summaryrefslogtreecommitdiff
path: root/etc
AgeCommit message (Collapse)Author
2023-07-05Fix sysctl invocation testing for missing entropy.martin
2023-07-02Fix typo in comment.nia
2023-06-30rc.conf(5): Set entropy=wait by default.riastradh
We no longer block indefinitely -- if nothing else, the hardclock timer should yield enough samples to unblock /dev/random on all but the most severely deterministic machines -- so it should be generally safe for availability to set entropy=wait. This doesn't guarantee that HWRNG/seed has been provided before you run ssh-keygen or call getentropy(3) in a user application, but it does raise the security above netbsd<=9. PR security/55659 PR lib/56905 XXX pullup-10
2023-06-30security(5): Check kern.entropy.needed for confident entropy.riastradh
Don't test whether a non-blocking read from /dev/random would return data. For the sake of availability, /dev/random will unblock based on sources like timer interrupts, which we can't confidently assert anything about the actual unpredictability of. Here, the goal is to highlight systems that have neither obtained entropy from an HWRNG with a confident entropy assessment, nor been seeded from a source the operator knows about. XXX pullup-10
2023-06-20pam: Disable pam_krb5, pam_ksu by default.riastradh
These are not useful unless you also set up /etc/krb5.conf and a keytab for the host from the Kerberos KDC. But having them enabled by default means that creating /etc/krb5.conf just to enable use of Kerberos for _client-side_ single sign-on creates usability issues. As proposed on tech-security: https://mail-index.netbsd.org/tech-security/2023/06/16/msg001160.html
2023-06-11more NBUILDJOBS deprecationlukem
The NBUILDJOBS option was deprecated in 2002; there's no need to keep warning about it, remove from params / show-params, and only document as obsolete.
2023-06-10Add some backwards compat. Adjust grammar.kim
2023-06-05/etc/rc.d/sshd: Use default curve for ECDSA keygen, not NIST P-521.riastradh
The default is NIST P-256, which: (a) has plenty of cryptanalytic security, (b) performs better on essentially all platforms (smaller enough that even the advantage of the Mersenne prime structure of P-521 can't compete), and (c) likely gets more scrutiny on implementations than P-521 since it's more widespread.
2023-06-05/etc/rc.d/sshd: Stop generating DSA host keys by default.riastradh
If you want them you can generate them yourself, but in this day and age (Monday and 2023, specifically) there's no reason to be using DSA except for compatibility with ancient legacy software.
2023-06-02etc.sparc64: remove obsolete MK32BITLIBSlukem
As there's a functional MKCOMPAT implementation, and MK32BITLIBS=yes hasn't worked since 2002 (and noone noticed the latter), remove obsolete MK32BITLIBS code. Per confirmation from martin@, mrg@, and riastradh@ on ICB.
2023-06-02etc.sparc64: fix syntax errors in MK32BITLIBS=yeslukem
sparc64 snapshots with MK32BITLIBS=yes has been broken because of make(1) and sh(1) syntax errors since my change in revision 1.18 on 2002-12-03, when snap_md_pre target was deprecated... Move the rules to snap_md_post and fix the syntax errors. The cross-build make snapshot snapbecause of the missing $TOOLDIR/bin/sparc--netbsdelf-gcc due to the invocation with SPARC32_ENV=MACHINE=sparc MACHINE_ARCH=sparc. A separate issue to resolve. (It seems MK32BITLIBS hasn't worked for 20+ years and noone noticed! Do we need it?)
2023-06-02etc.hp300, etc.sparc64: fix MKUPDATE handlinglukem
UPDATE was replaced with MKUPDATE 20 years ago, but these directories were missed in the conversion.
2023-05-26Revert "openssl: Nix build goo for dynamically loaded engines."riastradh
Turns out there is a regression lurking here: the devcrypto engine was made dynamic-only (https://github.com/openssl/openssl/pull/7859), so to maintain that functionality, we need to build dynamic engines. Will fix the aarch64 build issue and wire things up separately.
2023-05-26openssl: Nix build goo for dynamically loaded engines.riastradh
- Engines are deprecated in openssl 3. - We never actually had the .so engines wired up to be built in openssl 1.1, and judging by the lack of obsolete entries in the set lists, I don't think we ever had them wired up to be built at all.
2023-05-26/etc/rc.d/sshd: New check cmd and reload precmd.riastradh
- check cmd: run `sshd -t' to check sshd_config file - reload precmd: run check cmd before reloading so we don't nuke sshd if there's an error in the sshd_config file (It is still possible to effectively nuke sshd by changing the configuration tosomething that won't work on your network, but at least we avoid making sshd just exit on reload when you make a typo in a config option.) XXX pullup-9 XXX pullup-10
2023-05-21iscsictl uses authentication types (n)one, (c)hap and mutual (C)hap.mlelstv
2023-05-19Creating Type&Creator mappings for .bin (macbinary encoded) files,hauke
mkisofs changes files, then turns around and complains they have been changed. This is a self-inflicted wound, so demote the error to a warning. Reported upstream as <https://codeberg.org/schilytools/schilytools/issues/58>. Arguably fixes PR toolchain/42166 Request pull-ups to netbsd-{8,9,10}. XXX What about macppc?
2023-05-16Add the engines directory too (hannken)christos
Note that we don't install engines now, but we could.
2023-05-16OpenSSL entries are handled by NetBSD.dist.compatchristos
2023-05-15add more OpenSSL-3.xchristos
2023-05-15Add openssl fileschristos
2023-05-15add openssl fileschristos
2023-05-14undo previouschristos
2023-05-14try to fix the build.christos
2023-05-14openssl compat: Try this again!riastradh
compatdir appears to be for things like /usr/lib that have /usr/lib/eabi as a subdirectory, so for /usr/lib/openssl it would mean we have /usr/lib/openssl/eabi as a subdirectory. But that's not what we have; we have /usr/lib/eabi/openssl. Let's try using NetBSD.dist.compat.in instead, which appears to be intended for this purpose, from what I can gather.
2023-05-14mark /usr/lib/openssl and /usr/lib/openssl/modules as "compatdir".mrg
remove them as explicit part of all arm64 builds when they're only (currently) used and consumed by llvm builds. this fixes gcc builds and i don't think it breaks llvm ones though i'm still waiting for that test.
2023-05-13aarch64: New directories for compat openssl on aarch64.riastradh
Hope I got the setlist tags right, not really sure how this works.
2023-05-11switch sparc64/aarch64 to OpenSSL-3.xchristos
2023-05-11Add missing path for MKCOMPAT=no from Adamchristos
2023-05-10new openssl directorieschristos
2023-05-07RISC-V support that works on QEMU with a single hart.skrll
Thanks for Simon Burge for plic(4).
2023-04-16Resolve conflicts for lua 5.4.4 import.nikita
Adjust various files for lua 5.4.4.
2023-02-18Handle missing auth file.mlelstv
Skip empty lines.
2023-02-11Build a RAMDISK root kernel on NetBSD/next68k release build.tsutsui
No sysinst(8) yet, but useful on bootstrap and rescue ops.
2023-02-06If /etc/iscsi/volumes does not exist, explicitly exit with 0 statusmartin
2023-02-05With MKISCSI we need all files.mlelstv
2023-02-05Fix build without MKISCSImlelstv
2023-02-03Add missing template file for iscsid_volumes.mlelstv
2023-02-03missed commit for iscsid_volumesmlelstv
2023-02-03Add start script to attach iscsi volumes at boot.mlelstv
The default is to execute the script (iscsid_volumes=YES), so if you have any volumes defined, you should also start iscsid (iscsid=YES) to avoid error messages.
2023-01-15tests/lint: add basic tests for lint (not lint1 or lint2)rillig
2023-01-15Remove obsolete bpf entries not neceerary for clonified bpf(4).tsutsui
Fixes "MAKEDEV: bpf8: unknown device" errors.
2022-12-28fix hexprint functionjakllsch
2022-12-25As with normal users, include /usr/games in the default PATH of rootnia
2022-12-11Don't forget pci17kre
2022-12-01reinstate $NetBSD$jschauma
Noted by msaitoh@
2022-11-28regen from IANA as of 2022-09-28jschauma
This time using the updated tools from the net/iana-etc package, ensuring we don't revert previous changes and pass the tests from tests/lib/libc/net/.
2022-11-28revert previousjschauma
Automated test reports failure, reverting until I know why the test failed.
2022-11-28regen from IANA 2022-11-22jschauma
2022-11-28regen from IANA 2022-09-28jschauma