summaryrefslogtreecommitdiff
path: root/etc
AgeCommit message (Collapse)Author
2020-01-21regenMartin Pieuchot
2020-01-21Add /dev/dtMartin Pieuchot
2020-01-156.4 keys not needed anymoreTheo de Raadt
2020-01-15Do not redirect already quiet stdout for IPv6 reject routeskn
"route -q" already silences all standard output; if it still prints something, that's a bug to fix in route. OK bluhm
2019-12-30don't suppress error output from running updatelocatedbMarc Espie
check that the resulting db works instead of some more specific test okay schwarze@
2019-12-22regenMark Kettenis
2019-12-22Wire up ipmi(4).Mark Kettenis
ok deraadt@
2019-12-21a few depend:-related thingies that were still in.Marc Espie
okay millert@, tb@
2019-12-17syncReyk Floeter
2019-12-17Fix fido(4) documentation link (no functional change)Reyk Floeter
2019-12-17Add fido(4), a HID driver for FIDO/U2F security keysReyk Floeter
While FIDO/U2F keys were already supported by the generic uhid(4) driver, this driver adds the first step to tighten the security of FIDO/U2F access. Specifically, users don't need read/write access to all USB/HID devices anymore and the driver also improves integration with pledge(2) and unveil(2): It is pledge-friendly because it doesn't require any ioctls to discover the device and unveil-friendly because it uses a single /dev/fido/* directory for its device nodes. It also allows to support FIDO/U2F in firefox without further weakening the "sandbox" of the browser. Firefox does not have a proper privsep design and many operations, such as U2F access, are handled directly by the main process. This means that the browser's "fat" main process needs direct read/write access to all USB HID devices, at least on other operating systems. With fido(4) we can support security keys in Firefox under OpenBSD without such a compromise. With this change, libfido2 stops using the ioctl to query the device vendor/product and just assumes "OpenBSD" "fido(4)" instead. The ioctl is still supported but there was no benefit in obtaining the vendor product or name; it also allows to use libfido2 under pledge. With feedback from deraadt@ and many others OK kettenis@ djm@ and jmc@ for the manpage bits
2019-12-14Fix comment: vmctl command options come before argumentskn
2019-12-14syncTheo de Raadt
2019-12-14usb devices nodes have been excesively permissive.Theo de Raadt
repair that.
2019-12-13syncTheo de Raadt
2019-12-13gpr(4) goes awayTheo de Raadt
2019-12-04Insert missing &&job
OK claudio@
2019-12-04Attempt to smear out stampedes on the RPKI rsync serversjob
OK claudio@ benno@
2019-12-02sync namesTheo de Raadt
2019-12-01grow i386 cd ramdisk a little bitTheo de Raadt
2019-11-30Tweak rpki-client to create all 4 output file formats from a singleTheo de Raadt
compute, based upon flags. OpenBGPD compatible format by default if no options, to integrate with bgpd.conf and bgpctl reload. Adapt mtree and stuff. This will receive further refactoring... ok benno job
2019-11-29Uncomment a single line in root's crontab to run rpki-client and reloadTheo de Raadt
bpgd configuration, which enables Enterprise-Ready Industry-Leading-by-Example RPKI ROA filtering on your OpenBGP edge. Arguments remain about how often to run this operation, for now we propose 9AM when people who can fix their shit are in the office. ok claudio benno
2019-11-29Import /var/db/rpki-client/roa and filterTheo de Raadt
discussed at length with claudio and benno
2019-11-29add /var/cache/rpki-client, ok deraadt@Sebastian Benoit
2019-11-29create a var/db/rpki-client/roa file with correct ownership so thatTheo de Raadt
rpki-client(8) can deal with it (some upcoming changes...)
2019-11-29create var/db/rpki-client directory with correct modeTheo de Raadt
2019-11-27Nuke http captive portal detection; something better is coming.Florian Obser
OK otto
2019-11-26make implicit "listen on socket" explicit, the default config no longer hasGilles Chehade
any implicit behavior ok eric@, kn@
2019-11-25use explicit from notation in default configGilles Chehade
ok eric@
2019-11-22sndiod(8) reopens audio interfaces on SIGHUP, which makes a lot of senseClaudio Jeker
when -F is used. Because of this allow rc.d script to reload sndiod. OK kn ratchov aja
2019-11-15fix the spelling of rpki, as noted by jmc@Sebastian Benoit
2019-11-15grow an install mediaTheo de Raadt
2019-11-14uid/gid 70 is _rpki-client for privdrop; ok bennoTheo de Raadt
2019-11-11change the nmea sensor to "trusted"Theo de Raadt
2019-11-11move /usr and var remounting (nfs diskless case...) earlier, so thatTheo de Raadt
unwind can be started (silently) before pf is configured (for those few weirdos who use hostnames in pf.conf...). Other unidentified concerns may be improved by this startup re-ordering, so let's give it a try. discussed with florian.
2019-11-11update ntpd example configurationTheo de Raadt
2019-11-10use $(<file) instead of $(cat file) since this script uses ksh; ok ajacoutot@Christian Weisgerber
2019-11-07Reenable "val-log-level: 2", so that when sites have misconfiguredStuart Henderson
dnssec the sysadmin has some idea what's going on in logs, and "aggressive-nsec: yes", if we're using dnssec anyway we might as well get the benefits. These were both enabled last time dnssec was enabled in this sample unbound.conf. ok florian@
2019-11-07Enable DNSSEC validation in unbound by defaultjob
OK deraadt@ otto@
2019-11-06Perform contraint validation against 9.9.9.9 and 2620:fe::fe also (whichTheo de Raadt
avoids DNS lookups entirely, but yes this https is correctly validated) long discussions with otto, florian, and the quad9 crew.
2019-11-06we have emergency entropy injection code in rc, for if the bootblocks andTheo de Raadt
other methods failed to inject/churn the rng enough. Move it up far earlier. ok naddy sthen kettenis
2019-11-05Add a default priority of 5 for user _pbuild, this should help keeping systemsolene
responsive during packages compilation, especially on slower machines. feedback welcome from people building ports discussed with deraadt@
2019-10-25handle aggr(4) in the same way as trunk(4)David Gwynne
from brad@ ok bluhm@ claudio@ deraadt@
2019-10-22Import regenerated moduli file.Darren Tucker
2019-10-20regenMark Kettenis
2019-10-20Add /dev/pri.Mark Kettenis
2019-10-18Bump datasize-cur for pbuild on mips64, to make room for modernity.Visa Hankala
OK deraadt@
2019-10-12accidentally stated the MP kernel twice, leading the SHA256/SHA256.sigTheo de Raadt
file to contain two hashes for bsd.mp, and cause later upgrade problems spotted by afresh1
2019-10-07sync arm64 pbuild resource limits with amd64; arm64 now builds some largeStuart Henderson
things and can easily exceed the previous 1.5GB limit. (obviously, as with amd64, machines with less physical RAM won't cope with building the largest ports). ok deraadt phessler millert kettenis
2019-10-07update pkg nameTheo de Raadt
generated by cgit v1.2.3 (git 2.25.1) at 2024-11-24 03:15:32 +0000