Re: SSD for ZIL suggestions?
On Fri, Jan 13, 2012 at 09:40:58PM -0600, Rob wrote: > I'm looking at getting a couple of SSDs to act as ZIL drives on FreeBSD > 8/9 systems. Are there any recommended drives? We recently bought the Intel 311 for that purpose. This drive is quite cheap and should perform ok. If you want something better have a look at the 710 line. You should always mirror your ZIL drives. There's a lot of content available on this subject actually. I once read about a tool called zilstat which should help you decide if you do actually need a SSD. NFS and db's are the usual usecases. cherio, Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: NFSv4 and file locking
On Thu, Jan 12, 2012 at 05:37:57PM +0100, Leon Meßner wrote: > Hi, > > Does anyone know what you have to do to get locking working under NFSv4? > I tried the following: > > # mount_nfs -o nfsv4,sec=sys ip.nfsv4:/nfstest /mnt/test > # mount | grep ip.nfsv4 > ip.nfsv4:/nfstest on /mnt/test (newnfs) > # kldstat | grep nfs > 62 0x8103f000 1015fnfscommon.ko > 91 0x81054000 3008fnfscl.ko > # cd /mnt/test > # lockf testlockfile ls > lockf: cannot open testlockfile: Operation not supported Looks like lockf is the wrong tool for this job. I tried the NFSv4 lock testing suite from [1] and this worked flawlessly. I don't know if this test actually does what it claims to do but as i couldn't find any freebsd specific testing tool this will probably suffice. Thanks, Leon [1] http://nfsv4.bullopensource.org/tools/tests_index.php (see locks robustness) ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
NFSv4 and file locking
Hi, Does anyone know what you have to do to get locking working under NFSv4? I tried the following: # mount_nfs -o nfsv4,sec=sys ip.nfsv4:/nfstest /mnt/test # mount | grep ip.nfsv4 ip.nfsv4:/nfstest on /mnt/test (newnfs) # kldstat | grep nfs 62 0x8103f000 1015fnfscommon.ko 91 0x81054000 3008fnfscl.ko # cd /mnt/test # lockf testlockfile ls lockf: cannot open testlockfile: Operation not supported Client runs 8.2-RELEASE-p6, Server runs 8-STABLE from about a month ago. cherio, Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: NFSv4 directory listing issues.
On Tue, Aug 23, 2011 at 01:11:52AM +0200, Leon Meßner wrote: > Hi, > > i'm just testing a kerberized NFSv4 export of a ZFS-Filesystem. Both > client and server are FreeBSD at the moment. I tried Linux clients, but > could not mount with sec=krb5. If i mount an exported directory with > -o sec=krb5(i|p)i, directory listings with ls do sometimes take a very > long time (about 20times). Example output below. > > > time ls -la > total 8 > drwxr-xr-x+ 3 rootwheel 4 Aug 16 13:27 . > drwxr-xr-x 3 locadm locadm 512 Aug 22 23:46 .. > drwxr-xr-x+ 2 rootwheel 2 Aug 16 13:27 testdir > -rw-r--r-- 1 rootwheel 0 Aug 16 13:27 testfile > 0.003u 0.003s 0:00.23 0.0% 0+0k 0+0io 0pf+0w > > time ls -la > total 8 > drwxr-xr-x+ 3 rootwheel 4 Aug 16 13:27 . > drwxr-xr-x 3 locadm locadm 512 Aug 22 23:46 .. > drwxr-xr-x+ 2 rootwheel 2 Aug 16 13:27 testdir > -rw-r--r-- 1 rootwheel 0 Aug 16 13:27 testfile > 0.000u 0.007s 0:04.27 0.0% 0+0k 0+0io 0pf+0w > > The share is mounted by a local user with a kerberos ticket by > mount -t nfs -o nfsv4,sec=krb5 130.149.58.249:/home mount. > Mounting with sec=sys does not produce this problem. > Has anyone experienced similar issues ? It looks like this could be related to kern/158432 [1] although i'm using IPv4 and amd64. I can't test it at the moment because the testmachine is temp. out of service but i got the same error messages in my kdc's log file. Greetings, Leon [1] http://www.freebsd.org/cgi/query-pr.cgi?pr=158432&cat=kern ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
NFSv4 directory listing issues.
Hi, i'm just testing a kerberized NFSv4 export of a ZFS-Filesystem. Both client and server are FreeBSD at the moment. I tried Linux clients, but could not mount with sec=krb5. If i mount an exported directory with -o sec=krb5(i|p)i, directory listings with ls do sometimes take a very long time (about 20times). Example output below. > time ls -la total 8 drwxr-xr-x+ 3 rootwheel 4 Aug 16 13:27 . drwxr-xr-x 3 locadm locadm 512 Aug 22 23:46 .. drwxr-xr-x+ 2 rootwheel 2 Aug 16 13:27 testdir -rw-r--r-- 1 rootwheel 0 Aug 16 13:27 testfile 0.003u 0.003s 0:00.23 0.0% 0+0k 0+0io 0pf+0w > time ls -la total 8 drwxr-xr-x+ 3 rootwheel 4 Aug 16 13:27 . drwxr-xr-x 3 locadm locadm 512 Aug 22 23:46 .. drwxr-xr-x+ 2 rootwheel 2 Aug 16 13:27 testdir -rw-r--r-- 1 rootwheel 0 Aug 16 13:27 testfile 0.000u 0.007s 0:04.27 0.0% 0+0k 0+0io 0pf+0w The share is mounted by a local user with a kerberos ticket by mount -t nfs -o nfsv4,sec=krb5 130.149.58.249:/home mount. Mounting with sec=sys does not produce this problem. Has anyone experienced similar issues ? cherio, Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
8.3Release status?
Hi, is there already any information regarding the release process of 8.3 available ? On http://www.freebsd.org/releng/index.html 8.2 is still listed under the "Upcoming release schedule" section. I'm too curious to see which work/project made the release (like http://wiki.freebsd.org/Releng/8.2TODO for 8.2). cherio, Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: SAS controller for FreeBSD
On Sat, Jun 25, 2011 at 04:47:19PM -0400, Daniel Feenberg wrote: > > > On Sat, 25 Jun 2011, Leon Meßner wrote: > > > On Fri, Jun 24, 2011 at 06:51:37PM -0400, Daniel Feenberg wrote: > > ... > >> > >> There are some SAS RAID controllers that claim to support FreeBSD but I > >> can't tell if their JBOD mode is a true pass-through, or leaves some > >> undesirable junk on the disk. > >> > >> So does anyone have a recomendation for a reasonably priced SAS > >> controller? We aren't looking for anything fancy at this point. > > > > We are using two of the LSI SAS2008 based cards here and have no > > problems with them. Be sure to run a recent STABLE as the mps driver is > > relatively new. Speed and reliability are very nice. The only thing we > > February of this year: > >http://lists.freebsd.org/pipermail/freebsd-scsi/2011-February/004784.html > > > are missing is IR-Firmware support but if you only want a HBA this won't > > bother you. > > If I search the LSI website for "SAS2008" the first hit includes a > description of the chipset features, including the bullet point > >* Integrated RAID > > All the cards on the LSI website that I can find using the SAS2008 chipset > include the sentence "Integrated RAID avoids additional host CPU overhead" > in their brief description, even the ones labeled "HBA". Apparently the > FreeBSD driver does not include an interface to the RAID capability, but > it seems that the chipset still provides it. I suppose this still avoids > controller lock in, so it should be satisfactory. Can I ask what model you > have? We are running the SAS 9200-8e and the onboard version on the X8SI6-F Mainboard from Supermicro. It was possible to Flash IT-Firmware on Systems that had been delivered with IR-Firmware. I think they removed that feature from their flashing utility. cheers, Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: SAS controller for FreeBSD
On Fri, Jun 24, 2011 at 06:51:37PM -0400, Daniel Feenberg wrote: > > We have been using ZFS under FreeBSD for a while, and are very pleased, > but are considering building a system with SAS drives, in the hope that > they will be faster (any truth to that?). I am assuming that I should look > for a non-RAID controller, but I can't find any SAS controllers that don't > claim to do RAID and are on the FreeBSD compatibility list. I have always > thought that using a RAID controller for a non-raid partition was a bad > idea, since it limited ones ability to swap controllersm, and presumably > if we are using ZFS for our RAID we don't need another level of RAID > provided by the controller. Is that prejudice justified? > > There are some SAS RAID controllers that claim to support FreeBSD but I > can't tell if their JBOD mode is a true pass-through, or leaves some > undesirable junk on the disk. > > So does anyone have a recomendation for a reasonably priced SAS > controller? We aren't looking for anything fancy at this point. We are using two of the LSI SAS2008 based cards here and have no problems with them. Be sure to run a recent STABLE as the mps driver is relatively new. Speed and reliability are very nice. The only thing we are missing is IR-Firmware support but if you only want a HBA this won't bother you. cherio, Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: dnssec with freebsd's resolver(3)
This mail got only send to Matthew because of bad time of day ;) On Wed, Jun 22, 2011 at 10:58:00PM +0100, Matthew Seaman wrote: > On 22/06/2011 20:02, Osterweil, Eric wrote: > > > > > > > > On 6/22/11 2:56 PM, "Leon Meßner" wrote: > > > >> On Mon, Jun 20, 2011 at 06:17:23AM +0100, Matthew Seaman wrote: > >>> On 20/06/2011 01:37, Leon Meßner wrote: > >>>> does the freebsd resolver(3) support sending the DO bit in queries and > >>>> thus do DNSSEC validation ? I tried using ssh with SSHFP RR's in a > >>>> signed zone but i still get the "insecure Key" message from ssh on > >>>> FreeBSD (works on some other OS). > >>> > >>> My understanding is that the stub resolver in the base system does not > >>> handle any DNSSEC functionality. It's not clear (at least to me) that > >>> DO bit processing in stub resolvers is very useful -- without support in > >>> the recursive resolver you use upstream, it won't work, but if your > >>> recursive resolver does DO processing, then you don't need it in your > >>> stub resolver. > >> > >> Ok, my recursive resolver does DO processing. How do i tell ssh to set > >> the bit ? Doesn't ssh use my base system stub resolveer to query my in > >> resolv.conf configured DNS ? > > > > I'm not sure what you mean by "DO processing," but validation requires a > > little more than issuing queries w/ the DO bit set (that has been the > > default in BIND for a while). You need to have the root (or some other) > > trust-anchor configured, and you need to enable DNSSEC validation in your > > named.conf. > > > > Only after that will you see the AD bit at the stub. > > Actually, typically with a correctly configured validating resolver, as > an end user issuing queries from the system's stub resolver, you'll only > see responses with data that is either: > > -- completely unsigned > > -- signed, and that validates correctly > > Data that doesn't validate correctly is discarded. Better make sure > your DNSSEC setup is correctly maintained and updated, or your domains > may effectively disappear from the net. > > "validates correctly" is a function of how your recursive resolver is > configured: for instance, you will probably want to trust DLV secured > data until authentication paths up to the root become more prevalent in > all corners of the DNS. The only thing i want to do at the moment is serve my local zone to my local clients. If i do % dig @dns +dnssec rosa.physik-pool.tu-berlin.de i get ;; flags: qr rd ra ad; QUERY: 1, ANSWER: 2, AUTHORITY: 4, ADDITIONAL: 3 and also i can see the D0 bit set when looking at the tcpdump. If i now use the stub resolver through telnet/ssh the D0 bit does _not_ get set in the query. So there is no way for the recursive NS to supply AD data, right ? thanks for helping the blind. Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: dnssec with freebsd's resolver(3)
On Mon, Jun 20, 2011 at 06:17:23AM +0100, Matthew Seaman wrote: > On 20/06/2011 01:37, Leon Meßner wrote: > > does the freebsd resolver(3) support sending the DO bit in queries and > > thus do DNSSEC validation ? I tried using ssh with SSHFP RR's in a > > signed zone but i still get the "insecure Key" message from ssh on > > FreeBSD (works on some other OS). > > My understanding is that the stub resolver in the base system does not > handle any DNSSEC functionality. It's not clear (at least to me) that > DO bit processing in stub resolvers is very useful -- without support in > the recursive resolver you use upstream, it won't work, but if your > recursive resolver does DO processing, then you don't need it in your > stub resolver. Ok, my recursive resolver does DO processing. How do i tell ssh to set the bit ? Doesn't ssh use my base system stub resolveer to query my in resolv.conf configured DNS ? thanks, Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
dnssec with freebsd's resolver(3)
Hi, does the freebsd resolver(3) support sending the DO bit in queries and thus do DNSSEC validation ? I tried using ssh with SSHFP RR's in a signed zone but i still get the "insecure Key" message from ssh on FreeBSD (works on some other OS). cherio, Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Kernel loading very slowly with specific (wrong?) loader.conf
Hi, when you use the following loader.conf: # cat /boot/loader.conf hint.sio.1.flags="0x20" comconsole_speed="115200" boot_multicons="yes" and have no /boot.config, then booting the kernel is extremely slow. It writes about one character per second on the screen. Also i dont actually have a serial device (dmesg says so), although i should. cu, Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Mentioning of geom in the handbook's RAID chapter.
Hi, I recently searched google for "FreeBSD software raid" because i wanted to compare the advice google gives me for creating a software raid in linux and freebsd. First hit here was the link to the handbook page (18.4). This page still is only talking about ccd and vinum. I know there is a whole chapter about geom but why is there no mentioning about that in the Storage.RAID part of the Handbook ? Sincerly, Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: SAS HBA card for freebsd?
On Thu, Dec 23, 2010 at 10:32:24PM -0500, Robert Boyer wrote: > I need a SAS controller that has preferably 8 ports (two four channel) > connections per card. I don't mind decent buying a RAID card but really > really desire it to be configurable in HBA mode vs. RAID or JBOD with RAID > signatures. There are plenty of HBA only cards that would be suitable but I > can find none that seem to fit the bill in terms of FreeBSD. I have seen a > couple of cheap RAID cards recommended but cannot seem to get a definitive > answer of whether they are actually configurable as plain old disks (HBA > mode) vs JBOD w/ RAID signature. > > Anybody using a reasonably priced card that fits the bill? Not yet, but were planning to get the LSI 9200. The driver is prob. comming in 8.2 if i interpret the TODO list correctly. If you are fine with SAS version 1 there are lots of good supported RAID-cards that can work in JBOD mode. chario, Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: A jail with a dash in its name
On Tue, Dec 21, 2010 at 11:31:42PM +0100, Christer Solskogen wrote: > On Tue, Dec 21, 2010 at 9:26 PM, Matthew Seaman > wrote: > > > Of course, there's no problem with using the form 'forest-friend' on the > > RHS of any assignments, so long as it's properly quoted, of course. > > > > Thanks for all your help! > I chose to remove all hyphens instead. I use ezjail and have jails with hyphens. Everything works fine there. salut, Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: Stale NFS file handles on 8.x amd64
I set a wrong cc . Please look over to -stable. Sorry for that, Leon On Tue, Nov 30, 2010 at 03:10:18PM +, krad wrote: > On 30 November 2010 01:48, Leon Meßner wrote: > > > Hi, > > > > On Mon, Nov 29, 2010 at 08:06:54PM -0500, Adam McDougall wrote: > > > I've been running dovecot 1.1 on FreeBSD 7.x for a while with a bare > > > minimum of NFS problems, but it got worse with 8.x. I have 2-4 servers > > > (usually just 2) accessing mail on a Netapp over NFSv3 via imapd. > > > delivery is via procmail which doesn't touch the dovecot metadata and > > > webmail uses imapd. Client connections to imapd go to random servers > > > and I don't yet have solid means to keep certain users on certain > > > servers. I upgraded some of the servers to 8.x and dovecot 1.2 and ran > > > into Stale NFS file handles causing index/uidlist corruption causing > > > inboxes to appear as empty when they were not. In some situations their > > > corrupt index had to be deleted manually. I first suspected dovecot 1.2 > > > since it was upgraded at the same time but I downgraded to 1.1 and its > > > doing the same thing. I don't really have a wealth of details to go on > > > yet and I usually stay quiet until I do, and half the time it is > > > difficult to reproduce myself so I've had to put it in production to get > > > a feel for progress. This only happens a dozen or so times per weekday > > > but I feel the need to start taking bigger steps. I'll probably do what > > > > Does it depend on the size of the message? > > > > > I can to get IMAP back on a stable base (7.x?) and also try to debug 8.x > > > on the remaining servers. A binary search is within possibility if I > > > can reproduce the symptoms often enough even if I have to put a test > > > server in production for a few hours. > > > > > > Any tips on where we could start looking, or alterations I could try > > > making such as sysctls to return to older behavior? It might be worth > > > > there were some problems on nullfs mounted nfs shares (like in jails) > > and dovecot, as dovecot changed its location for temporary file creation > > to the user home. But IIRC the error message looked more like: > > http://www.mail-archive.com/dove...@dovecot.org/msg26856.html > > And are fixed in stable. > > > > Just a hint, > > Leon > > ___ > > freebsd-questions@freebsd.org mailing list > > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > > To unsubscribe, send any mail to " > > freebsd-questions-unsubscr...@freebsd.org" > > > > > im seeing similar issues on a large mail platform with netapp and dovecot on > freebsd 8.1 as well. The problems existed in 7.x as well though. Basically > the NFS mount just locks up. I've not managed to pin point it yet but one > thing im certain of its a client os issue rather than the filer. This is > because only one node out fo the 16 will lock at any time on that particular > nfs mount. Strangely as well if I remount the dead nfs share on say /mnt on > the affected node, it works fine. I'm convinced its some kind of locking > issue. > > I have dtrace (WITH_CTF=1) in the kernel, so will have a poke around with > that and see if I can see anything interesting. Can anyone recommend > anything here? > ___ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org" ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: Stale NFS file handles on 8.x amd64
Hi, On Mon, Nov 29, 2010 at 08:06:54PM -0500, Adam McDougall wrote: > I've been running dovecot 1.1 on FreeBSD 7.x for a while with a bare > minimum of NFS problems, but it got worse with 8.x. I have 2-4 servers > (usually just 2) accessing mail on a Netapp over NFSv3 via imapd. > delivery is via procmail which doesn't touch the dovecot metadata and > webmail uses imapd. Client connections to imapd go to random servers > and I don't yet have solid means to keep certain users on certain > servers. I upgraded some of the servers to 8.x and dovecot 1.2 and ran > into Stale NFS file handles causing index/uidlist corruption causing > inboxes to appear as empty when they were not. In some situations their > corrupt index had to be deleted manually. I first suspected dovecot 1.2 > since it was upgraded at the same time but I downgraded to 1.1 and its > doing the same thing. I don't really have a wealth of details to go on > yet and I usually stay quiet until I do, and half the time it is > difficult to reproduce myself so I've had to put it in production to get > a feel for progress. This only happens a dozen or so times per weekday > but I feel the need to start taking bigger steps. I'll probably do what Does it depend on the size of the message? > I can to get IMAP back on a stable base (7.x?) and also try to debug 8.x > on the remaining servers. A binary search is within possibility if I > can reproduce the symptoms often enough even if I have to put a test > server in production for a few hours. > > Any tips on where we could start looking, or alterations I could try > making such as sysctls to return to older behavior? It might be worth there were some problems on nullfs mounted nfs shares (like in jails) and dovecot, as dovecot changed its location for temporary file creation to the user home. But IIRC the error message looked more like: http://www.mail-archive.com/dove...@dovecot.org/msg26856.html And are fixed in stable. Just a hint, Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: Mutt Port broken ?
Salut, On Sun, Nov 14, 2010 at 04:11:35PM +0100, t...@diogunix.com wrote: > Hello everybody, > > just tried to build /usr/ports/mail/mutt but surprisingly got stuck with an > Error 1 though the ports collectionis updated and well maintained: > > m_err -lcrypto -lasn1 -lroken -lcrypt -lssl -lcrypto -lintl -liconv -liconv > muttlib.o(.text+0x12f2): In function `mutt_mktemp': > : warning: warning: mktemp() possibly used unsafely; consider using > mkstemp() > /usr/lib/libhx509.so: undefined reference to `MD2_Init' > /usr/lib/libhx509.so: undefined reference to `MD2_Final' > /usr/lib/libhx509.so: undefined reference to `MD2_Update' > *** Error code 1 > > Stop in /usr/ports/mail/mutt/work/mutt-1.4.2.3. > *** Error code 1 > > Stop in /usr/ports/mail/mutt/work/mutt-1.4.2.3. > *** Error code 1 > > Stop in /usr/ports/mail/mutt/work/mutt-1.4.2.3. > *** Error code 1 > > Stop in /usr/ports/mail/mutt. > > Any ideas on what could be done ? I'm nut sure but i remember that openssl dropped support for the MD2 Algo. Perhaps try with MD2 enabled. hth, leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Heimdal 1.4 can't open old 0.6.3 database
Hello, because of the unusable base gssapi i switched to using the security/heimdal port. But now my heimdal tools (ipropd-slave, kdc) can't open my old database the error i get is: kdc[5156]: Failed to open database: opening /var/heimdal/heimdal.db: Invalid argument # /usr/local/libexec/kdc --builtin-hdb builtin hdb backends: db:, keytab:, sqlite: # ls -l /var/heimdal total 1856 -rw--- 1 root wheel 1658880 Nov 1 14:27 heimdal.db -rw--- 1 root wheel157706 Nov 12 22:01 log -rw-r- 1 root wheel 10485760 Aug 16 20:06 log.01 -rw--- 1 root wheel83 Aug 7 22:31 m-key # file heimdal.db heimdal.db: Berkeley DB 1.85/1.86 (Btree, version 3, native byte-order) The old heimdal version was 0.6.3 the new: # /usr/local/libexec/kdc --version kdc (Heimdal 1.4) I can't find any information if i have to merge anything or so. The Kerberos docu only talks about MIT to Heimdal or v4 to v5 conversion. thanks, leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: How do we like our base kerberos? Will it flee soon?
On Fri, Nov 12, 2010 at 06:03:33PM +0100, Joerg Pulz wrote: > On Fri, 12 Nov 2010, Leon Meßner wrote: > > > On Thu, Nov 11, 2010 at 04:22:57PM +0100, Joerg Pulz wrote: > >> On Wed, 10 Nov 2010, Leon Meßner wrote: > > Did exactly as told and everything worked fine. Im currently in the > > process of rebuilding gssapi dependent software. Will tell if it fixed > > my issue. > > Hi, > > good to hear that everything went fine for you. > If you're using 8.x you should remove some of the leftover kerberos/gssapi > libraries by yourself as the ObsoleteFiles list is still incomplete in > 8.x and 'make delete-old delete-old-libs' will not remove everything. > E.g. > in /usr/lib and /usr/lib32 > libasn1* libgssapi* libhdb* libheimntlm* libhx509* > libkadm5* libkafs5* libkrb5* > in /usr/libexec > kcm It looks like i do also still have the old kerberos tools (kinit,kadmin etc.) in the base prefix and they do now segfault: /libexec/ld-elf.so.1: Shared object "libkafs5.so.10" not found, required by "kinit" # ls /usr/local/lib/libkafs* /usr/local/lib/libkafs.a/usr/local/lib/libkafs.la /usr/local/lib/libkafs.so /usr/local/lib/libkafs.so.5 > Btw. > If you're using security/cyrus-sasl2 with GSSAPI please take a look at > PR/152071. Using that. Patch applied and build cleanly. saslauthd starts as expected. But i do have some problems now getting tickets. This machine is a kerberos slave. if i start ipropd-slave with local kdc running i get: krb5_get_init_creds: Client (iprop/lise.physik-pool.tu-berlin...@pcpool.physik.tu-berlin.de) unknown when local kdc is not running authentication works but i get: ipropd-slave[28610]: connection successful to master: marie.physik-pool.tu-berlin.de[130.149.58.147] ipropd-slave[28610]: ipropd-slave started at version: 10166 ipropd-slave[28610]: db->open: dbm_open(/var/heimdal/heimdal): Inappropriate file type or format Which i can understand because the db is at /var/heimdal/heimdal.db which in turn is correctly specified in /etc/krb5.conf. Are there any config syntax changes between 0.6.3 and 1.4, so i have to modify my krb5.conf ? Thanks, Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: mergemaster comparing everything.
On Fri, Nov 12, 2010 at 09:40:01AM -0700, Warren Block wrote: > On Fri, 12 Nov 2010, Leon Me?ner wrote: > > > is there a trick besides using the rcs funktion of mergemaster to get > > around having to look at every file in /etc for comparison? > > I know there once was a bug in mergemaster but it's closed for a long > > time now. > ... > > 90% of the differences are just in this cvs? tag lines. This is an > > upgrade from 8.1 to -STABLE. > > 'mergemaster -Ui' helps. thanks, that helped. Did the default behavior of mergemaster change somewhere because i didn't have to do this awhile ago (months not years). greetings, Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: How do we like our base kerberos? Will it flee soon?
On Thu, Nov 11, 2010 at 04:22:57PM +0100, Joerg Pulz wrote: > -BEGIN PGP SIGNED MESSAGE- > Hash: SHA1 > > > On Wed, 10 Nov 2010, Leon Meßner wrote: > > > Hi, > > > > What i didn't try: > > > > - Use the port. > > > please take a look at ports/152030 and the patches i mentioned in the PR. > > With applied ports/152030 and the world patch applied, you should be able > to build a world fully against the security/heimdal port by simply > specifying WITH_KERBEROS_PORT=1 in /etc/src.conf and HEIMDAL_HOME= > (normally /usr/local) in /etc/make.conf. > You should specify WITHOUT_KERBEROS=1 in /etc/src.conf to avoid mess and > confusion with two different heimdal version installed. > > Don't forget to install the security/heimdal port first. > > Comments are welcome. Did exactly as told and everything worked fine. Im currently in the process of rebuilding gssapi dependent software. Will tell if it fixed my issue. thanks, Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
mergemaster comparing everything.
Hi, is there a trick besides using the rcs funktion of mergemaster to get around having to look at every file in /etc for comparison? I know there once was a bug in mergemaster but it's closed for a long time now. Example: *** Displaying differences between ./etc/periodic/daily/300.calendar and installed version: --- /etc/periodic/daily/300.calendar2010-07-29 12:54:42.0 +0200 +++ ./etc/periodic/daily/300.calendar 2010-11-12 17:06:33.0 +0100 @@ -1,6 +1,6 @@ #!/bin/sh # -# $FreeBSD: src/etc/periodic/daily/300.calendar,v 1.5.36.1.4.1 2010/06/14 02:09:06 kensmith Exp $ +# $FreeBSD: src/etc/periodic/daily/300.calendar,v 1.5.36.1 2009/08/03 08:13:06 kensmith Exp $ # # `calendar -a' needs to die. Why? Because it's a bad idea, particular # with networked home directories, but also in general. If you want # the 90% of the differences are just in this cvs? tag lines. This is an upgrade from 8.1 to -STABLE. Greetings, Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
How do we like our base kerberos? Will it flee soon?
Hi, I'm looking for workarounds for this crappy situation which currently prevents FreeBSD8 from working together with libgssapi (see kern/147454) and multiple threads on -questions. What i tried: - Use old RELENG_8 and RELENG_8_1 sources where Benjamin's patch still applied. (Can't build world then). - Modify /usr/bin/krb5-config to include -lgssapi_spnego -lgssapi_krb5 at the right place (works on some machines). What i didn't try: - Use the port. How are you handling this situation. Does anyone know a cvs tag= and date= combination which lets you build world with Benjamin's patch (tried RELENG_8 and _8_1 from 24.6 and 19.7 and now)? Actually a complete base kerberos would be much appreciated. best regards, Leon pgpNaCkW0QB3v.pgp Description: PGP signature
Downgrade from 8.1 to 8.0 possible ?
Hi, because of the broken heimdal (gssapi) in 8.1-RELEASE i'm thinking of going back to 8.0-p2 because i suppose the patch mentioned in kern/147454 works there (opposed to 8.1). Can i just csup RELENG_8_0_0_RELEASE and make a new world/kernel plus eventually freebsd-update to -p2 then ? TIA, Leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Does this look reasonable (y/n)?
Hello, i have quite a common question i think but my google skills didn't bring up anything decent. If you use binary freebsd-update to upgrade between major releases it starts comparing config files at some point. After the manual merges it start's "automerge" and asks you: Does this look reasonable (y/n)? for every file. If you answer n freebsd-update bails out (after working for like ages getting patches/files etc.) So wouldn't it be nice to give the user a chance to resolve the merge or at least ask if the user really wants to quit the upgrade. Am i missing something here? regards, leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: openldap-sasl fails after 8.1 upgrade
On Wed, Aug 25, 2010 at 10:34:27PM +0300, Reko Turja wrote: > Sadly the GSSAPI/Kerberos has been broken in 8.x for a good while now. > You can either install the heimdal or MIT port, although getting that > to work in stead of the base can be messy. > > kern/147454 PR actually has a working fix, although I'm not sure if it > applies cleanly as it's pretty big - I managed to get working GSSAPI > with it on 8.1 PRERELEASE. I'll try that. > See also discussion at > http://lists.freebsd.org/pipermail/freebsd-stable/2010-July/057734.html Following the link in the other thread to http://lists.freebsd.org/pipermail/freebsd-stable/2010-February/055017.html i made the changes to /usr/bin/krb5-config: # diff /usr/bin/krb5-config /usr/bin/krb5-config.org 96c96 < lib_flags="$lib_flags -lgssapi -lgssapi_spnego -lgssapi_krb5 -lheimntlm" --- > lib_flags="$lib_flags -lgssapi -lheimntlm" After that, rebuilding openldap+dependencies makes it work again. I suppose this is quite dirty and i have to see if it introduces other problems. Thanks, leon > > -- > From: "LeonMeßner" > Sent: Wednesday, August 25, 2010 7:04 PM > To: > Subject: openldap-sasl fails after 8.1 upgrade > > > Hi, > > > > after binary upgrading to freebsd8.1 from 7.2 i encounter an error > > with openldap24, cyrus-sasl2 and kerberos: > > > > # ldapsearch uid=whatever > > SASL/GSSAPI authentication started > > ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) > > error (80) > >additional info: SASL(-1): generic failure: GSSAPI Error: No > > credentials were supplied, or the credentials were unavailable or > > inaccessible. (unknown mech-code 0 for mech unknown) > > > > Simple binding to the ldap server does work. The KDC behind this is > > still on kerberos 0.6.3 (FreeBSD7.3) and there have been reported > > Problems with such a setup, but as i can login through ssh and > > kerberos > > i suppose these [1] don't apply here (also already tested the > > proposed > > changes). > > > > If anybody got any insight please share. > > > > Thanks in Advance, > > Leon > > > > [1] > > http://lists.freebsd.org/pipermail/freebsd-stable/2009-October/052217.html > > ___ > > freebsd-questions@freebsd.org mailing list > > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > > To unsubscribe, send any mail to > > "freebsd-questions-unsubscr...@freebsd.org" > > > > > > ___ > freebsd-questions@freebsd.org mailing list > http://lists.freebsd.org/mailman/listinfo/freebsd-questions > To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org" ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
openldap-sasl fails after 8.1 upgrade
Hi, after binary upgrading to freebsd8.1 from 7.2 i encounter an error with openldap24, cyrus-sasl2 and kerberos: # ldapsearch uid=whatever SASL/GSSAPI authentication started ldap_sasl_interactive_bind_s: Other (e.g., implementation specific) error (80) additional info: SASL(-1): generic failure: GSSAPI Error: No credentials were supplied, or the credentials were unavailable or inaccessible. (unknown mech-code 0 for mech unknown) Simple binding to the ldap server does work. The KDC behind this is still on kerberos 0.6.3 (FreeBSD7.3) and there have been reported Problems with such a setup, but as i can login through ssh and kerberos i suppose these [1] don't apply here (also already tested the proposed changes). If anybody got any insight please share. Thanks in Advance, Leon [1] http://lists.freebsd.org/pipermail/freebsd-stable/2009-October/052217.html ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: freeBSD nullfs together nfs and "silly rename"
nevermind.. resend and forgot to change the addressee. If anyone has an idea i would of course still be grateful. Regards, leon On Wed, Jun 02, 2010 at 01:50:33PM +0200, Leon Meßner wrote: > Hi, > I hope this is not the wrong list to ask. Didn't get any answers on > -questions. > > When you try to do the following inside a nullfs mounted directory, > where the nullfs origin is itself mounted via nfs you get an error: > > # foo > # tail -f foo& > # rm -f foo > tail: foo: Stale NFS file handle > # fg > > This is really a problem when running services inside jails and using > NFS as storage. As of [2] it looks like this problem is known for a > while. On a normal NFS mount this does not happen as "silly renaming" > [1] works there (producing nasty little .nfs files). > > TIA, > Leon > > [1] http://nfs.sourceforge.net/#faq_d2 > [2] > http://ftp.freebsd.org/pub/FreeBSD/development/FreeBSD-CVS/src/sys/nfsclient/nfsnode.h,v > rev:1.32.2.1 pgplzqWuHVMeY.pgp Description: PGP signature
freeBSD nullfs together nfs and "silly rename"
Hi, I hope this is not the wrong list to ask. Didn't get any answers on -questions. When you try to do the following inside a nullfs mounted directory, where the nullfs origin is itself mounted via nfs you get an error: # foo # tail -f foo& # rm -f foo tail: foo: Stale NFS file handle # fg This is really a problem when running services inside jails and using NFS as storage. As of [2] it looks like this problem is known for a while. On a normal NFS mount this does not happen as "silly renaming" [1] works there (producing nasty little .nfs files). TIA, Leon [1] http://nfs.sourceforge.net/#faq_d2 [2] http://ftp.freebsd.org/pub/FreeBSD/development/FreeBSD-CVS/src/sys/nfsclient/nfsnode.h,v rev:1.32.2.1 pgpiC7e0lo2WH.pgp Description: PGP signature
freeBSD nullfs together nfs and "silly rename"
Hi, when you try to do the following inside a nullfs mounted directory, where the nullfs origin is itself mounted with nfs you get an error: # foo # tail -f foo& # rm -f foo tail: foo: Stale NFS file handle # fg This is really a problem when running services inside jails and using NFS as storage. As of [2] it looks like this problem is known for a while. On a normal NFS mount this does not happen as "silly renaming" [1] works there. As freeBSD is getting towards NFSv4 perhaps this would be a solution but i actually would'nt want to use these in production. Is there a fix or anything ? [1] http://nfs.sourceforge.net/#faq_d2 [2] http://ftp.freebsd.org/pub/FreeBSD/development/FreeBSD-CVS/src/sys/nfsclient/nfsnode.h,v rev:1.32.2.1 pgpkbYYlcaFv0.pgp Description: PGP signature
security/libassuan's distinfo missing something ?
Hi, as a dependency to gnupg i tried to install security/libassuan and noticed that Makefile's verify section contains a reference to a .sig file which isn't in the distinfo. There are ongoing pr's about this port (ports/144186). Though i don't think this is related this pr would perhaps fix this issue too. The error i get is: ===> gnupg-2.0.14_1 depends on package: libassuan>=1.0.4 - not found ===>Verifying install for libassuan>=1.0.4 in /usr/ports/security/libassuan ===> Vulnerability check disabled, database not found => libassuan-1.0.5.tar.bz2.sig is not in /basejail/usr/ports/security/libassuan/distinfo. => Either /basejail/usr/ports/security/libassuan/distinfo is out of date, or => libassuan-1.0.5.tar.bz2.sig is spelled incorrectly. *** Error code 1 Did anyone run into this problem ? TIA, Leon pgpDxxxlSJ44W.pgp Description: PGP signature
Re: Default labeling and space for rebuilding the kernel.
On Wed, Mar 31, 2010 at 08:34:59AM -0400, Michael Powell wrote: > Leon Meßner wrote: > > > Hi, > > > > if one uses the default labeling with current installer it is not > > possible to rebuild the kernel (GENERIC). It fails on installing the > > wlan.ko. > > /: write failed, filesystem is full > > install: /boot/kernel/wlan.ko.symbols: No space left on device > [snip] > > There has been some discussion lately about possibly changing the defaults. > If you become faced with having to reinstall jot down your current partition > sizes and adjust manually making / larger. On production machines i have some 2G. This was just an as fast as possible installation. > Since it is full, if you intend to try and recover it will entail deleting > something. This could get tricky, especially if the new 'kernel' space is > what filled up. This would presuppose that the kernel.old area was already > written out successfully. If the machine will not boot successfully with the > new kernel it is imperative that kernel.old still be healthy in order to > recover. However, if the new kernel does actually boot, with the result > being that some modules are missing you may be able to delete the kernel.old > in order to buy space. Messing around with this can potentially be > problematic, for obvious reasons. A strong 'YMMV' is indicated here. I just went the easy way and moved the old kernel away from / . I wouldn't have done so if this machine would be very critical though. > If you can get past that, you may be able to mitigate the / being too small. > Place STRIP= -s into /etc/make.conf and WITHOUT_PROFILE= true into > /etc/src.conf. The con of this is that you lose some debugging ability. The > pro is new kernels will now fit. I have two servers set up this way at home, > and one uses 91MB while the other uses 93MB of space. The 91MB one only has > a / of 200MB total, and is nearly half empty. Allows for rebuilding and > installing a new kernel without running out of space. Hm, never used this file. Looks like it was introduced in FBSD7 somewhere. Looks reasonable to split parameters for /usr/src into a different file than /etc/make.conf thanks, Leon pgpvRV7QIQqB5.pgp Description: PGP signature
Default labeling and space for rebuilding the kernel.
Hi, if one uses the default labeling with current installer it is not possible to rebuild the kernel (GENERIC). It fails on installing the wlan.ko. Isn't that wrong somehow ? ===> wi (install) install -o root -g wheel -m 555 if_wi.ko /boot/kernel install -o root -g wheel -m 555 if_wi.ko.symbols /boot/kernel ===> wlan (install) install -o root -g wheel -m 555 wlan.ko /boot/kernel install -o root -g wheel -m 555 wlan.ko.symbols /boot/kernel /: write failed, filesystem is full install: /boot/kernel/wlan.ko.symbols: No space left on device *** Error code 71 Stop in /usr/src/sys/modules/wlan. *** Error code 1 regards, Leon pgp1J9IYK1Sgu.pgp Description: PGP signature
Re: FreeBSD in a cloud
On Thu, May 28, 2009 at 12:35:05PM +0200, Iv Ray wrote: > Does anyone know a place to host FreeBSD in a cloud? Nope, but i heard amazon and some FreeBSD people are working on this. AFAIK it's dependent on the used Hypervisor and works with latest version of Xen (the freebsd wiki says so at least). > Rackspace offer quite interesting cloud servers via www.mosso.com - > but they claim they run only Linux. > > We have had FreeBSD with Rackspace for over 5 years (though they > refuse to officially support it) and I cannot understand if they > cannot or do not want to run it in the cloud. cheers, leon ___ freebsd-questions@freebsd.org mailing list http://lists.freebsd.org/mailman/listinfo/freebsd-questions To unsubscribe, send any mail to "freebsd-questions-unsubscr...@freebsd.org"
Re: Hardwire drive0 to ad0 on hw raid.
On Sat, Apr 25, 2009 at 08:39:09PM -0600, Tim Judd wrote: > On Sat, Apr 25, 2009 at 8:08 PM, Leon Meßner > wrote: > > > Hi, > > > > i'm having a problem with the disk numbering of RAID arrays (3ware > > 9650SE). When i boot, the array with my system is always the last > > numbered drive (ATM its ad16). This array is on its own controller. > > lsdev in the loader shows the array as drive0 (first BIOS drive i > > assume). > > Is there a way to hardwire this to ad0 as i dont want my system > > array to have different numbers when booting with different amounts > > of drives attached to the system. > > That's one of the advantages of putting labels on a filesystem. You > then > specify in fstab that you mount by it's label versus the device name > directly. > Ok, thanks. That works for getting my system mounted ok. Now i have a zfs raid on the rest of my drives (ad0-ad15). If i now boot with one of these removed, will zfs try to use my system disk (now beeing ad15) ? Is it necessary to label all my drives and setup zfs to use the labeled devices ? I need glabel for this right, because there is no fs on these drives. Thanks, Leon pgprfTFa8KaSU.pgp Description: PGP signature
Hardwire drive0 to ad0 on hw raid.
Hi, i'm having a problem with the disk numbering of RAID arrays (3ware 9650SE). When i boot, the array with my system is always the last numbered drive (ATM its ad16). This array is on its own controller. lsdev in the loader shows the array as drive0 (first BIOS drive i assume). Is there a way to hardwire this to ad0 as i dont want my system array to have different numbers when booting with different amounts of drives attached to the system. I couldn't find any hints on this in the 3ware manuals or controller-setup. Thanks in Advance, Leon FWIW: This is on FreeBSD-7.1-p5 (latest binary update). pgpGqN9NZe6lp.pgp Description: PGP signature
