Re: OpenBSD as a pentester PC?

2015-11-26 Thread Chris Smith
On Thu, Nov 26, 2015, at 10:23 PM, Mohammad BadieZadegan wrote: > Hi every OpenBSD user, > I have OpenBSD on my Notebook since 2 years ago and I don't want to > switch > other OS for my business pentest project. > I need some pentest tools for my project like metasploit, fuzzers, ..etc > but I

-current not building

2014-04-13 Thread Chris Smith
-current not currently building: == mandoc -Tlint -Wfatal /usr/src/usr.sbin/ldapd/ldapd.conf.5 cc -o ldapd ber.o log.o control.o util.o ldapd.o ldape.o conn.o attributes.o namespace.o btree.o filter.o search.o parse.o auth.o modify.o index.o ssl.o

Re: -current not building

2014-04-13 Thread Chris Smith
Guess I'm missing the point, Downloaded src from scratch and now getting a different error (on two separate systems) when trying to build userland: mandoc -Tlint -Wfatal /usr/src/usr.sbin/ntpd/ntpctl.8 === usr.sbin/openssl cc -O2 -pipe -DMONOLITH -DTERMIOS -DANSI_SOURCE -DOPENSSL_NO_RC5

Re: -current not building

2014-04-13 Thread Chris Smith
OK, I'll try again. I do follow the source changes via gmane with a newsreader but I think there's a bit of delay. Thanks. On Sun, Apr 13, 2014 at 11:27 PM, Ted Unangst t...@tedunangst.com wrote: On Sun, Apr 13, 2014 at 23:15, Chris Smith wrote: Guess I'm missing the point, Downloaded src from

Re: upgrades no longer allow ftp for sets

2014-03-27 Thread Chris Smith
On Thu, Mar 27, 2014 at 1:37 PM, Diana Eichert deich...@wrench.com wrote: FWIW, Anyone who is responsible for border firewalls deplores FTP protocol. And its cousin, FTPS, which, although encrypted, has the same dual port problem yet not curable via a proxy. Chris

Re: Unbound in base, yes, what about ldns?

2014-03-23 Thread Chris Smith
On Thu, Mar 20, 2014 at 7:39 PM, Stuart Henderson s...@spacehopper.org wrote: You can uninstall the package if you don't need it, or you can keep it if you do need it (for example, for drill or the ldns-* tools). How about this line added to rc.conf.local when using the package:

Re: Unbound in base, yes, what about ldns?

2014-03-21 Thread Chris Smith
On Wed, Mar 19, 2014 at 7:44 PM, Chris Smith obsd_m...@chrissmith.org wrote: See the thread unbound dnssec revisited I started on 12/30/2013 for some hints. Looks like creating a new directory with the proper permissions is the best way to go. Now fixed in -current with a /var/unbound/db

Unbound in base, yes, what about ldns?

2014-03-19 Thread Chris Smith
Great to see Unbound in base, thanks. But what about ldns? I still have that installed as a package - removed the unbound package as per the -current instructions, but shouldn't the ldns package package be removed as well as I believe unbound requires it and therefore it would have to be built by

Re: Unbound in base, yes, what about ldns?

2014-03-19 Thread Chris Smith
On Wed, Mar 19, 2014 at 6:12 PM, Kenneth Westerback kwesterb...@gmail.com wrote: The unbound in base has it's own cut down version of ldns. No need for the package. Can I just uninstall the package after the fact or do some files need to be replaced? Thanks, Chris

Re: Unbound in base, yes, what about ldns?

2014-03-19 Thread Chris Smith
See the thread unbound dnssec revisited I started on 12/30/2013 for some hints. Looks like creating a new directory with the proper permissions is the best way to go. On Wed, Mar 19, 2014 at 7:01 PM, Атанас Владимиров don.na...@gmail.com wrote: Hi, Sorry for Off-topic, but when you enable

Re: unreliable connections

2014-03-17 Thread Chris Smith
I think the source of this reported problem has been found, and happily fixed (the preliminary results are promising). Basically I needed to find some way to get the backups to complete reliably so I started a 20 count ping job a minute before the rsync job (actually an rsnapshot job which

Re: unreliable connections

2014-01-26 Thread Chris Smith
On Thu, Jan 16, 2014 at 8:26 PM, Stuart Henderson s...@spacehopper.org wrote: This could be an MTU or RWIN-related issue. Could my issue have anything to with the miscounting bug for inbound with pf on mentioned in the following commit? CVSROOT:

Re: unreliable connections

2014-01-22 Thread Chris Smith
On Mon, Jan 20, 2014 at 11:31 AM, Chris Smith obsd_m...@chrissmith.org wrote: have moved the block all to the beginning of the ruleset to see if it will make any difference Unfortunately no difference. The attempt to rsync the first directory failed last night, second one worked fine. Any

Re: unreliable connections

2014-01-22 Thread Chris Smith
On Wed, Jan 22, 2014 at 12:56 PM, Charles RAPENNE char...@bsd.zplay.euwrote: Do you rsync directly to an ip address or are you using avec domain name ? Not DNS - directly to IP address. Thanks, Chris

Re: unreliable connections

2014-01-22 Thread Chris Smith
On Thu, Jan 16, 2014 at 8:26 PM, Stuart Henderson s...@spacehopper.org wrote: Posting the firewall ruleset may possibly help people diagnose this in more detail. Here's some pertinent pf.conf info: === set skip on { lo enc0 } set block-policy drop set reassemble

Re: unreliable connections

2014-01-20 Thread Chris Smith
On Thu, Jan 16, 2014 at 8:26 PM, Stuart Henderson s...@spacehopper.org wrote: This could be an MTU or RWIN-related issue. One common problem is if the firewall state is created from an already-established connection rather than a SYN packet, in this case the firewall can't keep track of the

Re: unreliable connections

2014-01-16 Thread Chris Smith
to troubleshoot this. Chris On Sun, Dec 29, 2013 at 9:56 PM, Chris Smith obsd_m...@chrissmith.org wrote: I'm having a problem connecting with (and through) one OpenBSD box. Both ends are running OpenBSD -current (-current as of last weekend) and I've had the issue through a couple of months

ack! (not ack)

2014-01-12 Thread Chris Smith
hope they come looking for me next... http://www.dailykos.com/story/2014/01/09/1267958/-Cartoon-Pufferfish-madness-in-Chagrin-nbsp-Falls?detail=hide

Re: unbound dnssec revisited

2013-12-31 Thread Chris Smith
Chris On Mon, Dec 30, 2013 at 6:45 PM, Chris Smith obsd_m...@chrissmith.org wrote: On Mon, Dec 30, 2013 at 6:10 PM, Remi Locherer remi.loche...@relo.ch wrote: Having the root.key in a separate directory works. Yes, it works. But /var/unbound/etc was the choice during configure which means

make obj failing for -current

2013-12-31 Thread Chris Smith
=== regress/gnu/egcs/gcc-builtins /bin/sh: cd: /usr/src/regress/gnu/egcs/gcc-builtins - No such file or directory *** Error 1 in regress/gnu/egcs (bsd.subdir.mk:48 'obj') *** Error 1 in regress/gnu (bsd.subdir.mk:48 'obj') *** Error 1 in regress (bsd.subdir.mk:48 'obj') *** Error 1 in /usr/src

Re: make obj failing for -current

2013-12-31 Thread Chris Smith
On Tue, Dec 31, 2013 at 12:11 PM, Ingo Schwarze schwa...@usta.de wrote: cd /usr/src/regress/gnu/egcs/ cvs up -dP As usual, don't forget the -d. Ah... thanks. Guess I need to add that -d to my .cvsrc file.

Re: unbound dnssec revisited

2013-12-31 Thread Chris Smith
On Tue, Dec 31, 2013 at 2:40 PM, Dennis Davis dennisdavis+openbsd-m...@fastmail.fm wrote: It's a while since I looked at this, so the exact details are hazy, but is all this necessary? snip Doesn't seem to me that you need to run unbound-anchor as a part of /etc/rc.d/unbound. You just need to

unbound dnssec revisited

2013-12-30 Thread Chris Smith
I've been working on using dnssec with the unbound package and viewing some of the threads here on the list regarding this. Enabling autotrust and the validator module in unbound.conf and running unbound-anchor before starting unbound will enable dnssec but eventually will log errors of: could

Re: unbound dnssec revisited

2013-12-30 Thread Chris Smith
On Mon, Dec 30, 2013 at 12:10 PM, Chris Smith obsd_m...@chrissmith.org wrote: And to strongly reiterate that it would be supper to have this product in base Er.. that it would be SUPER to have this product in base

Re: unbound dnssec revisited

2013-12-30 Thread Chris Smith
On Mon, Dec 30, 2013 at 3:22 PM, Ted Unangst t...@tedunangst.com wrote: More simply, can that file be moved to another location? Then we can enable write permissions to /var/unbound/etc/autotrust/files/... or something, without giving away the keys to the whole kingdom. Actually that was close

Re: unbound dnssec revisited

2013-12-30 Thread Chris Smith
On Mon, Dec 30, 2013 at 6:10 PM, Remi Locherer remi.loche...@relo.ch wrote: Having the root.key in a separate directory works. Yes, it works. But /var/unbound/etc was the choice during configure which means a little more work: The autotrust path line in unbound.conf needs to be edited with the

unreliable connections

2013-12-29 Thread Chris Smith
I'm having a problem connecting with (and through) one OpenBSD box. Both ends are running OpenBSD -current (-current as of last weekend) and I've had the issue through a couple of months of various builds of -current. The problem occurs whether I'm connecting directly to the remote OpenBSD box

Re: netstat segfault on -current

2013-12-25 Thread Chris Smith
On Mon, Dec 23, 2013 at 11:51 PM, Kenneth R Westerback kwesterb...@gmail.com wrote: It is a real issue, due to errors I made replacing CIRCLEQ with TAILQ. A fix is being worked on, and a workaround probably sooner than that. Looks like the recent updates have resolved the issue. Thanks!

Re: netstat segfault on -current

2013-12-24 Thread Chris Smith
On Mon, Dec 23, 2013 at 11:51 PM, Kenneth R Westerback kwesterb...@gmail.com wrote: It is a real issue, due to errors I made replacing CIRCLEQ with TAILQ. A fix is being worked on, and a workaround probably sooner than that. Thanks. I knew it wasn't a userland/kernel sync problem.

netstat segfault on -current

2013-12-23 Thread Chris Smith
Two systems running -current (x86_64) cannot run netstat: OpenBSD 5.4-current (GENERIC.MP) #3: Sat Dec 21 17:05:25 EST 2013 # netstat Segmentation fault

Re: netstat segfault on -current

2013-12-23 Thread Chris Smith
On Mon, Dec 23, 2013 at 5:10 PM, Alexey E. Suslikov alexey.susli...@gmail.com wrote: blind guess - you have kernel and userland out of sync. Not so.

Re: dhcpd: rejecting bogus offer

2013-12-11 Thread Chris Smith
Yes, that does help it all make sense. Thanks to all. On Tue, Dec 10, 2013 at 11:43 PM, Ted Unangst t...@tedunangst.com wrote: On Tue, Dec 10, 2013 at 22:16, Chris Smith wrote: On Tue, Dec 10, 2013 at 8:04 PM, Chris Smith obsd_m...@chrissmith.org wrote: Dec 10 16:19:46 firewall dhcpd[29710

Re: dhcpd: rejecting bogus offer

2013-12-10 Thread Chris Smith
On Mon, Dec 9, 2013 at 3:01 PM, Kenneth R Westerback kwesterb...@rogers.com wrote: Malicious or confused. Or truncated packets. The log message means that the option length as given in the packet would run the option data outside the received packet. The confusion might have started in an

Re: dhcpd: rejecting bogus offer

2013-12-10 Thread Chris Smith
On Tue, Dec 10, 2013 at 8:04 PM, Chris Smith obsd_m...@chrissmith.org wrote: Dec 10 16:19:46 firewall dhcpd[29710]: Many bogus options seen in offers. In particular the above line: Many bogus options seen in offers. Doesn't the server make the offer? If so, why would the OpenBSD dhcpd server

dhcpd: rejecting bogus offer

2013-12-09 Thread Chris Smith
What might be the implications of the following messages in the log? Dec 6 15:09:39 firewall dhcpd[29710]: option option-79 (119) larger than buffer. Dec 6 15:09:39 firewall dhcpd[29710]: rejecting bogus offer. Dec 9 12:15:35 firewall dhcpd[29710]:

Re: DNS problem

2013-12-08 Thread Chris Smith
Turns out the problem was with the Internet Guide service. If the IP address from which the query was sent was on the subscriber list then the incorrect info was sent. That's why it worked from one of my networks but not the others. Thanks to all. Chris

DNS problem

2013-12-06 Thread Chris Smith
This falls under the category When in doubt, ask the OpenBSD guys (and as all of my firewalls are running OpenBSD I hope this isn't too off topic). Basically, four of my networks are not getting an answer for a specific mx query from dyn.com's DNS server. Yet every other DNS cache I've queried

Re: DNS problem

2013-12-06 Thread Chris Smith
On Fri, Dec 6, 2013 at 11:54 AM, Peter N. M. Hansteen pe...@bsdly.net wrote: but, say $ dig @216.146.35.35 bsdly.net mx works? Or do you get no answer for any queries? It's just that one particular query and the same domain's TXT record. There may be others but this one was found because

Re: DNS problem

2013-12-06 Thread Chris Smith
On Fri, Dec 6, 2013 at 12:07 PM, Giancarlo Razzolini grazzol...@gmail.com wrote: I do not know if it is the case, but many isp's today use dns transparent proxying. You can try using the site www.dnsleaktest.com to see if it is your case. The lwtitle.com mx and lwtitle.com txt queries

Re: DNS problem

2013-12-06 Thread Chris Smith
On Fri, Dec 6, 2013 at 1:38 PM, Patrik Lundin patrik.lundin@gmail.com wrote: Just out of curiosity: If you are running unbound on the firewall, why are you querying the troublesome resolver directly? Do you get the same result when querying the local unbound? Same results from Unbound.

Re: DNS problem

2013-12-06 Thread Chris Smith
On Fri, Dec 6, 2013 at 2:35 PM, Patrik Lundin patrik.lundin@gmail.com wrote: Sorry if I'm missing something, but what lead you to suspect the 216.146.35.35 machine in the first place? Some of my clients use that service and for them Unbound doesn't act as a validator, just an iterator that

Re: smtpd config issue

2013-12-04 Thread Chris Smith
On Thu, Nov 28, 2013 at 7:53 PM, Ted Unangst t...@tedunangst.com wrote: I just needed to do the same (smtpd would elect to use ipv6, but i only have ipv4 spf records). The man page kind of says it's a table name, but it's not. Try this instead: accept from local for any relay source a.b.c.d

Re: smtpd config issue

2013-11-27 Thread Chris Smith
On Tue, Nov 26, 2013 at 12:46 PM, Christopher Zimmermann christop...@gmerlin.de wrote: what's $alias1 in your pf.conf? Can't you paste just your whole pf.conf? What do you mean by smtpip = $alias1. You seem to do a on $alias1. so $alias1 seems to be an interface? It's just a macro for one of

smtpd config issue

2013-11-25 Thread Chris Smith
Hello, Trying to use smtpd on a particular interface alias (for sending only, not for listening) and am not finding a way to do so. It seems to default sending out via the :0 address. Chris

Re: smtpd config issue

2013-11-25 Thread Chris Smith
On Mon, Nov 25, 2013 at 12:33 PM, Giancarlo Razzolini grazzol...@gmail.com wrote: Taking a look on the smtpd.conf(5) man page, there is the source directive, which does what you are trying to accomplish. Don't know what I'm doing wrong as I can't get it to work here. Using these rules works

Re: smtpd config issue

2013-11-25 Thread Chris Smith
On Mon, Nov 25, 2013 at 2:35 PM, Christopher Zimmermann christop...@gmerlin.de wrote: Now I'd be looking at 'route -n show -inet', 'ifconfig $ext_if' and 'ifconfig $alias1' ifconfig doesn't understand pf macros (as far as i can tell) == # route

mongodb

2013-11-22 Thread Chris Smith
Mentioned previously: On Tue, Oct 22, 2013 at 12:29 PM, Stuart Henderson s...@spacehopper.org wrote: Note that the mongodb port is currently broken (and has been since 5.3-ish iirc). Wondering if mongodb is operational with -current? Thank you, Chris

Re: Blocking facebook.com: PF or squid?

2013-10-31 Thread Chris Smith
On Fri, Oct 18, 2013 at 8:24 PM, Clint Pachl pa...@ecentryx.com wrote: Running your own own DNS resolver is the best solution to deny the whole network facebook access. With Unbound this is simple: # This will block facebook.com and all subdomains. local-zone: facebook.com redirect

Occasionally connected mail access

2013-10-27 Thread Chris Smith
don't want to bother with a whole Cyrus/Fetchmail/ IMAP/dovecot stack of turtles. It's too much pain to keep running. Any help appreciated! -- Chris Smith * *

updating -current fail

2013-07-19 Thread Chris Smith
/usr/bin/Mail - /usr/bin/mail /usr/bin/mailx - /usr/bin/mail === usr.bin/make install -c -S -s -o root -g bin -m 555 make /usr/bin/make install -c -o root -g bin -m 444 /usr/src/usr.bin/make/make.1 /usr/share/man/man1/make.1 === usr.bin/man make: unknown option -- P

Re: updating -current fail

2013-07-19 Thread Chris Smith
On Fri, Jul 19, 2013 at 3:51 PM, Marc Espie es...@nerim.net wrote: So, don't run make -P... OK, thanks.

Re: setting ttl

2013-06-19 Thread Chris Smith
On Wed, Jun 19, 2013 at 6:43 AM, Henning Brauer lists-open...@bsws.de wrote: no Thanks. Any plans to implement this?

egress group no longer auto assigned after -current update

2013-06-08 Thread Chris Smith
Updated -current recently which left my internal network unusable. The system was forwarding packets but not doing NAT. Turns out the problem was that the external interface, which is a dhcp assigned (via the ISP) interface was no longer being assigned to the egress group. And my NAT rule is:

setting ttl

2013-04-23 Thread Chris Smith
Seems that pf can enforce a min-ttl but can it explicitly set the ttl on packets leaving an interface?

match and nat-to

2013-04-13 Thread Chris Smith
Looking for a bit of clarification on match and nat-to. At one point (and maybe still so?) nat rules were first matching as opposed to the 'normal' case of last matching but match rules are sticky until overridden. With: match out on $ext_if inet from !($ext_if) to any nat-to ($ext_if) match out

Re: dhclient could not allocate memory

2013-02-28 Thread Chris Smith
On Thu, Feb 28, 2013 at 12:58 PM, Marc Peters m...@mpeters.org wrote: dhclient I've noticed a lot of dhclient changes in cvs over the past few weeks.You might try a newer snapshot. Chris

Re: problem compiling userland in -current

2013-02-25 Thread Chris Smith
On Mon, Feb 25, 2013 at 1:03 AM, Mike Korbakov mike-...@yandex.ru wrote: May be, your host system too old, and in -current system header files has changed significantly. Compare files in /usr/include/sys and /usr/src/sys/sys (check other headers too) Or download and install -current as host

Re: problem compiling userland in -current

2013-02-25 Thread Chris Smith
On Mon, Feb 25, 2013 at 3:39 AM, Stuart Henderson s...@spacehopper.org wrote: Is /usr/obj clean? Also, if you're building outside of make build make sure you use make -f Makefile.bsd-wrapper. I built the nsd update successfully on amd64 i386 macppc and vax before I committed it and there have

Re: problem compiling userland in -current

2013-02-25 Thread Chris Smith
On Mon, Feb 25, 2013 at 11:18 AM, Chris Smith obsd_m...@chrissmith.org wrote: I use a .cvsrc file with: = cvs -q -danon...@anoncvs3.usa.openbsd.org:/cvs diff -up update -Pd checkout -P = I do not checkout the ports or xenocara trees

problem compiling userland in -current

2013-02-24 Thread Chris Smith
make echo #include config.h zlexer.c echo #include \configyyrename.h\ configlexer.c /usr/bin/yacc -d -o configparser.c /usr/src/usr.sbin/nsd/configparser.y flex -i -t /usr/src/usr.sbin/nsd/zlexer.lex zlexer.c flex -i -t /usr/src/usr.sbin/nsd/configlexer.lex configlexer.c /usr/bin/yacc -d -o

Re: problem compiling userland in -current

2013-02-24 Thread Chris Smith
On Sun, Feb 24, 2013 at 4:10 PM, Stuart Henderson s...@spacehopper.org wrote: It seems your tree is not clean, the tsig_get_algorithm_by_id prototype which it's complaining about was removed in tsig.h r1.1.1.3. I re-ran cvs up which was clean (no changes) and did a make build (after the other

Re: problem compiling userland in -current

2013-02-24 Thread Chris Smith
On Sun, Feb 24, 2013 at 4:10 PM, Stuart Henderson s...@spacehopper.org wrote: It seems your tree is not clean, the tsig_get_algorithm_by_id prototype which it's complaining about was removed in tsig.h r1.1.1.3. I have plenty of tsig.h files: === locate tsig.h

Re: problem compiling userland in -current

2013-02-24 Thread Chris Smith
On Sun, Feb 24, 2013 at 6:04 PM, Alexander Hall alexan...@beard.se wrote: $ cvs up -dAP That didn't help :-(

Re: dhcp and dns

2013-02-04 Thread Chris Smith
On Sat, Feb 2, 2013 at 11:56 PM, bofh goodb...@gmail.com wrote: I'm running 5.2. And starting to have more and more things that need IP addresses pop in and out of the house. Rather than hardcoding everything into dhcpd.conf, I thought I'd check with you guys to see what you use to have new

Re: dhcpd not starting

2013-01-01 Thread Chris Smith
On Tue, Jan 1, 2013 at 7:59 AM, MERIGHI Marcus mcmer-open...@tor.at wrote: I could not figure out which dhcp option(s) you are referring to. Please specify option number and RFC number. For options with names see: dhcp-options(5) (beeing reworked currently) /usr/src/usr.sbin/dhcpd/tables.c

dhcpd not starting

2012-12-31 Thread Chris Smith
Maybe it's a problem due to Unbound being a package and not part of the core system, but a normal configuration such as: host hostname.example.com { hardware ethernet 00:1a:80:f4:75:ad; fixed-address hostname.example.com; } has to be rewritten as: host hostname.example.com { hardware

Re: cvs up failing on -current

2012-12-30 Thread Chris Smith
That works fine. Thanks! On Sat, Dec 29, 2012 at 7:47 PM, Philip Guenther guent...@gmail.com wrote: Whoops, the obj directory got added to cvs. It'll cause problems for cvs up -d until we can verify that the mirrors won't be broken when we remove it. For you, for now, the following steps

cvs up failing on -current

2012-12-29 Thread Chris Smith
Trying to keep -current and am getting this message when doing a cvs up: cvs [update aborted]: could not chdir to regress/misc/sse2/foo/obj/: No such file or directory It's there:

Re: ftps?

2012-11-30 Thread Chris Smith
On Fri, Nov 30, 2012 at 7:47 AM, Stuart Henderson s...@spacehopper.org wrote: Not exactly, but you might be able to do something with this, *before* your ftp-proxy rule: pass out quick proto tcp to 0.0.0.0/0 port 8821 rdr-to 0.0.0.0/0 port 21 bitmask Then if you tell your ftp client to

Re: ftps?

2012-11-29 Thread Chris Smith
On Wed, Nov 28, 2012 at 12:48 PM, Chris Smith obsd_m...@chrissmith.org wrote: Looks like skipping ftp-proxy for that target address works. Thanks! Is there any way to make this work automagically for ftps? Right now I'm doing this: anchor ftp-proxy/* pass in quick

Re: ftps?

2012-11-28 Thread Chris Smith
On Wed, Nov 28, 2012 at 7:29 AM, Stuart Henderson s...@spacehopper.org wrote: If the control connection is encrypted as with ftp+tls, then ftp-proxy *cannot* work, as it cannot read the commands. So, if this is with NAT, you can't rely on ftp-proxy to fix things up, you will need ftp+tls

Re: ftps?

2012-11-28 Thread Chris Smith
On Wed, Nov 28, 2012 at 1:43 PM, Hugo Osvaldo Barrera h...@osvaldobarrera.com.ar wrote: Since you say this works with a standard home router, have you checked if maybe the server software uses nat pmp or something similar for port redirection? I tested it with an Asus RT-AC66U with its UPnP

ftps?

2012-11-27 Thread Chris Smith
Having some issues with a client system attempting to use a product called MoveItFreely to connect to server via FTPS (FTP with TLS). The firewall is running a snapshot from April, 3 2011 of version 4.9. I have added a pass rule for the additional (to port 21) requested ports of 989, 990, and

Ubiquiti EdgeMax

2012-09-12 Thread Chris Smith
The Edge Router Lite looks to be a sweet box: http://www.ubnt.com/edgemax Dual-core MIPS64 processor with hardware acceleration for packet processing and encryption/decryption. Only 99 USD, wonder if OpenBSD can run on it and take advantage of the hardware acceleration.

Re: OpenBSD is just an OS, not a firewall...

2012-06-10 Thread Chris Smith
On Sat, Jun 9, 2012 at 11:52 PM, Lars Hansson romaby...@gmail.com wrote: Hmm..I get  This post could not be found. Apparently the original post has been deleted by its author. His prerogative, but I think it's in bad taste to create such history gaps.

Re: OpenBSD is just an OS, not a firewall...

2012-06-10 Thread Chris Smith
On Sun, Jun 10, 2012 at 1:58 PM, Ted Unangst t...@tedunangst.com wrote: The original post had nothing to do with OpenBSD, some nitwit hijacked the comment thread.  I don't think the author has any obligation to play host to a battleground. The original post was about IPv6, someone commented

OpenBSD is just an OS, not a firewall...

2012-06-08 Thread Chris Smith
... if you really want a firewall you need pfSense. Also if you walk into any security experts convention and claim that raw OpenBSD is a firewall, you will get laughed out of the room for lack of clue. Guess I've been wrong all these years: see the comments to

Re: Unbound

2012-05-25 Thread Chris Smith
On Fri, May 25, 2012 at 2:37 PM, Geoff Steckel g...@oat.com wrote: Thanks very much! I think using NSD for the outward facing authoritative service makes sense. Retaining BIND is probably best for the internal service since I see no way to add the local domains, etc. to unbound/nsd while

strange dmesg/log entries

2012-05-21 Thread Chris Smith
Running -current (updated 5/19/12) and saw these entries today: = pf: pfi_table_update: cannot set 1 new addresses into table fxp1:0: 12 pf: pfi_table_update: cannot set 1 new addresses into table fxp1:network: 12 pf: pfi_table_update: cannot set 1 new

Re: Unbound

2012-05-21 Thread Chris Smith
On Mon, May 21, 2012 at 3:30 PM, Geoff Steckel g...@oat.com wrote: My site needs both split horizon and pretty complete authoritative support. Does anyone have suggestions about BIND replacement(s) for this scenario? NSD for authoritative and Unbound (both from NLnet Labs of Amsterdam) for

Re: unbound

2012-05-20 Thread Chris Smith
On Sat, May 19, 2012 at 5:05 PM, Stuart Henderson s...@spacehopper.org wrote: I'll try and find time to properly review the diff to add it to the system infrastructure (/etc/rc and /etc/rc.d parts etc) in the next week or so. I am pretty confident in unbound itself but the system integration

unbound

2012-05-19 Thread Chris Smith
As unbound is now in base but not yet built by default how is it built in order to test it (is it a simple 'make install' or is more involved)? How to add it to the list the gets built with a make build of userland (or is this even safe)? Or is it simply best to use packages or ports at this time?

VPN questions

2012-05-11 Thread Chris Smith
Would like to tunnel the net traffic from my (android) cell phone (and tablet if I ever get one) through my soho OpenBSD firewall/router when I'm connected to untrusted and/or open wifi. My outside/public IP is not fixed (cable) but it rarely changes and I do have a ddns hostname. Is this

Static or dynamic code analysis software

2012-01-16 Thread Chris Smith
the Internet returned nothing useful unfortunately. Best Regards, Chris Smith

Re: OpenBSD/amd64 runs on computers equipped with AMD Athlon64

2011-12-13 Thread Chris Smith
On Tue, Dec 13, 2011 at 7:32 AM, sc...@web.de wrote: It is no discovery, I continously change the computer. Right now searching for an old one that do not consume much electricity. The best is a Siemens with a celeron, 800mhz, the whole machine consumes 32w when idle, but goes to 42w or more

Re: af-to error?

2011-12-06 Thread Chris Smith
On Tue, Dec 6, 2011 at 12:50 PM, Stuart Henderson s...@spacehopper.org wrote: in the meantime, adding inet to the line is likely to help. Indeed, thank you.

af-to error?

2011-12-05 Thread Chris Smith
Having some issues with -current. This line in pf.conf: match out on $ext_if from my_net to any nat-to $ext_ad0 Generates the following error: # pfctl -n -f /etc/pf.conf /etc/pf.conf:41: af-to is not supported on match rules /etc/pf.conf:41: skipping rule due to errors /etc/pf.conf:41: rule

Re: USB mouse

2011-10-26 Thread Chris Smith
On Wed, Oct 26, 2011 at 7:22 PM, Zantgo zan...@gmail.com wrote: WTF? I use OpenBSD and hate the other operating systems Don't listen to those posts - clearly you need the Windows 7 drivers if you're running -current.

Re: Quad-Gigabit 1U mini-itx board recommendations?

2011-10-01 Thread Chris Smith
On Sat, Oct 1, 2011 at 11:18 AM, Joe S js.li...@gmail.com wrote: Since I don't actually need 4 NICs, I'm looking at the new Intel S1200KP (mini-itx 1155 board with dual intel nics). I can put a g620t and get the same power consumption rates as an atom d525, for the same prices as the Soekris.

Re: -current userland not building

2011-09-28 Thread Chris Smith
On Fri, Sep 23, 2011 at 11:34 AM, Amit Kulkarni amitk...@gmail.com wrote: Yes, it happens when you start out. Look Nick added this because of you :-) http://www.openbsd.org/faq/current.html#20110919 Thank you Nick :) However, I just realized that:

Re: -current userland not building

2011-09-28 Thread Chris Smith
On Wed, Sep 28, 2011 at 3:00 PM, Amit Kulkarni amitk...@gmail.com wrote: The site at http://openbsd.org is not in sync with http://www.openbsd.org/. yes they are different. its addressed already in the archives multiple times. Found a thread from 2007 where Theo states www.openbsd.org is a

Re: -current userland not building

2011-09-28 Thread Chris Smith
On Wed, Sep 28, 2011 at 3:59 PM, Nick Holland n...@holland-consulting.net wrote: quit using the site without the www's. :) Yes, I've made a mental note to that effect and already edited my bookmarks. nowww.openbsd.org is not the source and never was (at least in the ten years I've been on the

Re: -current userland not building

2011-09-23 Thread Chris Smith
On Fri, Sep 23, 2011 at 3:56 AM, Tomas Bodzar tomas.bod...@gmail.com wrote: Mmmm are you on alpha or landisk that you follow those instructions? No, but I think a landshark was knocking at the door at the time and interrupted my train of thought :) In reality, the instructions weren't labelled

Re: -current userland not building

2011-09-22 Thread Chris Smith
, the question is, how do I get gcc-4.x back ? Thanks, Chris On Wed, Sep 21, 2011 at 12:01 PM, Chris Smith obsd_m...@chrissmith.org wrote: Problems building -current userland: == === libcurses cc -O2 -pipe -g -I. -I/usr/src/lib/libcurses B B -c codes.c -o codes.o cc

Re: -current userland not building

2011-09-22 Thread Chris Smith
On Thu, Sep 22, 2011 at 7:26 PM, Brynet bry...@gmail.com wrote: you may be able to extract the comp set I did extract the comp set from the latest snapshot and gcc-4.x was returned. However, once again the kernel compiled fine but received the same error with the userland, Chris

-current userland not building

2011-09-21 Thread Chris Smith
Problems building -current userland: == === libcurses cc -O2 -pipe -g -I. -I/usr/src/lib/libcurses-c codes.c -o codes.o cc -O2 -pipe -g -I. -I/usr/src/lib/libcurses-c comp_captab.c -o comp_captab.o cc -O2 -pipe -g -I. -I/usr/src/lib/libcurses-c

pf table creation query

2011-08-08 Thread Chris Smith
Searching for a method to create a table based on the contents a file but slightly modified without needing to modify the file itself. Non-modified example is: table fromfile persist file /mypath/assortedaddresses Yet, attempts to modify do not work: table fromfile persist { !x.x.x.x/y, file

PCIe wireless cards

2011-07-22 Thread Chris Smith
Hello, I'm not seeing any PCIe wireless devices listed under amd64 supported hardware. Does anyone know of any g/n PCIe cards that work in host AP mode? Thank you, Chris

Re: em0: watchdog timeout with -current

2011-07-04 Thread Chris Smith
@ Have no idea if it is a driver issue but if it is this info. might assist. Thanks, Chris On Sun, Jul 3, 2011 at 5:08 PM, Chris Smith obsd_m...@chrissmith.org wrote: System is hanging and I'm getting these errors after upgrading to -current: == em0

em0: watchdog timeout with -current

2011-07-03 Thread Chris Smith
System is hanging and I'm getting these errors after upgrading to -current: == em0: watchdog timeout -- resetting em0: watchdog timeout -- resetting == I can still boot and run with the old kernel but the new one is not working. From dmesg:

  1   2   3   >