freebsd-hack...@freebsd.org

2013-03-26 Thread budsz
Hi folks,

I want ask about error in `dmesg` output remove Bump sched buckets to
64 (was 0)
in FreeBSD 8.3 STABLE version. Where's the code lines should be remove (safety)?

Thank You

-- 
budsz
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: gettext problem in FreeBSD 8.3 system hosed

2013-03-26 Thread Antonio Olivares
Dear Sir,


 As bapt@ hints: try rebuilding binutils without NLS.

 --
 --

I have binutils installed without NLS.  I ran make deinstall reinstall
inside /usr/ports/devel/binutils/ and it deinstalls and it fails to
reinstall because it depends on gettext :(  Now I guess I am really in
trouble.

I am not using pkgng just ports.  On three machines I am successfull,
two 9.1-RELEASE-p1 and one 8.3-RELEASE, but this 9.1-RELEASE box I
could not build some ports, I tried deinstall/reinstall options, and
now I guess I am in a major problem, unless gettext starts to build
soon, I uninstalled glib20, and tried reinstall it fails with gettext.
 There is a new version out, but it has not made it to ports :(
I'll hang in there for a little while longer, but if it comes down to
deleting and reinstalling all ports, I may do just that.

Best Regards  Thanks for the suggestions and advice provided.

Antonio
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Status of Xen/Dom0 on FreeBSD?

2013-03-26 Thread C. P. Ghost
Hello,

I'm wondering if there's been some progress on the Xen/Dom0
front recently. The Wiki
  https://wiki.freebsd.org/FreeBSD/Xen
still doesn't show any improvements in this area, but it may
also be outdated (?).

Thanks,
-cpghost.

-- 
Cordula's Web. http://www.cordula.ws/
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


software support

2013-03-26 Thread Oblitey, Edmund
I am trying to install FreeBSD on a E7520/6300ESB chipset. Program
freezes during probing devices. It always restart when it gets to the
atkbd0. Want to know if u can help me on it.

___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: software support

2013-03-26 Thread Matthew Seaman
On 26/03/2013 14:10, Oblitey, Edmund wrote:
 I am trying to install FreeBSD on a E7520/6300ESB chipset. Program
 freezes during probing devices. It always restart when it gets to the
 atkbd0. Want to know if u can help me on it.

Sounds like there's something on-board that either isn't supported or
that doesn't get the right driver bound to it.  Or that might possibly
be defective.

What version of FreeBSD are you trying to install?

Can you definitely run other OSes without problems on this same hardware?

Can you try disconnecting as many non-essential peripherals as possible
and see if that allows FreeBSD to boot?

Cheers,

Matthew


___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: Status of Xen/Dom0 on FreeBSD?

2013-03-26 Thread Shane Ambler

On 26/03/2013 23:30, C. P. Ghost wrote:

Hello,

I'm wondering if there's been some progress on the Xen/Dom0
front recently. The Wiki
   https://wiki.freebsd.org/FreeBSD/Xen
still doesn't show any improvements in this area, but it may
also be outdated (?).


Not sure about any Xen/Dom0 work but I get the impression that bhyve is
the focus of freebsd development in that area.

https://wiki.freebsd.org/bhyve


___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: security/heimdal generates openssl conflict [was - Re: Installing openssl from ports]

2013-03-26 Thread Shane Ambler

On 26/03/2013 11:53, Shane Ambler wrote:


Either the man pages list is incorrect or heimdal installs a
duplicate copy of the openssl man pages - maybe this could be
disabled if openssl from ports is used.


For reference - heimdal includes source for libhcrypto which it uses if
openssl is not present. While it doesn't install libhcrypto it still
installs the man pages which conflicts with the openssl port man pages.

I have submitted a patch to fix this -

http://www.freebsd.org/cgi/query-pr.cgi?pr=177397


___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: Client Authentication

2013-03-26 Thread Joseph Olatt
On Sat, Mar 23, 2013 at 09:22:07PM -0700, Doug Hardie wrote:
 I am not sure this is the best place to ask this, but I didn't see any other 
 maillists that seemed more appropriate.
 
 Basically, my outgoing mail server is being systematically attacked to try 
 passwords looking for one that works.  When they do find one, we get 
 inundated by spam sent through that account throughout the world.  The 
 situation is such that most of our users are older and their computer is a 
 hand-me-down so they can talk to their grandchildren.  Passwords are a great 
 inconvenience for them and create numerous problems with remembering them 
 even when they are simple.  Unfortunately, most of them are quite easy to 
 guess.
 
 Telling users to use more appropriate passwords is a complete waste of my 
 time.  Its never going to make any changes as they probably would not 
 remember any other password (or where they wrote down the password).  This 
 situation requires a technical solution.
 
 I have been investigating the use of client authentication through SSL.  DoD 
 uses this approach by having the certificates on an ID card and a card reader 
 on each computer.  We don't have the money to use that approach no could we 
 every get our users to spring for that.  I was hoping to figure out a way to 
 put the certificate on a flash drive or CD that the user would carry.  The 
 approach we use has to also work for iPads, smart phones etc that do not have 
 an interface for a card reader.
 
 At this time, I have successfully configured a test for openssl client 
 authentication using a client certificate.  There are a few issues remaining. 
  DoD uses a p12 format for their certificates.  Many browsers support that 
 format.  It encrypts the certificate and private key so they are not easily 
 obtained from the smart card.  Openssl's s_client uses pem certificates and 
 the key has to be included in the certificate file.  While that is easily 
 transported on CD or flash drive, the private key is in the clear on the 
 device.  Thats not really viable.
 
 S_client works properly without a certificate when the certificate check in 
 the server is set to not fail if a certificate is not provided.  This is 
 needed because we will never get all our users to use this approach at home.  
 They will still want to use passwords.  Since the certificate request is made 
 before the connection information is available, there is no easy way to 
 request it only when needed.  I have only been able to test with the Safari 
 browser and it does not handle the no certificate case properly.  I believe 
 it is dropping the connection when the user does not select a certificate.  I 
 still have to test the other browsers.
 
 There is an interesting aspect of openssl that the certificate it uses for 
 normal SSL authentication is not used for client authentication.  There are 
 another completely different set of calls that have to be made to set the 
 certificate/key for use in validating the client certificates.  Much of this 
 is only documented in existing code.
 
 With Safari you have to import the client's certificate into the keychain.  
 Then it works fine.  Unfortunately, it doesn't go away when you are done with 
 it.  Unlike the smart card which, when removed, removes the certificate, the 
 Safari certificate can continue to be used by anyone afterwards.  Hence, its 
 not all that useful for authentication.  One approach I have heard about, but 
 not investigated yet is to place the keychain on the removable device.  That 
 would make it go away.  However, that approach would not work with any other 
 browser or mail program.
 
 Any ideas/suggestions on this will be appreciated.  Thanks,
 
 -- Doug

A little while back I wrote a system to do a simple Two Factor
Authentication and dynamic manipulation of PF (Packet Filter) Tables. I
created it to prevent brute-force attacks on the servers that I have
exposed on the Internet. 

Users would carry around a flash drive that has an HTML file containing
a message that is signed by your server (Alternatively, the HTML file
can be saved/placed of frequently used devices). When users double-click 
that file, that message is verfified and the user is then prompted for
his/her password. If the password is correct, then access from the
user's IP is allowed to your server. 

The system is released as FOSS and is available at: 
  http://taferno.sourceforge.net

More info may be found at:
  http://taferno.com


I don't know if it will work for you. But, you can try if you'd like.


 ___
 freebsd-questions@freebsd.org mailing list
 http://lists.freebsd.org/mailman/listinfo/freebsd-questions
 To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to 

Re: Status of Xen/Dom0 on FreeBSD?

2013-03-26 Thread C. P. Ghost
On Tue, Mar 26, 2013 at 5:10 PM, Shane Ambler free...@shaneware.biz wrote:

 On 26/03/2013 23:30, C. P. Ghost wrote:

 Hello,

 I'm wondering if there's been some progress on the Xen/Dom0
 front recently. The Wiki

 https://wiki.freebsd.org/**FreeBSD/Xenhttps://wiki.freebsd.org/FreeBSD/Xen
 still doesn't show any improvements in this area, but it may
 also be outdated (?).


 Not sure about any Xen/Dom0 work but I get the impression that bhyve is
 the focus of freebsd development in that area.

 https://wiki.freebsd.org/bhyve


Interesting! Thanks for the hint.

However, that's not what I'm looking for. I'm interested in running
a type-1 Hypervisor with FreeBSD as the host (as in Xen/Dom0) and
all kinds of DomU clients (FreeBSD, Linux, Windows, etc.). The host
machine will be a server with at least 90 GB RAM (later up to 512 GB)
and plenty of SAS/SATA drives.

Since I'm considering running ZFS on those drives at the host level,
and serving the clients on top of that, FreeBSD as Xen/Dom0 seems
like a good idea... if it was already available. However, I'm not sure
yet if ZFS would be advisable for this scenario or if it would kill
performance. If not, I wouldn't mind running Xen/Dom0 with some
lightweight Linux distro as host, and FreeBSD as DomU. It wouldn't
be as nice as a native FreeBSD setup, but it's better than nothing.

Thanks,
-cpghost.

-- 
Cordula's Web. http://www.cordula.ws/
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Still a problem with 'pkg check -Ba'

2013-03-26 Thread Walter Hurry
I hope Matthew Seaman sees this:

All the files are of course present and correct in /usr/local/lib/
virtualbox

# pkg check -Ba
pkg: (virtualbox-ose-4.2.6) /usr/local/bin/VBoxAutostart - shared library 
VBoxRT.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/bin/VBoxAutostart - shared library 
VBoxXPCOM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/bin/VBoxBalloonCtrl - shared 
library VBoxRT.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/bin/VBoxBalloonCtrl - shared 
library VBoxXPCOM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/bin/VBoxManage - shared library 
VBoxDDU.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/bin/VBoxManage - shared library 
VBoxRT.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/bin/VBoxManage - shared library 
VBoxXPCOM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/bin/VBoxSVC - shared library 
VBoxDDU.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/bin/VBoxSVC - shared library 
VBoxRT.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/bin/VBoxSVC - shared library 
VBoxXPCOM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/bin/VBoxTestOGL - shared library 
VBoxOGLhostcrutil.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/bin/VBoxTestOGL - shared library 
VBoxRT.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/bin/VBoxTestOGL - shared library 
VBoxREM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/bin/VBoxTestOGL - shared library 
VBoxVMM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/bin/VBoxTestOGL - shared library 
VBoxXPCOM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/bin/VBoxXPCOMIPCD - shared library 
VBoxXPCOM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/bin/VBoxXPCOMIPCD - shared library 
VBoxRT.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxAutostart - 
shared library VBoxRT.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxAutostart - 
shared library VBoxXPCOM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxBalloonCtrl - 
shared library VBoxRT.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxBalloonCtrl - 
shared library VBoxXPCOM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/
VBoxExtPackHelperApp - shared library VBoxRT.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxManage - shared 
library VBoxDDU.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxManage - shared 
library VBoxRT.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxManage - shared 
library VBoxXPCOM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxSVC - shared 
library VBoxDDU.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxSVC - shared 
library VBoxRT.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxSVC - shared 
library VBoxXPCOM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxTestOGL - 
shared library VBoxOGLhostcrutil.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxTestOGL - 
shared library VBoxRT.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxTestOGL - 
shared library VBoxREM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxTestOGL - 
shared library VBoxVMM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxTestOGL - 
shared library VBoxXPCOM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxXPCOMIPCD - 
shared library VBoxXPCOM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxXPCOMIPCD - 
shared library VBoxRT.so not found
#

___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: Still a problem with 'pkg check -Ba'

2013-03-26 Thread Walter Hurry
On Tue, 26 Mar 2013 19:13:04 +, Walter Hurry wrote:

 I hope Matthew Seaman sees this:
 
 All the files are of course present and correct in /usr/local/lib/
 virtualbox

snip code

Should have mentioned: This is pkg-1.0.9_2

___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: Still a problem with 'pkg check -Ba'

2013-03-26 Thread Matthew Seaman
On 26/03/2013 19:18, Walter Hurry wrote:
 On Tue, 26 Mar 2013 19:13:04 +, Walter Hurry wrote:
 
 I hope Matthew Seaman sees this:

 All the files are of course present and correct in /usr/local/lib/
 virtualbox
 
 snip code
 
 Should have mentioned: This is pkg-1.0.9_2

I see it.  There haven't been any changes to the shlib code in pkg-1.0.x
-- however, things have been improved in pkg-1.1.  Still not perfect though:

worm:...matthew/src/pkgng:# pkg check -B virtualbox-ose
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxAutostart -
shared library VBoxRT.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxAutostart -
shared library VBoxXPCOM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxBalloonCtrl -
shared library VBoxRT.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxBalloonCtrl -
shared library VBoxXPCOM.so not found
pkg: (virtualbox-ose-4.2.6)
/usr/local/lib/virtualbox/VBoxExtPackHelperApp - shared library
VBoxRT.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxManage -
shared library VBoxDDU.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxManage -
shared library VBoxRT.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxManage -
shared library VBoxXPCOM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxSVC - shared
library VBoxDDU.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxSVC - shared
library VBoxRT.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxSVC - shared
library VBoxXPCOM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxXPCOMIPCD -
shared library VBoxXPCOM.so not found
pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxXPCOMIPCD -
shared library VBoxRT.so not found

Still working on it...

Cheers,

Matthew




-- 
Dr Matthew J Seaman MA, D.Phil.

PGP: http://www.infracaninophile.co.uk/pgpkey
JID: matt...@infracaninophile.co.uk



signature.asc
Description: OpenPGP digital signature


Re: Client Authentication

2013-03-26 Thread Daniel O'Callaghan

On 27/03/2013 4:18 AM, Joseph Olatt wrote:

Any ideas/suggestions on this will be appreciated.  Thanks,

-- Doug

A little while back I wrote a system to do a simple Two Factor
Authentication and dynamic manipulation of PF (Packet Filter) Tables. I
created it to prevent brute-force attacks on the servers that I have
exposed on the Internet.
I'm happy to share a program I wrote which slows down the brute force 
attackers.
It simply counts the SYN packets from a given IP and limits the rate per 
minute by dropping the packet if they are coming too fast.


Uses ipfw divert sockets, so would work if you prefer ipfw over pf.

If you have a known set of OK IP addresses, you can allow them in ipfw 
rules before the packets get passed through ratelimit.


ratelimit usage:

-p size maximum packet size (default: 16384 bytes)
-d port divert port number (default: 1)
-r rate rate at which 50% of packets are dropped (default: 4)
-f rate rate at which 100% of packets are dropped (default: 8)
-l secs number of seconds to sleep between syslog() calls 
(default: 30)

-z path   path of pidfile (default: /var/run/ratelimit.pid)
-hthis message

Have you looked at simply using a non-standard port?

Danny
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: Still a problem with 'pkg check -Ba'

2013-03-26 Thread Matthew Seaman
On 26/03/2013 21:36, Matthew Seaman wrote:
 On 26/03/2013 19:18, Walter Hurry wrote:
 On Tue, 26 Mar 2013 19:13:04 +, Walter Hurry wrote:

 I hope Matthew Seaman sees this:

 All the files are of course present and correct in /usr/local/lib/
 virtualbox

 snip code

 Should have mentioned: This is pkg-1.0.9_2
 
 I see it.  There haven't been any changes to the shlib code in pkg-1.0.x
 -- however, things have been improved in pkg-1.1.  Still not perfect though:
 
 worm:...matthew/src/pkgng:# pkg check -B virtualbox-ose
 pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxAutostart -
 shared library VBoxRT.so not found
 pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxAutostart -
 shared library VBoxXPCOM.so not found
 pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxBalloonCtrl -
 shared library VBoxRT.so not found
 pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxBalloonCtrl -
 shared library VBoxXPCOM.so not found
 pkg: (virtualbox-ose-4.2.6)
 /usr/local/lib/virtualbox/VBoxExtPackHelperApp - shared library
 VBoxRT.so not found
 pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxManage -
 shared library VBoxDDU.so not found
 pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxManage -
 shared library VBoxRT.so not found
 pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxManage -
 shared library VBoxXPCOM.so not found
 pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxSVC - shared
 library VBoxDDU.so not found
 pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxSVC - shared
 library VBoxRT.so not found
 pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxSVC - shared
 library VBoxXPCOM.so not found
 pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxXPCOMIPCD -
 shared library VBoxXPCOM.so not found
 pkg: (virtualbox-ose-4.2.6) /usr/local/lib/virtualbox/VBoxXPCOMIPCD -
 shared library VBoxRT.so not found
 
 Still working on it...

Actually, fixed that problem and just pushed the commit to master...

worm:...matthew/src/pkgng:# pkg check -vB virtualbox-ose
Reanalyzing files for shlibs: virtualbox-ose
worm:...matthew/src/pkgng:# pkg info -B virtualbox-ose
virtualbox-ose-4.2.6:
libxml2.so.5
libvncserver.so.0
libssl.so.8
libpng15.so.15
libiconv.so.3
libcurl.so.6
libcrypto.so.8
VBoxXPCOM.so
VBoxVMM.so
VBoxRT.so
VBoxREM.so
VBoxDDU.so
VBoxDD2.so

Cheers,

Matthew

-- 
Dr Matthew J Seaman MA, D.Phil.

PGP: http://www.infracaninophile.co.uk/pgpkey
JID: matt...@infracaninophile.co.uk



signature.asc
Description: OpenPGP digital signature


Re: Client Authentication

2013-03-26 Thread Michael Ross
On Tue, 26 Mar 2013 22:56:37 +0100, Daniel O'Callaghan  
da...@clari.net.au wrote:



On 27/03/2013 4:18 AM, Joseph Olatt wrote:

Any ideas/suggestions on this will be appreciated.  Thanks,

-- Doug

A little while back I wrote a system to do a simple Two Factor
Authentication and dynamic manipulation of PF (Packet Filter) Tables. I
created it to prevent brute-force attacks on the servers that I have
exposed on the Internet.
I'm happy to share a program I wrote which slows down the brute force  
attackers.
It simply counts the SYN packets from a given IP and limits the rate per  
minute by dropping the packet if they are coming too fast.


Uses ipfw divert sockets, so would work if you prefer ipfw over pf.


Me Me Me! ...ahem.
I do prefer IPFW over PF and would very much like to try it out,
so please do share.

Regards,

Michael
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: Client Authentication

2013-03-26 Thread Daniel O'Callaghan

On 27/03/2013 10:37 AM, Michael Ross wrote:
I'm happy to share a program I wrote which slows down the brute force 
attackers.
It simply counts the SYN packets from a given IP and limits the rate 
per minute by dropping the packet if they are coming too fast.


Uses ipfw divert sockets, so would work if you prefer ipfw over pf.


Me Me Me! ...ahem.
I do prefer IPFW over PF and would very much like to try it out,
so please do share. 

OK, here 'tis

https://secure.clari.net.au/ratelimit2.tgz

Danny
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: Client Authentication

2013-03-26 Thread Michael Ross
On Wed, 27 Mar 2013 01:37:36 +0100, Daniel O'Callaghan  
da...@clari.net.au wrote:



On 27/03/2013 10:37 AM, Michael Ross wrote:
I'm happy to share a program I wrote which slows down the brute force  
attackers.
It simply counts the SYN packets from a given IP and limits the rate  
per minute by dropping the packet if they are coming too fast.


Uses ipfw divert sockets, so would work if you prefer ipfw over pf.


Me Me Me! ...ahem.
I do prefer IPFW over PF and would very much like to try it out,
so please do share.

OK, here 'tis

https://secure.clari.net.au/ratelimit2.tgz

Danny


Thanks!

I'd like to be able to change the time window:

http://gurder.ross.cx/misc/ratelimit.patch



Regards,

Michael
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org


Re: Client Authentication

2013-03-26 Thread Daniel O'Callaghan

On 27/03/2013 12:59 PM, Michael Ross wrote:

I'd like to be able to change the time window:

http://gurder.ross.cx/misc/ratelimit.patch

Neat.  Thanks for that.

Danny
___
freebsd-questions@freebsd.org mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-questions
To unsubscribe, send any mail to freebsd-questions-unsubscr...@freebsd.org