if you want to run multiple ifconfig commands in rc.conf say configure IP address then add members for a bridge

can you do ifconfig_bridge0 twice?

bridge0 being the interface you want to configure

or do you chain it

"inet 192.168.56.32 netmask 255.255.255.0 addm fxp0 addm fxp1"

would that be valid?

also according to the man pages... bridge and tap are both created through interface cloning... so if I do cloned_interface="bridge0 tap0"

both a bridge and tap device will be created, correct?

ok so I have node modules taking around 5 gb apache is around 15gb

python, and other node modules 5 gb , usr/ports taking another 5 gb

but the breakdown is /usr is 25 gb /var 12.7 gb /jails 3gb /root 2.6gb

hello anyone here?

how do I check if firewall is on?

ok ipfw is enabled

pfctl

like what would be the command?

sixpiece: No, if you have ipfw enabled, ipfw list will show you your current rules

both are enabled now

but I don't know how to block someone

Don't enable both

The handbook explains how to use the firewalls: docs.freebsd.org/en/books/handbook/firewalls

i deleted some log files that were really huge to free up space and will it recreate those files or I need to remember their names?

termbin.com/cvk8 fbsd 5.x days was easier

# Stop RFC1918 nets on the outside interface

haha

not current

haha

# Stop RFC1918 nets on the outside interface

probably should use pf at this point.

PF is a complete, full-featured firewall that has optional support for ALTQ (Alternate Queuing), which provides Quality of Service (QoS).

Dummynet & ipfw = QoS perhaps

dummynet is a flexible tool originally designed for testing networking protocols, and since then (mis)used for bandwidth management.

termbin.com/4n3t generic vmware.vmx file w00t.. xhci vs echi. finally got. now i just need to lsi scsi to it. Saturday night one more beer.

thats a good .vmx file

when /usr/obj is on tmpfs, it looks that META_MODE does not work?

sixpiece: I'm missing some context. Are you the person who was here the other day with a VPS that was fuller than it should?

vkarlsen yes that's me

sixpiece: Thoser are some large numbers for a small server without much content, especially /var and /root. Are you storing a bunch of things in /root? Did you find out why /var/db takes up so much space?

I cleared it up quite a bit

now I have 20gb but they had a ssl error log and some people obviously trying to hack and I just deleted the file that was over many gb

so I am hoping these deleted files will recreate themselves when they attempt to write to the file

but I agree there's probably still quite a bit more that needs to be deleted

Anyone can answer my questions in the backlog? (casually bumping my query) :P

polarian: you shouldn't write commands in rc.conf, as how often it get read (sourced) is unspecified, you should only have assignments there and later assignments to a variable override previous assignments to that variable

nimaje: not commands

but when doing ifconfig configurations... do you duplicate the variable or do you chain them

for example, I need to set an IP for bridge0 and also assign interfaces to it

can I mix the inet with addm?

that was the question, sorry if I was not clear.

anyone know the answer/

cloned_interface is correct. i have added the ip here via alias - no clue, why i did that back then. so maybe you can not mix it (assuming, you are asking, because you have tried and did not work)

[…] and later assignments to a variable override previous assignments to that variable

tsoome: That loader.conf.local issue - it is NOT a problem with the Azure templates - the file originated in the VM I was migrating from DigitalOcean to Azure. Looking at the original droplet, the file is dated 2017

how hard would it be to replace the entire address space on a signal

(or, at least the object code)

see, we have this cursed proposal, let's call it "sigaltexec", which, given appropriate compiler support, lets you replace the object code with a signal-safe version when handling signals

and by "signal safe" we mean the code would be compiled twice: once with access to everything normally, and once without access to things like malloc

(then it's just a matter of replacing the object code when handling signals and even function pointers can be safely passed around between the two "worlds")

nimaje: so how do you assign and add interfaces

do you just compress it into a single ifconfig_bridge0 line

addm and set inet/netmask on the same line

probably, I didn't need to look to deeply into configuring network stuff yet

i have `ifconfig_bridge0` just for the `addm ...` and then `ifconfig_bridge0_alias0` for an `inet ...` ipv4 on it

that's sad story kwiat

that's sad story ketas

mzar: i can't recall any recent sad stories, only older ones

your laptop BrindledCat

your laptop broke

oh

I am sorry for tab abuse BrindledCat

well

it was n.o.s. t60 that worked over 10 years?

you can install FreeBSD on more recent hardware

ig4 touchpad works, touchscreen too

ig4 is what?

and yes i could

nimaje: I will try this then, and if not I will do what ridcully has done... thanks for all the help <3

polarian, In /etc/rc.conf you cannot have duplicate variables. Later assignments overwrite earlier assignments. Your previous cloned_interface="bridge0 tap0" is normal. Add ifconfig_bridge0="addm eth1 up" ifconfig_tap0="up" with whatever names your system needs.

rwp: I am aware... that wasn't my question... my question was can you mix arguments kaa... ifconfig_bridge="inet 192.168.43.21 netmask 255.255.255.0 addm eth0 addm eth1"

would that be valid or invalid

I am unsure how freebsd would interpret it... as an ifconfig command it would be invalid, but what about in rc.conf?

Any valid ifconfig command is valid there. If you can run the command from the command line as an ifconfig command then it can be used in an ifconfig_bridge0 setting.

ifconfig processes option arguments left to right across the argument list.

The only thing you are missing is that ifconfig_bridge does not match the pattern ifconfig_${name} and name is bridge0 or bridge1 or tap0 some such. So it needs to be ifconfig_bridge0 there.

Or ifconfig_bridge1 or ifconfig_tap0 or whatever named interface you are configuring.

Saying a different way for clarity, if you can successfully run "ifconfig bridge0 inet 192.168.43.21 netmask 255.255.255.0 addm eth0 addm up" from the command line and it works then the same is a valid setting in the ifconfig_bridge0= variable setting, without the "ifconfig bridge0" part because that's in the name.

You probably want to add "up" as well to make sure the interface is marked up so it can pass packets. Not bringing interfaces up is a typical snag I hit myself often.

There is a sysctl setting for automatically marking tap interfaces up on open to avoid snags for tap devices too. net.link.tap.up_on_open=1

rwp: oh...

it does work from ifconfig

in the man pages and handbook it always is ran separately

I assumed it didn't work... so ifconfig can do all configuration in a single line... if so then that solves ALL my issues :P

I can't remember if the rc script parses the argument list itself and then runs the commands separately or not. It might. But the effect will be the same in either case. So actually it doesn't matter to us. We can put the list of commands all in that one variable for it and it is okay.

Also, instead of the old-style 192.168.43.21 netmask 255.255.255.0 which is still and always will be okay it's more compact to use the CIDR style 192.168.43.21/24 and so I definitely prefer seeing the more compact style now. Just less to read. Lines are shorter.

yeah use cidr

while there, set IFCONFIG_FORMAT=inet:cidr,inet6:cidr

Let me say again just for clarity that the rc scripts actually call the ifconfig command. I always test out what I want to do on the command line first. Then I put those settings in the rc.conf. Then I clear everything out (ifconfig bridge0 destroy, and destroy everything else back to nothing) and test the settings by running the rc scripts.

and uptime to env LC_TIME=de_DE.ISO8859-15 uptime or so

oh well

I always work on a system with console access. Usually I do this from the console. So I don't have fear that I will lock myself out of the system.

why ifconfig can't do ether ... inet in one go?

however if you run it twice...

internally it can do whatever it wants in meaning of order

ketas, Please say more? I don't understand the point you are making.

rwp: funny enough, I CIDR when it comes to IPv6

but for some reason I like sticking netmask :32

i mean i can't set mac and ip to if in one command

just doesn't work

then

how would you do that

in rc.conf

supposedly families conflict

on OpenBSD hostname.if(4) uses newlines to separate commands

ketas, Can you give an example? Because I mean ifconfig can process a very long list of things. Like the example I posted above.

but rc.conf(5) doesn't seem to support multiple commands

so either it allows the entire interface config in a single line... or theres a limitation on what you can do on rc.conf

Hmm... Looking at "man rc.conf" I see at least one example of multiple commands ifconfig_wlan0="DHCP WPA mode 11b" but that's it. It would be nice if it gave a more complicated example for em0 or something.

But we only run into this usually with jails and bhyve and so I guess those examples get explained in more detail in that side of the documentation. Maybe.

rwp: agreed...

the handbook separates them into commands, but does not talk about what to do in rc.conf either...

polarian, I am not familiar with OpenBSD's details. I have run it sparingly. Mostly for a reference and not in actual use where I get a lot of experience with it. So I don't know about hostname.if and am reading the man page for it now.

rwp: go and literally run: ifconfig bridge30000 create ether aa:aa:aa:aa:aa:aa inet 1.1.1.1/32

that doesn't work!

So far if I want to do more than what can be done all at once then I do those other things in the jail.conf file where one can run multiple lines using exec.prestart and exec.poststop.

when it didn't work in init, i went and look why

and i was surprised

without create it won't, either

rwp: ketas what the fuck? why would you have 30,001 bridges!!!

as namespace reasons

polarian, That command doesn't work because it doesn't work though not because it is all on one line.

but this was example

rwp: I know but still

why would you have 30,001 bridges

Oops. s/polarian/ketas/ there.

no it should

but it can't do l2 and l3 at same time

funnily

kernel happily accepts it all in both ways sequenced

ifconfig is just nooope fu

then you need to put one as _alias0=

took for a while to realize

ketas, That looks like either a bug in ifconfig or a limitation in ifconfig. Something that could be improved in ifconfig.

yeah

Using alias0 is a nice hack for it.

but yes i do have epair10000

and 20000

not 10000 of epairs

unsure how much memory one took

> ifconfig -l

em0 lo0 bridge1 bridge3 bridge10000 bridge10001 bridge10002 bridge10003 tap4 tap5 tap6 tap10000 tap10001 tap10002 tun20 lagg0 epair3a epair3b epair10000a epair10001a epair10002a epair10003a epair10004a epair10005a epair10006a epair20007a vlan1 vlan3 vlan4 vlan7 vlan9 vlan40 vlan60 vlan61 vlan62 vlan63 vlan64 vlan65 pflog0

dvl :)

in the end i have this

not thousands

epair is total legit reason for ether x inet y

i didn't want to rename them either altho i could

rwp: but this limitation is then a issue

if rc.conf only accepts a single command

either 1. rc.conf supports multiple ifconfig commands per interface or 2. ifconfig can configure an entire interface in a single command

otherwise you run into limitations

It's definitely a limitation with regards to ketas' ifconfig limitation of setting both the ethernet link address and the IP address. That feels like a bug in ifconfig to me.

So far I personally have not needed to control the MAC address of a bridge. So I haven't run into that case yet myself. Though I could see a VPS providing having MAC filtering and therefore it being a requirement in some environments.

ketas: maybe report this as a bug then?

it's known

And as far as managing epairs I always do those things in jail.conf in exec.prestart and such and so for me it hasn't been a limitation.

well according to if_bridge(4) the bridge mac address is assigned randomly within the local range, it should never conflict

so the need for changing mac is low

maybe i could move it to jail.conf but still

which, if it is a bug, is likely why its unpatched then if its known

I vaguely recall there is a setting that causes bridge ethernet link addresses to inherit from the first associated member but can't find the docs on it now.

ketas: you could run it as a script

this will run on startup then

rc.conf was simpler for now

That's what I would do too. If I need something really custom then I put it in a script.

hey its a good patch for someone who wanted to get into freebsd contributions

probably could improve

i can't really figure out how to patch ifconfig for that, properly

i also wish uptime could do 24h clock, maybe on option, and uptime in secs with option too

had to use separate util for that which i badly wrote in c

some patches i could even submit

like one which configures whatever wifi if is there, automatically on init

iirc it's still not there

there are no fallbacks like ifconfig_DEFAULT

what used to work is in ketas.si.pri.ee/bbb/src-patches/rcng-wlan_autoconfig.diff

i currently haven't place to test it anymore

it allowed me to not known what driver the random usb wifi used

likely noone else will submit it than me?

however with ifconfig i'm unsure if i can do it

init one is already a hack

rwp: i wanted my macs to stay put, instead of changing every boot, as ll's come from them and therefore v6 ips, and if you dhcp it like my jails are, then v4 ones too, now you need fixes macs on host or jail

on bridge and on epairs

also less of a confusio where the hell is mac actually located at

i also stole mac prefix from phys nic

naughty

so i know whatever participates in network comes from single machine

Quick question. I found a Pi with some sort of BSD on it. Is there a command to tell which Pi version and which BSD it is?

archer72: If it is running, uname -a should tell you some things about the OS

Ahh TY vkarlsen I forgot about that one

FreeBSD PiBSD 13.1-RELEASE FreeBSD 13.1-RELEASE releng/13.1-n250148-fc952ac2212 GENERIC arm

I tried `pinout` but that didn't exist on my system to show the Pi version. I suspect it is a version 2

ketas, For my use I am always doing static IP assignment so they are not ever going to change regardless of dynamic ethernet address.

archer72, On most systems of the various types BSD & other these days this will yield useful information: cat /etc/os-release

I found my Pi 1. Does FreeBSD run on this?

rwp pastebin.com/nkf147mE

freebsd is removimg support for armv6 as it is an old legacy architecture

nbsd works iirc

archer72, Yep!

I don't know the history but /etc/os-release is where all of the current operating systems that I interact with place information about the running release.

Probably can't be counted upon in an absolute sense. But across my collective that's the one place where every system puts interesting descriptive information about their release.

So how's the FreeBSD project doing these days? I love FreeBSD, I use it on almost all of my servers

Hope for the project to continue to exist for a long time :) It's the best OS out there right now imho

(Just a random thought)

it kernel panics constantly

from several year old kernel page fault bugs

still open due to lack of manapower

Hmm, is FreeBSD getting new hackers from the younger generations?

(while I use it daily I don't really keep track of the mailing lists, etc.)

idk

sfox_: Just curious, have you got a link to the bug you mentinoed?

Thanks

it's got several bug numbers from multiple people reporting it over the years, but this is one of the older ones

Fun fact: A long time ago I tried to do a freebsd project under the GSoC. I was in brief contact with a maintainer but they stopped responding altogether after a few emails, I found that a bit rude

Haven't tried to get active within the project since, but still like it very much as a user:)

I think that was around 2008 or so

i tried adding the workaround of exec.poststop = "sleep 2";

but unfortunately that no longer prevents crashing anymore in 14.1-R

That bug sounds to me like people are unsure as to the root cause?

it's related to VNET's networking code

it's been reproduced in both virtual machines and bare metal

i'm not sure how the root cause could still be unknown. I can provide core dumps to developers if need be

I'm having a problem with acpi_video after upgrading to 14.1 from 14.0. All sysctl variables for brightness are there, but changing them don't do anything. hw.acpi.video.lcd0.active is 0 and cannot be changed to 1. acpi_video kernel module is loaded after drm. What am I missing?

4

err

Ah I see there's now a backlight program and it works. Neat, not sure if it existed before

Hello, all. The networkmgr utilty must be auto-started via sudo, but won't. .xsession-errors tells me I must use an askpass helper. What is the FreeBSD way to let a sudo command succeed during the X login, wihtout user interaction?

The solution to my problem here says I should add the user to the `wheel' group: <forums.freebsd.org/threads/networkm…ring-after-login.92383/#post-645155>. Are there any alternatives?

(seems a bit dangerous just to let a GUI network manager autostart)

ant-x: You could set the sudo entry to run the command be password free.

skered, OK: via what mechanism?

Look at /usr/local/etc/sudoers for a NOPASSWD example. The man page for sudoers as well.

er well that might not work if this is an X application?

If the user can run sudo `sudo ...` where ... is the path to the application run/appear in X?

Thanks, waity-minty.

Yeah, I am a sudoer in the `sudoers' file: <mylogin> ALL=(ALL:ALL) ALL

I can use sudo commands in the X terminal, but the first time I have to enter the root password.

Will look into NOPASSWD

Ok then maybe it will work. Running X application as a different user than who is logged in can sometimes be a pain due to DISPLAY/XAUTHORITY unset/mismatch

There's also doas (sudo like) that can help here too.

I see: I can make the user a NOPASSED sudoer: too much for a single application.

Is there a way to enable a passwordless sudo invocation of /that one/ program for /that one/ user?

Yes. You might want to also look at doas. Its config is a bit simpler but less fearure rich as sudo.

skered, ... and shall I then replace `sudo` with the corresponding `duas` in my autostart .desktop file?

doas but yes.

That was a typo. Thanks. So, there are three optons: 1) make the user a NOPASSED sudoer; 2) same thing with `doas`, and 3) add the user to the wheel group.

I wouldn't be surprised if you still need to be in wheel for other things.

I would have maybe expected xfce to use polkit to allow this type of access.

skered, polkit is starge: it requires JavaScript programming!

* strange

Once you get it you get it.

and that's after all the security issues it has had.

ant-x, BSD has this extra security layer that if you are not in the wheel group then you are blocked from root access.

Use of the name "wheel" is a joke name because if you are in the wheel group then you are a "big wheel" idioms.thefreedictionary.com/a+big+wheel

Without being in the wheel group so that one can su or sudo to root then one can only login as root from the console.

"I wanna roll like big wheel, across a Georgeia cottonfield!" -- I love Joe Turner.

How I have inserted a USB stick. How do I find out which device it is?

The default sshd_config is PermitRootLogin=no so one can't ssh in as root either unless that is changed.

rwp, Thanks, there is a lot of mechanisms. I am not on SSH, though.

ant-x, I "tail /var/log/messages" and see what device it just created. Probably /dev/da0

rwp, Ouch! "logfile turned over due to size > 1000K (-:

(tail won't show anything)

Then look at the previous file.

zless /var/log/messages.0.bz2 would be my choice and then G to get to the end of the file.

You guessed right: it was /dev/da0. Hmmm! there should a transparent way of examing the last log records that took care of the log rotation.

On SATA based systems the disks will be /dev/ada0 ada1 ada2... but on SAS/SCSI based systems they will be /dev/da0 da1 da2... so on SAS systems one must be super careful not to get the wrong device!

But on SATA systems it is safer because only USB will be using the da0 type naming.

On my SATA desktop I add this following /etc/devfs.rules files entries. paste.debian.net/plain/1322626

That changes the permissions on USB devices to be 0660 writable by group wheel.

And then I can write to inserted USB devices as me without needing su or sudo. Seems a lot safer. I can't wipe out my disk when working as me.

Don't do that on a SAS system though as that would be too risky there as it would also affect the system disk drives on those systems.

Thanks for the tip. I have not yet tried to write to USB stick as normal user.

rwp, then one could intercept an automount event and set the permissions there. Ingternal HDDs do not automount.

Cool! If you write it up please send me the instructions for it!

Indeed, I can't write to USB sticks as normal user.

rwp, This time, I am preparing this laptop for a colleague, so not sure... I have written up a script for exponential brightness control, which was non-trivial!

hmm why exp?

transparent way to look rotated logs?

ketas, because the starndard ACPI interface, at each Fn keypress changed the brightness level by 1 point of 100, so that it took ages to adjust it.

ketas, Yes: to access the last n entries even if part of them are in in rotated an archived log file.

like zfgrep boo /var/log/messages* ?

oh

Yes, I think so.

zfgrep boo /var/log/messages* will list them in an inopportune order for my taste. Reversing the file order would grep entries in time order.

( zcat /var/log/messages.?.* ; cat /var/log/messages ) | tail

assuming they aren't large

that's still wrong

zgrep foo $(ls -t1 /var/log/messages*)

Sorry, reverse that. zgrep foo $(ls -rt /var/log/messages*)

Guys -- I am trying those now, have to learn some basic shell scripting first.

That will list entries in a more intuitive time order. But I don't like using the output of ls -t there as it feels icky since it isn't really an explicit command and might be wrong.

Perhaps a decidcated script/program?

I would like to use "tac" (which prints lines in reverse) but it is not in base.

tail -r works like tac

...Has anybody got Wine working on their FreeBSD machine? A freshly insalled Wine on mine complains that i386-wine-pkg/user/local/bin/wine does not exists and asks me to install 32-bit Wine with: /usr/local/share/wine/pkg32.sh . This is not right for my amd64 laptop...

find /var/log -depth 1 -name 'messages*' | sort -r | xargs fgrep dhcp

from shell to ls isn'y ideal indeed

shell expands *, then ls sorts it

it works

(z)

The find case is fun. Though I would do it this way: find /var/log/messages* -name 'messages*'

I hadn't thought about sort -r. With that I might do: echo /var/log/messages* | tr ' ' '\n' | sort -r

shell expands * again

here

it's fine

yeah echo * is fine too

What's wrong with having the shell expand the *?

echo /var/log/messages* | xargs -n 1 | sort -r | xargs zfgrep boo

nothing

but ls * is like double task

fine for oneliner you do once

tr eh

works

I think "tr ' ' '\n'" is lighter weight than "xargs -n 1".

yes

I would prefer not "ls /var/log | grep messages" as that might produce significant character I/O that is not needed.

i have xargsy habits

oh text manip tools are fub

I do often do things like this when searching through crontabs and not knowing where something was located: find /etc/cron* /usr/local/etc/cron* -type f -exec grep foo {} +

fun

like tr ' ' + | xargs bc

for number adding

cracauer

bsdconfig(8) seems interesting

not my cup of tea using a tui but its still cool

?

we're having so much fun, aren't we?

Well, it is a legitimate regression on 14.1 (probably) and I don't want to deal with Windows, so there I go. I just wish he would start running `make world`s already instead of fiddling with the commit list.

many (and I really mean many) of us have tried to help that guy over the years. It's tedious.

Well, it better be today. I have work-work tomorrow :-)

heh :p

better don't F5 then

I had help on the Raspberry pi front. `sysctl hw` gave me what I was looking for.

hw.fdt.model: Raspberry Pi 2 Model B Rev 1.1

ATM, I'm git cloning NanoBSD for Pi 1.

use --depth 1 if you git clone and don't need the full history

greatly improves perf