Re: emmc support on Ubiquiti Networks UniFi Security Gateway PRO-4

2019-02-25 Thread Sebastian Benoit
Diana Eichert(deich...@wrench.com) on 2019.02.24 13:42:34 -0700: > thanks everyone for their feedback. > > I ended up backing up internal emmc drive and disklabel > dd if=/dev/rsd1c of=emmc_4G_backup/factory_linux.img bs=8225280 count=481 > > next step is install on internal drive. > > New

Re: iked road warrior setup with multiple clients connecting

2019-02-25 Thread Hrvoje Popovski
On 25.2.2019. 16:44, Michael Lam wrote: > Hi, > > I have a very straight forward setup use case that I want to use my > OpenBSD router as a VPN gateway, which will accept IKEv2 road warrior > connections from the Internet and route all traffics through my > router. > > I am using a ms-chapv2

Re: security - preferred way to make check_access_file happy?

2019-02-25 Thread Stuart Henderson
On 2019/02/25 09:13, Adam Thompson wrote: > > Use vipw to put 13 * in the password field > > > > From passwd(5) > > [...] > > authentication, conventionally have 13 asterisks in the password field. > > Thank you! Now that I know what I'm looking for, I can see the relevant > code in

Re: pppoe(4) and vlan(4)

2019-02-25 Thread Markus Hennecke
Am 25.02.2019 um 16:30 schrieb Thomas Huber: > Hi misc, > > i got the opportuniy to have 4 ADSL links to my rural site. > Two links have already been there and OpenBSD -stable running a APU2 is > shaping the traffic between this two links. > > But now I struggle with setting up the 3rd (pppoe2)

Re: emmc support on Ubiquiti Networks UniFi Security Gateway PRO-4

2019-02-25 Thread Diana Eichert
I'm going to build the updated version Stuart posted. Will be awhile as USG aren't the fastest build platform. thanks On Mon, Feb 25, 2019 at 10:56 AM Sebastian Benoit wrote: > > Diana Eichert(deich...@wrench.com) on 2019.02.24 13:42:34 -0700: > > thanks everyone for their feedback. > > > > I

Re: security - preferred way to make check_access_file happy?

2019-02-25 Thread Adam Thompson
On 2019-02-25 11:14, Stuart Henderson wrote: On 2019/02/25 09:13, Adam Thompson wrote: > Use vipw to put 13 * in the password field > > From passwd(5) > [...] > authentication, conventionally have 13 asterisks in the password field. Thank you! Now that I know what I'm looking for, I can see

Re: security - preferred way to make check_access_file happy?

2019-02-25 Thread Theo Buehler
On Mon, Feb 25, 2019 at 05:14:50PM +, Stuart Henderson wrote: > On 2019/02/25 09:13, Adam Thompson wrote: > > > Use vipw to put 13 * in the password field > > > > > > From passwd(5) > > > [...] > > > authentication, conventionally have 13 asterisks in the password field. > > > > Thank you!

Re: "bioctl -d" before shutdown

2019-02-25 Thread Roderick
I suspect, umount (that always syncs) is enough and umount happens always at shutdown. Rodrigo On Mon, 25 Feb 2019, Kapfhammer, Stefan wrote: I have the umount and bioctl -d commands in /etc/rc.shutdown, in case I forget to do it manually. If you don't do that proberly, you will need to

Re: security - preferred way to make check_access_file happy?

2019-02-25 Thread Stuart Henderson
On 2019/02/25 18:20, Theo Buehler wrote: > On Mon, Feb 25, 2019 at 05:14:50PM +, Stuart Henderson wrote: > > On 2019/02/25 09:13, Adam Thompson wrote: > > > > Use vipw to put 13 * in the password field > > > > > > > > From passwd(5) > > > > [...] > > > > authentication, conventionally have

Re: iked road warrior setup with multiple clients connecting

2019-02-25 Thread William Ahern
On Mon, Feb 25, 2019 at 03:44:10PM +, Michael Lam wrote: > Hi, > > I have a very straight forward setup use case that I want to use my > OpenBSD router as a VPN gateway, which will accept IKEv2 road warrior > connections from the Internet and route all traffics through my > router. > > I am

Re: "bioctl -d" before shutdown

2019-02-25 Thread Kapfhammer, Stefan
‎Hi, I have the umount and bioctl -d commands in /etc/rc.shutdown, in case I forget to do it manually. If you don't do that proberly, you will need to fsck the device, next time you attach it. -Stefan ‎ Origineel bericht Van: Roderick Verzonden: zondag 24 februari 2019 21:53 Aan:

Re: Can't set up IPv6 for IKEv2 VPN

2019-02-25 Thread Fernando Gont
On 11/2/19 11:32, Aram Hăvărneanu wrote: > Hello, > > I am trying to set-up an dual-stack IKEv2/IPsec VPN. The server is > OpenBSD (obviously). The clients are macs (so far). IPv4 works, but > I can't get IPv6 working for the clients. The clients get a v6 IP > and a good route, but it seems

Re: "bioctl -d" before shutdown

2019-02-25 Thread chohag
Roderick writes: > > I suspect, umount (that always syncs) is enough and umount > happens always at shutdown. How do people cope with "I suspect"? "I suspect" would scare the crap out of me. Did it never occur that it's possible to _know_? Not unmounting is dangerous because there are in-memory

Re: A (partial) vmmci(4) Linux implementation

2019-02-25 Thread Mike Larkin
On Sun, Feb 24, 2019 at 12:21:24PM -0500, Dave Voutila wrote: > I've been experimenting with implementing something like vmmci(4) for > Linux guests. It's started to prove useful to myself so maybe others > will benefit, even though there are currently some caveats[1]. > >

Re: pppoe(4) and vlan(4)

2019-02-25 Thread Stuart Henderson
On 2019-02-25, Markus Hennecke wrote: > Am 25.02.2019 um 16:30 schrieb Thomas Huber: >> Hi misc, >> >> i got the opportuniy to have 4 ADSL links to my rural site. >> Two links have already been there and OpenBSD -stable running a APU2 is >> shaping the traffic between this two links. >> >> But

Re: iked road warrior setup with multiple clients connecting

2019-02-25 Thread Stuart Henderson
On 2019-02-25, Michael Lam wrote: > Hi, > > I have a very straight forward setup use case that I want to use my > OpenBSD router as a VPN gateway, which will accept IKEv2 road warrior > connections from the Internet and route all traffics through my > router. > > I am using a ms-chapv2

Re: emmc support on Ubiquiti Networks UniFi Security Gateway PRO-4

2019-02-25 Thread Stuart Henderson
I may be doing it wrong, but if I download an old fedora squash.img or openwrt's openwrt-x86-generic-rootfs-squashfs.img and attempt to mount it using this on amd64, it gives me an empty directory. Other supposedly squashfs image files that I tried were mostly rejected with "This doesn't look like

snapshots files timestamps

2019-02-25 Thread Mihai Popescu
Hello, I am trying since a while to figure out the master site / mirrors files timestamps. Here is the thing: I can see the timestamps on master site, ftp.openbsd.org (let's skip the transfer protocol, like ftp, http/https). Are these timestamps the original from compilation time? I mean, does

Re: pppoe(4) and vlan(4)

2019-02-25 Thread Thomas Huber
Hi Markus, I just spotted the typo too but doesn´t make difference when setting to pppoe2. I guess the handshake doesn´t get that far. The inet within the vlan0 ist just a leftover from trying around. Cleaning it up couldn´t establish the connection neither. --mirac On Mon, 25 Feb 2019 at

Re: security - preferred way to make check_access_file happy?

2019-02-25 Thread Stuart Henderson
On 2019/02/25 08:50, Adam Thompson wrote: > Hi, > I'm getting daily insecurity (i.e. security(8)) nags about userids that are > off but still have a valid shell and access files. (Specifically, I'm > getting the nag from check_access_files() in /usr/libexec/security.) > > Since ports (at least

Re: Keeping track of MAC addresses

2019-02-25 Thread Kapetanakis Giannis
On 20/02/2019 23:38, Henry Bonath wrote: > Not sure if this is what you are looking for, but I like Netdisco for this. > It uses SNMP to query network routers, switches, and access points, > and dumps out their TCAM as well as ARP tables into a Database in > order to preserve a history of not only

my constraints paradox

2019-02-25 Thread Peter J. Philipp
Hi, I'm currently working with TSIG (RFC 2845) on my project. The idea came to me to use it as a constraint to openntpd. This would solve a paradox on my NUC which does DNS in my apartment. The NUC's BIND uses TSIG to question a forwarder for DNS answers. TSIG relies on time to be correct

Re: Block/allow outgoing traffic by user or application?

2019-02-25 Thread Stuart Henderson
On 2019-02-25, Frank Beuth wrote: > On Sun, Feb 24, 2019 at 03:12:31PM +, Stuart Henderson wrote: >>Basically I'm trying to say, if you wanted to do it the other way round >>(pass by default, block certain traffic) you wouldn't be able to block >>everything. >> >>If you're trying to stop all

Re: security - preferred way to make check_access_file happy?

2019-02-25 Thread Adam Thompson
Use vipw to put 13 * in the password field From passwd(5) [...] authentication, conventionally have 13 asterisks in the password field. Thank you! Now that I know what I'm looking for, I can see the relevant code in security(8), too. I wonder if there's a way for ports to do that for me

Re: security - preferred way to make check_access_file happy?

2019-02-25 Thread Adam Thompson
Whoops... I'm getting the messages from 3 systems, all running 6.4-STABLE, with no local modifications, under both VMware and Openstack, using openup to keep systems updated. Dmesg available if anyone thinks it's relevant. -Adam On 2019-02-25 08:50, Adam Thompson wrote: Hi, I'm getting

Re: security - preferred way to make check_access_file happy?

2019-02-25 Thread Solene Rapenne
On Mon, Feb 25, 2019 at 08:50:18AM -0600, Adam Thompson wrote: > Hi, > I'm getting daily insecurity (i.e. security(8)) nags about > userids that are off but still have a valid shell and access > files. (Specifically, I'm getting the nag from > check_access_files() in /usr/libexec/security.) > >

Re: Block/allow outgoing traffic by user or application?

2019-02-25 Thread Frank Beuth
On Mon, Feb 25, 2019 at 12:31:42PM -, Stuart Henderson wrote: I've not done much with ssh tun forwarding, but I have previously had to run openvpn over TCP and didn't find that it really get in the way in practice, even with connections over wifi. It would depend on connection

security - preferred way to make check_access_file happy?

2019-02-25 Thread Adam Thompson
Hi, I'm getting daily insecurity (i.e. security(8)) nags about userids that are off but still have a valid shell and access files. (Specifically, I'm getting the nag from check_access_files() in /usr/libexec/security.) Since ports (at least in my experience) regularly creates userids that

Re: my constraints paradox

2019-02-25 Thread Otto Moerbeek
On Mon, Feb 25, 2019 at 09:38:13AM +0100, Peter J. Philipp wrote: > Hi, > > I'm currently working with TSIG (RFC 2845) on my project. The idea came to me > to use it as a constraint to openntpd. This would solve a paradox on my NUC > which does DNS in my apartment. The NUC's BIND uses TSIG to

Re: security - preferred way to make check_access_file happy?

2019-02-25 Thread Solene Rapenne
On Mon, Feb 25, 2019 at 09:13:33AM -0600, Adam Thompson wrote: > > Use vipw to put 13 * in the password field > > > > From passwd(5) > > [...] > > authentication, conventionally have 13 asterisks in the > > password field. > > Thank you! Now that I know what I'm looking for, I can see the >

pppoe(4) and vlan(4)

2019-02-25 Thread Thomas Huber
Hi misc, i got the opportuniy to have 4 ADSL links to my rural site. Two links have already been there and OpenBSD -stable running a APU2 is shaping the traffic between this two links. But now I struggle with setting up the 3rd (pppoe2) link. As far as I know I´ve to go through a vlan(4) with

iked road warrior setup with multiple clients connecting

2019-02-25 Thread Michael Lam
Hi, I have a very straight forward setup use case that I want to use my OpenBSD router as a VPN gateway, which will accept IKEv2 road warrior connections from the Internet and route all traffics through my router. I am using a ms-chapv2 authentication and a letsencrypt certificate, which I can

Re: Is there a fix for stock vi's bug-for-bug compatible ESC-equals-return feature?

2019-02-25 Thread Alfred Morgan
I do find this behavior odd but then I realized that this cancel-applies mentality has been with us all along: https://creativepro.com/secrets-of-the-esc-key/ "The effect of the Esc key is often the opposite of the Enter (or Return) key." "Be aware of how the Esc key works in each application you

Re: my constraints paradox

2019-02-25 Thread Peter J. Philipp
On Mon, Feb 25, 2019 at 05:04:01PM +0100, Otto Moerbeek wrote: > I've done some work in a related area, bootstrapping ntpd while using > a DNSSEC enabled resolver. If the time is off, that does not work atm. > That work was never finished because of reasons. *nod* yeah time is a decisive factor.