02:30:46 Is there a natural way to run hourly scripts on FreeBSD such as through periodic? Or is the normal thing to create a /usr/local/etc/cron.d/houly-something crontab that calls /usr/local/sbin/hourly-something script? 02:32:20 Why not cron? 02:32:38 What do you mean why not cron? I proposed using cron. 02:34:10 If you don't think cron should be used then I am curious as to why. 02:34:11 Periodic is called from cron anyway. 02:34:20 Right. 02:34:30 But I think the natural way is to make a crontab line. 02:34:41 I don't think periodic has an hourly function? 02:34:53 Not that I can find. It's only daily, weekly, monthly. 02:35:22 I am missing the easy use of /etc/cron.hourly/* scripts. 02:35:46 Yeah, sorry, i meant just creating a cron line. 02:36:27 Then it needs multiple pieces like all Rube Goldberg machines. Which just makes installing it on machines more installing that needs to be done. 02:37:35 Okay so the X part of this XY problem is that I need to create a jail to hold a process. I need to pf firewall it so that if something gets loose in it (well... this is in reaction to something that got loose in it) then it can't leave the jail. 02:38:21 So I have a pf set of rules that by default block outgoing as well as incoming. To keep anything that is loose inside from leaving the container. 02:39:42 But I want to be able to "pkg upgrade -y" in the system. Which means it needs access to pkg.freebsd.org. I create a table "table persist { pkg.freebsd.org }" Which works nicely. but pkg.freebsd.org might change addresses. So I need to do a DNS lookup periodically and update it. 02:40:17 Because currently it is not a jail but a full virtual machine. So it needs to be able to get upgrades. 02:42:33 Brute force and ignorance will always triumph so I have decided to run this command periodically: { host -t a pkg.freebsd.org; host -t aaaa pkg.freebsd.org ;} | awk '/has .*address/{print$NF}' | pfctl -t freebsd_pkg -T replace -f - 02:42:36 rwp: Why not just have 0 * 0 0 0 update-the-dns-stuff ? 02:43:06 oh, you've moved past that 02:43:28 That's basically what I am doing. But with a randomized $minute * * * * root /usr/local/sbin/update-freebsd-pkg-pf-table instead. 02:43:59 Oh, right, more asterisks. 02:44:05 Yeah, that all seems reasonable. 02:44:07 I knew what you meant. :-) 02:44:42 It's best not to run things on the 0 because then there is a load spike right at that time. I always try to randomize a little time skew so process work spikes are amortized over a little bit of time. 02:45:50 I could put everything into the crontab but things like this always grow and having a multiple line script with comments and documentation is better than trying to fit everything into a one-liner. 02:46:06 Yeah, it's a good point. When I guide people through setting up Let's Encrypt I have them pick a random day of the month and a random time, not on then zero. 02:46:18 Agreed, a script is better. 02:46:34 s/then zero/the zero/ 02:47:08 Globally it is just a DNS lookup and so I don't feel bad about doing it relatively often. Locally then that is a distributed thing so can reload the pf table with it no problem. 02:48:13 Having the pkg.freebsd.org name in the pf.conf table means that at boot time it is loaded okay. And then it can get updated periodically later. 02:58:44 I like how you're doing that. In local news, I implemented the thing I thought would be like iRobbery's set-up, on 15, and it worked nicely, up to and including jails being able to talk to each other. I'll update my jail docs once I'm totally comfortable with this new method. 05:50:35 geez, for 10 days my server's been hammered by the filesystem security checks running from cron. i'm trying to find what changed, trussing the procs just show them iterating over files 05:52:02 I turn many of those that are on by default off due to the very low return on the work of them. 05:58:30 checking my reports, it starts at 0300, and i was receiving emails by 0330. no major changes... but on may 4 suddently i'm not getting the security report until 1400! 05:58:46 and find is spinning hard. i upgraded to 14.4 in april, so it's quite a while after that 05:58:53 i don't mind disabling it, but i'd like to find the cause 06:01:20 no major change in usage, files on disk, etc. zpools look ok. it's not io intensive, it's reading file metadata (find traversing file listing) 06:06:47 I can't imagine what would still be running after a very long time of running. 06:06:59 "zpool status" to look for errors? 06:13:47 zpools are fine. i killed the find to move on, want to see if maybe one ran long and they conflict 06:13:56 i can run the periodic job by hand to see once it's quiet 06:30:57 i'm running with time, and hitting control-t to find where its at 06:32:48 Morning: how can I check what modules are being used by the kernel? 06:32:56 kldstat 06:37:07 hmm.. this is strange, I mean my hard-drive name is da0 and that module is not listed.. what I wish to to see what I can remove from kernel, in case of compiling a new kernel 06:40:33 puf: in the dmesg output, you will also see the driver name listed. you would want to keep that driver in your kernel conf(and anything that depends on it) 06:42:59 the GENERIC kernel contains nearly all features already, so you won't have many modules loaded 06:52:55 i once compiled an almost all modules kernel to be able to boot a VM with under 96mb of ram 06:54:12 ivy: sure, but the default config is using about 700MB of RAM. Handbook suggest me to compile kernel to spend less memory... for example this server don't use wifi-cards, so I can remove them.. and many other network cards that I don't need can be removed too.. so I am just following along.. but the pciconf -lv command, don't give me the correct names used by the kernel, so I need to figure out which ones 06:54:17 that's what MODULAR is for, although i lost the argument against including storage drivers in it 06:54:18 are needed 06:54:53 puf: the generic kernel is ~30MB, you're not going to save much by removing bits from it. how are you determing memory in use? 06:55:37 ivy: I installed htop and it shows that I am using that amount of memory 06:56:05 in a fresh installation 06:56:11 without X 06:57:18 I have some experience with Linux and having a server (without X) normally cost about 200/300 MB by default 06:57:43 puf: htop includes filesystem caches by default. run 'top' and add up active + wired, then subtract the ARC size if you're using ZFS, that's the actual amount of memory in use 07:06:49 ok, doesn't look so much.. but I will compile the kernel anyway, for the sake of that experience X) 07:26:07 it's useful to know how to do but, fwiw, we strongly recommend using GENERIC nowadays unless you have a specific reason not to. 'learning' is a valid reason, of course 07:30:03 ok, using less 400MB of RAM is nice. Another "crazy" issue is that, after compilation, memory used, keeps active.. this is a normal behavior? 12:57:51 hm, cleaning up my zpool a bit helped for a short while, but now the bulk is slow again and CPU is used mostly for system, any other ideas what could be the problem/help? zfs shouldn't be a problem any more as it is only a bit over half full 13:12:19 not busy pruning? 13:12:23 top -SH 13:16:13 oh, yeah kernel(arc_prune) takes about 99% cpu 13:18:02 how to tune the system better? ARC is only about 5GB big and 46GB RAM are free according to top 13:30:08 gah, ok i ran the 100.chksetuid scan by hand as root, and it took 4 hours. omg 14:59:29 Demosthenex, Due to the storage arrays I set /etc/periodic.conf security_status_chksetuid_enable="NO" for that exact reason. 15:14:09 yeah, just trying to figure out what changed to make it take 4 hours all of a sudden. there's no major increasein storage usage, it's an idle NAS. 15:14:29 i removed some old snapshots, but 1.2TB free in the zpool it shouldn't be struggling from being nearly full yet 15:17:04 You might try running "time find /path -print | wc -l" across it and see how long that takes and how many files exist there. (directories are files too) 15:24:02 setting nosuid and noexec on datasets helps a bit for that periodic task, as that reduces how much gets scanned 15:27:05 nimaje, Wait... So does the security_status_chksetuid script check for that and avoid scanning datasets with that set? TIL! 18:59:02 periodic gets worse the more jails you add, and i havent found a way to stop it traversing into jails completely, or any kind of strategy for that. Some keep periodic local to the jails. 19:00:27 IMO needs a PERIODIC_DENYLIST or something like that. 19:00:43 just mount them as nosuid: problem solved 19:01:18 the problem is bigger than that 19:07:32 if you have 5 thick jails, that's 5 extra basesystems to scan, plus whatever is installed into them, and periodic will gladly traverse into them, for all of its scripts, not just the suid script. 19:55:55 hello, is it possible to trace memory allocations using dtrace? 20:10:21 which allocations? 20:18:21 malloc, I found that redis have a memory leak, but valgrind couldn't catch it because on end of process everything is fred. 20:45:40 hello 20:45:46 anyone here? 20:46:21 738 of us 20:47:43 michalz https://www.brendangregg.com/blog/2011-02-11/dtrace-pid-provider-arguments.html 20:47:53 yeah but i bet 730 of them are ghosts 20:48:01 thats the deal with most of the channels 20:48:03 buh 20:49:08 some bots, some idlers, some shy people, its a mixed bunch :) 20:50:54 tsoome_ thank you, I will try it 21:20:31 eh, i exist. but they left 21:22:20 ok, just another question: is possible to redirect ssh connections per user? I mean, if user a@server redirect to serverA, if user b@server redirect to serverB 21:25:59 puf: configured from the server, or from the client? 21:26:04 I know that redirecting with pf is possible, but I was thinking about this, or maybe I need to setup a main server that accept both users and from there, they can ssh into the server that accept them 21:26:14 rtprio: from the server 21:27:37 so no ProxyJump 21:28:47 not sure what is ProxyJump.. but it looks like a ssh feature.. I will read more about to understand 21:28:56 ProxyJump is highly useful 21:29:18 if you have an sshd-running host exposed to WAN and want to get to something on LAN 21:31:10 nice, I didn't knew about it.. first time. So yeah, I would probably setup this feature into the main host and then redirect clients to their "servers" which in this case will be jails 21:31:33 puf: how would you identify the users in pf? 21:31:47 if by ip, then you could transparently rdr them into their jail 21:31:54 but otherwise, it gets more complicated 21:32:11 rtprio: that is a good question.. I see 21:42:51 ok... I found a possibility that simplify the problem.. something new to me too.. multi-port on ssh-server.. with that I can "identify users" and redirect them to the correct jail, ... looks pretty nice 21:57:15 since we can add into sshd_config the option "Allowusers puf fup", if used ports are 22 24 I can define that on pf.conf rules 21:58:28 any other suggestions as a approach, that solve the IP problem ? 22:33:06 o0x1eef, In /etc/periodic.conf I always set security_status_chkmounts_ignore="/jails|/bhyve" to avoid that check going down those paths. 22:34:14 rwp: Same. I also do it for large cold storage data mounts as well (like ZFS backup dumps and the like). I don't need it scanning that kind of stuff. 22:42:55 nice tips.. rwp, security_status_chkmounts_ignore="/full/path/to/jail"? 22:46:00 puf, It is an egrep regular expression. See: less +42 /etc/periodic/security/200.chkmounts 22:46:43 Seems like the documentation for it is missing from "man periodic.conf". 22:47:34 rwp Thanks! 22:48:24 I actually turn many things off. Here is my list: https://bpa.st/KS3A 22:50:23 Much of that I got from dvl's post: https://gist.github.com/dlangille/ce60ac76b69f267a3f1de33495a338fc 22:53:30 interesting.. so I assume that the "periodic" event-system is always on.. 22:54:16 correct me if I am wrong because, this is all new to me 22:58:45 man periodic.conf yeah.. that explain all .. too lazy 23:01:31 puf, "periodic" is simply "cron" and yes the cron daemon is always running. 23:03:29 Yeah, check /etc/crontab and you will see it has three entries. You can remove them to disable it. 23:04:02 It is considered to be rather one of the standard base features of the system though. 23:04:43 Having said that, I do modify many standard base features of the system. 23:05:04 Right, probably best to fine tune it, but I still think it can kill a machine if you have a lot of jails, because it tries to traverse everything and I'm not sure one variable is enough to address that. 23:07:02 When I started creating jails I went through and tried to disable all of the extra traversing down the jails. dvl's post was insightful. I think the defaults out of the box at install are poor. But then having made those changes I posted I haven't noticed problems after that point. 23:07:28 Link? 23:08:10 I posted it above: https://gist.github.com/dlangille/ce60ac76b69f267a3f1de33495a338fc 23:08:18 And my settings: https://bpa.st/KS3A 23:08:22 Sorry I missed that. Ty. 23:09:28 Note that I said I hadn't noticed problems. Not that their still were not things that should additionally be disabled. Probably still are. But I haven't noticed them. 23:10:22 Fair enough. My idea at first was to isolate periodic per jail, then have the host just be a dumb jail host that didn't have anything worth scanning, but lets see how this goes instead. 23:16:32 more doubts: when cloning a jail using bastille, it makes full clone with all changes made? this can simplify that configuration problem if using many jail 23:17:55 Depends on what type of jail, with a thin jail you can have a single copy of the base system and share it with many jails, then mount it inside the jail. You can add your own things in there too. So that can serve as a way to setup the same base jail many times over. 23:20:34 the "mount it inside the jail" confuse me.. 23:21:36 Yes, its a bit complex, but bastille handles it for you. It adds a fstab with sth like: /usr/local/bastille/releases/15-STABLE /usr/local/bastille/jails/turtle/root/.bastille nullfs ro 0 0 23:21:56 Check /usr/local/bastille as well, you'll find everything there, the config, the jail.conf, etc. 23:28:21 mind blowing.. I love it.. jails let me think that is possible to create almost a "full intranet" that are only jails.. 23:28:46 Yeah BSD is awesome 23:33:22 The internet is not the Internet, it is only a BSD system lol .. I am amazed 23:35:30 I remember some FreeBSD geek talking about jails inside jails.. assuming that is possible, how it works? 23:36:01 inception 23:36:11 jail edition 23:36:11 Yes, its possible, you can configure the number of children jails a jail has, and from there it is the usual way. 23:36:37 its a capability you can control 23:36:47 inception .. is that a application? 23:37:09 lol. No it's a movie. 23:37:21 its a movie where there's many levels of dreams and each time you sleep you go into a new dream, so youre never sure when youre in reality 23:37:23 Dreams within dreams. 23:37:47 thats just an average day for me 23:37:50 what? hahah let me check that! 23:37:59 It's a good movie. 23:38:26 False awakening 23:38:45 Leonardo Di Caprio movies are usually good 23:38:55 Yeah, agreed. 23:39:52 same 23:45:36 damn, I having difficult to find that trailer on youtube.. too much dreamers there.. too much false movies .. No Leonardo.. 23:46:32 https://www.youtube.com/watch?v=wUWdIaaCvjg 23:46:33 https://www.youtube.com/watch?v=YoHD9XEInc0 23:46:36 lol 23:46:41 ah the name was inception.. ok.. I was trying to find for dreams.. haha 23:47:15 full movie? O_o .. thanks! GN! :D 23:47:22 It also has some great music