Tag Info

Hot answers tagged

37

We run exclusively OpenBSD routers/firewalls to serve FogBugz On Demand. Unless you're operating in a transit role and need the extremely high pps throughput that purpose-built hardware and integrated software can provide, OpenBSD on solid hardware will be a more manageable, scalable, and economical solution. Comparing OpenBSD to IOS or JUNOS (in my ...


13

Preface Authenticating against Active Directory with Kerberos is pretty simple on systems using PAM, but OpenBSD doesn't and makes it more difficult. From a tcpdump, it looks like the PAM systems are just doing pre-authentication while OpenBSD's bsd_auth system is using the whole Kerberos authentication process. Anyway, this took me a while to figure out ...


10

OpenVPN doesn't support any kind of state sharing between two different daemon instances, so no, you can't have seamless failover. But, you can always configure your clients to handle a server failure gracefully. If this kind of redundancy meets your needs, you can achieve it by combining two features that OpenVPN does actually have: 1) automatically ...


8

pfsense Is a great FreeBSD based firewall, its very feature rich, easy to setup, and has an active community as well as support options. There are several people using it in commercial / production situations that are active in the forum. I use it at home and I'm pushing it at work, its a really well put together alternative. They even have a VM image for ...


8

I've read carp+pfsync is a good solution. Is that currently what most of you are using? Yes and yes :) As Instye notes, there are two public projects for CARP under Linux. But as you'll notice neither of them are particularly active and don't believe they include pfsync. Which is pretty important to the whole shebang. Additionally there have been some ...


7

for each interface: /etc/hostname.<if> e.g. if the interface is em0, the file is /etc/hostname.em0 If the IP address is obtained via DHCP, there is only dhcp in it, else the address, network mask and options Maunal page for this. Update: if you want to set you IP address, just create the files. The /etc you provided doesn't contain any configuration ...


7

Well vSphere 4.x only supports FreeBSD 6.x-8.x while vSphere 5.x also supports Mac OSX 10.6-10.7 - so one of those, anything else isn't supported.


6

The 1st thing I've spotted was that you are using "-s /tftpboot" in xinetd.conf and adding the dhcpd.conf "root-path" option. Setting the "-s" option for tftpd means that is the "/" directory as seen for tftp client. So your dhcpd.conf should only have "filname /pxeboot", without the root-path option. From "man tftpd": -s Change root directory on ...


6

Assuming you're running a recent release, when you get the disklabel setup simply type: D - this blanks the disklabels a b - Give the desired size of your swap partition a a - Assign the rest to / Folders and such are created automatically for you by the installer.


6

On OpenBSD you have: sysctl hw.ncpu or sysctl hw.ncpufound As explained in sysctl(3), ncpu is the number of CPU used by system and ncpufound is the number of CPU found by the system. By the way, devio.us provides free shell account on OpenBSD servers.


6

Make sure you check your installed ports for vulnerable packages every so often : portaudit -Fda


5

I think the best open source combinations are: For NIDS: Snort with BASE for the web ui For HIDS: OSSEC I also use OSSEC to consolidade the NIDS data into a single place (like a SIEM OSSEC does log analysis, file integrity checking and rootkit detection). Links: http://www.snort.org http://www.ossec.net http://base.secureideas.net/ ...


5

pfSense 2.0 has back ported Intel drivers from FreeBSD 9 so that will definitely work, and is generally the preferred release for new deployments anyway. m0n0wall snapshot versions should work too.


4

Just wanted to update on this in case anyone runs in to the same problem. Essentially it comes down to the state rules in Pf. By default Pf keeps state, and uses S/SA as a mask. However, it seems that the NFS server implementation on OS X attempts to start a conversation back to the client using a non-standard set of flags. This was causing it to fail ...


4

As your Question says that this is for a testing configuration, I'd say Go for it! Not dealing with the vagaries of which partitioning scheme is optimal, can really save you time and disk space (e.g. that 5G you partitioned for /etc is wasted space when you've only got 10G or less to play with.) OpenBSD works just fine with a single slice for working with, ...


4

OVERVIEW Bayesian filters and pattern matching and RBLs are all part of the fight against spam. This setup is intended to augment rather than replace those. Note that I'm NOT greylisting. Greylisting is great in theory but in practice it's extremely annoying to your users. Some people have great success with it. I'm not one of those people. What I've done ...


4

I'm not sure there's a specific "BSD way" to do this type of stuff. It all comes down to knowing what's being updated and testing -- generic sysadmin stuff. Fortunately, freebsd-update and portsnap make the "knowing what" fairly trivial. But, since you asked for specifics, back when I herded a large number of FreeBSD machines, they were all nodes in a ...


4

OpenBSD Update Philosophy This is my approach for updating OpenBSD Stay Up to Date on security releases/patches for: BASE (i.e. the stuff the OpenBSD dev team maintains in their source tree) Packages/Ports (i.e. software applications installed on top of BASE) Update Procedures: Same OS Version New OS Version BASE a. Follow the relevant mailing ...


4

Daytime and Time and what I would consider "legacy" protocols. My guess is they are included in the default configuration for traditional UNIX-style completeness. They are started by inetd, and unless you need these services (you probably don't if you have to ask) you can disable them by commenting out the relevant lines in your /etc/inetd.conf (see man ...


4

First, you should configure the LAN NIC to an address from the routed(!) /64; the ::1 is an ideal candidate. Then, fire up radvd on the LAN interface---it should not need any configuration. PF doesn't play any role in it, or rather, make sure that it doesn't get in the way.


4

There are a number of things you can do here. To see which hosts are responsible for the large number of state table entries you can do pfctl -vs state. To add more state table entries you can do what you suggested (set limit states to a bigger number), but if there is an underlying issue you probably don't want to do that. You can also consider adjusting ...


4

http://www.fwbuilder.org/ Firewall Builder supports a wide range of firewall platforms, including Cisco ASA & PIX, Linux iptables, BSD pf and many more. You’re not confined to one platform—or locked into a single vendor. See the intro: http://www.fwbuilder.org/4.0/docs/firewall_builder_intro.html


4

From practical experience I can tell you all of the Big 3 BSDs (FreeBSD, OpenBSD, NetBSD) will run in VMWare, but as Chopper3 said, only FreeBSD and Apple's OS X (Mach/BSD Hybrid) are officially supported by VMWare. If this is going to be a production system and support from the VMWare folks is important to you I would stick to a stripped-down version ...


4

To list all values, try pfctl -s all To list only the limits you requested, try pfctl -s memory To list only the timeouts you requested, try pfctl -s timeouts Out of the curiosity: Are you sure you need to adjust those values? Are you sure you can outsmart the default values, if merely listing the values is not familiar to you?


4

Bridges in Linux actually behave exactly like a physical switch. Hey, let's take a look at my physical switch now. Can't get much switchier than a Cisco switch, right? core-sw1#sh ip int brief Interface IP-Address OK? Method Status Protocol Vlan1 unassigned YES NVRAM up up ...


4

Give a try to http://openbsd.org/faq/faq4.html#site. This is the official recommendation for to customize the installation.


3

When you run the OpenBSD installer, simply delete the other slices at the disklabel step, leaving just a and b. The installer will still create the other directories; they just won't be as securely protected. (For example, normally OpenBSD sets things like nodev for /home; when on the same volume as /, which houses the /dev directory, this is no longer ...


3

The recommended specs for pfSense are way, way, way overkill. Your machine should handle that load quite handily. For a point of reference, I used a Soekris Net5501 in production for a little while and it fell over at about 45Mbps. It was spec'd out with a 500MHz Geode, 256MB RAM, and some of the worst NICs ever created (Via Rhinestone - vr driver). In my ...


3

Actually it's both, the server part is probably a flavour, see: http://openbsd.org/faq/faq15.html#PortsFlavors Unless you have good reason to compile from source you should check out packages, they're designed to be easy to use and maintain, especially when upgrading to newer versions (see pkg_add(1))


3

First server should work out OK, second: 1-8 GB is a bit "open" spec. I would suggest at least 2. If you can do anything about it, try to have as few users as possible use IMAP, although I imagine that using roundcube you'd have to use it. Generally, RAM isn't that expensive, so take 4 GB or 8. Most important for a mail system and database system is I/O. ...



Only top voted, non community-wiki answers of a minimum length are eligible