.6.36-libre-debait.en

OpenBSD-capable, fanless, diskful computer with ECC RAM

2010-10-29 Thread Damien Miller
Hi, Can anyone recommend a small, fanless computer that will accept a HD (perhaps a 2.5" drive) that uses ECC RAM? Needless to say, it must run OpenBSD. Being 64 bit, having accellerated crypto and/or supporting multiple drives would be bonus points, but are not required. -d

Re: Same shit all over again

2010-08-16 Thread Damien Miller
On Sun, 15 Aug 2010, David Hill wrote: > Well, tinyurl redirects to my box which redirects to trollaxer. Here is > the culprit log for falling for such a silly trick. You should have finished the job by redirecting to the goatse.cx guy :)

Re: undeadly article

2010-08-16 Thread Damien Miller
On Mon, 16 Aug 2010, Mihai Popescu B.S. wrote: > Hello, > > I have read the undeadly.org article about how to "play" with airport > security. I don't know who is the guy acting like this on an airport, > but my brain triggered something I read in the past, about a well > known guy from open sourc

Re: PTY allocation error

2010-07-11 Thread Damien Miller
On Sun, 11 Jul 2010, Peter Bako wrote: > I'm setting up (well, trying to I guess :-) ) a read-only OpenBSD system to > run off a small CF card. Never having done this before, I found an > excellent article written by Daniele Mazzocchio > (http://www.kernel-panic.it/openbsd/embedded/) to use as my

Re: tcpdump no output on stdout

2010-07-08 Thread Damien Miller
On Thu, 8 Jul 2010, Marian Hettwer wrote: > Hi all, > > I'm experiencing a rather strang behaviour with tcpdump on OpenBSD 4.7 i386 > running on a vmware esx vsphere 4. > My tcpdump gives no output at all on stdout, but if I use the very same > command with "-w foobar" it actually does dump pack

Re: Why I left OpenBSD

2010-06-10 Thread Damien Miller
On Thu, 10 Jun 2010, Samuel Baldwin wrote: > > Those who taste the de Raadt wrath, however, always run in the end. A friend > > of mine once incurred his ire by asking the wrong question at the wrong > > time, > > and Theo de Raadt hacked his router and remotely remapped his keyboard! > > hahaha

Re: New Western Digital disks will have 4KB block size - issue?

2009-12-16 Thread Damien Miller
On Wed, 16 Dec 2009, Marco Peereboom wrote: > The issue isn't the 4k blocks. The issues are the 512 bytes constants > or 1 << 9 or DEV_BSHIFT or DEV_BSIZE that are all over the tree. I > know for a fact that softraid is busted with these devices and you can > bet that the wrong assumption has b

Re: Chromium port [?]

2009-12-08 Thread Damien Miller
On Wed, 9 Dec 2009, Andrej Elizarov wrote: > Just wonder, does anyone know about Chromium browser port for openbsd? > I had tried it on Windows box and seems it's much faster than FF (in fact, > not Chromium - Chrome based on sources' one). > And google sad that it's ported on freebsd and there fl

Re: apachectl and/or /etc/rc

2009-09-26 Thread Damien Miller
why not just fix mod_php? (or avoid it altogether) On Sat, 26 Sep 2009, frantisek holop wrote: > hi there, > > given that apache is often re-started using apachectl > and that apache/mod_php leaks environment variables > and that mostly sudo is used in this process as well, > i thought it would

Re: encryption

2009-08-26 Thread Damien Miller
On Wed, 26 Aug 2009, My List Mail wrote: > Been waiting for a while to see some current encryption added to > openbsd. [...] I realise that I'm probably replying to a troll, but on the small chance that you are actually serious: please spend some of the effort you put in to ranting into reading t

Re: tmux vs screen questions

2009-07-12 Thread Damien Miller
On Mon, 13 Jul 2009, Nicholas Marriott wrote: > > > > What does "echo $TERM" show before you attach tmux? > > > > > > again, this seems to be a putty specific issue. > > > no problems whatsoever on local terminal. > > > TERM is set to xterm before i run tmux, then it changes to screen. > > > > T

Re: man softraid improvement

2009-04-28 Thread Damien Miller
On Tue, 28 Apr 2009, Sebastian Rother wrote: > > it is not a blanket thing - not all archs use it. the disklabel stuff > > well, we expect people to know how to use disklabel anyway. if they > > don;t, they can read the man page. > > The method I descriped is NOT mentioned anywhere. > People have

Re: Padlock accelerated SHA on Via C7

2009-04-15 Thread Damien Miller
On Tue, 14 Apr 2009, Theo de Raadt wrote: > > Has anybody been able to get Padlock accelerated SHA1 working on a C7 > > or is this not currently possible? > > It isn't worth using it. The overhead is too high. Specifically: Via botched the implementation - their instruction set does not allow t

Re: European orders

2009-04-08 Thread Damien Miller
On Thu, 9 Apr 2009, ropers wrote: > [citation needed] http://bit.ly/3dMFBs

Re: OpenSSH release CDS

2009-03-12 Thread Damien Miller
On Wed, 11 Mar 2009, patric conant wrote: > I've repeatedly been in a position where we weren't making direct use > of OpenBSD, but were using OpenSSH, and if there were a recurring > cost associated with it (like purchasing a semi-annual CD) it would > have been relatively painless to get a rubbe

Re: openssl freezes ssh and entire inet service

2009-03-01 Thread Damien Miller
On Sun, 1 Mar 2009, Vivek Ayer wrote: > why would this occur? Without you looking at the console, who knows? > I thought openssl was stable. It is. It almost certainly isn't OpenSSL that has crashed, but rather your host. > Does it have to do > with the key length? No. -d

Re: openssl freezes ssh and entire inet service

2009-03-01 Thread Damien Miller
On Sun, 1 Mar 2009, Vivek Ayer wrote: > Hi, > > I'm not sure why it happens, but I tried running: > > openssl genrsa -out /etc/ssl/private/server.key 1024 > > over an ssh connection to a web server that I wanted to setup as > https. Believe it or not, it froze while it was running openssl. Now

Re: ssh VisualHostKey

2009-02-03 Thread Damien Miller
On Wed, 4 Feb 2009, Chris wrote: > I've recently enabled VisualHostKey yes in my .ssh/config file. I > would like to hear from people who are using it and how they are > finding it useful. the undead orc hits, you die.

Re: Python in base?

2008-12-27 Thread Damien Miller
On Sat, 27 Dec 2008, Jordi Espasa Clofent wrote: > Hi misc@, > > ?Are there some plans to include python in base system (as Perl is at > present)? No. We only need one such language in base and perl got there first. -d

Re: package integrity, security and checks. .... where are they ?

2008-12-14 Thread Damien Miller
On Sun, 14 Dec 2008, spamtester spamtester wrote: > It does not matter what faith one places in the pki or webs of trust > (gpg/pgp style). Most linux distributions have had their packages > signed for years (for example at ruxcon - an australian security > conference a large number of participant

Re: extract part of text

2008-12-13 Thread Damien Miller
On Sat, 13 Dec 2008, igor denisov wrote: > Hi there, > I need to extract part of text between /pat1/ and /pat2/ but /pat2/ may appear > and may not, > awk '{if (/pat2/) /pat1/, /pat2/ {print}' filename > does not work. How to do that in shell? Do /pat1/ and /pat2/ appear on the same line? If so,

Re: offtopic - postfix book/doc recommendation

2008-12-06 Thread Damien Miller
On Sat, 6 Dec 2008, Gilles Chehade wrote: > On Sun, Dec 07, 2008 at 12:30:32AM +0100, Jesus Sanchez wrote: > > I want to start learning about postfix running on OpenBSD > > for a serious pourpose than home services. > > > > Think I'm not familiar with the mail servers concepts > > and I'm startin

Re: Ellipitc Curves: off-topic

2008-11-27 Thread Damien Miller
On Thu, 27 Nov 2008, John Nietzsche wrote: > Does anybody know a tutorial on implementing such curves in ANSI C? src/sbin/isakmpd/math_ec2n.{c,h}

Re: Multiple ssl servers on one external IP by using internal addresses?

2008-11-09 Thread Damien Miller
On Sat, 8 Nov 2008, Jeff Ross wrote: > My ssl hosts work.openvistas.net and cvs.work.openvistas.net resolve > to the same IP address as everything else from the internet, but to > different internal IP addresses beginning at 10.30.50.1 with a split > horizon DNS setup. These two use two different

Re: NTFS-3G Stable Read/Write Driver ready to merge on cvs obsd ?

2008-10-25 Thread Damien Miller
no On Sat, 25 Oct 2008, Neko wrote: > so there can be an end to this retard "cant write on the file system" bs > > http://www.ntfs-3g.org/ > > > so will it be merged in the next obsd release ? > this is the future. people use multiple os on their machine, not just > vm , they will local instal

Re: eSATA support?

2008-09-21 Thread Damien Miller
On Sun, 21 Sep 2008, Brian wrote: > I'm thinking about picking up an eSATA pci card and backing up my data > to an external hd over eSATA using rsync. Is this supported? eSATA is a conector, cable and electrical specification and otherwise is identical to regular SATA. If the particular adapter's

Re: Patching a SSH 'Weakness'

2008-09-12 Thread Damien Miller
-003-ssh-traffic-analysis/ > > The ACM paper was also published in 2001, same time frame. There's > more padding (see the TCPDump output I provided) in SSH2. Also, take a > look at what Damien Miller responded with: OpenSSH is applying extra > padding. > > SSH2 is the de

Re: Patching a SSH 'Weakness'

2008-09-12 Thread Damien Miller
On Thu, 11 Sep 2008, [EMAIL PROTECTED] wrote: > Just off the top of my head (I have to check the SSH protocol yet): > Why not encipher all accumulated keystrokes up to the key as a > block send them instead of sending each keystroke as it is typed? This > shrouds the typist's characteristics. Th

Re: Patching a SSH 'Weakness'

2008-09-10 Thread Damien Miller
On Wed, 10 Sep 2008, STeve Andre' wrote: > On Wednesday 10 September 2008 15:58:03 Kevin Neff wrote: > > Hi, > > > > Some secure protocols like SSH send encrypted keystrokes > > as they're typed. By doing timing analysis you can figure > > out which keys the user probably typed (keys that are > >

Re: Patching a SSH 'Weakness'

2008-09-10 Thread Damien Miller
On Wed, 10 Sep 2008, Kevin Neff wrote: > Hi, > > Some secure protocols like SSH send encrypted keystrokes > as they're typed. By doing timing analysis you can figure > out which keys the user probably typed (keys that are > physically close together on a keyboard can be typed > faster). A caref

Re: Does this look like SSP to you? (Vista)

2008-08-13 Thread Damien Miller
On Thu, 14 Aug 2008, Sunnz wrote: > Hi, > > I am just curious, have Vista implemented something similar to > Stack-Smashing Protector as in OpenBSD's GCC? > > http://arstechnica.com/news.ars/post/20080811-the-sky-isnt-falling-a-look-at-a-new-vista-security-bypass.html > > I don't really know th

Re: free plot software

2008-08-02 Thread Damien Miller
On Sat, 2 Aug 2008, Pau wrote: > PS: Still, a BSD-licensed programme like R or gnuplot seems not to > exist, right? It isn't exactly a plotting "program", but ports/graphics/py-matplotlib is BSD licensed and has a matlab-like interface. Then again I don't consider gnuplot's license to be particu

Re: sub-notebook computers

2008-08-02 Thread Damien Miller
On Fri, 1 Aug 2008, Anathae Townsend wrote: > Besides the ASUS EEEPCs, has anyone tried to get other sub-notebooks working > under OpenBSD? http://openbsd.org/zaurus.html -d

Re: Performance issues with the DNS patch?

2008-07-28 Thread Damien Miller
On Sat, 26 Jul 2008, J Duke wrote: > I realize that the whole fix to this DNS cache poisoning is to have > random ports and random query ids, and that generating good, strong, > random numbers costs cpu cycles and time. Has anyone else noticed the > performance hit? Anything that I can do? Particu

Re: bad tcp cksum and odd delay to close a connection on OpenBSD?

2008-07-25 Thread Damien Miller
On Sat, 26 Jul 2008, Frank Denis wrote: > Le Fri, Jul 25, 2008 at 05:54:28PM -0600, Daniel Melameth ecrivait : > > Can't reproduce on a 4.2 -stable box with fxp NICs: > > Hello Daniel, > > Try to with net.inet.tcp.ecn=1 This is ECN blackhole detection at work, making a 2nd ECN-less connecti

Re: failed make on openssh 5.1

2008-07-23 Thread Damien Miller
On Wed, 23 Jul 2008, Joel Dinel wrote: > On Wed, Jul 23, 2008 at 9:42 AM, Damien Miller <[EMAIL PROTECTED]> wrote: > > I have just updated the patch, please try again once it has hit the > > ftp server: > > > > -rw-r--r-- 1 djm djm 6411 Jul 23 23:31 openbsd4

Re: failed make on openssh 5.1

2008-07-23 Thread Damien Miller
.patch) = d45b51c446f08e2f1356ef77c4d004814d27c572 Sorry for the confusion. -d On Wed, 23 Jul 2008, Renaud Allard wrote: > Damien Miller wrote: > > On Tue, 22 Jul 2008, Joel Dinel wrote: > > > > > > To answer my own question, no sooner had I hit 'send' th

Re: failed make on openssh 5.1

2008-07-22 Thread Damien Miller
On Tue, 22 Jul 2008, Joel Dinel wrote: > > To answer my own question, no sooner had I hit 'send' than I noticed the > > patch number indicated 4.3. I have downloaded OpenSSH 5.0, the > > appropriate 4.1 -> 5.0 patch and all is well. > > Well I am getting the exact same compilation error as you,

Re: svnd questions (encrypting all of a partition or disk)

2008-07-20 Thread Damien Miller
On Sun, 20 Jul 2008, Aaron Stellman wrote: > Now, on boot, the softraid0 doesn't attach itself to sd0n, perhaps not > implemented yet? I was wondering if there were any plans to create > support for crypto devices so that they could be mounted on boot as > specified in fstab(5). Yes, but someone

Re: Postfix race condition at boot

2008-07-20 Thread Damien Miller
On Sun, 20 Jul 2008, Uwe Dippel wrote: > On Mon, 14 Jul 2008 12:47:40 -0500, Karl O. Pinc wrote: > > > I've an OpenBSD box that's been running postfix for a few > > years, strictly as a "send-only" mta, and every night the > > box gets rebooted. Every couple of months postfix does > > not come u

Re: 'Nother broken package - git-1.5.4.2

2008-07-16 Thread Damien Miller
On Wed, 16 Jul 2008, L. V. Lammert wrote: > On Thu, 17 Jul 2008, Marc Espie wrote: > > > On Wed, Jul 16, 2008 at 09:30:02AM -0500, L. V. Lammert wrote: > > > If a command line tool like git has a 'GUI Helper', then that package is > > > broken (which, I believe, is the case in this situation). >

Re: 'Nother broken package - git-1.5.4.2

2008-07-15 Thread Damien Miller
On Tue, 15 Jul 2008, Ted Unangst wrote: > try it. install x, then resist the urge to type "startx". can you do > it? can you ignore the siren song, or do your fingers fly forth of > their own volition? I have it on good authority that plugging one's ears with wax helps. -d

Re: developer laptop choices

2008-06-16 Thread Damien Miller
On Mon, 16 Jun 2008, Brad Walker wrote: > FYI, newer Thinkpads have mini-pci cards whitelisted in the BIOS. One > can't install a ral(4) in them without hacking the BIOS (not > recommended). > > http://www.thinkwiki.org/wiki/Problem_with_unauthorized_MiniPCI_network_card We have had tools to wor

Re: OpenSSL On Openbsd help

2008-06-14 Thread Damien Miller
On Sat, 14 Jun 2008, Khalid Schofield wrote: > Hi, > I need to get a proper signed ssl certificate for my ecommerce website > hosted on my openbsd box. Getting confused as most websites describe > how to do this in many different ways and most refere to self signed > certificates. Wanted to ask th

Re: nmeaattach(8) removed in -current, superseeded by ldattach(8)

2008-06-09 Thread Damien Miller
On Mon, 9 Jun 2008, James Hartley wrote: > On Mon, Jun 9, 2008 at 3:36 PM, Marc Balmer <[EMAIL PROTECTED]> wrote: > > If you are using a GPS device with nmeaattach(8), please switch to > > ldattach(8) now. > > Thanks Marc for passing on this information. Can you describe in > short why this chan

Re: [OT] developers running -current on laptops

2008-05-23 Thread Damien Miller
On Fri, 23 May 2008, Chris wrote: > I can see from the recent undeadly posts and pictures that most > developers are using laptops and I know you have to run -current to do > development work. I was just wondering if these laptops are for > development use only or development+personal use? I know

Re: More details show that someone seriously fucked up in debian. [Was: Re: Debian libssl security (OpenSSH safe?)]

2008-05-15 Thread Damien Miller
On Wed, 14 May 2008, chefren wrote: > On 5/13/08 7:08 PM, Marc Espie wrote: > > > More details show that someone seriously fucked up in debian. > > Well, this Kurt has seriously asked for details on the relevant openssl-dev > list: > > http://marc.info/?l=openssl-dev&m=114651085826293&w=2 > >

Re: tpwireless

2008-05-08 Thread Damien Miller
On Thu, 8 May 2008, Adam Patterson wrote: > Anyone know of any documentation on tpwireless? Specifically how to "re-set" > the bit that it unsets. There isnt a man page and there aren't and switches to > cause 'usage' to show up. There are no flags. There is no usage doc. However, if you edit th

Re: ssh-keyscan tries protocol 1 and does not rollover to 2

2008-04-30 Thread Damien Miller
On Wed, 30 Apr 2008, Lars NoodC)n wrote: > On OpenBSD 4.2, ssh-keyscan looks like it tries for SSH1 first, rather > than SSH2, which is the default[1] for OpenBSD. However, it appears not > to retry the scan with SSH2 if SSH1 fails. ssh-keyscan never rolls over to a different protocol unless you

Re: OpenBSD && !GSoC

2008-03-26 Thread Damien Miller
On Thu, 27 Mar 2008, raven wrote: > Hi, like subject, i would to know why OpenBSD do not partecipate to Google > Summer of Code. Exist a reasonable reason? I wanted to get some candidate projects proposed for OpenSSH but I wasn't organised in time. -d

Re: AMD Geode

2008-03-17 Thread Damien Miller
On Mon, 17 Mar 2008, Dimitri wrote: > Hello all. > > My cuestion is simply. > > OpenBSD run over AMD Geode, Yes. > specificly over Packard > Bell S18P?. Don't know. -d

Re: sftp logging using chroot internal-sftp in -current

2008-03-12 Thread Damien Miller
On Wed, 12 Mar 2008, Calomel wrote: > Is it possible to enable DEBUG logging for internal-sftp in sshd? > > Using -current (Mar 12, 2008) and enabling a chroot'd sftp server we can > get sshd to log initial connections. But, we would also like to log sftp > activity like uploads, downloads, and d

Re: FIPS 140-2

2008-03-12 Thread Damien Miller
On Wed, 12 Mar 2008, Ed Ahlsen-Girard wrote: > Does OpenBSD's OpenSSL use the FIPS 140-2 certified bits where > applicable? No. Furthermore, there are no "FIPS 140-2 certified bits" - it is an entire package that is certified, you don't get to pick and choose. -d

Re: ssh complaining about bad file descriptor on 4.3beta.

2008-02-21 Thread Damien Miller
On Fri, 22 Feb 2008, Chris Smith wrote: > On Thursday 21 February 2008, Allie D. wrote: > > I'm getting bad file descriptor errors on every ssh connection on a > > box that I built from source on 4.3 beta last night. Anyone else > > seeing this as well ? > > > > Feb 21 09:54:43 crusty sshd[21741]:

Re: Cold Boot Attacks on Encryption Keys

2008-02-21 Thread Damien Miller
On Fri, 22 Feb 2008, Brett Lymn wrote: > On Thu, Feb 21, 2008 at 05:19:28PM -0600, Marco Peereboom wrote: > > > > Let me give you an engineering opinion: bwahahahahahaha this is > > retarded. > > > > Well, let me give you another engineering opinion based on actual > experience working on a m

Re: Multi-Threaded SSH/SCP made by university of Puttsburgh

2008-02-13 Thread Damien Miller
On Wed, 13 Feb 2008, [EMAIL PROTECTED] wrote: > I just wanted to bring it to your attention that the university of > Pittsburgh provides a HPC-Patch for OpenSSH 4.7 wich may is worth looking > at (include it into the base if possible? who knows..). :) Is crypto really a bottleneck for non-HPC use

Re: Real men don't attack straw men

2007-12-14 Thread Damien Miller
On Fri, 14 Dec 2007, Richard Stallman wrote: > You said "Real men don't attack straw men". Yet this is *EXACTLY* what > you are now doing. You continue to repeatedly write that OpenBSD > recommends the ports system to its users, *which it does not*. Let me > say that once again: Op

Re: Real men don't attack straw men

2007-12-14 Thread Damien Miller
On Fri, 14 Dec 2007, Richard Stallman wrote: > It also seems silly to me this idea between "tainted" and "clean" > oses, such as Open and gNewSense, respectively. Take for example > a user that runs Ubuntu [GNU/]Linux but proscribes to your free-only > philosophy. They don't have

Re: Could Hiawatha replace Apache as in base HTTP server if it's license changed?

2007-12-03 Thread Damien Miller
On Mon, 3 Dec 2007, Andris wrote: > I was reading about Hiawatha security features, and seems like a > perfect fit for OpenBSD goals. I'd volunteer to talk to Hugo Leisink > (the developer) and see if the code could be relicensed if the project > has interest in it. IMHO, replacing forked software

Re: removing sendmail

2007-12-02 Thread Damien Miller
On Sun, 2 Dec 2007, Douglas A. Tutty wrote: > > Why is everyone trying to come up with a solution to a problem that > > doesn't exist? > > The 'problem' is a piece of software installed on the box that some of > us don't use. It takes up space (how much?). Each MTA has its > champions and its d

Re: About Xen: maybe a reiterative question but ..

2007-10-24 Thread Damien Miller
On Wed, 24 Oct 2007, Brian wrote: > All of the theoretical attack vectors are exactly that: theoretical. > But by adding complex layers does not guarantee any increase in security. They aren't theoretical, they have been demonstrated. Read the paper: http://taviso.decsystem.org/virtsec.pdf

Re: About Xen: maybe a reiterative question but ..

2007-10-24 Thread Damien Miller
On Wed, 24 Oct 2007, L. V. Lammert wrote: > I still stand by my original statement. Running application 'domains' in > VMs instead of on a single server increases security. It no worse security-wise to run applications on VMs rather than on the one OS, but that isn't the only choice - is it? You

Re: About Xen: maybe a reiterative question but ..

2007-10-23 Thread Damien Miller
On Tue, 23 Oct 2007, Theo de Raadt wrote: > > Virtualization seems to have a lot of security benefits. > > You've been smoking something really mind altering, and I think you > should share it. > > x86 virtualization is about basically placing another nearly full > kernel, full of new bugs, on t

Re: OpenBSD replacement for GnuPG

2007-10-11 Thread Damien Miller
On Thu, 11 Oct 2007, Sean Darby wrote: > Hi, > > Is there an alternative PGP or OpenPGP-like program available other > than PGP or GnuPG/GPG? > > Is there something along lines of a "BSD-PG"-type program (using BSD > licensing/copyright and basically non-GNU)? There is this: http://openpgp.nomin

Re: SMTP flood + spamdb

2007-09-26 Thread Damien Miller
On Wed, 26 Sep 2007, Liviu Daia wrote: > Greylisting is trivial to bypass, with or without a queue: just send > the same messages twice. Some spammers have figured that out long ago. > Ever wondered why sometimes you receive 2 or 3 copies of the same spam, > from the same IP, with the same Me

Re: OBSD's perspective on SELinux

2007-09-24 Thread Damien Miller
On Sat, 22 Sep 2007, Douglas A. Tutty wrote: > Hello all, > > I'm running OBSD on my older boxes but still Debian on my big box (not > ready yet). > > Linux has SELinux in its 2.6 kernel and debian has gone ahead and > compiled SELinux into the libraries, although the SELinux policies > aren't r

Re: The Atheros story in much fewer words

2007-09-15 Thread Damien Miller
On Sat, 15 Sep 2007, Rui Miguel Silva Seabra wrote: > On Sat, Sep 15, 2007 at 09:54:10PM +1000, Damien Miller wrote: > > On Sat, 15 Sep 2007, Rui Miguel Silva Seabra wrote: > > > > > You seem uneducated about how powerless someone is without the freedom to > > >

Re: The Atheros story in much fewer words

2007-09-15 Thread Damien Miller
On Sat, 15 Sep 2007, Rui Miguel Silva Seabra wrote: > You seem uneducated about how powerless someone is without the freedom to > change a program because he has no access to the source code. You seem to be entirely missing the irony of making this statement in the context of an argument about so

Re: Software freedom

2007-08-27 Thread Damien Miller
On Mon, 27 Aug 2007, [EMAIL PROTECTED] wrote: > > rest of the kernel uses it to store the value of curlwp. Sam won't > > recompile the HAL for us (fair enough), and we can't modify the HAL > > to use another register because doing so could put us in breach of > > the license (v. crappy). So, do a

Re: classify scp and ssh

2007-07-08 Thread Damien Miller
On Sat, 7 Jul 2007, Lawrence Horvath wrote: > Is there a way using pf to distinguish between ssh shell logins, and > scp file transfers? Not easily: ssh sets IPTOS_THROUGHPUT for non-interactive sessions, but does it after the TCP handshake. If you are assigning connections to queues statefully,

Re: Security of the keyboard

2007-06-20 Thread Damien Miller
On Wed, 20 Jun 2007, Mikulas Patocka wrote: > > Yay ! Let's map everything uncached from now on! For great justice! > > > > [I was tempted to write some stuff about how keyboard keycode translation > > works in wscons, but it's not worth my time] > > > > Miod > > You don't have to map keyboard

Re: OpenSSL key theft through cache timing

2007-06-20 Thread Damien Miller
On Wed, 20 Jun 2007, Karel Kulhavy wrote: > http://www.daemonology.net/papers/htt.pdf > > This is the missing link to my post about keyboard security. No, it isn't. You can't really compare a public key crypto operation to someone bashing at a keyboard. -d

Re: Multicast sending

2007-06-11 Thread Damien Miller
On Sun, 10 Jun 2007, Praveen wrote: > Hi, > I am using the send program from this example: > http://ntrg.cs.tcd.ie/undergrad/4ba2/multicast/antony/example.html#sender > > The only modification is the use of setsockopt() to > set the interface from which I want to send the > packet. > The setsoc

Re: Linux and Novell article in Linux Journal

2007-06-01 Thread Damien Miller
I think you have the wrong list... On Fri, 1 Jun 2007, Dan Farrell wrote: > At the link below from the Linux Journal, Glyn Moody states that the > GNU/Linux Community should wish Novell well, as it may be the first > domino to fall. In the comments section I mentioned there's a least one > projec

Re: OpenBSD sucks

2007-05-31 Thread Damien Miller
On Thu, 31 May 2007, Open Phugu wrote: > On 5/31/07, qw er <[EMAIL PROTECTED]> wrote: > > It really sucks. it is slow. > > > What you say does not apply to OpenBSD. What you said describes you. I find it amazing that, in 2007, people still respond to the most blatant trolling in exactly the way

Re: tpb and tphdisk assistance

2007-05-28 Thread Damien Miller
where did you get that idea from? you are wrong. On Mon, 28 May 2007, openbsd fan wrote: > tpb and tphdisk are only for thinkpads with apm not acpi... > > On 5/27/07, Don Scott <[EMAIL PROTECTED]> wrote: > > I have setup an MSDOS partition for tphdisk: > > > > $ sudo fdisk sd0 > > Disk: sd0

Re: Peek active process

2007-05-23 Thread Damien Miller
On Wed, 23 May 2007, Daniel Ouellet wrote: > I am trying to find out how many peek active process a server run in a given > time period, like in one day, and may be a week. I try to see how servers > handle heavy peak at time. > > I thought that systat vmstat, or others could provide me that. >

Re: Why Linus Torvalds won't donate to OpenSSH

2007-04-11 Thread Damien Miller
On Wed, 11 Apr 2007, Timo Schoeler wrote: > Which commercial *NIX that's still alive is more of a security thread > and covered with the same level of stability problems as GNU/Linux? One > really stops counting remote exploits for GNU/Linux very soon, > otherwise one would have to dedicate one's

Re: Why Linus Torvalds won't donate to OpenSSH

2007-04-10 Thread Damien Miller
Two points: 1. Please don't post private email. (Apologies if you obtained his permission to post). 2. Who really cares? I'd much rather see contibutions from companies who ship OpenSSH in their products and list "SSH support" as a feature on their glossy brochures than shaking down othe

Re: bcw(4) is gone

2007-04-06 Thread Damien Miller
On Thu, 5 Apr 2007, Andris Delfino wrote: > First, this wouldn't happen cause I prefer the BSD license, but, if > someone violates the copyright of my work, I'll take that guy down. In > the most publicly and shameful way. How does this militant attitude work alongside your preference for the BSD

Re: No Blob without Puffy

2007-03-18 Thread Damien Miller
On Sun, 18 Mar 2007, Jason Dixon wrote: > Again, why are you being hypocritical by including a BLOB-friendly OS in your > campaign? You're part of the problem, not the solution. Actually, I think that by listing only blob-distributing OSs on their poster the campaign has a very funny subtextual

Re: ssh/sshd challenge-response seems to have stopped working in -current

2007-02-27 Thread Damien Miller
what does the client say? (ssh -vvvp 222 localhost) On Tue, 27 Feb 2007, Josh Grosse wrote: > On Tue, Feb 27, 2007 at 04:20:20PM -0700, Damien Miller wrote: > > Please send a Debug3 trace (sshd -dddp222), debug level 1 doesn't > > contain all the necessary inf

Re: ssh/sshd challenge-response seems to have stopped working in -current

2007-02-27 Thread Damien Miller
also, does it work if you try connecting without any keys in your ssh-agent? On Tue, 27 Feb 2007, Josh Grosse wrote: > On Tue, Feb 27, 2007 at 04:20:20PM -0700, Damien Miller wrote: > > Please send a Debug3 trace (sshd -dddp222), debug level 1 doesn't > > contain all the necessary information ...

Re: ssh/sshd challenge-response seems to have stopped working in -current

2007-02-27 Thread Damien Miller
Please send a Debug3 trace (sshd -dddp222), debug level 1 doesn't contain all the necessary information -d On Tue, 27 Feb 2007, Josh Grosse wrote: > After building -current on Feb 25, I noticed when I attempted to use S/Key > remotely, that it was not a permitted authentication style. (I use S/

Re: Compile Issue in libssl/crypto.

2007-01-29 Thread Damien Miller
On Mon, 29 Jan 2007, Sean Kennedy wrote: > Understood, -- Just being pedantic, before I move to -rstable, I usually do a > build with -rOPENBSD_X_x first when I do a Vanilla system. > Answer of "Use -rstable." is your answer. > libssl/crypto has issues with -rOPENBSD_4_0. To be clear, your prob

Re: atactl smartstatus to email other than cron user

2007-01-23 Thread Damien Miller
On Wed, 24 Jan 2007, Paul Pruett wrote: > Using cron and atactl to email smartstatus errors > to an email address other than cron user: ... I use the following script to help with cron stuff, it can do what you want. -d --- #!/bin/sh # Helper for cron(8) to send mail

Re: PlayStation 3

2007-01-23 Thread Damien Miller
On Wed, 24 Jan 2007, Jeroen Massar wrote: > The key in getting it to work is "UPNP", thus something like: > > http://upnp.sourceforge.net/ > http://linux-igd.sourceforge.net/ a more OpenBSDish implementation seems to be http://miniupnp.free.fr/ NB. I have never used it, or any for of uPNP (nor

Re: Why setresuid() and not setuid() is used?

2007-01-22 Thread Damien Miller
On Mon, 22 Jan 2007, Alexander Farber wrote: > Hello, > > I'm writing a small network daemon program and > want it to drop priviliges after it opens a listening port. > > I've looked at the several programs in /usr/src/usr.sbin > and many do it in the similar way: > > 1) getpwnam(NTPD_USER) to

Re: openbsd 4.0 ralink problem low operation range

2006-12-17 Thread Damien Miller
On Mon, 18 Dec 2006, pedro la peu wrote: > On Friday 15 December 2006 09:51, you wrote: > > So far for all you people who have complained about lousy ral(4) > > range or reception, only one of you has posted a dmesg (and even it was > > incomplete) and none of you have posted your interface config

  1   2   3   >