Re: libc.so.4 not found

2000-11-25 Thread Kris Kennaway
On Sat, Nov 25, 2000 at 10:28:53PM +0100, Leif Neland wrote: Could this be the reason why Avp (virusscanner) for FreeBSD 4X just dumps core on Fbsd current? It works on a Fbsd stable. Could be malloc.conf defaults. i.e. a bug in avp triggered by the debugging /etc/malloc.conf settings in

wall/rwall cleanups

2000-11-25 Thread Kris Kennaway
Please review. This syncs up our code with some NetBSD changes, as well as attempting to sync rwall up with wall. Kris Index: wall/wall.c === RCS file: /mnt/ncvs/src/usr.bin/wall/wall.c,v retrieving revision 1.15 diff -u -r1.15

Re: CURRENT is freezing again ...

2000-11-20 Thread Kris Kennaway
On Fri, Nov 17, 2000 at 05:58:30PM -0800, Kris Kennaway wrote: On Fri, Nov 17, 2000 at 12:55:28PM +0100, Soren Schmidt wrote: I thought I was the only one, since my question on the freebsd-current mailing list went unanswered. You are _not_ alone, there has been numerous complains

Re: CURRENT is freezing again ...

2000-11-17 Thread Kris Kennaway
On Fri, Nov 17, 2000 at 12:55:28PM +0100, Soren Schmidt wrote: I thought I was the only one, since my question on the freebsd-current mailing list went unanswered. You are _not_ alone, there has been numerous complains about this on the list, but so far they have not been taken seriously

Re: Proper permissons on /tmp

2000-11-15 Thread Kris Kennaway
On Thu, Nov 16, 2000 at 06:54:23AM +0100, Leif Neland wrote: What is the proper perms on /tmp? 1777 Kris PGP signature

New openssh maintainer

2000-11-12 Thread Kris Kennaway
I havent had time to deal with OpenSSH problems lately - I've asked Brian Feldman to take over for me, and he's agreed. Hassle him from now on, please :-) Kris PGP signature

Re: OpenSSL 0.9.6 update

2000-11-10 Thread Kris Kennaway
On Sat, Nov 04, 2000 at 03:25:53PM -0800, Kris Kennaway wrote: Please test the new version of OpenSSL available at: http://www.freebsd.org/~kris/openssl-0.9.6.tbz Extract it in /usr/src and it will spam over the existing copies of your crypto/openssl and secure/. A patch relative

Re: cvs problems

2000-11-08 Thread Kris Kennaway
On Wed, Nov 08, 2000 at 10:18:18AM +0100, urded wrote: I updated my sources using cvsup, and i am unable to make the world : the message i get is : === doc /usr/obj/usr/src/i386/usr/src/gnu/usr.bin/gperf/doc created for /usr/src/gnu/usr.bin/gperf/doc make: don't know how to make

Re: Problem with dlopen()/dlsym() after recent crt* changes

2000-11-06 Thread Kris Kennaway
On Mon, Nov 06, 2000 at 10:14:32AM +0200, Maxim Sobolev wrote: Jordan Hubbard wrote: After the crt changes the following piece of code, which worked previously, gives a 'host: dlopen() failed: ./module.so: Undefined symbol "__register_frame_info' error message (yeah, I know that it's

OpenSSL 0.9.6 update

2000-11-04 Thread Kris Kennaway
Please test the new version of OpenSSL available at: http://www.freebsd.org/~kris/openssl-0.9.6.tbz Extract it in /usr/src and it will spam over the existing copies of your crypto/openssl and secure/. A patch relative to the current version will also shortly be at

Re: entropy reseeding is totally broken

2000-10-26 Thread Kris Kennaway
On Wed, Oct 25, 2000 at 10:35:55AM +, Terry Lambert wrote: I see the opposite. I see that without writing to the /dev/random device I get a cons is an object that cares fortune 99+% of the time on my first login. With it, I see more decently random fortunes (but I haven't done a

Re: entropy reseeding is totally broken

2000-10-26 Thread Kris Kennaway
On Wed, Oct 25, 2000 at 02:50:29PM +0400, Andrej Cernov wrote: It is because /dev/random totally ignore _time_ and not reseed from it, but no other randomness source available at boot time. We should probably be using the time since boot as ONE thing we seed with, but it only provides maybe

Re: modules again non-shareable?

2000-10-14 Thread Kris Kennaway
On Fri, Oct 13, 2000 at 08:38:34PM -0700, Matthew Jacob wrote: would that nullfs worked! It does, modulo remaining bugs which Boris hasnt yet fixed. Kris To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-current" in the body of the message

Re: sio problems?

2000-10-08 Thread Kris Kennaway
On Sat, Oct 07, 2000 at 08:03:12PM -0500, Mike Meyer wrote: I recently got my digital camera back out, and started pulling the old pictures from it. I noticed something I hadn't ever seen before - silo overflows from the sio port. At the moment, I'm wondering if this is a known problem that

Re: Today -current broken on build

2000-10-01 Thread Kris Kennaway
On Sun, Oct 01, 2000 at 12:20:04AM -0500, Tony Johnson wrote: Run 4.0 or piss off... Tony, I suggest you apologise to Mr Choi for this extremely insulting message. Kris -- In God we Trust -- all others must submit an X.509 certificate. -- Charles Forsythe [EMAIL PROTECTED] To

Re: interesting problem

2000-09-27 Thread Kris Kennaway
On Wed, 27 Sep 2000, Tony Johnson wrote: When I booted the 9/27/2000 (ie. today) I got a page fault 12 in kernel mode. The problem seems to be because I have all my IDE devices turned off in my bios. If this is the case, please undo this! That would be the silliest reason for a kernel to

RE: interesting problem

2000-09-27 Thread Kris Kennaway
On Wed, 27 Sep 2000, Tony Johnson wrote: I don't believe the handbook covers "today's" 5.0-Current... Why would having no bustmastering DMA IDE disk contriollers on an all-scsi system cause a system to page fault from "today's" kern.flp mfsroot.flp boot floppy. Try again... No, you try

Re: Breakage in make world: pam_ssh

2000-09-25 Thread Kris Kennaway
On Mon, 25 Sep 2000, Leif Neland wrote: I changed from the individual parts to src/all, and besides getting kerberos and secure, I also got these files from crypto, which I should have gotten already with src/crypto: Nope, these are in the src-sys-crypto collection. Checkout

Re: Fsck wrappers, revisited

2000-09-24 Thread Kris Kennaway
On Sat, 23 Dec 2000, Adrian Chadd wrote: On Fri, Sep 22, 2000, Boris Popov wrote: On Sat, 23 Dec 2000, Adrian Chadd wrote: So now is a problem which I'm sure the NetBSD people came up against. The fstypenames are names like 4.2BSD, vinum, ISO9660, etc. NetBSD fixed this by

Re: Breakage in make world: pam_ssh

2000-09-24 Thread Kris Kennaway
On Mon, 25 Sep 2000, Leif Neland wrote: After trouble making world for some days, I blew the entire /usr/src away (and lost my kernel-config's :-( ) On a freshly cvsupped current, this has been broken for a few days. I think you're not cvsupping all of the source. In particular the crypto

Re: Getting ssh back to work?

2000-09-23 Thread Kris Kennaway
On Sat, 23 Sep 2000, Mark Huizer wrote: I thought I had read the interesting stuff on ssh recently in -current, but I can't get ssh to work again on the machine I switched to yesterday's current :-( device random in your kernel. Kris -- In God we Trust -- all others must submit an X.509

Re: 1131 unneeded includes in the kernel...

2000-09-20 Thread Kris Kennaway
On Wed, 20 Sep 2000, Brandon D. Valentine wrote: On Tue, 19 Sep 2000, Matthew Jacob wrote: Oh- don't get me wrong. Valuable info. Thanks. What would be very cool is to feed this into another script which strips these unnecesary includes out. Then do a test build of LINT in your local

Re: ssh and scp fail connecting to a root account

2000-09-17 Thread Kris Kennaway
On 17 Sep 2000, Jason Evans wrote: On Fri, Sep 15, 2000 at 03:40:12PM +0100, Konstantin Chuguev wrote: Udo Schweigert wrote: after a fresh build of -current openssh does not work if connecting to the root-user. For example (tested from a -stable machine, but the same from

Re: upgrade libgmp?

2000-09-16 Thread Kris Kennaway
On Sat, 16 Sep 2000, Steve Kargl wrote: Before I jump in and attempt to do an upgrade of libgmp, I thought I'd asked if anyone else has endured this joy? Note, src/contrib/libgmp is at version 2.0.x and it is 3+ years old. The newest version is at 3.1. The Changelog indicates that

Re: upgrade libgmp?

2000-09-16 Thread Kris Kennaway
On Sat, 16 Sep 2000, Steve Kargl wrote: I'm not fluent in FSF configure scripts, but it looks like configure tests the compiler for specific features to determine CPU type. The gross hack would be to add CPU_TYPE="generic" to /etc/defaults/make.conf, and allow users to define CPU_TYPE in

Re: upgrade libgmp?

2000-09-16 Thread Kris Kennaway
On Sat, 16 Sep 2000, Steve Kargl wrote: I need to review the gmp documents again, but I not sure the preference order is much of an issue. By default, CPU_TYPE="generic" would build the C code, which should work on all architectures supported by FreeBSD. If a user explicitly sets CPU_TYPE

Re: ssh and scp fail connecting to a root account

2000-09-15 Thread Kris Kennaway
On Fri, 15 Sep 2000, Udo Schweigert wrote: The strange: both commands succeed if connecting to a non-root account. Are there any others with these problems? Any clues? run sshd -d on the server, ssh -d on the client, and send me the output Kris -- In God we Trust -- all others must submit

Re: Please consider some cosmetic changes in boot messages

2000-09-12 Thread Kris Kennaway
On Tue, 12 Sep 2000, Jordan Hubbard wrote: I'm also not sure where the rumors about a FreeBSD 4.1.5 got started since I'd certainly never planned on such a thing, that, I think, A certain user called jkh on IRC :-). I asked you and you agreed to it as a net-only release. Kris -- In God we

Re: make world libcrypto Undefined symbol RSA_PKCS1

2000-09-11 Thread Kris Kennaway
On Sun, 10 Sep 2000, Mark Hittinger wrote: It may be because of something screwy that I did, I had been cvsup'ing from cvsup3. Saw the note about 3 not having a full crypto mirror so I tried a cvsup from 2 and make world completed, but when running ssh I get this:

HEADS UP: New OpenSSH

2000-09-10 Thread Kris Kennaway
New version of OpenSSH has been updated as announced a few days ago. Notable features: * ssh-add can handle DSA keys * sftp server interoperable with ssh.com clients and others * scp can handle files 2GB * better interoperability with other ssh2 clients/servers * ssh-agent can handle DSA keys *

Re: HEADS UP: New OpenSSH

2000-09-10 Thread Kris Kennaway
On Sun, 10 Sep 2000, David Malone wrote: On Sun, Sep 10, 2000 at 03:30:54AM -0700, Kris Kennaway wrote: * better interoperability with other ssh2 clients/servers Any idea if it can read non-OpenSSH DSA host keys? The version in 4.1 doesn't seem to be able too, though it can read non

Re: Another broken buildworld

2000-09-10 Thread Kris Kennaway
On Sun, 10 Sep 2000, Eric Hedberg wrote: OK, fresh cvsup (blew away the old /usr/src, slurped down a new one this afternoon). Don't cvsup from cvsup3, it doesnt carry a full crypto mirror. Kris -- In God we Trust -- all others must submit an X.509 certificate. -- Charles Forsythe [EMAIL

Re: USA_RESIDENT variable is no longer needed ?

2000-09-07 Thread Kris Kennaway
On Thu, 7 Sep 2000, Makoto MATSUSHITA wrote: IIRC, the only file that uses USA_RESIDENT is src/secure/lib/Makefile, and now it is gone away. Does this change imply that we are free from defining USA_RESIDENT when building the FreeBSD world ? I believe so - I'm going to go over the crypto

Re: HEADS UP: linux module breaks current

2000-09-07 Thread Kris Kennaway
On Thu, 7 Sep 2000, Sheldon Hearn wrote: Just a warning to anyone wanting to try out SMPng -- make sure that you hdon't have ``linux_enable="YES"'' in /etc/rc.conf. I got a kernel trap when /etc/rc tried to load the linux module. I haven't had time to get a panic and backtrace to Marcel,

HEADS UP: sshd (Re: cvs commit: src/release/sysinstall config.c)

2000-09-04 Thread Kris Kennaway
On Mon, 4 Sep 2000, Jordan K. Hubbard wrote: jkh 2000/09/04 08:50:15 PDT Modified files: release/sysinstall config.c Log: enable sshd by default. This only effects *new* installs, so upgraders will not receive any unpleasant surprises. This will be semi-broken

Re: Include OpenSSL root CA cert list?

2000-09-04 Thread Kris Kennaway
On Mon, 4 Sep 2000, Poul-Henning Kamp wrote: In message [EMAIL PROTECTED], Nick Sayer writes: If something like this already exists, then my searches must have missed it. In order to improve the usefulness of the openssl installation, I would like to suggest that a collection of CA root

Re: HEADS UP: sshd (Re: cvs commit: src/release/sysinstall config.c)

2000-09-04 Thread Kris Kennaway
On Mon, 4 Sep 2000, Jordan Hubbard wrote: This will be semi-broken for the next 17 days for US people because sshd won't work out of the box if you have "Protocol 1" defined, which is in the default config (and removing it may surprise people upgrading) Well, it's at least one step

Re: HEADS UP: sshd (Re: cvs commit: src/release/sysinstall config.c)

2000-09-04 Thread Kris Kennaway
On Mon, 4 Sep 2000, Warner Losh wrote: In message [EMAIL PROTECTED] Jordan Hubbard writes: : Well, it's at least one step closer - all they have to do now (the US : people) is install the rsaref port to have the already-running sshd : work correctly post-install, correct? Unless they want

Re: Current jumpieness

2000-09-01 Thread Kris Kennaway
On Fri, 1 Sep 2000, Paul Herman wrote: Has anyone else noticed that -CURRENT is a bit "jumpy"? I notice for It's probably the new /dev/random implementation. It's being worked on. Kris -- In God we Trust -- all others must submit an X.509 certificate. -- Charles Forsythe [EMAIL

Re: Current jumpieness

2000-09-01 Thread Kris Kennaway
On Fri, 1 Sep 2000, Sheldon Hearn wrote: On Fri, 01 Sep 2000 03:07:33 MST, Kris Kennaway wrote: On Fri, 1 Sep 2000, Paul Herman wrote: Has anyone else noticed that -CURRENT is a bit "jumpy"? I notice for It's probably the new /dev/random implementation. It's be

Re: yarrow /dev/random

2000-09-01 Thread Kris Kennaway
On Fri, 1 Sep 2000, Mark Murray wrote: PC's are pretty low-entropy devices; users who need lots of random bits (as opposed to a steady supply of random numbers) are arguably going to need to go to extraordinary lengths to get them; their own statistical analysis is almost certainly

OpenSSH 2.2.0 patches for review

2000-09-01 Thread Kris Kennaway
Can everyone please review the following code: http://www.freebsd.org/~kris/openssh-2.2.0.tgz which is my first pass at integrating the latest 0-day OpenSSH release. OpenBSD have integrated some of our patches and subtly changed others, and moved several chunks around, so I'd like some eyes-on

Re: Restricting ftpd commands (fwd)

2000-08-29 Thread Kris Kennaway
On Tue, 29 Aug 2000, Chris D. Faulhaber wrote: The following got no response on -security two weeks ago. Perhaps -current will have more opinions. -- Forwarded message -- I have found quite a few commands that ftpd shouldn't necessarily be responding to if the user

Re: make buildworld (4-5) failed

2000-08-26 Thread Kris Kennaway
On Sat, 26 Aug 2000, Alexey Zelkin wrote: hi, Just experienced on 4.0-RELEASE and 4.1-STABLE (two days ago) following error when tried to build current world. This was already fixed a few days ago. Kris -- In God we Trust -- all others must submit an X.509 certificate. -- Charles

Re: People running with LOCALBASE set to something other than/usr/local?

2000-08-23 Thread Kris Kennaway
On Wed, 23 Aug 2000, Mike Meyer wrote: How does it decide whether or not a package conforms? Probably by looking for files which get installed in /usr/local or /usr/X11R6 instead of ${LOCALBASE} or ${X11BASE} :-) Kris -- In God we Trust -- all others must submit an X.509 certificate. --

Re: problem with ftp in latest -current

2000-08-16 Thread Kris Kennaway
On Wed, 16 Aug 2000, Donn Miller wrote: Lately, I can't ftp to any anonymous ftp sites. Every single one I attempt to ftp to gives me a "connection refused" error message. Is there a problem with bind? Only on your end :-) Kris -- In God we Trust -- all others must submit an X.509

Re: Upgrading 2.2.8 - current

2000-08-09 Thread Kris Kennaway
On Wed, 9 Aug 2000, Warner Losh wrote: OK. I have a laptop that's running 2.2.8 right now. I had planned on upgrading it to 3.5 via a source build and then again to -current from there. Before I did that, since this is a 486 DX4 100 pc98 machine, I thought I'd ask if the 2.2.8 -

Re: Loss of fetch(1) functionality with libfetch

2000-08-03 Thread Kris Kennaway
On 3 Aug 2000, Dag-Erling Smorgrav wrote: Peter Jeremy [EMAIL PROTECTED] writes: Whilst the environment is somewhat safer than the command line, I'd still prefer not to have passwords embedded in environment variables. Since ps(1) no longer allows users to view other users' processes'

Re: ssh -2 -v displays debug messages when typed

2000-08-01 Thread Kris Kennaway
On Tue, 1 Aug 2000, Jun Kuriyama wrote: On my -current environment, ssh -2 -v (Version 2 protocol with DSA, verbose mode) displays debug message to tty whenever I typed. If I use version 1 protocol, debug messages are not displayed after logged in to another system. Is this expected

Mozilla-M15+ipv6 package available

2000-07-31 Thread Kris Kennaway
A few people have asked me for this, so I uploaded a package of the mozilla-M15+ipv6 port from KAME to http://www.freebsd.org/~kris/mozilla-M15.tgz (yes, I know M16 is out, but the port isn't yet updated). Install this package and you too can see the dancing kame at http://www.kame.net, the

sort(1) broken?

2000-07-31 Thread Kris Kennaway
The following no longer seems to work on any of my 5.0 boxes: ls -l | sort -n -k 5 which should sort numerically by the size column (instead it seems to do the same thing as sort -n). It works correctly on 3.x and 4.x boxes. Anyone have ideas? Kris -- In God we Trust -- all others must

Re: sort(1) broken?

2000-07-31 Thread Kris Kennaway
On Mon, 31 Jul 2000, Alexander Langer wrote: Thus spake Brian Fundakowski Feldman ([EMAIL PROTECTED]): I'm doubtful it's the only one of it's kind in GNU sort(1). Time for BSD sort(1)? What about BSD/OS's sort? BSD/OS userland is almost completely untouched from the 4.4BSD sources.

Re: randomdev entropy gathering is really weak

2000-07-30 Thread Kris Kennaway
On Sun, 30 Jul 2000, Mark Murray wrote: This is a reversion to the count-entropy-and-block model which I have been fiercely resisting (and which argument I thought I had sucessfully defended). Actually, I was waiting for your reply to Jeroen's question about changing the semantics of the

Re: randomdev entropy gathering is really weak

2000-07-26 Thread Kris Kennaway
On Wed, 26 Jul 2000, void wrote: How does OpenBSD handle this issue? Anyone know? It looks like they have four different kernel-exported random-number generators: #define RND_RND 0 /* real randomness like nuclear chips */ #define RND_SRND1 /* strong random source

Re: randomdev entropy gathering is really weak

2000-07-24 Thread Kris Kennaway
On Mon, 24 Jul 2000, Jeroen C. van Gelderen wrote: 1. The overhead will probably be insignificant. One doesn't use such vast amounts of random numbers. True, but the effect on slow CPUs for a single read may be signfificant. We'll have to see. 2. At least the generator gate can be

Re: randomdev entropy gathering is really weak

2000-07-23 Thread Kris Kennaway
On Sun, 23 Jul 2000, Mark Murray wrote: Your are missing the point that it is not possible to get more than the ${number-of-bits-ofrandomness} from any accumulator or PRNG. You have to draw the line somewhere; The current implementation has it at 256. Uhh..a PRNG which hashes entropy

Re: randomdev entropy gathering is really weak

2000-07-23 Thread Kris Kennaway
On Sun, 23 Jul 2000, Mark Murray wrote: By your own admission, the old system was bad; yet you still want ${it}? You'd like to see a programmer with less experience than Schneier come up with a more secure algorithm than him? The old implementation was bad. The class of algorithm is not, as

Re: randomdev entropy gathering is really weak

2000-07-23 Thread Kris Kennaway
On Sun, 23 Jul 2000, Mark Murray wrote: Okay, using RSA keys wasn't the best example to pick, but Yarrow also seems easy to misuse in other cases: for example if you want to generate multiple 256-bit symmetric keys (or other random data) at the same time, each additional key after the

Re: Netscape

2000-07-23 Thread Kris Kennaway
On Sun, 23 Jul 2000 [EMAIL PROTECTED] wrote: Netscape 4.74 is already out but FreeBSD 4.1-RC2 contains 4.73 version yet. Will FreeBSD 4.1-RELEASE contains the last version (4.74) of Netscape Communicator and Navigator? No. The ports tree has been frozen. Kris -- In God we Trust -- all

Re: randomdev entropy gathering is really weak

2000-07-23 Thread Kris Kennaway
On Sun, 23 Jul 2000, Poul-Henning Kamp wrote: Obviously, if you need more randomness than a stock FreeBSD system can provide you with, you add hardware to give you more randomness. This won't help if it's fed through Yarrow. In other words, and more bluntly: Please shut up now, will you ?

Re: randomdev entropy gathering is really weak

2000-07-23 Thread Kris Kennaway
On Sun, 23 Jul 2000, Mark Murray wrote: Erm, read 4.1 again :-). The paragraph that begins "One approach..." is the old approach. It is also the approach that you are advocating. The next paragraph "Yarrow takes..." is Yarrow, and the current implementation. "The strength of the first

Re: Netscape

2000-07-23 Thread Kris Kennaway
On Sun, 23 Jul 2000 [EMAIL PROTECTED] wrote: If there will be "FreeBSD 4.1-RC3+" will it contains the newer version of Netscape? No - the ports collection for 4.1-RELEASE has been frozen. Are the fixed in Netscape 4.74 bugs not critical for release? Who knows? I don't know of any changelog

Re: randomdev entropy gathering is really weak

2000-07-23 Thread Kris Kennaway
On Sun, 23 Jul 2000, Mark Murray wrote: This design tradeoff is discussed in section 4.1 of the paper. Tweakable. Doing a reseed operation with every output is going to be *very* computationally expensive. Tradeoff. What do you want? Lightning fast? Excessive security? Balance

Re: Re[2]: Journaling Filesystem ?

2000-07-23 Thread Kris Kennaway
On Sun, 23 Jul 2000, Joe McGuckin wrote: The big win with a journaling FS is when you have to reboot the system. With Softupdates, you still have to fsck. On a large FS (say half a terabyte) that can take hours. No you don't. Your filesystem will be in a consistent state except for blocks

Re: Re[2]: Journaling Filesystem ?

2000-07-23 Thread Kris Kennaway
On Sun, 23 Jul 2000, Brian O'Shea wrote: I didn't even know that background fsck was supported at all. I remember hearing Kirk talk about it as a future feature at FreeBSD CON last year, but I havn't heard anything about it since. How do you use it? I've never tried it myself - maybe I am

Re: randomdev entropy gathering is really weak

2000-07-23 Thread Kris Kennaway
On Sun, 23 Jul 2000, Mark Murray wrote: There are two other models which rate "pretty well-designed" in the Yarrow paper: the cryptlib and PGP PRNGs. I don't know what their properties are right now (the cryptlib one is described in the paper on PRNG cryptanalysis). Do you have copies

Re: randomdev entropy gathering is really weak

2000-07-23 Thread Kris Kennaway
On Sun, 23 Jul 2000, Jeroen C. van Gelderen wrote: Well, a simple scheme which doesn't seem to suffer from any of the vulnerabilities discussed in the schneier papers is to accumulate entropy in a pool, and only return output when the pool is full. i.e. the PRNG would either block or

Re: randomdev entropy gathering is really weak

2000-07-22 Thread Kris Kennaway
On Sat, 22 Jul 2000, Mark Murray wrote: Lots of references: Schneier's "Applied Cryptography" talks about using Good Hashes for crypto and Good Crypto for hashes. Schneier's site at www.counterpane.com will give you plenty. I havent been able to get my hands on Applied Cryptography, but I

Re: randomdev entropy gathering is really weak

2000-07-22 Thread Kris Kennaway
On Sat, 22 Jul 2000, Mark Murray wrote: Because of Yarrow's cryptographic protection of its internal state, its frequent reseeds and its clever geneation mechanism, this paradigm is less important - the output is 256-bit safe (Blowfish safe) for any size of output[*]. When you read 1000

Re: randomdev entropy gathering is really weak

2000-07-22 Thread Kris Kennaway
On Sat, 22 Jul 2000, Mark Murray wrote: So what it if I want/need 257 bits? :-) Read them. You'll get them. If you want higher quality randomness than Yarrow gives, read more than once. Do other stuff; play. Don't get stuck in the "I have exhausted the randomness pool" loop; Yarrow does

Re: randomdev entropy gathering is really weak

2000-07-22 Thread Kris Kennaway
On Sat, 22 Jul 2000, Jeroen C. van Gelderen wrote: You don't care in practice, 256 bits are unguessable. Actually, I do..that's the entire point of using long keys. If you do care, you load a different random module :-) The core of my complaint is that even though our old PRNG did crappy

Re: randomdev entropy gathering is really weak

2000-07-22 Thread Kris Kennaway
On Sat, 22 Jul 2000, Jeroen C. van Gelderen wrote: I agree that you need long RSA keys ... but the real discussion isn't really about key length but rather about the overall complexity of attacking the key: Okay, using RSA keys wasn't the best example to pick, but Yarrow also seems easy to

Re: randomdev entropy gathering is really weak

2000-07-21 Thread Kris Kennaway
On Tue, 18 Jul 2000, Dan Moschuk wrote: Well, how many other OSs out there allow /dev/random to be written to? FreeBSD, OpenBSD, NetBSD, Linux... Kris -- In God we Trust -- all others must submit an X.509 certificate. -- Charles Forsythe [EMAIL PROTECTED] To Unsubscribe: send mail to

Re: randomdev entropy gathering is really weak

2000-07-21 Thread Kris Kennaway
On Fri, 21 Jul 2000, Mark Murray wrote: Section 2.1, last paragraph: "If a system is shut down, and restarted, it is desirable to store some high-entropy data (such as the key) in non-volatile memory. This allows the PRNG to be restarted in an unguessable state at the next restart. We call

Re: randomdev entropy gathering is really weak

2000-07-21 Thread Kris Kennaway
On Fri, 21 Jul 2000, Mark Murray wrote: If you are worried about someone reading the disk of a rebooting box, then you need to be worried about console access; if your attacker has console, you are screwed anyway. For most people, yes. But it's like all of the buffer overflows in non-setuid

RE: randomdev entropy gathering is really weak

2000-07-21 Thread Kris Kennaway
On Fri, 21 Jul 2000, David Schwartz wrote: You generate a new PGP keypair and start using it. Your co-worker reboots your machine afterwards and recovers the PRNG state that happens to be stashed on disk. He can then backtrack and potentially recover the exact same random numbers that

Re: randomdev entropy gathering is really weak

2000-07-21 Thread Kris Kennaway
On Fri, 21 Jul 2000, Kris Kennaway wrote: Section 2.1, last paragraph: "If a system is shut down, and restarted, it is desirable to store some high-entropy data (such as the key) in non-volatile memory. This allows the PRNG to be restarted in an unguessable state at the next restar

Re: trafshow doesn't work?

2000-07-19 Thread Kris Kennaway
On Wed, 19 Jul 2000, Sam Xie wrote: Hi! There, My trafshow doesn't work. Whenever I tried to run trafshow, it gave me error message says, "trafshow: : Device not configured" I check my Kernel configuration file, a line Fallout from the malloc.conf changes. tcpdump has

Re: randomdev entropy gathering is really weak

2000-07-18 Thread Kris Kennaway
On Tue, 18 Jul 2000, Bruce Evans wrote: You must have a fast machine to get 10MB/sec. I see the following speeds (using a better reading program than dd; dd gives up on EOF on the old /dev/random): Oops, I misread the rate by 2 orders of magnitude. I get about 100K/sec on my PPro/233 :-)

Re: randomdev entropy gathering is really weak

2000-07-17 Thread Kris Kennaway
On Mon, 17 Jul 2000, Mark Murray wrote: On the other hand, doing a dd if=/dev/random of=/dev/null gives me infinite "randomness" at 10MB/sec - have the semantics of /dev/random changed? Yes; remember that what we have here is Yarrow algorithm; which is an algorithm for

Re: randomdev entropy gathering is really weak

2000-07-17 Thread Kris Kennaway
On Mon, 17 Jul 2000, Mark Murray wrote: What we really need is this: fetch -o http://entropy.freebsd.org/ /dev/random For this to work, you'll need to encrypt the traffic. fetch -o https://entropy.freebsd.org/ /dev/random ^ If the world knows what they are,

Re: randomdev entropy gathering is really weak

2000-07-16 Thread Kris Kennaway
On Sun, 16 Jul 2000, Mark Murray wrote: On Sun, Jul 16, 2000 at 08:26:44PM +0200, Mark Murray wrote: Gotcha - fix coming; I need to stash some randomness at shutdown time, and use that to reseed the RNG at reboot time. ... and for installations where ssh-keygen is run the first

Re: missing idea.h, still conflicting defines WITH_IDEA and MAKE_IDEA

2000-07-16 Thread Kris Kennaway
On Sun, 16 Jul 2000, Andreas Klemm wrote: Something seems to be wrong with the logic concerning IDEA stuff. I ask because I can't build the security/p5-Net-SSLeay port anymore which is for example needed for webmin. Compare r1.2 of /usr/src/crypto/openssl/crypto/evp/evp.h with r1.4. Kris

Re: -current, racoon, ipsec

2000-07-15 Thread Kris Kennaway
On Sat, 15 Jul 2000, Mark Huizer wrote: Grr... ok, that might be solved when putting IPSEC in the kernel config, but the second part still stands, I guess. (Why include libipsec code when it is in the base tree... they should be compatible) Just use the port. I presume the included

Re: weird application coredumps ....

2000-07-15 Thread Kris Kennaway
On Sat, 15 Jul 2000, Pascal Hofstee wrote: ln -sf j /etc/malloc.conf --- fixed the problems i was having Thanks ... (maybe a HEADS UP in UPDATING ??) Nope, the new malloc flags are hilighting bugs in your application..they should be fixed, not ignored :-) (this was the whole point of

Re: -current, racoon, ipsec

2000-07-14 Thread Kris Kennaway
On Fri, 14 Jul 2000, Mark Huizer wrote: Grr... ok, that might be solved when putting IPSEC in the kernel config, but the second part still stands, I guess. (Why include libipsec code when it is in the base tree... they should be compatible) Just use the port. I presume the included copy of

tcpdump malloc bug

2000-07-14 Thread Kris Kennaway
citusc17# ln -s AJ /etc/malloc.conf citusc17# tcpdump tcpdump: [CRAP DELETED]: Device not configured This is true on 4.0-S as well, where I actually first found it. Kris -- In God we Trust -- all others must submit an X.509 certificate. -- Charles Forsythe [EMAIL PROTECTED] To

Re: KAME integration and plans

2000-07-11 Thread Kris Kennaway
On Tue, 11 Jul 2000, Ben Smithurst wrote: I'd like to commit this: --- stf.4 2000/07/04 16:39:23 1.4 +++ stf.4 2000/07/11 13:44:47 @@ -36,7 +36,7 @@ .Nd .Tn 6to4 tunnel interface .Sh SYNOPSIS -.Cd "pseudo-device stf" +.Cd "pseudo-device gif" .Sh DESCRIPTION The

malloc() bug in ld

2000-07-11 Thread Kris Kennaway
Since setting my malloc.conf flags to AJ I'm getting spontaneous sig10's in ld(1) - in fact I can't link anything with those flags set. Can anyone else confirm? Kris -- In God we Trust -- all others must submit an X.509 certificate. -- Charles Forsythe [EMAIL PROTECTED] To Unsubscribe:

Re: malloc() bug in ld

2000-07-11 Thread Kris Kennaway
On Tue, 11 Jul 2000, Kris Kennaway wrote: Since setting my malloc.conf flags to AJ I'm getting spontaneous sig10's in ld(1) - in fact I can't link anything with those flags set. Can anyone else confirm? Hmm, well it went away after a binutils recompile. So maybe I just still had the old

Re: malloc() bug in ld

2000-07-11 Thread Kris Kennaway
On Tue, 11 Jul 2000, Kris Kennaway wrote: Hmm, well it went away after a binutils recompile. So maybe I just still had the old version or something. *shrug* Yes, I did: ld -V GNU ld version 2.10-anoncvs-2512 (with BFD 2.10-anoncvs-2512) Supported emulations: elf_i386 ld -V

Re: HEADS UP! Always use the 'make buildkernel' target to make yerkernels (fwd)

2000-07-10 Thread Kris Kennaway
+0200 From: Udo Schweigert [EMAIL PROTECTED] To: Kris Kennaway [EMAIL PROTECTED] Cc: [EMAIL PROTECTED] Subject: Re: HEADS UP! Always use the 'make buildkernel' target to make yer kernels On Sun, Jul 09, 2000 at 20:49:50 -0700, Kris Kennaway wrote: Subject basically says it all. "make buildk

Re: regex(3)

2000-07-09 Thread Kris Kennaway
On Mon, 10 Jul 2000, Daniel C. Sobral wrote: I think all bugs with the performance improvements to regex(3) have all been solved now. I haven't heard of any problems for over a week about the first improvement (Boyer-Moore search), and I have now tested the code against the original test

Re: Problems building kernel with IPSEC_DEBUG

2000-07-07 Thread Kris Kennaway
On Thu, 6 Jul 2000, Jim Bloom wrote: While compiling a kernel with recent code (cvsup 22:30 -0400 July 6), I had some undefined symbols. I traced the symbols to netkey/key_debug.c and found that it did not test IPSEC_DEBUG correctly. I have attached a patch below. Fixed! Kris -- In

Re: Suspicious warnings in -CURRENT

2000-07-07 Thread Kris Kennaway
On Fri, 7 Jul 2000, Alexander N. Kabaev wrote: After today's buildworld, I am seeing lots of warning messages from libc like: expr in free(): warning: modified (chunk-) pointer regexp breakage? There were several commits recently, try rebuilding libc. Kris -- In God we Trust -- all others

Call for help: KAME (inter)operational testing

2000-07-06 Thread Kris Kennaway
If anyone is able to help in verifying the new FreeBSD-current KAME ipv6/ipsec code, especially if you have available other platform ipv6/ipsec implementations to test against, please let me know or drop by the #kame channel on efnet on IRC (server irc.lsl.com, for example) so we can work

Re: -current with new KAME doesn't build with KERBEROS5 defined

2000-07-06 Thread Kris Kennaway
On Wed, 5 Jul 2000, Louis A. Mamakos wrote: I get errors like this while 'make depend' in the Heimdel code. So far, in libroken and libasn1. Fixed. I tried looking at fixing this, but I fear the build system is too tricky for me to want to venture in to fix. Actually, the fix was one

HEADS UP: cvs commit: src/lib/libftpio Makefile (fwd)

2000-07-06 Thread Kris Kennaway
If anyone has done a make world within the past few days you should remove your libftpio.6 since the version bump was made in error. It's now back to libftpio.5. Kris -- In God we Trust -- all others must submit an X.509 certificate. -- Charles Forsythe [EMAIL PROTECTED] --

Re: Problems building kernel with IPSEC_DEBUG

2000-07-06 Thread Kris Kennaway
On Thu, 6 Jul 2000, Jim Bloom wrote: While compiling a kernel with recent code (cvsup 22:30 -0400 July 6), I had some undefined symbols. I traced the symbols to netkey/key_debug.c and found that it did not test IPSEC_DEBUG correctly. I have attached a patch below. Whee! Thanks. I'll

KAME integration and plans

2000-07-05 Thread Kris Kennaway
As itojun has already posted, we are in the process of updating the KAME IPv6/IPSEC code in FreeBSD to the latest KAME sources. In importing the latest KAME code, we are not being too concerned about whitespace or cosmetic diffs, unifdef'ing __NetBSD__ sections (at least in userland) and so

<    6   7   8   9   10   11   12   13   14   15   >