Re: Brand new server - bad adventures

2020-01-23 Thread Özgür Kazancci
Hi Aaron, Considering heavy traffic load&requests through web/sql server on the system, wouldn't that decrease performance? HT might not be too safe - OpenBSD is. :) I do know and am aware of that OpenBSD team suggest turning it of, but.. Other than that, have you read anything else *specifica

Re: off-topic

2020-01-23 Thread myml...@gmx.com
On 12/30/19 6:09 AM, Gustavo Rios wrote: Is qmail dead ? Does anyone here use openbsd with qmail+ldap ? Hey Gustavo, qmail may not be dead, i suspect it is as most of the download links at the official site aren't reachable, not a good sign. I understand that people get attached to software,

for those looking for hardware to build an OBSD router/firewall

2020-01-23 Thread myml...@gmx.com
Hi All, I've been looking for hardware to replace my 15 year old i386 pc based openbsd firewall with 6 interfaces with something smaller and with less power draw for a while, a long while..:). I researched and saw things from lanner, axiomtek and portwell, but they were mad expensive. I have se

Re: Suricata from packages

2020-01-23 Thread myml...@gmx.com
On 1/21/20 1:05 PM, b2...@zonbie.net wrote: On 2020-01-18 07:08, Eric Zylstra wrote: On Jan 18, 2020, at 6:42 AM, Antoine Jacoutot wrote: On Fri, Jan 17, 2020 at 11:24:22PM -0600, Eric Zylstra wrote: OpenBSD 6.6 Generic.MP amd64 Stable. I installed suricata using pkg_add.  Having trouble wit

Re: pfctl -T expire

2020-01-23 Thread myml...@gmx.com
On 1/23/20 7:17 PM, myml...@gmx.com wrote: Hi All, Thanks to Jesper and Stuart, i'm using max-pkt-rate not! I'm also using max-src-conn-rate and overload in conjunction with authpf and I'm worried that potentially valid traffic may get blocked. I'm wondering if it's a condoned/accepted/best pr

pfctl -T expire

2020-01-23 Thread myml...@gmx.com
Hi All, Thanks to Jesper and Stuart, i'm using max-pkt-rate not! I'm also using max-src-conn-rate and overload in conjunction with authpf and I'm worried that potentially valid traffic may get blocked. I'm wondering if it's a condoned/accepted/best practice to use cron with pfctl to expire tabl

Re: Brand new server - bad adventures

2020-01-23 Thread Aaron Mason
After reviewing your dmesg and googling the model of your CPU, might I suggest/recommend turning off hyperthreading if you can. Bad security juju. On Thu, Jan 23, 2020 at 6:29 PM Andreas Kusalananda Kähäri wrote: > > On Wed, Jan 22, 2020 at 11:30:51PM +0300, Özgür Kazancci wrote: > > Hello every

Re: rate limit echo request

2020-01-23 Thread myml...@gmx.com
On 1/23/20 1:35 AM, Jesper Wallin wrote: Hi, Use the max-pkt-rate parameter instead. It does exactly what you think it does and is thoroughly covered in pf.conf(5) with examples and all. Regards Jesper Wallin On Wed, Jan 22, 2020 at 10:42:01PM -0700, myml...@gmx.com wrote: Hi, I'm just wo

Re: Android (MTP) with OpenBSD: Tiny success story

2020-01-23 Thread Roderick
BTW. If the purpose is transfering files, you can install in Android: https://play.google.com/store/apps/details?id=org.galexander.sshd and perhaps https://play.google.com/store/apps/details?id=jackpal.androidterm Then using the WiFi hotspot of Android, you can do sftp, rsync, ssh and scp t

Re: OpenBSD PPPOE

2020-01-23 Thread Sacha
Hey, * /etc/hostname.vlan500 # hostname.vlan500 vnetid 835 parent parent fxp0 up * /etc/hostname.pppoe0 #hostname.pppoe0 inet 0.0.0.0 255.255.255.255 NONE \ pppoedev vlan500 authproto pap \ authname "" authkey "" up dest 0.0.0.1 !/sbin/route add default -ifp pppoe0 0.0.0.1 For debuging: i

Re: DNS lookups on a different port for testing?

2020-01-23 Thread Claus Assmann
On Thu, Jan 23, 2020, Stuart Henderson wrote: > On 2020-01-22, Claus Assmann wrote: > > The functional tests for sendmail use ldns-testns as DNS server > > which provides specific test data and error behaviours. > > It runs on a port > 1024 to avoid requiring root access. > For the libbind port,

Re: rate limit echo request

2020-01-23 Thread Stuart Henderson
On 2020-01-23, myml...@gmx.com wrote: > Hi, > > I'm just wondering if there is a way to rate limit icmp echo request. > i.e. pings. > > I tried the following rule but it errors out with "syntax error" > > pass in quick on em1 inet proto icmp from 192.168.0.23  to 192.168.1.2 > icmp-type  echoreq (

Re: DNS lookups on a different port for testing?

2020-01-23 Thread Stuart Henderson
On 2020-01-22, Claus Assmann wrote: > The functional tests for sendmail use ldns-testns as DNS server > which provides specific test data and error behaviours. > It runs on a port > 1024 to avoid requiring root access. > There's code in sendmail to set the IP and port for a NS: > _res.nsadd

Re: Assigning multiple IPv6 addresses to loopback

2020-01-23 Thread Tom Smyth
Hi Aham, what I do is I add multiple loopback interfaces (it is useful in an ISP context so that when I add a loopback interface to ospf (to advertise the address as an intra area route ) (but I don't want to advertise the standard loopback addresses 127.0.0.1) eg echo inet a.b.c.d/32 >/etc/hos

Assigning multiple IPv6 addresses to loopback

2020-01-23 Thread Aham Brahmasmi
Namaste misc, In IPv6, what address prefix/range is recommended for use when assigning multiple addresses to the loopback interface? The use case is running multiple servers (nsd and unbound) on the same port but different loopback addresses. It is similar to what popped up on the other thread ab

Re: rate limit echo request

2020-01-23 Thread Jesper Wallin
Hi, Use the max-pkt-rate parameter instead. It does exactly what you think it does and is thoroughly covered in pf.conf(5) with examples and all. Regards Jesper Wallin On Wed, Jan 22, 2020 at 10:42:01PM -0700, myml...@gmx.com wrote: > Hi, > > I'm just wondering if there is a way to rate limi

Re: OpenBSD PPPOE

2020-01-23 Thread Peter J. Philipp
On Thu, Jan 23, 2020 at 05:59:20AM +0800, Peter Wong wrote: > The hostname.filename should follow vlan or vnetid? > > Regards, > -- > Peter Wong > 016-396 3326 Hi, In my router I have 3 vlans configured so far. I seem to have created the hostname.if arbitrarily after

Re: Brand new server - bad adventures -Update: note-

2020-01-23 Thread Özgür Kazancci
A note: "kbc: cmd word write error" still there, though. and booting into config, (boot -c) still hangs: https://ibb.co/z6V6585 On 23/01/2020 11:18, Özgür Kazancci wrote: Hej Andreas and all, I haven't tried that but I tried sysupgrade -s to upgrade to the latest snapshot today (as requested

Re: Brand new server - bad adventures -Update: fixed by the latest snapshot-

2020-01-23 Thread Özgür Kazancci
Hej Andreas and all, I haven't tried that but I tried sysupgrade -s to upgrade to the latest snapshot today (as requested by Mark) the inteldrm issue seems fixed. I'll have to wait till the next release - it seems. Here's the dmesg output of the snapshot from today: OpenBSD 6.6-current (GENE