yes

i have the infrastructure for it

i use a combination of unbound with dnsmasqd. Unbound by itself can't handle huge lists. So I off that work to dnsmasqd.

Was it worth it... no. I don't use any of it. I just could if I ever wanted to start implementing blocklists.

Oh, my bad, I do use it, I have a blocklist for malware and porn.

How big of a list are you talking about? I use unbound with a 300000+ line blocklist and it has no performance hit

performance how- query latency, RAM, or reload time?

let me check.

unbound chews 300k local zones fine at query time, pays for it in memory footprint and a slow reload

dnsmasq just reads addn-hosts and shrugs

which one bites depends on how often you update the list

root at aqua.home.network [root] # cat /var/unbound/etc/blocklists/malware.hosts | wc -l

435233

root at aqua.home.network [root] # cat /var/unbound/etc/blocklists/porn.hosts | wc -l

500295

So the performance hit is at boot time, and also when resolving URLs. Dnsmasqd was a consequence of that.

boot time hit at that size is just parsing, unavoidable. but resolve time slowdown is the suspicious part

I don't know, I consider it a solved problem.

unbound's local zone with type always_nxdomain is O(1) hash lookup

if you were loading entries as local data lines instead, then that's where the cost usually hides

dnsmasq still wins on memory for this volume, but it's possible the unbound side might have been misconfigured

dunno, don't care :)

fair

i remember pulling /etc/hosts from SRI-NIC twice a week over uucp in 85

Back in the summer of ..

jake feinler added you to it by email

back then couple thousand entries was a busy quarter

your malware list alone is a hundred times bigger than the entire arpanet namespace ever was

mockapetris built DNS specifically because that flat file wasnt going to clear 10k hosts

40 years later we shipped delegation, caching, hierarchy and the first thing everyone did with a home router was build a private hosts.txt to opt back out of half of it

unbound and dnsmasq is hosts.txt with a daemon and better PR

Yep

vixie and dave rand built MAPS RBL in 97 to fight spam

it was briliant abuse of DNS: encode the offender ip backwards into a domain like 1.0.0.127.bl.maps.vix.com dig it, get NXDOMAIN or a hit.

they used the resolver itself as a free distributed kv store before kv stores were a marketing category

it spawned an industry overnight

Interesting idea

then spammers started suing MAPS for libel and interference

they had to shut down the free tier because lawsuits cost more than the service did

spamhaus inherited the cause and had injunctions filed against them in czech courts

your local blocklist is the great grandchild of that battle

the only reason your inbox isnt 99% viagra ads is paul vixie and a handful of lawyers who hated spam more

I used this - github.com/blocklistproject/Lists

Just found this DJ Ware guy on youtube, man is he good

I was expecting some dope beats so this is different...

hey! anyone knows the syzbot status for freebsd? It seems to be down?

or has it been abandoned for some reason? or am i just blind?

does `pw lock` prevent ssh logins?

No. It scrambles the password but pub key authentication would still work.

Is there a way to truly disable login? I've changed authorized_keys' modes to 000

Basically at Umbrellix we're having a situation right now where a friend's computers have been compromised, so we have to lock her out of her accounts for her protection

I usually change the shell to /sbin/nologin

Done.

Yeah. Just change the shell to anything nonexistent. Should prevent any logins even when successful.

And, obviously, delete any ~user/.ssh/authorized_keys file(s) just to be safe.

Modes 000 not enough?

Should be. But deletion is always the safest. She'll need to recreate them later anyhow.

You can also add an "AllowUsers" line to /etc/ssh/sshd_config and not include their username for the time being.

We have experienced the sum of all possible fears today

Or something.

Were you allowing password auth before this?

Of necessity.

Technologically inexperienced user.

So, disbale that. Have users create keys with a passphrase.

Disable PAM module.

People need to get with the times!

Not sure what you are driving at here. Is the PAM module inherently insecure?

No. It's just another way to log in without a key (password). Disable password authentication and only allow keys.

We're not interested in completely disabling password authentication.

That's unfortunate. Perhaps integrate blocklisting and/or fail2ban/SSHGuard?

Wouldn't mitigate the compromise in question.

The log spam is the only really annoying thing from the roving horde of guesser bots for us.

How did the compromise happen?

Physical access.

We're unsure of whether she's even still alive, if I'm honest.

So, they already had a password then.

The "unsure if still alive" is a bit alarming. Have you contacted authorities?

I can't say very much, but she's currently a bit crosswise with them right now.

Oh, believe me, I'm not interested in details. But, a checkup or report for someone who may or may not be alive would be a good start.

Arrested or not, alive is alive.

Heard from her dad.

But, circling back to the login lock, as o0x1eef mentioned, changing the shell should be sufficient.

In FreeBSD to disable an account "pw lock rwp" will disable logins including ssh logins.

As a special it adds "*LOCKED*" to the password field and this is recognized as blocking logins including ssh logins. An authenticated login over ssh will exit 255 and nothing is printed.

This is the section of the Handbook which covers this topic. docs.freebsd.org/en/books/handbook/security

pub key auth doesn't care about master.passwd.

Try it.

Did you do it already, I'd prefer to believe to you :)

Yes. I have tested this. I went through this learning some time ago and have it in my notes files now. I tested it again just now to verify that it is still true.

I stand corrected then. I wonder how it works though. I guess adding LOCKED corrupts the field.

It's a magic string that is recognized.

aha

On GNU/Linux systems things work differently. Star'ing out the password does not block ssh logins there.

It wouldn't be a good default

And on FreeBSD just a star'ing out the password doesn't either. But "*LOCKED*" is a magic string which does.

It's a simple but hacky way to do it. I'd prefer a dedicated field.

If we go back to the early years before rsh/rlogin/ssh existed then disabling the password was sufficient to disable an account. But often we didn't want to obliterate the account. Just make the person come talk to us before they could login again. So it was common to block the password field from ever matching an actual password.

Passwords are encoded using a set of characters which does NOT include the '*' character. So putting a * in the password field meant that no password could ever match that field.

Sure. Another field would be another step you'd have to check separate to authentication as well. So if you forget or miss it, it's a serious mistake.

We couldn't add another field by that time. The fields were already set.

That's why the GECOS field also encodes as a comma separate list now. People snuck in office numbers and phone numbers there. I don't like that but so it is.

Then along came rlogin/rsh and then later ssh and that no longer required passwords. So another method is also needed. On GNU/Linux systems one uses "usermod -e 1 rwp" to set the expire date to 1 which is long ago and so the account is expired, effectively disabling that part.

whats wrong with changing the shell to /sbin/nologin

Meanwhile... If you have someone that you want to disable always check that their crontab is not still active or they could have set up cronjobs to run routinely still having access.

Yeah good point

Using a shell that is nologin is an alternate method. It's fine. I think that works on FreeBSD. But again on other systems it does not block everything. Specifically sftp is still allowed because that does not load the login shell and never notices the nologin.

Since almost all of these bypasses involve ssh, it is a good idea to disable the user's authorized_keys file to make sure there just isn't any way to finagle the system.

Just tested nologin with sftp and it accidentally works. "Received message too long 1416128883" "Ensure the remote shell produces no output for non-interactive sessions."

pw lock + authorized_keys + /sbin/nologin + hash the username temporarily

In a past time we used to add a '!' to the front of the username so that when listing files we would know if the file was owned by someone who is now persona non grata or not. Something easily reversed.

i went into a train of thought where i was thinking it is easy to make changes like that, and forget about it, and the reasoning, sometimes i wish i could attach my shell session to a larger context/database that would know which commands i ran, then a rationale for why, even as a education tool

It's a good thought. In IRC-land we have a bot Litharge for keeping track of just such things related to bans and such.

Since I mentioned above that in GNU/Linux one uses "usermod -e 1 rwp" to cause an account to be expired I will mention that "usermod -e '' rwp" unexpires it enabling it again. It removes the datestamp from the /etc/shadow file on those systems.

MelanieUrsidino ^^ this conversation

OT: In the US never call the police for a health and welfare check. Statistically this often results in a police shooting homicide. Get help from social services instead.

Her dad says she is alive and in police custody.

MelanieUrsidino, Just to verify you see it "pw lock rwp" is enough to disable accounts on FreeBSD systems. On GNU/Linux use "usermod -e 1 rwp" and rename the authorized_keys file.

aight.

Oh, I forgot I had written a blog on this for *GNU/Linux* anyway: proulx.com/~bob/doc/howto-disable-a…ccounts/howto-disable-accounts.html

I don't think I would sleep if I even tried to.

It doesn't hurt to take a layered approach though, and also change the shell, disable ~/.authorized_keys, and whatever else, the only downside is that it is a hassle to undo.

But boy howdy do need to.

on 14.4-RELEASE-p5, with 'net.link.epair.ether_gen_addr=1' in /etc/sysctl.conf, upon reboot, `sysctl net.link.epair.ether_gen_addr` returns "net.link.epair.ether_gen_addr: 0". This looks like a bug, can someone else confirm?

Sleep would be nice but caffeine is my vice.

moviuro, On 14.4-RELEASE-p5 "sysctl: unknown oid 'net.link.epair.ether_gen_addr'"

rwp: did you reboot after your second `freebsd-update install`? I have another 14.4 machine where that oid is not yet known

but here, it does work (and the machine was rebooted a few times already since the 14.4 upgrade)

Reading the man page... I need to load that driver first. Needs if_epair_load="YES"

in loader.conf file.

moviuro, I enabled the driver putting that in loader.conf and rebooted and doing only that then sysctl net.link.epair.ether_gen_addr returns 1 without needing to set it explicitly.

how does that even make sense? The default behavior was supposed to only have been changed in 15.0

Oh, sorry. This particular system I tested on is 15.0 system. Do I have a 14 system that I can use to test... Hmm...

if_epair_load="YES" in /boot/loader.conf seems to have done the trick, net.link.epair.ether_gen_addr: 1 now upon system reboot

thanks rwp

Found one. Edited loader.conf. Rebooting it. Waiting for it to boot back up again.

In 14.4-RELEASE it booted with net.link.epair.ether_gen_addr:0 but then can set it to 1.

So... You good? Or do you still want me to try /etc/sysctl.d/ for it?

yup, I knew the sysctl.conf(5) change was needed but it didn't make sense that the "1" value was not applied... now it is and I'm happy

Woot!

Has anyone messed with imitating user services? I have a couple things I want to automate like services under my user (i.e. Syncthing, WebDAV server, mpd server). Some of these might be run under multiple users separately, so I can't just configure syncthing_user in rc.conf for example. Current idea is to use either crontab or a custom rc service to start a runit `runsvdir` daemon under my user. But I'm curious what you guys think or have tried for user

services

I really like etcupdate, compared to mergemster

It seems slower

bbaovanc each user would need to run a syncthing, configured on a different port

bbaovanc: what exactly are you "imitating" ?

either you run the service or you do not

rtprio: I guess per user services like launchd, openrc or systemd has, which also ask the question of "for which user gets that service run", resulting in something possible being run multiple times for diffrent users

yeah, thank god we don't have that

well, you can fake it in part via @reboot in your crontab, but that would be missing the service manager part, so maybe run runit via @reboot for your user and get the service manager that way

Anyone else having drm kernel panics? two in one day.

Seems like might be zfs and drm is taking the fall.

does make DESTDIR work with /usr/ports?

polarian: you want LOCALBASE, not DESTDIR. but that affects *all* ports, you can't install one specific port in another place

(well, you could, but... ports is not meant to work like that, it will almost certainly break)

hmmmm

I just need to bootstrap a jail

and I dont want to use pkg for it :3

im finally getting around to setting up a build server

this will make contributing to ports 100x easier

so much to get done though :/

alright better idea, mount the src tree with nullfs and then make install the port to bootstrap the jail

why not just run 'make pkg' and then install the package in the jail. you can't "not use pkg" with ports anyway

s/make pkg/make package

wait doesnt work

duh, jails dont have pkg-static

ivy: because there is a dependency tree

and copying each dependency over one by one will be annoying

unless there is a envvar I can use to drop the .pkg into?

if there is, then sure that will work!

ah RTFM!!!

PKGREPOSITORY

make package wont build the dependencies ugh

fuck it fine, I will just use pkg ugh

no poudriere is literally possible

speaking of poudriere has anyone, in last 2 days, tried to build python311 package and receive a checksum issue.. so it will not build?

in my mind, my freebsd laptop is a bit slow cold booting, is there anything that one often does to speed it up

i never turn mine off

just thought id ask the pros

rtprio, tbh i dont often shut down either, im prolly just caught up in the freshness of it alll

ah gotta afk

do any of you guys use virtual-machine-manager? i get 1 pw prompt to connect to the remote machine, and then 6 more when accessing the vm. im not sure why/what i can do about it. if anyone has a hint thanks

from a debian pc i dont get any prompts at all

I haven't used it on a FreeBSD host.

the remote host is debian

So you're accessing a Debian VM host from a FreeBSD machine using virt-manager?

yes

i also added the libvirtd service etc but it didnt have any effect.

I think that is required for a VM host, but I'm not sure about what is effectively a remote terminal

elivoncoder: I can't help with libvirt or virt-manager, but have you considered trying vm-bhyve instead?

ek, I think the virtualization host is a Linux machine.

It sounds like he is using virt-manager to access a remote Linux virtualization host

yes thats right. i would be using bhyve when i get going with some local vms though

Ah, gotcha'.

Without having a similar setup in front of me, I'm not really sure how to troubleshoot that specifically. Would something like VNC be a viable alternative though?

Or SSH if it's not graphical

oh yes ssh works.

is it ssh asking for your password?

yes its the remote ssh login its asking me for user@remote pw

then getting ssh keys working properly would save you from that

most likely

oh good idea

You could also use keys if you'd like

im switching to freebsd full time and mostly just trying to get things working the same as they did in debian

yes keys are a great idea

thanks

No problem

ssh keys is not unique to debian

should be use keys stead of pw anyways

Also if you are wanting to harden the environment, I would encourage running ssh-audit as well.

on clients and servers

right on thanks for that too

ssh-audit

I use virt-manager on FreeBSD to manage remote libvirt. Works great.

You should definitely be using the local ssh-agent to be handling your ssh keys.

Run "ssh-add -l" and if don't see your keys loaded then start at the problem there and get that working first.

rtprio: I fell asleep earlier; how come you say "thank god we don't have that" (about user services)?

possible sour grapes

bbaovanc: thank god we don't have systemd on freebsd? does that really need an explination?

they're users, they can manage their own services

Oh, I thought you meant user services in general not systemd

i don't see the point, alas

manage their own services-- meaning like putting daemon(8) commands in crontab and manually killing/spawning daemons when you need to mess with them?

I as well am happy not to have systemd on FreeBSD. I must work with systemd elsewhere and know it fairly well. It's not a good thing.

I am not understanding the problem. Is managing a user service a problem? If I need something running then I start it. If I don't want it running then I stop it. Is that a problem needing a solution?

as a user of a multiuser system, assuming i am permitted to run services in the background, yeah, it is up to me. i don't expect the server operator to start syncthing or my irc bouncer for me

that's silly

i theoretically start `s6-svscan` for my users if they ask me to

Yes something like s6-svscan was like what I meant, the operator running a service manager for the user and then the user can do whatever under it

It's a server so that's why I want some sort of automation instead of manually starting the services

Anyone can create a Rube Goldberg machine of many parts. That does not mean it is needed to be so complicated.

i'm currently the only user at my site for whom I start s6-svscan but I don't expect that to last

rwp: exactly, tiny shell script which starts tmux and starts a few programs within works great

It just feels crude to me

well, just run your s6-svcscan for each user then. it's like 2 lines of shell

I use tmux, starting it at boot time for me, and start programs in it, because I want those interactive programs running for me interactively. tmux+emacs+irssi is a good combination!

tmux is an interesting idea

rwp, thanks ill check it out