Re: unix hosting

2018-09-14 Thread Marc Peters
On Fri, Sep 14, 2018 at 11:00:04PM -0300, Friedrich Locke wrote:
> Dear OBSD friends,
> 
> right now i am hosting my site within geekisp. There i provided with a unix
> shell, using openbsd.
> 
> I am in need to change my hosting provider, may some here suggest an obsd
> hosting service that besides email, web (with php), mysql DBMS and unix
> shell ?
> 
> Of course, i am not looking for free service, just paid.
> 
> Thanks in advance.

There is OpenBSD Amsterdam https://openbsd.amsterdam. They provide
OpenBSD VMs, so you would need to do the configuration of the services
on your own.

hth,
Marc



unix hosting

2018-09-14 Thread Friedrich Locke
Dear OBSD friends,

right now i am hosting my site within geekisp. There i provided with a unix
shell, using openbsd.

I am in need to change my hosting provider, may some here suggest an obsd
hosting service that besides email, web (with php), mysql DBMS and unix
shell ?

Of course, i am not looking for free service, just paid.

Thanks in advance.


Re: Burr-Brown USB Audio Support

2018-09-14 Thread Stuart Henderson
On 2018-09-14, Mikko Laine  wrote:
> Greetings misc@,
>
> I have troubles getting my speakers with built-in DAC to work.
>
> After doing
>
> # rcctl set sndiod flags -f rsnd/1
> # rcctl restart sndiod
>
> I get
>
> uaudio_chan_open: error creating pipe: err=INVAL endpt=0x02
> audio1: failed to start playback
> uaudio_chan_open: error creating pipe: err=INVAL endpt=0x84
> audio1: failed to start recording
>
> in the dmesg and no sound. Thank you for any assistance.

To have a chance of working, you will need to use a kernel with xhci
disabled. It might need more than that as well. To test, "boot -c" at
the boot prompt, "disable xhci", "quit", You can modify an on-disk
kernel with "config -ef /bsd", or build your own with this diff.

Index: arch/amd64/conf/GENERIC
===
RCS file: /cvs/src/sys/arch/amd64/conf/GENERIC,v
retrieving revision 1.463
diff -u -p -r1.463 GENERIC
--- arch/amd64/conf/GENERIC 31 Aug 2018 00:09:13 -  1.463
+++ arch/amd64/conf/GENERIC 14 Sep 2018 23:07:51 -
@@ -195,7 +195,7 @@ cardbus*at cardslot?
 pcmcia*at cardslot?
 
 # USB Controllers
-xhci*  at pci? # eXtensible Host Controller
+xhci*  at pci? disable # eXtensible Host Controller
 ehci*  at pci? # Enhanced Host Controller
 ehci*  at cardbus? # Enhanced Host Controller
 uhci*  at pci? # Universal Host Controller (Intel)



Burr-Brown USB Audio Support

2018-09-14 Thread Mikko Laine
Greetings misc@,

I have troubles getting my speakers with built-in DAC to work.

After doing

# rcctl set sndiod flags -f rsnd/1
# rcctl restart sndiod

I get

uaudio_chan_open: error creating pipe: err=INVAL endpt=0x02
audio1: failed to start playback
uaudio_chan_open: error creating pipe: err=INVAL endpt=0x84
audio1: failed to start recording

in the dmesg and no sound. Thank you for any assistance.

Full dmesg follows:

OpenBSD 6.4-beta (GENERIC.MP) #292: Mon Sep 10 18:26:22 MDT 2018
dera...@amd64.openbsd.org:/usr/src/sys/arch/amd64/compile/GENERIC.MP
real mem = 1767649280 (1685MB)
avail mem = 1704886272 (1625MB)
mpath0 at root
scsibus0 at mpath0: 256 targets
mainbus0 at root
bios0 at mainbus0: SMBIOS rev. 3.0 @ 0xedd10 (49 entries)
bios0: vendor American Megatrends Inc. version "SEN2AR16" date
12/13/2017
bios0: iEi SEN2
acpi0 at bios0: rev 2
acpi0: sleep states S0 S3 S4 S5
acpi0: tables DSDT FACP APIC FPDT FIDT MCFG SSDT SSDT SSDT UEFI LPIT
CSRT
acpi0: wakeup devices BRC1(S0) XHC1(S3) HDEF(S4) PXSX(S4) RP01(S4)
PXSX(S4) RP02(S4) PXSX(S4) RP03(S4) PXSX(S4) RP04(S4) PWRB(S4)
acpitimer0 at acpi0: 3579545 Hz, 24 bits
acpimadt0 at acpi0 addr 0xfee0: PC-AT compat
cpu0 at mainbus0: apid 0 (boot processor)
cpu0: Intel(R) Celeron(R) CPU N3160 @ 1.60GHz, 1600.42 MHz, 06-4c-04
cpu0:
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,SSE4.1,SSE4.2,MOVBE,POPCNT,DEADLINE,AES,RDRAND,NXE,RDTSCP,LONG,LAHF,3DNOWP,PERF,ITSC,SMEP,ERMS,SENSOR,ARAT,MELTDOWN
cpu0: 1MB 64b/line 16-way L2 cache
cpu0: smt 0, core 0, package 0
mtrr: Pentium Pro MTRR support, 8 var ranges, 88 fixed ranges
cpu0: apic clock running at 80MHz
cpu0: mwait min=64, max=64, C-substates=0.2.0.0.0.0.3.3, IBE
cpu1 at mainbus0: apid 2 (application processor)
cpu1: Intel(R) Celeron(R) CPU N3160 @ 1.60GHz, 1600.00 MHz, 06-4c-04
cpu1:
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,SSE4.1,SSE4.2,MOVBE,POPCNT,DEADLINE,AES,RDRAND,NXE,RDTSCP,LONG,LAHF,3DNOWP,PERF,ITSC,SMEP,ERMS,SENSOR,ARAT,MELTDOWN
cpu1: 1MB 64b/line 16-way L2 cache
cpu1: smt 0, core 1, package 0
cpu2 at mainbus0: apid 4 (application processor)
cpu2: Intel(R) Celeron(R) CPU N3160 @ 1.60GHz, 1600.01 MHz, 06-4c-04
cpu2:
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,SSE4.1,SSE4.2,MOVBE,POPCNT,DEADLINE,AES,RDRAND,NXE,RDTSCP,LONG,LAHF,3DNOWP,PERF,ITSC,SMEP,ERMS,SENSOR,ARAT,MELTDOWN
cpu2: 1MB 64b/line 16-way L2 cache
cpu2: smt 0, core 2, package 0
cpu3 at mainbus0: apid 6 (application processor)
cpu3: Intel(R) Celeron(R) CPU N3160 @ 1.60GHz, 1600.00 MHz, 06-4c-04
cpu3:
FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CFLUSH,DS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE,SSE3,PCLMUL,DTES64,MWAIT,DS-CPL,VMX,EST,TM2,SSSE3,CX16,xTPR,PDCM,SSE4.1,SSE4.2,MOVBE,POPCNT,DEADLINE,AES,RDRAND,NXE,RDTSCP,LONG,LAHF,3DNOWP,PERF,ITSC,SMEP,ERMS,SENSOR,ARAT,MELTDOWN
cpu3: 1MB 64b/line 16-way L2 cache
cpu3: smt 0, core 3, package 0
ioapic0 at mainbus0: apid 1 pa 0xfec0, version 20, 115 pins
acpimcfg0 at acpi0
acpimcfg0: addr 0xe000, bus 0-255
acpiprt0 at acpi0: bus 0 (PCI0)
acpiprt1 at acpi0: bus 1 (RP01)
acpiprt2 at acpi0: bus 2 (RP02)
acpiprt3 at acpi0: bus -1 (RP03)
acpiprt4 at acpi0: bus -1 (RP04)
acpiec0 at acpi0: not present
acpicpu0 at acpi0: C1(@1 halt!)
acpicpu1 at acpi0: C1(@1 halt!)
acpicpu2 at acpi0: C1(@1 halt!)
acpicpu3 at acpi0: C1(@1 halt!)
acpipwrres0 at acpi0: ID3C, resource for ISP3
acpipwrres1 at acpi0: CLK0, resource for CAMD
acpipwrres2 at acpi0: CLK0, resource for CAM1
acpipwrres3 at acpi0: CLK1, resource for CAM2, CAM3
acpipwrres4 at acpi0: USBC, resource for XHC1
acpipwrres5 at acpi0: FN00, resource for FAN0
acpitz0 at acpi0: critical temperature is 95 degC
acpicmos0 at acpi0
"BCM2E64" at acpi0 not configured
"BCM4752" at acpi0 not configured
"SMO91D0" at acpi0 not configured
"INTCF1C" at acpi0 not configured
"ATML1000" at acpi0 not configured
"MSFT0002" at acpi0 not configured
acpibtn0 at acpi0: PWRB
acpibtn1 at acpi0: SLPB
"PNP0C0B" at acpi0 not configured
"PNP0C14" at acpi0 not configured
acpivideo0 at acpi0: GFX0
acpivout0 at acpivideo0: DD1F
pci0 at mainbus0 bus 0
pchb0 at pci0 dev 0 function 0 "Intel Braswell Host" rev 0x35
inteldrm0 at pci0 dev 2 function 0 "Intel HD Graphics" rev 0x35
drm0 at inteldrm0
inteldrm0: msi
inteldrm0: 1920x1200, 32bpp
wsdisplay0 at inteldrm0 mux 1: console (std, vt100 emulation)
wsdisplay0: screen 1-5 added (std, vt100 emulation)
ahci0 at pci0 dev 19 function 0 "Intel Braswell AHCI" rev 0x35: msi,
AHCI 1.3.1
ahci0: port 0: 3.0Gb/s
ahci0: PHY offline on port 1
scsibus1 at ahci0: 32 targets
sd0 at scsibus1 targ 0 lun 0:  SCSI3

Burr-Brown USB Audio Support

2018-09-14 Thread Mikko Laine
Greetings misc@,

I have troubles getting my speakers with built-in DAC to work.

After doing

# rcctl set sndiod flags -f rsnd/1
# rcctl restart sndiod

I get

uaudio_chan_open: error creating pipe: err=INVAL endpt=0x02
audio1: failed to start playback
uaudio_chan_open: error creating pipe: err=INVAL endpt=0x84
audio1: failed to start recording

in the dmesg and no sound. Thank you for any assistance.
-- 
  Mikko Laine
  http://mlaine.sdfeu.org/



Re: location of ~/.aucat_cookie

2018-09-14 Thread Alexandre Ratchov
On Fri, Sep 14, 2018 at 09:22:59PM +0200, Olivier Regnier wrote:
> Hi,
> 
> Is it possible to disable the '.aucat_cookie' file or change his location?
> 

This file was renamed to ~/.sndio/cookie in -current. It's necessary
to programs connecting to sndiod, so it can't be deleted unless sndiod
is stopped or no audio programs are used at all.

Out of curiosity, what's the problem with its old location?



location of ~/.aucat_cookie

2018-09-14 Thread Olivier Regnier

Hi,

Is it possible to disable the '.aucat_cookie' file or change his location?

--
Regards,
Olivier Regnier



Re: alien OSPF route

2018-09-14 Thread Remi Locherer
On Fri, Sep 14, 2018 at 03:48:36PM +0200, Marko Cupać wrote:
> On Fri, 14 Sep 2018 15:27:30 +0200
> Remi Locherer  wrote:
> 
> > Did you save the console output and daemon log from the restart?
> > Can you share it?
> 
> I restarted ospfd again with rcctl, console output gives just usual:
> 
> ospfd(ok)
> ospfd(ok)
> 
> The second one waiting a bit more than I remember it used to.
> 
> Here's ospfd-related stuff from daemon log:
> 
> Sep 14 15:40:58 nat1 ospfd[34802]: route decision engine exiting
> Sep 14 15:40:58 nat1 ospfd[73845]: ospf engine exiting
> Sep 14 15:40:58 nat1 ospfd[2242]: kernel routing table decoupled
> Sep 14 15:40:58 nat1 ospfd[2242]: terminating

At this point no IPv4 routes with priority 32 should exists on host nat1.
You can check this with "route -n show -priority 32". But according to the
following log entries there still where some. 

How many OSPF routes do you have on host nat1? Which OpenBSD version?
If I find the time I'll try to reproduce this.

> Sep 14 15:40:58 nat1 ospfd[55815]: startup
> Sep 14 15:40:58 nat1 ospfd[55815]: alien OSPF route 10.30.1.45/32
> Sep 14 15:40:58 nat1 ospfd[55815]: alien OSPF route 10.30.1.56/32
> Sep 14 15:40:58 nat1 ospfd[55815]: alien OSPF route 10.30.6.81/32
> Sep 14 15:40:58 nat1 ospfd[55815]: alien OSPF route 10.30.19.42/32
> 
> First three alien routes are on openbsd router two hops away, the last
> one is my laptop which is one hop away.
> 
> Could it be these are routes installed when someone connects through
> ssh? I am connected through ssh, and it is possible that my colleague
> also connected through ssh from 10.30.1.X and 10.30.6.X addresses.
> 
> > Would I be in charge of running this network I would want to know
> > where these alien routes come from. But I think it did not affect
> > your network badly since you did not mention an outage. ;-)
> 
> My point exactly :) If you have any idea where to start looking I'd be
> grateful for any tips.
> 
> Thank you for helping me with this.
> -- 
> Before enlightenment - chop wood, draw water.
> After  enlightenment - chop wood, draw water.
> 
> Marko Cupać
> https://www.mimar.rs/



Re: alien OSPF route

2018-09-14 Thread Marko Cupać
On Fri, 14 Sep 2018 15:27:30 +0200
Remi Locherer  wrote:

> Did you save the console output and daemon log from the restart?
> Can you share it?

I restarted ospfd again with rcctl, console output gives just usual:

ospfd(ok)
ospfd(ok)

The second one waiting a bit more than I remember it used to.

Here's ospfd-related stuff from daemon log:

Sep 14 15:40:58 nat1 ospfd[34802]: route decision engine exiting
Sep 14 15:40:58 nat1 ospfd[73845]: ospf engine exiting
Sep 14 15:40:58 nat1 ospfd[2242]: kernel routing table decoupled
Sep 14 15:40:58 nat1 ospfd[2242]: terminating
Sep 14 15:40:58 nat1 ospfd[55815]: startup
Sep 14 15:40:58 nat1 ospfd[55815]: alien OSPF route 10.30.1.45/32
Sep 14 15:40:58 nat1 ospfd[55815]: alien OSPF route 10.30.1.56/32
Sep 14 15:40:58 nat1 ospfd[55815]: alien OSPF route 10.30.6.81/32
Sep 14 15:40:58 nat1 ospfd[55815]: alien OSPF route 10.30.19.42/32

First three alien routes are on openbsd router two hops away, the last
one is my laptop which is one hop away.

Could it be these are routes installed when someone connects through
ssh? I am connected through ssh, and it is possible that my colleague
also connected through ssh from 10.30.1.X and 10.30.6.X addresses.

> Would I be in charge of running this network I would want to know
> where these alien routes come from. But I think it did not affect
> your network badly since you did not mention an outage. ;-)

My point exactly :) If you have any idea where to start looking I'd be
grateful for any tips.

Thank you for helping me with this.
-- 
Before enlightenment - chop wood, draw water.
After  enlightenment - chop wood, draw water.

Marko Cupać
https://www.mimar.rs/



Re: alien OSPF route

2018-09-14 Thread Remi Locherer
On Fri, Sep 14, 2018 at 10:07:35AM +0200, Marko Cupać wrote:
> On Thu, 13 Sep 2018 21:13:11 +0200
> Remi Locherer  wrote:
> 
> > On Thu, Sep 13, 2018 at 05:21:37PM +0200, Marko Cupać wrote:
> > > Hi,
> > > 
> > > I saw this in my log for the first time, after adding 'no
> > > redistribute default':
> > > 
> > > ospfd[10921]: alien OSPF route 10.30.1.47/32
> >
> > 
> > ospfd logs this message  when it sees a routing entry with priority 32
> > which it did not originate.
> 
> Thank you for clarification, Remi. Indeed, this firewall gets
> default route with priority of 32 from downstream cisco router, which
> is visible in routing table:

This is a different thing! ospfd learns the default route from another
router and installs it into the routing table with prio 32. Prio 32 is
the prio of OSPF in OpenBSD.

> Internet:
> Destination   Gateway  Flags   Refs  Use   Mtu  Prio Iface
> default   193.53.106.254   UGS 1187 10456064776 - 8 bnx1 
> default   192.168.225.6UG 00 -32 carp1

The route learned via ospf is not used in this case since you have a
static default route.

> > When you see this during the start of ospfd it could be from another
> > ospfd running in the same rdomain. I had this when I wanted to do a
> > config check but missed to option "-n" and started a second instance.
> > There is now a check for this in the startup of ospfd in -current.
> 
> Those addresses reported as alien routes are on subnet which is
> connected to another openbsd box, something like this:
> 
> openbsd---cisco---openbsd
> 
> All those three boxes talk OSPF. But on remote openbsd box which
> probably reports those routes, vlan interfaces for these subnets are
> set as passive, so they shouldn't get any updates even if someone ran
> OSPF on their phone.
> 
> > You will also see this message when you add a static route with the
> > "-priority 32". ospfd removes such routes after logging it.
> > 
> > What did you do after adding "no redistribute default" to the config
> > file? Restart with rcctl, reload with ospfctl?
> 
> Restart with rcctl.

Did you save the console output and daemon log from the restart?
Can you share it?

It could mean that the "old" ospfd did not properly clean up it's routes
and the "new" ospfd removed the routes from the "old" one.

> 
> > And why did you add "no redistribute default"? By default your default
> > route is not redistributed.
> 
> I thought this firewall's carp partner to-be was getting default route
> from it, but it doesn't - it gets it from downstream cisco router.
> 
> I don't see any negative effects on my network, just curious if I
> should be worried :)

Would I be in charge of running this network I would want to know where
these alien routes come from. But I think it did not affect your network
badly since you did not mention an outage. ;-)

> 
> Regards,
> -- 
> Before enlightenment - chop wood, draw water.
> After  enlightenment - chop wood, draw water.
> 
> Marko Cupać
> https://www.mimar.rs/



network architecture question

2018-09-14 Thread Marko Cupać
Hi,

for years I have been using setup with two firewalls: "outer" one -
FW1-BGP - connecting to upstream ISPs and talking BGP to them regarding
my DMZ, and "inner" one - FW2-NAT, doing NAT for my LAN.

ISP1   ISP2
  \ /
   [FW1-BGP]
   |
 (DMZ)
   |
   [FW2-NAT]
   |
 (LAN)

(Actually, it's more complicated due to each of the firewalls having
their CARP twin, but that shouldn't matter for my questions).

I'm considering moving to setup with just one firewall (ok, two,
because of CARP, once again it should not matter), which would connect
to upstream ISPs, DMZ and LAN.

ISP1   ISP2
  \ /
   [FW1-ALL]
  / \
(DMZ)  (LAN)

Any success / failure stories from admins who already went through
this? Any pitfalls I should avoid?

My main concern is the fact that in previous setup I could set up ip
aliases on DMZ interface on my NAT server, and redirect requests to
them to LAN hosts. This way I could switch ISPs and still access my LAN
hosts (via redirection) through same, DMZ ip addresses.

Will I still be able to do this in single firewall setup? I guess this
won't work:

pass in on $ext_if inet proto tcp from any to $dmz_ipaddr \
  rdr-to $lan_ipaddr

...assuming I am also doing NAT on $ext_if:

match out on $ext_if inet from any to any received-on $if_int \
  nat-to $ext_if

If I'm correct about above not working, is there a chance to achieve
the same goal by means of nc proxy? Or some other way? Any other things
I should be aware of?

Or should I just continue with my current two-firewall setup?

Thank you in advance,
-- 
Before enlightenment - chop wood, draw water.
After  enlightenment - chop wood, draw water.

Marko Cupać
https://www.mimar.rs/



Re: chrome 68 and protonmail

2018-09-14 Thread vincent delft
For your info ...
otter-browser is not working with protonmail.

But midori is working fine.

regards






On Fri, Sep 14, 2018 at 9:14 AM Tiemen Werkman 
wrote:

> > -Original Message-
> > From: owner-m...@openbsd.org [mailto:owner-m...@openbsd.org] On Behalf
> > Of vincent delft
> > Sent: Friday, September 14, 2018 7:39 AM
> > To: OpenBSD misc
> > Subject: chrome 68 and protonmail
> >
> > Hello,
> >
> > With the last version of Chrome (Chromium 68.0.3440.106) on -current, I
> > can
> > no more login in protonmail.
> >
> > In fact after the 2nd login screen chrome complains about an issue.
> >
> > By looking at the console, I see this message:
> > "
> > <--- Last few GCs --->
> >
> > [13615:0x1b00ec7000]19499 ms: Scavenge 28.5 (34.8) -> 28.0 (34.8)
> > MB,
> > 0.7 / 0.0 ms  (average mu = 1.000, current mu = 1.000) idle task
> > [13615:0x1b00ec7000]20552 ms: Scavenge 28.9 (34.8) -> 28.2 (34.8)
> > MB,
> > 4.9 / 0.2 ms  (average mu = 1.000, current mu = 1.000) idle task
> > [13615:0x1b00ec7000]24816 ms: Scavenge 29.1 (34.8) -> 28.3 (33.8)
> > MB,
> > 2.2 / 0.0 ms  (average mu = 1.000, current mu = 1.000) allocation
> > failure
> >
> >
> > <--- JS stacktrace --->
> >
> >  JS stack trace =
> >
> > 0: ExitFrame [pc: 0x30a55ec5c33d]
> > 1: InternalFrame [pc: 0x30a55ec1238c]
> > Security context: 0x2471c02cba29  > https://mail.protonmail.com>
> > 2: new constructor(aka u) [0x6ed0e8a85b9] [
> > https://mail.protonmail.com/openpgp.45fc464591fddb524fc0c8f83f781965944
> > 76934.js:2]
> > [bytecode=0x23c4aa2110b1 offset=84](this=0x17ad66748f99  > 0xa7fcf3b2669>,e=0x17ad66748f41 )
> > 3: ConstructFrame [pc: 0x3...
> >
> > "
> >
> > I've cleared cache, config, ... but the problem persist.
> >
> > Am I the only one having such problem ?
> >
> > Note: Firefox cannot work for protonmail because of javascript issue (I
> > do
> > not remember the exact problem).
> > Is there an another browser for protonmail ?
> >
> > regards
>
> Where is the latest version of chromium?
> I've just checked several mirrors and I can't seem to find it.
>
> Tiemen Werkman
>
>


Re: Running your own mail server

2018-09-14 Thread Craig Skinner
On Thu, 13 Sep 2018 09:24:18 +0200 Peter N. M. Hansteen wrote:
> The part about getting a static IP address with correct reverse
> lookup is truly essential. 

Yes, this hostmaster work is more important for deliverability than the
*optional* TLS & DKIM stuff, which I still don't bother at all with...

Along with correct DNS PTR records (and matching SMTP HELO hostname),
basic SPF & DMARC DNS records are almost essential to send.

With almost all inbound connections being spam, fighting that is the
main task of the postmaster. Aggressive spamd settings are needed here.

After that, the MTA needs to be able to check the DNS validity of the
sender's SMTP HELO hostname, and check their DNS PTR record is valid,
and both the mail's envelope and address from domains have MX records.

Most spam is sent by infected consumer devices, which do not have valid
reverse DNS, nor a valid HELO hostname. After greylisting, bad DNS is
the biggest indicator of spam. An MTA needs a lot of DNS knobs to tweak.

Following that, the sender's IP address needs to be checked against
multiple reliable DNS black and lists, and a cumulative score being
totalled up to decide to reject or pass on to the next stage of tests.

TLS & DKIM have very little value. The postmaster instead needs to work
closely with the hostmaster and concentrate on good DNS practice/tests.

Cheers,
-- 
Craig Skinner | http://linkd.in/yGqkv7



Re: alien OSPF route

2018-09-14 Thread Marko Cupać
On Thu, 13 Sep 2018 21:13:11 +0200
Remi Locherer  wrote:

> On Thu, Sep 13, 2018 at 05:21:37PM +0200, Marko Cupać wrote:
> > Hi,
> > 
> > I saw this in my log for the first time, after adding 'no
> > redistribute default':
> > 
> > ospfd[10921]: alien OSPF route 10.30.1.47/32
>
> 
> ospfd logs this message  when it sees a routing entry with priority 32
> which it did not originate.

Thank you for clarification, Remi. Indeed, this firewall gets
default route with priority of 32 from downstream cisco router, which
is visible in routing table:

Internet:
Destination   Gateway  Flags   Refs  Use   Mtu  Prio Iface
default   193.53.106.254   UGS 1187 10456064776 - 8 bnx1 
default   192.168.225.6UG 00 -32 carp1


> When you see this during the start of ospfd it could be from another
> ospfd running in the same rdomain. I had this when I wanted to do a
> config check but missed to option "-n" and started a second instance.
> There is now a check for this in the startup of ospfd in -current.

Those addresses reported as alien routes are on subnet which is
connected to another openbsd box, something like this:

openbsd---cisco---openbsd

All those three boxes talk OSPF. But on remote openbsd box which
probably reports those routes, vlan interfaces for these subnets are
set as passive, so they shouldn't get any updates even if someone ran
OSPF on their phone.

> You will also see this message when you add a static route with the
> "-priority 32". ospfd removes such routes after logging it.
> 
> What did you do after adding "no redistribute default" to the config
> file? Restart with rcctl, reload with ospfctl?

Restart with rcctl.

> And why did you add "no redistribute default"? By default your default
> route is not redistributed.

I thought this firewall's carp partner to-be was getting default route
from it, but it doesn't - it gets it from downstream cisco router.

I don't see any negative effects on my network, just curious if I
should be worried :)

Regards,
-- 
Before enlightenment - chop wood, draw water.
After  enlightenment - chop wood, draw water.

Marko Cupać
https://www.mimar.rs/



Re: IPv6 router advertisement rdns not working?

2018-09-14 Thread Janne Johansson
Den tors 13 sep. 2018 kl 18:49 skrev Mike Coddington :

> On Thu, Sep 13, 2018 at 06:15:28AM +0200, Sebastien Marie wrote:
> > On Wed, Sep 12, 2018 at 10:26:40PM -0500, Mike Coddington wrote:
> > >  However, if I decide to go with just IPv6 by
> > > simplifying my /etc/hostname.if file and using "inet6 autoconf" by
> > > itself, I cannot do any DNS lookups.
> > >
> > rad(8) has support for sending rdns information, but currently nothing
> > in base has support to get resolv.conf configured with such information.
>
> Good to know. I'll stop spinning my wheels. That might be a nice project
> for me to start tinkering with. Thank you!
>

Do mind that it is somewhat non-trivial to figure out a method of having
0,1,2,more
sources of resolver information that all want to update /etc/resolv.conf
when adding
or removing resolvers as your interfaces go up and down without stomping on
eachothers toes. But having code that gets the info from rad(8) would still
be a part
of that, so it would be interesting to have anyhow.

-- 
May the most significant bit of your life be positive.


Re: chrome 68 and protonmail

2018-09-14 Thread Tiemen Werkman
> -Original Message-
> From: owner-m...@openbsd.org [mailto:owner-m...@openbsd.org] On Behalf
> Of vincent delft
> Sent: Friday, September 14, 2018 7:39 AM
> To: OpenBSD misc
> Subject: chrome 68 and protonmail
> 
> Hello,
> 
> With the last version of Chrome (Chromium 68.0.3440.106) on -current, I
> can
> no more login in protonmail.
> 
> In fact after the 2nd login screen chrome complains about an issue.
> 
> By looking at the console, I see this message:
> "
> <--- Last few GCs --->
> 
> [13615:0x1b00ec7000]19499 ms: Scavenge 28.5 (34.8) -> 28.0 (34.8)
> MB,
> 0.7 / 0.0 ms  (average mu = 1.000, current mu = 1.000) idle task
> [13615:0x1b00ec7000]20552 ms: Scavenge 28.9 (34.8) -> 28.2 (34.8)
> MB,
> 4.9 / 0.2 ms  (average mu = 1.000, current mu = 1.000) idle task
> [13615:0x1b00ec7000]24816 ms: Scavenge 29.1 (34.8) -> 28.3 (33.8)
> MB,
> 2.2 / 0.0 ms  (average mu = 1.000, current mu = 1.000) allocation
> failure
> 
> 
> <--- JS stacktrace --->
> 
>  JS stack trace =
> 
> 0: ExitFrame [pc: 0x30a55ec5c33d]
> 1: InternalFrame [pc: 0x30a55ec1238c]
> Security context: 0x2471c02cba29  https://mail.protonmail.com>
> 2: new constructor(aka u) [0x6ed0e8a85b9] [
> https://mail.protonmail.com/openpgp.45fc464591fddb524fc0c8f83f781965944
> 76934.js:2]
> [bytecode=0x23c4aa2110b1 offset=84](this=0x17ad66748f99  0xa7fcf3b2669>,e=0x17ad66748f41 )
> 3: ConstructFrame [pc: 0x3...
> 
> "
> 
> I've cleared cache, config, ... but the problem persist.
> 
> Am I the only one having such problem ?
> 
> Note: Firefox cannot work for protonmail because of javascript issue (I
> do
> not remember the exact problem).
> Is there an another browser for protonmail ?
> 
> regards

Where is the latest version of chromium?
I've just checked several mirrors and I can't seem to find it.

Tiemen Werkman