Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Lars Noodén
Kevin Stam wrote: ... failed to satisfactorily explain why running a specific application in a VM is more secure then running it in a standard OS. It's nonsense that you think it's more secure that way. It saves a lot of money, yes -- you don't necessarily want a separate box just to run an

Re: Keyboard/Mouse problem OpenBSD 4.2

2007-10-25 Thread David H. Lynch Jr.
Peter Hessler wrote: try enabling acpi at the bootloader prompt.. boot -c enable acpi exit Thanks ! that did the trick. On 2007 Oct 24 (Wed) at 13:58:29 -0400 (-0400), David H. Lynch Jr. wrote: :I am trying to complete a new install of OpenBSD 4.2 on an HP :Pavillion dv8000. : :

Help needed to get PF working

2007-10-25 Thread Timo Myyrä
Hi, I'm currently trying to configure small home network: ADSL Server / Firewall Desktop Now I'm working on building a proper firewall to my server. So far the situation is following: - Servers internet connection works - Desktop receives IP, nameserver and default route from server's

Re: Failure starting Gnome - OpenBSD 4.2

2007-10-25 Thread David H. Lynch Jr.
Matthieu Herrb wrote: David H. Lynch Jr. wrote: I have tried to install Gnome on two different machines running OpenBSD 4.2. The first machine ran Gnome fine under OpenBSD 4.1 (though there were other problems) One both machines - fresh installs gdm starts I can attempt

Java problems on 4.1

2007-10-25 Thread Pawel Veselov
Since some time ago it became impossible to run JVMs on my 4.1 box. I can't seem to figure out what's wrong, probably something easy and stupid... [EMAIL PROTECTED] /usr/local/jdk-1.5.0/bin/java [1] 28689 [EMAIL PROTECTED] # # An unexpected error has been detected by HotSpot Virtual Machine: # #

Re: lookup option in /etc/resolv.conf ignored

2007-10-25 Thread Can Erkin Acar
Darrin Chandler wrote: On Wed, Oct 24, 2007 at 11:46:34PM -0400, Brian wrote: Make sure you have restarted Firefox after making changes to /etc/resolv.conf. Specifically, the application-level DNS cache will contain old data if you have not restarted it. This bit me for 3 minutes straight

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Richard Toohey
My analogies usually go to custard, but I'll try this one. You are in charge of getting four ambassadors to a meeting. As well as making sure they are happy and fed, you are in charge of their security. All four are hated in their home countries and you know their are people wanting to kill

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Richard Toohey
On 25/10/2007, at 8:28 PM, Richard Toohey wrote: My analogies usually go to custard, but I'll try this one. You are in charge of getting four ambassadors to a meeting. As well as making sure they are happy and fed, you are in charge of their security. All four are hated in their home

Re: Odd FFS behavior

2007-10-25 Thread Edd Barrett
Hi, On 22/10/2007, Edd Barrett [EMAIL PROTECTED] wrote: Hi there, I have an odd one for you here. Im trying to copy music from a hard disk(FFS) mounted on /mnt/media. I can play the music with mplayer just fine, but cp seems to refuse to believe that the files exist. Whats going on? I

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Lars Noodén
Richard Toohey wrote: My analogies usually go to custard, but I'll try this one. .. 1. One car per ambassador. ... With all four cars loaded onto a single car-carrier truck. -Lars

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Richard Toohey
On 25/10/2007, at 9:00 PM, Lars Noodin wrote: Richard Toohey wrote: My analogies usually go to custard, but I'll try this one. .. 1. One car per ambassador. ... With all four cars loaded onto a single car-carrier truck. -Lars Exactly! Have you made each of the ambassadors more secure by

Re: new dell install completed, but...

2007-10-25 Thread Richard Toohey
On 25/10/2007, at 4:35 PM, [EMAIL PROTECTED] wrote: thanks for the response. I'll give that a read, and a try. where are you getting 4.2? the web site only shows 4.1 as being released. metajunkie 4.2 - order it online (they've been REALLY good this year - took less than 2 weeks from

Re: Problem with disk size

2007-10-25 Thread Jon Sjöstedt
Please dont kill me :) I'm really not experienced with this kind of stuff. Maby this helps: $ sudo disklabel wd0 # Inside MBR partition 3: type A6 start 63 size 16514001 # /dev/rwd0c: type: ESDI disk: ESDI/IDE disk label: Maxtor 6L250R0 flags: bytes/sector: 512 sectors/track: 63 tracks/cylinder:

Odd msdos fs behaviour [was: Re: Odd FFS behavior]

2007-10-25 Thread David Vasek
On Thu, 25 Oct 2007, Edd Barrett wrote: The directory made has been truncated msdos style. a_frag~1. Therefore when cp tries to copy files into the new directory, it can't find the new filename. The workaround is to do something like this, with a shorter filename ---8--- # cp -R a_fragile_hope

Re: new dell install completed, but...

2007-10-25 Thread Joel Sing
On Thursday 25 October 2007, Richard Toohey wrote: On 25/10/2007, at 4:35 PM, [EMAIL PROTECTED] wrote: thanks for the response. I'll give that a read, and a try. where are you getting 4.2? the web site only shows 4.1 as being released. metajunkie 4.2 - order it online (they've

OpenBSD 4.2 RAIDFrame mirror

2007-10-25 Thread Dominik Zalewski
Dear All, I have a machine with two Maxtor 160GB hard disks. I've installed OpenBSD 4.2 on first one and I would like to use second one as a mirror. As far as I understood I will have to repartition and reinstall whole system to enable second disk as a mirror. All I want is to have software

Re: Problem with disk size

2007-10-25 Thread Tony Abernethy
Jon Sjvstedt wrote: Please dont kill me :) I'm really not experienced with this kind of stuff. Looks like you maybe cloned an 8GB disk to the 250GB disk and are now running out of space on the cloned file system. fdisk wd0 should give you the MS-DOS partitioning (what BIOS sees) 16383/16/63

Re: OpenBSD 4.2 RAIDFrame mirror

2007-10-25 Thread knitti
On 10/25/07, Dominik Zalewski [EMAIL PROTECTED] wrote: How to enable RAID 1 and sync first disk with second one without installing everthing from scratch like in those howtos? well, apart from the fact, that these howtos are a bit outdated, as usual, they do more or less describe what to do.

Re: Wake on LAN, tcpdump weirdness with two ethernet interfaces

2007-10-25 Thread Lars Noodén
Stijn wrote: What I would do to test this: -Connect another box with crossover cable to re0. -Run tcpdump on both systems (as root) -(optional: Play with fixed speed/duplex settings) -Launch a wol and see if it reaches the other system (you do specify the network to send it to?) Yep. WOL

Re: Odd FFS behavior

2007-10-25 Thread Lars Hansson
On 10/25/07, Edd Barrett [EMAIL PROTECTED] wrote: The workaround is to do something like this, with a shorter filename or make sure you have a long filename in the root directory of the partition or mount with -l. --- Lars Hansson

max number of groups

2007-10-25 Thread Alexey Vatchenko
Hi! I'm running an OpenBSD server with a lot of users and project groups. Each project has its own group or two to protect it's files from other users. As i know each user can have not greater than 16 groups. As the solution, i can change value of NGROUPS_MAX in sys/syslimits.h. But it requires

Hardware support for secure virtualization (was: About Xen: maybe a reiterative question but ..)

2007-10-25 Thread Rodrigo V. Raimundo
With all this discussion some questions went to me: what's the hardware needed to do full and secure (para)?virtualization ? is there some arch with this support ever created? could the virtualization environment be secure if all guest OSes run in userland? (User-Mode Linux, QEMU without

Re: Wake on LAN, tcpdump weirdness with two ethernet interfaces

2007-10-25 Thread Lars Noodén
Maxim Bourmistrov wrote: Some odd chipset, like SiS900 (sis0), do not wake up until your computer is in hibernated mode. This can be read from linux-driver. FYI: I have been playing with experimental WOL-patches for freebsd (partially ported them to openbsd) for 3COM-cards. Those cards

Re: Hardware support for secure virtualization (was: About Xen: maybe a reiterative question but ..)

2007-10-25 Thread Stuart Henderson
On 2007/10/25 08:50, Rodrigo V. Raimundo wrote: could the virtualization environment be secure if all guest OSes run in userland? (User-Mode Linux, QEMU without acceleration, ...) Some qemu bugs were specifically mentioned in the paper.

Re: Performance problem with CF card on AMD CS5536 IDE

2007-10-25 Thread Stefan Klein
Hardware: ALIX Board from PC Engines FreeBSD: dmesg: Copyright (c) 1992-2007 The FreeBSD Project. Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994 The Regents of the University of California. All rights reserved. FreeBSD is a registered trademark of The FreeBSD

QEMU /dev/tun issue with tun device number 3 (more than 4 guests)

2007-10-25 Thread Michael
Hi, I've tried to run 5 QEMU guests simultanously but when trying to start the 5th I'll get the following error message: warning: could not open /dev/tun7 (No such file or directory): no virtual network emulation Could not initialize device 'tap' I have no idea why it looks for /dev/tun7 but

Re: Odd FFS behavior

2007-10-25 Thread Edd Barrett
On 25/10/2007, Lars Hansson [EMAIL PROTECTED] wrote: On 10/25/07, Edd Barrett [EMAIL PROTECTED] wrote: The workaround is to do something like this, with a shorter filename or make sure you have a long filename in the root directory of the partition or mount with -l. Aha! great. Thanks for

Re: How can i boot a bsd.rd from windows 2000 ?

2007-10-25 Thread Christopher Bianchi
Alexander Hall wrote: Christopher Bianchi skrev: Hello everyone. My situation is this: i've a laptop, a Sharp pc-ax10 with Windows 2000 preinstalled , without cdrom, floppy. I wish install OpenBSD on it. Naturally bios can't boot from USB. So i've thinked to boot the bsd.rd , but how ? The

Re: Non-x86 (was: About Xen: maybe a reiterative question but ..)

2007-10-25 Thread ropers
On 24/10/2007, Lars Noodin [EMAIL PROTECTED] wrote: Seriously, what (affordable) non-x86 hardware options are available, especially those without AMT or AMT-like backdoors? http://softwarecommunity.intel.com/articles/eng/1148.htm

Re: QEMU /dev/tun issue with tun device number 3 (more than 4 guests)

2007-10-25 Thread Michael
Hi, thanks for your fast answer. Marcus Andree schrieb: Maybe you'll have to compile a new kernel. There's an options(4) option called tun. I had to add something like pseudo-device tun 16 I read something while googling for this issue that you had to add something like that for older

Re: QEMU /dev/tun issue with tun device number 3 (more than 4 guests)

2007-10-25 Thread Marcus Andree
On 10/25/07, Michael [EMAIL PROTECTED] wrote: Hi, I've tried to run 5 QEMU guests simultanously but when trying to start the 5th I'll get the following error message: warning: could not open /dev/tun7 (No such file or directory): no virtual network emulation Could not initialize device

Re: QEMU /dev/tun issue with tun device number 3 (more than 4 guests)

2007-10-25 Thread Marcus Andree
comments inline. On 10/25/07, Michael [EMAIL PROTECTED] wrote: Hi, thanks for your fast answer. Marcus Andree schrieb: Maybe you'll have to compile a new kernel. There's an options(4) option called tun. I had to add something like pseudo-device tun 16 I read something while

Re: QEMU /dev/tun issue with tun device number 3 (more than 4 guests)

2007-10-25 Thread Claudio Jeker
On Thu, Oct 25, 2007 at 10:37:32AM -0200, Marcus Andree wrote: On 10/25/07, Michael [EMAIL PROTECTED] wrote: Hi, I've tried to run 5 QEMU guests simultanously but when trying to start the 5th I'll get the following error message: warning: could not open /dev/tun7 (No such file or

Re: QEMU /dev/tun issue with tun device number 3 (more than 4 guests)

2007-10-25 Thread Claudio Jeker
On Thu, Oct 25, 2007 at 11:03:56AM -0200, Marcus Andree wrote: comments inline. On 10/25/07, Michael [EMAIL PROTECTED] wrote: Hi, thanks for your fast answer. Marcus Andree schrieb: Maybe you'll have to compile a new kernel. There's an options(4) option called tun. I had to add

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Douglas A. Tutty
On Wed, Oct 24, 2007 at 10:07:59PM -0500, Tony Abernethy wrote: only an idiot would think that separatey physical machines would NOT increase security Many IBM PCs vs IBM mainframe Apples and oranges. When people compare one box to many, they're talking about the same arch of box. We

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Douglas A. Tutty
On Thu, Oct 25, 2007 at 08:37:02PM +1300, Richard Toohey wrote: On 25/10/2007, at 8:28 PM, Richard Toohey wrote: You are in charge of getting four ambassadors to a meeting. As well as making sure they are happy and fed, you are in charge of their security. All four are hated in their

4.2/amd64 disklabel wrongly detects fat32 file system as 4.2BSD

2007-10-25 Thread Siju George
Hi, I noticed one problem with the disklabel output while installing 4.2 It automatically detected the file system in my first slice which is fat32 wrongly as 4.2BSD But fdisk detected it correctly during the install phase After the install I got inside the System to investigate. The file system

Re: Help needed to get PF working

2007-10-25 Thread Calomel
Timo, If this box is going to be a firewall and you expect to pass packets from one interface to the other you _MUST_ enable packet forwarding. Even if pf is setup correctly for your network, no packets will traverse between your internal and external networks unless packet forwarding is turned

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread L. V. Lammert
On Wed, 24 Oct 2007, Jason Dixon wrote: You apparently missed my post. Allow me to re-summarize the situation. No, I didn't. There is *nothing* in any virtualization software that makes having it *more secure* than not having it at all. Is that direct enough for you? No, because it's

4.2/amd64 cannot detect any CDROM even the one from which it was installed

2007-10-25 Thread Siju George
Hi, I installed OpenBSD 4.2 on CD on my amd64 that was running OpenBSD 4.0 fine. I tried to mount the sparc64 CDROM to copy ports.tgz But I get the following Error # mount_cd9660 /dev/cd0c /mnt/ mount_cd9660: /dev/cd0c on /mnt: No medium found # mount_cd9660 /dev/cd0c /mnt/ mount_cd9660:

Re: multimode fiber card recs for OpenBGPD

2007-10-25 Thread Jörg Streckfuß
Am Wed, 24 Oct 2007 22:25:32 +0200 schrieb Henning Brauer [EMAIL PROTECTED]: * N.J. Thomas [EMAIL PROTECTED] [2007-10-24 19:28]: I have two servers that I would like to setup to run OpenBGPD for our border routers. I need to find a supported PCIe (not PCI-X) fiber card that runs

HD access problems and Audio sounds too fast: (was Re: Keyboard/Mouse problem OpenBSD 4.2)

2007-10-25 Thread Alvaro Mantilla Gimenez
-BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, I have a HP Pavilion dv8000 too and, after install 4.2, i go back to 4.1. The audio on vlc, xine, xmms sounds too fast and cut from time to time (5-6 sec intervals)even playing internet radioand the HD access sucks. For example: i spent

Re: new dell install completed, but...::uhci* usb keyboard

2007-10-25 Thread metajunkie
thanks everyone. I got into kernel mode with the /bsd -c boot I saw in the dmsg that was residual on the failing boot screen that : uhci1: host controller halted I disabled uhci* while in kernel mode - and on exit from kernel mode, the system booted without error. However this device only has

Long line scrolling in ksh

2007-10-25 Thread Edd Barrett
Hi there, Is there a way to turn off the long line scrolling in ksh? I have been searching the manual, it mentions the feature, but does not indicate if you can turn it off. -- Best Regards Edd --- http://students.dec.bournemouth.ac.uk/ebarrett

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread L. V. Lammert
At 05:56 PM 10/24/2007 -0700, you wrote: L. V. Lammert [EMAIL PROTECTED] wrote: security issues and protections do not add up like numbers. Sure they do. If I'm running Windoze as a guest OS, there are hundreds or thousands of possible vulnerabilities. If I'm runng OBSD as a guest OS, guess

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Adam Getchell
On 10/24/07, Damien Miller [EMAIL PROTECTED] wrote: You obviously didn't read Tavis' virtualisation security paper. VM escape vulnerabilites are not theoretical. Tavis found vulnerabilities in every VM he tested using only a couple of fuzzers. Restating my earlier post again, in regards to

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread L. V. Lammert
At 09:46 PM 10/24/2007 -0400, you wrote: On 10/24/07, L. V. Lammert [EMAIL PROTECTED] wrote: Sorry, it's YOU that missed the point! I never said or made any comparison to physical machines - the entirety of that I said is: Running services/application domains in VMs increases security. As I

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread L. V. Lammert
At 09:53 PM 10/24/2007 -0400, you wrote: L. V. Lammert wrote: The more discrete the security model (i.e. File/Print users are not valid on the httpd server) the better. There's something I think you don't see here. Let's assume, for a moment, that you have a VM host running two guests, one

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread L. V. Lammert
At 09:15 PM 10/24/2007 -0700, you wrote: On 10/24/07, L. V. Lammert [EMAIL PROTECTED] wrote: I have no clue what you're trying to say??? The original comment was the the number of vulnerabilities is a inverse measure of the security risk associated with a given OS. Please stop feeding this

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread L. V. Lammert
At 09:57 PM 10/24/2007 -0400, you wrote: You apparently missed my post. Allow me to re-summarize the situation. There is *nothing* in any virtualization software that makes having it *more secure* than not having it at all. Is that direct enough for you? Perfectly clear, and I agree

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread L. V. Lammert
At 08:06 PM 10/24/2007 -0400, Brian wrote: Hi! I think you are missing the point about x86 hardware being a mess. No, I'm not. The discussion has nothing to do with hardware, but thanks for the info. Lee

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Stuart VanZee
What you're saying, appears to be: 1) 3 applications in one OS - less secure. 2) 3 applications in 3 physical servers - more secure 3) 3 applications in 3 virtual servers each running one OS - in between #1 and #2 for security Yes, indeed! What the others are telling you is that you are

Re: 4.2/amd64 disklabel wrongly detects fat32 file system as 4.2BSD

2007-10-25 Thread Theo de Raadt
I noticed one problem with the disklabel output while installing 4.2 It automatically detected the file system in my first slice which is fat32 wrongly as 4.2BSD disklabel does not automatically detect filesystem types. in the past, you have SPECIFICALLY said it was a 4.2 filesystem on that

Re: max number of groups

2007-10-25 Thread Theo de Raadt
I'm running an OpenBSD server with a lot of users and project groups. Each project has its own group or two to protect it's files from other users. As i know each user can have not greater than 16 groups. As the solution, i can change value of NGROUPS_MAX in sys/syslimits.h. But it

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread L. V. Lammert
At 12:01 PM 10/25/2007 +1000, Damien Miller wrote: On Wed, 24 Oct 2007, L. V. Lammert wrote: I still stand by my original statement. Running application 'domains' in VMs instead of on a single server increases security. It no worse security-wise to run applications on VMs rather than on the

Re: Network Time Synchronization using timed or ntpd or a Combination?

2007-10-25 Thread Boris Goldberg
Hello Brian, Wednesday, October 24, 2007, 3:28:36 PM, you wrote: B OpenNTPD runs as a 'daemon,' yes, but it does so using privilege B separation and other goodies. The network code runs as a normal user, B isolated from other users. This is superior to running rdate AS ROOT B from a cronjob.

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread L. V. Lammert
At 12:23 PM 10/25/2007 -0400, you wrote: On Oct 25, 2007, at 10:06 AM, L. V. Lammert [EMAIL PROTECTED] wrote: On Wed, 24 Oct 2007, Jason Dixon wrote: There is *nothing* in any virtualization software that makes having it *more secure* than not having it at all. Is that direct enough for

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Lars Hansson
On 10/25/07, L. V. Lammert [EMAIL PROTECTED] wrote: The 'obvious' security benefits were in two or three other posts, . but, to summarize: Separate UID/PWs for each domain/VM Uh, how else would it work? How is this specific to virtualization? Separate admin configurations tools See

Re: HD access problems and Audio sounds too fast: (was Re: Keyboard/Mouse problem OpenBSD 4.2)

2007-10-25 Thread Edd Barrett
Hi, On 25/10/2007, Alvaro Mantilla Gimenez [EMAIL PROTECTED] wrote: -BEGIN PGP SIGNED MESSAGE- Hash: SHA1 Hi, I have a HP Pavilion dv8000 too and, after install 4.2, i go back to 4.1. The audio on vlc, xine, xmms sounds too fast and cut from time to time (5-6 sec

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Tom Van Looy
I think you forgot to count power savings here? Theo de Raadt wrote: And when physical servers cost less than some vmware licenses Then it is even more dumb to defend such stupid practices.

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Jason Dixon
On Oct 25, 2007, at 10:06 AM, L. V. Lammert [EMAIL PROTECTED] wrote: On Wed, 24 Oct 2007, Jason Dixon wrote: There is *nothing* in any virtualization software that makes having it *more secure* than not having it at all. Is that direct enough for you? No, because it's wrong. You're full

Re: multimode fiber card recs for OpenBGPD

2007-10-25 Thread Henning Brauer
* J??rg Streckfu?? [EMAIL PROTECTED] [2007-10-25 16:16]: Just one question. If you terminate the wan fibre on a switch and put a redundant router behind it, the switch himself turns out to be a single point of failure, right? yes. Or do you have a second uplink which terminates on a second

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread L. V. Lammert
At 12:08 PM 10/25/2007 -0400, Stuart VanZee wrote: The reason that people are going to #2 is that, if you are concerned about security, that is the optimal way of setting things up. One box, one task. That is true separation. In this light, the question of if #3 is more secure than #1 is

Re: Network Time Synchronization using timed or ntpd or a Combination?

2007-10-25 Thread Chris Kuethe
On 10/25/07, Boris Goldberg [EMAIL PROTECTED] wrote: Thank you very much for that (valuable) reply! BTW, this is an argument for making an OpenNTPD ntpdate tool or adding one_time_synchronization functionality into ntpd. :) no, it's not making an argument for a one-shot sync attempt in

Re: Network Time Synchronization using timed or ntpd or a Combination?

2007-10-25 Thread Henning Brauer
* Boris Goldberg [EMAIL PROTECTED] [2007-10-25 18:57]: BTW, this is an argument for making an OpenNTPD ntpdate tool well, it is already there, it is called rdate. -- Henning Brauer, [EMAIL PROTECTED], [EMAIL PROTECTED] BS Web Services, http://bsws.de Full-Service ISP - Secure Hosting,

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread L. V. Lammert
At 12:23 PM 10/25/2007 -0400, Jason Dixon wrote: On Oct 25, 2007, at 10:06 AM, L. V. Lammert [EMAIL PROTECTED] wrote: On Wed, 24 Oct 2007, Jason Dixon wrote: There is *nothing* in any virtualization software that makes having it *more secure* than not having it at all. Is that direct

Re: Help needed to get PF working

2007-10-25 Thread Timo Myyrä
Ah, I forgot to mention that the packet forwarding is indeed enabled already. I checked the sample pf.conf on your webpage and edited it to change the interface names and commented the queue rules. I then loaded the rules with pfctl -f /etc/pf.new but still I could only access my server from

Load balancing

2007-10-25 Thread Manpreet Nehra
We have are planning to get for 2Mbps lines from the same ISP(their max). The lines will have different routers in front of them so they can be configuered to be in different networks. |--

Re: Help needed to get PF working

2007-10-25 Thread Jack J. Woehr
On Oct 25, 2007, at 11:58 AM, Timo Myyrd wrote: Any other ideas? Here's a dumb idea: In your posting, a lot of lines in your pf.conf file are wrapped. I *hope* that happened in email and isn't actually the case in the pf.conf file? One of those Sir, is the computer actually plugged in?

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Jason Dixon
On Thu, 25 Oct 2007 11:26:53 -0500, L. V. Lammert [EMAIL PROTECTED] wrote: At 12:23 PM 10/25/2007 -0400, you wrote: On Oct 25, 2007, at 10:06 AM, L. V. Lammert [EMAIL PROTECTED] wrote: On Wed, 24 Oct 2007, Jason Dixon wrote: There is *nothing* in any virtualization software that makes having

Re: Long line scrolling in ksh

2007-10-25 Thread Christian Weisgerber
Edd Barrett [EMAIL PROTECTED] wrote: Is there a way to turn off the long line scrolling in ksh? No. Why would you want to be unable to edit the start of a long line? -- Christian naddy Weisgerber [EMAIL PROTECTED]

Re: Help needed to get PF working

2007-10-25 Thread Timo Myyrä
Yeah, that was pretty much caused by the gmail account. The pf.conf I have on my server is formatted correctly. Timo Jack J. Woehr wrote: On Oct 25, 2007, at 11:58 AM, Timo Myyrd wrote: Any other ideas? Here's a dumb idea: In your posting, a lot of lines in your pf.conf file are wrapped.

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread richardtoohey
Quoting Douglas A. Tutty [EMAIL PROTECTED]: Problem: in your analogy, there is some limit to the number of bad guys before they become obvious to local law-enforcement. In the computer case, best to consider the number of bad guys unlimited; you can only limit the _rate_ at which they try to

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread L. V. Lammert
At 02:28 PM 10/25/2007 -0400, Jason Dixon wrote: Sure you do. You claim that the following statement is wrong, but you don't offer any explanation. That's crap. There is *nothing* in any virtualization software that makes having it *more secure* than not having it at all. Quit dodging

Re: Long line scrolling in ksh

2007-10-25 Thread Ted Unangst
On 10/25/07, Christian Weisgerber [EMAIL PROTECTED] wrote: Edd Barrett [EMAIL PROTECTED] wrote: Is there a way to turn off the long line scrolling in ksh? No. Why would you want to be unable to edit the start of a long line? i think he wants line wrapping instead of scrolling. i know i

openbsd routing and link down

2007-10-25 Thread Tony Sarendal
I'm testing openbsd and routing in a basic setup. router-01 and router-02 are access routers with dynamic routing, both connect to a lan where firewall-01 resides. Both router-01 and router-02 have a static route for the network behind firewall-01. router-01# cat /etc/hostname.em1 inet

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Stuart VanZee
L. V. Lammert: At 12:08 PM 10/25/2007 -0400, Stuart VanZee wrote: The reason that people are going to #2 is that, if you are concerned about .security, that is the optimal way of setting things up. One box, one task. That is true separation. In this light, the question of if #3 is more secure

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread L. V. Lammert
At 03:09 PM 10/25/2007 -0400, Stuart VanZee wrote: Quite frankly, I tire of your dumb-ass attitude. This was VERY ON TOPIC. Indeed it is! I also tire of the dumb replies that don't have any relationship to the original subject. Security for the applecation domain is a function of the

Re: Help needed to get PF working

2007-10-25 Thread Nico Meijer
Hi Timo, Yeah, that was pretty much caused by the gmail account. The pf.conf I have on my server is formatted correctly. Since we're on the subject of dumb ideas... What happens when you start over with only your NAT rule and slowly start adding the additional rules? So, start over, start

Re: Long line scrolling in ksh

2007-10-25 Thread Edd Barrett
On 25/10/2007, Ted Unangst [EMAIL PROTECTED] wrote: On 10/25/07, Christian Weisgerber [EMAIL PROTECTED] wrote: Edd Barrett [EMAIL PROTECTED] wrote: Is there a way to turn off the long line scrolling in ksh? No. Why would you want to be unable to edit the start of a long line? i

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Theo de Raadt
Certainly! That is not the point, however. The point is that users of OTHER 'application domains' have better security with a VM (or one of the other approaches discussed) because THEIR environment has no ability to interact ^

Re: Problem with raid 1 in server dell

2007-10-25 Thread José Christian Rodríguez
I apologize for saying it is not compatible but i don't know exactly what is the problem. I had another dell server running without problem, when it was replaced by the new server with a raid controller, gives these problems of inconsistency disk and freeze. Something that no comment was

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread L. V. Lammert
At 01:58 PM 10/25/2007 -0600, Theo de Raadt wrote: Certainly! That is not the point, however. The point is that users of OTHER 'application domains' have better security with a VM (or one of the other approaches discussed) because THEIR environment has no ability to interact

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Theo de Raadt
At 01:58 PM 10/25/2007 -0600, Theo de Raadt wrote: Certainly! That is not the point, however. The point is that users of OTHER 'application domains' have better security with a VM (or one of the other approaches discussed) because THEIR environment has no ability to interact

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Don Jackson
I wanted to add my 2 cents to this thread. Ignoring the debate/flamage on this thread regarding the security merits/risks of virtualization, I beleive there are a number of us who would like the option to run OpenBSD as a guest under various virtual machine frameworks. Even if it is less secure

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Jason Dixon
On Thu, Oct 25, 2007 at 01:45:23PM -0500, L. V. Lammert wrote: At 02:28 PM 10/25/2007 -0400, Jason Dixon wrote: Sure you do. You claim that the following statement is wrong, but you don't offer any explanation. That's crap. There is *nothing* in any virtualization software that makes

Re: 4.2/amd64 disklabel wrongly detects fat32 file system as 4.2BSD

2007-10-25 Thread Siju George
On 10/25/07, Theo de Raadt [EMAIL PROTECTED] wrote: I noticed one problem with the disklabel output while installing 4.2 It automatically detected the file system in my first slice which is fat32 wrongly as 4.2BSD disklabel does not automatically detect filesystem types. Thank you so

FW: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Stuart VanZee
I finally get it... LEE! YOU ARE A FUCKING GENIUS! Hey everyone... In Mr. Lammert's world, as long as NOBODY is trying to break the system, VMs give a HUGE security plus! Problem is, there are a lot of very bad motherfuckers out there who ARE trying to break the system. So, when someone

Re: Network Time Synchronization using timed or ntpd or a Combination?

2007-10-25 Thread Mark Zimmerman
On Thu, Oct 25, 2007 at 11:19:21AM -0500, Boris Goldberg wrote: Thank you very much for that (valuable) reply! BTW, this is an argument for making an OpenNTPD ntpdate tool or adding one_time_synchronization functionality into ntpd. :) From ntpd(8): -s Set the time

Re: Long line scrolling in ksh

2007-10-25 Thread Christian Weisgerber
Edd Barrett [EMAIL PROTECTED] wrote: Why would you want to be unable to edit the start of a long line? i think he wants line wrapping instead of scrolling. i know i do. :) Correct. So I guess you can't turn it off? No, you can't. And if you could, you would get something like csh's

Re: FW: About Xen: maybe a reiterative question but ..

2007-10-25 Thread L. V. Lammert
At 05:08 PM 10/25/2007 -0400, Stuart VanZee wrote: I finally get it... LEE! YOU ARE A FUCKING GENIUS! Beautiful! [Taking Bow]

Re: Network Time Synchronization using timed or ntpd or a Combination?

2007-10-25 Thread Boris Goldberg
Hello Mark, Thursday, October 25, 2007, 4:13:09 PM, you wrote: MZ On Thu, Oct 25, 2007 at 11:19:21AM -0500, Boris Goldberg wrote: Thank you very much for that (valuable) reply! BTW, this is an argument for making an OpenNTPD ntpdate tool or adding one_time_synchronization

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Travers Buda
* Don Jackson [EMAIL PROTECTED] [2007-10-25 13:33:29]: I wanted to add my 2 cents to this thread. Ignoring the debate/flamage on this thread regarding the security merits/risks of virtualization, I beleive there are a number of us who would like the option to run OpenBSD as a guest under

SUMMARY: Still unable to get Cyclades Z serial ports working with OpenBSD

2007-10-25 Thread Don Jackson
Hello, The OpenBSD web site states that Cyclades-Z series multiport serial cards are supported via the cz driver: Serial Ports Cyclades-Z series multiport serial boards (cz) (G) I am running OpenBSD 4.1 stable, on i386. I installed a Cyclades Ze PCI card, and hooked it up to the

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Daniel Ouellet
L. V. Lammert wrote: Certainly! That is not the point, however. The point is that users of OTHER 'application domains' have better security with a VM (or one of the other approaches discussed) because THEIR environment has no ability to interact with the OTHER environments. The digression into

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread bofh
On 10/25/07, Daniel Ouellet [EMAIL PROTECTED] wrote: So, if I take your point or 'applications domain' and and translate this in more practical term and stop using words out of the far fetch paper and use more pragmatic day to day example. You argue that in this case, if a setup is using VM

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Adam Getchell
On 10/25/07, Jason Dixon [EMAIL PROTECTED] wrote: On Thu, Oct 25, 2007 at 01:45:23PM -0500, L. V. Lammert wrote: At 02:28 PM 10/25/2007 -0400, Jason Dixon wrote: Sure you do. You claim that the following statement is wrong, but you don't offer any explanation. That's crap. There is

Re: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Adam Getchell
On 10/25/07, Theo de Raadt [EMAIL PROTECTED] wrote: You're also a sysadm who refuses to read a paper written by a google researcher, who's team found massive bugs in every VM. That's not quite correct. Restating (yet) again: 1. Ormandy [1] states that Xen's design is congruent with good

Re: FW: About Xen: maybe a reiterative question but ..

2007-10-25 Thread Piotrek Kapczuk
2007/10/25, L. V. Lammert [EMAIL PROTECTED]: At 05:08 PM 10/25/2007 -0400, Stuart VanZee wrote: I finally get it... LEE! YOU ARE A FUCKING GENIUS! [+] you mean security from those bad guys, apparently you are talking about security from the damn sheep who couldn't break the system if

Re: SUMMARY: Still unable to get Cyclades Z serial ports working with OpenBSD

2007-10-25 Thread Brian A Seklecki (Mobile)
On Thu, 2007-10-25 at 14:39 -0700, Don Jackson wrote: no channels at tached Well, no channels attached tells me its a hardware issue (cables`n`shit), or the software failing to properly probe the hardware. Does it work in another system under another platform (Linux LiveCD, etc.). I use

  1   2   >