Re: IBM T60 - APM issues

2007-06-29 Thread atstake atstake

On 6/27/07, atstake atstake [EMAIL PROTECTED] wrote:

On 27 Jun 2007 11:58:04 +0200, Artur Grabowski [EMAIL PROTECTED] wrote:
 If the T60 is anything like the X60, it doesn't have APM, only ACPI.


I recompiled the kernel with this (removing the disable and the #)
and still can get halt -p working. Is there something I'm missing?

acpi0  at mainbus?
acpitimer* at acpi?
acpihpet*  at acpi?
acpiac*at acpi?
acpibat*   at acpi?
acpibtn*   at acpi?
acpicpu*   at acpi?
acpidock*  at acpi?
acpiec*at acpi?
acpiprt*   at acpi?
acpitz*at acpi?

Here's my new dmesg | grep acpi. Thanks for any help.

OpenBSD 4.1 (GENERIC.acpi) #0: Thu Jun 28 21:03:45 DST 2007
  [EMAIL PROTECTED]:/usr/src/sys/arch/i386/compile/GENERIC.acpi
acpi0 at mainbus0: rev 2
acpi0: tables DSDT FACP SSDT ECDT TCPA APIC MCFG HPET SLIC BOOT SSDT
SSDT SSDT SSDT
acpitimer0 at acpi0: 3579545 Hz, 24 bits
acpihpet0 at acpi0: 14318179 Hz
acpiprt0 at acpi0: bus 0 (PCI0)
acpiprt1 at acpi0: bus 0 (AGP_)
acpiprt2 at acpi0: bus 2 (EXP0)
acpiprt3 at acpi0: bus 3 (EXP1)
acpiprt4 at acpi0: bus 4 (EXP2)
acpiprt5 at acpi0: bus 12 (EXP3)
acpiprt6 at acpi0: bus 21 (PCI1)
acpiec0 at acpi0: EC__
acpibtn0 at acpi0: LID_
acpibtn1 at acpi0: SLPB
acpibat0 at acpi0: BAT0: model: 92P1141 serial:  1159 type: LION oem: SONY
acpibat1 at acpi0: BAT1: not present
acpiac0 at acpi0: AC unit online
acpitz0 at acpi0, critical temperature: 127 degC
acpitz1 at acpi0, critical temperature: 99 degC



Re: bgpd and multihop

2007-06-29 Thread Henning Brauer
* Jon Morby [EMAIL PROTECTED] [2007-06-29 02:56]:
 I've just updated one of our routers from an end of May snapshot to a  
 Jun 28th snapshot and have noticed that we seem to be having problems  
 with our multihop sessions since the upgrade.

errr... I'm inlcined to say impossible, since there weren't many 
changes at all in bgpd since then, and nothing that remotely touches 
nexthop verification. check your routes, something must be different.
bgpctl sh nex on both machines might give insight

-- 
Henning Brauer, [EMAIL PROTECTED], [EMAIL PROTECTED]
BS Web Services, http://bsws.de
Full-Service ISP - Secure Hosting, Mail and DNS Services
Dedicated Servers, Rootservers, Application Hosting - Hamburg  Amsterdam



Which address is used when sending via CARP?

2007-06-29 Thread Heinrich Rebehn

Hi all,

using the following setup:


# ifconfig vlan0
vlan0: flags=8943UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST mtu 1500
lladdr 00:13:d4:de:cf:88
vlan: 16 priority: 0 parent interface: sk0
groups: vlan
inet6 fe80::213:d4ff:fede:cf88%vlan0 prefixlen 64 scopeid 0x7
inet 134.102.176.251 netmask 0xff00 broadcast 134.102.176.255
# ifconfig carp0
carp0: flags=8843UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST mtu 1500
lladdr 00:00:5e:00:01:0a
carp: MASTER carpdev vlan0 vhid 10 advbase 1 advskew 0
groups: carp
inet6 fe80::200:5eff:fe00:10a%carp0 prefixlen 64 scopeid 0xc
inet 134.102.176.250 netmask 0xff00 broadcast 134.102.176.255
-

When the machine sends packets out, the carry 134.102.176.251 as source 
address, not 134.102.176.250. Is this expected behavior? How can i 
change that?
I noticed that the route to the 134.102.176.0/24 network points to 
vlan0, not carp0. Is this correct?


Thanks for any info,

Heinrich
--

Heinrich Rebehn

University of Bremen
Physics / Electrical and Electronics Engineering
- Department of Telecommunications -

Phone : +49/421/218-4664
Fax   :-3341



Re: bgpd and multihop

2007-06-29 Thread Henning Brauer
* Jon Morby [EMAIL PROTECTED] [2007-06-29 11:20]:
 On 29 Jun 2007, at 08:47, Henning Brauer wrote:
 
 * Jon Morby [EMAIL PROTECTED] [2007-06-29 02:56]:
 I've just updated one of our routers from an end of May snapshot to a
 Jun 28th snapshot and have noticed that we seem to be having problems
 with our multihop sessions since the upgrade.
 
 errr... I'm inlcined to say impossible, since there weren't many
 changes at all in bgpd since then, and nothing that remotely touches
 nexthop verification. check your routes, something must be different.
 bgpctl sh nex on both machines might give insight
 
 
 I know ... whether it's just something that has now cropped up  
 because it's the first time these several of these boxes have been  
 rebooted in months ...
 
 The addition of nexthop qualify via bgp seems to have overcome  
 things .. however the next hops should be learnt by ospf and are  
 reachable (otherwise the bgp sessions wouldn't actually be up, which  
 they are)

well, as said, bgpctl sh nex will tell what is going on, maybe bgpctl 
sh fib is required too

-- 
Henning Brauer, [EMAIL PROTECTED], [EMAIL PROTECTED]
BS Web Services, http://bsws.de
Full-Service ISP - Secure Hosting, Mail and DNS Services
Dedicated Servers, Rootservers, Application Hosting - Hamburg  Amsterdam



Re: bgpd and multihop

2007-06-29 Thread Jon Morby

On 29 Jun 2007, at 08:47, Henning Brauer wrote:


* Jon Morby [EMAIL PROTECTED] [2007-06-29 02:56]:

I've just updated one of our routers from an end of May snapshot to a
Jun 28th snapshot and have noticed that we seem to be having problems
with our multihop sessions since the upgrade.


errr... I'm inlcined to say impossible, since there weren't many
changes at all in bgpd since then, and nothing that remotely touches
nexthop verification. check your routes, something must be different.
bgpctl sh nex on both machines might give insight



I know ... whether it's just something that has now cropped up  
because it's the first time these several of these boxes have been  
rebooted in months ...


The addition of nexthop qualify via bgp seems to have overcome  
things .. however the next hops should be learnt by ospf and are  
reachable (otherwise the bgp sessions wouldn't actually be up, which  
they are)




Regards,
Jon Morby
FidoNet Registration Services Ltd


web: www.fido.net
tel: +44 (0) 845 004 3050
fax: +44 (0) 845 004 3051



Re: bgpd and multihop

2007-06-29 Thread Stuart Henderson
On 2007/06/29 10:15, Jon Morby wrote:
 On 29 Jun 2007, at 08:47, Henning Brauer wrote:

 * Jon Morby [EMAIL PROTECTED] [2007-06-29 02:56]:
 I've just updated one of our routers from an end of May snapshot to a
 Jun 28th snapshot and have noticed that we seem to be having problems
 with our multihop sessions since the upgrade.

 errr... I'm inlcined to say impossible, since there weren't many
 changes at all in bgpd since then, and nothing that remotely touches
 nexthop verification. check your routes, something must be different.
 bgpctl sh nex on both machines might give insight


 I know ... whether it's just something that has now cropped up because it's 
 the first time these several of these boxes have been rebooted in months ...

 The addition of nexthop qualify via bgp seems to have overcome things .. 
 however the next hops should be learnt by ospf and are reachable (otherwise 
 the bgp sessions wouldn't actually be up, which they are)

Are the nexthops in subnets where you receive the same exact prefixes
by both BGP and OSPF? I have found ospfd sometimes doesn't overwrite
routes installed by bgpd. That's not new though..



update of free wireless cards?

2007-06-29 Thread Vim Visual

Hi,

I am about to but a second hand thinkpad x40 which looks pretty good
_and_ has APM support (!!). Of course OpenBSD will be installed on it.

Now, the German ebayer is a nice person and I can actually choose
what's going to be the wireless card!

Until now I have only tried intel chips, so that you have to install
the firmware and everything is working fine. But if I can choose, I'd
like to have a 100% blob-less system. And also to show the vendors
that they have a public!

I have been googling, clustying and reading man pages to find a recent
update of the list of wireless cards which would fulfill this and I
have found out that the wireless devices that either do not require
firmware, or that have runtime firmware that OpenBSD is allowed to
distribute are:

* atu (4) - Atmel AT76C50x USB IEEE 802.11b wireless network device
* ral (4) - Ralink Technology IEEE 802.11a/b/g wireless network device
(2nd gen 802.11 Ralink)
* rum (4) - Ralink Technology USB IEEE 802.11a/b/g wireless network device
* zyd (4) - Zydas ZD1211 USB IEEE 802.11b/g wireless network device

Is this the whole list of blob-less devices?

And another question: How do these devices compare to the intel pro
ones? Are they as powerful?

Thanks for your attention...



Re: update of free wireless cards?

2007-06-29 Thread Peter N. M. Hansteen
Vim Visual [EMAIL PROTECTED] writes:

 And another question: How do these devices compare to the intel pro
 ones? Are they as powerful?

I have both ral and rum devices here, and we're quite happy with
them.  In my experience at least they are quite reliable.  They are
rather inexpensive too, the USB versions can can usually be had for 50
euros or less, mini-PCIs even less.

Since you mention Intel parts, wpi in my Thinkpad R60 has a tendency
to almost, but not quite, resetting it self at apparently random
intervals, losing the link.  Nothing that can't be handled with a new
ifconfig up mumble plus dhclient mumble, and the recent revisions in
-current is noticeably better, but still a bit irritating.  I was at
the point of considering some minor surgery on the Thinkpad to put a
rum mini-pci in there instead, but the Damien Bergamini did some magic
which made the wpi behave a little better.

- P

-- 
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/
Remember to set the evil bit on all malicious network traffic
delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.



Re: update of free wireless cards?

2007-06-29 Thread Vim Visual

Hi Peter,


I have both ral and rum devices here, and we're quite happy with
them.  In my experience at least they are quite reliable.  They are
rather inexpensive too, the USB versions can can usually be had for 50
euros or less, mini-PCIs even less.


Ops, sorry, I was meaning internal devices! I am looking for an
internal wireless card.



Since you mention Intel parts, wpi in my Thinkpad R60 has a tendency
to almost, but not quite, resetting it self at apparently random
intervals, losing the link.  Nothing that can't be handled with a new
ifconfig up mumble plus dhclient mumble, and the recent revisions in
-current is noticeably better, but still a bit irritating.


yes, I also have observed this behaviour in some machines... it's
indeed irritating!


I was at
the point of considering some minor surgery on the Thinkpad to put a
rum mini-pci in there instead, but the Damien Bergamini did some magic
which made the wpi behave a little better.


iwi is not that lucky, I think... but I should shut up because I have
not check it in detail

Thanks for your comments

Pau



acpi vs asus m6v notebook

2007-06-29 Thread bdz
4.1-current fresed yesterday. see attached dmesg after boot.

in GENERIC ACPIVERBOSE and ACPI_ENABLE enabled.

if i turn off the notebook and turn it on again it sees the battery, but 
the model is not read correctly (should be M6V) and there are no useful 
info about it:

# sysctl -a | grep ^hw\.sensors
hw.sensors.acpibat0.volt0=unknown (voltage), UNKNOWN
hw.sensors.acpibat0.volt1=unknown (current voltage), UNKNOWN
hw.sensors.acpibat0.amphour0=unknown (last full capacity), UNKNOWN
hw.sensors.acpibat0.amphour1=4294.97 Ah (warning capacity)
hw.sensors.acpibat0.amphour2=4294.97 Ah (low capacity)
hw.sensors.acpibat0.amphour3=unknown (remaining capacity), UNKNOWN
hw.sensors.acpibat0.raw0=unknown (battery unknown), UNKNOWN
hw.sensors.acpibat0.raw1=unknown (rate), UNKNOWN
hw.sensors.acpibat1.volt0=unknown (voltage), UNKNOWN
hw.sensors.acpibat1.volt1=unknown (current voltage), UNKNOWN
hw.sensors.acpibat1.amphour0=unknown (last full capacity), UNKNOWN
hw.sensors.acpibat1.amphour1=4294.97 Ah (warning capacity)
hw.sensors.acpibat1.amphour2=4294.97 Ah (low capacity)
hw.sensors.acpibat1.amphour3=unknown (remaining capacity), UNKNOWN
hw.sensors.acpibat1.raw0=unknown (battery unknown), UNKNOWN
hw.sensors.acpibat1.raw1=unknown (rate), UNKNOWN

i have just one battery, so acpibat1 should be ignored.

if i just reset the notebook without a poweroff then there are no 
batteries seen at all.

other mistery:
if i make a halt -p then somtimes the machine is powered off and 
sometimes it is powered off but after 1-2 secs it is powered on again. 
strange ah?

i really don't care about the halt -p but to see the battery's state is 
important. i don't like to fly with closed eyes.

please give me vectors how i could solve this problem?
thank you

bdz
OpenBSD 4.1-current (GENERIC) #1: Thu Jun 28 18:29:46 GMT 2007
[EMAIL PROTECTED]:/usr/src/sys/arch/i386/compile/GENERIC
cpu0: Intel(R) Pentium(R) M processor 1.73GHz (GenuineIntel 686-class) 1.73 
GHz
cpu0: 
FPU,V86,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,TM,SBF,EST,TM2
real mem  = 1073049600 (1023MB)
avail mem = 1029996544 (982MB)
mainbus0 at root
bios0 at mainbus0: AT/286+ BIOS, date 06/08/05, BIOS32 rev. 0 @ 0xf0010, SMBIOS 
rev. 2.3 @ 0xf8dd0 (36 entries)
bios0: ASUSTeK Computer Inc. M6V
pcibios0 at bios0: rev 2.1 @ 0xf/0x1
pcibios0: PCI IRQ Routing Table rev 1.0 @ 0xf4750/272 (15 entries)
pcibios0: PCI Interrupt Router at 000:31:0 (Intel 82801FB LPC rev 0x00)
pcibios0: PCI bus #3 is the last bus
bios0: ROM list: 0xc/0x1
acpi0 at mainbus0: rev 0
acpi0: tables DSDT FACP APIC MCFG OEMB SSDT 
acpitimer at acpi0 not configured
acpi device at acpi0 from table DSDT not configured
acpi device at acpi0 from table FACP not configured
acpi device at acpi0 from table APIC not configured
acpi device at acpi0 from table MCFG not configured
acpi device at acpi0 from table OEMB not configured
acpi device at acpi0 from table SSDT not configured
acpiprt0 at acpi0: bus 0 (PCI0)
acpiprt1 at acpi0: bus 3 (P0P3)
acpiprt2 at acpi0: bus 1 (P0P1)
acpiprt3 at acpi0: bus 0 (P0P4)
acpiprt4 at acpi0: bus 0 (P0P5)
acpiprt5 at acpi0: bus 0 (P0P6)
acpiprt6 at acpi0: bus 0 (P0P7)
acpiec at acpi0 not configured
acpicpu at acpi0 not configured
acpitz at acpi0 not configured
acpiac at acpi0 not configured
acpibat0 at acpi0: BAT0: model: \M^?\M^?\M^?\M^?\M^?\M^?\M^?\M^? serial:   
type: LIon oem: ASUSTEK
acpibat1 at acpi0: BAT1: model: \M^?\M^?\M^?\M^?\M^?\M^?\M^?\M^? serial:   
type: LIon oem: ASUSTEK
acpibtn at acpi0 not configured
acpibtn at acpi0 not configured
cpu0 at mainbus0
cpu0: unknown Enhanced SpeedStep CPU, msr 0x06120d2606000d26
cpu0: using only highest and lowest power states
cpu0: Enhanced SpeedStep 1733 MHz (1308 mV): speeds: 1733, 800 MHz
pci0 at mainbus0 bus 0: configuration mode 1 (no bios)
pchb0 at pci0 dev 0 function 0 Intel 82915GM/PM/GMS Host rev 0x03
ppb0 at pci0 dev 1 function 0 Intel 82915PM/GM PCIE rev 0x03
pci1 at ppb0 bus 3
vga1 at pci1 dev 0 function 0 ATI Radeon Mobility X600 rev 0x00
wsdisplay0 at vga1 mux 1: console (80x25, vt100 emulation)
wsdisplay0: screen 1-5 added (80x25, vt100 emulation)
azalia0 at pci0 dev 27 function 0 Intel 82801FB HD Audio rev 0x04: irq 5
azalia0: host: High Definition Audio rev. 1.0
azalia0: codec: Realtek ALC880 (rev. 5.0), HDA version 0.9
azalia0: codec: 0x14f1/0x2bfa (rev. 0.0), HDA version 0.9
azalia0: codec[1]: No support for modem function groups
azalia0: codec[1]: No audio function groups
audio0 at azalia0
uhci0 at pci0 dev 29 function 0 Intel 82801FB USB rev 0x04: irq 4
uhci1 at pci0 dev 29 function 1 Intel 82801FB USB rev 0x04: irq 5
uhci2 at pci0 dev 29 function 2 Intel 82801FB USB rev 0x04: irq 6
uhci3 at pci0 dev 29 function 3 Intel 82801FB USB rev 0x04: irq 5
ehci0 at pci0 dev 29 function 7 Intel 82801FB USB rev 0x04: irq 4
usb0 at ehci0: USB revision 2.0
uhub0 at usb0: Intel EHCI root hub, rev 2.00/1.00, addr 1
ppb1 at pci0 dev 30 function 0 Intel 82801BAM Hub-to-PCI 

Setting up a virtual hosting machine w. SSH/SFTP accounts - pitfalls/experiences?

2007-06-29 Thread Matt

Hello,

Someone far more experienced than me challenged my take on virtual 
hosting setups.
I am accustomed to having virtual users, not real users, doing stuff 
with MySQL backends etc.
My ideas now seem to have corrupted that what made me choose OpenBSD in 
the first place.


I would like to setup a multi user (real accounts) hosting machine 
without using any MySQL/web-gui kind of user management.
For you perhaps intuitive and elementary stuff, for me a bold and new 
undertaking.
So I would really like some advise on this from those of you that have 
been working with non-virtual hosting setups all along.


1) What kind of permission scheme is sane for non-jailed user accounts 
(SSH+SFTP)


These are website owners that need nothing fancy but being able to edit 
their site(s), manage their e-mail and edit their zone-files.
All of this is now virtual (and with regular FTP chrooted).  My setup so 
far consists of the user accounts in /home - owned by username:username 
and chmodded 700.
In their homedir there is a `ln -s` to their /var/www/home/username 
webspace. That webspace is chowned username:www and chmodded 770 so 
httpd can access/write to their dir as well.

Is that advisable / workable? Other ideas?

2) Chroot jails / limited shells - do's and don'ts

I understand the implications of chroot jails. I understand they are not 
worth the risk. Which is a shame really as they bring certain 
functionality (or limits if you will) that I would consider nice to have.
How do you prevent people from snooping around the system, looking for 
that sloppy permissioned file / gathering intelligence about your 
clientbase? All by setting permissions manually?

How do you prevent them from compiling and installing all sorts of things?
Is it possible/maintainable at all without chrootjails for your users?

3) Mail setups

I can find lots of setups with virtual mailusers. I have been 
succesfully using a Courier-imap/Postfix/MySQL setup for several years 
now, connected to a webbased mailmanagement tool.
If I was to drop all that in favor of a more 'core' OpenBSD setup - what 
would be a nice maintainable (both for users and myself) way to offer 
single users multiple domains / mailboxes?


4) Other considerations

Any advice on what to avoid and what to certainly do/check/follow up on 
is appreciated.

I will certainly miss stuff that might present a problem down the road.
For instance things like cronjobs- do you limit their use by custom 
scripts or do you just monitor abuse?


I am aware of things like 'accounting', 'quota' and 'ulimit' - any other 
handy utils I might check?


Thanks,
Matt



Re: Intel Core 2

2007-06-29 Thread David W. Hess
On Thu, 28 Jun 2007 15:34:05 +0100, Stuart Henderson [EMAIL PROTECTED]
wrote:

Lead is still permitted for some equipment (notably network infrastructure),
http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=CELEX:32002L0095:EN:HT
ML
annex 7:

- lead in solders for servers, storage and storage array systems
(exemption granted until 2010),

- lead in solders for network infrastructure equipment for switching,
signalling, transmission as well as network management for
telecommunication,

For some reason I thought this only applied to telecommunications and medical
equipment because of reliability concerns and long installed life.  Are those
the same reasons for including servers and storage?

I suspect a lot of RoHS compliant parts will make it into exempted equipment
just because of availability and difficult quality control but I would not
expect this to cause any significant problems.

I have not seen an exception for CdS photocells although many manufacturers
have
petitioned for one.  Unfortunately there are a lot of esoteric applications
for
which they have no substitute short of complete reengineering and in some
cases
not even then.  I expected at least the hermetically sealed ones to be
exempted.

http://sales.hamamatsu.com/en/products/solid-state-division/compound-semicond
uctors/cds.php



Re: FTP traffic counting

2007-06-29 Thread Juan Miscaro
--- Juan Miscaro [EMAIL PROTECTED] wrote:

 I am using OpenBSD 4.0 and I am counting bytes with labels for most
 protocols but with ftp-proxy I do not know how to proceed.  How can I
 do this?  These are the rules I have in pf.conf:
 
 
   nat-anchor ftp-proxy/*
   rdr-anchor ftp-proxy/*
 
   rdr pass on $INT \
 inet proto tcp \
 from any \
 to any port ftp \
 - 127.0.0.1 port 8021
 
   anchor ftp-proxy/*
 
   pass out on $EXT \
 inet proto tcp \
 from ($EXT) \
 to any port 21 \
 keep state
 
 
 I can add a label for port 21 but how do I track the data ports?

I thought of the 'user' keyword where I could set it to 'proxy' and set
up a label but I need an explicit rule for that.  Any other ideas?

   Juan



  Get news delivered with the All new Yahoo! Mail.  Enjoy RSS feeds right 
on your Mail page. Start today at http://mrd.mail.yahoo.com/try_beta?.intl=ca



Re: openbsd 4.0 installed, need to add network interface after install

2007-06-29 Thread Brian Candler
   1- Check the hardware compatability list to make sure the
  lan card is supported.
   2- Take a look and make sure the lan card is seated in it's
  slot properly.  I have had this happen a few times with 
  smaller cards not seating all the way (it's probably because
  of my fat paws).

3. Temporarily boot from another operating system's live CD, e.g.
   FreeBSD 6.2 disc 1 (select fixit mode to get a shell)

   For a Linux view try Ubuntu 6.06.1, or Fedora 7 for a more
   bleeding-edge kernel. These two require you to wait for a graphical
   environment to start though.

These will show you if another OS recognises the card(s) you have.

Also, under Linux, lspci -v gives useful info about the PCI cards you have
installed. In theory, you should be able to do this with OpenBSD too:
http://mj.ucw.cz/pciutils.shtml

However it doesn't work for me:

# pkg_add ftp://ftp.openbsd.org/pub/OpenBSD/4.0/packages/i386/pciutils-2.2.1.tgz
pciutils-2.2.1: complete
# lspci -v
lspci: obsd_init: /dev/pci open failed

ktrace and kdump just show:

...
  4341 lspciCALL  open(0x3c002b8b,0x2,0)
  4341 lspciNAMI  /dev/pci
  4341 lspciRET   open -1 errno 1 Operation not permitted
...

Regards,

Brian.



Any OpenSBD users in Manchester UK?

2007-06-29 Thread Siju George

Hi,

I have to come to U.K from 6th July to 15th July.
It would be great if I can find a few OpenBSD users there and see how
your implementations are :-)

Please let me know your contact details off list.
Also let me know if you need something from India :- if i can
afford it I'll get it for you.

I have never seen other architectures except x86, amd64, PPC ( thanks
to e-mac ).
Yes I saw a sparc system once but it was not connected to anything and
a few people were around it in an institute trying to make heads and
tails out of lump of metal and find the place where to connect the
keyboard because it had no serial/ps2/usb ports.

It would be great if I can see those other architectures like sparc64,
VAX, arm etc and spend some time learning from experienced users
:-

I think this would be the best opportunity for that.
Those things are rare if at all existent in this part of the sub continent.
I have a tight schedule since I am coming there as part of my Job so I
don't even know if I'll get free time on weekends but surely don't
want to miss the chance of seeing you people and these machines if the
Lord permits :-)

If the trip were to Paris I would have gone to the house of Johan
Sanchez :-) who has a whole lot of different architectures.

And if the trip were to Canada I would stay at Theo's place and give
him some bright Ideas ;-)

Germany? Henning of course :-

US? Nick or JCR :-))

Thank you so much

Kind Regards

Siju



Re: bgpd and multihop

2007-06-29 Thread Jon Morby

On 29 Jun 2007, at 11:12, Stuart Henderson wrote:





I know ... whether it's just something that has now cropped up  
because it's
the first time these several of these boxes have been rebooted in  
months ...


The addition of nexthop qualify via bgp seems to have overcome  
things ..
however the next hops should be learnt by ospf and are reachable  
(otherwise

the bgp sessions wouldn't actually be up, which they are)


Are the nexthops in subnets where you receive the same exact prefixes
by both BGP and OSPF? I have found ospfd sometimes doesn't overwrite
routes installed by bgpd. That's not new though..


Yup .. most likely ...

certainly qualifying via bgp seems to have solved things for the time  
being




Re: bgpd and multihop

2007-06-29 Thread Claudio Jeker
On Fri, Jun 29, 2007 at 11:12:15AM +0100, Stuart Henderson wrote:
 On 2007/06/29 10:15, Jon Morby wrote:
  On 29 Jun 2007, at 08:47, Henning Brauer wrote:
 
  * Jon Morby [EMAIL PROTECTED] [2007-06-29 02:56]:
  I've just updated one of our routers from an end of May snapshot to a
  Jun 28th snapshot and have noticed that we seem to be having problems
  with our multihop sessions since the upgrade.
 
  errr... I'm inlcined to say impossible, since there weren't many
  changes at all in bgpd since then, and nothing that remotely touches
  nexthop verification. check your routes, something must be different.
  bgpctl sh nex on both machines might give insight
 
 
  I know ... whether it's just something that has now cropped up because it's 
  the first time these several of these boxes have been rebooted in months ...
 
  The addition of nexthop qualify via bgp seems to have overcome things .. 
  however the next hops should be learnt by ospf and are reachable (otherwise 
  the bgp sessions wouldn't actually be up, which they are)
 
 Are the nexthops in subnets where you receive the same exact prefixes
 by both BGP and OSPF? I have found ospfd sometimes doesn't overwrite
 routes installed by bgpd. That's not new though..
 

ospfd will remove bgpd routes if the same network is distributed via bgp
and ospf. This should work since some time now. So if you still can
reproduce it I would like to know how because that is a bug.

-- 
:wq Claudio



Re: Any OpenSBD users in Manchester UK?

2007-06-29 Thread michael enoma aghayere

I have never seen other architectures except x86, amd64, PPC ( thanks
to e-mac ).
Yes I saw a sparc system once but it was not connected to anything and
a few people were around it in an institute trying to make heads and
tails out of lump of metal and find the place where to connect the
keyboard because it had no serial/ps2/usb ports.

It would be great if I can see those other architectures like sparc64,
VAX, arm etc and spend some time learning from experienced users
:-


Hi siju,

You probably wont see any of their systems on display running OpenBSD,
but if you're in the UK and into old kit how about a trip over to
Bletchley Park?
http://en.wikipedia.org/wiki/Bletchley_Park

They should even have a Colossus on display dating back to '44.
Again, this probably wont run OpenBSD.

:)

--
~michael
www.bsdqed.com



Re: bgpd and multihop

2007-06-29 Thread Claudio Jeker
On Fri, Jun 29, 2007 at 10:15:14AM +0100, Jon Morby wrote:
 On 29 Jun 2007, at 08:47, Henning Brauer wrote:
 
 * Jon Morby [EMAIL PROTECTED] [2007-06-29 02:56]:
 I've just updated one of our routers from an end of May snapshot to a
 Jun 28th snapshot and have noticed that we seem to be having problems
 with our multihop sessions since the upgrade.
 
 errr... I'm inlcined to say impossible, since there weren't many
 changes at all in bgpd since then, and nothing that remotely touches
 nexthop verification. check your routes, something must be different.
 bgpctl sh nex on both machines might give insight
 
 
 I know ... whether it's just something that has now cropped up  
 because it's the first time these several of these boxes have been  
 rebooted in months ...
 
 The addition of nexthop qualify via bgp seems to have overcome  
 things .. however the next hops should be learnt by ospf and are  
 reachable (otherwise the bgp sessions wouldn't actually be up, which  
 they are)
 

There were some ospfd changes in the last month so it could be that you
actually have a ospfd regression and not a bgpd one.
Could you try to provide more information especially about the nexthop?

-- 
:wq Claudio



acpiprt patch not committed?

2007-06-29 Thread giovanni

http://article.gmane.org/gmane.os.openbsd.tech/13150

why this patch has not been committed?



Re: update of free wireless cards?

2007-06-29 Thread Peter N. M. Hansteen
Vim Visual [EMAIL PROTECTED] writes:

 Ops, sorry, I was meaning internal devices! I am looking for an
 internal wireless card.

the ordinary PCI bus versions are about the same price or slightly cheaper.

- P
-- 
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://www.blug.linux.no/rfc1149/ http://www.datadok.no/ http://www.nuug.no/
Remember to set the evil bit on all malicious network traffic
delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.




Re: Any OpenSBD users in Manchester UK?

2007-06-29 Thread demuel
What will you be doing here in UK?

 Hi,

 I have to come to U.K from 6th July to 15th July.
 It would be great if I can find a few OpenBSD users there and see how
 your implementations are :-)

 Please let me know your contact details off list.
 Also let me know if you need something from India :- if i can
 afford it I'll get it for you.

 I have never seen other architectures except x86, amd64, PPC ( thanks
 to e-mac ).
 Yes I saw a sparc system once but it was not connected to anything and
 a few people were around it in an institute trying to make heads and
 tails out of lump of metal and find the place where to connect the
 keyboard because it had no serial/ps2/usb ports.

 It would be great if I can see those other architectures like sparc64,
 VAX, arm etc and spend some time learning from experienced users
 :-

 I think this would be the best opportunity for that.
 Those things are rare if at all existent in this part of the sub continent.
 I have a tight schedule since I am coming there as part of my Job so I
 don't even know if I'll get free time on weekends but surely don't
 want to miss the chance of seeing you people and these machines if the
 Lord permits :-)

 If the trip were to Paris I would have gone to the house of Johan
 Sanchez :-) who has a whole lot of different architectures.

 And if the trip were to Canada I would stay at Theo's place and give
 him some bright Ideas ;-)

 Germany? Henning of course :-

 US? Nick or JCR :-))

 Thank you so much

 Kind Regards

 Siju



Re: Any OpenSBD users in Manchester UK?

2007-06-29 Thread Darrin Chandler
On Fri, Jun 29, 2007 at 06:06:59PM +0530, Siju George wrote:
 I have to come to U.K from 6th July to 15th July.
 It would be great if I can find a few OpenBSD users there and see how
 your implementations are :-)

I'm not 100% sure on the dates, but I believe you will just miss the
Manchester BSD User Group meeting :(

No, I'm not in the UK. Here's the web page:

http://www.bsdgroups.org.uk/manchester/

-- 
Darrin Chandler|  Phoenix BSD User Group  |  MetaBUG
[EMAIL PROTECTED]   |  http://phxbug.org/  |  http://metabug.org/
http://www.stilyagin.com/  |  Daemons in the Desert   |  Global BUG Federation



Re: Setting up a virtual hosting machine w. SSH/SFTP accounts - pitfalls/experiences?

2007-06-29 Thread Darren Spruell

On 6/29/07, Matt [EMAIL PROTECTED] wrote:

In their homedir there is a `ln -s` to their /var/www/home/username
webspace. That webspace is chowned username:www and chmodded 770 so
httpd can access/write to their dir as well.
Is that advisable / workable? Other ideas?


You don't want the www user being able to write to your web space.
Think about it.

DS



Re: Setting up a virtual hosting machine w. SSH/SFTP accounts - pitfalls/experiences?

2007-06-29 Thread Matt

Darren Spruell schreef:

On 6/29/07, Matt [EMAIL PROTECTED] wrote:

In their homedir there is a `ln -s` to their /var/www/home/username
webspace. That webspace is chowned username:www and chmodded 770 so
httpd can access/write to their dir as well.
Is that advisable / workable? Other ideas?


You don't want the www user being able to write to your web space.
Think about it.

DS


Just did - blush
Thanks for pointing that out.
So that should be chmod 750.

Matt



Re: Any OpenSBD users in Manchester UK?

2007-06-29 Thread Siju George

Thank you so much Darrin and Michael for your responses :-)
Hope I will be lucky enough to have time and oppourtunity.

On 6/29/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote:

What will you be doing here in UK?



Well...

Well..

Now who told you to ask that question? :-)
I carefully avoided that in the previous mail !

I am coming there to install a BSD firewall for a client.
They need a GUI, that is a must.
So it is not our favourite OS.
It is pfSense :-)

I will have to train them how to use it too.

Besides we did develop some demo application for them in MS technologies.
So will be doing the demo installation of that as well and some
training on that too.

Ok keep it secret. it is classified information :-)

Thanks for asking any ways

Kind regards

Siju



Re: Setting up a virtual hosting machine w. SSH/SFTP accounts - pitfalls/experiences?

2007-06-29 Thread Almir Karic

On 6/29/07, Matt [EMAIL PROTECTED] wrote:

2) Chroot jails / limited shells - do's and don'ts

I understand the implications of chroot jails. I understand they are not
worth the risk. Which is a shame really as they bring certain
functionality (or limits if you will) that I would consider nice to have.
How do you prevent people from snooping around the system, looking for
that sloppy permissioned file / gathering intelligence about your
clientbase? All by setting permissions manually?
How do you prevent them from compiling and installing all sorts of things?


regarding the info about client database, it depends what kind of
backend are you using, if it is flat files than permissions are sane
way to protect them IMO.


regarding compiling, IMO not worth the hassle to try to prevent that,
it is not really hard to compile the code on other machine + lack of
compiler makes it painfull for you to follow -current.


regarding all sorts of junk that they might throw at you, well, i use
ulimit. it works.



3) Mail setups

I can find lots of setups with virtual mailusers. I have been
succesfully using a Courier-imap/Postfix/MySQL setup for several years
now, connected to a webbased mailmanagement tool.
If I was to drop all that in favor of a more 'core' OpenBSD setup - what
would be a nice maintainable (both for users and myself) way to offer
single users multiple domains / mailboxes?




i like virtual mail users.


4) Other considerations

Any advice on what to avoid and what to certainly do/check/follow up on
is appreciated.
I will certainly miss stuff that might present a problem down the road.
For instance things like cronjobs- do you limit their use by custom
scripts or do you just monitor abuse?


IMO not worth the effort to restrict usage of crontab. (afterall it is
fairly simple to setup ssh keys and a cronjob on local machine that
will execute some code/script/whatever)




I am aware of things like 'accounting', 'quota' and 'ulimit' - any other
handy utils I might check?



logcheck (never set it up on OBSD tho, just linux).

--
almir



Re: Any OpenSBD users in Manchester UK?

2007-06-29 Thread demuel
Hmm, are there no competent OpenBSD user/programmer/administrator/whatever in 
the UK?
They should inform me, I been into OpenBSD since 2.6 and now they have to 
import someone
from a different timezone just to do that while I am here basically several 
hours by
train -).

That is not classified anymore. Just be careful, security here might be a 
tougher one in
the airport due to a foiled terrorist attack earlier today at the heart of 
Central
London.


 Thank you so much Darrin and Michael for your responses :-)
 Hope I will be lucky enough to have time and oppourtunity.

 On 6/29/07, [EMAIL PROTECTED] [EMAIL PROTECTED] wrote:
 What will you be doing here in UK?


 Well...

 Well..

 Now who told you to ask that question? :-)
 I carefully avoided that in the previous mail !

 I am coming there to install a BSD firewall for a client.
 They need a GUI, that is a must.
 So it is not our favourite OS.
 It is pfSense :-)

 I will have to train them how to use it too.

 Besides we did develop some demo application for them in MS technologies.
 So will be doing the demo installation of that as well and some
 training on that too.

 Ok keep it secret. it is classified information :-)

 Thanks for asking any ways

 Kind regards

 Siju



Re: openbsd 4.0 installed, need to add network interface after install

2007-06-29 Thread John Mendenhall
Stuart,

 I'm far from a guru, but looking at your dmesg I don't see
 a lan card there at all. Here are the first few steps:
 
   1- Check the hardware compatability list to make sure the
  lan card is supported.
   2- Take a look and make sure the lan card is seated in it's
  slot properly.  I have had this happen a few times with 
  smaller cards not seating all the way (it's probably because
  of my fat paws).

The linksys lne100tx card is listed twice, once as
4.x, and another time with no version.  My lne100tx
cards are both v5.1.  I have tried both.  Neither
work.  No lights on back.  Nothing.

Is it possible for the pci slot to be bad?

 btw, for an add on card, you probably won't see anything in the
 systems bios, that is unless bios systems have
 gotten much more functional than they were last time I looked.

Understood.

Thanks so much for your input.

JohnM

-- 
john mendenhall
[EMAIL PROTECTED]
surf utopia
internet services



Re: Setting up a virtual hosting machine w. SSH/SFTP accounts - pitfalls/experiences?

2007-06-29 Thread Daniel Ouellet

3) Mail setups

I can find lots of setups with virtual mailusers. I have been
succesfully using a Courier-imap/Postfix/MySQL setup for several years
now, connected to a webbased mailmanagement tool.
If I was to drop all that in favor of a more 'core' OpenBSD setup - what
would be a nice maintainable (both for users and myself) way to offer
single users multiple domains / mailboxes?


i like virtual mail users.


I am curious about this statement here. Care to provide more details? I 
used to do and am still doing a lots of it in QMail that is changing for 
postfix now and was actually going to add MySQL backend for that to make 
my life easier to manage multiple domains and obviously multiple users. 
I am curious at the replay as it may look like you have something more 
efficient? I was actually looking to just possibly use the postmap with 
hash may be, or may be the built db tools. Wasn't sure however if that 
would be best then MySQL. Obviously much smaller setup. Simpler is 
always better anyway. So, I would appreciate just a bit more suggestion, 
or details on your statement, so that may be something better I haven't 
thought of yet might be best. I am sure not oppose to use MySQL however. 
As for any web tools, I could care less. CLI is plenty good for me and 
anyone else here. SSH access does wonders... (:




Re: openbsd 4.0 installed, need to add network interface after install

2007-06-29 Thread John Mendenhall
Brian,

1- Check the hardware compatability list to make sure the
   lan card is supported.
  2- Take a look and make sure the lan card is seated in it's
   slot properly.  I have had this happen a few times with 
   smaller cards not seating all the way (it's probably because
   of my fat paws).
 
 3. Temporarily boot from another operating system's live CD, e.g.
FreeBSD 6.2 disc 1 (select fixit mode to get a shell)
 
For a Linux view try Ubuntu 6.06.1, or Fedora 7 for a more
bleeding-edge kernel. These two require you to wait for a graphical
environment to start though.
 
 These will show you if another OS recognises the card(s) you have.

I booted an ultimate boot disk, with several small linux distros
on them.  None of them found the card.

I reseated the card.  No go.
I tried another card I had, same model.  Nothing.
I am doing this in a 1U box, so there is a pci 1u
riser card.  Could it be the riser is bad?  Or,
could the pci slot itself be bad?

What is the best way to test the pci slot?

Thanks!

JohnM

-- 
john mendenhall
[EMAIL PROTECTED]
surf utopia
internet services



Re: Setting up a virtual hosting machine w. SSH/SFTP accounts - pitfalls/experiences?

2007-06-29 Thread Almir Karic

On 6/29/07, Daniel Ouellet [EMAIL PROTECTED] wrote:

 3) Mail setups

 I can find lots of setups with virtual mailusers. I have been
 succesfully using a Courier-imap/Postfix/MySQL setup for several years
 now, connected to a webbased mailmanagement tool.
 If I was to drop all that in favor of a more 'core' OpenBSD setup - what
 would be a nice maintainable (both for users and myself) way to offer
 single users multiple domains / mailboxes?

 i like virtual mail users.

I am curious about this statement here. Care to provide more details? I
used to do and am still doing a lots of it in QMail that is changing for
postfix now and was actually going to add MySQL backend for that to make
my life easier to manage multiple domains and obviously multiple users.
I am curious at the replay as it may look like you have something more
efficient? I was actually looking to just possibly use the postmap with
hash may be, or may be the built db tools. Wasn't sure however if that
would be best then MySQL. Obviously much smaller setup. Simpler is
always better anyway. So, I would appreciate just a bit more suggestion,
or details on your statement, so that may be something better I haven't
thought of yet might be best. I am sure not oppose to use MySQL however.
As for any web tools, I could care less. CLI is plenty good for me and
anyone else here. SSH access does wonders... (:





what excatly are you curious about? :)


if you have relativelly few users the postfix hashes should do the
trick, there is one annoyance tho, after every edit you have to run
postmap (easily solvable by wrapper scripts). i tend to use mysql,
maybe it is because i'm used to it.



if you have trully big setups you might wanna look at ldap, from what
i've heard/read it should perform well under heavy read intensive
operations.


--
almir



path traversal exploits

2007-06-29 Thread J.C. Roberts
The unarj v2.43 archiver we have for use with clamav virus scanning does 
not really work. The same is true for the newer 2.65 version released 
by the author. The problem is unarj is unable to extract with paths, 
hence it will overwrite files and stuff won't actually be scanned.

At the moment, I've got a working port of 2.65 patched to extract with 
full paths. The last problem to solve is preventing path traversal 
exploits. I suspect that just searching for double dot .. in the to 
be created path string is not enough but since I've never done this 
sort of thing, I'm not sure where/what to ask.

I would like to find a standardized, well tested way to test strings for 
potential path traversal sequences. Searching with google has been 
fruitless. If you'd be so kind as to drop kick me in the right 
direction, possibly example code, it would be much appreciated. 

Kind Regards,
JCR



Re: openbsd 4.0 installed, need to add network interface after install

2007-06-29 Thread Brian Candler
On Fri, Jun 29, 2007 at 03:16:36PM +0200, St?phane Chausson wrote:
 Brian Candler wrote, On 29/06/07 14:43:
 Also, under Linux, lspci -v gives useful info about the PCI cards you 
 have
 installed. In theory, you should be able to do this with OpenBSD too:
 http://mj.ucw.cz/pciutils.shtml
 
 However it doesn't work for me:
 
 # pkg_add 
 ftp://ftp.openbsd.org/pub/OpenBSD/4.0/packages/i386/pciutils-2.2.1.tgz
 pciutils-2.2.1: complete
 # lspci -v
 lspci: obsd_init: /dev/pci open failed
 
 
 From the pkg_info of pciutils, you have to set machdep.allowaperture=2 
 via sysctl(8)
 
 I set it to 0 and got the same error as the one you show

Thank you, that fixed it. (However I couldn't modify this value using sysctl
while the system was running; I had to put it in /etc/sysctl.conf and
reboot)

# lspci -v
...
01:00.0 Ethernet controller: Realtek Semiconductor Co., Ltd. 
RTL-8139/8139C/8139C+ (rev 10)
Subsystem: Realtek Semiconductor Co., Ltd. RT8139
Flags: bus master, medium devsel, latency 32, IRQ 5
I/O ports at b800
Memory at fe5ffc00 (32-bit, non-prefetchable)
Capabilities: [50] Power Management version 2

01:08.0 Ethernet controller: Intel Corporation 82562EZ 10/100 Ethernet 
Controller (rev 02)
Subsystem: GVC/BCM Advanced Research Unknown device 2181
Flags: bus master, medium devsel, latency 32, IRQ 10
Memory at fe5ee000 (32-bit, non-prefetchable)
I/O ports at bc00
Capabilities: [dc] Power Management version 2

(Those are rl0 and fxp0 respectively)

So maybe the OP can do this too and see if any network cards are reported.

Regards,

Brian.



Re: Setting up a virtual hosting machine w. SSH/SFTP accounts - pitfalls/experiences?

2007-06-29 Thread Matt

Daniel Ouellet schreef:

3) Mail setups

I can find lots of setups with virtual mailusers. I have been
succesfully using a Courier-imap/Postfix/MySQL setup for several years


i like virtual mail users.


I am curious about this statement here. Care to provide more details?


The setup I have been using for a long time now is based on this 
document: 
http://postfix.wiki.xs4all.nl/index.php?title=OpenBSD_PostfixAdmin_Guide
I've succesfully used that on everything up to (and including) 4.1, 
although there are some small changes. Namely the courier-auth libs are 
now different packages.


However I have never liked the sasl2 / imap connection setup - it seems 
a bit dodgy.

Then again I am not anywhere near able to come up with something better.

Any new mailboxes / aliases / etc are immediately available, which is 
nice and convenient.

Downside is MySQL has now become a point of failure for maildelivery.

Matt



Re: openbsd 4.0 installed, need to add network interface after install

2007-06-29 Thread Brian Candler
On Fri, Jun 29, 2007 at 12:40:56PM -0700, John Mendenhall wrote:
 I booted an ultimate boot disk, with several small linux distros
 on them.  None of them found the card.

I'd personally go with a full-sized Linux distro, as it's more likely to
have a complete driver set, but it does seem more like a hardware issue now.

 I reseated the card.  No go.
 I tried another card I had, same model.  Nothing.
 I am doing this in a 1U box, so there is a pci 1u
 riser card.  Could it be the riser is bad?  Or,
 could the pci slot itself be bad?

Yes it's possible. (But then again, I think you said the motherboard had an
on-board NIC too, and that wasn't working either?)

 What is the best way to test the pci slot?

If you remove the motherboard from its case, can you insert a PCI card
directly, not using the riser?

If you have a PCI card which definitely works in another unit (say something
which appears as fxp0 in another box), so much the better.

Given that your on-board LAN isn't working either, maybe the motherboard has
a serious fault. But you might not be able to return it until you can prove
that *Windows* can't find any network cards either :-)

Regards,

Brian.



Re: Setting up a virtual hosting machine w. SSH/SFTP accounts - pitfalls/experiences?

2007-06-29 Thread Daniel Ouellet

Almir Karic wrote:

if you have trully big setups you might wanna look at ldap, from what
i've heard/read it should perform well under heavy read intensive
operations.


I always see a lots of LDAP talks and some documents on it for many 
things including managing multiples users on multiples servers as a way 
to make life easier. To be honest. I never set one up yet. Doesn't know 
much about it either. Always been on my list of things to learn and 
explore. I guess I never came across a very good document that explain 
it so well to me with pro/cons to trigger my interest to try it yet. 
Lots on the net for sure. It just haven't grab me yet. May be that's the 
best things after slice bread and I am missing out. I don't know. May be 
if someone have a reference they ever come across that really trigger 
their interest and turn them to it, I would love to read it. I would 
very much appreciate the pointers to much reading. My ignorance on that 
subject always makes me think that it could be done with SQL, what ever 
flavor you like, so why yet use an other database LDAP? See my total 
dark side to it. (; I never came across a reason or reading to push me 
to learn it and see it as better then other solutions. I am more then 
open to be put in the 21th century and learn it however if that's so 
blind of me.


Best,

Daniel



Re: Setting up a virtual hosting machine w. SSH/SFTP accounts - pitfalls/experiences?

2007-06-29 Thread Almir Karic

On 6/29/07, Daniel Ouellet [EMAIL PROTECTED] wrote:

Almir Karic wrote:
 if you have trully big setups you might wanna look at ldap, from what
 i've heard/read it should perform well under heavy read intensive
 operations.

I always see a lots of LDAP talks and some documents on it for many
things including managing multiples users on multiples servers as a way
to make life easier. To be honest. I never set one up yet. Doesn't know
much about it either. Always been on my list of things to learn and
explore. I guess I never came across a very good document that explain
it so well to me with pro/cons to trigger my interest to try it yet.
Lots on the net for sure. It just haven't grab me yet. May be that's the
best things after slice bread and I am missing out. I don't know. May be
if someone have a reference they ever come across that really trigger
their interest and turn them to it, I would love to read it. I would
very much appreciate the pointers to much reading. My ignorance on that
subject always makes me think that it could be done with SQL, what ever
flavor you like, so why yet use an other database LDAP? See my total
dark side to it. (; I never came across a reason or reading to push me
to learn it and see it as better then other solutions. I am more then
open to be put in the 21th century and learn it however if that's so
blind of me.



http://www.ldapman.org/articles/intro_to_ldap.html IMO good intro to ldap.


if you just want to deploy a not-huge mail server you probably won't
see any advantages of ldap over mysql.


what you can do with ldap (IMO) much better than with mysql is ACL, i
found the 'self' to be pretty nice, example:

access to attrs=userPassword,shadowLastChange
   by dn=cn=admin,dc=my,dc=domain write
   by anonymous auth
   by self write
   by * none


--
almir



Re: openbsd 4.0 installed, need to add network interface after install

2007-06-29 Thread Almir Karic

On 6/29/07, Brian Candler [EMAIL PROTECTED] wrote:

Given that your on-board LAN isn't working either, maybe the motherboard has
a serious fault. But you might not be able to return it until you can prove
that *Windows* can't find any network cards either :-)



that's simple, create a screen session with (multiple) windows in it
and show them ifconfig -A in each of those. :)


--
almir



Re: Setting up a virtual hosting machine w. SSH/SFTP accounts - pitfalls/experiences?

2007-06-29 Thread Craig Skinner
On Fri, Jun 29, 2007 at 09:41:49PM +0200, Almir Karic wrote:
  i like virtual mail users.

I don't. But that's me.

 
 if you have relativelly few users the postfix hashes should do the
 trick, there is one annoyance tho, after every edit you have to run
 postmap (easily solvable by wrapper scripts). i tend to use mysql,
 maybe it is because i'm used to it.
 
 if you have trully big setups you might wanna look at ldap, from what
 i've heard/read it should perform well under heavy read intensive
 operations.
 

Err... No.

NOTHING outperforms flat files. LDAP is good, but not that good.

The more users that you have, the *more* likely you are to use postfix's
builtin maps (esp btree).

The way that ISP's often do it:

Keep customer data in a Postgres database (views, forigen keys, ACID,
triggers, stored procedures, functions,. this is what a database is
for) Support staff and customers can web into this and manipulate
accounts. Heck, even give the account's lassie a button where she can
suspend services for non-payment. Customer data != OS data.

Have scripts that pull data from (materialised) views periodically, use
that data to generate the postfix maps. Diff the new maps to the live
ones, and install the new ones if there is a difference, on all of the
MTA boxes in your mail farm.

When you have (tens of) thousands of users, your CPU is going to be busy
with spam and virus filtering, and SQL is just way to slow.

LDAP is faster, but it is just as much work to set up as is some
perl/shell scripts to set up maps. But you have introduced a weak point,
namely LDAP must be online for you to receive mail.

Repeat the above for passwd, httpd.conf, ftpusers, ftpchroot,
sshd_config, quota.user, mailman, courier, mysql wont help you with
half of the services that you'll end up offering, so why bother?

And just so you don't think that I'm anti SQL, I work as an SQL Data
Analyst. Before that, I worked as a sysadmin, and before that, I worked
as a sysadmin for a national ISP.

Just take the time to think about what it is that you want to achive,
and work back from there, using the bare minimum of stuff, because stuff
goes wrong. e.g: you place all of your trust in a database, and a new
release comes out, that enforces strict practices that your schema does
not adhere to. You upgrade, can't serve requests for week while you
alter all of your data, your name is mud. If you use flat files, kill
the update cronjobs so that things run as they are, fix your data, and
then you can insert new customers. But your existing customers are
unaware that there was a problem at your end as the vast bulk of
business went on as normal.

SQL is complex, and complex equals unreliable. It has its place, but be
careful where you use it.
-- 
Craig Skinner | http://www.kepax.co.uk | [EMAIL PROTECTED]



Re: openbsd 4.0 installed, need to add network interface after install

2007-06-29 Thread Stuart Henderson
 I am doing this in a 1U box, so there is a pci 1u
 riser card.  Could it be the riser is bad?

Maybe, you could remove the bracket from a PCI card and try it with
the case lid off and no riser for a test (and other slots if you have
any)..

Have a look for leaky capacitors while you're there, if you haven't
already seen your fair share, look at http://badcaps.net/ident/



Intel xeon fails to boot with 4.1 release

2007-06-29 Thread Austin Hook
Trying to set up a fairly heavy duty web server I encountered boot
problems with this fairly new machine using the release CD ROM.  Using the
-c command at the boot prompt I already see error messages, before it
gives me the UKC ...

UVM_PAGE_PHYSLOAD: unable to load physical memory segment
5 segments allocated, ignoring 0x7fa9a - 0x7fad0
Increase VM_PHYSSEG_MAX

and repeats this two more times for ranges like:
   0x7fb1a - 0x7fb2c

There is also a message:
RTCBios diagnostic error 1


The system also fails to boot under 3.9 with a ton of virtual memory
warnings, however, it does boot with 4.0 CD release, so the dmesg is given
below.

When using 4.0, however, I go through the motions of fdisk and disklabel
of sd0 -- assigning the entire disk to OpenBSD.  It looks like it works,
but when I reboot - dang, Windows server comes back.

Suggestions anyone?

OpenBSD 4.0 (RAMDISK_CD) #39: Sat Sep 16 19:34:26 MDT 2006
[EMAIL PROTECTED]:/usr/src/sys/arch/i386/compile/RAMDISK_CD
RTC BIOS diagnostic error 1
cpu0: Intel(R) Xeon(R) CPU 5130 @ 2.00GHz (GenuineIntel 686-class) 2 GHz
cpu0: 
FPU,V86,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,SBF,SSE3,MWAIT,DS-CPL,VMX,TM2,CX16
real mem  = 2141388800 (2091200K)
avail mem = 1946718208 (1901092K)
using 4256 buffers containing 107171840 bytes (104660K) of memory
RTC BIOS diagnostic error 1
mainbus0 (root)
bios0 at mainbus0: AT/286+(00) BIOS, date 10/02/06, SMBIOS rev. 2.5 @ 
0x7fa42000 (67 entries)
bios0: Intel MP Server
pcibios at bios0 function 0x1a not configured
bios0: ROM list: 0xc/0x9000 0xc9000/0x1000 0xca000/0x1000
cpu0 at mainbus0
pci0 at mainbus0 bus 0: configuration mode 1 (no bios)
pchb0 at pci0 dev 0 function 0 vendor Intel, unknown product 0x25d8 rev 0x92
ppb0 at pci0 dev 2 function 0 vendor Intel, unknown product 0x25f7 rev 0x92
pci1 at ppb0 bus 1
ppb1 at pci1 dev 0 function 0 Intel 6321ESB PCIE rev 0x01
pci2 at ppb1 bus 2
ppb2 at pci2 dev 0 function 0 Intel 6321ESB PCIE rev 0x01
pci3 at ppb2 bus 3
ppb3 at pci2 dev 1 function 0 Intel 6321ESB PCIE rev 0x01
pci4 at ppb3 bus 4
ppb4 at pci2 dev 2 function 0 vendor Intel, unknown product 0x3518 rev 0x01
pci5 at ppb4 bus 5
em0 at pci5 dev 0 function 0 Intel PRO/1000 PT (80003ES2) rev 0x01: irq 5, 
address 00:15:17:0f:06:5e
em1 at pci5 dev 0 function 1 Intel PRO/1000 PT (80003ES2) rev 0x01: irq 11, 
address 00:15:17:0f:06:5f
ppb5 at pci1 dev 0 function 3 Intel 6321ESB PCIE-PCIX rev 0x01
pci6 at ppb5 bus 6
ppb6 at pci0 dev 3 function 0 Intel 5000 PCIE rev 0x92
pci7 at ppb6 bus 7
ppb7 at pci0 dev 4 function 0 Intel 5000 PCIE rev 0x92
pci8 at ppb7 bus 8
ppb8 at pci0 dev 5 function 0 Intel 5000 PCIE rev 0x92
pci9 at ppb8 bus 9
ppb9 at pci0 dev 6 function 0 Intel 5000 PCIE rev 0x92
pci10 at ppb9 bus 10
ppb10 at pci0 dev 7 function 0 Intel 5000 PCIE rev 0x92
pci11 at ppb10 bus 11
vendor Intel, unknown product 0x1a38 (class system subclass miscellaneous, 
rev 0x92) at pci0 dev 8 function 0 not configured
pchb1 at pci0 dev 16 function 0 Intel 5000 Error Reporting rev 0x92
pchb2 at pci0 dev 16 function 1 Intel 5000 Error Reporting rev 0x92
pchb3 at pci0 dev 16 function 2 Intel 5000 Error Reporting rev 0x92
pchb4 at pci0 dev 17 function 0 Intel 5000 Reserved rev 0x92
pchb5 at pci0 dev 19 function 0 Intel 5000 Reserved rev 0x92
pchb6 at pci0 dev 21 function 0 Intel 5000 FBD rev 0x92
pchb7 at pci0 dev 22 function 0 Intel 5000 FBD rev 0x92
ppb11 at pci0 dev 28 function 0 Intel 6321ESB PCIE rev 0x09
pci12 at ppb11 bus 12
uhci0 at pci0 dev 29 function 0 Intel 6321ESB USB rev 0x09: irq 11
usb0 at uhci0: USB revision 1.0
uhub0 at usb0
uhub0: Intel UHCI root hub, rev 1.00/1.00, addr 1
uhub0: 2 ports with 2 removable, self powered
uhci1 at pci0 dev 29 function 1 Intel 6321ESB USB rev 0x09: irq 5
usb1 at uhci1: USB revision 1.0
uhub1 at usb1
uhub1: Intel UHCI root hub, rev 1.00/1.00, addr 1
uhub1: 2 ports with 2 removable, self powered
uhci2 at pci0 dev 29 function 2 Intel 6321ESB USB rev 0x09: irq 11
usb2 at uhci2: USB revision 1.0
uhub2 at usb2
uhub2: Intel UHCI root hub, rev 1.00/1.00, addr 1
uhub2: 2 ports with 2 removable, self powered
uhci3 at pci0 dev 29 function 3 Intel 6321ESB USB rev 0x09: irq 5
usb3 at uhci3: USB revision 1.0
uhub3 at usb3
uhub3: Intel UHCI root hub, rev 1.00/1.00, addr 1
uhub3: 2 ports with 2 removable, self powered
ehci0 at pci0 dev 29 function 7 Intel 6321ESB USB rev 0x09: irq 11
usb4 at ehci0: USB revision 2.0
uhub4 at usb4
uhub4: Intel EHCI root hub, rev 2.00/1.00, addr 1
uhub4: 8 ports with 8 removable, self powered
ppb12 at pci0 dev 30 function 0 Intel 82801BA AGP rev 0xd9
pci13 at ppb12 bus 13
vga1 at pci13 dev 12 function 0 ATI ES1000 rev 0x02
wsdisplay0 at vga1 mux 1: console (80x25, vt100 emulation)
ichpcib0 at pci0 dev 31 function 0 Intel 6321ESB LPC rev 0x09: PM disabled
pciide0 at pci0 dev 31 function 2 Intel 6321ESB SATA rev 0x09: DMA, channel 0 
wired to compatibility, channel 1 wired