Is there a natural way to run hourly scripts on FreeBSD such as through periodic? Or is the normal thing to create a /usr/local/etc/cron.d/houly-something crontab that calls /usr/local/sbin/hourly-something script?

Why not cron?

What do you mean why not cron? I proposed using cron.

If you don't think cron should be used then I am curious as to why.

Periodic is called from cron anyway.

Right.

But I think the natural way is to make a crontab line.

I don't think periodic has an hourly function?

Not that I can find. It's only daily, weekly, monthly.

I am missing the easy use of /etc/cron.hourly/* scripts.

Yeah, sorry, i meant just creating a cron line.

Then it needs multiple pieces like all Rube Goldberg machines. Which just makes installing it on machines more installing that needs to be done.

Okay so the X part of this XY problem is that I need to create a jail to hold a process. I need to pf firewall it so that if something gets loose in it (well... this is in reaction to something that got loose in it) then it can't leave the jail.

So I have a pf set of rules that by default block outgoing as well as incoming. To keep anything that is loose inside from leaving the container.

But I want to be able to "pkg upgrade -y" in the system. Which means it needs access to pkg.freebsd.org. I create a table "table <freebsd_pkg> persist { pkg.freebsd.org }" Which works nicely. but pkg.freebsd.org might change addresses. So I need to do a DNS lookup periodically and update it.

Because currently it is not a jail but a full virtual machine. So it needs to be able to get upgrades.

Brute force and ignorance will always triumph so I have decided to run this command periodically: { host -t a pkg.freebsd.org; host -t aaaa pkg.freebsd.org ;} | awk '/has .*address/{print$NF}' | pfctl -t freebsd_pkg -T replace -f -

rwp: Why not just have 0 * 0 0 0 update-the-dns-stuff ?

oh, you've moved past that

That's basically what I am doing. But with a randomized $minute * * * * root /usr/local/sbin/update-freebsd-pkg-pf-table instead.

Oh, right, more asterisks.

Yeah, that all seems reasonable.

I knew what you meant. :-)

It's best not to run things on the 0 because then there is a load spike right at that time. I always try to randomize a little time skew so process work spikes are amortized over a little bit of time.

I could put everything into the crontab but things like this always grow and having a multiple line script with comments and documentation is better than trying to fit everything into a one-liner.

Yeah, it's a good point. When I guide people through setting up Let's Encrypt I have them pick a random day of the month and a random time, not on then zero.

Agreed, a script is better.

s/then zero/the zero/

Globally it is just a DNS lookup and so I don't feel bad about doing it relatively often. Locally then that is a distributed thing so can reload the pf table with it no problem.

Having the pkg.freebsd.org name in the pf.conf table means that at boot time it is loaded okay. And then it can get updated periodically later.

I like how you're doing that. In local news, I implemented the thing I thought would be like iRobbery's set-up, on 15, and it worked nicely, up to and including jails being able to talk to each other. I'll update my jail docs once I'm totally comfortable with this new method.

geez, for 10 days my server's been hammered by the filesystem security checks running from cron. i'm trying to find what changed, trussing the procs just show them iterating over files

I turn many of those that are on by default off due to the very low return on the work of them.

checking my reports, it starts at 0300, and i was receiving emails by 0330. no major changes... but on may 4 suddently i'm not getting the security report until 1400!

and find is spinning hard. i upgraded to 14.4 in april, so it's quite a while after that

i don't mind disabling it, but i'd like to find the cause

no major change in usage, files on disk, etc. zpools look ok. it's not io intensive, it's reading file metadata (find traversing file listing)

I can't imagine what would still be running after a very long time of running.

"zpool status" to look for errors?

zpools are fine. i killed the find to move on, want to see if maybe one ran long and they conflict

i can run the periodic job by hand to see once it's quiet

i'm running with time, and hitting control-t to find where its at

Morning: how can I check what modules are being used by the kernel?

kldstat

hmm.. this is strange, I mean my hard-drive name is da0 and that module is not listed.. what I wish to to see what I can remove from kernel, in case of compiling a new kernel

puf: in the dmesg output, you will also see the driver name listed. you would want to keep that driver in your kernel conf(and anything that depends on it)

the GENERIC kernel contains nearly all features already, so you won't have many modules loaded

i once compiled an almost all modules kernel to be able to boot a VM with under 96mb of ram

ivy: sure, but the default config is using about 700MB of RAM. Handbook suggest me to compile kernel to spend less memory... for example this server don't use wifi-cards, so I can remove them.. and many other network cards that I don't need can be removed too.. so I am just following along.. but the pciconf -lv command, don't give me the correct names used by the kernel, so I need to figure out which ones

that's what MODULAR is for, although i lost the argument against including storage drivers in it

are needed

puf: the generic kernel is ~30MB, you're not going to save much by removing bits from it. how are you determing memory in use?

ivy: I installed htop and it shows that I am using that amount of memory

in a fresh installation

without X

I have some experience with Linux and having a server (without X) normally cost about 200/300 MB by default

puf: htop includes filesystem caches by default. run 'top' and add up active + wired, then subtract the ARC size if you're using ZFS, that's the actual amount of memory in use

ok, doesn't look so much.. but I will compile the kernel anyway, for the sake of that experience X)

it's useful to know how to do but, fwiw, we strongly recommend using GENERIC nowadays unless you have a specific reason not to. 'learning' is a valid reason, of course

ok, using less 400MB of RAM is nice. Another "crazy" issue is that, after compilation, memory used, keeps active.. this is a normal behavior?

hm, cleaning up my zpool a bit helped for a short while, but now the bulk is slow again and CPU is used mostly for system, any other ideas what could be the problem/help? zfs shouldn't be a problem any more as it is only a bit over half full

not busy pruning?

top -SH

oh, yeah kernel(arc_prune) takes about 99% cpu

how to tune the system better? ARC is only about 5GB big and 46GB RAM are free according to top

gah, ok i ran the 100.chksetuid scan by hand as root, and it took 4 hours. omg

Demosthenex, Due to the storage arrays I set /etc/periodic.conf security_status_chksetuid_enable="NO" for that exact reason.

yeah, just trying to figure out what changed to make it take 4 hours all of a sudden. there's no major increasein storage usage, it's an idle NAS.

i removed some old snapshots, but 1.2TB free in the zpool it shouldn't be struggling from being nearly full yet

You might try running "time find /path -print | wc -l" across it and see how long that takes and how many files exist there. (directories are files too)

setting nosuid and noexec on datasets helps a bit for that periodic task, as that reduces how much gets scanned

nimaje, Wait... So does the security_status_chksetuid script check for that and avoid scanning datasets with that set? TIL!

periodic gets worse the more jails you add, and i havent found a way to stop it traversing into jails completely, or any kind of strategy for that. Some keep periodic local to the jails.

IMO needs a PERIODIC_DENYLIST or something like that.

just mount them as nosuid: problem solved

the problem is bigger than that

if you have 5 thick jails, that's 5 extra basesystems to scan, plus whatever is installed into them, and periodic will gladly traverse into them, for all of its scripts, not just the suid script.

hello, is it possible to trace memory allocations using dtrace?

which allocations?

malloc, I found that redis have a memory leak, but valgrind couldn't catch it because on end of process everything is fred.

hello

anyone here?

738 of us

michalz brendangregg.com/blog/2011-02-11/dtrace-pid-provider-arguments.html

yeah but i bet 730 of them are ghosts

thats the deal with most of the channels

buh

some bots, some idlers, some shy people, its a mixed bunch :)

tsoome_ thank you, I will try it

eh, i exist. but they left

ok, just another question: is possible to redirect ssh connections per user? I mean, if user a@server redirect to serverA, if user b@server redirect to serverB

puf: configured from the server, or from the client?

I know that redirecting with pf is possible, but I was thinking about this, or maybe I need to setup a main server that accept both users and from there, they can ssh into the server that accept them

rtprio: from the server

so no ProxyJump

not sure what is ProxyJump.. but it looks like a ssh feature.. I will read more about to understand

ProxyJump is highly useful

if you have an sshd-running host exposed to WAN and want to get to something on LAN

nice, I didn't knew about it.. first time. So yeah, I would probably setup this feature into the main host and then redirect clients to their "servers" which in this case will be jails

puf: how would you identify the users in pf?

if by ip, then you could transparently rdr them into their jail

but otherwise, it gets more complicated

rtprio: that is a good question.. I see

ok... I found a possibility that simplify the problem.. something new to me too.. multi-port on ssh-server.. with that I can "identify users" and redirect them to the correct jail, ... looks pretty nice

since we can add into sshd_config the option "Allowusers puf fup", if used ports are 22 24 I can define that on pf.conf rules

any other suggestions as a approach, that solve the IP problem ?

o0x1eef, In /etc/periodic.conf I always set security_status_chkmounts_ignore="/jails|/bhyve" to avoid that check going down those paths.

rwp: Same. I also do it for large cold storage data mounts as well (like ZFS backup dumps and the like). I don't need it scanning that kind of stuff.

nice tips.. rwp, security_status_chkmounts_ignore="/full/path/to/jail"?

puf, It is an egrep regular expression. See: less +42 /etc/periodic/security/200.chkmounts

Seems like the documentation for it is missing from "man periodic.conf".

rwp Thanks!

I actually turn many things off. Here is my list: bpa.st/KS3A

Much of that I got from dvl's post: gist.github.com/dlangille/ce60ac76b69f267a3f1de33495a338fc

interesting.. so I assume that the "periodic" event-system is always on..

correct me if I am wrong because, this is all new to me

man periodic.conf yeah.. that explain all .. too lazy

puf, "periodic" is simply "cron" and yes the cron daemon is always running.

Yeah, check /etc/crontab and you will see it has three entries. You can remove them to disable it.

It is considered to be rather one of the standard base features of the system though.

Having said that, I do modify many standard base features of the system.

Right, probably best to fine tune it, but I still think it can kill a machine if you have a lot of jails, because it tries to traverse everything and I'm not sure one variable is enough to address that.

When I started creating jails I went through and tried to disable all of the extra traversing down the jails. dvl's post was insightful. I think the defaults out of the box at install are poor. But then having made those changes I posted I haven't noticed problems after that point.

Link?

I posted it above: gist.github.com/dlangille/ce60ac76b69f267a3f1de33495a338fc

And my settings: bpa.st/KS3A

Sorry I missed that. Ty.

Note that I said I hadn't noticed problems. Not that their still were not things that should additionally be disabled. Probably still are. But I haven't noticed them.

Fair enough. My idea at first was to isolate periodic per jail, then have the host just be a dumb jail host that didn't have anything worth scanning, but lets see how this goes instead.

more doubts: when cloning a jail using bastille, it makes full clone with all changes made? this can simplify that configuration problem if using many jail

Depends on what type of jail, with a thin jail you can have a single copy of the base system and share it with many jails, then mount it inside the jail. You can add your own things in there too. So that can serve as a way to setup the same base jail many times over.

the "mount it inside the jail" confuse me..

Yes, its a bit complex, but bastille handles it for you. It adds a fstab with sth like: /usr/local/bastille/releases/15-STABLE /usr/local/bastille/jails/turtle/root/.bastille nullfs ro 0 0

Check /usr/local/bastille as well, you'll find everything there, the config, the jail.conf, etc.

mind blowing.. I love it.. jails let me think that is possible to create almost a "full intranet" that are only jails..

Yeah BSD is awesome

The internet is not the Internet, it is only a BSD system lol .. I am amazed

I remember some FreeBSD geek talking about jails inside jails.. assuming that is possible, how it works?

inception

jail edition

Yes, its possible, you can configure the number of children jails a jail has, and from there it is the usual way.

its a capability you can control

inception .. is that a application?

lol. No it's a movie.

its a movie where there's many levels of dreams and each time you sleep you go into a new dream, so youre never sure when youre in reality

Dreams within dreams.

thats just an average day for me

what? hahah let me check that!

It's a good movie.

False awakening

Leonardo Di Caprio movies are usually good

Yeah, agreed.

same

damn, I having difficult to find that trailer on youtube.. too much dreamers there.. too much false movies .. No Leonardo..

lol

ah the name was inception.. ok.. I was trying to find for dreams.. haha

full movie? O_o .. thanks! GN! :D

It also has some great music