Re: OpenBSD & OpenBGPD router replacement

2018-12-19 Thread Tony Sarendal
You will likely run out of CPU before bandwidth. Even on nice hardware I have yet to exceed 1Mpps with OpenBSD. /T Den ons 19 dec. 2018 kl 03:12 skrev Max Clark : > Tom, > > The presentation was very interesting and it's given me a lot of food for > thought for another project. Fortunately for

Re: Cheaper alternatives for APC UPS

2018-12-19 Thread Radek
Thank you for all your comprehensive technical references. I just wanted to know if there is any way to save some money buying other brands than APC. After reading your posts I will definitely stay with APC. Salicru, OpenUPS - I have never heard about these brands/solutions. Thanks. > I am not

yubikey: touch not working

2018-12-19 Thread kolargol
Hi, I attached Yubikey to OpenBSD-stable and while gpg2 works great, I am unable to use touch for OTP. Yubikey is version 5, pcsc installed and working. Yubikey is hooked up to APU2, no other keyboard is attached - only USB serial cable. I have verified that on other host (non-openbsd) touch work

sshd_config: PubkeyAcceptedKeyTypes does not seem to have any effect

2018-12-19 Thread Aham Brahmasmi
Hello misc, Setting PubkeyAcceptedKeyTypes in the sshd_config does not seem to have any effect on the selection of server signature algorithms (server-sig-algs). Further, the certificate variants of the algorithms are not selected at all. Steps: ON SERVER $ cat /etc/ssh/sshd_config ... PubkeyAcce

man switchd.conf - Port 6633 or 6653

2018-12-19 Thread Aham Brahmasmi
Hello misc, >From the man page of switchd.conf [1]: ... By default, switchd(8) uses port 6653 and listen address 0.0.0.0. ... The following example is a typical one. listen on 0.0.0.0 port 6633 ... Would the example benefit from 6653 as the port number, instead of 6633? Dhanyavaad. Regards, ab

Re: Automated remote install

2018-12-19 Thread andrew fabbro
On Tue, Dec 18, 2018 at 1:03 AM Frank Beuth wrote: > On Mon, Dec 17, 2018 at 02:35:41PM -0200, Daniel Bolgheroni wrote: > >If you're going to run on some public cloud, they usually offer the > >possibility of keeping a custom image you provide, and use this image to > >deploy new VMs based on it.

Re: radeondrm failure on amd64 but not on i386?

2018-12-19 Thread Andy Bradford
Thus said Daniel Dickman on Fri, 14 Dec 2018 20:45:11 -0500: > Try previous releases of OpenBSD/amd64 to check if radeondrm ever > worked for you on amd64. That was a fruitful suggestion. I tried 6.3 amd64 and it works. So somewhere after 6.3 a change was introduced that made this p

calmwm mouse stuck inside of window

2018-12-19 Thread Charles A Daniels
A slight issue I've noticed with calmwm (under OpenBSD 6.4) is that the mouse can occasionally get "stuck" inside of a window, and can't be moved out of it. This most often seems to occur with modal dialogs (in particular, most of the configuration dialogs for graphics/ipe exhibit this behavior, bu

blocking openvpn port scanners

2018-12-19 Thread Steve Fairhead
I'm probably missing something obvious. Cluebats invited. A few OpenBSD servers I look after have OpenVPN server installed (for homeworkers' access), which means port 1194 is open. Recently they seem to have appeared on some scumbag's "hack this" list, as they're constantly deluged with brute-

Re: blocking openvpn port scanners

2018-12-19 Thread Torsten
Hi Steve Try to add below to your pf.conf table persist pass in on $ext_if inet proto tcp from any to $ext_if port 1194 \ (max-src-conn 10, max-src-conn-rate 30/5, \ overload flush global) T -Original Message- From: owner-m...@openbsd.org [mailto:owner-m...@openbs

Re: blocking openvpn port scanners

2018-12-19 Thread Peter N. M. Hansteen
On 12/19/18 10:26 PM, Steve Fairhead wrote: > I already use pf.conf to protect my ssh port against such attacks > (rate-limiting). Can I do anything similar with pf for the openvpn port? > Don't want to block real users if they screw up once or twice... > although they are few enough that I can be

Pf traffic redirection on internal lan

2018-12-19 Thread Flipchan
Hello all, I am trying to get packets(/curl -v) to go 192.168.2.4 > 192.168.2.5:80 > 192.168.2.21:8801 .5 middle host | cat /etc/pf.conf set skip on lo block return# block stateless traffic pass# establish keep-state pass in quick on any proto tcp from any to any port 80

Re: Pf traffic redirection on internal lan

2018-12-19 Thread Tom Smyth
Hi, A quick read of your rule below pass in quick on any proto tcp from any to any port 80 rdr-to 192.168.2.21 port 8801 seems way too general try this instead pass in quick on any proto tcp from any to 192.168.2.5 port 80 rdr-to 192.168.2.21 port 8801 and see how you get on ... On Thu, 20 D

Re: Pf traffic redirection on internal lan

2018-12-19 Thread Flipchan
I solved it with relayd :) On December 20, 2018 3:00:45 AM GMT+02:00, Tom Smyth wrote: >Hi, >A quick read of your rule below >pass in quick on any proto tcp from any to any port 80 rdr-to >192.168.2.21 port 8801 > >seems way too general > >try this instead >pass in quick on any proto tcp from a