[Undeadly.org] OpenBSD logs
-
⇒ Automatic expiry at timeout for pf(4) overload tables
Network-oriented readers will be familiar with the concept of overload tables, commonly used with state tracking options to create adaptive rulesets for such things as punishing password-guessing botnets.
A downside to tables that would tend to fill up indefinitely is that at some point they will be quite full, and the administrator would need to either manually run pfctl expire or set up a crontab entry to weed out old entries at intervals.
- https://undeadly.org/cgi?action=article;sid=20260513064948
- https://marc.info/?l=openbsd-tech&m=177846164902091&w=2
ping: https://framapiaf.org/@openbsdjournal@mastodon.social/116565993077076112
-
That’s an interesting idea, though I’m not sure if it’s relevant.
The question I’m asking myself is: why is it problematic to use the
expireoption, which is designed for this very purpose? because sysadmins forget to configure it, which causes the relevant tables to grow?!
I think this is more relevant:
The "feature request" wish I have is to be able to backup/restore tables
preserving the counters and timestamp for each entry.Currently I do a "pfctl -T show" and save to file on server shutdown.
Then I do a "pfctl -T add" from filename to reload table on boot.
Obviously this resets all the timestamps to the current boot time.
I know, don't reboot.seen on: - https://undeadly.org/cgi?action=article;sid=20260513064948
This seems me a good idea: save with good informations when rebooting is needed, as instance a "new" rebuilded kernel
-
(06/12)
⇒ syslogd(8) privileged and non-privileged parts now separate binaries
In OpenBSD, the syslogd(8) system logger has already for a while now fork(2)ed the privileged from the non-privileged parts.
-
06/29
⇒ relayd(8) and httpd(8) TLS settings update.
Both relayd(8) and httpd(8) now have the "secure" list of allowed crypto methods for HTTPS, which include TLSv1.3 and the TLSv1.2 AEAD cipher suites. The previous list was "HIGH:!aNULL" which contain non-perfect-forward-security methods and this change may cause old clients to not be able to connect.
-
26/07/08
⇒ OpenBSD's pledge(2) and unveil(2) are developer-friendly, study finds
Academic studies of OpenBSD's features and their practical impact on security are somewhat rare, but we were pleasantly surprised to see the recent paper A Measurement Study on the Adoption of Pledges and Unveils in the OpenBSD Operating System, by Jukka Ruohonen, Krzysztof Sierszecki, Abhishek Tiwari (all at University of Southern Denmark).
-
26/07/14
⇒ g2k26 Hackathon Report: Job Snijders (job@) on rpki-client(8) progress
Sometimes I like to think of OpenBSD development as a form of spiritual discipline. The project is a decades-long painstaking labor of love with hackers carefully rearranging source code by hand. In Dutch you'd call this monnikenwerk. So what better place could there be for a hackathon than an actual monastery?
-
26/08/04
⇒ Call for testing: OpenBSD vmm(4)/vmd(8) fd-ification
Thanks to the tireless work of among others Dave Voutila (dv@), development of the OpenBSD/amd64 virtualization system vmm(4)/vmd(8) continues to make progress. Now breaking changes, but with with potential benefits in both process isolation and compartmentalization of functionality, are on the way. It almost goes without saying that this code needs testing.
-
26/08/05
⇒ Dead Software Walking: The ongoing evolution of relayd(8) and httpd(8)
Returning readers of this site may have noticed that the pace of development in relayd(8) and httpd(8) has been picking up recently. Now Rafael Sadowski (rsadowski@) has a new blog post out titled Dead Software Walking: The ongoing evolution of relayd(8) and httpd(8) where he tells the story.
-
26/08/06
⇒ OpenBGPD 9.2 released
A sure sign that a new OpenBSD will soon be ready is that a new OpenBGPD release appears. On August 6th, 2026, the project released OpenBGPD version 9.2.
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login