02:19:27 would anyone want a tool that lets you direct all of your servers to start ddosing any unauthorized IP that attempts to ssh into any of the servers? 02:21:50 no that is likely illegal and is a dumb idea for many reasons 02:23:28 isn't it good for an active defense system? 02:23:50 why is it illegal if they're doing something wrong first? jc 02:25:20 the assumption that the source system doing the "unauthorized ssh" personally belongs to the attacker and is not just an innocent victim is a poor one 02:26:15 oh ya 02:26:18 ok nvm 02:27:31 if you want to reduce attack surface dont expose ssh at all, setup wireguard or similar which wont even respond to unauthorized clients 02:47:42 There is always https://www.tarsnap.com/spiped.html for hiding ssh. 02:52:51 good ideas ty guys 02:54:08 i know wireguard is awesome. spiped also looks interesting never heard of it 04:39:55 it is okay 04:49:58 kerneldove_: bro that is kind of like vengence-based defence mechanism 04:50:57 don't recommend that. I know random ssh attempts happen all the time. you can set a banner to be displayed on their terminal if they fail. 04:51:16 I used to say stuff like "stop trying to log into my server" 04:52:40 the most effective yet also the simplest way to avoid such things is to use a non-conventional port ideally above 1000, since port scanning is a time consuming task they can't afford to perform. 04:53:33 per personal experiences, that eliminates 99% of login attempts 04:54:06 vengeance* sorry 05:01:06 ya i do that 05:09:44 advice needed: I run FreeBSD on a 3TB hdd, but want to migrate to a 8TB (hdd) mirror. Is it feasable to add those disk to the system, create a mirror with the first, after resilvering add the second, and again after resilvering remove the original disk from that (now) three-way mirror? 06:03:15 Afterglow: so it's zfs? 06:04:29 Afterglow: the last time i did this, i just installed fresh and zfs imported the old drive, do import things out of /usr/local/etc and /etc 06:08:39 Just wondering, is there a reason why there are so many Firefox clones on the BSD's, but only 1 Chrome clone (ungoogled-chromium)? 06:09:25 I mean native builds, so excluding Linuxulator. 06:23:58 how many do you need[root@freebsd-test ~]# podman run -i -t --rm --os=linux docker.io/library/debian:latest uname -a 06:34:25 rtprio, zfs indeed, but also rootonzfs 06:46:56 Afterglow, Yes. What you propose is feasible. Many people upgrade storage that way. 07:28:20 thanks rwp 07:30:01 After I´ve put my laptop into sleep-mode, and resume it I need to restart netif to get network access again, (wireless) is it someone else that has this kind of problem with Wifi AX210/AX1675 cards? 07:42:13 nwe, I don't know about suspend-resume nor wifi but if you need to run netif again then you probably also need to run routing again too. 07:45:11 nwe: i have the same issue 07:45:27 not with AX210, though 07:46:11 AX210 is what i want to upgrade to. but i will use wifibox. iwlwifi is unreliable for me. 07:46:48 wifibox does restart connection automatically but there is a some second delay before it is up 07:46:55 Note that in 14.3-RELEASE FreeBSD made a HUGE improvement in the wifi drivers. HUGE! So might want to try them again now. 07:47:22 Though if you have wifibox working then I hear it works so well that it scratches the itch pretty well. 07:47:38 well. it wasn't to good in stable/15 so i am not sure it is ok anyway 07:47:57 but i have not received ax210 yet to make a judge on that 07:48:07 angry_vincent: do you have a workaround to share? ;) I changed to AX210 (from Intel 7265 (because bad performance with that) bought ax210 for (260 swedish kr) 26 usd :) 07:49:10 i don't have a workaround. wifibox does restart on it's own. when using wifi drivers i need to restart netif 07:49:20 angry_vincent: ah 07:50:13 my old card is 8265 07:50:32 it works only in 2Ghz mode and only in g mode aswell. 07:50:42 even with iwlwifi 07:51:07 but it does work in 5GHz mode and very reliable with wifibox. so that's it 07:52:35 i am not grumpy at this. i know limitations and that is is a complex subject. just a facts. wifi is little bit of a problem on FreeBSD. 08:05:08 like I said if you not sure about how to get wifi to work, just buy a mini SOHO router running openWRT 08:05:49 it's half the size of a Rubik's cube, and runs on USB power supply. 08:06:31 saves the hassle of getting wifi to work on native hardware 09:30:01 * nerozero wow 09:30:52 just found that in RC.CONF you can place FIB at for each service, eg: syscrc named_fib=1 && service named restart 09:31:18 sockstat -fl4 => bind will sit in fib 1 ... 09:32:08 also it is possible to specify `nice` parameter for each daemon ! WOOW 09:47:24 sure, you can 10:06:05 no the question, can I run multiple instances of same daemon in different fibs ? 10:14:40 *now 10:16:25 nerozero: not via rc.d, unless the rc.d script is one that has built-in support for multiple instances (e.g., unbound) 10:17:34 so I literally should make a separate daemon run script like in /u/l/etc/rc.d/bind-fib2 ? 10:22:25 bsd should rather should go towards rc.conf format like: `fib_1_named_enable="YES"` much more logical and that could lead to a possibility to run multiple daemons in proper fibs 10:22:58 nerozero: patches welcome 10:24:52 yep, good point ivy, nerozero, maybe it's good opportunity to contribute ? 10:25:41 ok, will think about it and make a draft, then put it in the freebsd forum, then will share link here ... 10:26:00 ivy, mzar thank you for quick replies 10:27:32 welp 10:27:46 today is the day, I am moving from quarterly on laptop to latest 10:28:10 I have considered this for over a year, as some cves can take a month to patch 10:28:20 s/patch/backport/ 10:28:37 polarian: you could always become a ports committer and mfh those fixes 10:28:47 ivy: I do not have the skill, would if I could :P 10:28:55 maybe sometime in the future :P 10:30:00 I usually do a shoddy backport myself, but this time to address all the cves (and they are all about 5 in severity) I would need to recompile most of the system, so yeah 10:30:06 iirc I saw python as one of the major blockers :P 10:30:07 98% of it is just typing "git cherry-pick -x" 10:30:24 well, maybe 50% of it is that, and 48% is actually getting the change landed 10:30:56 ivy: what about dependencies, and the hell they cause 10:31:44 its not abnormal for python to differ in the latest, and quarterly, and sometimes patches require the latest version, which means security patches can't be backported unless python is updated, which then means updating all the python packages... 10:31:56 polarian: the latest quarterly branch is at most 3 months out of date, in general dependencies won't be a problem. in rare cases, maybe... 10:32:22 welp anyways, future issue :P 10:32:28 updating Python should not require updating all python ports 10:32:46 although last I checked some of these packages are still vulnerable in latest 10:33:16 and then the build for pkg can sometimes take a day or two 10:35:02 thats quite a few security patches missing from latest too :/ 10:35:17 lets check bugzilla 10:36:14 https://bugs.freebsd.org/bugzilla/show_bug.cgi?id=273161 I wonder if this is what causes xorg to segfault when securelevel is used 10:36:45 hmmm 10:42:59 alright quite a few of the vulns is just pkg being slow :) 10:43:44 polarian: do you mean pkg being slow, or the ports package builders being slow? 10:43:55 ivy: both :P 10:44:06 pkg isn't the fastest, but it works :P 10:44:13 but anyways it was the latter I was talking about ;) 10:44:36 hm, "pkg audit" just downloads the latest VuXML and reports it, even if it's slow to do that for some reason, that shouldn't affect the results 10:44:59 i mean, it always uses the latest vuxml and local system pkg database 10:45:42 ivy: mate, I I was joking how pkg can take a while to update packages :) 10:45:44 its not a big deal 10:45:52 the latter is the thing I was actually talking about though 10:45:56 port builders get clogged up 10:46:42 I did say about 6 months ago that it would be cool if the port builders could use vulxml to prioritise compiling what is security patches, and do feature updates after... 10:46:54 but I know nothing about the port building infrastructure so not like I can simply send a patch 10:47:07 that isn't feasible with how ports currently works 10:47:23 you aren't the first person to suggest it though 10:48:31 or the problem could be brute forced 10:48:42 throw more compute at the problem :P 10:48:56 but I doubt the foundation wants to fund something like that :P 10:50:04 the foundation literally just added a new builder which is ~4x faster than the old one 10:50:24 the problem is you can't build just some ports, you need a way to work out the dependents and dependencies and rebuild those too 10:52:10 ivy: in other words its difficult to parallelise 10:53:18 polarian: on a single machine, no, it's trivial. across multiple machines, yes -- clearly we can't just keep adding faster hardware, the proper fix is to support distributed builds 10:58:52 patches wanted! :P 10:59:34 yes? are you saying that because you would like to work on this? 10:59:52 goto "I haven't the skill" :P 11:00:22 I am not even familiar with the porting process very much yet... theres two things on my todo list to port and then submit on phab 11:00:42 I was meant to port them at the devsummit in Zagreb but I got caught up in other business 11:00:47 ended up sending a doc patch instead... 11:45:20 say I executed `ifconfig rl0 down`, how can I find it is down? 11:45:48 the `ifconfig rl0` shows nothing about it is down or up, just active 11:47:40 nevermind it in the flags ... `flags=8863 metric 0 mtu 9000`, the flag "UP" 11:52:43 I'm having some trouble with linking to libunwind. It says it's missing symbols like unw_getcontext, unw_init_local, etc. 11:53:04 'nm -D /usr/local/lib/libunwind* | grep unw_' yields nothing 11:53:19 Is there something I'm doing wrong? 13:04:31 hi 13:04:48 o/ <3 13:04:58 \o 13:26:51 Is there a bootc / immutable image based way to run FreeBSD? 13:27:47 Xe, as an option - use zfs + rollback 13:28:13 nerozero: is that able to detect if boot fails and automatically rollback without human intervention? 13:29:23 i guess so, the beadm - also creates boot environment snapshots .. 13:29:37 so you can rollback at any point 13:29:56 nerozero: does a human have to touch the keyboard to force it to roll back? 13:30:51 never dive deep into it, but for sure - you can do some flagging like boot-successful and if flag is not set - rollback ... 13:31:49 better phrasing: if i install FreeBSD with ZFS on a computer today, will that configuration combination be set out of the box for me without me having to configure it myself? 13:34:19 Xe - you can run an entire installer script including specific partitions to be readonly or with snapshots ... 13:34:40 so I have to configure things manually, gotcha 13:34:41 but this will require deep dive and understanding, yes 13:37:19 Xe, yes, as a side effect, *nix platforms require the use of the brain, and as a result, they prevent the transformation into a plant, as, for example, users of M$ 13:38:04 :V 13:40:08 I'm just trying to figure out what the difficulty of doing something like that for a NAS is so I can weigh multiple options (Fedora/Rocky Linux 10 + bootc, TrueNAS SCALE, etc) tbh 13:41:17 a day or so smoking man and reading forums and some (posix) SH scripting experience 13:41:50 the benefit of BSD is that THERE IS NO DAMN SYSTEMD there, and everything (mostly) is a text file 13:42:03 ah, okay, i see, thank you for your time 13:43:17 windows user .. 14:08:56 nope 14:53:33 Just wondering, is there a reason why there are so many Firefox clones on the BSD's, but only 1 Chrome clone (ungoogled-chromium)? 14:53:35 I mean native builds, so excluding Linuxulator. 14:56:37 no ones bothered to port them 15:02:50 hard to blame them, porting one chromium is shit enough looking 15:03:54 take a look just at the magnitude of patches applied to each: https://cgit.freebsd.org/ports/tree/www/chromium/files https://cgit.freebsd.org/ports/tree/www/firefox/files 15:04:26 even if every single one of those patches was trivial, that's a lot of sledge to drag around 15:06:55 (at the risk of being a dick, I'm not going to analyze ~1500 patches to determine average complexity, but let's just agree that it sucks) 15:33:34 hey weird question, what is poweroff? 15:33:38 which poweroff shows nothing 15:33:44 I know its equal to running shutdown -p now 15:33:58 /sbin/poweroff 15:34:02 hm weird 15:34:33 oh its because I wasn't escalation privileges 15:34:36 my user cant see it 15:34:41 Did you run which poweroff without having /sbin in your path? 15:35:01 sbin should be in path 15:35:15 yeah /sbin is the first path entry as it should be 15:35:20 * polarian shrugs 15:35:23 works when I doas, but not when I dont 15:36:12 sbin directory has r for anyone so idk 15:36:20 'which' searches the dirs in your $PATH 15:36:30 yes... I have sbin in path 15:36:38 I can also view the dir without root 15:36:45 but which returns nothing 15:36:57 That's strange. It does for me (as a user too). 15:37:10 even weirder, which returns /sbin/reboot for reboot 15:37:18 its only shutdown and poweroff 15:37:25 they do exist too, they arent deleted or anything 15:37:33 which zfs, returns /sbin/zfs 15:37:35 * polarian shrugs 15:38:04 Oh wait, poweroff is not executable for you unless you're root or a member of operator 15:38:08 yeah 15:38:11 I just realised :P 15:38:16 was literally typing that :P: 15:38:24 it needs the execute bit :P 15:38:45 vkarlsen: however... my user is in wheel and the group is wheel 15:39:00 and wheel does have the execute bit 15:39:19 For reboot, yes, but not for poweroff 15:39:43 -r-sr-xr-- 2 root operator 16168 25 Jun 11:54 shutdown 15:40:46 hm well 16:54:23 hi, does ntftp support TLS ? 16:54:53 it doesn't seem to try and use it 16:56:31 I'm on a Linux machine, but I wanted to use ntftp because I found out it can be made to execute commands from a file 17:02:55 that's not really a freebsd question; what does your documentation say? 17:05:36 sorry, I meant tnftp 17:06:36 my manpage has no mention of TLS... but it does mention an env variable "FTPSSLNOVERIFY" 17:07:01 I went to ask here because it tnftp seems to originally be a BSD FTP client, and FreeBSD to me is the most popular BSD 17:07:19 anyway, thanks, maybe it's the wrong place 17:07:25 Fall 2025 FreeBSD Vendor Summit - Day 2 17:07:27 https://www.youtube.com/live/I5Ft3tVSm8c?si=JowuTAz_XtixdW1W 17:08:40 jonesmeier: check the source or ask the author of the program 17:09:51 jonesmeier: original ftp server and client in FreeBSD doesn't support TLS 17:10:08 they both don't 17:10:27 thank you mzar! Okay 17:10:42 and those would have been options rtprio 17:11:12 glad I got an answer, thank you very much, now I can look for sometehing else 17:11:56 jonesmeier: maybe you can stay longer, have you ever used FreeBSD ? 17:12:15 no, I haven't ever used a BSD 17:12:33 you could have just googled it; https://forums.freebsd.org/threads/netbsds-tnftpd-compared-to-other-ftp-servers.95259/ 17:12:33 please don't hesitate to give it a try 17:13:40 I was always a bit curious, but then... I'm happy I know what I do about Linux, and then alot of that I would have to "duplicate" 17:14:03 tbh i'm amazed that people still use ftp these days 17:14:54 yeah, I have to in this case, it's backup space provided by a VPS host 17:15:13 thanks for the link rtprio, I did not see that 17:15:51 rtprio: what would they do on daily basis struggling with this mess in networks gear ? 17:22:11 well thanks alot, I'll keep this open and maybe see what's going on here with BSD :) 17:26:08 also, if I can add anything, there is a nicely scriptable FTP client called lftp but it could not cope with quota exceeded and ignored it's max-retries setting, can very much not recommend 17:27:05 what is there to script? put file. get file. goodbye 17:27:18 you know, scp does that all also, and can be scripted 17:28:23 I want it to remove a list of single files 17:29:19 and the vps doesn't offer ssh 17:29:26 which bizarro world are we living in 17:29:29 no the backup space is only FTP 17:29:59 1998 called and they want their webhosting back 17:30:10 yeah, that's what it is.. it's a nice amount of space, but it is getting annoying right now 17:30:41 you might look into rclone, it might abstract the ftp space into something less... stupid 17:30:50 hehe I don't know, they like to do it with FTP.. 17:31:30 oh OK, I have heard of rclone before! Thank you, I should look at rclone next 17:32:32 how much space do you consider 'a decent amount of space' ? 17:33:27 like a few tb? 17:33:27 well it's 30 GB of space, for an already good value VPS 17:33:51 so no, it's not much, but for cheap VPS plans I haven't seen many even give you any backup space 17:33:56 so I'm happy with it ;) 17:34:06 if you say so 17:34:46 hehe yes 17:35:27 wow FTP-only 17:37:22 \o/ 17:56:33 rclone definitely works as an FTP client, that's cool, and it uses TLS. Thanks rt, it's a good option 19:52:43 i wonder if i should write my new driver as gpioaddrled or perhaps some generic tight timing bitbanger 19:52:59 because i actually want latter eh 19:53:47 and here i was trying to figure out https://github.com/Alexays/Waybar/issues/2676 21:23:38 btw, who said that touchscreens won't work 21:23:51 wmt(5) exists 22:18:30 my main zfs pool just works. i boot up, reboot, and it's fine. but i'm adding a 2nd internal drive so i gpart it, zpool create on it, but how do i make it automatically export on shutdown/reboot, and import on bootup, just like the existing internal drive? 22:18:38 i don't wanna have to manually import/export every reboot 22:21:20 why would you do that 22:21:39 why not? it's an internal drive, why wouldn't i want it to be automatically imported/exported? 22:22:02 kerneldove_: I'm really confused why you have to "do" anything across boots. It's not automatically imported/exported -- it's just part of the zfs service start 22:22:14 what are you trying to accomplish by exporting it? is it a second pool on a single drive or what 22:22:48 2 drives. 1 has main OS pool on it. 2nd drive has new pool and it's mounted into my home dir for extra space 22:23:44 and are you sometimes pulling the drive and slapping it into another system? 22:23:49 kerneldove_: if your zroot already has a "$HOME" defined, that might be an issue? 22:24:13 wavefunction: not what he's asking 22:24:22 no, internal drive, permanent 22:25:21 kerneldove_: perhaps you're using the wrong terminology; are you saying your zhome pool is missing when you reboot ? 22:25:24 kerneldove_: it sounds like you have "zfs root, exluding $HOME" on one drive, and you want to add a second drive as "$HOME" ? Is that correct? 22:28:24 it's weird how impossible it is to get this across 22:28:41 If so, you have to `zfs destroy` the old zroot/home dataset and create your new pool as `zfs create -o mountpoint=/home newpool/datasetname` 22:28:52 i have a system working fine with 1 drive and zfs. i installed a 2nd drive that i now want automatically mounted on reboots into my home dir 22:30:28 Right, so, when you run `zfs list` do you get an entry like `zroot/home`? 22:31:07 ya 22:31:11 kerneldove_: it will by default, come back when you boot 22:31:15 ok, what's the name of the second drive pool, and have you created a dataset on it yet? 22:31:33 i just called it storage 22:32:39 have you done a `zfs create` on the storage pool yet? 22:33:58 after the gpart stuff, i ran zpool create storage /dev/ada1p1, mkdir /home/kerneldove/storage 22:34:05 okay, 22:34:18 maybe i did zpool create wrong because i didn't home it in my /home/kerneldove/storage dir? 22:34:32 zfs list shows its name storage, but mountpoint is /storage 22:34:42 It sounds like you missed the part where you create a dataset. (`zfs create ...` vs `zpool create`) 22:34:43 i want it to be at /home/kerneldove/storage 22:35:00 kerneldove_: Oh that's perfect, okay, 22:35:02 well i did gpart add -l storage -t freebsd-zfs is that ok? 22:35:13 zfs create -o mountpoint=/home/kerneldove/storage storage/kerneldove 22:35:21 you don't need to gpart nonbootable disks 22:35:29 You did the partitioning and the zpool just fine -- 22:35:39 you have to create a zfs dataset -on the pool- 22:35:40 you could have just zpool create storage /dev/ada1 22:36:01 What rtprio sent you (zfs create...) is what you need 22:36:10 that should auto-mount across reboots 22:37:22 ok so zfs list stuff pertaining to this 2nd drive/pool is: 22:37:48 storage .. .. .. /storage \n storage/kerneldove ... .. .. /home/kerneldove/storage 22:37:59 Looks right to me. 22:38:19 :thumbs up: 22:39:16 for some reason running `kldload ipmi` causes my system to freeze 22:39:18 ok cool i'll try rebooting now and see if it's auto, ty! 22:39:24 kerneldove_: Good luck! 22:39:25 it'll do this from single user mode, and it does not display anything else 22:39:53 zip: what? 22:40:50 am I doing something stupid here or something? It's a mini desktop, I think it has the hardware 22:42:11 oh. i wasn't aware there was an ipmi kernel module; i always have used ipmitool 22:45:18 it worked! 22:45:21 ty guys 22:45:58 zip: i'm not aware of any desktops having ipmi 22:47:59 weirdly, it seems to think it does 22:48:21 I assume this is what the BIOS calls "system management" 22:49:23 https://www.irccloud.com/pastebin/x1IC0ezF/ 22:57:23 oh well, this was in the category of "oh that's neat" rather than something I desperately need 22:58:56 rtprio: desktops as in boards? 22:59:32 i have an asrock x570d4u that uses a ryzen that has ipmi... that may be considered a workstation / server board though. supports ecc too (advertised). 23:26:51 I think the BIOS option might be AMD DASH, which was off. And which I should proably leave off. 23:27:17 i don't suppose anyone wants to buy a bunch of dell ddr4 server mem? 23:40:30 kerneldove_, put it in your own server and enjoy? 23:43:59 it's not fitting i assume 23:57:07 ya 23:57:23 got larger modules and been sitting on the smaller stuff. now that ram prices are exploding it's a good time to sell 23:58:07 if any regulars in this chan want it, i'll give a good deal and send first then you can just btc me 23:58:25 if you're not a regular and a regular vouches for you i'll consider that too