02:21:38 yes 02:21:44 i have the infrastructure for it 02:23:13 i use a combination of unbound with dnsmasqd. Unbound by itself can't handle huge lists. So I off that work to dnsmasqd. 02:23:36 Was it worth it... no. I don't use any of it. I just could if I ever wanted to start implementing blocklists. 02:26:36 Oh, my bad, I do use it, I have a blocklist for malware and porn. 02:27:11 How big of a list are you talking about? I use unbound with a 300000+ line blocklist and it has no performance hit 02:29:46 performance how- query latency, RAM, or reload time? 02:29:50 let me check. 02:30:01 unbound chews 300k local zones fine at query time, pays for it in memory footprint and a slow reload 02:30:11 dnsmasq just reads addn-hosts and shrugs 02:30:23 which one bites depends on how often you update the list 02:31:27 root at aqua.home.network [root] # cat /var/unbound/etc/blocklists/malware.hosts | wc -l 02:31:27 435233 02:31:27 root at aqua.home.network [root] # cat /var/unbound/etc/blocklists/porn.hosts | wc -l 02:31:27 500295 02:32:18 So the performance hit is at boot time, and also when resolving URLs. Dnsmasqd was a consequence of that. 02:33:48 boot time hit at that size is just parsing, unavoidable. but resolve time slowdown is the suspicious part 02:34:07 I don't know, I consider it a solved problem. 02:34:10 unbound's local zone with type always_nxdomain is O(1) hash lookup 02:34:32 if you were loading entries as local data lines instead, then that's where the cost usually hides 02:34:52 dnsmasq still wins on memory for this volume, but it's possible the unbound side might have been misconfigured 02:35:14 dunno, don't care :) 02:35:34 fair 02:37:14 i remember pulling /etc/hosts from SRI-NIC twice a week over uucp in 85 02:37:47 Back in the summer of .. 02:37:50 jake feinler added you to it by email 02:37:59 back then couple thousand entries was a busy quarter 02:38:23 your malware list alone is a hundred times bigger than the entire arpanet namespace ever was 02:38:51 mockapetris built DNS specifically because that flat file wasnt going to clear 10k hosts 02:39:11 * MelanieUrsidino puts on some music she associates with retro computers 02:39:46 40 years later we shipped delegation, caching, hierarchy and the first thing everyone did with a home router was build a private hosts.txt to opt back out of half of it 02:40:35 unbound and dnsmasq is hosts.txt with a daemon and better PR 02:43:26 Yep 02:46:54 vixie and dave rand built MAPS RBL in 97 to fight spam 02:47:22 it was briliant abuse of DNS: encode the offender ip backwards into a domain like 1.0.0.127.bl.maps.vix.com dig it, get NXDOMAIN or a hit. 02:47:45 they used the resolver itself as a free distributed kv store before kv stores were a marketing category 02:47:55 it spawned an industry overnight 02:48:14 Interesting idea 02:48:20 then spammers started suing MAPS for libel and interference 02:48:34 they had to shut down the free tier because lawsuits cost more than the service did 02:48:53 spamhaus inherited the cause and had injunctions filed against them in czech courts 02:49:04 your local blocklist is the great grandchild of that battle 02:49:29 the only reason your inbox isnt 99% viagra ads is paul vixie and a handful of lawyers who hated spam more 02:49:48 I used this - https://github.com/blocklistproject/Lists 02:51:29 Just found this DJ Ware guy on youtube, man is he good 02:52:04 I was expecting some dope beats so this is different... 02:53:32 hey! anyone knows the syzbot status for freebsd? It seems to be down? 02:54:08 or has it been abandoned for some reason? or am i just blind? 05:17:02 does `pw lock` prevent ssh logins? 05:32:38 No. It scrambles the password but pub key authentication would still work. 05:37:51 Is there a way to truly disable login? I've changed authorized_keys' modes to 000 05:38:56 Basically at Umbrellix we're having a situation right now where a friend's computers have been compromised, so we have to lock her out of her accounts for her protection 05:39:06 I usually change the shell to /sbin/nologin 05:40:01 Done. 05:42:07 Yeah. Just change the shell to anything nonexistent. Should prevent any logins even when successful. 05:43:21 And, obviously, delete any ~user/.ssh/authorized_keys file(s) just to be safe. 05:43:38 Modes 000 not enough? 05:44:19 Should be. But deletion is always the safest. She'll need to recreate them later anyhow. 05:45:47 You can also add an "AllowUsers" line to /etc/ssh/sshd_config and not include their username for the time being. 05:46:25 We have experienced the sum of all possible fears today 05:47:16 Or something. 05:47:31 Were you allowing password auth before this? 05:48:05 Of necessity. 05:48:15 Technologically inexperienced user. 05:48:53 So, disbale that. Have users create keys with a passphrase. 05:49:07 Disable PAM module. 05:49:24 People need to get with the times! 05:49:35 Not sure what you are driving at here. Is the PAM module inherently insecure? 05:50:31 No. It's just another way to log in without a key (password). Disable password authentication and only allow keys. 05:50:58 We're not interested in completely disabling password authentication. 05:51:54 That's unfortunate. Perhaps integrate blocklisting and/or fail2ban/SSHGuard? 05:52:14 Wouldn't mitigate the compromise in question. 05:52:43 The log spam is the only really annoying thing from the roving horde of guesser bots for us. 05:52:48 How did the compromise happen? 05:52:54 Physical access. 05:53:19 We're unsure of whether she's even still alive, if I'm honest. 05:53:38 So, they already had a password then. 05:54:47 The "unsure if still alive" is a bit alarming. Have you contacted authorities? 05:55:18 I can't say very much, but she's currently a bit crosswise with them right now. 05:56:15 Oh, believe me, I'm not interested in details. But, a checkup or report for someone who may or may not be alive would be a good start. 05:56:45 Arrested or not, alive is alive. 05:57:37 Heard from her dad. 05:57:56 But, circling back to the login lock, as o0x1eef mentioned, changing the shell should be sufficient. 06:00:16 In FreeBSD to disable an account "pw lock rwp" will disable logins including ssh logins. 06:01:31 As a special it adds "*LOCKED*" to the password field and this is recognized as blocking logins including ssh logins. An authenticated login over ssh will exit 255 and nothing is printed. 06:02:21 This is the section of the Handbook which covers this topic. https://docs.freebsd.org/en/books/handbook/security/ 06:02:38 pub key auth doesn't care about master.passwd. 06:02:59 Try it. 06:03:18 Did you do it already, I'd prefer to believe to you :) 06:03:46 Yes. I have tested this. I went through this learning some time ago and have it in my notes files now. I tested it again just now to verify that it is still true. 06:04:17 I stand corrected then. I wonder how it works though. I guess adding LOCKED corrupts the field. 06:04:32 It's a magic string that is recognized. 06:04:38 aha 06:04:54 On GNU/Linux systems things work differently. Star'ing out the password does not block ssh logins there. 06:05:26 It wouldn't be a good default 06:05:32 And on FreeBSD just a star'ing out the password doesn't either. But "*LOCKED*" is a magic string which does. 06:06:28 It's a simple but hacky way to do it. I'd prefer a dedicated field. 06:08:00 If we go back to the early years before rsh/rlogin/ssh existed then disabling the password was sufficient to disable an account. But often we didn't want to obliterate the account. Just make the person come talk to us before they could login again. So it was common to block the password field from ever matching an actual password. 06:08:37 Passwords are encoded using a set of characters which does NOT include the '*' character. So putting a * in the password field meant that no password could ever match that field. 06:09:01 Sure. Another field would be another step you'd have to check separate to authentication as well. So if you forget or miss it, it's a serious mistake. 06:09:26 We couldn't add another field by that time. The fields were already set. 06:09:59 That's why the GECOS field also encodes as a comma separate list now. People snuck in office numbers and phone numbers there. I don't like that but so it is. 06:11:10 Then along came rlogin/rsh and then later ssh and that no longer required passwords. So another method is also needed. On GNU/Linux systems one uses "usermod -e 1 rwp" to set the expire date to 1 which is long ago and so the account is expired, effectively disabling that part. 06:11:51 whats wrong with changing the shell to /sbin/nologin 06:11:58 Meanwhile... If you have someone that you want to disable always check that their crontab is not still active or they could have set up cronjobs to run routinely still having access. 06:12:32 Yeah good point 06:13:07 Using a shell that is nologin is an alternate method. It's fine. I think that works on FreeBSD. But again on other systems it does not block everything. Specifically sftp is still allowed because that does not load the login shell and never notices the nologin. 06:14:10 Since almost all of these bypasses involve ssh, it is a good idea to disable the user's authorized_keys file to make sure there just isn't any way to finagle the system. 06:15:20 Just tested nologin with sftp and it accidentally works. "Received message too long 1416128883" "Ensure the remote shell produces no output for non-interactive sessions." 06:15:24 pw lock + authorized_keys + /sbin/nologin + hash the username temporarily 06:17:01 In a past time we used to add a '!' to the front of the username so that when listing files we would know if the file was owned by someone who is now persona non grata or not. Something easily reversed. 06:17:21 i went into a train of thought where i was thinking it is easy to make changes like that, and forget about it, and the reasoning, sometimes i wish i could attach my shell session to a larger context/database that would know which commands i ran, then a rationale for why, even as a education tool 06:18:04 It's a good thought. In IRC-land we have a bot Litharge for keeping track of just such things related to bans and such. 06:20:30 Since I mentioned above that in GNU/Linux one uses "usermod -e 1 rwp" to cause an account to be expired I will mention that "usermod -e '' rwp" unexpires it enabling it again. It removes the datestamp from the /etc/shadow file on those systems. 06:23:40 MelanieUrsidino ^^ this conversation 06:26:16 OT: In the US never call the police for a health and welfare check. Statistically this often results in a police shooting homicide. Get help from social services instead. 06:27:44 Her dad says she is alive and in police custody. 06:31:48 MelanieUrsidino, Just to verify you see it "pw lock rwp" is enough to disable accounts on FreeBSD systems. On GNU/Linux use "usermod -e 1 rwp" and rename the authorized_keys file. 06:32:16 aight. 06:32:39 Oh, I forgot I had written a blog on this for *GNU/Linux* anyway: https://www.proulx.com/~bob/doc/howto-disable-accounts/howto-disable-accounts.html 06:33:40 I don't think I would sleep if I even tried to. 06:33:48 It doesn't hurt to take a layered approach though, and also change the shell, disable ~/.authorized_keys, and whatever else, the only downside is that it is a hassle to undo. 06:33:49 But boy howdy do need to. 06:34:20 on 14.4-RELEASE-p5, with 'net.link.epair.ether_gen_addr=1' in /etc/sysctl.conf, upon reboot, `sysctl net.link.epair.ether_gen_addr` returns "net.link.epair.ether_gen_addr: 0". This looks like a bug, can someone else confirm? 06:34:23 Sleep would be nice but caffeine is my vice. 06:36:09 moviuro, On 14.4-RELEASE-p5 "sysctl: unknown oid 'net.link.epair.ether_gen_addr'" 06:37:32 rwp: did you reboot after your second `freebsd-update install`? I have another 14.4 machine where that oid is not yet known 06:38:00 but here, it does work (and the machine was rebooted a few times already since the 14.4 upgrade) 06:38:05 Reading the man page... I need to load that driver first. Needs if_epair_load="YES" 06:38:11 in loader.conf file. 06:41:34 moviuro, I enabled the driver putting that in loader.conf and rebooted and doing only that then sysctl net.link.epair.ether_gen_addr returns 1 without needing to set it explicitly. 06:42:10 how does that even make sense? The default behavior was supposed to only have been changed in 15.0 06:42:52 Oh, sorry. This particular system I tested on is 15.0 system. Do I have a 14 system that I can use to test... Hmm... 06:45:52 if_epair_load="YES" in /boot/loader.conf seems to have done the trick, net.link.epair.ether_gen_addr: 1 now upon system reboot 06:46:00 thanks rwp 06:46:05 Found one. Edited loader.conf. Rebooting it. Waiting for it to boot back up again. 06:48:02 In 14.4-RELEASE it booted with net.link.epair.ether_gen_addr:0 but then can set it to 1. 06:48:24 So... You good? Or do you still want me to try /etc/sysctl.d/ for it? 06:49:21 yup, I knew the sysctl.conf(5) change was needed but it didn't make sense that the "1" value was not applied... now it is and I'm happy 06:49:31 Woot! 06:54:38 Has anyone messed with imitating user services? I have a couple things I want to automate like services under my user (i.e. Syncthing, WebDAV server, mpd server). Some of these might be run under multiple users separately, so I can't just configure syncthing_user in rc.conf for example. Current idea is to use either crontab or a custom rc service to start a runit `runsvdir` daemon under my user. But I'm curious what you guys think or have tried for user 06:54:39 services 10:07:54 I really like etcupdate, compared to mergemster 13:47:40 It seems slower 14:30:30 bbaovanc each user would need to run a syncthing, configured on a different port 14:30:49 bbaovanc: what exactly are you "imitating" ? 14:30:57 either you run the service or you do not 14:38:58 rtprio: I guess per user services like launchd, openrc or systemd has, which also ask the question of "for which user gets that service run", resulting in something possible being run multiple times for diffrent users 14:50:30 yeah, thank god we don't have that 14:59:32 well, you can fake it in part via @reboot in your crontab, but that would be missing the service manager part, so maybe run runit via @reboot for your user and get the service manager that way 16:00:55 Anyone else having drm kernel panics? two in one day. 16:02:34 Seems like might be zfs and drm is taking the fall. 16:25:27 does make DESTDIR work with /usr/ports? 16:26:57 polarian: you want LOCALBASE, not DESTDIR. but that affects *all* ports, you can't install one specific port in another place 16:27:17 (well, you could, but... ports is not meant to work like that, it will almost certainly break) 16:27:17 hmmmm 16:27:27 I just need to bootstrap a jail 16:27:33 and I dont want to use pkg for it :3 16:28:11 im finally getting around to setting up a build server 16:28:17 this will make contributing to ports 100x easier 16:28:52 so much to get done though :/ 16:29:36 alright better idea, mount the src tree with nullfs and then make install the port to bootstrap the jail 16:30:21 why not just run 'make pkg' and then install the package in the jail. you can't "not use pkg" with ports anyway 16:30:26 s/make pkg/make package 16:30:45 wait doesnt work 16:30:51 duh, jails dont have pkg-static 16:31:12 ivy: because there is a dependency tree 16:31:24 and copying each dependency over one by one will be annoying 16:31:50 unless there is a envvar I can use to drop the .pkg into? 16:31:55 if there is, then sure that will work! 16:33:21 ah RTFM!!! 16:34:24 PKGREPOSITORY 16:39:59 make package wont build the dependencies ugh 16:40:11 fuck it fine, I will just use pkg ugh 16:40:21 no poudriere is literally possible 16:46:07 speaking of poudriere has anyone, in last 2 days, tried to build python311 package and receive a checksum issue.. so it will not build? 17:01:51 in my mind, my freebsd laptop is a bit slow cold booting, is there anything that one often does to speed it up 17:02:16 i never turn mine off 17:02:16 just thought id ask the pros 17:02:44 rtprio, tbh i dont often shut down either, im prolly just caught up in the freshness of it alll 17:04:39 ah gotta afk 18:15:53 do any of you guys use virtual-machine-manager? i get 1 pw prompt to connect to the remote machine, and then 6 more when accessing the vm. im not sure why/what i can do about it. if anyone has a hint thanks 18:16:19 from a debian pc i dont get any prompts at all 18:16:59 I haven't used it on a FreeBSD host. 18:17:22 the remote host is debian 18:19:15 So you're accessing a Debian VM host from a FreeBSD machine using virt-manager? 18:20:11 yes 18:21:22 i also added the libvirtd service etc but it didnt have any effect. 18:22:28 I think that is required for a VM host, but I'm not sure about what is effectively a remote terminal 18:22:56 elivoncoder: I can't help with libvirt or virt-manager, but have you considered trying vm-bhyve instead? 18:23:15 ek, I think the virtualization host is a Linux machine. 18:23:35 It sounds like he is using virt-manager to access a remote Linux virtualization host 18:23:44 yes thats right. i would be using bhyve when i get going with some local vms though 18:23:54 Ah, gotcha'. 18:24:33 Without having a similar setup in front of me, I'm not really sure how to troubleshoot that specifically. Would something like VNC be a viable alternative though? 18:24:45 Or SSH if it's not graphical 18:26:40 oh yes ssh works. 18:26:53 is it ssh asking for your password? 18:27:24 yes its the remote ssh login its asking me for user@remote pw 18:28:26 then getting ssh keys working properly would save you from that 18:28:29 most likely 18:28:38 oh good idea 18:29:04 You could also use keys if you'd like 18:29:24 im switching to freebsd full time and mostly just trying to get things working the same as they did in debian 18:29:29 yes keys are a great idea 18:29:31 thanks 18:29:37 No problem 18:29:37 ssh keys is not unique to debian 18:30:08 should be use keys stead of pw anyways 18:30:13 Also if you are wanting to harden the environment, I would encourage running ssh-audit as well. 18:30:20 on clients and servers 18:30:39 right on thanks for that too 18:30:44 ssh-audit 18:37:40 I use virt-manager on FreeBSD to manage remote libvirt. Works great. 18:38:20 You should definitely be using the local ssh-agent to be handling your ssh keys. 18:38:58 Run "ssh-add -l" and if don't see your keys loaded then start at the problem there and get that working first. 20:00:29 rtprio: I fell asleep earlier; how come you say "thank god we don't have that" (about user services)? 20:14:10 possible sour grapes 20:45:15 bbaovanc: thank god we don't have systemd on freebsd? does that really need an explination? 20:45:25 they're users, they can manage their own services 20:47:15 Oh, I thought you meant user services in general not systemd 20:57:23 i don't see the point, alas 20:59:54 manage their own services-- meaning like putting daemon(8) commands in crontab and manually killing/spawning daemons when you need to mess with them? 20:59:55 I as well am happy not to have systemd on FreeBSD. I must work with systemd elsewhere and know it fairly well. It's not a good thing. 21:01:13 I am not understanding the problem. Is managing a user service a problem? If I need something running then I start it. If I don't want it running then I stop it. Is that a problem needing a solution? 21:02:47 as a user of a multiuser system, assuming i am permitted to run services in the background, yeah, it is up to me. i don't expect the server operator to start syncthing or my irc bouncer for me 21:02:54 that's silly 21:03:10 i theoretically start `s6-svscan` for my users if they ask me to 21:05:03 Yes something like s6-svscan was like what I meant, the operator running a service manager for the user and then the user can do whatever under it 21:05:30 It's a server so that's why I want some sort of automation instead of manually starting the services 21:05:58 Anyone can create a Rube Goldberg machine of many parts. That does not mean it is needed to be so complicated. 21:07:11 i'm currently the only user at my site for whom I start s6-svscan but I don't expect that to last 21:08:22 rwp: exactly, tiny shell script which starts tmux and starts a few programs within works great 21:10:19 It just feels crude to me 21:12:16 well, just run your s6-svcscan for each user then. it's like 2 lines of shell 21:12:35 I use tmux, starting it at boot time for me, and start programs in it, because I want those interactive programs running for me interactively. tmux+emacs+irssi is a good combination! 21:22:39 tmux is an interesting idea 21:27:14 rwp, thanks ill check it out