[00:31] Rada: I found a hung VM, suspected it was yours and rebooted it :) [01:13] *** visinin has quit IRC ("word") [01:32] *** bobbyw has joined #arpnetworks [06:48] up_the_irons: looks like more than just that one vm was affected, mine is down [07:06] *** sroute has quit IRC (Remote closed the connection) [07:07] *** sroute has joined #arpnetworks [08:13] *** bobbyw_ has joined #arpnetworks [08:13] *** bobbyw has quit IRC (Read error: 54 (Connection reset by peer)) [08:13] *** bobbyw_ is now known as bobbyw [08:16] *** bobbyw_ has joined #arpnetworks [08:16] *** bobbyw has quit IRC (Read error: 54 (Connection reset by peer)) [08:16] *** bobbyw_ is now known as bobbyw [08:58] *** heavysixer has joined #arpnetworks [09:41] openbsd 4.6 was just released!! [10:00] Yee-haw! [10:37] up_the_irons: you around? [11:18] OpenBSD is only at 4.6? [11:18] * sroute fires up python [11:18] 'FreeBSD 7.2 is %0.2f%% better than newly released OpenBSD ;-)' % ((7.2-4.6)/4.6*100) [11:18] 'FreeBSD 7.2 is 56.52% better than newly released OpenBSD ;-)' [11:18] * sroute 's toungue is firmly planted in cheek... [11:26] hehe [11:46] *** dj_goku has quit IRC ("leaving") [11:57] *** visinin has joined #arpnetworks [12:32] *** dj_goku has joined #arpnetworks [12:43] *** timburke has quit IRC ("Leaving") [12:51] *** timburke has joined #arpnetworks [13:05] *** dj_goku has quit IRC ("leaving") [14:38] *** bobbyw has quit IRC () [14:49] *** vtoms has left [15:42] *** ballen has joined #arpnetworks [15:57] *** ballen is now known as ballen|away [16:03] *** ballen|away is now known as ballen [16:31] *** visinin has quit IRC ("out out") [16:37] *** ballen has quit IRC () [17:05] *** ballen has joined #arpnetworks [17:08] sroute: you forgot to take into calculation your maths about freebsd and security issues vs openbsd .. 2 in 12 years, beat that! *grin* [17:24] any good movies just come out on dvd? [18:19] toddf: I get that, no argument. But a BSD OS is more than the core... one can't just look there. [18:19] http://www.openbsd.org/security.html - a great many more than 2 security issues listed over the years when one looks at the total OS. [18:20] * sroute likes all BSDs but decommissioned last OpenBSD a couple years ago [18:20] I just like managing one is all. [18:22] i think he means by default install or something [18:27] the record is about during a current release [18:27] aka if people updated as they should have [18:31] and also the 2 holes have to do with only remote root exploits [18:31] but still, if you compare remote exploits in the current release of openbsd through the years (2 total) vs any other os you still come up with quite a wide gap [18:45] Sure, but Apache 1.3.29 is pretty useless ... [18:46] whats wrong with apache 1.3? [18:47] although .29 is pretty dated [18:47] No worker MPM, inferior mod_proxy, ... [18:47] mofo's rock solid though [18:47] Sure, for serving static content. [18:47] mod_perl [18:48] Hah. [18:48] Okay. [18:48] ;-) [18:48] :) [18:48] Just saying. It's rock solid but not bleeding edge. [18:49] If you run the non bleeding edge stuff in FreeBSD, you'll be pretty safe as well. [18:49] heh, yea I think it would be about the farthest from bleeding edge you can get [18:49] and still be using a support app [18:49] There are also more people running FreeBSD in production, which exposes more vulns (The BIND effect, etc.) [18:49] supported* [18:49] Also, app performance on OpenBSD is horrid. [18:49] I think the lighttpd guys benchmarked it. Might have been someone else. [18:50] But it didn't scale at all. [18:50] But it's a great firewall! [18:50] (pf rocks.) [18:50] yea pf is on FreeBSD though [18:50] Yup. [18:50] I wish m0n0wall used pf. [18:50] even though I use ipfw [18:51] yea def a fan of FreeBSD over OpenBSD or NetBSD [18:52] and the few guys that I've met that work on or have worked on FreeBSD project are awesome [18:52] of course I've never met anyone that's worked on NetBSD or Open [18:52] so not much comparision [18:52] Yeha. There was a FreeBSD dev on the floor I was on while at Cisco but I never talked with him. [18:52] Not sure if Ron ever met him ... [18:52] no idea [18:53] he's never mentioned it to me [18:56] I met one at Google who was a core dev up until FreeBSD 4 or so [18:57] left the project because they added Periodic when they were already using Cron [19:25] *** Nat_RH has quit IRC (Remote closed the connection) [19:31] *** Nat_RH has joined #arpnetworks [19:41] I used to be a commerical unix guy (DG/UX); even though it was Sys V R4 I grew to like FreeBSD quickly. I like how it is managed... is why I never went the Linux route. [19:42] you should give OpenBSD a spin ... pkg_add -uri is hard to beat ;-) [19:42] when I left DG an 8 core box cost a few hundred thousand. Ah, the good ol' days. [19:43] heh [19:43] toddf, FreeBSD has pkg_add -r [19:43] if you're so inclined [19:44] I'm sure I'd like OpenBSD but I do more app wrangling now and the broad availability of ports is often handy. Can't disregard app performance either. [19:44] yep FreeBSD ports is the shiznas [19:45] must admit I do prefer pf to ipfw [19:45] yea either or [19:45] pf is more advanced [19:45] nice that fbsd has it now; auto blocking brute force attackers is so simple in pf [19:46] sroute, or you just turn off password auth ;-) [19:46] ballen: I do, except for one account - a backdoor [19:46] did freebsd ports ever make packages then install from packages or does the Makefile in the ports tree still do manual mucking? [19:46] toddf it makes a pkg first [19:47] does a staged install [19:47] then installs from the pkg [19:47] ballen: I use my blocking config to block them to ALL services, not just ssh. [19:47] aahhh [19:47] thats new, they didn't used to do that, openbsd did that for years first .. ;-) [19:47] that makes more sense [19:47] make package or make pkg [19:47] so you could have one freebsd system build packages for a farm of servers? [19:47] will put a .pkg file in the port dir [19:47] you could [19:48] I even have a fake HyperVM listener running on some boxes and accounts - back when the HyperVM exploit was making the news in VPS hosting land, a few chinese dudes were trying to hack em... of course I don't run it here. [19:48] hah [19:48] why? [19:48] because I can; mostly was interested to see how active the bad dudes were over that one. [19:49] fair enough [19:49] not very it turned out. [19:49] I think I ended up blocking 4 IPs in the past few months. [19:49] vs hundreds aimed at ssh [19:49] yea ssh brute forcing is constant [19:49] silly morons [19:50] must be getting in somewhere [19:50] or just script kiddies [19:51] right now someone is trying to gain access to PlcmSpIp = some sort of ip phones I think [19:52] anyone know of a simple script that will poll snmp for a single item and update a graph with the data over time [19:52] specifically for the os x platform [19:53] last word on blocking- I notice less of this offending activity on my VM at arp -- believe Garry is doing some filtering up stream [19:53] yea he filters ssh brute forcing [19:54] or at least limits the connection rate [20:04] *** bobbyw has joined #arpnetworks [20:11] fuck man [20:11] wayport/starbucks/att internet fucking sucks [20:11] always nasty lag [20:11] hmm [20:11] ever try VPN'ing somewhere? [20:12] sroute, that's what my polycom has in it's phone log [20:12] huh ballen [20:12] i am vpn'd [20:12] ah [20:12] just wondering if they were shaping traffic [20:12] it's 400ms-600ms [20:12] and if a UDP vpn would get past it [20:12] i have to call every fucking time i'm here [20:12] i dont understand how they dont know there's a problem [20:12] and why then they always say "i spotted the probme" [20:12] its not that they don't know... its that they could give a flying fuck [20:12] well.. i know having 150 servers aint anything close to the nodes att has [20:12] but i can detect an issue on my server within a minute [20:13] i dont know how they let this go on so long [20:19] *** sentabi has quit IRC (pratchett.freenode.net irc.freenode.net) [20:19] *** sentabi has joined #arpnetworks [21:04] *** dj_goku has joined #arpnetworks [21:58] gawd damn Vim's master site is down [21:58] ports could def set the timeout on downloads to be a lot faster [21:58] also FYI: IGNORE_MASTER_SITE_VIM=YES in /etc/make.conf [21:59] and it will fetch it directly from freebsd.org [22:00] heh [22:01] yea the timeout issue is stupid [22:01] i wish while cvsuping, you could get a real0time working list [22:01] real-time [22:03] i wonder if there are precompiled ports packages for updated ports [22:04] ahh, if running -stable [22:11] that the hell is wrong with fetch... [22:11] /usr/bin/fetch -4ApRr -T 2 -S 2611 http://ftp.vim.org/pub/vim/patches/7.2/7.2.052 [22:12] why does that not timeout after 2 seconds [22:12] wish fetch showed progress too.. [22:12] can't tell if sometimes ports are working or slow downloads [22:12] the downloads that is [22:13] -T seconds Set timeout value to seconds. Overrides the environment [22:13] variables FTP_TIMEOUT for FTP transfers or HTTP_TIMEOUT for [22:13] HTTP transfers if set. [22:14] the vim port is such a pain in the nuts [22:14] freaking 150+ patchsets it needs to download [22:15] vim sucks [22:18] solution is: [22:18] add IGNORE_MASTER_SITE_VIM=YES [22:18] and set FETCH_ARGS="-4ApRr" [22:19] forcing fetch to use IPv4 and freebsd.org [22:19] for whatever reason it fails randomly when using ipv6 [22:19] SOLID [22:19] and we're up to patch set 239 [22:19] not hard to release a gawd damn new version [22:25] up_the_irons: how do upgrades work? can I reinstall myself? [22:27] dj_goku, there are ways you could but he'd probably hvae to start your vps with the cdrom mounted and you'd have to connect via console [22:28] I don't need a cdrom I can do it all remotely through ssh actually. [22:28] freebsd-update ? [22:28] I just want to keep it as standard so if I need help up_the_irons can help me. [22:29] ballen: I use openbsd. [22:29] awwww [22:29] download the tar balls and extract them? [22:30] yaifo [22:30] is a kernel + sshd [22:30] is there anything special he had todo the obsd kernel to get it to run in KVM? [22:31] no idea. [22:31] probably not. [22:31] I recompiled other than 1 blip, I didn't change anything. [22:32] yea [22:32] ballen: all I can think of is the user that is created. [22:33] http://scie.nti.st/2009/10/4/running-openbsd-4-5-in-kvm-on-ubuntu-linux-9-04 [22:33] yup [22:33] k [22:33] I haven't ever upgraded openbsd so I don't know how to do that. [22:33] well [22:33] If I did I would probably do that. [22:34] what I used todo [22:34] was litterally go download the new .tgz files [22:34] from the mirror [22:35] and extract them [22:35] on what distro? [22:35] over the system [22:35] openbsd [22:35] thats all the installer does [22:35] right. [22:35] you may want to back up /etc though [22:35] as its a rather blunt way of upgrading [22:36] http://www.openbsd.org/faq/upgrade36.html [22:36] if there were a way to say download click this and be ugpraded I would love that :) [22:37] http://www.openbsd.org/faq/upgrade46.html [22:37] meh way over complicated these days [22:38] haha [22:38] Or I can backup /etc /home and reinstall :) [22:38] i liked my tar -xf base36.tgz [22:38] yea thats basically what you're doing, just in place [22:39] bring up a new vm, and migrate [22:39] 4 minutes to reinstall [22:39] I already moved my router over to openbsd 4.6 [22:39] mmk have fun [22:39] My router is a VM, :D [22:40] esxi FTW [22:40] yea I do love esxi [22:40] run the fucker on a 1gb sd card [22:41] use normal local disks for the storage pool [22:41] I have always wanted a via board, since it has the crypo chip on-board. [22:42] yea if you're going for low power [22:42] pretty slow chips though [22:42] who cares its a router [22:42] in that case checkout: http://www.liantec.com/product/lpc/LPC-5842.htm [22:42] a home router none the less [22:43] and if you happen to figure out how to get one of the boxes in the US let me know [22:44] I know you can import than directly from Taiwan [22:44] them* [22:44] but its rather expensive [22:44] ballen: I have a am2 system that I use as my esxi host, I don't plan on buying a mini-atx system. [22:45] ah [22:45] those boxes are quite good for throughput / watt consumption [22:47] *shrug* its currently running a total of 4vms, openbsd (router), openbsd (dev), win2k3, win2k8, xp [22:47] I just build vim from scratch from cvs/svn sources. [22:47] I just use emacs :) [22:47] * dj_goku runs [22:48] emacs hurts my hands ;) [22:48] get your emacs' loving crap outta here [22:48] vim hurts my head but I use it anyway LOL [22:48] yea should just use ee [22:48] actually... not. You know you are adicted when you do ESC:wq in a text box on a web page [22:48] yea I've done that [22:48] echo/cat works too. [22:49] lol [22:49] better yet :wq at the end of an IM [22:49] hehe [22:49] I still do that. [22:50] though it is nice that a lot of the emacs shortcuts are used in other apps. [22:51] I like that I can use emacs CTRL + A now that I am using tmux instead of screen. [22:52] ... like tmux too [22:53] anyone using opensmtpd in here? I don't think I will ever run my own mail server again since I use google. [22:58] *** bobbyw has quit IRC () [23:03] wrt openbsd 'bsd -c' or 'config -ef /bsd' and 'disable mpbios' is `the trick to get openbsd current/4.6 to run on kvm' [23:03] opensbsd starting with 4.5 and better with 4.6 has 'sysmerge' to merge /etc and such [23:04] toddf: so are you a fan of upgrade or clean installs? [23:04] I most definately am for upgrades [23:04] I can see the benefit, but it seems like a lot of work :) [23:04] clean installs tend to suggest something in the (massivly simplified) upgrade process is borked, aka the cheating way out [23:04] for me, if I'm doing a reinstall [23:05] I have to do lots of customization afterwards [23:05] while I do have siteXY.tgz and my own custom packages to help [23:05] it is so much easier to just upgrade it isn't funny [23:05] I use afs and kerberos and such so my experience may be different than most [23:05] fresh installs also tend to blow away any existing data [23:06] backing up /etc and re-installing then getting /etc back and merging it by hand is by far a more painful procedure than doing the upgrade of the base sets, then sysmerge the conf files and finally 'pkg_add -uri' ;-) [23:06] wow man [23:07] i've said it before, i have over a hundred servers easy [23:07] i've been updating ports on 3 all day. [23:07] this is killing me an dpissing me off [23:07] freebsd die ina fire [23:08] jeev: diaf is easier :) [23:08] i hate acronyms, except the old school ones [23:08] lol [23:15] *** ballen is now known as ballen|away [23:20] *** ballen|away is now known as ballen [23:52] *** sroute has quit IRC ("WeeChat 0.3.0") [23:55] *** sroute has joined #arpnetworks [23:55] *** sroute has quit IRC (Client Quit) [23:59] *** sroute has joined #arpnetworks