Re: Can't get carp to fail over all interfaces with pfsync

2009-11-10 Thread Toni Mueller
Hi, On Tue, 10.11.2009 at 19:53:40 +1100, Mikel Lindsaar raasd...@gmail.com wrote: To clarify, CARP is working in terms of redundancy, what does not seem to be working is the preempting of the primary firewall interfaces by the backup firewall should _one_ of the primary interfaces be taken

IGNORE: Re: Can't get carp to fail over all interfaces with pfsync

2009-11-10 Thread Toni Mueller
On Tue, 10.11.2009 at 13:58:26 +0100, Toni Mueller openbsd-m...@oeko.net wrote: Did you set the appropriate sysctl switch? net.inet.carp.preempt=1 Note to self: Don't write emails when not fully awake. -- Kind regards, --Toni++

Re: http://www.theregister.co.uk/2009/11/03/linux_kernel_vulnerability

2009-11-08 Thread Toni Mueller
Hi, On Fri, 06.11.2009 at 13:41:13 +0200, Lars Nooden lars.cura...@gmail.com wrote: Unless you aren't running shit-for-architecture x86 systems still. It is 2009 and there are sparc, mips, freescale and arm on the market. now you only need to educate us about how such machines can be used in

Re: Problems with 4.5 as a KVM guest

2009-10-30 Thread Toni Mueller
Thanks, John and Michiel, On Thu, 29.10.2009 at 14:02:27 +0100, Michiel van Baak mich...@vanbaak.info wrote: On 12:18, Thu 29 Oct 09, Toni Mueller wrote: I'm running kvm 85+dfsg-4~bpo5 and see the following interesting behaviour with OpenBSD 4.6: * /bsd.rd runs just fine, using the ne

Re: Anyway to force IP to be assigned only if MAC matches?

2009-10-29 Thread Toni Mueller
Hi, On Wed, 28.10.2009 at 17:29:36 -0500, Andres Salazar ndrsslz...@gmail.com wrote: I Have dhcp enabled on my LAN which assigns an IP according to the clients MAC address, however if a user wanted to be malicious he can statically assign any IP to his NIC. he then has root access to the

Re: Problems with 4.5 as a KVM guest

2009-10-29 Thread Toni Mueller
Hi, On Tue, 14.07.2009 at 11:27:13 -0600, Bob Beck b...@openbsd.org wrote: and/or ask the linux people to fix KVM to make it really a PC. I'm running kvm 85+dfsg-4~bpo5 and see the following interesting behaviour with OpenBSD 4.6: * /bsd.rd runs just fine, using the ne(4) driver, but * /bsd

Re: Script to ping, traceroute a destination and record the time

2009-10-29 Thread Toni Mueller
Hi, On Thu, 29.10.2009 at 16:26:49 +0200, Kasper Adel karim.a...@gmail.com wrote: I am trying to troubleshoot a problem that is totally random and the one idea that would help me is to have a bash script that will ping a few destinations every minute, then do a traceroute to these

Re: Questions for OpenBGPd Developers

2009-10-15 Thread Toni Mueller
Hi, On Tue, 13.10.2009 at 16:41:35 +0200, Igor Sobrado igor.sobr...@gmail.com wrote: requirements come first, then you can choose the best tools to get that work done, not the reverse. why is it so difficult to understand? well... short story: Your definition of better may or may not meet

Re: Questions for OpenBGPd Developers

2009-10-15 Thread Toni Mueller
Hi, On Tue, 13.10.2009 at 11:33:40 -0400, and...@msu.edu and...@msu.edu wrote: The problem with this is that the interface between the other OS and the OpenBSD based code needs to be correct and secure, else there will be bugs and people will complain that OpenBSD code isn't good, etc and in

Re: Forum engine

2009-10-12 Thread Toni Mueller
Hi, On Sun, 11.10.2009 at 22:02:45 -0400, Sean Howard sil...@callysto.com wrote: A good usenet implementation is *closer* to a forum, which is what you want. But forums are a different (more dynamic) use case. With smaller entry barriers to large amounts of content. all other things aside: If

Re: Forum engine

2009-10-12 Thread Toni Mueller
On Mon, 12.10.2009 at 15:23:12 +, Matthew Szudzik mszud...@andrew.cmu.edu wrote: On Mon, Oct 12, 2009 at 04:42:44PM +0200, Toni Mueller wrote: archive, whereas, when the forum operator changes his forum software, or shuts down the forum, all past content is simply gone (or as good

Feature request: pf + set-tos, Re: IPSEC ECN: no-go?

2009-10-05 Thread Toni Mueller
Hi, On Thu, 01.10.2009 at 12:21:19 +0200, Toni Mueller openbsd-m...@oeko.net wrote: Searching around, I found that this question was already raised by Martin Hedenfalk well over a year ago (http://marc.info/?l=openbsd-miscm=121127258816047w=2), but he got no answer. I thought I'd try

OpenBSD + Nehalem: Now or Later?

2009-10-02 Thread Toni Mueller
Hi, I'm considering to purchase Supermicro servers with one or two Nehalem CPUs and a 5520 chipset. Has anyone already tried these, and/or how much breakage should I expect? My reading of /plus.html suggests that it may be too early to jump onto this train, but if some devs want a few weeks play

IPSEC ECN: no-go?

2009-10-01 Thread Toni Mueller
Hi, I operate a VPN that has some road warriors who all get a default route attached that points them into the local VPN gateway. With names and IP numbers replaced, this looks like this: # ipsecctl -s all FLOWS: flow esp in from 192.168.1.22 to 0.0.0.0/0 peer 1.1.1.1 srcid 5.5.5.5/32 dstid

Re: spamd - nixspam list, September 30, 2009

2009-10-01 Thread Toni Mueller
Hi, On Wed, 30.09.2009 at 09:12:16 -0600, Bob Beck b...@ualberta.ca wrote: Again? sheesh, it wasn't supposed to, we had talked to them. yes, again. I get a 404 all the time. Kind regards, --Toni++

Re: spamd - nixspam list, September 30, 2009

2009-10-01 Thread Toni Mueller
On Thu, 01.10.2009 at 21:16:30 +1000, Rod Whitworth glis...@witworx.com wrote: Me too, but I learned my lesson first time around. Now I have a cronjob that runs a script which attempts to get the file. If that fails the existing local nixspam file is used. I didn't check whether the stale file

Re: Ports isn't working for me...

2009-10-01 Thread Toni Mueller
Hi Marc, [ sorry for cross-posting from ports@ ] On Thu, 01.10.2009 at 17:20:05 +0200, Marc Espie es...@nerim.net wrote: Why do you want to do that ? what's wrong with php5-mbstring ? (which is one of the packages compiled in extensions) I didn't check whether it influences this extension,

Re: IPSEC: Problem with default route

2009-09-19 Thread Toni Mueller
Hi, On Fri, 18.09.2009 at 17:05:51 -0700, Lordsporkton lordspork...@gmail.com wrote: Could you send us some actual details? Interface configs, ipsec.conf, pf.conf, output of route show, maybe a little network diagram? anything so that we actually know what is doing on? this is one

Re: IPSEC: Problem with default route

2009-09-19 Thread Toni Mueller
Hi, thank you for your answer! On Sat, 19.09.2009 at 12:11:43 +, Stuart Henderson s...@spacehopper.org wrote: SADB entries are not normal routing table entries, they take priority. This is what I suspected. But even given those IPSEC semantics (they are documented where, please?), the

IPSEC: Problem with default route

2009-09-18 Thread Toni Mueller
Hi, I tend to a network that locally looks like this: East = 1.2.0.0/15 (central site) West = 1.5.0.0/16 (satellite site) West has a default route across the VPN to East. All gateways are running OpenBSD 4.5-stable. Connectivity between East and West is no problem. The problem is that

really strange console message?

2009-09-14 Thread Toni Mueller
Hi, today, one of my servers (4.5-stable/i386) beeped to me, over an SSH connection, and said this, via syslogd: hostname /bsd: 1540? The fact that the message went to a terminal suggests that this should describe a pretty serious error condition. Google turned up nothing, though... Kind

Re: shutting down

2009-09-12 Thread Toni Mueller
Hi, On Fri, 11.09.2009 at 22:28:43 +0200, Maurice Janssen maur...@z74.net wrote: Will the master shutdown normally, or will it stall while trying to umount the NFS share? The slaves will shutdown first, so when the master goes down, the NFS server won't be responding. man mount_nfs You

Re: Very high interrupt load with rl(4)

2009-09-09 Thread Toni Mueller
Hi, On Thu, 13.08.2009 at 19:24:15 +, Stuart Henderson s...@spacehopper.org wrote: - change the nic; almost anything else would be better I'm seeing rl(4) on these small embedded style computers where one can't plug in a regular nic. I don't know how to make vendors ship better interfaces,

OT: Rebranding, was: Re: Recommended Switches for Trunking?

2009-09-03 Thread Toni Mueller
Hi, On Thu, 03.09.2009 at 10:06:26 -0700, J.C. Roberts list-...@designtools.org wrote: Getting people at HP to just admit to rebranding is impossible, but getting them to tell what's really inside the box is double impossible. HP is a big enough company that I'd expect to be able to open the

Recommended Switches for Trunking?

2009-09-02 Thread Toni Mueller
Hi, I'm looking into getting switches to be used in port-extender style, and found a thread from last year recommending Cisco switches. I need about 20-50 ports atm, and would like to avoid Cisco. My current preference is using Procurve (2810 or 29xx). Do they work? What do you recommend? Any

Re: Recommended Switches for Trunking?

2009-09-02 Thread Toni Mueller
Hi, thanks for all your answers! -- Kind regards, --Toni++

Fully Automatic (network-based) Installation of OpenBSD?

2009-08-27 Thread Toni Mueller
Hi, I dimly remember seeing a short thread flowing by that mentions someone's hacks to bsd.rd to arrive at an installation system that works w/o human intervention, but can't seem to find it anymore. Pointers are greatly appreciated! -- Kind regards, --Toni++

Re: Automated service/daemon management

2009-08-27 Thread Toni Mueller
Hi, On Tue, 09.06.2009 at 15:52:55 -0400, Bryan Allen b...@mirrorshades.net wrote: My suggestion would be to move all your services to run under runit or daemontools. You can manage both with Puppet. I'm not familiar with runit, really, but I've used daemontools for years, quite happily, on

Re: Fully Automatic (network-based) Installation of OpenBSD?

2009-08-27 Thread Toni Mueller
Thank you both, Miod and Soeren - I think I was actually after the link Soeren posted, but didn't think that it was that long ago already. -- Kind regards, --Toni++

art(4): how to debug card or line errors?

2009-08-05 Thread Toni Mueller
Hi, I'm experiencing problems with an E1 line, and would very much like to be sure that the other end is to blame, instead of me. Unfortunately, I don't see how to get sufficiently detailed information from the card to find out whether this is a line problem, or a card's problem. The problem set

Re: [SOLVED, sort of] Re: 'ps auwx' and 'top': inconsistent display?

2009-08-05 Thread Toni Mueller
Hi, On Sat, 01.08.2009 at 17:13:43 +0300, Jussi Peltola pe...@pelzi.net wrote: Why should fork touch user id's? I was under the impression that only the effective userid should be inherited by a forked process, not the real user id. Also, the inconsistency in the display of the tools doesn't

[SOLVED, sort of] Re: 'ps auwx' and 'top': inconsistent display?

2009-08-01 Thread Toni Mueller
Hi, On Fri, 24.07.2009 at 15:09:23 +0200, Toni Mueller openbsd-m...@oeko.net wrote: I have a perl script that should work as follows: * check some parameters * drop privileges ( $ = ...; $) = ...;) it turned out that 'top' displayed the real userid which I didn't set, while 'ps' displayed

locale support, again

2009-08-01 Thread Toni Mueller
Hi, I know that the subject of what to do in the absense of having locale support has been discussed quite often already. I'd like to know what I need to do to supply full locale support to applications that want to use them. My problem arises from those pesky web applications which simply

Perl: strange mode on libs?

2009-07-30 Thread Toni Mueller
Hello, I've just implemented the patch 007 for 4.5, and found out that the .a libs are chmod 0600, while all other .a libs are chmod 0444. Although the Makefiles evaluated to this (amongst others): install -c -o root -g bin -m 600 libperl.a /usr/lib install -c -o root -g bin -m 600

Re: Multiple IPSec-tunnels and load balancing

2009-07-30 Thread Toni Mueller
Hi, On Tue, 30.06.2009 at 11:15:21 +0200, u...@o3si.de u...@o3si.de wrote: I try to use an OpenBSD firewall with two ADSL links connected (dynamic addresses!) to the internet. Now I want to establish two IPSec tunnels over each link to a central VPN gateway (OpenBSD too). Is it possible to

'ps auwx' and 'top': inconsistent display?

2009-07-24 Thread Toni Mueller
Hello, I have a perl script that should work as follows: * check some parameters * drop privileges ( $ = ...; $) = ...;) * fork some other programs Now when I run this script and ps auwx thereafter, I see that the programs I forked are running under the user id that I specified in the script.

Re: AMD64 with 4GB RAM

2009-07-14 Thread Toni Mueller
Hi, On Mon, 22.06.2009 at 17:21:11 +0200, Claudio Jeker cje...@diehard.n-r-g.com wrote: Consider it unsave. Without iommu (e.g. on Intel Boxes) many devices will be unable to talk to memory 4GB bad if that is where your data is. With the amd64 gart acting as iommu it is possible to use the

Re: re-writing RAIDframe parity asynchronously?

2009-07-13 Thread Toni Mueller
Hi, On Wed, 17.06.2009 at 15:55:00 +0200, Raimo Niskanen raimo+open...@erix.ericsson.se wrote: On Wed, Jun 17, 2009 at 03:05:47PM +0200, Toni Mueller wrote: I'm not sure that I understand you correctly, and don't want to make a statement about the merit of having raidctl running

Re: prioritizing carp interfaces

2009-07-13 Thread Toni Mueller
Hi, On Mon, 23.03.2009 at 17:22:55 +0100, Joerg Streckfuss streckf...@dfn-cert.de wrote: In my opinion preemption on both nodes effects that advskew is set to 240 on all interfaces and as a consequence there is no host which could advertise faster then the other host in the carp group.

CARP: multiple host groups on one network?

2009-07-13 Thread Toni Mueller
Hello, I've decided to make more use of CARP, but I'm not sure that I understand how vhid and carpnodes are supposed to work. So far, my reading of carp(4) and ifconfig(8) is as follows: * If I have a number of aliases bound to a certain interface, I should move them all to individual carp

Re: IPSEC problem after upgrading one side to 4.5

2009-06-17 Thread Toni Mueller
Hello, On Fri, 12.06.2009 at 10:54:56 +0200, Toni Mueller openbsd-m...@oeko.net wrote: I have a VPN running which looks like a hub-and-spoke configuration. For the remainder of the discussion, the spokes are OpenBSD 4.4. Since I've upgraded the hub to 4.5, a connection to one of the spoke

Re: re-writing RAIDframe parity asynchronously?

2009-06-17 Thread Toni Mueller
Hi, On Wed, 17.06.2009 at 10:52:05 +0200, Stefan Unterweger ste...@rg-me.it wrote: I am considering patching rc(8) and commenting out the `raidctl -P all` line, and running it via cron(8) at @reboot, but this seems like a hack to me. So before I venture that way, I'd rather make sure I didn't

Re: amd64 on Xeon X3220

2009-06-16 Thread Toni Mueller
Hi, On Tue, 16.06.2009 at 11:20:35 +0100, Gaby Vanhegan g...@vanhegan.net wrote: I've been googling around for any information about OpenBSD on this hardware. hmmm I can only tell you that it works on an X3230 (Supermicro, though). The machine works for me since a few months now. Getting a

Re: ipsec config with x509 certificates

2009-06-12 Thread Toni Mueller
Hi Eric, On Fri, 13.03.2009 at 19:16:32 +0100, Eric Belhomme eric.belho...@eve-team.com wrote: - copying my host private key on /etc/isakmpd/private/local.key - copying my host public key on /etc/isakmpd/keynote/my FQDN/credentials I was so far unable to get this keynote-credentials stuff

IPSEC problem after upgrading one side to 4.5

2009-06-12 Thread Toni Mueller
Hi, I have a VPN running which looks like a hub-and-spoke configuration. For the remainder of the discussion, the spokes are OpenBSD 4.4. Since I've upgraded the hub to 4.5, a connection to one of the spoke starts to fail. After running for well over a week, the connection was not automatically

Re: arp table timeout / how to update automatically if foreign MAC changes?

2009-06-03 Thread Toni Mueller
Hi, On Tue, 11.03.2008 at 15:59:24 +0100, smartTERRA NOC n...@smartterra.de wrote: I have found a workaround: heartbeat. Heartbeat uses (like carp on OpenBSD) a virtual MAC address, so there is no problem with the arp cache on the OpenBSD firewall. how do I do this if the remote machines

Re: Where's demime?

2009-05-30 Thread Toni Mueller
Hi, On Fri, 29.05.2009 at 09:29:39 +0200, ropers rop...@gmail.com wrote: I know that demime is being used on the misc mailing list. I even tried to see if it's contained in some other package: http://www.google.ie/search?q=demime+inurl%3Aopenbsd.org+inurl%3Acontents.html A Google search for

Re: multilink VPN

2009-05-29 Thread Toni Mueller
Hi, On Wed, 27.05.2009 at 22:07:25 -0300, James Mackinnon jmackin...@devantec.com wrote: I need to setup redundant VPN's between these locations without the use of BGP. I have used sasync in the past, pfsync etc however, I have not tried to setup a VPN where 2 ISPs are used without the ISPs

strange performance problem (4.5)

2009-05-20 Thread Toni Mueller
Hi, I've just upgraded a (server) machine to 4.5, and now experience a strange performance problem. The problem itself manifests in about 95-100% CPU usage (0-1% idle), permanently, without being able to see much in top. This is distributed to about 8-25% system and the rest almost exclusively

UTF-8 on the file system?

2009-05-13 Thread Toni Mueller
Hi, from a discussion around early November last year, I gather that OpenBSD has not much UTF-8 support right now. I am a bit unsure about whether having file names with UTF-8 characters are supported, though. I don't need to type the characters, nor see or print them, but only have a program

Re: UTF-8 on the file system?

2009-05-13 Thread Toni Mueller
Hi Otto, thanks for the quick answer. On Wed, 13.05.2009 at 10:50:37 +0200, Otto Moerbeek o...@drijf.net wrote: On Wed, May 13, 2009 at 10:35:25AM +0200, Toni Mueller wrote: fd = open(filename_with_utf8_characters); succeed on a standard OpenBSD disk (FFS, if I'm not mistaken), using

Re: UTF-8 on the file system?

2009-05-13 Thread Toni Mueller
Hi, On Wed, 13.05.2009 at 12:12:31 +0200, Otto Moerbeek o...@drijf.net wrote: show me what filename you constructed (and how you did that) and the contents of ls-output.txt. I prefer hexdump -C, btw. I can't send you a recipe for constructing these filenames because I didn't do it, and I also

Re: UTF-8 on the file system?

2009-05-13 Thread Toni Mueller
Hi, On Wed, 13.05.2009 at 19:26:59 +0900, Jordi Beltran Creix jbcreix.m...@gmail.com wrote: print '?' or an octal escape sequence on nonprint chars. With a hacked libc and a utf-8 version of multibyte functions as well as a few fixes on apps solve most of these problems, gtk apps and scim

Re: [dera...@cvs.openbsd.org: Re: I would like to send this to misc@ and security-announce@, from me.]

2009-05-13 Thread Toni Mueller
Hi, On Thu, 30.04.2009 at 11:21:50 -0600, Bob Beck b...@openbsd.org wrote: The best place to get OpenBSD is from an official CD set, produced in a secured location FWIW, I have what I think are official CDs, and they contain OS code dated 2009-02-28 22:41 UTC. This means the official

Re: Samsung HD License Issue

2009-05-04 Thread Toni Mueller
Hi, On Mon, 04.05.2009 at 11:46:51 +0200, David Vasek va...@fido.cz wrote: It seems we are no longer buying hardware products, we are only buying permissions to use them - almost everything contains some form of firmware or microcode now. You never _own_ that code built-in in your

Re: Samsung HD License Issue

2009-05-04 Thread Toni Mueller
Hi, On Mon, 04.05.2009 at 12:03:15 +0200, Jochem Kossen jkos...@xs4all.nl wrote: On Mon, May 04, 2009 at 11:46:51AM +0200, David Vasek wrote: Possibly, but you need to get the mentioned license _from Microsoft_, as is written in the license: ...may require an additional license from

Re: How do I enable bsd.mp kernel in 4.4/i386?

2009-05-04 Thread Toni Mueller
Hi, On Sat, 02.05.2009 at 19:15:59 -0600, Theo de Raadt dera...@cvs.openbsd.org wrote: I am running the GENERIC OBSD 4.4/i386 'bsd' kernel and would like to set up the bsd.mp kernel instead. cd / mv bsd bsd.sp mv bsd.mp bsd reboot what was wrong with: # echo 'set image

Re: How do I enable bsd.mp kernel in 4.4/i386?

2009-05-04 Thread Toni Mueller
Hi, On Sun, 03.05.2009 at 11:00:02 -0700, J.C. Roberts list-...@designtools.org wrote: I never said the boot.conf was not useful. I said the i386\amd64 hack I don't see how 'set image ...' is a hack, nor how it would be specific to i386 and amd64. The new installer (destined for 4.6) in

Re: How do I enable bsd.mp kernel in 4.4/i386?

2009-05-04 Thread Toni Mueller
Hi Otto, On Mon, 04.05.2009 at 12:33:53 +0200, Otto Moerbeek o...@drijf.net wrote: Summary: changes in the OpenBSD 4.6 install script, plus: after building a new kernel 'make install' copies it to /bsd. In both cases you end up running and old kernel. I agree to be guilty of posting before

Re: Internet access over Bluetooth; a summary.

2009-04-30 Thread Toni Mueller
On Tue, 28.04.2009 at 07:12:34 +0200, Otto Moerbeek o...@drijf.net wrote: Caching only reduces load on the DNS system if the caches get used a lot. Lots of caches that are virtually unused increase the load. Imagine every laptop owner would do this, and the resulting load of root and other

Re: build fails on 4.5

2009-04-28 Thread Toni Mueller
Hi, On Mon, 27.04.2009 at 16:19:39 -0400, Ted Unangst ted.unan...@gmail.com wrote: That's what I remembered from the last time it happened, but I just double checked. It seems rsync only does this when -C cvs-exclude is passed. The problem is that it ignores directories, not just files.

Re: build fails on 4.5

2009-04-27 Thread Toni Mueller
On Mon, 27.04.2009 at 14:14:07 -0400, Ted Unangst ted.unan...@gmail.com wrote: The mirror is broken because rsync, in its infinite wisdom, doesn't copy directories named *.so. And since the mirror doesn't have that directory, you don't have it either. Get it from somewhere else. dtalk has

Re: T1 card compatible with 4.4

2009-04-27 Thread Toni Mueller
On Fri, 24.04.2009 at 11:26:42 -0400, (private) HKS hks.priv...@gmail.com wrote: I'm looking for a T1 card compatible with 4.4. ;) There were a fair number of recommendations for Sangoma's a101 a few years ago, followed by threads describing major problems and Sangoma yanking support for

Re: Recipient Validation Design Opinions

2009-04-27 Thread Toni Mueller
Hi, On Fri, 24.04.2009 at 08:47:00 -0400, Mario Vega mario.j.v...@gmail.com wrote: The two internal servers use several different domains and accept a variety of different name formats. In addition, some users have one or more aliases. Furthermore, only the primary address is published

Re: Problem with slow disk I/O

2009-04-23 Thread Toni Mueller
On Thu, 23.04.2009 at 19:40:34 +0200, Thomas Pfaff tpf...@tp76.info wrote: On Thu, 23 Apr 2009 17:25:57 +0200 Jan Stary h...@stare.cz wrote: On Apr 23 18:09:55, Thomas Pfaff wrote: First on Ubuntu: /dev/sda2 on / type ext3 (rw,relatime,errors=remount-ro) ~$ time (tar -zxf ports.tar.gz

Re: Is there any particular reason to not have RAIDFrame on RAMDISK_CD

2009-04-20 Thread Toni Mueller
Hi, On Mon, 20.04.2009 at 11:55:05 +0200, Henning Brauer lists-open...@bsws.de wrote: and in any case this is less about ramdisk size but more about raidframe which we're going to get rid off eventually (when marco ever gets softraid upt o a usable level, read rebuild working) please also

Re: spam from chrooted CMSes

2009-04-10 Thread Toni Mueller
Hi, On Fri, 10.04.2009 at 09:42:21 +0800, Uwe Dippel udip...@uniten.edu.my wrote: I'm running postfix as MTA on a machine with several CMS, on a chrooted Apache. Recently, there is a huge number of spam being sent from there, alas. When I scan the postfix-logs, all those come from 'root',

Re: Anyone using munin?

2009-04-06 Thread Toni Mueller
Hi, On Sat, 04.04.2009 at 12:15:35 +0200, Cezary Morga c...@therek.net wrote: I think munin comes with a bunch of plugins already. If not you can grab some Linux package (like Debian's munin-node) and extract them from it. These are simple scripts (shell, perl, python) so they might run on

Re: [semi-OT] Can anyone recommend an OpenBSD-compatible colour laser printer?

2009-04-06 Thread Toni Mueller
Hi, On Sun, 05.04.2009 at 15:24:09 -0400, System Administrator ad...@bitwise.net wrote: device with most of the processing happening on the host. If you stick to real hardware printers that provide built-in Postscript (or at least PCL) language and fonts, you will have no problems with

Re: VPN client-to-site over IPSec

2009-04-04 Thread Toni Mueller
Hi, On Fri, 03.04.2009 at 18:26:45 -0300, Marcello Cruz marcello.c...@globo.com wrote: Do you mean a VPN where only a HOST will access an entire NETWORK? If so, then the answer is YES. I don't need anything specifically right now which would fit into this thread, but asked questions to

Re: Wim

2009-04-03 Thread Toni Mueller
Hi Kili, On Thu, 02.04.2009 at 22:15:13 +0200, Matthias Kilian k...@outback.escape.de wrote: Wim *does* filter traffic from cvs.openbsd.org. At least on ports 25 and 80: $ telnet www.kd85.com 25 Trying 62.116.6.182... [nothing] Silly. So silly. I've seen many kinds of breakage, but

Re: where to order now ?

2009-04-03 Thread Toni Mueller
Hi, On Fri, 03.04.2009 at 00:56:16 +0200, Martin SchrC6der mar...@oneiros.de wrote: 30 is 60% of 50. :-) I seriously doubt that other european resellers donate the 20 profit they make. can we agree that you shouldn't make such blanket assumptions about other people's books, please? Btw,

Re: VPN client-to-site over IPSec

2009-04-03 Thread Toni Mueller
Hi, On Fri, 03.04.2009 at 12:43:33 -0300, JoC#o Salvatti salva...@gmail.com wrote: Is it possible to implement a client-to-site VPN over IPSec? I have searched on the web, but only found site-to-site models. what exactly do you mean by client to site? You can distinguish between transport

Re: Wim

2009-04-02 Thread Toni Mueller
Hi, On Thu, 02.04.2009 at 00:17:35 -0600, Theo de Raadt dera...@cvs.openbsd.org wrote: This guy some of you think is so honest. He's filtering port 25 from cvs.openbsd.org. did you try sending from a different server thereafter? I've seen a failure mode where a machine appears to be up,

Re: OpenBSD mta with postfix

2009-04-01 Thread Toni Mueller
Hi, [ I don't yet see how this is related to Postfix, or OpenBSD ] On Sat, 28.03.2009 at 11:47:41 +0200, Lars NoodC)n larsnoo...@openoffice.org wrote: I run into it a lot. My guess is that it's to distract from the IT team having selected software which doesn't work reliably. So if they

Re: European orders

2009-04-01 Thread Toni Mueller
Hello, On Wed, 01.04.2009 at 08:58:40 +0200, Artur Grabowski a...@blahonga.org wrote: Where do they come from? Suddenly there's this astroturfing campaign about... what? forcing Theo to do business with someone he has no intention of doing business with anymore? this is a bit besides the

Re: persistent bios infection paper and openbsd

2009-03-27 Thread Toni Mueller
Hi, On Thu, 26.03.2009 at 12:21:31 -0600, Theo de Raadt dera...@cvs.openbsd.org wrote: I wrote: I'd say that, at least for running machines, some precautionary measures should be possible to take to thwart hackers that try to rob your machine from under your fingertips. Eg. a driver

Re: European orders

2009-03-26 Thread Toni Mueller
Hi, On Wed, 25.03.2009 at 17:37:54 +0200, Ross Cameron abal...@gmail.com wrote: On Wed, Mar 25, 2009 at 4:51 PM, frantisek holop min...@obiit.org wrote: Theo has made some serious allegations and i hope he has evidence to back it up. Theo may be many things,... but a liar I have never found

Re: persistent bios infection paper and openbsd

2009-03-26 Thread Toni Mueller
Hi, On Wed, 25.03.2009 at 10:05:13 -0600, Theo de Raadt dera...@cvs.openbsd.org wrote: The operating systems are not vulnerable. The *machines* are. this begs the question: Which machines are NOT vulnerable? There really is absolutely nothing we can do about it. I'd say that, at least

Re: intel 5400 chipset support, was: Re: raidframe and hotplugd on 4.4

2009-03-23 Thread Toni Mueller
Hi David, On Mon, 23.03.2009 at 09:48:36 +0100, David Vasek va...@fido.cz wrote: On Sun, 22 Mar 2009, Toni Mueller wrote: isa0 at mainbus0 com0 at isa0 port 0x3f8/0 irq4: ns8240, .. fifo Not that I would be able to help with this, just note that these two lines are very different from

intel 5400 chipset support, was: Re: raidframe and hotplugd on 4.4

2009-03-22 Thread Toni Mueller
Hi, [ hijacking my own thread in order to avoid posting the dmesg twice... ] I tried to enable AHCI mode on this computer with the intel 5400 chipset on board. This resulted in the kernel not finding the disks, after they were registered fine with the BIOS. So I thought, I'd peek at the disks

Re: prioritizing carp interfaces

2009-03-21 Thread Toni Mueller
Hi, On Fri, 20.03.2009 at 14:28:46 +0100, Joerg Streckfuss streckf...@dfn-cert.de wrote: How does CARP behaves when on the master node two unimportantly interfaces fail and on the backup node only the uplink interface fails? Does CARP failover to the backup node and as consequence the whole

Re: openbsd in virtualization

2009-03-19 Thread Toni Mueller
Hi, On Wed, 18.03.2009 at 23:10:01 +0100, Marc Balmer m...@msys.ch wrote: Machines that are exposed to the internet run on real hardware, for security reasons. I don't trust the underlying virtualization software to be secure/stable/good. I generally second that, but have a nagging doubt

Re: openbsd in virtualization

2009-03-19 Thread Toni Mueller
Hi, On Thu, 19.03.2009 at 10:23:18 +0100, Julian Leyh jul...@vgai.de wrote: Pehr Svderman schrieb: Let me put it this way: I don't mind creating 60 virtual instances to give each student in a course a server to mess around with. I can wipe them and reinstall them in a matter of minutes if a

Re: openbsd in virtualization

2009-03-18 Thread Toni Mueller
Hi, On Wed, 18.03.2009 at 09:33:38 +, Stuart Henderson s...@spacehopper.org wrote: how does one increase efficiency and reduce IT costs by making things more complicated? sorry, but this is the wrong question. Using virtual machines makes some things more complicated, but it also enables

Re: raidframe and hotplugd on 4.4

2009-03-17 Thread Toni Mueller
Hi, On Tue, 17.03.2009 at 00:16:20 -0700, Philip Guenther guent...@gmail.com wrote: On Mon, Mar 16, 2009 at 4:46 AM, Toni Mueller openbsd-m...@oeko.net wrote: ... B hotplugd[7128]: waitpid: Error 10 I didn't yet find out what that means. Hmm, 10 == ECHILD. ok. After you see that, do

Re: altq incoming vpn connections

2009-03-17 Thread Toni Mueller
Hi, On Mon, 16.03.2009 at 16:31:12 +0200, Eugeni Akmuradov e.akmura...@gmail.com wrote: is out there any possibility to load queues from separate file and/or via anchors. I don't know what you want to achieve, but look at # pfctl -A -f some-queue-definitions-in-this-file (man pfctl) Kind

raidframe and hotplugd on 4.4

2009-03-16 Thread Toni Mueller
Hi, while trying to repair a 4.4 machine, I recently added two SATA disks to the two SATA disks already there (dmesg below), which were only detected after reboot, contrary to my expectations. The first thing to note after reboot was that the formerly second disk (wd1) has now become wd2,

Re: IPSEC: certificate ignored

2009-03-09 Thread Toni Mueller
Hi, thanks for answering to Mitja and you. On Sat, 07.03.2009 at 19:28:09 +0100, Heinrich Rebehn reb...@ant.uni-bremen.de wrote: Am 06.03.2009 um 22:56 schrieb Toni Mueller: 223644.842092 Plcy 30 keynote_cert_obtain: failed to open /etc/ isakmpd/keynote//u...@road-warrior/credentials

IPSEC: certificate ignored

2009-03-06 Thread Toni Mueller
Hi, I'm trying to get a VPN connection to work which should actually be a no-brainer (and I have quite similar things out there, for years): network 1 | Linux w/ isakmpd (u...@road-warrior) | | Internet | | OpenBSD w/ isakmpd (office-router) | network 2

Re: NAT, Firewall pf

2009-02-24 Thread Toni Mueller
Hi, On Mon, 23.02.2009 at 17:58:20 -0800, Hilco Wijbenga hilco.wijbe...@gmail.com wrote: c. How can I get pflog to flush immediately? I noticed I have to wait a minute or so before logged lines show up. you don't need to. Listen on pflog0 instead. Kind regards, --Toni++

STM-1 connectivity (OT?)

2009-02-20 Thread Toni Mueller
Hi, I'm looking into ways to handle STM-1 connections. I dimly remember that there were Marconi cards, that were supported, but can't find them anymore. What would be the recommended method these days to terminate STM-1 circuits, possibly on an OpenBSD based router, please? What alternatives do

Re: request for package: Distributed Checksum Clearinghouses (DCC)

2009-02-20 Thread Toni Mueller
Hi, On Thu, 19.02.2009 at 20:55:09 -0500, Juan Miscaro jmisc...@gmail.com wrote: Are there any plans to package DCC for anti-spam gateways? Thanks. once upon a time I converted the Debian package for pyzor to OpenBSD, which is tedious, but otherwise rather straightforward. It never never hit

Re: OpenBSD AMD64 4.4 install hangs at boot (softraid0 at root) on Intel Q9550, 8GB RAM, 1TB WD

2009-02-20 Thread Toni Mueller
Hi, On Fri, 20.02.2009 at 00:24:28 -0500, David Heinrich dh0...@gmail.com wrote: sd0 - sd3 are because of my CF card reader. However, I don't want to install the latest beta-versin of OpenBSD; those of us who have hardware that is not, or not well supported by the release version of OpenBSD,

Re: STM-1 connectivity (OT?)

2009-02-20 Thread Toni Mueller
Hi, On Fri, 20.02.2009 at 11:49:19 -0600, tico tico-o...@raapid.net wrote: Toni Mueller wrote: I'm looking into ways to handle STM-1 connections. I dimly remember that there were Marconi cards, that were supported, but can't find them anymore. What would be the recommended method these days

Re: Backup strategies

2009-02-01 Thread Toni Mueller
Hi, On Sat, 31.01.2009 at 14:04:32 +, Dieter open...@sopwith.solgatos.com wrote: ISO files have a 2 GB filesize limit, so large files don't fit. are you sure? I can fetch files that are well over 4GB and burn them on DVD. These files are called as ISO files, but I don't know exactly

Re: Backup strategies

2009-02-01 Thread Toni Mueller
On Sun, 01.02.2009 at 13:01:52 +, Matthew Szudzik mszud...@andrew.cmu.edu wrote: See http://en.wikipedia.org/wiki/ISO_9660#The_4_GiB_.28or_2_GiB_depending_on_implementation.29_file_size_limit Thanks for the heads-up, but Some operating systems can handle files up to 4GB on an ISO 9660

Re: Backup strategies

2009-02-01 Thread Toni Mueller
Hi, On Sun, 01.02.2009 at 18:34:31 +0100, Pierre Riteau pierre.rit...@gmail.com wrote: You seem to be mistaken. yes. Thanks to all of you, and note to self: Don't post when tired and distracted... Kind regards, --Toni++

altq problem: how to correctly borrow in hfsc?

2009-01-30 Thread Toni Mueller
Hi, I'd like to have both the most bandwidth and the most throughput for fast, if traffic classified as eligible for fast needs to be transferred, and otherwise most of the bandwidth available for slow, but leaving 100Kb free for fast at any one time, and, preferably, also leaving a bit of free

Re: OpenBGPD Flaps, 32bit ASn in the wild.

2009-01-30 Thread Toni Mueller
Hi, On Fri, 30.01.2009 at 04:08:34 -0800, OpenBSD User gb10hkzo-open...@yahoo.co.uk wrote: Just to add my vote. I'm with Claudio on this one. me too. Validate the input yes, but don't tamper with what's not yours After reading the thread on idr, I'm under the impression that the

<    1   2   3   4   5   >