Re: ssh agent authentication for doas

2015-07-26 Thread Vadim Zhukov
2015-07-26 13:06 GMT+03:00 David Gwynne da...@gwynne.id.au: On 26 Jul 2015, at 7:41 pm, Vadim Zhukov persg...@gmail.com wrote: 2015-07-26 12:19 GMT+03:00 David Gwynne da...@gwynne.id.au: On 26 Jul 2015, at 7:07 pm, Nicholas Marriott nicholas.marri...@gmail.com wrote: Hi I can't say I

Re: ssh agent authentication for doas

2015-07-26 Thread Nicholas Marriott
Fair enough, thanks. On Sun, Jul 26, 2015 at 07:19:06PM +1000, David Gwynne wrote: On 26 Jul 2015, at 7:07 pm, Nicholas Marriott nicholas.marri...@gmail.com wrote: Hi I can't say I know a lot about bsdauth so maybe this is a stupid question, but could this work as a login_*

ssh agent authentication for doas

2015-07-26 Thread David Gwynne
this is rough, but enough to start a discussion. this lets doas authenticate a user by talking to their ssh agent by specifying 'ssh-agent' on a permit line in the config. if agent auth fails, doas falls back to bsd auth (ie, password auth). to minimise the amount of code needed in doas, most of

Re: ssh agent authentication for doas

2015-07-26 Thread David Gwynne
On 26 Jul 2015, at 7:07 pm, Nicholas Marriott nicholas.marri...@gmail.com wrote: Hi I can't say I know a lot about bsdauth so maybe this is a stupid question, but could this work as a login_* authentication method instead of doas doing it? i had a look at that. the biggest technical

Re: ssh agent authentication for doas

2015-07-26 Thread Vadim Zhukov
2015-07-26 12:19 GMT+03:00 David Gwynne da...@gwynne.id.au: On 26 Jul 2015, at 7:07 pm, Nicholas Marriott nicholas.marri...@gmail.com wrote: Hi I can't say I know a lot about bsdauth so maybe this is a stupid question, but could this work as a login_* authentication method instead of

doas -n

2015-07-26 Thread Marc Espie
I don't think it falls on the side of bloat, and it's a pretty nifty option to sudo... Index: doas.1 === RCS file: /build/data/openbsd/cvs/src/usr.bin/doas/doas.1,v retrieving revision 1.10 diff -u -p -r1.10 doas.1 --- doas.1

Re: ssh agent authentication for doas

2015-07-26 Thread David Gwynne
On 26 Jul 2015, at 7:41 pm, Vadim Zhukov persg...@gmail.com wrote: 2015-07-26 12:19 GMT+03:00 David Gwynne da...@gwynne.id.au: On 26 Jul 2015, at 7:07 pm, Nicholas Marriott nicholas.marri...@gmail.com wrote: Hi I can't say I know a lot about bsdauth so maybe this is a stupid

Re: doas -n

2015-07-26 Thread Marc Espie
On Sun, Jul 26, 2015 at 02:27:55PM +0300, Vadim Zhukov wrote: 2015-07-26 14:15 GMT+03:00 Marc Espie es...@nerim.net: I don't think it falls on the side of bloat, and it's a pretty nifty option to sudo... Index: doas.1

Update to /etc/services

2015-07-26 Thread Denis Fondras
Hello, Following is a patch to add BFD specific ports (RFC5881) and move RDP entry so the list is ordered. Denis Index: etc/services === RCS file: /cvs/src/etc/services,v retrieving revision 1.93 diff -u -p -r1.93 services ---

Re: ssh agent authentication for doas

2015-07-26 Thread Nicholas Marriott
Hi I can't say I know a lot about bsdauth so maybe this is a stupid question, but could this work as a login_* authentication method instead of doas doing it? On Sun, Jul 26, 2015 at 06:43:57PM +1000, David Gwynne wrote: this is rough, but enough to start a discussion. this lets doas

Re: Update to /etc/services

2015-07-26 Thread Stuart Henderson
Are both TCP and UDP actually used for these? If not, please only list the protocols which are used (not just reserved). On 26 July 2015 09:53:52 BST, Denis Fondras open...@ledeuns.net wrote: Hello, Following is a patch to add BFD specific ports (RFC5881) and move RDP entry so the list is

Re: Update to /etc/services

2015-07-26 Thread Denis Fondras
Are both TCP and UDP actually used for these? If not, please only list the protocols which are used (not just reserved). Only UDP is used currently. Index: services === RCS file: /cvs/src/etc/services,v retrieving revision 1.93

Re: doas -n

2015-07-26 Thread Vadim Zhukov
26 июля 2015 г. 14:43 пользователь Marc Espie es...@nerim.net написал: On Sun, Jul 26, 2015 at 02:27:55PM +0300, Vadim Zhukov wrote: 2015-07-26 14:15 GMT+03:00 Marc Espie es...@nerim.net: I don't think it falls on the side of bloat, and it's a pretty nifty option to sudo...

Re: doas -n

2015-07-26 Thread Marc Espie
On Sun, Jul 26, 2015 at 03:07:06PM -0400, Ted Unangst wrote: Marc Espie wrote: I don't think it falls on the side of bloat, and it's a pretty nifty option to sudo... @@ -361,7 +365,7 @@ main(int argc, char **argv, char **envp) } if (!(rule-options NOPASS)) { -

Re: crypto softraid and keydisk on same harddrive

2015-07-26 Thread Patrik Lundin
On Sat, Apr 25, 2015 at 10:54:22PM +1000, Joel Sing wrote: Apologies for not getting back to look at this - the above diff is in part a hack and it needs to be more cleanly implemented before it is committed. Additionally, it needs to be implemented and tested for all platforms that

Re: doas -n

2015-07-26 Thread Marc Espie
On Sun, Jul 26, 2015 at 12:07:44PM -0400, Ted Unangst wrote: Marc Espie wrote: I don't think it falls on the side of bloat, and it's a pretty nifty option to sudo... well, it's not just about code bloat. or even mostly about code bloat. every option added to the program is added to

Re: Update to /etc/services

2015-07-26 Thread Alexey Suslikov
Denis Fondras openbsd at ledeuns.net writes: krb524 /tcp# Kerberos 5-4 I would tweak krb524 comment to be # Kerberos 5 to 4 because this is how krb524 reads.

Re: [patch] Remove archaic manual sizing from dump(8)

2015-07-26 Thread Theo de Raadt
On 2015-07-23, Michael McConville mmcco...@sccs.swarthmore.edu wrote: --- sbin/dump/main.c23 May 2015 05:17:20 - 1.56 +++ sbin/dump/main.c15 Jun 2015 23:16:10 - @@ -115,7 +115,7 @@ main(int argc, char *argv[]) usage(); obsolete(argc,

Interactive F option in fsck man pages

2015-07-26 Thread Michael McConville
It's documented in fsck(8), but not fsck_*(8). This can confuse people. I just copied its paragraph from fsck(8). Index: sbin/fsck_ext2fs/fsck_ext2fs.8 === RCS file: /cvs/src/sbin/fsck_ext2fs/fsck_ext2fs.8,v retrieving revision

Re: ssh agent authentication for doas

2015-07-26 Thread Ted Unangst
David Gwynne wrote: this is rough, but enough to start a discussion. this lets doas authenticate a user by talking to their ssh agent by specifying 'ssh-agent' on a permit line in the config. if agent auth fails, doas falls back to bsd auth (ie, password auth). to minimise the amount of

Re: doas -n

2015-07-26 Thread Ted Unangst
Marc Espie wrote: I don't think it falls on the side of bloat, and it's a pretty nifty option to sudo... well, it's not just about code bloat. or even mostly about code bloat. every option added to the program is added to the man page, and then users learning how to use the program must