Re: Route-to with a dynamic 'next hop'

2014-10-09 Thread Justin Mayes
Ok I got it working. Here is what I did Enabled multipath routing (sysctl) Added the relayd anchor to pf.conf Created a relayd.conf with this in it gw1=fxp0 gw2=fxp1 table gateways { $gw1 ip ttl 1, $gw2 ip ttl 1 } router uplinks { route 0.0.0.0/0 forward to gateways check

rc.conf issue on upgrade from 5.5 to 5.6

2014-10-09 Thread Jason Tubnor
Hi, I was just testing upgrades prior to the 5.6 release and noticed items in the rc.conf.local were being ignored. A bit of digging, I noticed, rc.subr had some changes and more importantly there were quite a few changes to rc.conf. Cutting to the chase, replacing rc.conf from the upgraded 5.5

Re: Securing communications with OpenBSD

2014-10-09 Thread Duncan Patton a Campbell
On Tue, 7 Oct 2014 07:08:54 + C. L. Martinez carlopm...@gmail.com wrote: On Mon, Oct 6, 2014 at 11:52 PM, Duncan Patton a Campbell campb...@neotext.ca wrote: The most basic consideration in computer security has nothing to do with technology and computers. Do the people you need to

Re: Securing communications with OpenBSD

2014-10-09 Thread C. L. Martinez
On Thu, Oct 9, 2014 at 7:21 AM, Duncan Patton a Campbell campb...@neotext.ca wrote: On Tue, 7 Oct 2014 07:08:54 + C. L. Martinez carlopm...@gmail.com wrote: On Mon, Oct 6, 2014 at 11:52 PM, Duncan Patton a Campbell campb...@neotext.ca wrote: The most basic consideration in computer

Re: smtpd smarthost ISP config

2014-10-09 Thread admin
On 08/10/14 04:05 PM, admin wrote: Hello Current Sep 25 i386: I want to use shawmail.vc.shawcable.net as smarthost, and i tried smtp:// tls+auth:// and the others with failing results. What could be wrong? Thanks. --

Re: combination of ssh port fowarding and pf redirection

2014-10-09 Thread Giancarlo Razzolini
On 08-10-2014 18:25, stan wrote: Anyone have any sugestions as to how to make this work? Did you try the suggestion I gave you off list, of making two ssh connections? Also, you could provide more details of your setup? Both your e-mails trying to explain it, were confusing. I think I understood

Route-to dynamic next hop

2014-10-09 Thread Justin Mayes
I have 2 internet connections. One of them is static IP, one is dynamic. I want to use both of them on my gateway. From the man pages and other docs I see the use of route-to in the pf.conf including the 'next-hop' that it requires. This is easy enough. Problem is that the next hop is hard coded

Re: Route-to with a dynamic 'next hop'

2014-10-09 Thread Giancarlo Razzolini
On 09-10-2014 02:58, Justin Mayes wrote: Ok I got it working. Here is what I did Enabled multipath routing (sysctl) Added the relayd anchor to pf.conf Created a relayd.conf with this in it gw1=fxp0 gw2=fxp1 table gateways { $gw1 ip ttl 1, $gw2 ip ttl 1 } router uplinks { route

Re: Route-to with a dynamic 'next hop'

2014-10-09 Thread Justin Mayes
I did notice the problem with only detecting a LAN failure and was looking at a better monitor. If I just used plain PF rules what would I use for the next-hop parameter to the route-to command? This IP is dynamic. -Original Message- From: Giancarlo Razzolini

Re: Route-to with a dynamic 'next hop'

2014-10-09 Thread Giancarlo Razzolini
On 09-10-2014 10:16, Justin Mayes wrote: I did notice the problem with only detecting a LAN failure and was looking at a better monitor. If I just used plain PF rules what would I use for the next-hop parameter to the route-to command? This IP is dynamic. There is no next-hop. Just make your

Connection drop (i.e. IRC) caused by pf/pfsync/carp/...?

2014-10-09 Thread Nicolas Christener
Hello We have a somewhat curious issue and run out of ideas ;) We do not have a trigger to reproduce the issue, but we for example see some IRC disconnects from users behind our firewall. What we have: - two HP Proliant DL360 G5 with Broadcom BCM5708 NICs, 2GB RAM, Intel Xeon E5335@2.0GHz -

Re: Connection drop (i.e. IRC) caused by pf/pfsync/carp/...?

2014-10-09 Thread Paul S.
I can confirm that we've seen this with any long running TCP connections in environments where pf was literally only sampling packets for pflow (not even actually firewalling.) Removing pf from the equation fixed the problem right up. 5.5 current was what I was running at the time. On

Re: Route-to with a dynamic 'next hop'

2014-10-09 Thread Justin Mayes
My understanding of route-to is that if the destination is not on same network as the 'route-to' interface, you need the second 'next hop' parameter. All examples I was seeing show pf.conf this way. Is that not right? I will test with just the interface name. -Original Message- From:

Re: Route-to with a dynamic 'next hop'

2014-10-09 Thread Justin Mayes
In Reyk's presentation he talks about this (http://www.youtube.com/watch?v=JtMxGslqGbM) @ 19:30 and describes the 'link balancer' functionality of relayd intended to do exactly what I want. It appears to work as described. In the presentation Reyk says relayd will check for upstream router

Re: Securing communications with OpenBSD

2014-10-09 Thread Duncan Patton a Campbell
On Thu, 9 Oct 2014 08:15:22 + C. L. Martinez carlopm...@gmail.com wrote: On Thu, Oct 9, 2014 at 7:21 AM, Duncan Patton a Campbell campb...@neotext.ca wrote: On Tue, 7 Oct 2014 07:08:54 + C. L. Martinez carlopm...@gmail.com wrote: On Mon, Oct 6, 2014 at 11:52 PM, Duncan Patton a

Re: Route-to with a dynamic 'next hop'

2014-10-09 Thread Giancarlo Razzolini
On 09-10-2014 11:23, Justin Mayes wrote: In Reyk's presentation he talks about this (http://www.youtube.com/watch?v=JtMxGslqGbM) @ 19:30 and describes the 'link balancer' functionality of relayd intended to do exactly what I want. It appears to work as described. In the presentation Reyk says

Re: Firewall: Where is the bottleneck?

2014-10-09 Thread Andy
Hi, Just so I understand what you have done, PRIQ is not the same as queuing. You can set a simple prio on a rule like; pass proto tcp from $left to $right set prio (1,4) But this doesn't manage the situations where you have lots of different types/profiles of traffic on your network. For

Re: Connection drop (i.e. IRC) caused by pf/pfsync/carp/...?

2014-10-09 Thread Andy
I have seen this when the allowed number or states is too low and PF clears the idle states too early.. See http://www.openbsd.org/faq/pf/options.html; set optimization/option/ Good luck, Andy. On 09/10/14 14:58, Paul S. wrote: I can confirm that we've seen this with any long running TCP

Changing root password from stdin value

2014-10-09 Thread Nux!
Hello, I'm trying to get some scripts working which would take a password from stdin and set it for root. In Linux passwd --stdin is used, in FreeBSD pw mod user root -h 0. How would I do this in OpenBSD? Thanks, Lucian -- Sent from the Delta quadrant using Borg technology! Nux! www.nux.ro

Re: Changing root password from stdin value

2014-10-09 Thread Sébastien Marie
On Thu, Oct 09, 2014 at 06:22:05PM +0100, Nux! wrote: Hello, I'm trying to get some scripts working which would take a password from stdin and set it for root. In Linux passwd --stdin is used, in FreeBSD pw mod user root -h 0. How would I do this in OpenBSD? Thanks, Lucian Hi, You

Re: Changing root password from stdin value

2014-10-09 Thread Nux!
Thanks, that worked great! Lucian -- Sent from the Delta quadrant using Borg technology! Nux! www.nux.ro - Original Message - From: Sébastien Marie semarie-open...@latrappe.fr To: Nux! n...@li.nux.ro Cc: misc@openbsd.org Sent: Thursday, 9 October, 2014 18:48:54 Subject: Re:

openbsd sysprep?

2014-10-09 Thread Nux!
Hi, I'm trying to build a Cloudstack OpenBSD template and I need to do a bit of cleaning up on it before I let people use it. Besides changing the password, wiping the shell history, ssh keys, random seed and /var/log stuff, what else should I be doing to trigger a more unique installation?

Re: Question re dhclient.conf

2014-10-09 Thread Duncan Patton a Campbell
On Mon, 29 Sep 2014 10:24:44 -0400 Jiri B ji...@devio.us wrote: On Mon, Sep 29, 2014 at 08:03:14AM -0600, Duncan Patton a Campbell wrote: My purpose here is to allow dynamic dns updates via nsupdate from a dhcp clients where addresses are subject to change. I have a solution that will

Re: Changing root password from stdin value

2014-10-09 Thread Nick Holland
On 10/09/14 13:21, Nux! wrote: Hello, I'm trying to get some scripts working which would take a password from stdin and set it for root. In Linux passwd --stdin is used, in FreeBSD pw mod user root -h 0. How would I do this in OpenBSD? Thanks, Lucian in addition to the already provided

Which is the better way to use softraid?

2014-10-09 Thread tmw
Hello It seems I will be moving on up, and replacing an old P4 (that I pulled out of the trash and have been using with openbsd as a mail server and such) with a much newer/fancier computer. I was reading about softraid, and saw the suggestions about using softraid and altroot. I

rrdtool troubles after 5.4-5.5 upgrade

2014-10-09 Thread Steven Surdock
As required for the upgrade I exported all my rrd's and they appear correct, but when I performed a 'restore' on the upgraded 5.5 system the dates appeared to become advanced by 136 years. These are for Cacti and interestingly, cacti shows graphs for the old data, but not for data collected

Re: Which is the better way to use softraid?

2014-10-09 Thread Nick Holland
On 10/09/14 14:24, t...@wynnychenko.com wrote: ... Now, if there are going to be multiple partitions for the install (e.g. /home, /var, etc.), my questions is, which is better: A: Is it better to make larger initial partitions for raid assembly, and then use disklable to create multiple

Re: Changing root password from stdin value

2014-10-09 Thread Артур Истомин
On Thu, Oct 09, 2014 at 02:23:54PM -0400, Nick Holland wrote: On 10/09/14 13:21, Nux! wrote: Hello, I'm trying to get some scripts working which would take a password from stdin and set it for root. In Linux passwd --stdin is used, in FreeBSD pw mod user root -h 0. How would I do this in