Question about httpd tls config

Hi! I run httpd on 6.1-stable (thanks to all of you who make that possible!), with a pretty vanilla tls setup. When testing the server on ssllabs.com, results say that TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA is considered weak. How should I interpret that information, as you see it? And shouldn't de

Re: Question about httpd tls config

; tls cipher "HIGH:!aNULL:!3DES" > > Ronan > > > Le 15 août 2017 à 09:54, Andreas Thulin a > écrit : > > > > Hi! > > > > I run httpd on 6.1-stable (thanks to all of you who make that possible!), > > with a pretty van

Re: ftp.eu.openbsd.org no longer accepts anonymous ftp?

Also, yesterday's # pkg_add -u failed for me, apparently for that same reason. BR, Andreas lör 19 aug. 2017 kl. 11:06 skrev Peter N. M. Hansteen : > About to do my few-times-a-week upgrade to the most recent snapshot for > one of my systems earlier this week, I discovered that > ftp.eu.openbsd.

(Possibly OT) Trouble installing kanboard

Hi all! This may be OT, and if so I apologise (and appreciate being pushed in the right direction). I'm trying to install and run kanboard ( https://kanboard.net) on my 6.1-stable amd64 VPS using httpd + php 7.0.16 + php-fpm-7.0. At first, the web GUI installer complained (Internal Error: PHP ext

Re: (Possibly OT) Trouble installing kanboard

Ah. Awesome, thank you! BR, Andreas tis 12 sep. 2017 kl. 16:14 skrev Martijn van Duren < openbsd+m...@list.imperialat.at>: > On 09/12/17 15:38, Andreas Thulin wrote: > > Hi all! > > > > This may be OT, and if so I apologise (and appreciate being pushed in the > >

Need help setting http headers using relayd (and httpd)

Hi! Before anything, thanks for yet another awesome OpenBSD release! I’ll extend my gratitude into the pockets of the Foundation and finally donate this time. Then: I’m a relayd virgin. Consider all the following a lab exercise, I want to learn and understand more. My target: Understanding how

Re: Need help setting http headers using relayd (and httpd)

Thank you, I just bought the Kindle version. :-) BR, Andreas fre 13 okt. 2017 kl. 02:16 skrev Bryan Harris : > There is a book called relayd and httpd. I think it has what you need. > > V/r, > Bryan > > > > > On Oct 12, 2017, at 1:33 PM, Andreas Thulin > wro

Re: Need help setting http headers using relayd (and httpd)

;" match response header append "Content-Security-Policy" value "style-src 'self'" match response header append "Content-Security-Policy" value "img-src 'self'" match response header append "Content-Security-Policy&quo

Looking for discussions/threads on TLS v 1.3 (in OpenBSD context)

Hi all! Just out of curious interest, I've been googling a bit to find discussions or threads related to TLS 1.3, what "you guys" think of it, and what benefits and drawbacks it brings to the OpenBSD world. However, I'm either unlucky or a poor googler, because I can't seem to find any. If you kno

athn(4) and Atheros AR9462

Hi! I just installed OpenBSD 6.5 on an Acer Aspire 5 laptop I got, and realised after some googling that there is no driver available for the Atheros AR9462 wifi card. This seems to have been covered in previous posts here. Any pointers on the right course of action? I haven’t yet set up mail on

Re: athn(4) and Atheros AR9462

Thank you, perfect answer! :) BR, Andreas ons 18 sep. 2019 kl. 13:01 skrev Antal Ispanovity : > 2019-09-18 12:38 GMT+02:00, Andreas Thulin : > > Hi! > > > > I just installed OpenBSD 6.5 on an Acer Aspire 5 laptop I got, and > realised > > after some googling tha

mount smbfs (sharity-light is uncooperative)

Hi! After some googling, I couldn't find answers to my questions so I turn to this list. Please forgive me if this is a worn-out topic etc. - Is there a specific reason there's no "mount -t smbfs" or similar option in OpenBSD that let's me mount an smb filesystem easily, and on boot tim

Re: mount smbfs (sharity-light is uncooperative)

On Thu, Oct 22, 2015 at 2:47 PM Stuart Henderson wrote: > On 2015-10-22, Andreas Thulin wrote: > > Hi! > > > > After some googling, I couldn't find answers to my questions so I turn to > > this list. Please forgive me if this is a worn-out topic etc. > > &

Newbie question: Proxy for appearing in Sweden for on demand streaming?

Hi all! My mom lives in Sweden but spends loads of time in Spain. She likes the public service online TV streaming service, which cannot be watched abroad for various reasons. I thought I'd try to setup a proxy of some sort that she could turn her iPad to, and appear as if in Sweden while in fact

ikectl errors

Hi! I’m trying to set up iked on machine A, to create a tunnel between machines A and B. ikectl produces errors when creating a certificate with my ”test” ca, and I have failed to understans why: # ikectl ca test certificate 192.168.1.1 create Generating RSA private key, 2048 bit long modulus ...

Re: ikectl errors

Ah! Thank you! BR, Andreas ons 1 nov. 2017 kl. 20:36 skrev Mike Larkin : > On Wed, Nov 01, 2017 at 09:08:08AM +0000, Andreas Thulin wrote: > > Hi! > > > > I’m trying to set up iked on machine A, to create a tunnel between > machines > > A and B. ikectl produces erro

Re: ikectl errors

. Thanks again for the tip! BR, Andreas tors 2 nov. 2017 kl. 08:25 skrev Andreas Thulin : > Ah! Thank you! > > BR, Andreas > ons 1 nov. 2017 kl. 20:36 skrev Mike Larkin : > >> On Wed, Nov 01, 2017 at 09:08:08AM +, Andreas Thulin wrote: >> > Hi! >> > >

Re: Question on more concise httpd.conf setup for subdomain + https redirects

Hi! I suppose you can script one config into ”httpd.foo.net”, another to ” httpd.bar.com” etc. and then include all individual files into httpd.conf with the keyword ”include”? BR, Andreas fre 22 dec. 2017 kl. 03:39 skrev Ryan Flannery : > Hi, I'm curious if there's a more concise/preferred wa

Community-driven OpenBSD tutorials wiki?

Hi all! Thought I'd create an OpenBSD wiki somewhere, where anyone (especially non-developers like myself) could create and edit tutorials for stuff non-developers like myself would find useful. I find that sometimes existing tutorials become outdated, and was thinking that a wiki would make updat

help understanding ikectl error messages

Hi! Following the example on https://man.openbsd.org/ikectl, I # ikectl ca test create ...and then # ikectl ca test certificate sub.domain.com create ...filled out "the form", but after that... Using configuration from /etc/ssl/test/sub.domain.com-ssl.cnf Check that the request matches the signat

Writing "ones" instead of "zeroes" when wiping disk

Hi! Again, an ignorant question (as usual): How might I do something similar to # dd if=/dev/one of=/dev/sd0 bs=1M as a complement to the usual and well-described # dd if=/dev/zero of=/dev/sd0 bs=1M followed by # dd if=/dev/urandom of=/dev/sd0 bs=1M in order to achieve paranoid disk-wiping?

Re: Writing "ones" instead of "zeroes" when wiping disk

Thanks to all of you for either useful tips or good-to-read rants. :-) I’ll try out tips from Nick & Todd, let’s see where that takes me. BR, Andreas fre 12 jan. 2018 kl. 05:22 skrev Todd C. Miller : > On Thu, 11 Jan 2018 22:09:32 -0500, "trondd" wrote: > > > A 1 is too narrow to fully cover the

Re: help understanding ikectl error messages

, Andreas sön 14 jan. 2018 kl. 23:03 skrev Stuart Henderson : > On 2018-01-09, Andreas Thulin wrote: > > Hi! > > > > Following the example on https://man.openbsd.org/ikectl, I > > > > # ikectl ca test create > > ...and then > > # ikectl ca test certificate

Re: help understanding ikectl error messages

Thanks Stuart for replies! I can confirm that I could proceed without issues on 6.2-current. :-) BR, Andreas mån 15 jan. 2018 kl. 10:31 skrev Stuart Henderson : > On 2018/01/15 06:35, Andreas Thulin wrote: > > Sorry, my bad! > > > > 6.2-stable. And after sending my e-mail,

Anyone got stickers for sale?

Hi! Please forgive a very non-technical question: Does anyone in the list have spare OpenBSD and/or RUN BSD stickers for sale (to Sweden)? I recently changed jobs and failed to move stickers from one laptop to another. Feel very naked now. Poor me. In any case, TGIF. /Andreas

Can I run OpenBSD on an ASUS RT-AC88U?

Hi! Aplogies in advance if this post comes out as tremendously stupid - I'm not very experienced. I bought an ASUS RT-AC88U wireless router. Performance is great, but I lack the configurability I'm used to from working with on other boxes. Started out exploring options for making it a NAS by atta

Openup and stable

Hi all! I'm running 6.0 -stable using openup for patching. I think it works very well since it's so convenient. At the same time I realise there are trust and security concerns with people like myself, who "blindly" install patches without understanding the details. I suppose my problem is that I'

Re: Openup and stable

Fantastic, thanks for info! I'll look into syspatch, of course. :-) BR, Andreas lör 25 mars 2017 kl. 12:11 skrev Hiltjo Posthuma : > On Sat, Mar 25, 2017 at 08:49:22AM +, Andreas Thulin wrote: > > Hi all! > > > > Hey!, > > > I'm running 6.0 -stab

Re: Openup and stable

Thanks - I do, too. My questions were more about whether _I_ can be trusted. :-) lör 25 mars 2017 kl. 21:07 skrev Maurice McCarthy : > On Sat, Mar 25, 2017 at 11:53:35AM +0100 or thereabouts, ludovic coues > wrote: > > You might have missed the email from Antoine Jacoutot about syspatch, > > on t

How to create "paranoid" cipher list in httpd.conf

Hi misc readers! This is my first attempt to ask for help using misc@openbsd.org, so please bear with me if I'm making mistakes. Also, apologies if I'm asking about something recently discussed. I want to limit the number of tls ciphers​ in httpd.conf so that only strong (>128 bit) ciphers with