make installworld failed on 4.0-RELEASE

2002-04-23 Thread Dmitry Mottl
Hi! I have a problem upgrading 4.0-RELEASE to 4-STABLE from remotely mounted /usr/src and /usr/obj: ELF binary type not known. Use "brandelf" to brand it Why? === # cd /usr/src; make installworld [skipped] -- >>> Installing everything

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Jochem Kossen
On Tuesday 23 April 2002 05:46, Greg 'groggy' Lehey wrote: > On Monday, 22 April 2002 at 19:53:06 -0700, Jordan Hubbard wrote: > >> That fix relies on the extensive PAM updates in -CURRENT however; > >> in -STABLE it can probably be similarly replicated via appropriate > >> tweaking of sshd (?). >

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Greg 'groggy' Lehey
On Tuesday, 23 April 2002 at 10:09:51 +0200, Jochem Kossen wrote: > On Tuesday 23 April 2002 05:46, Greg 'groggy' Lehey wrote: >> On Monday, 22 April 2002 at 19:53:06 -0700, Jordan Hubbard wrote: That fix relies on the extensive PAM updates in -CURRENT however; in -STABLE it can probably

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Joerg Micheel
On Tue, Apr 23, 2002 at 06:34:52PM +0930, Greg 'groggy' Lehey wrote: > Well, yes. But I've been using X for 11 years. Why should I have to > read the man page to find changes? How do I know which man page to > read? If I did that for everything that happened, I wouldn't get any > work done. A

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Neil Blakey-Milner
On Tue 2002-04-23 (21:13), Joerg Micheel wrote: > On Tue, Apr 23, 2002 at 06:34:52PM +0930, Greg 'groggy' Lehey wrote: > > Well, yes. But I've been using X for 11 years. Why should I have to > > read the man page to find changes? How do I know which man page to > > read? If I did that for ever

Re: "boot -a" in 4.5-STABLE

2002-04-23 Thread Marc Heckmann
Hi, On Tue, Apr 23, 2002 at 06:46:18AM +0200, Thierry Herbelot wrote: > Marc Heckmann wrote: > > > > I've got 4.5-STABLE setup here with vinum as per the Vinum bootstrapping howto > > (http://www.freebsd.org/doc/en_US.ISO8859-1/articles/vinum/index.html). > > > > I have ad0s1a which is "/" and

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Jochem Kossen
On Tuesday 23 April 2002 11:04, you wrote: [...] > >> > >> I've been noticing a continuing trend for more and more "safe" > >> configurations the default. I spent half a day recently trying to > >> find why I could no longer open windows on my X display, only to > >> discover that somebody had tu

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Joerg Micheel
On Tue, Apr 23, 2002 at 11:38:26AM +0200, Neil Blakey-Milner wrote: > There are people who will tell people that still use X11 tcp sockets to > start living in the 21st century. ssh X11 forwarding still works, it's > only the (often much lower security) tcp sockets that are disabled by > default.

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Marco Molteni
On Tue, 23 Apr 2002 11:38:26 +0200, Neil Blakey-Milner <[EMAIL PROTECTED]> wrote: > On Tue 2002-04-23 (21:13), Joerg Micheel wrote: [..] > > The system has to work right away, when installed out of the box. Period. > > No when's and if's. And don't tell me that X11 is an add-on and luxury. > >

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Jochem Kossen
On Tuesday 23 April 2002 11:13, you wrote: > On Tue, Apr 23, 2002 at 06:34:52PM +0930, Greg 'groggy' Lehey wrote: > > Well, yes. But I've been using X for 11 years. Why should I have > > to read the man page to find changes? How do I know which man page > > to read? If I did that for everythin

sendfile() in tftpd?

2002-04-23 Thread Attila Nagy
Hello, Would it be possible to use sendfile in tftpd? With an Athlon XP 1600+ I could only get ~40 Mbps out from the machine with 0% idle CPU time (large file transfers from many machines, getting the same file). Thanks, [ Free Software ISOs - ftp://ftp.fsn.hu/pub/CDROM-Images/ ]---

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Terry Lambert
Greg 'groggy' Lehey wrote: > I've been noticing a continuing trend for more and more "safe" > configurations the default. I spent half a day recently trying to > find why I could no longer open windows on my X display, only to > discover that somebody had turned off tcp connections by default. >

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread David Schultz
Thus spake Greg 'groggy' Lehey <[EMAIL PROTECTED]>: > work done. And you can bet your bottom dollar that somebody coming > from another UNIX variant and trying out FreeBSD won't do so. They'll > just say that it's broken and wander off again. I agree with this point, in general. FreeBSD should

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Terry Lambert
Neil Blakey-Milner wrote: > > The system has to work right away, when installed out of the box. Period. > > No when's and if's. And don't tell me that X11 is an add-on and luxury. > > We are living in the 21st century. > > There are people who will tell people that still use X11 tcp sockets to >

Re: sendfile() in tftpd?

2002-04-23 Thread Terry Lambert
Attila Nagy wrote: > Would it be possible to use sendfile in tftpd? > With an Athlon XP 1600+ I could only get ~40 Mbps out from the machine > with 0% idle CPU time (large file transfers from many machines, getting > the same file). Only if all file transfers were binary, or all ASCII files were

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Daniel C. Sobral
Jochem Kossen wrote: > > *shrug* I was the one who sent in the patch. It was added some time > around 2001/10/26 to the XFree86-4 megaport. When the metaport was > created, the patch was incorporated too. > > A simple 'man startx' should have cleared your mind: > >Except for the '-liste

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Daniel C. Sobral
Terry Lambert wrote: > > Greg 'groggy' Lehey wrote: > > I've been noticing a continuing trend for more and more "safe" > > configurations the default. I spent half a day recently trying to > > find why I could no longer open windows on my X display, only to > > discover that somebody had turne

Re: sendfile() in tftpd?

2002-04-23 Thread Tomas Svensson
AN> Would it be possible to use sendfile in tftpd? AN> With an Athlon XP 1600+ I could only get ~40 Mbps out from the machine AN> with 0% idle CPU time (large file transfers from many machines, getting AN> the same file). No, sendfile() is only for TCP connections, TFTP is using UDP. If you want

Re: sendfile() in tftpd?

2002-04-23 Thread Attila Nagy
Hello, > Only if all file transfers were binary, or all ASCII files were stored > on the host with line termination, instead of . That's the > same reason sendfile() is stupid for POP3, IMAP4, and SMTP servers... Hmm. Both FTP and TFTP supports ASCII and binary transfers, am I right? In libexec/

Re: sendfile() in tftpd?

2002-04-23 Thread Attila Nagy
Hello, > No, sendfile() is only for TCP connections, TFTP is using UDP. If you > want performance, use something else. It's even in the manpage: Sendfile() sends a regular file specified by descriptor fd out a stream socket specified by descriptor s. Silly me. BTW, I can't use anything else. Are

Re: sendfile() in tftpd?

2002-04-23 Thread Danny Braniss
i've had this modified tftpd for some time now, o - it's single threaded - runs as daemon and does not fork new children o - it caches files o - uses mmap o - knows about some of the newer tftp stuff - mainly blocksize. it's been running for some years now, and late

Re: sendfile() in tftpd?

2002-04-23 Thread void
On Tue, Apr 23, 2002 at 12:29:03PM +0200, Attila Nagy wrote: > Hello, > > Would it be possible to use sendfile in tftpd? > With an Athlon XP 1600+ I could only get ~40 Mbps out from the machine > with 0% idle CPU time (large file transfers from many machines, getting > the same file). Performanc

Re: implementing linux mmap2 syscall

2002-04-23 Thread Andrew Gallatin
Kenneth Culver writes: > OK, I found another problem, here it is: > > static void > linux_prepsyscall(struct trapframe *tf, int *args, u_int *code, caddr_t > *params) > { > args[0] = tf->tf_ebx; > args[1] = tf->tf_ecx; > args[2] = tf->tf_edx; > args[3] = tf->tf_esi

Re: implementing linux mmap2 syscall

2002-04-23 Thread Kenneth Culver
> > Basically, linux_mmap2 takes 6 args, and this looks here like only 5 args are > > making it in... I checked this because the sixth argument to linux_mmap2() in > > truss was showing 0x6, but when I printed out that arg from the kernel, it > > was showing 0x0. Am I correct here? > > > > K

Re: sendfile() in tftpd?

2002-04-23 Thread Attila Nagy
Hello, > i've had this modified tftpd for some time now, > o - it's single threaded - runs as daemon and does not fork new children Basically, I don't have any problems with the inetd startup. It can be rate limited, etc. > o - it caches files How? Doesn't leaving this job to the OS

Re: Security through obscurity? (and /etc/defaults/rc.conf changes)

2002-04-23 Thread Frank Mayhar
Jochem Kossen wrote: > Because things evolve? :) You say "evolve." I say "get broken." > > How do I know which man page to read? > You start X with startx, seems obvious to me. The disabling of tcp > connections only applies to startx It's not obvious when one has been starting X with the sam

Re: Security through obscurity? (was: ssh + compiled-in SKEY supportconsidered harmful?)

2002-04-23 Thread Frank Mayhar
Jochem Kossen wrote: > It does work. But i think you mean the tcp connections. > Does that mean you vote for enabling _all_ services? They don't work out > of the box as well... This is ridiculous. You know as well as I do that that's _not_ what Greg means. Just don't change stuff out from und

Re: implementing linux mmap2 syscall

2002-04-23 Thread Andrew Gallatin
Kenneth Culver writes: > > > Basically, linux_mmap2 takes 6 args, and this looks here like only 5 args are > > > making it in... I checked this because the sixth argument to linux_mmap2() in > > > truss was showing 0x6, but when I printed out that arg from the kernel, it > > > was showing

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Robert Watson
On Tue, 23 Apr 2002, Greg 'groggy' Lehey wrote: > On Monday, 22 April 2002 at 19:53:06 -0700, Jordan Hubbard wrote: > >> That fix relies on the extensive PAM updates in -CURRENT however; in > >> -STABLE it can probably be similarly replicated via appropriate tweaking > >> of sshd (?). > > > > Wh

Re: Security through obscurity? (was: ssh + compiled-in SKEY supportconsidered harmful?)

2002-04-23 Thread Frank Mayhar
Robert, it's really, really simple. For new installs, install the new, more secure behavior. Be sure to loudly document this behavior so that those of us who expect the _old_ behavior don't get bitten by the change. And don't change the old behavior in upgrades of existing systems. As I said i

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread utsl
On Tue, Apr 23, 2002 at 01:16:46PM +0930, Greg 'groggy' Lehey wrote: > On Monday, 22 April 2002 at 19:53:06 -0700, Jordan Hubbard wrote: > >> That fix relies on the extensive PAM updates in -CURRENT however; in > >> -STABLE it can probably be similarly replicated via appropriate tweaking > >> of s

Re: Security through obscurity?

2002-04-23 Thread M. Warner Losh
: When you change defaults on a running system, you piss off a lot of users. : Including me. :-) When we fail to take reasonable steps to preclude intruders from gaining access to your system, we'd likely piss you off more if you knew about it :-(. I'll also point out that years ago core created

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Robert Watson
On Tue, 23 Apr 2002, Frank Mayhar wrote: > Robert, it's really, really simple. For new installs, install the new, > more secure behavior. Be sure to loudly document this behavior so that > those of us who expect the _old_ behavior don't get bitten by the > change. And don't change the old beh

Re: sendfile() in tftpd?

2002-04-23 Thread Nate Williams
> Would it be possible to use sendfile in tftpd? Nope, since as someone else has pointed out, tftp uses UDP and not TCP. The problem with TFTP is the protocol, not the implementation. It's got a window size of 'one', so the speed is limited by the latency between the two hosts. You could have a

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Robert Watson
On Tue, 23 Apr 2002, Greg 'groggy' Lehey wrote: > On Monday, 22 April 2002 at 19:53:06 -0700, Jordan Hubbard wrote: > >> That fix relies on the extensive PAM updates in -CURRENT however; in > >> -STABLE it can probably be similarly replicated via appropriate tweaking > >> of sshd (?). > > > > Wh

Changing defaults versus increased security.

2002-04-23 Thread Frank Mayhar
M. Warner Losh wrote: > : When you change defaults on a running system, you piss off a lot of users. > : Including me. :-) > When we fail to take reasonable steps to preclude intruders from > gaining access to your system, we'd likely piss you off more if you > knew about it :-(. Hey, I intention

Re: Changing defaults versus increased security.

2002-04-23 Thread M. Warner Losh
In message: <[EMAIL PROTECTED]> Frank Mayhar <[EMAIL PROTECTED]> writes: : It seems easy enough to create an /etc/rc.overrides script with a large : "Danger Will Robinson" message to annoy a sysadmin into looking at it : and containing the old defaults. There may be a good way to deal

Re: sendfile() in tftpd?

2002-04-23 Thread Richard Sharpe
On Tue, 23 Apr 2002, Attila Nagy wrote: > Hello, > > > No, sendfile() is only for TCP connections, TFTP is using UDP. If you > > want performance, use something else. > It's even in the manpage: > Sendfile() sends a regular file specified by descriptor fd out a stream > socket specified by descr

Re: Security through obscurity? (and /etc/defaults/rc.conf changes)

2002-04-23 Thread Jochem Kossen
On Tuesday 23 April 2002 16:54, Frank Mayhar wrote: > Jochem Kossen wrote: > > Because things evolve? :) > > You say "evolve." I say "get broken." Don't tell me that in 11 years, defaults never change > > > How do I know which man page to read? > > > > You start X with startx, seems obvious to

Re: sendfile() in tftpd?

2002-04-23 Thread Ronald G Minnich
On Wed, 24 Apr 2002, Richard Sharpe wrote: > Multicast! BootIX (nee InCom) have support for this in their BootROMS. it > might not be hard to hack into Etherboot et al. bproc now uses multicast for distributing new kernels and init ram disks, if you want to see an example. It's on sourceforge.

OT: Better fake challenges [Re: ssh + compiled-in SKEY support considered harmful?]

2002-04-23 Thread Bjoern Fischer
Hello, > jhubbard@wafer-> ssh [EMAIL PROTECTED] > otp-md5 114 wi7854 ext > S/Key Password: > otp-md5 117 wi5044 ext > S/Key Password: > otp-md5 397 wi0652 ext > S/Key Password: > [EMAIL PROTECTED]'s password: If anyone is concerned about revealing too much information on valid/invalid OTP lo

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Jochem Kossen
On Tuesday 23 April 2002 16:57, Frank Mayhar wrote: > Jochem Kossen wrote: > > It does work. But i think you mean the tcp connections. > > Does that mean you vote for enabling _all_ services? They don't > > work out of the box as well... > > This is ridiculous. You know as well as I do that that'

Re: sendfile() in tftpd?

2002-04-23 Thread Terry Lambert
Attila Nagy wrote: > > Only if all file transfers were binary, or all ASCII files were stored > > on the host with line termination, instead of . That's the > > same reason sendfile() is stupid for POP3, IMAP4, and SMTP servers... > > Hmm. Both FTP and TFTP supports ASCII and binary transfers, a

Re: sendfile() in tftpd?

2002-04-23 Thread Terry Lambert
Attila Nagy wrote: > > No, sendfile() is only for TCP connections, TFTP is using UDP. If you > > want performance, use something else. > It's even in the manpage: > Sendfile() sends a regular file specified by descriptor fd out a stream > socket specified by descriptor s. > > Silly me. BTW, I can

Re: sendfile() in tftpd?

2002-04-23 Thread Terry Lambert
Attila Nagy wrote: > With Danny's tftpd I could get 16-17 Mbps with one machine (this is what > the client says) and around 4 Mbps per client at a concurrency of 24 > machines. > That's about 90-96 Mbps. > > I will try do more benchmarks with an accurate method, once I could figure > out what sho

Re: sendfile() in tftpd?

2002-04-23 Thread Nate Williams
> > > No, sendfile() is only for TCP connections, TFTP is using UDP. If you > > > want performance, use something else. > > It's even in the manpage: > > Sendfile() sends a regular file specified by descriptor fd out a stream > > socket specified by descriptor s. > > > > Silly me. BTW, I can't us

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Terry Lambert
Robert Watson wrote: > A more conservative default configuration results in a material > improvement in system security. I really don't think there's any way to fully protect a security-unconscious user, as if they had spent the time to learn what was necessary, and chosen the right settings for

Re: sendfile() in tftpd?

2002-04-23 Thread utsl
On Tue, Apr 23, 2002 at 11:46:34AM -0600, Nate Williams wrote: > > > > No, sendfile() is only for TCP connections, TFTP is using UDP. If you > > > > want performance, use something else. > > > It's even in the manpage: > > > Sendfile() sends a regular file specified by descriptor fd out a stream >

Re: Security through obscurity? (and /etc/defaults/rc.conf changes)

2002-04-23 Thread Terry Lambert
Jochem Kossen wrote: > On Tuesday 23 April 2002 16:54, Frank Mayhar wrote: > > Jochem Kossen wrote: > > > Because things evolve? :) > > > > You say "evolve." I say "get broken." > > Don't tell me that in 11 years, defaults never change When the routing code was changed, back in the mid 1990's,

Re: sendfile() in tftpd?

2002-04-23 Thread Nate Williams
[ TFTP performance is poor ] > > > USE TFTP to get a tiny image up, and then go TCP. > > > > > > Going to TCP soon assumes that you have a lossless medium in order to > > transmit packets over. If you're using a lossy medium, TFTP (and other > > UDP based protocols) can kick their butt because

Re: sendfile() in tftpd?

2002-04-23 Thread Terry Lambert
Nate Williams wrote: > Going to TCP soon assumes that you have a lossless medium in order to > transmit packets over. If you're using a lossy medium, TFTP (and other > UDP based protocols) can kick their butt because of TCP's assumption > that packet loss is a function of congestion, which is oft

Erm, since everyone managed to HIJACK my sshd thread! ;)

2002-04-23 Thread Jordan Hubbard
I'm going to commit the following in 48 hours unless someone can convince me that it's a good idea for FreeBSD to be the odd-OS out with respect to this behavior: Index: sshd_config === RCS file: /home/ncvs/src/crypto/openssh/sshd_co

Re: sendfile() in tftpd?

2002-04-23 Thread Nate Williams
> > Going to TCP soon assumes that you have a lossless medium in order to > > transmit packets over. If you're using a lossy medium, TFTP (and other > > UDP based protocols) can kick their butt because of TCP's assumption > > that packet loss is a function of congestion, which is often not the >

Re: Erm, since everyone managed to HIJACK my sshd thread! ;)

2002-04-23 Thread Alfred Perlstein
* Jordan Hubbard <[EMAIL PROTECTED]> [020423 11:39] wrote: > I'm going to commit the following in 48 hours unless someone can > convince me that it's a good idea for FreeBSD to be the odd-OS out > with respect to this behavior: Please do it. > > Index: sshd_config > ===

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Robert Watson
On Tue, 23 Apr 2002, Terry Lambert wrote: > Robert Watson wrote: > > A more conservative default configuration results in a material > > improvement in system security. > > I really don't think there's any way to fully protect a > security-unconscious user, as if they had spent the time to learn

Re: Erm, since everyone managed to HIJACK my sshd thread! ;)

2002-04-23 Thread Kenneth Culver
PLEASE commit this :-) It's so annoying. Ken On Tue, 23 Apr 2002, Jordan Hubbard wrote: > I'm going to commit the following in 48 hours unless someone can > convince me that it's a good idea for FreeBSD to be the odd-OS out > with respect to this behavior: > > Index: sshd_config > =

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Terry Lambert
Robert Watson wrote: > "System programming is hard, let's go shopping". This is exactly the phrase that comes to mind every time someone yanks the plug on a service they are afraid might one day have an exploit found for it. > Someone who's unaware or unwilling to address security issues will *

Re: Erm, since everyone managed to HIJACK my sshd thread! ;)

2002-04-23 Thread Mike Meyer
In <[EMAIL PROTECTED]>, Jordan Hubbard <[EMAIL PROTECTED]> typed: > I'm going to commit the following in 48 hours unless someone can > convince me that it's a good idea for FreeBSD to be the odd-OS out > with respect to this behavior: If someone objects, let me know and I'll pay them a visit wit

Re: Erm, since everyone managed to HIJACK my sshd thread! ;)

2002-04-23 Thread Terry Lambert
Jordan Hubbard wrote: > I'm going to commit the following in 48 hours unless someone can > convince me that it's a good idea for FreeBSD to be the odd-OS out > with respect to this behavior: [ ... ] > -# Uncomment to disable s/key passwords > -#ChallengeResponseAuthentication no > +# Comment out

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Mike Meyer
In <[EMAIL PROTECTED]>, Jochem Kossen <[EMAIL PROTECTED]> typed: > On Tuesday 23 April 2002 11:04, you wrote: > OK, then i suggest we mention it in the handbook, the security policy > document, the manpage AND the release notes :) None of those are things that are on the "Must read" list for peo

Re: sendfile() in tftpd?

2002-04-23 Thread Terry Lambert
Nate Williams wrote: > > Maybe 802.11b. 8-(. > > Exactly! Or, something that boots remotely over satellite (for easier > maintenance). Or cable modems, booting from the cable plant. Actually, there's a lot of uses, the more you think about it, even though I think you'd have to be pretty insan

More about security, X, rc.conf and changing defaults.

2002-04-23 Thread Frank Mayhar
Terry Lambert wrote: > FWIW: I wouldn't object to a firewall rule that disallowed remote > TCP connections to the X server by default, if the firewall is > enabled. I think we already have this... Yep, I agree, and whether or not it's in the distributed rc.firewall, I have the ports blocked in m

Re: sendfile() in tftpd?

2002-04-23 Thread utsl
On Tue, Apr 23, 2002 at 12:34:24PM -0600, Nate Williams wrote: > [ TFTP performance is poor ] > > > > > USE TFTP to get a tiny image up, and then go TCP. > > > > > > > > > Going to TCP soon assumes that you have a lossless medium in order to > > > transmit packets over. If you're using a lossy

Re: implementing linux mmap2 syscall

2002-04-23 Thread Kenneth Culver
> > > > Basically, linux_mmap2 takes 6 args, and this looks here like only 5 args are > > > > making it in... I checked this because the sixth argument to linux_mmap2() in > > > > truss was showing 0x6, but when I printed out that arg from the kernel, it > > > > was showing 0x0. Am I corre

Problems with nge driver and copper GbE cards

2002-04-23 Thread Fengrui Gu
I am evaluating copper GbE cards for our lab. According to previous talk threads, it seems that SMC9462TX has better performance than NetGear cards. I bought two SMC9462TX cards and connect them through a Cat 5e cross-link cable. The machines in use are two dual PIII 733Mhz with 756MB memory. I us

Re: Erm, since everyone managed to HIJACK my sshd thread! ;)

2002-04-23 Thread Jordan Hubbard
FWIW, I agree with you, but I'm more interested in fixing this right now than I am in chasing the OpenSSH maintainers around with patches (unless we've already forked - have we?). I'll also be happy to change this twice if it turns out that getting the change into OpenSSH is easier than I thought

Re: sendfile() in tftpd?

2002-04-23 Thread Nate Williams
> > [ TFTP performance is poor ] > > > > > > > USE TFTP to get a tiny image up, and then go TCP. > > > > > > > > > > > > Going to TCP soon assumes that you have a lossless medium in order to > > > > transmit packets over. If you're using a lossy medium, TFTP (and other > > > > UDP based protoco

Re: Erm, since everyone managed to HIJACK my sshd thread! ;)

2002-04-23 Thread Jordan Hubbard
Have we forked OpenSSH? Can I just make the change to our local tree? I really don't want to have to deal with the OpenSSH folks over at openbsd.org. They bite. :) - Jordan > > --6c2NcOVqGQ03X4Wi > Content-Type: text/plain; charset=us-ascii > Content-Disposition: inline > > On Tue, Apr 23, 2

Re: More about security, X, rc.conf and changing defaults.

2002-04-23 Thread Daniel Eischen
On Tue, 23 Apr 2002, Frank Mayhar wrote: > Terry Lambert wrote: > > FWIW: I wouldn't object to a firewall rule that disallowed remote > > TCP connections to the X server by default, if the firewall is > > enabled. I think we already have this... > > Yep, I agree, and whether or not it's in the d

Re: sendfile() in tftpd?

2002-04-23 Thread utsl
On Tue, Apr 23, 2002 at 02:07:32PM -0600, Nate Williams wrote: > > Probably true, but the better solution is to find something else (or > > make something else) that doesn't completely suck like TFTP does. > > Because it's used so rarely, having it suck every once in a while isn't > so bad. TFTP

Re: sendfile() in tftpd?

2002-04-23 Thread Nate Williams
[ moved to -chat, since this has no business being in -hackers anymore ] > > > Probably true, but the better solution is to find something else (or > > > make something else) that doesn't completely suck like TFTP does. > > > > Because it's used so rarely, having it suck every once in a while is

Re: Security through obscurity?

2002-04-23 Thread Giorgos Keramidas
On 2002-04-23 09:49, M. Warner Losh wrote: > The decision to go for a more secure system by default was made years > ago. I for one think the Security Officers have done a good job at > doing this, but even as far as they have come, I suspect that > additional things will be locked down over time

Re: Security through obscurity? (was: ssh + compiled-in SKEYsupport considered harmful?)

2002-04-23 Thread Garance A Drosihn
At 2:37 PM -0400 4/23/02, Robert Watson wrote: >Here I'll disagree with you: we make a concerted effort to >produce a system that is safe to use. This involves a number >of things, and it doesn't just mean security fixes. I would >argue that we have a moral obligation to do so. I agree that the

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Robert Watson
On Tue, 23 Apr 2002, Terry Lambert wrote: > Robert Watson wrote: > > "System programming is hard, let's go shopping". > > This is exactly the phrase that comes to mind every time someone yanks > the plug on a service they are afraid might one day have an exploit > found for it. This isn't abo

Re: Problems with nge driver and copper GbE cards

2002-04-23 Thread Mike Makonnen
On Tue, 2002-04-23 at 13:32, Fengrui Gu wrote: > > Third, I had trouble to set half-duplex mode on nge0. > If I issued command "ifconfig nge0 media 1000baseTX mediaopt half-duplex", I > got the > following error message > "ifconfig: SIOCSIFMEDIA: Device not configured" > I don't have trouble to i

RE: Problems with nge driver and copper GbE cards

2002-04-23 Thread Fengrui Gu
It works. Thanks a lot. So setting half-duplex is to disabe full-duplex.:) I didn't do this before so I was confused in the first place. But the following statement in the man page of nge driver probably may need some changes. === The ng

RE: Problems with nge driver and copper GbE cards

2002-04-23 Thread Fengrui Gu
There is something interesting. I accidentally started a ping command(ping data sender side) from data receiver side. As you know, ping will continue running until you stop it. I started netperf again from data sender side. You know what? The link seems more stable with additional ping session on

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Greg 'groggy' Lehey
On Tuesday, 23 April 2002 at 12:06:01 +0200, Jochem Kossen wrote: > On Tuesday 23 April 2002 11:04, you wrote: > [...] I've been noticing a continuing trend for more and more "safe" configurations the default. I spent half a day recently trying to find why I could no longer op

Re: Erm, since everyone managed to HIJACK my sshd thread! ;)

2002-04-23 Thread Joshua Goodall
We have an openssh maintainer? Right now, policy differs between branches. releng_4's openssh gives a commented alternative in the config, whilst head's gives a commented default. A consistent change to -stable would be: Index: servconf.c ===

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Greg 'groggy' Lehey
On Tuesday, 23 April 2002 at 11:13:42 -0400, Robert Watson wrote: > > On Tue, 23 Apr 2002, Greg 'groggy' Lehey wrote: > >> On Monday, 22 April 2002 at 19:53:06 -0700, Jordan Hubbard wrote: That fix relies on the extensive PAM updates in -CURRENT however; in -STABLE it can probably be sim

Re: More about security, X, rc.conf and changing defaults.

2002-04-23 Thread Greg 'groggy' Lehey
On Tuesday, 23 April 2002 at 16:35:55 -0400, Daniel Eischen wrote: > On Tue, 23 Apr 2002, Frank Mayhar wrote: >> Terry Lambert wrote: >>> FWIW: I wouldn't object to a firewall rule that disallowed remote >>> TCP connections to the X server by default, if the firewall is >>> enabled. I think we al

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Terry Lambert
Robert Watson wrote: > > "Securing telnet is hard; let's turn it off and go shopping". 8-). > > Or maybe, > > Few people use telnet any more, so we'll spend some time fixing it, but > we'll also disable it by default, since many of the reports of > compromise come from people who weren't

Re: Security through obscurity? (was: ssh + compiled-in SKEYsupport considered harmful?)

2002-04-23 Thread Garance A Drosihn
At 8:44 AM +0930 4/24/02, Greg 'groggy' Lehey wrote: >On Tuesday, 23 April 2002 at 12:06:01 +0200, Jochem Kossen wrote: > >>> *shrug* I was the one who sent in the patch. It was added > >>> some time around 2001/10/26 to the XFree86-4 megaport. When > >>> the metaport was created, the patch was

Re: Security through obscurity? (and /etc/defaults/rc.conf changes)

2002-04-23 Thread Matthew N. Dodd
On Tue, 23 Apr 2002, Terry Lambert wrote: > It really pissed me off when the AHA-1742 support dropped out when CAM > came in, but that, at least, was understandable, since it was a trade: > something deisrable for something less desirable to the majority of > users. AHA-1742 works again now. May

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Robert Watson
On Tue, 23 Apr 2002, Terry Lambert wrote: > > The reality is that reducing exposure is an important part of any security > > posture. > > This is an argument for security through obscurity. > > If we are talking risk reduction, then we can easily achieve it > statistically through obscurity.

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Robert Watson
On Wed, 24 Apr 2002, Greg 'groggy' Lehey wrote: > > A more conservative default configuration results in a material > > improvement in system security. > > *snip* By snipping here, you removed reference to the fact that this was a general discussion of direction and policy, rather than specifi

Re: Problems with nge driver and copper GbE cards

2002-04-23 Thread Terry Lambert
Fengrui Gu wrote: > There is something interesting. I accidentally started a > ping command(ping data sender side) from data receiver side. > As you know, ping will continue running until you stop it. > > I started netperf again from data sender side. You know what? > The link seems more stable w

need help: ld final link failed. Memory exhausted

2002-04-23 Thread Martin Blapp
Hi, Now that I finally got the openoffice build running with the stock gcc, the next problem appears. # limits Resource limits (current): cputime infinity secs filesize infinity kb datasize 524288 kb stacksize 65536 kb coredumpsize infinity kb

Re: need help: ld final link failed. Memory exhausted

2002-04-23 Thread Martin Blapp
Hi, Setting the max stacksize to 128MB helped. Can we have this as default ? As many users plan to use staroffice, requiring them to recompile kernel just for this would be ... Anyway, is there a reason that the maxstack is 64MB only ? Martin Martin Blapp, <[EMAIL PROTECTED]> <[EMAIL PROTECT

Re: need help: ld final link failed. Memory exhausted

2002-04-23 Thread Alfred Perlstein
* Martin Blapp <[EMAIL PROTECTED]> [020423 19:55] wrote: > > Hi, > > Setting the max stacksize to 128MB helped. Can we have this as > default ? > > As many users plan to use staroffice, requiring them to recompile > kernel just for this would be ... > > Anyway, is there a reason that the maxst

Re: need help: ld final link failed. Memory exhausted

2002-04-23 Thread Martin Blapp
> Because 64MB of stack should be enough for anybody? times have changed ... it seems. The OpenOffice build linking needs definitly more that 64MB. Martin To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Greg 'groggy' Lehey
On Tuesday, 23 April 2002 at 21:38:38 -0400, Robert Watson wrote: > > On Wed, 24 Apr 2002, Greg 'groggy' Lehey wrote: > >>> A more conservative default configuration results in a material >>> improvement in system security. >> >> *snip* > > By snipping here, you removed reference to the fact that

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Robert Watson
On Wed, 24 Apr 2002, Greg 'groggy' Lehey wrote: > > I'm more interested in the general issue here, since you made the > > general assertion that there was a problem that stretched beyond > > this one issue. > > Well, we saw the ssh problem as well; that's more than one. We also see > things li

Re: Security through obscurity? (was: ssh + compiled-in SKEY support considered harmful?)

2002-04-23 Thread Robert Watson
On Wed, 24 Apr 2002, Greg 'groggy' Lehey wrote: > I think the issue is POLA. Sure, we can put in individual knobs to > twiddle, but who will do that? I thought that securelevel would have > been a suitable solution to say "I want approximately *this* much > security". If that's not the case,

SB Audigy Driver?

2002-04-23 Thread Gary Stanley
Anyone know if the current set of FreeBSD pcm drivers support Sound Blaster Audigy? To Unsubscribe: send mail to [EMAIL PROTECTED] with "unsubscribe freebsd-hackers" in the body of the message

Re: fix wrong PNP ID comment

2002-04-23 Thread Doug Barton
Please submit such things as problem reports. Take a look at 'man send-pr' if you need help. -- "We have known freedom's price. We have shown freedom's power. And in this great conflict, ... we will see freedom's victory." - George W. Bush, President of the United State

Re: implementing linux mmap2 syscall

2002-04-23 Thread Kenneth Culver
> Kenneth Culver writes: > > OK, I found another problem, here it is: > > > > static void > > linux_prepsyscall(struct trapframe *tf, int *args, u_int *code, caddr_t > > *params) > > { > >args[0] = tf->tf_ebx; > >args[1] = tf->tf_ecx; > >args[2] = tf->tf_edx; > >args[3] =

Re: make installworld failed on 4.0-RELEASE

2002-04-23 Thread Doug Barton
On Mon, 22 Apr 2002, Dmitry Mottl wrote: > Hi, I have a problem when installing 4-STABLE on 4.0-RELEASE from remotely > mounted /usr/src and /usr/obj: > ELF binary type not known. Use "brandelf" to brand it You're trying to cross an upgrade boundary that just won't fly. Back up your dat

Re: Security through obscurity? (and /etc/defaults/rc.conf changes)

2002-04-23 Thread David Schultz
Thus spake Terry Lambert <[EMAIL PROTECTED]>: > The entire idea of "bit rot" is really "the code did not keep > ``up to date'' with my changes, which broke the code", which > is really a ridiculous position. > > It really pissed me off when the AHA-1742 support dropped out > when CAM came in, but

mutex owned stuff fallible?

2002-04-23 Thread Matthew Jacob
This is a recent i386 SMP kernel: panic: mutex isp not owned at ../../../kern/kern_synch.c:449 cpuid = 0; lapic.id = Debugger("panic") Stopped at Debugger+0x41: xorl%eax,%eax db> db> t Debugger(c031189a) at Debugger+0x41 panic(c0310ae8,c030470d,c0312018,1c1,d2d08438) at panic

  1   2   >