01:29:06 is it possible to hotplug passthrough usb devices to and from bhyve vms? 01:35:18 i think it'd need to be the pci address of the whole usb controller 01:36:01 but it should 01:41:21 😩️ 01:43:48 this is a problem 01:44:02 it's hard to have a hypervisor if you can't ...hypervise 01:44:39 i can passthrough the entire usb bus, but then i can't input to the host 01:49:28 You could add a PCIe USB controller that you dedicate to the VM. 01:50:34 that was my first thought, but the one controller i do have is partially broken so i can't get it to power on 02:59:42 Hi, since I'm not getting the help I need in the pfsense channel, can I ask here? (I'm sorry if that's not a legit thing) 03:20:11 Does pfsense still use FreeBSD? I thought they were switching to linux. 03:24:19 It still use FreeBSD 12.3 for the latest version 03:24:35 But my issue is probably more related to pfsense than FreeBSD 05:23:09 CrtxReavr: pfSense is very much FreeBSD based, and there are no plans that I'm aware of (and I contract for Netgate...) to change that. 05:23:18 The upcoming 23.01 release will be based on FreeBSD main too. 05:41:55 alright i got it to work on one of the "good day" runs, but damn, all the graphics are corrupted 05:42:12 TIL wayland doesn't like the gpu being in passthrough mode, presumably 06:46:02 ixmpp: sorry man, don't know if any hypervisor will do that 07:00:57 it works in theory 07:01:09 if only we lived in theory 07:14:35 I'm unsure how pfSense *could* switch to Linux, given, uh, pf 08:17:00 yea.... no 08:23:17 How do I fix "DAD" issues? I'm getting this in the dmesg. em0: DAD detected duplicate IPv6 address 2001:470:1f07:26c::: NS in/out/loopback=0/1/0, NA in=1 08:23:17 em0: DAD complete for 2001:470:1f07:26c:: - duplicate found 08:23:48 I added fe80::1 as an alias to em0.... stupid me 08:24:07 then I deleted it but now I have a "duplicated" and it causes all sorts of issues. 08:26:34 i would expect it to clear up if there truly is no duplicate address on the network 08:27:22 It's been ~5 hours, I rebooted multiple time but unbound refuse to bind on 2001:470:1f07:26c: since I did this 08:36:23 08:56:15 and that ip is in ifconfig ? 08:56:24 at this moment? 08:58:30 ixmpp: in theory there is no difference between theory and practice, while in practice there is. 09:21:11 rtprio yes, but only one time. I'm not sure how it's duplicated 09:30:12 i do like that quote 13:37:52 curl --cert-status -o /dev/null -vsS https://git.sr.ht/~dch/ports give me a weird error 13:37:53 Title: ~dch/ports - sourcehut git 13:38:25 * SSL certificate problem: unable to get local issuer certificate 13:39:43 dch: do you have Mozilla's bundle installed? 13:40:19 Is your time accurate to within the margin of error for SSL/TLS? 13:40:38 debdrup: yes, although this is a CURRENT laptop so maybe some sloppy upgrading on my part 13:40:51 time is ok, and these sites work just fine in my browser 13:40:56 *firefox 13:41:07 Welp, then I'm out of ideas. :P 13:43:32 debdrup: they were both good ideas :-) 13:43:55 i will look for that script that regenerates tls certs that allan jude added a while back 13:44:14 certctl? 13:46:42 hmm probably 13:46:43 thanks! 13:46:55 certctl -v list is the same on both working and nonworking 13:51:19 <_JusSx_> is there a channel for helping porters? 13:52:57 yes 13:53:22 #bsdports on EFnet 13:53:43 there is #freebsd-ports here on libera too 13:53:48 and mmm #freebsd-ports on libera too 14:04:11 <_JusSx_> dch: thanks you very much 17:31:29 dch: do other Letsencrypt certs work ? 17:31:56 rtprio: its weird, browser works for everything, only commandline / curl 17:32:28 I think its all LE certs 17:32:47 I will do a fresh beinstall.sh soon 17:32:58 and then it will probably all work again 17:56:53 when dealign with le acme.sh seems to do well with some tweaks 18:00:59 this is something missing in my / I think 18:06:44 can you pastebin the output? 18:28:11 https://www.irccloud.com/pastebin/ZMwmoq0k/ 18:28:12 Title: Snippet | IRCCloud 18:28:14 ^rtprio 18:29:33 * CAfile: /usr/local/share/certs/ca-root-nss.crt 18:29:33 * CApath: none 18:30:36 dch is ca_root_nss installed ? 18:30:47 rtprio: yep 18:32:19 does curl --cacert /usr/local/share/certs/ca-root-nss.crt work ? 18:36:40 https://www.irccloud.com/pastebin/LLxLtEF6/curl-freebsd 18:36:41 Title: Snippet | IRCCloud 18:37:13 rtprio: and with the forced caroot it works 18:37:18 let me delete & reinstall it 18:37:53 nope, thats not sufficient 18:37:58 but we're close 18:40:14 curl --cacert /etc/ssl/cert.pem https://freebsd.org/ -o /dev/null -4vsS works 18:40:15 Title: The FreeBSD Project 18:40:18 i.e. the softlink is fine 18:40:52 uh 18:41:27 so... 18:41:37 reverting to curl-7.86.0 works 18:41:39 hmmm 18:42:47 and curl-7.87.0 does not 18:42:52 i'm on 7.87 18:43:55 me too on my desktop, and this only breaks on my laptop 18:44:05 let me beinstall.sh and see if that fies it 18:44:17 what is beinstall.sh 18:45:33 oh boy are you in for some fun 18:45:44 https://www.freebsd.org/cgi/man.cgi?beinstall 18:45:46 Title: beinstall 18:46:07 /usr/src/tools/build/beinstall.sh 18:46:40 how is that different than make installworld installkernel distrdistribution DESTDIR=/mnt 18:48:11 rtprio: it does the plumbing the upgrade and the boot environment all for you 18:48:48 huhh 18:49:44 and if something fails all is nicely rolled back 18:50:35 HI. 18:52:06 Inside a FBSD Jail - is there a way to leak public internet IP address if the only internet connection is to an localhost port? 18:54:26 what do you mean? 18:54:43 wall $(dig +short myip.opendns.com @resolver1.opendns.com) 18:54:47 is that leaky enough? 18:55:45 The point is to not leak my address 18:56:01 And I said the only connection should be to localhost 18:56:14 Is there some sort of history file that stores IP addresses on FBS? 18:56:19 FBSD* 18:56:20 a) yes there is a way 18:56:26 Really? How 18:56:31 b) it depends on what software you run 18:56:36 How? Lol 18:56:38 c) i'm not sure how it matters 18:56:45 c) it matters a lot 18:57:13 b) how? The whole point of me using FreeBSD jails is to strictly control networking access 18:57:16 a) how 18:57:43 how does it depend on the software? 18:57:49 Yeah 18:58:03 Software depends on internet access in order to reveal IP address, right? 18:58:24 Think about it this way - what if I got some malware inside of an FBSD jail, and networking is strictly controlled? 19:01:25 Has anyone worked with bhyve and Windows 98 - is it even possible? 19:01:51 both ways you phased the question is vague enough to be yes or no 19:02:02 PredatorONormies: i don't know man, what software are you running? 19:02:12 rtprio, Quark 19:02:17 How does it matter what software? 19:02:27 Like I said - imagine a fucking malicious person inside of the jail 19:02:31 how hard can that be? 19:02:32 :( 19:02:34 why you bully me 19:02:48 I need a jail for untrusted use 19:02:57 yes, a malicious person inside a jail can figure out your public ip address. 19:02:58 PredatorONormies: settle down please nobody's sassing you here 19:03:06 rtprio, how? 19:03:16 PredatorONormies: a simple curl http://jsonip.com/ will show the external NAT IP 19:03:21 PredatorONormies: try that dig command i pasted 19:03:47 llua I just want to know if it's even possible to get Windows 98 working on bhyve. I've cloned a disk with dd and want to see if I can make it boot. 19:03:53 if you want to be hidden, then use tor or tor + vpn 19:03:54 PredatorONormies: in my experience just answering the question is not that great in getting people to understand. which is why i ask, "what software, and why is it a problem" 19:04:22 AReal486: i wasn't responding to you 19:04:24 but quark is static files how are they going to root you that way 19:04:30 oh, that was perfect timing then 19:04:34 indeed 19:05:25 curl: (6) Could not resolve host: 19:05:35 Like I said - only networking connection should be localhost 19:05:41 /r/homelab is full of people trying to hide their ip address and i simply cannot understand the attack surface 19:05:44 dch, see? It doesn't 19:05:49 AReal486: I can't imagine anybody has ever tried, https://wiki.freebsd.org/bhyve/Windows doesnt show it 19:05:50 Title: bhyve/Windows - FreeBSD Wiki 19:06:02 how are you going to serve any web files if it's only on localhost? 19:06:04 PredatorONormies: ok, if you don't have *any* network access then ofc it won't work 19:06:21 rtprio, the proxy per-say is outside of jail xD 19:06:31 dch, BAKA 19:06:31 PredatorONormies: but if you have network access then I will find your IP, curl is convenient, netcat is also functional 19:06:38 I am bad at explaining myself 19:06:42 AReal486: i don't expect it to work, but let me see if i have that iso 19:07:06 PredatorONormies: if you can't stop throwing insults around I have better things to do 19:07:14 I do ip4.addr="lo0|127. (some local IP)" 19:07:37 * dch nods 19:07:38 dch, what insulted you? 19:08:23 And I disabled IPv6 access 19:08:27 networking 19:08:46 AReal486: maaaybe if you install sysutils/uefi-edk2-bhyve-csm as well, it might work? 19:08:50 well you still have some local ip and with an ip there is a chance for it to... escape 19:09:05 Anything else I should know about? :/ Like I asked - I did in the past connect with a real straight (no bunny-hopping) internet connection so I might fear there is somewhere a log file with the IP address 19:09:19 rtprio, lol how? 19:09:29 PredatorONormies: I think we're assuming this: 19:09:34 PredatorONormies: we don't know enough of your layout to give you an answer 19:09:42 the IP doesn't directly connect to internet (on the outside of jail, where localhost connection mounts to next0 19:09:47 internet <> router <> jail host running some proxy <> jail with loopback IP 19:09:50 ;-; 19:09:58 dch, probably yes 19:10:04 and you have something exploited that escapes to the jail only 19:10:09 I thought htat was obvious 19:10:16 exploited? 19:10:26 welcome to the internet 19:10:28 something malicious, let's call it 19:10:31 lol? 19:10:41 can't we just use hand signals? 19:11:11 so we have a compromised process in the jail 19:11:17 oky 19:11:23 and what exactly are you worried about here that it does? 19:11:40 there are a few possible things it could do 19:11:48 let's focus on the easiest one to exploit 19:12:15 from the jail, I can think of at least 5 ways I could identify the external IP of your router, presumably all behind NAT. 19:12:24 Like I said - in the past I connceted like this for some reasons I forgot: internet <> router <> jail, and perhaps there is public IP address LOGGED somewhere within that jail? 19:12:29 FIVE? 19:12:42 I'm not even warmed up 19:13:06 let me hold your beer 19:13:10 so inside the jail, running e.g. nginx or something like that? 19:13:28 something like that 19:13:36 and you want to know if inside the jail itself, the public gateway (i.e. router) address would be visible? 19:13:42 but let's say even that got somehow compromised 19:13:45 what 19:13:49 yeah 19:14:03 aka public IP address that can deanonymize me 19:14:12 so yes this is very easy 19:14:18 :( how 19:14:40 the jail has network access, and is receiving inbound traffic, and has a compromised process inside it 19:14:52 not direct network access, remember 19:14:56 proxy aka firewall 19:15:01 You ever heard of Tor? 19:15:07 *sigh* 19:22:13 Tor as in the system invented by US intelligence? 19:22:19 kp, perhaps I was confusing pfSense with OpenNAS? 19:22:45 even tor is not a perfet scape goat anyway 19:22:53 you can poison it with enough nodes offering relay 19:23:33 * CrtxReavr wonders how many TOR gateways are run by "three-letter organizations." 19:23:36 enough trusted peers within its web that is, saying a .onion is somewhere 19:23:44 CrtxReavr, I imagine far to many 19:24:10 and who controls the root keys for decrypting stuff 19:24:23 there are no root keys 19:24:31 its peer to peer for every link 19:24:36 true 19:25:53 so three points of attack, the algoritm, the key and the person 19:26:35 I do definately not trust tor in any way since I don't know all of them 19:26:47 Even if you're using (and trust) tor, you should still be using encrypted protocols over it. 19:26:59 that is a a way yes 19:28:32 in modern security as with old security the easiest is generally the person 19:28:48 spear phishing and its ilk often have the greatest chance of success 19:28:51 always 19:28:56 or just his dustbin 19:29:20 data/dumpster diving :D haha I remember that from years ago I bet it still would be true of modern organisations 19:29:29 it is 19:29:57 you may not get keys, but there is plenty of user ids to be had 19:29:57 I seen a bit of spam recently I thought was quite innovative 19:30:01 pwds 19:30:23 https://i.imgur.com/vla2tf6.png 19:30:33 ^ obviously stuffed blocked out for sanity reasons 19:30:37 and no one visit any url seen there 19:31:07 ah that is quite inventive 19:31:12 was sent to my work email address which is a tech firm 19:31:16 got one lately from "the water works" 19:31:45 oh what was they offering 19:32:00 in order to sync our new accounting system please log in and key in your current water usage 19:32:03 etc 19:32:13 log in being the part they where after 19:32:38 ooooh that is quite like the one our HR manager got, the persons resposible looked up who worked for ou company and emailed her asking up date payment/bank details to them as they changed banks 19:32:52 i DK we have a common public login system 19:33:52 weird when you start appreciating the efforts of the scammers/spammers 19:34:27 though innovation is innovation wherever it appears I suppose 19:34:39 :-) 19:35:09 in fact all you have to guess in order to send a login request to someone is probably the user id today :-) 19:35:16 pretty sure they will all become awesome at marketing, development or automation shortly :D 19:35:29 "do you wish to login - swipe right" 19:36:06 there is one swipe between you and personal bankruptcy I suppose 19:36:19 ok .. that is a bit populistic 19:36:27 but - a password would be nice 19:38:47 Hi People 20:29:37 > Tor as in the system invented by US intelligence? < Yes 20:29:44 https://torproject.org 20:29:46 Title: Tor Project | Anonymity Online 20:30:05 > even tor is not a perfet scape goat anyway < Probably, yeah 20:30:15 > you can poison it with enough nodes offering relay < That's why I prefer I2P :) 20:30:55 daemon, do you have some advice? 20:31:11 advice on what> 20:31:18 I'm trying to host a site from within a FBSD Jail, and have it be as secure from leaking my IP as possible 20:31:24 You seem to be familiar with Tor 20:31:27 what about Jails? 20:31:36 dch seems to have given up 20:31:40 yse I am I host several tor services but that is nothing to do with jails 20:31:51 you could simply install tor within the jail and offer a hidden service 20:32:11 run nginx or ngircd or w/e you want 20:32:20 bind it to localhost and point the tor hidden service at it 20:32:26 I run Quark xD remember it? 20:32:29 I do, daemon 20:32:35 I do not know what quark is 20:32:36 I run Tor outside of jails, on the host 20:32:39 and the site within a jail 20:32:47 we worked on Quark just recently 20:32:49 you guys are still on about this? 20:32:51 remmber that redirect bug? 20:32:56 Of course 20:32:58 it's not a small deal to me 20:33:02 PredatorONormies, no I helped you with a buffering issue involving stdio 20:33:09 I did not even look up what quark is 20:33:25 anyhowe 20:33:35 if you run a website or ircd or something within a jail 20:33:42 daemon, that, yes 20:33:45 xD 20:33:47 all you do is create a bridge for that jail to be attached to that is not reachable via the outside internet 20:33:55 y 20:34:08 you run tor on the host and point a hidden service to the internal ip of the service of the internal bridge 20:34:17 dch> internet <> router <> jail host running some proxy <> jail with loopback IP 20:34:18 This, right? 20:34:20 the service is not connectable via the outside internet only via a tor hidden onion 20:34:42 Yeah 20:35:08 dch said there are at least 5 ways he could at the time remember, with which one can deanonymize from within the jail 20:35:32 depends how insane you want to be 20:35:35 I connected with the jail directly to the internet before, would there be any self public IP logged anywhere? 20:35:38 a generic non vnet jail 20:35:41 daemon, pretty insane? 20:35:42 yeah that sounds about right 20:35:53 right.. I think I don't have a vnet? But I have some vnet devfs rules so IDk 20:36:03 there are two types of jails 20:36:12 ones based on VIMAGE and ones that are not 20:36:24 the ones that are not share there localhost, with the host system 20:36:26 VIMAGE? 20:36:28 this is like chroot in linux 20:36:34 VIMAGE style jails have their own IP stack 20:36:41 oh 20:36:53 if you wanted even more isolation there is also bhyve which is an actual hypervisor 20:37:03 in jail.conf I did `ip4="lo0|127..."` 20:37:15 sounds like insecure bloat 20:37:31 I am not prepared to teach you the difference between those three ^ as it would take hours and I am busy trying to get drunk 20:37:31 wraping a RAGING dog in toilet paper 20:37:49 > trying to get drunk < sounds familiar xD 20:37:51 however 20:37:54 PredatorONormies: ok, not sure where you get that info from 20:37:58 I drink wine so slow that I cannot really get drunk 20:38:05 because otherwise I'd have to go pee rly often 20:38:13 https://forums.freebsd.org/threads/vimage-setup-guide.49561/ 20:38:13 rtprio, what info from? 20:38:13 Title: VIMAGE: Setup Guide | The FreeBSD Forums 20:38:14 this is old 20:38:16 xD 20:38:18 but I believe still accurate 20:38:20 PredatorONormies: your info on bhyve 20:38:40 rtprio, no info 20:38:47 daemon, rejected 20:38:56 Does forums.freebsd.org ban the Tor network? 20:39:12 connect with it and see 20:39:19 we can't do everything for you 20:39:19 I did, rejecte 20:39:21 Many websites seemingly do not allow you to access them via tor due to protection from DDOS provided via things like cloudflare 20:39:45 That's not what I meant 20:39:56 the tor network is massive 20:39:58 someone I "knew" just did a firewall rule to block the Tor network 20:40:01 and this same error appeared 20:40:04 I know 20:40:05 certain nodes may be banned certain ones may not be 20:40:16 you can't just block the tor network 20:40:17 newer ones aren't, I know. 20:40:26 You can the majority of it 20:40:28 100's of exit nodes leave and re-appear every minute 20:40:33 all exit nodes are public, by which I mean their IP addresses 20:40:48 for the services they wish to allow you to connect to yes 20:40:53 Yeah I know, but I won't be sitting here for 2 hours just to try and load a fucking page lol 20:41:03 PredatorONormies: based on this whole converstation i'm not sure you have a very soild grasp of ip networks 20:41:16 ?? 20:41:23 well then get a cell/mobile phone paid for in cash and a pay2go data plan, in conjunction with a cash laptop from facebook and use that from a field 20:41:25 problem solved 20:41:39 XD 20:41:52 what about satellites? (a joke, obviously) 20:41:54 also boot the laptop from a live usb 20:42:17 im starting to wonder what the hell you are trying to hide from 20:42:17 No need 20:42:20 I don't use ShitScripts 20:42:31 daemon, the governments, of course. 20:42:32 what's a shitscript? 20:42:50 toilet paper? I mean maybe? 20:43:07 JavaScript, TypeScript, any kind of manipulation one can done on the user computer.. obviously I'm not talking about something like just HTML (which isn't really a programming langauge) 20:43:17 lol 20:43:38 well html is a markup language - its in th name :) 20:43:48 i have no idea what you're on about, or what javascript has to do with... hiding your ip from the government or what 20:43:53 hyper-text-markup-language, did I guess right? 20:44:06 im going for a smoke 20:44:08 rtprio, it has all the DO about it 20:44:25 rtprio, you obviously aren't educated about the concept of browser attacks 20:44:40 daemon, have fun.. I hope we can talk some more. 20:45:06 you have no idea what i'm educated in, but what do browser attacks have to do with hosting some shitty httpd in a jail 20:45:39 rtprio, who said they do? 20:45:58 Is this the right channel for this discussion? 20:46:02 nope 20:46:06 moving on 20:46:42 Yeah 20:46:52 > I don't use ShitScripts < I cannot figure out why I said this ' I don't use ShitScripts' 20:47:16 whoops 20:47:30 I need a slap on the face to wake the fuck up 20:47:56 nice name 20:48:30 maybe a slap will change your mind about fool's folly of "hiding my ip address" 20:49:50 It's not a fool's folly. The dangers I have might not seem real to you because you cannot imagine how dangerous governments are. Why would you? You seem to be a normie. Let me guess, you think you got nothing to hide, right? 20:50:01 stay on topic 20:50:13 you continued it again 20:50:37 ok man, then good luck figuring it out 20:50:51 it's not paranoia if they're actually after you 20:51:28 It isn't paranoia if you know what their rules are and you're breaking them :) not to mention worse happening to other people 20:52:33 maybe Ross Ulbricht can help you 20:54:28 Laugh all you want, before you burn for your mistakes, by the hands you trusted in. 20:54:45 That almost sounded cool 20:55:49 almost as cool as almost running illegal services on tor and serving life in prison 20:57:45 > If you feed a dog, the dog will protect its feeder, regardless of him being 20:57:45 good or bad 20:57:45 - unknown, unknown 21:24:26 well this graylog 4.3.9 -> 5.0.2 upgrade is turning into a fairly diabolical experience 21:24:50 needs to upgrade mongodb 3 times to get to mongo 5.0 21:25:09 and now elasticsearch isn't supported so I need to migrate all the things to opensearch 2.0 21:25:26 (recall the elastic vs AWS drama and subsequent fork) 22:16:30 dch: why does graylog need MongoDB? 22:16:39 meena: for config 22:16:46 config & data are separated 22:17:00 if only theyd used something else than mongo 22:42:20 dch: after three upgrades of MongoDB you'd want to fake it with PostgreSQL? 22:47:28 pkg can haz i3 4.22? 22:57:31 polyex, is it can be bogzila tiem nao?