Re: Bug in dhclient, isc_named or misconfiguration ?

Hi Zbyszek, are you required to run a DHCP client? I guess you get the same IP every time anyway (it's a VPS, right?) so why not configure it statically? Regards, Florian Am 7. September 2017 15:24:21 MESZ schrieb "Zbyszek Żółkiewski" : >Hi group, > >Recently i come up with this problem: runn

Re: Thinkpad R40 varia

Am 2. September 2017 17:08:17 MESZ schrieb leo_...@volny.cz: >Just some notes on the damn thing: > >Swapping the general battery clears the 'CMOS' memory. I surmise that >there is no seperate CMOS battery: I consider this a design flaw. > Have you checked for a separate CMOS battery - which is pr

Re: OpenBSD 6.1-stable lock up

Am 1. September 2017 06:38:49 MESZ schrieb Philipp Buehler : >Hello, > >Am 01.09.2017 00:33 schrieb Maxim Bourmistrov: >> 0/232/64 mbuf 2048 byte clusters in use (current/peak/max) >> 423/2865/120 mbuf 2112 byte clusters in use (current/peak/max) >> 0/160/64 mbuf 4096 byte clusters in use (current

Re: ksh ^R vs EDITOR=vi

Am 27. August 2017 23:43:38 MESZ schrieb Jeremie Courreges-Anglas : >On Sun, Aug 27 2017, Florian Ermisch >wrote: >> Hi Jeremie, >> >> Am 27. August 2017 17:57:57 MESZ schrieb Jeremie Courreges-Anglas >: >>>On Sun, Aug 27 2017, Jan Stary wrote: >>>

Re: ksh ^R vs EDITOR=vi

Hi Jeremie, Am 27. August 2017 17:57:57 MESZ schrieb Jeremie Courreges-Anglas : >On Sun, Aug 27 2017, Jan Stary wrote: >> This is current/amd64. I am using ksh(1) as a shell. >> Using ^R opens a search in the command history. >> However, with 'export EDITOR=vi', pressing ^R >> just literarily ty

Re: mount_nfs(8) -b option

Hi Alessandro, Am 15. August 2017 15:57:01 MESZ schrieb Alessandro DE LAURENZIS : >Dear misc@ readers, > >From mount_nfs(8): > > -b If an initial attempt to contact the server fails, fork off a > child to keep trying the mount in the background. Useful for > fstab(5),

Re: octeon port, ubiquity edgerouter

Hi, if noone chimes in then maybe you can get a dmesg or lshw output from the linux-based EdgeOS to get some more details on the hardware. I would guess it's quite a bit beefier than the ERL3 and for embedded platforms this can mean more differences than just more cores and more RAM. Regar

Re: Get an MAC address of a LAN PC - OpenBSD

Some systems list their onboard NIC's MAC in the BIOS. A few ones may even have it printed on the board or a sticker with the MAC somewhere close to the NIC's port. Or get a permit to unplug its disk(s) before booting an OpenBSD CD, then drop to a shell and run ifconfig. If the MAC was spoofed

Re: isakmpd dies quietly with over 100 tunnels

Hi all, I got to admit I've seen isakmpd dying on 5.9* (amd64 on VMware). But after having to deal with half a dozen peers all over Europe using different proprietary solutions a cronjob like "rcctl ls faulty | grep isakmpd && rcctl restart…" worked well enough for me. I won't be able to test w

Re: bioctl crypto size limitation ?

Just make slice sd0a smaller than 100% of the RAID array. Regards, Florian Am 25. Mai 2017 19:03:59 MESZ schrieb myml...@gmx.com: >I'm wondering if there is a limit to the size of a disk for full disk >encryption. > >I'm trying to encrypt a 32Tb raid 6 drive on a lsi 9265-8i with 8 x 6Tb > >dri

Re: cloud docs

If it's text as in plaintext with some light markup: net/syncthing works well enough for me. The version in ports is reasonably up to date¹ and you get clients for anything else, too. (Initial configuration of all the peers is a little fiddly though.) And when you've accepted markdown's omnip

Re: Qubes-OS is "fake" security

Sorry, out of herrings. Have a listen to this instead: "Risky Biz Soap Box: A microvirtualisation primer with Bromium co-founder Ian Pratt (a.k.a. how to run Java plugin on IE8 and not die!)" https://risky.biz/soapbox3/ Am 12. Mai 2017 03:41:05 MESZ schrieb Kim Blackwood : >Hi, > >I am at nov

Re: IPv6, sshd, and latest patches?

Am 8. Mai 2017 04:18:30 MESZ schrieb Eric Johnson : > > >On Mon, 8 May 2017, Sterling Archer wrote: > >> On Mon, May 8, 2017 at 1:58 AM, Eric Johnson > wrote: >> >> >> Has anyone else had problems with sshd and IPv6 after applying >the latest >> patches?  It seems to me that the patch

Re: OpenBSD 6.1: relayd does not start more than 3 processes

Am 5. Mai 2017 16:05:09 MESZ schrieb Maxim Bourmistrov : > >> 5 maj 2017 kl. 15:55 skrev Maxim Bourmistrov >: >> >> >>> 5 maj 2017 kl. 14:41 skrev Hiltjo Posthuma : >>> >>> On Fri, May 05, 2017 at 12:30:56PM +0200, Maxim Bourmistrov wrote: […] Changing ’prefork’ from 15 to 3 makes

Re: Pf with secondary DNS resolution

Am 4. Mai 2017 08:39:51 MESZ schrieb Janne Johansson : >I would make those rules have a table, and a cronjob to feed the table >with >the current ips that these hostnames resolve to. Same here. >But of course, that implies you trust the replies you get all the time >from >that cronjob. > Is the

Re: pledge for sockets?

Hi Luke, you can have rules to filter by user for both incoming and outgoing connections, see http://man.openbsd.org/OpenBSD-6.1/pf.conf.5#user I don't think there's too much gain in adding support for this kinda thing in pledge but that's for the devs to decide. Regards, Florian Am 26. April

Re: nvi(1)

Am 23. April 2017 15:30:02 MESZ schrieb Unixway1 : >Dear, > >I started to use nvi(1) OpenBSD base editor, the manpage isn't clean >about: >1- How copy and paste between xterms? > Should I use Marks? is it possible or not? Use one terminal with tmux, split it into several panes, then use tmux'

Re: howto show IPv6 address lifetime?

Hi Harri, until someone in the know replies you could take a look at the DHCPv6 traffic to see if a lifetime is included in the replies (and maybe keep them handy for a dev to look at). Maybe dhcpcd supports this feature but there's an uncommon combination of flags it doesn't know about yet. R

Re: pf.conf: best practice for IP address lookup?

Am 16. April 2017 14:22:42 MESZ schrieb Florian Ermisch : >Am 16. April 2017 10:54:51 MESZ schrieb Harald Dunkel >: >>Hash: SHA256 >> >>Hi Florian, >> >>sorry to say, but you missed the point. The IP address of >>*another* host inside my LAN changes, e.

Re: pf.conf: best practice for IP address lookup?

Am 16. April 2017 10:54:51 MESZ schrieb Harald Dunkel : >Hash: SHA256 > >Hi Florian, > >sorry to say, but you missed the point. The IP address of >*another* host inside my LAN changes, e.g. a mail server, >a http proxy, etc. The interface identifier of each host is >surely stable. The prefix is not

Re: pf.conf: best practice for IP address lookup?

Hi Harald, just use `($IFACE)` to get interface's current IP (with the rules being updated when the IP changes). In addition you can use the interface group `egress` to address the interface which is used for the default route. Both options are used together in the OpenBSD router tutorial on bsdno

Blocking outgoing, non-privacy ext. IPv6 addresses' traffic?

Hi everyone, is there a way with to identify and filter automatically generated, MAC-based IPv6 addresses in pf? I think there was some bit set or flipped in the MAC-based or the RFC 4941 privacy extensions based addresses. But I then still had to match an address based on a single bit (and the ne

Re: ipv6 router ping6 = good, web = bad

Hi Edgar, check the MTU on your tunnel device. It has to be lower than the one on your NIC. As DNS and ICMP packets are tiny they will pass through anyway but the browser's TCP connections' packets will max out the configured MTU and get dropped. You can give it a try with doas ifconfig gif0 MTU

Re: Looking for replacement of thinkpad x201

Hi Florian, the maintainability of the x2?? Thinkpads dropped from great to good(ish) starting with the x230. With the recent ones you have to remove the bottom half of the case to access anything but the rear battery*, see [0]. But at least the x250 and the x260 have dedicated buttons for the tra

Re: pkg_add: ftp: connect: Invalid argument

Am 5. Februar 2017 07:46:43 MEZ schrieb jungle boogie : > On 02/04/2017 07:17 PM, Philip Guenther wrote: > >> Is this it? > >> > >> "Trying 129.128.5.191... > > ... > >> 80377 ftp CALL connect(3,0xaf766dd0bf0,16) > >> 80377 ftp STRU struct sockaddr { AF_INET, 129.128.5.191:80 } > >> 803

Re: IPSEC from behind NAT stage 2 failure

Am 6. Dezember 2016 23:38:31 MEZ, schrieb Damian McGuckin : > On Tue, 6 Dec 2016, Robert Szasz wrote: > > > I'll try it, but that would be a problem if I have to add the local > > address for any machine that wants to connect. I assume there is a > way > > to work through NAT because picked up n

Re: IPSEC from behind NAT stage 2 failure

Am 6. Dezember 2016 10:04:34 MEZ, schrieb Florian Ermisch : > Hi Robert, > > Am 6. Dezember 2016 03:05:34 MEZ, schrieb Robert Szasz > : > > I'm trying to set up an L2TP/IPSEC tunnel for roaming windows users > to > > > > tunnel in to our office network. &

Re: IPSEC from behind NAT stage 2 failure

Hi Robert, Am 6. Dezember 2016 03:05:34 MEZ, schrieb Robert Szasz : > I'm trying to set up an L2TP/IPSEC tunnel for roaming windows users to > > tunnel in to our office network. > > I'm testing with the following setup > > Win10 ->obsd5.9(firewall doing nat)->{}->obsd5.9(IPSEC) > > I'd like so

Re: Get active IP from an dhcp enabled interface

Am 27. Oktober 2016 17:10:16 MESZ, schrieb "Sjöholm Per-Olov" : > Hi > > If you use a dhclient on the Internet interface, what is the best > method to > get the currently used IP address? A regexp to get the IP from > "ifconfig > inet” output or check the dhclient lease file? […] A regex like t

Re: Would you use OpenBSD on Power8, and if so what applications? (IBM asks! They're thinking about donating hw.)

Am 19. Oktober 2016 19:48:49 MESZ, schrieb Mikael : > 2016-10-20 1:15 GMT+08:00 Ralph Siegler : > .. > > > Their ecosystem? > > > > closed source softwares including for x86-64 like Websphere, DB2, MQ, > > > .. > > > Hardware platforms limited to Power ($11,000 and up), Z series ($60,000 > > > >

Re: 4th nic for pcengines apu2

Am 19. Oktober 2016 15:50:10 MESZ, schrieb sven falempin : > On Wed, Oct 19, 2016 at 9:20 AM, Mihai Popescu > wrote: > > > > e.g. from Lanner. > > > > Can you compensate for the price difference? […] > […] > Also you may use a usb to ethernet , or serial to ethernet and connect > the > two board

Re: Multiple web servers behind NAT

Am 10. Oktober 2016 14:35:00 MESZ, schrieb Markus Hennecke : > Am 10.10.2016 um 12:01 schrieb Radek: > > > The second thing to do is enabling > > wesites' SSL/TLS certs. > > Each website has its own certificate > > on its server. […] > > > You can't do that. TLS exchange is done > before the host

Re: Route via gre0 works different than route via gre{1,2}?

Am 15. Juli 2016 22:22:32 MESZ, schrieb Florian Ermisch : > Hi, > > while debugging a problem with routing via GRE I figured > out I have to use `route add $LAN_A $GRE_REMOTE_A` > for the route going via gre0 but `route add -iface $LAN_B > $GRE_LOCAL_B` for a route via gre1.

Route via gre0 works different than route via gre{1,2}?

Hi, while debugging a problem with routing via GRE I figured out I have to use `route add $LAN_A $GRE_REMOTE_A` for the route going via gre0 but `route add -iface $LAN_B $GRE_LOCAL_B` for a route via gre1. When I used `route $LAN_B $GRE_REMOTE_B` packets for $LAN_B were send via gre0 (and probab