Re: FreeBSD Stable Image

2012-03-30 Thread Mike Barnard
On 29 March 2012 19:22, Matthew Seaman matt...@freebsd.org wrote:

 On 29/03/2012 17:18, Matthew Seaman wrote:
  On 29/03/2012 17:10, Mike Barnard wrote:
  Hi,
 
  Any one know where I can get a FreeBSD-9.0-STABLE ISO/IMG image?
 
  ftp.freebsd.org/pub/FreeBSD/FreeBSD-stable/
 
  That path does not seem to have it.
 
 
  ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/9.0/

 Errr... except of course that is -RELEASE and you asked for -STABLE.  I
 don't believe there's a 9.0-STABLE snapshot available at freebsd.org
 right now.  Instead, try one from here:


 ftp://ftp.allbsd.org/pub/FreeBSD-snapshots/amd64-amd64/9.0-RELENG_9-20120329-JPSNAP/

 There's a new snapshot available there pretty much daily.


Thanks Matthew.

I do recall downloading a STABLE ISO a while back, make that a few years
back. It was a 7.0-STABLE image. I guess they are not there any more :-(



-- 
Mike

Of course, you might discount this possibility, but remember that one in a
million chances happen 99% of the time.

___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: FreeBSD Stable Image

2012-03-30 Thread Julian H. Stacey
Hi,
Reference:
 From: Mike Barnard mike.barna...@gmail.com 
 Date: Fri, 30 Mar 2012 09:32:39 +0300 
 Message-id:   
 cadhh34ofe5v3nrg3lzwvejomzes0fykbfr4patv2hj+j5c6...@mail.gmail.com 

Mike Barnard wrote:
 On 29 March 2012 19:22, Matthew Seaman matt...@freebsd.org wrote:
 
  On 29/03/2012 17:18, Matthew Seaman wrote:
   On 29/03/2012 17:10, Mike Barnard wrote:
   Hi,
  
   Any one know where I can get a FreeBSD-9.0-STABLE ISO/IMG image?
  
   ftp.freebsd.org/pub/FreeBSD/FreeBSD-stable/
  
   That path does not seem to have it.
  
  
   ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/9.0/
 
  Errr... except of course that is -RELEASE and you asked for -STABLE.  I
  don't believe there's a 9.0-STABLE snapshot available at freebsd.org
  right now.  Instead, try one from here:
 
 
  ftp://ftp.allbsd.org/pub/FreeBSD-snapshots/amd64-amd64/9.0-RELENG_9-20120329-JPSNAP/
 
  There's a new snapshot available there pretty much daily.
 
 
 Thanks Matthew.
 
 I do recall downloading a STABLE ISO a while back, make that a few years
 back. It was a 7.0-STABLE image. I guess they are not there any more :-(

With advent of 9 release, various paths that had a single i386 or
amd64 etc in, now have a double set in the path name.
But all the old 8,7,6 etc paths retain use of single $ARCH.
Other than that I dont think there's been other path name changes.

Cheers,
Julian
-- 
Julian Stacey, BSD Unix Linux C Sys Eng Consultants Munich http://berklix.com
 Reply below not above, cumulative like a play script,  indent with  .
 Format: Plain text. Not HTML, multipart/alternative, base64, quoted-printable.
Mail from @yahoo dumped @berklix.  http://berklix.org/yahoo/
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


question regarding geom labels

2012-03-30 Thread Alexander Best
hi there,

i have a question regarding a label for a swap partition. when should i do the
labeling? after or before creating the partition scheme?

when i label before creating the partition scheme, likes this:

glabel label -v swap /dev/da0
gpart create -s GPT /dev/da0

i get the following warning:

GEOM: da1: the secondary GPT header is not in the last LBA.

which is obvious, because the label is being written into the last LBA and thus
the backup GPT header gets written into the last-1 LBA.

if i create the partitioning scheme before labeling the device, like this:

gpart create -s GPT /dev/da0
glabel label -v swap /dev/da0

or

gpart create -s GPT /dev/da0
gpart add -t freebsd-swap /dev/da0
glabel label -v swap /dev/da0p1

the label gets written into da0 or da0p1 and is at constant risk of being
overwritten by userdata.

cheers.
alex
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Surge 2012 CFP is Open!

2012-03-30 Thread Katherine Jeschke
Surge 2012, the scalability conference, September 27-28, Baltimore, MD
has opened its CFP. Please visit http://omniti.com/surge/2012/cfp for
details.

-- 
Katherine Jeschke
Director of Marketing and Creative Services
OmniTI Computer Consulting, Inc.
7070 Samuel Morse Drive, Ste.150
Columbia, MD 21046
O: 443-325-1357, 222
F: 410/872-4911
C: 443/643-6140
omniti.com
Surge2012: http://omniti.com/surge/2012
PG Corridor Days - DC: http://pgday.bwpug.org/

The information contained in this electronic message and any attached
documents is privileged, confidential, and protected from disclosure.
If you are not the intended recipient, note that any review,
disclosure, copying, distribution, or use of the contents of this
electronic message or any attached documents is prohibited. If you
have received this communication in error, please destroy it and
notify us immediately by telephone (1-443-325-1360) or by electronic
mail (i...@omniti.com). Thank you.
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: Please help me diagnose this crazy VMWare/FreeBSD 8.x crash

2012-03-30 Thread Joe Greco
 On 3/29/2012 7:01 AM, Joe Greco wrote:
  On 3/28/2012 1:59 PM, Mark Felder wrote:
  FreeBSD 8-STABLE, 8.3, and 9.0 are untested
 
  As much as I'm sensitive to your production requirements, realistically
  it's not likely that you'll get a helpful result without testing a newer
  version. 8.2 came out over a year ago, many many things have changed
  since then.
 
  Doug
  
  So you're saying that he should have been using 8.3-RELEASE, then.
 
 That isn't what I said at all, sorry if I wasn't clear. The OP mentioned
 9.0-RELEASE, and in the context of his message (which I snipped) he
 mentioned 8-stable. That's what I was referring to.

And since both the poster and I made it clear that this doesn't seem
to be a case of it fails reliably on a machine of your choosing,
just installing random other versions and hoping that it's going to
cause a fail ... well, let's just say that doesn't make a whole lot
of sense.  Or at least it's a recipe for a hell of a lot of busywork,
busywork not guaranteed to return any sort of useful result.

What you suggest is a fine solution for My ASUS Sempron box fails 
when I do X! -- in such a case, Try a different version of FreeBSD 
makes lots of sense.  The problem is, in a virtualization environment,
theoretically the virtual hosts are all the same sort of hardware 
(modulo any specific configuration changes of course), so when someone
presents a problem that afflicts only a percentage of their VM's, it
is important to keep in mind that you are not interacting with physical
hardware, and that reinstalling an OS on a problem VM...?  

Well, let's just say I like real hardware better for many reasons.

In the meantime, it's unrealistic to tell people to use supported
releases, to wait fifteen months between releases, and then to criticize
people complaining about problems with a supported release for using
old code.

... JG
-- 
Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net
We call it the 'one bite at the apple' rule. Give me one chance [and] then I
won't contact you again. - Direct Marketing Ass'n position on e-mail spam(CNN)
With 24 million small businesses in the US alone, that's way too many apples.
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: question regarding geom labels

2012-03-30 Thread Warren Block

On Fri, 30 Mar 2012, Alexander Best wrote:


i have a question regarding a label for a swap partition. when should i do the
labeling? after or before creating the partition scheme?

when i label before creating the partition scheme, likes this:

glabel label -v swap /dev/da0
gpart create -s GPT /dev/da0

i get the following warning:

GEOM: da1: the secondary GPT header is not in the last LBA.

which is obvious, because the label is being written into the last LBA and thus
the backup GPT header gets written into the last-1 LBA.


Right.  Don't do that, the GPT backup header needs to be at the end of 
the physical device.  If you're using that whole disk for swap, there's 
no need for a partition anyway.



if i create the partitioning scheme before labeling the device, like this:

gpart create -s GPT /dev/da0
glabel label -v swap /dev/da0

or

gpart create -s GPT /dev/da0
gpart add -t freebsd-swap /dev/da0
glabel label -v swap /dev/da0p1

the label gets written into da0 or da0p1 and is at constant risk of being
overwritten by userdata.


No.  The swap device entered in /etc/fstab would be /dev/label/swap, 
which is one block smaller than da0p1.  That's the last-block metadata, 
it's safe.


But if the whole disk is for swap, skip the partitioning entirely.
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: Please help me diagnose this crazy VMWare/FreeBSD 8.x crash

2012-03-30 Thread Joe Greco
 On Thu, 29 Mar 2012 19:27:31 -0500, Joe Greco jgr...@ns.sol.net wrote:
 
  It also doesn't explain the experience here, where one VM basically
  crapped out but only after a migration - and then stayed crapped out.
  It would be interesting to hear about your datastore, how busy it is,
  what technology, whether you're using thin, etc.  I just have this real
  strong feeling that it's some sort of corruption with the vmfs3 and thin
  provisioned disk format, but it'd be interesting to know if that's
  totally off-track.
 
 We've ruled out SAN, but we haven't ruled out VMFS. Even FreeBSD Guests on  
 standalone ESXi servers with no SAN exhibit this crash.

 For the record, we only use thick provisioning and if it was corruption  
 I'm not sure what layer the corruption could be at. The crashy servers  
 show no abnormalities when I run either `freebsd-update IPS` or  
 `pkg_libchk` to confirm checksums of all installed programs. Now the other  
 data on there... it's not exactly verified, but our backups via rsnapshot  
 seem to prove there is no issue there or we'd have lots of new files each  
 run.

Crud, there goes part of my theory :-)

Have you migrated these hosts, or were they installed in-place and
never moved?

fwiw the apparent integrity of things on the VM is consistent with
our experience too.

... JG
-- 
Joe Greco - sol.net Network Services - Milwaukee, WI - http://www.sol.net
We call it the 'one bite at the apple' rule. Give me one chance [and] then I
won't contact you again. - Direct Marketing Ass'n position on e-mail spam(CNN)
With 24 million small businesses in the US alone, that's way too many apples.
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: Printer recommendation please

2012-03-30 Thread Julian H. Stacey
Karel Miklav wrote:
 Could you please recommend me a home printer that works nicely with FreeBSD?
 
 HP inkjets aren't that bad, FreeBSD drivers are allright, but I'd like 
 to shift towards some kind of PostScript laser. Xerox Phaser 6500 looks 
 nice, but I can not economically justify my appetite. Is there a cheaper 
 alternative or maybe PostScript printers aren't that good idea anyway, heh?

Postscript printers make [more] sense If:
- Corporate use .. maybe ?
- Trying to offload connected PC CPU (rarely need to for home
  use, now PCs are fast).
- Coms link to printer is slow 
Worst case: I once had a serial cable to a serial 
to parallel converter, then you notice how big PCL data is.
especially if doing own font rendering, not using printer
built in font sets, ( I made my own Russian font sets once).

So now CPU load no longer an issue,  as
these days an ethernet to centronics type converter is cheap, connect
any old PCL laser with centronics (eg my Old HP 4L cost me ~ 3 beers)

Ghostscript converts { PS  PDF etc } to PCL, 
called automatically as a filter from /etc/printcap

I wrote my own filter,
http://berklix.com/~jhs/src/bsd/jhs/bin/local/lpf_vsl/lpf_vsl
before becoming aware there's a standard one:
/usr/ports/print/apsfilter

There's a section in the Handbook about CUPS you should read
For some new HP USB you want certain options in  out of kernel.

Cheers,
Julian
-- 
Julian Stacey, BSD Unix Linux C Sys Eng Consultants Munich http://berklix.com
 Reply below not above, cumulative like a play script,  indent with  .
 Format: Plain text. Not HTML, multipart/alternative, base64, quoted-printable.
Mail from @yahoo dumped @berklix.  http://berklix.org/yahoo/
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


how often to update ports?

2012-03-30 Thread Robert Huff

Aleksandr Miroslav writes:

  How often do you folks update your ports/packages. I was manging
  two servers for years for my personal web/email, and I've rarely
  gone for more than 3 months with any single package being not up
  to date, usually about once a month I would update all my ports.

Security updates go in as soon as they can be tested locally.
Everything else ... within a couple of days, unless a) others
report problems, or b) it requires a lot of re-building dependant
ports (e.g. perl, X, autotools).
Caveats: no machine is mission-critical; most are lightly
loaded; spares are available.


Robert Huff


___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: Printer recommendation please

2012-03-30 Thread Jerry
On Fri, 30 Mar 2012 16:14:20 -0400
Mike Jeays articulated:

 I strongly recommend a laser printer over an inkjet even for home
 use. The reduced running costs and better reliability are easily
 worth the lack of colour, IMO. I have used an HP 1020 for three years
 now, and it works fine after three cartridges. I had an inkjet fail
 at the first cartridge change, after I bought new cartridges. (EPSON
 - never again).

I know several students that purchase inexpensive ink-jet printers that
work perfectly. When the ink runs out, they just replace the unit. The
cost is about the same.

I could replace probably four cheap ink-jet units for what it is gong to
cost me just to replace the cartridges in my Brother Laser Color unit.
Then when you factor in the other parts that eventually will need
replacement, it really gets expensive.

-- 
Jerry ♔

Disclaimer: off-list followups get on-list replies or get ignored.
Please do not ignore the Reply-To header.
__
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: Printer recommendation please

2012-03-30 Thread Polytropon
On Fri, 30 Mar 2012 17:38:36 +0200, Karel Miklav wrote:
 Could you please recommend me a home printer that works nicely with FreeBSD?
 
 HP inkjets aren't that bad, FreeBSD drivers are allright, but I'd like 
 to shift towards some kind of PostScript laser. Xerox Phaser 6500 looks 
 nice, but I can not economically justify my appetite. Is there a cheaper 
 alternative or maybe PostScript printers aren't that good idea anyway, heh?

Allow me to mention some things that are worth investing in.

1. Network connection.
Don't bother with USB stuff. Buy a printer that offers Ethernet
and maybe also WLAN, this will save you many trouble, and you
are free to put the printer wherever you want.

2. Standard language.
Postscript and PCL. Make sure the printer understands at least
one of them. PCL is very common among HP printers. Regarding
drivers - you don't need them. PS is the default output format
for printing from every application. Printer filter collections
such as apsfilter or CUPS tend to support non-PS printers very
well, and it's quite easy to write your own printer filter (may
even be a one-liner) using ghostscript. There's nothing wrong
with PS because (as I said) you don't need any drivers, but the
data transfer may need some time, and the processing speed
depends on how fast and how good (!) the PS interpreter in the
printer is. In my experience (with the printers I'm going to
mention at the end of this message) PCL is faster.

3. Laser printer.
Don't believe that inkpee printers are genereally cheaper. They
are not. The only excuse for using them is that you need photo
quality color prints (requiring the proper paper, too).

4. Additional functionalities.
Before buying something, ask yourself what you need. Does it
need to have a scanner? Does the scanner part support FreeBSD?
Is there a way to scan to local storage (e. g. USB stick)
in the printer? Does it need a sheet feeder for scan input?
Does it need to scan photo positive/negative films? Does it
need to fax?

I have had good luck with my army of laser printers here.
HP Laserjet II, 4, 4000 duplex, as well as a Samsung color
laserprinter CLX-2160. All this stuff works out of the box.
I don't have any need for inkpee. Photos can be printed at
much better quality at my local drugstore, if I need that.
The printer filters are gs one-liners I wrote myself, because
I speak PCL to the laser printer, and some splix gibberish
using foo2qpdl to the (sadly USB connected) color printer.




-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: freebsd 9.0-release + zfs + mysqld(percona) = kernel: swap zone exhausted, increase kern.maxswzone

2012-03-30 Thread Philip M. Gollucci
On 03/28/12 03:09, Philip M. Gollucci wrote:

 It works out to roughly 7.7GB from 32MB okay fine.
 If I double it, that should give me 15.4GB from 64MB (still not enough).
 If I 16x it that should give me 246GB from 512MB.  Thats more my
 physical ram + swap.  Oh well.

After reading several sparse articles/post, I've come to the conclusion
that FreeBSD doesn't do well with SWAP  32GB; however it does allow it.
As such I decided to drop the swap to 8GB*2=16GB.  Sadly that didn't
help either after dropping kern.maxswzone back 2*thedefault which is
apparently very near or the max you can up it and get more actual
SWAPMETA space b/c of the limiting based on the number of total system
pages.

I'm still quite perplexed here.  Please also the recent thread on
-stable where someone has the same problem with ZFS/NFS.

subject: 9-STABLE, ZFS, NFS, ggatec - suspected memory leak



-- 

1024D/DB9B8C1C B90B FBC3 A3A1 C71A 8E70  3F8C 75B8 8FFB DB9B 8C1C
Philip M. Gollucci (pgollu...@p6m7g8.com) c: 703.336.9354
Member,   Apache Software Foundation
Committer,FreeBSD Foundation
Consultant,   P6M7G8 Inc.
Director Operations,  Ridecharge Inc.

Work like you don't need the money,
love like you'll never get hurt,
and dance like nobody's watching.



signature.asc
Description: OpenPGP digital signature


Re: Printer recommendation please

2012-03-30 Thread RW
On Fri, 30 Mar 2012 16:14:20 -0400
Mike Jeays wrote:

 I strongly recommend a laser printer over an inkjet even for home
 use. The reduced running costs and better reliability are easily
 worth the lack of colour, IMO. 

How do they compare for light and  occasional use? I'm thinking in
terms of a few pages, a few times a year, so presumably the
consumables become perishables.
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: Printer recommendation please

2012-03-30 Thread Chris Hill

On Fri, 30 Mar 2012, RW wrote:


On Fri, 30 Mar 2012 16:14:20 -0400
Mike Jeays wrote:

I strongly recommend a laser printer over an inkjet even for home 
use. The reduced running costs and better reliability are easily 
worth the lack of colour, IMO.


How do they compare for light and occasional use? I'm thinking in 
terms of a few pages, a few times a year, so presumably the 
consumables become perishables.


In exactly that scenario, ink nozzles can dry out, rendering your inkjet 
printer inoperable. I only print every few weeks, and if I had to 
replace ink for every print just because it dried out, I think I might 
become angry. My laser printer works even after months of inactivity.


For the record, I completely agree with Mike. I also would not buy a 
printer that did not speak Postscript. My PS-speaking LaserJet was 
working as fast as I could edit /etc/printcap - no CUPS, no drivers, no 
ghostscript, no filters.


--
Chris Hill   ch...@monochrome.org
** [ Busy Expunging / ]
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


RE: Printer recommendation please

2012-03-30 Thread Graeme Dargie


-Original Message-
From: owner-freebsd-questi...@freebsd.org 
[mailto:owner-freebsd-questi...@freebsd.org] On Behalf Of Karel Miklav
Sent: 30 March 2012 16:39
To: freebsd-questions@freebsd.org
Subject: Printer recommendation please

Could you please recommend me a home printer that works nicely with FreeBSD?

HP inkjets aren't that bad, FreeBSD drivers are allright, but I'd like to shift 
towards some kind of PostScript laser. Xerox Phaser 6500 looks nice, but I can 
not economically justify my appetite. Is there a cheaper alternative or maybe 
PostScript printers aren't that good idea anyway, heh?

--

Thanks,
Karel
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org

Not exactly conclusive, I have a Dell 1320C with the Ethernet module, and while 
I have never needed to connect it to one of my FreeBSD machines, it would work 
with OS X and CUPS, since then Dell has released an official driver for OS X. 
However I am not sure as to how much use an OS X driver would be for FreeBSD, 
for £90 I am satisfied with its performance.

Regards

Graeme
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org

FreeBSD Security in Multiuser Environments

2012-03-30 Thread schultz

Hello,

I would like to raise a discussion about the security features
of FreeBSD as a whole and how they might be employed to actually
derive some meaningful guarantees.

I have found myself administering a system with many potentially
untrusted users. Furthermore, some users do not trust some of the
programs they run and are thus allowed to ask for some slave
accounts. A slave account is a user account accessible only to
root and the master user. This can lead to a hierachy of authority.
Also, each account has potentially confidential data that may be
accessed only by the account itself and its ancestor accounts. This
includes when a user is logged on and what the user is running.
Finally, the system must always be up so no user untrusted by root
may trash it.

This is a pretty harsh set of restrictions and is almost unmanageable.
However, I have taken three steps to ensure security: base system
hardening, using sudo for privilege granting and using rctl(8) for
resource accounting and control. Gathering enough information in these
three areas has been an ongoing task for almost half a year, and I
would like to discuss some problems of my approach.

In terms of system hardening, I have:
  * Encrypted the whole (except /boot) system with geli(8)
(HMAC/SHA256 and AES-XTS). It is not as nice and much slower
than proper filesystem-level checksumming but it is what
FreeBSD provides (ZFS is too unstable).
  * Disabled useless and potentially dangerous services: cron, devd
and sendmail.
  * Removed every setuid bit. The system works even then.
  * Hardened /dev: every non necessary device has had the 0007 bits
stripped. Optional groups were created (e.g. audio, mixer and mic
for devices /dev/{mixer,dsp,audio}*).
  * Hardened the sysctls:
- security.bsd.see_other_uids=0: Users can only see own processes.
- security.bsd.unprivileged_proc_debug=0
- security.bsd.unprivileged_read_msgbuf=0: The log is considered
  sensitive information.
- security.bsd.hardlink_check_uid=1: Avoid hardlinks to old SUID
  binaries.
- kern.log_console_output=0
- kern.coredump=0
- vm.overcommit=1: This avoids retarded Linux-like behaviour on
  OOM conditions.
  * Changed permissions on /root to 0700: root deserves privacy.
  * A boot script changes some permissions:
- /var/log to 0750: the logs are considered sensitive information.
- /var/run/dmesg.boot to 0640: this is also sensitive information.
  * Added a group sudoers and made sudo setuid only to users in
sudoers: would have avoided trouble with recent sudo exploit if
only trusted users have slaves.

As for using sudo to grant privilege, for each master-slave
relationship between users u and v, I have added a line like
u ALL = (v) NOPASSWD: ALL to /etc/sudoers. Then the user u is
supposed to become v by issuing sudo -i -u v and to execute a
command as v by issuing sudo -i -u v 

It is worth noticing that sudo closes all file descriptors greater than
or equal to 3. It is important not to let your pseudo-terminal leak
through file descriptors 0, 1 and 2 if you have a shell connected to
it.  Also, the -i is mandatory because otherwise a file descriptor
open at directory . is leaked via the cwd file descriptor. I
believe this is enough, but since this is not properly documented, I
am not sure.

As for resource limiting via rctl(8), for each user u root does not
trust, I have added three rules:
  * user:u:vmemoryuse:deny=MEM
  * user:u:maxproc:deny=PROCS
  * user:u:pseudoterminals:deny=0

Here MEM and PROCS are limits on total virtual memory usage and
total occupied entries in the process table for process u,
respectively. Furthermore, I never give access to pseudo-terminals to
untrusted users because all sessions are started from ssh or ptys of
trusted users. Also, ptys must be available otherwise trusted users can
not work on the machine. Finally, I have noticed rctl -u user:u
reports a single pty open for user u no matter how many open ptys u has
(except of course if u has no open pty, in which case 0 is reported).

One naively would expect these restrictions to be enough to prevent
abuse (trashing or DoS) as long as the sum of the MEM values (rounded
up to page size) is less than or equal to the total physical memory
plus swap space less the system (and trusted users') memory usage and
the sum of the PROC values is less than the process table size minus
the number of trusted processes. I sincerely do not know if this is the
case.

However, using vmemoryuse as a limit is overkill: it counts the total
mapped pages, not the total anonymous pages, which are the ones that
actually take resources. Of course, this assumes the memory management
data structures (including the page table) are accounted as anonymous
memory of the corresponding process, since it is easy (especially on
amd64), to map pages sparsely to greatly increase the size of the
page table. However, I do not know if this assumption holds on

RE: Printer recommendation please

2012-03-30 Thread Matt Emmerton
On Fri, 30 Mar 2012 16:14:20 -0400
 Mike Jeays wrote:
 
  I strongly recommend a laser printer over an inkjet even for home use. 
  The reduced running costs and better reliability are easily worth the 
  lack of colour, IMO.

 How do they compare for light and  occasional use? I'm thinking in terms
of a few pages,
 a few times a year, so presumably the consumables become perishables.

Toner really doesn't go bad, and good laser printers are built to last.  My
first laser printer was an HP LaserJet 5P that my local bank branch was
throwing away in 2003. It ran on its existing toner cartridge for 5 or 6
years under light use - maybe 500 pages per year.

Matt



___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: Printer recommendation please

2012-03-30 Thread Polytropon
On Sat, 31 Mar 2012 00:12:07 -0400, Matt Emmerton wrote:
 Toner really doesn't go bad, and good laser printers are built to last.  My
 first laser printer was an HP LaserJet 5P that my local bank branch was
 throwing away in 2003. It ran on its existing toner cartridge for 5 or 6
 years under light use - maybe 500 pages per year.

Ha, that's nothing!

I _still_ have a fully functional HP Laserjet 4. I got it
in a heavily used state in 1996, and I've never treated it
in a polite way: always quite heavy use. The printer is
still working today, after more than 15 years. It has
been on pause for some years, and right after plugging
it in again, it produced regular quality results. Just
try _that_ with typical home consumer inkpee stuff. :-)

I can't tell you how many pages the printer has done in
its life. The page counter must have encountered an overrun
and now says some 4 digit number which doesn't increase
anymore. So now I can sell it as only few pages printed,
like new... :-)

If durability is interesting, buying a laser printer will
be the right choice. Today's inkpee printers seem to be
the same price as a full ink cartridge refill (or even
lower), creating cheaper devices on one hand (good), but
creating more electronic waste at the other hand (bad).
So if you want to reduce garbage, get a printer that will
serve you for a long time.

When I was at university, there was a student, a rich one
as one could assume: When he had emptied a printer, he
bought a new one, dropping the old one into the garbage
can. He even bought a new printer when he failed to plug
in the one he just bought, and he also bought a new one
when he didn't get the drivers installed of another new
printer. He threw away two (maybe more?) fully functional
printers.

You see, money can compensate stupidity. His educational
result? He got a degree in computer science. :-)



-- 
Polytropon
Magdeburg, Germany
Happy FreeBSD user since 4.0
Andra moi ennepe, Mousa, ...
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: Printer recommendation please

2012-03-30 Thread Robert Bonomi

RW rwmailli...@googlemail.com wrote:
 Mike Jeays wrote:

  I strongly recommend a laser printer over an inkjet even for home
  use. The reduced running costs and better reliability are easily
  worth the lack of colour, IMO. 

 How do they compare for light and  occasional use? I'm thinking in
 terms of a few pages, a few times a year, so presumably the
 consumables become perishables.

Laser 'consumables' do _not_ suffer problems if the printer is only used
occasionally.  This is, in fact, one of the *BIG* advantaes of lasers 
over inkpee units.  The 'cost per page' of output, at the rated pagecount
is substantially lower for lasers, *AND* you will get the rated pagecount,
even if it takes a decade, or longer.

I've got a low-end laser I bought, *used*, over a decade ago.  I have
-yet- to replace the _used_ toner cartridge that came with the printer.
Print quality is still as good as when I got it.

My 'total cost of ownership' is, so far, around $3/year, and _declining_. 
Or, under two cents per page, _including_ the cost of the hardware.

With inkpee printers you have to print a some pages every couple of weeks
(preferably somewhat more often) or you run a _high_ probability of the
cartridge having gotten 'gummed up', and rendered unusable, *despite* the
amount of ink remaining in it.   In 'lightly used' units, this can result
in a _tripling_ (or more) of the (already high) 'true cost' per page of 
output.

___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: Printer recommendation please

2012-03-30 Thread Erich Dollansky
Hi,

On Saturday 31 March 2012 11:28:55 Polytropon wrote:
 On Sat, 31 Mar 2012 00:12:07 -0400, Matt Emmerton wrote:
 
 When I was at university, there was a student, a rich one
 as one could assume: When he had emptied a printer, he
 bought a new one, dropping the old one into the garbage
 can. He even bought a new printer when he failed to plug
 in the one he just bought, and he also bought a new one
 when he didn't get the drivers installed of another new
 printer. He threw away two (maybe more?) fully functional
 printers.

I know a person who did this too. But for the purpose of saving money. It was 
during a time when new printers with refill have been cheaper than the refill. 
This guy actually saved money and has had the latest model.

I do not know if the pricing is still this strange.

Erich
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: Printer recommendation please

2012-03-30 Thread Erich Dollansky
Hi,

On Saturday 31 March 2012 11:12:07 Matt Emmerton wrote:
 On Fri, 30 Mar 2012 16:14:20 -0400
  Mike Jeays wrote:
  
   I strongly recommend a laser printer over an inkjet even for home use. 
   The reduced running costs and better reliability are easily worth the 
   lack of colour, IMO.
 
  How do they compare for light and  occasional use? I'm thinking in terms
 of a few pages,
  a few times a year, so presumably the consumables become perishables.
 
 Toner really doesn't go bad, and good laser printers are built to last.  My
 first laser printer was an HP LaserJet 5P that my local bank branch was
 throwing away in 2003. It ran on its existing toner cartridge for 5 or 6
 years under light use - maybe 500 pages per year.

yes, take a laser. Inkjets just dry out before the next use. You need then to 
take some time to fix it. I have had only one in my life. I thought it was a 
good buy until I realised this problem.

My first laser printer was a IIP running for at least a decade until the 
electronics gave way. I just realised that I have had no laser printer failing 
mechanically.

The problem might will be to find a cheap one which works with FreeBSD. Friends 
bought the cheapest Samsung AIO. It did not give them any problems running 
Linux.

Erich
 
 Matt
 
 
 
 ___
 freebsd-questions@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/freebsd-questions
 To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
 
 
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org