Re: PF Seems To Reload Its Default Rules Unexpectedly

2009-03-21 Thread Henning Brauer
* J.C. Roberts list-...@designtools.org [2009-03-21 09:54]: On Fri, 20 Mar 2009 20:16:32 +0100 Henning Brauer lists-open...@bsws.de wrote: * J.C. Roberts list-...@designtools.org [2009-03-10 02:03]: The smart answer for an ISP is moving to IPv6 that is about the least smart thing

Re: PF Seems To Reload Its Default Rules Unexpectedly

2009-03-21 Thread J.C. Roberts
On Fri, 20 Mar 2009 20:16:32 +0100 Henning Brauer lists-open...@bsws.de wrote: * J.C. Roberts list-...@designtools.org [2009-03-10 02:03]: The smart answer for an ISP is moving to IPv6 that is about the least smart thing anybody could do. Hi Henning, If everyone continues to avoid IPv6,

Re: Install freezes on macppc

2009-03-21 Thread J.C. Roberts
On Fri, 20 Mar 2009 15:39:24 -0400 (EDT) Daniel Barowy dbar...@barowy.net wrote: Needless to say, getting an operating system to play nice with firmware that is in an unknown patch state is a major pain in the ass. The first thing you should try is getting the OpenBSD 4.5-current ISO

Re: prioritizing carp interfaces

2009-03-21 Thread Toni Mueller
Hi, On Fri, 20.03.2009 at 14:28:46 +0100, Joerg Streckfuss streckf...@dfn-cert.de wrote: How does CARP behaves when on the master node two unimportantly interfaces fail and on the backup node only the uplink interface fails? Does CARP failover to the backup node and as consequence the whole

Re: arp MiTM

2009-03-21 Thread Henning Brauer
* irix i...@ukr.net [2009-03-09 17:40]: Sorry, if I been rude. I not administartor of network, i am client. And other client use MiTM. This network is use unmanaged switches, and ISP spit on it. That's why i try to find out to protect my workstation from MiTM, with out static

Re: PF and CLamAV Integration - how to do it?

2009-03-21 Thread Marc Balmer
Am 20.03.2009 um 12:15 schrieb jmc: --- Marc Balmer [Thu, Mar 19, 2009 at 07:36:18PM +0100]: --- Am 19.03.2009 um 15:27 schrieb Protocol Six Consulting: Hi, I was wondering if anyone here knows how to integrate the PF firewall with ClamAV. smtp-vilter, which is in ports, does that, i

Re: Where is Secure by default ?

2009-03-21 Thread Henning Brauer
* Felipe Alfaro Solana felipe.alf...@gmail.com [2009-03-09 17:07]: ARP is insecure by default. If you care, move to IPv6 and use IPSec/SeND. hah. IPv6 makes arp look like the brightest invention ever. -- Henning Brauer, h...@bsws.de, henn...@openbsd.org BS Web Services, http://bsws.de

Re: How to break the httpd's 4G file size limit?

2009-03-21 Thread Henning Brauer
* Alexey Suslikov alexey.susli...@gmail.com [2009-03-11 16:38]: The limitation is 2Gb on 32-bit platforms because of off_t (man lseek). off_t is 64bit on all platforms we support. even vax. -- Henning Brauer, h...@bsws.de, henn...@openbsd.org BS Web Services, http://bsws.de Full-Service ISP -

Re: might be slightly OT: `probability in PF'

2009-03-21 Thread Henning Brauer
* jmc j...@cosmicnetworks.net [2009-03-11 15:05]: so anyway, how are _you_ using probability? it's high on my list of useless features in pf I'd rather remove. if anybody is actually using it, I'd like to hear about it. -- Henning Brauer, h...@bsws.de, henn...@openbsd.org BS Web Services,

Re: Ramifications of blocking SYN+FIN TCP packets

2009-03-21 Thread Henning Brauer
not sure wether it wouldn't be smarter to just have pf scrub drop these as well. --- pf_norm.c Sat Mar 21 12:17:44 2009 +++ pf_norm.c.orig Sat Mar 21 12:16:56 2009 @@ -782,11 +782,8 @@ flags = th-th_flags; if (flags TH_SYN) { /* Illegal packet */ +

Re: OpenBSD 4.4 amd64 bsd.mp can't detect 16GB memory

2009-03-21 Thread Henning Brauer
* Thomas Pfaff tpf...@tp76.info [2009-03-10 20:00]: OpenBSD does not currently support 4GB of RAM. that is not true. OpenBSD does not currently support more than 4GB of RAM on amd64, that is true. -- Henning Brauer, h...@bsws.de, henn...@openbsd.org BS Web Services, http://bsws.de

Re: Where is Secure by default ?

2009-03-21 Thread Henning Brauer
* irix i...@ukr.net [2009-03-09 15:55]: In www.openbsd.org wrote Only two remote holes in the default install, in more than 10 years!, this not true. I using OpenBSD like customer, not like administrator. And my OpenBSD were attacked, by simple MiTM attack in arp protocol.

Re: might be slightly OT: `probability in PF'

2009-03-21 Thread Matthias Kilian
On Sat, Mar 21, 2009 at 12:14:44PM +0100, Henning Brauer wrote: so anyway, how are _you_ using probability? it's high on my list of useless features in pf I'd rather remove. if anybody is actually using it, I'd like to hear about it. I used it once about two years ago, to simulate a bad

Re: How to find available wifi access points?

2009-03-21 Thread Edd Barrett
On Fri, Mar 20, 2009 at 09:14:49AM +, Stuart Henderson wrote: On 2009-03-20, Matt open...@women-at-work.org wrote: Thank you all - that worked (both 'chan' and 'scan'). you should use scan, chan does something else now. bah, this keeps changing! -- Best Regards Edd Barrett

Re: might be slightly OT: `probability in PF'

2009-03-21 Thread Lars Noodén
Henning Brauer wrote: * jmc j...@cosmicnetworks.net [2009-03-11 15:05]: so anyway, how are _you_ using probability? it's high on my list of useless features in pf I'd rather remove. if anybody is actually using it, I'd like to hear about it. PF is one of the main factors for me to use

SOEKRIS - How to install MTR to a Flashdist image

2009-03-21 Thread Frothingdog.ca
I've been working on a OpenBSD image for a soekris boxes. I've actually made some headway with some help and pointers from Chris (maker of flashdist). I have the image mounted to /mnt/etc using vnconfig so I can modify the files before flashing the image (ie. boot.conf, rc, dhcpd.conf...etc).

Re: SOEKRIS - How to install MTR to a Flashdist image

2009-03-21 Thread Matthias Kilian
On Sat, Mar 21, 2009 at 07:42:31AM -0700, Frothingdog.ca wrote: I have the image mounted to /mnt/etc using vnconfig so I can modify the files before flashing the image (ie. boot.conf, rc, dhcpd.conf...etc). But I'd like to install a coupe packages into the image, such as MTR and TTCP.

Re: SOEKRIS - How to install MTR to a Flashdist image

2009-03-21 Thread Lars Noodén
Frothingdog.ca wrote: I have the image mounted to /mnt/... If you are running the same version, then one way is to chroot to the new image: chroot /mnt /bin/ksh then install the packages you wish. +Lars

Canada immigration

2009-03-21 Thread Agence Casa ElFirdaous
WARNING: contains undecipherable part Received: from unicornia896a8 (adsl-211-249-192-81.adsl.iam.net.ma [81.192.249.211]) by mail.cashcom.ma (Postfix/TrioOS) with ESMTP id 065961200A390 for MISC@OPENBSD.ORG; Sat, 21 Mar 2009 16:23:49 + (WET) From: Agence Casa ElFirdaous

Re: Ramifications of blocking SYN+FIN TCP packets

2009-03-21 Thread Johan Linner
Henning Brauer skrev: not sure wether it wouldn't be smarter to just have pf scrub drop these as well. --- pf_norm.c Sat Mar 21 12:17:44 2009 +++ pf_norm.c.orig Sat Mar 21 12:16:56 2009 @@ -782,11 +782,8 @@ flags = th-th_flags; if (flags TH_SYN) { /*

Re: Install freezes on macppc

2009-03-21 Thread Nick Holland
Daniel Barowy wrote: Hello everyone, A little searching on the lists and Google don't reveal anyone else having this problem, so I thought I'd ask for help. I originally tried installing 4.3 on this machine awhile back, and when I ran into this problem, I had other things to do, so I

Re: PF Seems To Reload Its Default Rules Unexpectedly

2009-03-21 Thread Garry Dolley
If everyone continues to avoid IPv6, then it will remain less than useful. I understand IPv6 has less than 1% uptake at the moment, but I don't understand why employing it (in addition to IPv4 NATing hacks) is about the least smart thing an ISP could do? Is it a cost issue? no, a

Re: Install freezes on macppc

2009-03-21 Thread Daniel Barowy
Hi Nick, Thanks for looking at this... Nick Holland wrote: Keep in mind the Macs are basically closed, secretive hardware, supported by a closed, secretive OS provided by the same vendor...so they can stick workarounds in for odd hardware quirks that no one else knows about (and they do have

Re: PF Seems To Reload Its Default Rules Unexpectedly

2009-03-21 Thread Henning Brauer
* Garry Dolley gdol...@arpnetworks.com [2009-03-21 20:32]: If everyone continues to avoid IPv6, then it will remain less than useful. I understand IPv6 has less than 1% uptake at the moment, but I don't understand why employing it (in addition to IPv4 NATing hacks) is about the least

Re: PF Seems To Reload Its Default Rules Unexpectedly

2009-03-21 Thread Bryan Irvine
On Sat, Mar 21, 2009 at 1:03 PM, Henning Brauer lists-open...@bsws.de wrote: * Garry Dolley gdol...@arpnetworks.com [2009-03-21 20:32]: If everyone continues to avoid IPv6, then it will remain less than useful. I understand IPv6 has less than 1% uptake at the moment, but I don't

Re: SOEKRIS - How to install MTR to a Flashdist image

2009-03-21 Thread Frothingdog.ca
I'm not sure of the command to run. Can you elaberate on the command. Please keep in mind I'm pretty new to this. if using MTR file from here: ftp://ftp.bitwizard.nl/mtr/mtr-0.75.tar.gz Thanks again for the help. Frothingdog.ca wrote: I've been working on a OpenBSD image for a soekris

Re: Install freezes on macppc

2009-03-21 Thread J.C. Roberts
On Sat, 21 Mar 2009 15:40:22 -0400 Daniel Barowy m...@barowy.net wrote: umass0 at uhub0 port 1 configuration 1 interface 0 Memorex Flashdrive 303B rev 2.00/1.10 addr 2 umass0: using SCSI over Bulk-Only scsibus1 at umass0: 2 targets, initiator 0 sd0 at scsibus1 targ 1 lun 0: Memorex,

Re: PF Seems To Reload Its Default Rules Unexpectedly

2009-03-21 Thread J.C. Roberts
On Sat, 21 Mar 2009 21:03:45 +0100 Henning Brauer lists-open...@bsws.de wrote: whoever claims v6 would be any good has never written network code dealing with it. hey, compare these two which do the same, one for v4 and one for v6: snip great code example don't get me started on the

Re: snapshot upgrades

2009-03-21 Thread Aaron Stellman
On Sat, Mar 21, 2009 at 09:21:30PM -0500, Mark Bucciarelli wrote: Is there danger in upgrading to the latest snapshot using a script? - fetch tarballs and kernels - run sysmerge -s etc*.tgz - run sysmerge -x xetc*.tgz you realize that sysmerge(8) is interactive, right?

snapshot upgrades

2009-03-21 Thread Mark Bucciarelli
Is there danger in upgrading to the latest snapshot using a script? - fetch tarballs and kernels - run sysmerge -s etc*.tgz - run sysmerge -x xetc*.tgz - extract tarballs to their place - copy over kernels to root dir - pkg_add -ui -F udate -F updatedepends - reboot Thanks, m

Re: Install freezes on macppc

2009-03-21 Thread Nick Holland
J.C. Roberts wrote: ... I've got no clue what kind of serial connector is used on your G4 Sawtooth, but if it uses MiniDIN-8F, you can easily find a converter to DE-9. Run a null-modem cable between the G4 and your x86. well..here's another feature of the newer MacPPC systems: no serial port.

Re: SOEKRIS - How to install MTR to a Flashdist image

2009-03-21 Thread Nick Holland
Frothingdog.ca wrote: I'm not sure of the command to run. Can you elaberate on the command. Please keep in mind I'm pretty new to this. How about just getting a 1G CF card, and doing a normal install? What do you gain by inflicting this pain upon yourself?

Re: snapshot upgrades

2009-03-21 Thread Nick Holland
Mark Bucciarelli wrote: Is there danger in upgrading to the latest snapshot using a script? Usually, or edge case? - fetch tarballs and kernels - run sysmerge -s etc*.tgz - run sysmerge -x xetc*.tgz as pointed out already, these are interactive programs... - extract tarballs to

Re: snapshot upgrades

2009-03-21 Thread Jacob Meuser
On Sat, Mar 21, 2009 at 11:14:48PM -0400, Nick Holland wrote: Mark Bucciarelli wrote: Is there danger in upgrading to the latest snapshot using a script? ... - run sysmerge -s etc*.tgz - run sysmerge -x xetc*.tgz as pointed out already, these are interactive programs... ... -