Intermediate cert in relayd?

2013-12-02 Thread Bernd
Hi list, I'm planning to configure SSL offloading using relayd(8). The manpage for relayd.conf(5) states the following: ``If the ssl keyword is present, the relay will accept connections using the encrypted SSL protocol. The relay will attempt to look up a private key in

ipsec or iked to deploy under openbsd carp fws

2013-12-02 Thread C. L. Martinez
Hi all, I need to deploy IPSec tunnels (lan-to-lan and roadwarriors clients like linux and windows) under two openbsd carp firewalls. Searching in google and reading some docs, I have several doubts about which one to choose. If I am not wrong, iked doesn't supports sasyncd, is it correct??

Re: ipsec or iked to deploy under openbsd carp fws

2013-12-02 Thread C. L. Martinez
On Mon, Dec 2, 2013 at 8:13 AM, C. L. Martinez carlopm...@gmail.com wrote: Hi all, I need to deploy IPSec tunnels (lan-to-lan and roadwarriors clients like linux and windows) under two openbsd carp firewalls. Searching in google and reading some docs, I have several doubts about which one

Re: 10G with Intel card - GBIC options

2013-12-02 Thread Andy
Hmm surprised by that! Henning, could you please confirm for us if the 32bit bandwidth limit was lifted in the new queuing subsystem, or if it is just still in place whilst dual-running the new and the old? I guess considering Hrvoje's findings the limit is still in place until ALTQ is

Re: 10G with Intel card - GBIC options

2013-12-02 Thread Kapetanakis Giannis
On 29/11/13 19:16, Andy wrote: On Fri 29 Nov 2013 16:19:26 GMT, Kapetanakis Giannis wrote: Unfortunately on the Cisco part I don't SFP+. I have XENPACK option only which give me 3 options: SR ~ 3K GPL LRM ~ 1.5K GPL (I can't find any LRM GBIC for Intel side) CX4 ~ 600 GPL I'd avoid CX4, you

Re: 10G with Intel card - GBIC options

2013-12-02 Thread Jonathan Gray
On Mon, Dec 02, 2013 at 11:36:31AM +0200, Kapetanakis Giannis wrote: On 29/11/13 19:16, Andy wrote: On Fri 29 Nov 2013 16:19:26 GMT, Kapetanakis Giannis wrote: Unfortunately on the Cisco part I don't SFP+. I have XENPACK option only which give me 3 options: SR ~ 3K GPL LRM ~ 1.5K GPL (I

Re: Intermediate cert in relayd?

2013-12-02 Thread Giancarlo Razzolini
Em 02-12-2013 06:05, Bernd escreveu: Hi list, I'm planning to configure SSL offloading using relayd(8). The manpage for relayd.conf(5) states the following: ``If the ssl keyword is present, the relay will accept connections using the encrypted SSL protocol. The relay will attempt to look

Re: Should Android have used OpenBSD instead of Linux?

2013-12-02 Thread Matthieu Herrb
On Tue, Nov 26, 2013 at 02:00:53PM -0800, Chris Cappuccio wrote: Chris Cappuccio [ch...@nmedia.net] wrote: openda...@hushmail.com [openda...@hushmail.com] wrote: Hi, What are the ups and downs of replacing Linux with OpenBSD in Google's Android operating system? I guess this

Help troubleshooting performance problem

2013-12-02 Thread Jan Lambertz
I m not sure if you already investigated this but s.m.a.r.t. has quite many diagnostic info. Even if the drive has not actually been marked as broken. This is somewhat vendor dependent. I did not check these info with openbsd but it should be possible. Facts from my hard drives include: Bad

Re: IPS hardware recomendation

2013-12-02 Thread deoxyt2
El 29-11-2013 14:26, Andy escribió: On Fri 29 Nov 2013 17:24:15 GMT, Andy wrote: Fastest you can buy!! Even then you probably struggle.. You'll need the fastest single core you can get your hands on for the network stack/OBSD kernel, and the other cores for Snort etc.. ... On Fri 29 Nov 2013

Re: Help troubleshooting performance problem

2013-12-02 Thread Erling Westenvik
On Mon, Dec 02, 2013 at 03:39:17PM +0100, Jan Lambertz wrote: I m not sure if you already investigated this but s.m.a.r.t. has quite many diagnostic info. Even if the drive has not actually been marked as broken. This is somewhat vendor dependent. I did not check these info with openbsd but it

Re: 10G with Intel card - GBIC options

2013-12-02 Thread Andy
Yea CX4 will work, its the chipset that matters. But CX4 is short range and superseded, and by using SFP+ you can pick and choose your transceivers for fibre or CAT cabling etc. On Mon 02 Dec 2013 10:10:37 GMT, Jonathan Gray wrote: On Mon, Dec 02, 2013 at 11:36:31AM +0200, Kapetanakis

uvm_fault with OpenBSD 5.4

2013-12-02 Thread Kor son of Rynar
Hey guys, I have just upgraded two Dell servers (a PowerEdge R410 and a R320) to OpenBSD 5.4-stable -- before the upgrade, these machines were running 5.3-stable without a problem. After the upgrade to 5.4, both machines started to panic with a uvm_fault. (3 panics so far...) The panic messages

Re: 10G with Intel card - GBIC options

2013-12-02 Thread Kapetanakis Giannis
On 02/12/13 17:15, Andy wrote: Yea CX4 will work, its the chipset that matters. But CX4 is short range and superseded, and by using SFP+ you can pick and choose your transceivers for fibre or CAT cabling etc. Well the Cisco CX4 costs ~ 600$ List price, while the SR one costs 3.000$ List

Re: Should Android have used OpenBSD instead of Linux?

2013-12-02 Thread Maxim Belooussov
On Sat, Nov 30, 2013 at 6:41 PM, Mikael mikael.tr...@gmail.com wrote: just like everyone else, i would love to see an openbsd powered android phone. but i think the elephant in the room no one is talking about is performance. without getting into running bad code faster vs running

Re: Help troubleshooting performance problem

2013-12-02 Thread David Vasek
On Mon, 2 Dec 2013, Erling Westenvik wrote: On Mon, Dec 02, 2013 at 03:39:17PM +0100, Jan Lambertz wrote: I m not sure if you already investigated this but s.m.a.r.t. has quite many diagnostic info. Even if the drive has not actually been marked as broken. This is somewhat vendor dependent. I

Re: ntfs with big files

2013-12-02 Thread Joel Sing
On Sat, 19 Oct 2013, David Vasek wrote: On Thu, 17 Oct 2013, David Vasek wrote: On Fri, 11 Oct 2013, Joel Sing wrote: On Thu, 10 Oct 2013, Manuel Giraud wrote: Hi, I have a ntfs partition with rather large (about 3GB) files on it. When I copy these files on a ffs partition they are

Re: 10G with Intel card - GBIC options

2013-12-02 Thread Andy
The choice is of course yours.. ;) It would be worth trying a Cisco 'compatible' first before spending the big bucks on 'branded' optics.. http://www.gbics.com/xenpak-10gb-sr/?gclid=CKv_96G-irsCFSX4wgodQDEAdA Anyway, this is quite a personal decision and does affect support.. On Mon 02 Dec

Re: Should Android have used OpenBSD instead of Linux?

2013-12-02 Thread sven falempin
On Mon, Dec 2, 2013 at 7:50 AM, Matthieu Herrb mhe...@gmail.com wrote: On Tue, Nov 26, 2013 at 02:00:53PM -0800, Chris Cappuccio wrote: Chris Cappuccio [ch...@nmedia.net] wrote: openda...@hushmail.com [openda...@hushmail.com] wrote: Hi, What are the ups and downs of replacing

Re: Should Android have used OpenBSD instead of Linux?

2013-12-02 Thread Theo de Raadt
cross compiling is really missing in openBSD to handle very small Platform which does not have the power to compile, and more. If you choose to not become educated, fine, that's your choice. There is a completely fine cross-build environment that works well. We can natively build on a vax and a

NPPPD and IPSec

2013-12-02 Thread Or Elimelech
Hi, I'm having trouble configuring Windows clients with l2tp over ipsec, This config works great on OSX/iOS/Android/Linux I do not know which type of auth/enc/group I should use for Windows clients I currently use OpenBSD 5.4 with the following ike passive esp transport \ proto udp from

Re: 10G with Intel card - GBIC options

2013-12-02 Thread Chris Cappuccio
Kapetanakis Giannis [bil...@edu.physics.uoc.gr] wrote: On 02/12/13 17:15, Andy wrote: Yea CX4 will work, its the chipset that matters. But CX4 is short range and superseded, and by using SFP+ you can pick and choose your transceivers for fibre or CAT cabling etc. Well the Cisco CX4 costs

Potential scripting engine to integrate into mg?

2013-12-02 Thread Edward L.
Hello misc@ There have been discussions about extending mg with tinyscheme: http://www.daemonforums.org/showthread.php?t=7262 Or with lua: http://undeadly.org/cgi?action=articlesid=20120723072952 What about with python? Any thoughts? Regards,Edward.

Re: Potential scripting engine to integrate into mg?

2013-12-02 Thread Theo de Raadt
There have been discussions about extending mg with tinyscheme: http://www.daemonforums.org/showthread.php?t=7262 Or with lua: http://undeadly.org/cgi?action=articlesid=20120723072952 What about with python? So we should put python in the base. That would be great.

Re: Potential scripting engine to integrate into mg?

2013-12-02 Thread Edward L.
So why don't we have python in the base? Perl is in there. Just curious, not that I'm requesting. :-) Thanks. Edward From: Theo de Raadt dera...@cvs.openbsd.org To: Edward L. drawd...@gmail.com CC: misc@openbsd.org

Re: Potential scripting engine to integrate into mg?

2013-12-02 Thread Gregor Best
On Mon, Dec 02, 2013 at 08:41:47PM -, Edward L. wrote: [...] Any thoughts? [...] For that, tinyscheme, lua or python would have to be integrated into base. That seems rather unlikely. What would be nice would be to take the Lisp interpreter from xedit and integrate it into mg. Xedit is in

Re: Potential scripting engine to integrate into mg?

2013-12-02 Thread Ted Unangst
On Mon, Dec 02, 2013 at 20:58, Edward L. wrote: So why don't we have python in the base? Perl is in there. Just curious, not that I'm requesting. :-) It's totally reasonable for an operating system to include *a* first class scripting language. It allows us to build tools like pkg_add in that

Re: NPPPD and IPSec

2013-12-02 Thread Frans Haarman
I have used this with windows 7 and osx: ike passive esp transport \ proto udp from $public_ip to any port 1701 \ main auth hmac-sha1 enc 3des group modp1024 \ quick auth hmac-sha1 enc aes \ psk 2013/12/2 Or Elimelech o...@xwise.com Hi, I'm having trouble

Re: Potential scripting engine to integrate into mg?

2013-12-02 Thread Marc Espie
On Mon, Dec 02, 2013 at 04:13:34PM -0500, Ted Unangst wrote: On Mon, Dec 02, 2013 at 20:58, Edward L. wrote: So why don't we have python in the base? Perl is in there. Just curious, not that I'm requesting. :-) It's totally reasonable for an operating system to include *a* first class

Re: BGP changes to support CARP better

2013-12-02 Thread andy
Hi, Could someone help me with this issue we have found where the OpenBGPd rule 'match to bgppeerip set nexthop bgpcarpip' doesn't work if OpenBGPd is started whilst the OpenBSD host is a carp master. It only works if it is a CARP backup :( Or could someone give me a clue where in the source

Re: BGP changes to support CARP better

2013-12-02 Thread Chris Cappuccio
andy [a...@brandwatch.com] wrote: Hi, Could someone help me with this issue we have found where the OpenBGPd rule 'match to bgppeerip set nexthop bgpcarpip' doesn't work if OpenBGPd is started whilst the OpenBSD host is a carp master. It only works if it is a CARP backup :( Or could

Re: wifi firmware for lenovo thinkpad E420

2013-12-02 Thread Craig McCormick
Siju George sgeorge.ml2 at gmail.com writes: On Fri, May 11, 2012 at 12:11 AM, Henning Brauer lists-openbsd at bsws.de wrote: I have one of these somewhere - basically, all that is needed is a pci attachment for the existing urtwn. shouldn't be too hard, but as usual - somebody has to

Re: BGP changes to support CARP better

2013-12-02 Thread athompso
No, I'm seeing the same thing - the carp master advertises the carp IP as next-hop no matter what. The carp backup advertises whatever you've told it to advertise via set nexthop. -Adam On Dec 2, 2013 6:43 PM, Chris Cappuccio ch...@nmedia.net wrote: andy [a...@brandwatch.com] wrote: Hi,

Re: wifi firmware for lenovo thinkpad E420

2013-12-02 Thread cyril
On 12/2/2013 11:10 PM, Craig McCormick wrote: Siju George sgeorge.ml2 at gmail.com writes: On Fri, May 11, 2012 at 12:11 AM, Henning Brauer lists-openbsd at bsws.de wrote: I have one of these somewhere - basically, all that is needed is a pci attachment for the existing urtwn. shouldn't be

Lenovo L420 ACPI, kernel panic

2013-12-02 Thread Cyril Andreichuk
hi there is always a kernel panic when booting with enabled acpi on my Lenovo ThinkPad L420 (7854RP1). here are pics of it and trace http://imgur.com/KPW4972http://imgur.com/gUAV1Gy any suggestions? thanks

Re: NPPPD and IPSec

2013-12-02 Thread MJ
This works with Windows 8, OSX, Android and iOS: ike passive esp transport \ proto udp from $public_ip to any port 1701 \ main auth hmac-sha1 enc aes group modp1024 \ quick auth hmac-sha1 enc aes \ psk $psk On 03 Dec 2013, at 00:28, Frans Haarman