Reduced network performance since installing 6.4

2018-11-04 Thread Colton Lewis
misc@,

Since installing 6.4, I have noticed a significant reduction in download speeds
during ordinary desktop use with my wifi adapter on the order of
a 75% decrease and a much greater frequency of stalled downloads.

I regret I am at a loss to describe the problem in much greater
detail, but I have
been tweaking system parameters and have discovered that setting
net.inet.tcp.always_keepalive=1 results in an improvement, gaining back much
of the lost performance.

Does anyone have an idea what my issue might be?

athn0 at pci6 dev 0 function 0 "Atheros AR9287" rev 0x01: apic 8 int 17
athn0: AR9287 rev 2 (2T2R), ROM rev 4, address c0:25:e9:10:9f:a7

-- 
Sincerely,
Colton Lewis



Re: Severe clock problems with OpenBSD VM on OpenBSD Host

2018-11-04 Thread trondd
On Sat, November 3, 2018 7:10 pm, Stefan Arentz wrote:
> Hi everyone,
>
> I am having an issue where an OpenBSD VM running on vmd is having
> serious clock skew issues.
>
> I am relatively new to OpenBSD, so I am not sure how to properly debug
> this. What I hope is that I can provide a good amount of data and folks
> here can give me some hints and ask me for additional information to
> get to the root cause of this.
>
> So first some facts and symptoms:
>
> - Both Host and Guest are running OpenBSD 6.4. The host runs GENERIC.MP
>   and the guest GENERIC.
> - The host runs 50 guests, all OpenBSD (openbsd.amsterdam)
> - Only this VM is having this clock issue (is this correct, or were
>   there others?)
>
> - The guest has kern.timecounter.hardware=tsc
> - The time on the VM was set with rdate a couple of days ago, and as of
>   now the VM is running about 4 hours behind.
> - ntpd is running (main process, dns engine, ntp engine)
> - when started or restarted, ntpd complains about "pipe write error
>   (from main): No such file or directory" but does seem to start
>
> - I just ran rdate nl.pool.ntp.org and the date was properly updated
> - One minute after running rdate, the clock is already 7 seconds slow
>
> - The guest also has some severe networking issues. often I cannot type
>   more than a few characters before a ~15 second delays happens.
>   Interactive typing is difficult.
> - I can SSH into the Host and have none of these issues, ruling out
>   connectivity issues between me (Toronto) and the Host (Amsterdam)
>
> It would be easy to blame this on NTPd, which does have an unexplained
> error message. However, I think even without running NTPd, the clock
> skew should not be this extreme.
>
> Somehow I have a gut feeling that the clock issues and the networking
> issues are related.
>
> I am root on the VM but I am not on the host. I do have vmctl access.
> However, the host admin is friendly (Hi Mischa) and is happy to help to
> debug this issue.
>
> I tried to ktrace ntpd to get more insight in the "pipe write error
> (from main): No such file or directory" error but I did not get useful
> info out of it. This may be because of my unfamiliarity with those
> tools.
>
> Help appreciated :-)
>
>  S.
>

VMM VMs do have clock issues.  tsc and ntpd should be enough, though (at
least with only a couple VMs it is).  Is ntpd doing anything?  what does
'ntpctl -sa' say?

I think that error is causing ntpd to exit (one of the child procs, if not
the whole thing).



Re: [OpenIKED] Is it impossible to differentiate the policies by dstid?

2018-11-04 Thread Aaron Mason
What happens when you remove quick from both policies?
On Mon, Nov 5, 2018 at 7:00 AM 雷致强  wrote:
>
> OpenIKED is so great when I use one policy for all users. However, I’m having 
> trouble when I try to apply different policies to different users.
> With iked.conf followed, iked seems to applies “blackjack” policy to incoming 
> connections only, which keeps the users of “redheart” out.
>
> ikev2 "blackjack" quick passive ipcomp esp \
> from 0.0.0.0/0 to 10.0.0.2 \
> local egress \
> ikesa enc aes-256 prf hmac-sha2-256 group curve25519 \
> childsa enc chacha20-poly1305 group curve25519 \
> dstid "blackjack.local" \
> psk "testpsk1" \
>
> ikev2 "redheart" quick passive ipcomp esp \
> from 0.0.0.0/0 to 172.16.0.0/24 \
> local egress \
> dstid "redheart.local" \
> psk "testpsk2" \
> config protected-subnet 0.0.0.0/0 \
> config address 172.16.0.0/24 \
> config netmask 255.255.255.0 \
> config name-server 8.8.8.8
>
> This is what happens when redheart.local connects to the responder. (I 
> replaced the IPs to redheart.local and asgard.local)
>
> # iked -dv
> set_policy: could not find pubkey for /etc/iked/pubkeys/fqdn/blackjack.local
> ikev2 "blackjack" quick passive esp inet from 0.0.0.0/0 to 10.0.0.2 local 
> asgard.local peer any ikesa enc aes-256 prf hmac-sha2-256 auth 
> hmac-sha2-256,hmac-sha1 group curve25519 childsa enc chacha20-poly1305 group 
> curve25519 dstid blackjack.local lifetime 10800 bytes 536870912 psk 
> 0x7465737470736b31
> set_policy: could not find pubkey for /etc/iked/pubkeys/fqdn/redheart.local
> ikev2 "redheart" quick passive esp inet from 0.0.0.0/0 to 172.16.0.0/24 local 
> asgard.local peer any ikesa enc aes-256,aes-192,aes-128,3des prf 
> hmac-sha2-256,hmac-sha1 auth hmac-sha2-256,hmac-sha1 group 
> modp2048,modp1536,modp1024 childsa enc aes-256,aes-192,aes-128 auth 
> hmac-sha2-256,hmac-sha1 dstid redheart.local lifetime 10800 bytes 536870912 
> psk 0x7465737470736b32 config protected-subnet 0.0.0.0 config address 
> 172.16.0.0 config netmask 255.255.255.0 config name-server 8.8.8.8
> ikev2_recv: IKE_SA_INIT request from initiator redheart.local:60970 to 
> asgard.local:500 policy 'blackjack' id 0, 604 bytes
> ikev2_sa_responder: no proposal chosen
> ikev2_msg_send: IKE_SA_INIT response from asgard.local:500 to 
> redheart.local:60970 msgid 0, 36 bytes
> sa_state: SA_INIT -> CLOSED from any to any policy 'blackjack'
> ikev2_recv: IKE_SA_INIT request from initiator redheart.local:60970 to 
> asgard.local:500 policy 'blackjack' id 0, 604 bytes
> ikev2_sa_responder: no proposal chosen
> ikev2_msg_send: IKE_SA_INIT response from asgard.local:500 to 
> redheart.local:60970 msgid 0, 36 bytes
> sa_state: SA_INIT -> CLOSED from any to any policy 'blackjack'
>
> If I remove the “quick” option of “blackjack” policy, all incoming connection 
> goes to “redheart” policy, which blocks “blackjack” users.
>
> Regarding to all the examples I saw, I guess dstid is not a condition to 
> match the policies? Only “peer” matters?
>


-- 
Aaron Mason - Programmer, open source addict
I've taken my software vows - for beta or for worse



Re: spamd and google smtp ips

2018-11-04 Thread Mik J
 Thank you Peter for this opinion.

Misc User, these gmail, live, yahoo spams you're talking about are really 
comming from IP addresses that belong to them ? Because on my side it seems 
it's not the case.

In my greylist right now I have rosaronald70s...@gmail.com but if I check the 
IP that originated the spam it's from China Unicom Henan province network. I 
check a second one and it's also from that ISP.

On the other hand if spam is coming from gmail, live, outlook we can blame them 
for not filtering out these spams and high volume sent mails.
With google you cannot send mails to more than 500 people within 24h
 

Le dimanche 4 novembre 2018 à 23:49:47 UTC+1, Misc User 
 a écrit :  
 
 On 11/4/2018 2:25 PM, Mik J wrote:
>  Hello Peter,
> 
> Thank you for this article.
> Do you know why, and particularly Microsoft, use very random IPs to send 
> mails.
> In that way, they make greylisting not as reliable as it should be. We could 
> all use greylisting if google or microsoft would use the same 4 or 5 IPs to 
> retry sending the mails.
> Google and Microsoft don't help to fight against spam.
> 

In my experience Google and Microsoft are the source of most of my spam.
About 80% of it comes from a hijacked gmail, live.com, or outlook.com
accounts.  The rest from yahoo and gmx.com addresses with a sprinkling
of one-off spam domains making up the last percentage points.
  


Re: spamd and google smtp ips

2018-11-04 Thread Misc User

On 11/4/2018 2:25 PM, Mik J wrote:

  Hello Peter,

Thank you for this article.
Do you know why, and particularly Microsoft, use very random IPs to send mails.
In that way, they make greylisting not as reliable as it should be. We could 
all use greylisting if google or microsoft would use the same 4 or 5 IPs to 
retry sending the mails.
Google and Microsoft don't help to fight against spam.



In my experience Google and Microsoft are the source of most of my spam.
About 80% of it comes from a hijacked gmail, live.com, or outlook.com
accounts.  The rest from yahoo and gmx.com addresses with a sprinkling
of one-off spam domains making up the last percentage points.



Re: spamd and google smtp ips

2018-11-04 Thread Peter N. M. Hansteen
On 11/4/18 11:25 PM, Mik J wrote:

> Do you know why, and particularly Microsoft, use very random IPs to send 
> mails.
> In that way, they make greylisting not as reliable as it should be. We could 
> all use greylisting if google or microsoft would use the same 4 or 5 IPs to 
> retry sending the mails.
> Google and Microsoft don't help to fight against spam.

The larger providers such as the ones you mention seem to have concluded
that they need to send their mail from a large number of different IP
addresses.

As long as they actually use only addresses they have published as valid
senders via their SPF info, we can let them bypass greylisting as
described in the article (or referenced material) and determining
whether any given message was spam becomes the task of other software
such as your favorite content filtering.

I would personally have preferred a clarification of the retry
requirement to specify 'retry from the same IP address', which would
have made greylisting *a lot* easier, but unfortunately that did not
happen (cf
https://bsdly.blogspot.com/2008/10/ietf-failed-to-account-for-greylisting.html).

Cheers,
Peter

-- 
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/
"Remember to set the evil bit on all malicious network traffic"
delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.



Re: spamd and google smtp ips

2018-11-04 Thread Mik J
 Hello Peter,

Thank you for this article.
Do you know why, and particularly Microsoft, use very random IPs to send mails.
In that way, they make greylisting not as reliable as it should be. We could 
all use greylisting if google or microsoft would use the same 4 or 5 IPs to 
retry sending the mails.
Google and Microsoft don't help to fight against spam.

Le dimanche 4 novembre 2018 à 21:56:35 UTC+1, Peter N. M. Hansteen 
 a écrit :  
 
 A final followup on this issue - I wrote a (relatively) short piece on
greylisting vs domains with multiple outbound SMTP servers, which
includes the little script I use to create a nospamd from a list of
domains, of course by feeding to 'smtpctl spf walk'.

You can find the article at
https://bsdly.blogspot.com/2018/11/goodness-enumerated-by-robots-or.html
- TL;DR: don't download *my* nospamd, use smtpctl to generate your own :)

All the best,
Peter
-- 
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/
"Remember to set the evil bit on all malicious network traffic"
delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.

  


Re: spamd and google smtp ips

2018-11-04 Thread Peter N. M. Hansteen
A final followup on this issue - I wrote a (relatively) short piece on
greylisting vs domains with multiple outbound SMTP servers, which
includes the little script I use to create a nospamd from a list of
domains, of course by feeding to 'smtpctl spf walk'.

You can find the article at
https://bsdly.blogspot.com/2018/11/goodness-enumerated-by-robots-or.html
- TL;DR: don't download *my* nospamd, use smtpctl to generate your own :)

All the best,
Peter
-- 
Peter N. M. Hansteen, member of the first RFC 1149 implementation team
http://bsdly.blogspot.com/ http://www.bsdly.net/ http://www.nuug.no/
"Remember to set the evil bit on all malicious network traffic"
delilah spamd[29949]: 85.152.224.147: disconnected after 42673 seconds.



[OpenIKED] Is it impossible to differentiate the policies by dstid?

2018-11-04 Thread 雷致强
OpenIKED is so great when I use one policy for all users. However, I’m having 
trouble when I try to apply different policies to different users.
With iked.conf followed, iked seems to applies “blackjack” policy to incoming 
connections only, which keeps the users of “redheart” out.

ikev2 "blackjack" quick passive ipcomp esp \
from 0.0.0.0/0 to 10.0.0.2 \
local egress \
ikesa enc aes-256 prf hmac-sha2-256 group curve25519 \
childsa enc chacha20-poly1305 group curve25519 \
dstid "blackjack.local" \
psk "testpsk1" \

ikev2 "redheart" quick passive ipcomp esp \
from 0.0.0.0/0 to 172.16.0.0/24 \
local egress \
dstid "redheart.local" \
psk "testpsk2" \
config protected-subnet 0.0.0.0/0 \
config address 172.16.0.0/24 \
config netmask 255.255.255.0 \
config name-server 8.8.8.8

This is what happens when redheart.local connects to the responder. (I replaced 
the IPs to redheart.local and asgard.local)

# iked -dv 
set_policy: could not find pubkey for /etc/iked/pubkeys/fqdn/blackjack.local
ikev2 "blackjack" quick passive esp inet from 0.0.0.0/0 to 10.0.0.2 local 
asgard.local peer any ikesa enc aes-256 prf hmac-sha2-256 auth 
hmac-sha2-256,hmac-sha1 group curve25519 childsa enc chacha20-poly1305 group 
curve25519 dstid blackjack.local lifetime 10800 bytes 536870912 psk 
0x7465737470736b31
set_policy: could not find pubkey for /etc/iked/pubkeys/fqdn/redheart.local
ikev2 "redheart" quick passive esp inet from 0.0.0.0/0 to 172.16.0.0/24 local 
asgard.local peer any ikesa enc aes-256,aes-192,aes-128,3des prf 
hmac-sha2-256,hmac-sha1 auth hmac-sha2-256,hmac-sha1 group 
modp2048,modp1536,modp1024 childsa enc aes-256,aes-192,aes-128 auth 
hmac-sha2-256,hmac-sha1 dstid redheart.local lifetime 10800 bytes 536870912 psk 
0x7465737470736b32 config protected-subnet 0.0.0.0 config address 172.16.0.0 
config netmask 255.255.255.0 config name-server 8.8.8.8
ikev2_recv: IKE_SA_INIT request from initiator redheart.local:60970 to 
asgard.local:500 policy 'blackjack' id 0, 604 bytes
ikev2_sa_responder: no proposal chosen
ikev2_msg_send: IKE_SA_INIT response from asgard.local:500 to 
redheart.local:60970 msgid 0, 36 bytes
sa_state: SA_INIT -> CLOSED from any to any policy 'blackjack'
ikev2_recv: IKE_SA_INIT request from initiator redheart.local:60970 to 
asgard.local:500 policy 'blackjack' id 0, 604 bytes
ikev2_sa_responder: no proposal chosen
ikev2_msg_send: IKE_SA_INIT response from asgard.local:500 to 
redheart.local:60970 msgid 0, 36 bytes
sa_state: SA_INIT -> CLOSED from any to any policy 'blackjack'

If I remove the “quick” option of “blackjack” policy, all incoming connection 
goes to “redheart” policy, which blocks “blackjack” users.

Regarding to all the examples I saw, I guess dstid is not a condition to match 
the policies? Only “peer” matters?



Re: Printer Epson WF-4630 with CUPS

2018-11-04 Thread Paolo Aglialoro
I have already run into this loop with other WorkForce Epson printers, for
some reason that PPD works on linux but not on obsd; the only comfortable
way out is buying a Postscript one, those ones ending in "90" like WF-xx90
models.

On Sun, Nov 4, 2018 at 4:45 PM  wrote:

> Hello,
>
> I am testing OpenBSD and am looking for documentation on how to add
> support for my printer.
>
> 1. My printer is an Epson WF-4630.
>
> 2. I installed CUPS with pkg_add.
>
> 3. I configured CUPS for this printer with "$ lynx localhost:631".
>Unsurprisingly there was no driver for this printer.
>
> 4. When using the driver "Epson 9-Pin Series (grayscale)"
>to print the default CUPS test page, the printer outputs
>a white page and the motor moving the paper sounds like the motor
>from a needle printer.
>
>My point is that CUPS can send something to the printer.
>
>"$ lpstat" did *not* show any jobs, although the printer reacted.
>
> 5. I got the "Epson-WF-4630_Series-epson-escpr-en.ppd" from
>the "epson-inkjet-printer-escpr-1.6.32-1lsb3.2.tar.gz" from
>the Epson Website after clicking on the link which semantically
>means "download drivers for Linux".
>As far as I know a .ppd file is a post script printer description
>file. I have the impression that the file depends solely on the
>printer and not on the operating system. (Please inform me
>in case you know this assumption is incorrect.)
>
> 6. CUPS now shows the driver
>"Model:
> [Current Driver - EPSON WF-4630 Series , Epson Inkjet Printer
> Driver (ESC/P-R) for Linux:]" (no line breaks)
> in the "Modify $printer" page but still shows the
> "Driver: Epson 9-Pin Series (grayscale)"
> on the EPSON_WF-4630_Series page.
> Note: This driver is still selected in the fifth step above
> although I selected a custom .ppd file.
>
> 7. I set the printer as the default printer with
>"$lpadmin -d $printer_machine_readable_name" and confirmed
>the change with "$lpoptions -l".
>
> 8. Printing the CUPS test page from the web interface leaves the
>printer idle. The job now shows up in "$ lpstat" and can also
>be cancelled with "$ cancel $job_id".
>
>
> Please, if anyone knows which documentation I should look at to get
> at the root of this problem or if anyone here has experience with
> setting up a driver for their own printer on OpenBSD, contact me.
>
>
>
> Greetings
>
> Andrew Easton
>
>


Re: Send midi to software

2018-11-04 Thread Alexandre Ratchov
On Sun, Nov 04, 2018 at 10:28:04AM -0500, Ken M wrote:
> As an alternative could I cat rmidi0 to midithru0?
> 

Yes. But we've no utility to do so in base, you could try to install
this one:

http://caoua.org/alex/obsd/midicat.tar.gz

Then do:

midicat -q rmidi/0 -q midithru/0

You could do that with the audio/midish port, but it's too
sophisticated to just move data from one port to another.



Re: Send midi to software

2018-11-04 Thread Ken M
On Sun, Nov 04, 2018 at 03:22:23PM +0100, Alexandre Ratchov wrote:
> IIRC, the lmms sndio-midi backend lacks the "device chooser dialog",
> so it uses "default" as midi device, which translates
> "midithru/0". Your controller is probably "rmidi/0", so lmms doesn't
> use it.
> 
> You could workaround this by redefining the "default" midi port,
> starting lmms as follows:
> 
>   MIDIDEVICE=rmidi/0 lmms
> 
> assuming "rmidi/0" is your midi controller. Patching the sndio-midi
> code to implement the "device chooser" seems to be the nicer option.

Setting MIDIDEVICE worked flawlessly, as a follow up.

Thank you

Ken



Printer Epson WF-4630 with CUPS

2018-11-04 Thread andrew
Hello, 

I am testing OpenBSD and am looking for documentation on how to add
support for my printer.

1. My printer is an Epson WF-4630.

2. I installed CUPS with pkg_add.

3. I configured CUPS for this printer with "$ lynx localhost:631".
   Unsurprisingly there was no driver for this printer.

4. When using the driver "Epson 9-Pin Series (grayscale)"
   to print the default CUPS test page, the printer outputs
   a white page and the motor moving the paper sounds like the motor
   from a needle printer.

   My point is that CUPS can send something to the printer.

   "$ lpstat" did *not* show any jobs, although the printer reacted.

5. I got the "Epson-WF-4630_Series-epson-escpr-en.ppd" from
   the "epson-inkjet-printer-escpr-1.6.32-1lsb3.2.tar.gz" from
   the Epson Website after clicking on the link which semantically
   means "download drivers for Linux".
   As far as I know a .ppd file is a post script printer description
   file. I have the impression that the file depends solely on the
   printer and not on the operating system. (Please inform me
   in case you know this assumption is incorrect.)

6. CUPS now shows the driver
   "Model:
[Current Driver - EPSON WF-4630 Series , Epson Inkjet Printer
Driver (ESC/P-R) for Linux:]" (no line breaks)
in the "Modify $printer" page but still shows the 
"Driver: Epson 9-Pin Series (grayscale)"
on the EPSON_WF-4630_Series page.
Note: This driver is still selected in the fifth step above
although I selected a custom .ppd file.

7. I set the printer as the default printer with
   "$lpadmin -d $printer_machine_readable_name" and confirmed
   the change with "$lpoptions -l". 

8. Printing the CUPS test page from the web interface leaves the
   printer idle. The job now shows up in "$ lpstat" and can also
   be cancelled with "$ cancel $job_id".


Please, if anyone knows which documentation I should look at to get
at the root of this problem or if anyone here has experience with
setting up a driver for their own printer on OpenBSD, contact me.



Greetings

Andrew Easton



Re: Send midi to software

2018-11-04 Thread Ken M
As an alternative could I cat rmidi0 to midithru0?

I will look into patching lmms as well. 

Sent from my iPad

> On Nov 4, 2018, at 9:22 AM, Alexandre Ratchov  wrote:
> 
>> On Sat, Nov 03, 2018 at 02:26:59PM -0400, Ken M wrote:
>> So I am sure I am missing something stupid. Just the first time I have tried 
>> a
>> midi controller with openbsd.
>> 
>> So the device shows in the dmesg
>> a hexdump shows I am receiving sounds
>> but in lmms even with a device set to receive midi, nothing happens.
>> 
>> And yes sound is coming from lmms.
>> 
>> I am guessing there is something obvious I am missing. lmms is set to 
>> sndio-midi
>> in the preferences.
>> 
> 
> IIRC, the lmms sndio-midi backend lacks the "device chooser dialog",
> so it uses "default" as midi device, which translates
> "midithru/0". Your controller is probably "rmidi/0", so lmms doesn't
> use it.
> 
> You could workaround this by redefining the "default" midi port,
> starting lmms as follows:
> 
>MIDIDEVICE=rmidi/0 lmms
> 
> assuming "rmidi/0" is your midi controller. Patching the sndio-midi
> code to implement the "device chooser" seems to be the nicer option.



Re: OpenBSD terminals and ligatures

2018-11-04 Thread Philippe
On 04/11/2018 12:18, Roman Zolotarev wrote:
> No sure about konsole, but take a look at this blog post by Wesley Moore:
> http://www.wezm.net/technical/2017/12/a-killer-linux-gui-for-neovim-neovimgtk/


Hello,


this doesn't seem to help. From what I understood from the blog, it's
very neovimGTK-related. I don't want to change my entire working
environment here. I want to install some fonts that should be available
on many terminals.

I do know that konsole is fine with ligatures. I can use another one,
don't really care. But I do want it to be available on the entire
terminal, not just for programming stuff.


Thanks,
-- 
Philippe



Re: Send midi to software

2018-11-04 Thread Alexandre Ratchov
On Sat, Nov 03, 2018 at 02:26:59PM -0400, Ken M wrote:
> So I am sure I am missing something stupid. Just the first time I have tried a
> midi controller with openbsd.
> 
> So the device shows in the dmesg
> a hexdump shows I am receiving sounds
> but in lmms even with a device set to receive midi, nothing happens.
> 
> And yes sound is coming from lmms.
> 
> I am guessing there is something obvious I am missing. lmms is set to 
> sndio-midi
> in the preferences.
> 

IIRC, the lmms sndio-midi backend lacks the "device chooser dialog",
so it uses "default" as midi device, which translates
"midithru/0". Your controller is probably "rmidi/0", so lmms doesn't
use it.

You could workaround this by redefining the "default" midi port,
starting lmms as follows:

MIDIDEVICE=rmidi/0 lmms

assuming "rmidi/0" is your midi controller. Patching the sndio-midi
code to implement the "device chooser" seems to be the nicer option.



Re: what would a POP3s daemon best look like?

2018-11-04 Thread Walter Alejandro Iglesias
On Sun, Nov 04, 2018 at 05:38:42AM -0700, Todd C. Miller wrote:
> On Sun, 04 Nov 2018 12:26:27 +0100, Walter Alejandro Iglesias wrote:
> 
> > I've been assuming that running pop3d(8) from ports, listening in 995
> > only and with 110 port firewalled my passwords aren't traveling in plain
> > text.  Am I assuming right?
> 
> Port 995 is pop3 protocol over TLS/SSL so that should be safe enough.

Then, as an idea for Peter,

Time ago I sent a patch to Sunil Nimmagadda to allow pop3d read an
optional certs location, he corrected and committed the patch.  In that
opportunity he mentioned me that he wasn't hacking pop3d anymore since
he himself stopped using it because he considered it severely limited.
Personally I like simplicity, I still use pop3d(8) but I'm not a
developer, I'm not skilled enough to hack it and maintain it.

If Peter is willing to, perhaps pop3d(8) could be a good start point.

If allowing pop connections by default through 110 port is not desirable
perhaps it would be fine to implement an only TLS pop3 daemon
(deliberately refusing non TLS connections over 110).  In case this is
possible, that would be a fine simple and secure pop3 daemon for OpenBSD
base.

> 
>  - todd

Walter



Re: what would a POP3s daemon best look like?

2018-11-04 Thread Todd C. Miller
On Sun, 04 Nov 2018 12:26:27 +0100, Walter Alejandro Iglesias wrote:

> I've been assuming that running pop3d(8) from ports, listening in 995
> only and with 110 port firewalled my passwords aren't traveling in plain
> text.  Am I assuming right?

Port 995 is pop3 protocol over TLS/SSL so that should be safe enough.

 - todd



Re: what would a POP3s daemon best look like?

2018-11-04 Thread Walter Alejandro Iglesias
Hi Todd,

Not an expert here and just to be sure, :-)

In article <21bf906b4c6c6...@sudo.ws> Todd C. Miller  
wrote:
> I don't think there is much interest in having a pop3 daemon in
> base due to the use of plain-text passwords

I've been assuming that running pop3d(8) from ports, listening in 995
only and with 110 port firewalled my passwords aren't traveling in plain
text.  Am I assuming right?


Walter



Re: heap full during amd64 boot.

2018-11-04 Thread Angelo Rossi
I agree with you. I already have fixed this crazy partitioning scheme on
other machines. I would never use such configuration on production
machines, but these were merely tests with limited resources PCs (< 500 GB
HDs). So my idea in respect the boot loader is not to add checks since it
is a matter of configuration: changing the HEAP_SIZE worked, but again if
this is not the intended behavior is good to know. Surely the problem
arisen from the fact that memory resources became smaller introducing EFI
on amd64 and the partitioning scheme did the rest. Thanks for the answer!


Re: OpenBSD terminals and ligatures

2018-11-04 Thread Roman Zolotarev
Hi Philippe,

> I would like to install a font (Fira Code), with ligatures.

No sure about konsole, but take a look at this blog post by Wesley Moore:
http://www.wezm.net/technical/2017/12/a-killer-linux-gui-for-neovim-neovimgtk/



Re: Persistent flags for disabled daemons?

2018-11-04 Thread John Long
On Sun, 2018-11-04 at 03:57 +0100, Klemens Nanni wrote:
> On Sun, Nov 04, 2018 at 12:41:17AM +, John Long wrote:
> > If I use rcctl set to set minidlna's flags to -R it seems it will
> > only
> > allow me to do it when minidlna is enabled. I would like the flags
> > to
> > survive disablement because I don't want to start the minidlna
> > server
> > every time the box comes up.
> 
> Settings flags for disabled daemons is not possible as rcctl tells
> you.
> 
> Keeping flags when disabling daemons with rcctl is currently not
> possible.  The only way to do so is by commenting the rc.conf.local
> line
> manually.

Hi,

rcctl does not seem to respect the flag in rc.conf.local, so I don't
understand how it would help to comment it out. If I have a flag
specified in rc.conf.local it does not seem to be respected when I
start the daemon using rcctl.

It seems like it would make sense for the status of the daemon
(enabled/disabled) to be separate from the flags.

/jl





Problem installing port ruby24-passenger / nginx

2018-11-04 Thread Mik J
Hello,

It's been a few releases that I noticed I can't install nginx from the ports.
The problem is not nginx itself but the package ruby24-passenger-5.1.11p0

I make install in the nginx port directory, I get the crash messages below.
mv: 
/usr/ports/pobj/passenger-5.1.11-ruby24/gem-tmp/.gem/ruby/2.4/gems/passenger-5.1.11/src/.passenger/support-binaries/5.1.11/*:
 No such file or directory

I install ruby24-passenger-5.1.11p0 with pkg_add and I restart to install in 
the nginx port directory. That's my workaround.

The problem is present from at least 6.2

checking for alloca.h... no
checking for ruby/version.h... yes
checking for ruby/io.h... yes
checking for ruby/thread.h... yes
checking for ruby_version... no
checking for rb_thread_io_blocking_region() in ruby/io.h... yes
checking for rb_thread_call_without_gvl() in ruby/thread.h... yes
creating Makefile
cd 'buildout/ruby/ruby-2.4.4-x86_64-openbsd6.4/' && make
compiling 
/usr/ports/pobj/passenger-5.1.11-ruby24/gem-tmp/.gem/ruby/2.4/gems/passenger-5.1.11/src/ruby_native_extension/passenger_native_support.c
linking shared-object passenger_native_support.so
rm -r 
/usr/ports/pobj/passenger-5.1.11-ruby24/gem-tmp/.gem/ruby/2.4/gems/passenger-5.1.11/nginx-1.12.1
  
/usr/ports/pobj/passenger-5.1.11-ruby24/gem-tmp/.gem/ruby/2.4/gems/passenger-5.1.11/bin/passenger-install-*-module
  
/usr/ports/pobj/passenger-5.1.11-ruby24/gem-tmp/.gem/ruby/2.4/bin/passenger-install-*-module*
mv 
/usr/ports/pobj/passenger-5.1.11-ruby24/gem-tmp/.gem/ruby/2.4/gems/passenger-5.1.11/src/.passenger/support-binaries/5.1.11/*
  
/usr/ports/pobj/passenger-5.1.11-ruby24/gem-tmp/.gem/ruby/2.4/gems/passenger-5.1.11/buildout/support-binaries/
mv: 
/usr/ports/pobj/passenger-5.1.11-ruby24/gem-tmp/.gem/ruby/2.4/gems/passenger-5.1.11/src/.passenger/support-binaries/5.1.11/*:
 No such file or directory
*** Error 1 in /usr/ports/www/ruby-passenger (Makefile:69 'post-build')
*** Error 1 in /usr/ports/www/ruby-passenger 
(/usr/ports/infrastructure/mk/bsd.port.mk:2761 
'/usr/ports/pobj/passenger-5.1.11-ruby24/.build_done')
*** Error 1 in /usr/ports/www/ruby-passenger 
(/usr/ports/infrastructure/mk/bsd.port.mk:2003 
'/usr/ports/packages/amd64/all/ruby24-passenger-5.1.11p2.tgz')
*** Error 1 in /usr/ports/www/ruby-passenger 
(/usr/ports/infrastructure/mk/bsd.port.mk:2465 '_internal-package')
*** Error 1 in /usr/ports/www/ruby-passenger 
(/usr/ports/infrastructure/mk/bsd.port.mk:2444 'package')
*** Error 1 in /usr/ports/www/ruby-passenger 
(/usr/ports/infrastructure/mk/bsd.port.mk:2021 
'/var/db/pkg/ruby24-passenger-5.1.11p2/+CONTENTS')
*** Error 1 in /usr/ports/www/ruby-passenger 
(/usr/ports/infrastructure/mk/bsd.port.mk:2444 'install')
*** Error 1 in . (/usr/ports/infrastructure/mk/bsd.port.mk:2132 
'/usr/ports/pobj/nginx-1.14.0/.dep-ruby24-passenger-ANY-www-ruby-passenger')
*** Error 1 in . (/usr/ports/infrastructure/mk/bsd.port.mk:2523 
'/usr/ports/pobj/nginx-1.14.0/.extract_done')
*** Error 1 in . (/usr/ports/infrastructure/mk/bsd.port.mk:2003 
'/usr/ports/packages/amd64/all/nginx-1.14.0p1.tgz')
*** Error 1 in . (/usr/ports/infrastructure/mk/bsd.port.mk:2465 
'_internal-package')
*** Error 1 in . (/usr/ports/infrastructure/mk/bsd.port.mk:2444 'package')
*** Error 1 in . (/usr/ports/infrastructure/mk/bsd.port.mk:2021 
'/var/db/pkg/nginx-1.14.0p1/+CONTENTS')
*** Error 1 in /usr/ports/www/nginx 
(/usr/ports/infrastructure/mk/bsd.port.mk:2444 'install')

Regards


Re: Persistent flags for disabled daemons?

2018-11-04 Thread John Long
On Sun, 2018-11-04 at 10:46 +0100, Antoine Jacoutot wrote:
> On Sun, Nov 04, 2018 at 03:57:30AM +0100, Klemens Nanni wrote:
> > On Sun, Nov 04, 2018 at 12:41:17AM +, John Long wrote:
> > > If I use rcctl set to set minidlna's flags to -R it seems it will
> > > only
> > > allow me to do it when minidlna is enabled. I would like the
> > > flags to
> > > survive disablement because I don't want to start the minidlna
> > > server
> > > every time the box comes up.
> > 
> > Settings flags for disabled daemons is not possible as rcctl tells
> > you.
> > 
> > Keeping flags when disabling daemons with rcctl is currently not
> > possible.  The only way to do so is by commenting the rc.conf.local
> > line
> > manually.
> 
> Note that it would be easy for rcctl to save the flags (basically
> only remove
> minidlna from the pkg_scripts variable). But that would make the
> behavior
> inconsistent with how base rc.d scripts behave. When you disable a
> base script,
> you must remove the foo_flags from rc.conf.local (and can't retain
> the flags).
> I prefer to have a consistent behavior, this is why rcctl works this
> way.

I did not understand why it worked this way. Thanks for the
explanation!

/jl




Re: Persistent flags for disabled daemons?

2018-11-04 Thread Antoine Jacoutot
On Sun, Nov 04, 2018 at 03:57:30AM +0100, Klemens Nanni wrote:
> On Sun, Nov 04, 2018 at 12:41:17AM +, John Long wrote:
> > If I use rcctl set to set minidlna's flags to -R it seems it will only
> > allow me to do it when minidlna is enabled. I would like the flags to
> > survive disablement because I don't want to start the minidlna server
> > every time the box comes up.
> Settings flags for disabled daemons is not possible as rcctl tells you.
> 
> Keeping flags when disabling daemons with rcctl is currently not
> possible.  The only way to do so is by commenting the rc.conf.local line
> manually.

Note that it would be easy for rcctl to save the flags (basically only remove
minidlna from the pkg_scripts variable). But that would make the behavior
inconsistent with how base rc.d scripts behave. When you disable a base script,
you must remove the foo_flags from rc.conf.local (and can't retain the flags).
I prefer to have a consistent behavior, this is why rcctl works this way.

-- 
Antoine