Re: Max number of states in pf? (100k? 200k? 1M?)

2005-09-24 Thread nate
Ted Unangst said: states are only allocated on demand. you could set the limit to a billion with no problem until you actually start using too many states. the limit is there to protect you from the firewall imploding. thanks for all the info, very useful! hopefully such info can get added

Re: upgrade is it important ?

2005-09-24 Thread Stuart Henderson
--On 24 September 2005 08:53 +0700, Budhi Setiawan wrote: 1. how important to make our system (OS and packages) always up-to-date ( except with security reason of course ), because some people says you should update your system at least once a year Given the ease of upgrading OpenBSD, and

Re: slow ssh connect

2005-09-24 Thread Darren Tucker
Simon Strandgaard wrote: I have openbsd 3.7 on an old P133. Connecting with SSH to the box takes near 20 seconds. Any ideas on how to make it go faster? http://www.openssh.com/faq.html#3.3 -- Darren Tucker (dtucker at zip.com.au) GPG key 8FF4FA69 / D9A3 86E9 7EEE AF4B B2D4 37C9 C982 80C7

Re: is there a way to block sshd trolling?

2005-09-24 Thread Matthias Kilian
On Fri, Sep 23, 2005 at 08:07:35PM -0600, jared r r spiegel wrote: caveat is that i currently haven't implemented a way to expire entries out, however until you get something fancier tested/implemented, some simple pf action like that above might fly /usr/ports/sysutils/expiretable in

Re: slow ssh connect

2005-09-24 Thread Simon Strandgaard
On 9/24/05, Simon Strandgaard [EMAIL PROTECTED] wrote: I have openbsd 3.7 on an old P133. Connecting with SSH to the box takes near 20 seconds. Any ideas on how to make it go faster? just realized that ssh takes a '-v' argument.. output attached. approx 13 seconds is spend in this line:

Re: slow ssh connect

2005-09-24 Thread Stuart Henderson
--On 24 September 2005 11:27 +0200, Simon Strandgaard wrote: I have openbsd 3.7 on an old P133. Connecting with SSH to the box takes near 20 seconds. Any ideas on how to make it go faster? Depending on your needs, either read about ControlMaster in ssh_config(5) and -M in ssh(1), or use the

Re: slow ssh connect

2005-09-24 Thread moma
On 9/24/05, Simon Strandgaard [EMAIL PROTECTED] wrote: I have openbsd 3.7 on an old P133. Connecting with SSH to the box takes near 20 seconds. Any ideas on how to make it go faster? ssh [EMAIL PROTECTED] -- Simon Strandgaard look into /etc/hosts, it probably has to do with dns

Re: slow ssh connect

2005-09-24 Thread Tarquin Joseph
You may want to check your /etc/resolv.conf and make sure you have at least one valid nameserver entry. nameserver a.b.c.d Tarquin. On 9/24/05, Simon Strandgaard [EMAIL PROTECTED] wrote: I have openbsd 3.7 on an old P133. Connecting with SSH to the box takes near 20 seconds. Any ideas on

Time limited internet connection

2005-09-24 Thread Kiraly Zoltan
I want to build a home network using OpenBSD as gateway. A child in network have a computer, and like to surf the Internet. I want to drop her Internet connection at night (11:00AM) because the child don't go to sleep. I don't want to unplug the network cable, i need to do this job with

Re: Time limited internet connection

2005-09-24 Thread Rod.. Whitworth
On Sat, 24 Sep 2005 13:29:18 +0300, Kiraly Zoltan wrote: I want to build a home network using OpenBSD as gateway. A child in network have a computer, and like to surf the Internet. I want to drop her Internet connection at night (11:00AM) because the child don't go to sleep. 11 AM at night is

Re: Time limited internet connection

2005-09-24 Thread Rogier Krieger
On 9/24/05, Kiraly Zoltan [EMAIL PROTECTED] wrote: I want to drop her Internet connection at night (11:00AM) because the child don't go to sleep. It would seem your problem is primarily one of parenting and not so much a technical one. Still, cron(8) and various self-made scripts may prove

Re: Time limited internet connection

2005-09-24 Thread Kiraly Zoltan
Rod.. Whitworth wrote: On Sat, 24 Sep 2005 13:29:18 +0300, Kiraly Zoltan wrote: I want to build a home network using OpenBSD as gateway. A child in network have a computer, and like to surf the Internet. I want to drop her Internet connection at night (11:00AM) because the child don't go

Re: Time limited internet connection

2005-09-24 Thread steven mestdagh
On Sat, Sep 24, 2005 at 08:45:25PM +1000, Rod.. Whitworth wrote: On Sat, 24 Sep 2005 13:29:18 +0300, Kiraly Zoltan wrote: I want to build a home network using OpenBSD as gateway. A child in network have a computer, and like to surf the Internet. I want to drop her Internet connection at

Re: slow ssh connect

2005-09-24 Thread Simon Strandgaard
On 9/24/05, Darren Tucker [EMAIL PROTECTED] wrote: Simon Strandgaard wrote: just realized that ssh takes a '-v' argument.. output attached. approx 13 seconds is spend in this line: debug1: Local version string SSH-2.0-OpenSSH_3.6.1p1+CAN-2004-0175 any ideas how to make this error go

Re: Time limited internet connection

2005-09-24 Thread Nick Holland
Rod.. Whitworth wrote: On Sat, 24 Sep 2005 13:29:18 +0300, Kiraly Zoltan wrote: I want to build a home network using OpenBSD as gateway. A child in network have a computer, and like to surf the Internet. I want to drop her Internet connection at night (11:00AM) because the child don't go to

Re: upgrade is it important ?

2005-09-24 Thread Nick Holland
Budhi Setiawan wrote: dear all i guess this is stupid question, but since i very young in the openbsd land, i have a lof of question : 1. how important to make our system (OS and packages) always up-to-date ( except with security reason of course ), because some people says you should

Re: recommended USB 2.0 host adapters?

2005-09-24 Thread steven mestdagh
On Sun, Sep 18, 2005 at 02:34:10AM +0100, Niall O'Higgins wrote: I'm going to extend my i386 machine with a USB 2.0 (PCI) host adapter. Are there any recommended cards or cards that I should not buy or that do not work? I think they are pretty much all ehci(4). yep, bought a Eminent

Re: is there a way to block sshd trolling?

2005-09-24 Thread ed
On Fri, 23 Sep 2005 21:24:26 -0700 Ray Percival [EMAIL PROTECTED] wrote: Yeah. This is only a threat against *really* weak boxes. Having said that I've seen a lot of posts talking about changing ports. That's a line that I won't cross. I refuse to hide from the bots and it's not even a

Re: is there a way to block sshd trolling?

2005-09-24 Thread Stuart Henderson
--On 24 September 2005 13:31 +0100, ed wrote: What they did was to exploit gzip, I'm fairly certain. I could not apt-get of course and thus left helpless. I no longer have faith in user passwords. I do my best to prevent people using common user names (besides myself who uses 'ed' of course,

Re: is there a way to block sshd trolling?

2005-09-24 Thread frantisek holop
just a minor variation (in B dur) for what the others had said: relevant parts of /etc/pf.conf: SSH_LIMIT=(max-src-conn-rate 3/30, overload bad_ssh flush global) table bad_ssh persist block return-rst log quick proto tcp from bad_ssh label ssh-pirate block in pass in on $ext_if proto tcp from

Re: upgrade is it important ?

2005-09-24 Thread Marc Peters
I am on OpenBSD since 3.6. Whenever i did feel i need an upgrade to a newer version, i did, because it works for my configurations. i insert the cd (if it's a snapshot or release), or fetch the sources, upgrade the whole system and it simply works. that's it. and that's the thing i am awaiting

Re: named log files

2005-09-24 Thread Bryan Irvine
named[1028]: unable to rename log file 'named_query.log' to 'named_query.log.0': permission denied The logfiles are in /var/named... do I need to chgrp on this directory? Yes, typical Unix stuff. Check r/w and uid/gid permissions. --Bryan