• grab NetBSD-current sources
• cd src/share/man/man0
• make

P.S.: For those wondering how to get single pages formatted, here's a little excursion in *roff, the formatting language that Unix manual pages are written in. Take src/bin/ls/ls.1 as an example. To get a formatted page in ASCII output, use:

        nroff -man ls.1 

        groff -man -Tps ls.1 >ls.ps 

        groff -man -Thtml ls.1 >ls.html 

Maybe that's of interest for parties who want to help out in translating those parts of the NetBSD operating system. BTW, while here: at www@, we receive regular inquiries about help with translating NetBSD's website and the NetBSD Guide into other languages. Unfortunately doing one-shot translations is one thing, maintaining them is quite a different beast. Experiences from the past have shown that those translations are usually not maintained after an initial translation effort, and stay outdated. As a consequence, the NetBSD project has decided that we will not put efforts into maintaining translations in the future. People who want to translate parts of NetBSD's website or any of the guides (NetBSD Guide, pkgsrc guide) are welcome to do so when they are also hosting them at their site. Please talk to www@NetBSD.org for linking to those external translations then. Thanks!

[Tags: Docs, l10n]

Here's how to get an "ä" (assuming standard screen key bindings): ^A^V:a

^A^V will get you into "digraph" (character composing) mode, and :a will get you the resides character.

[Tags: Docs, screen]

See Jared's documentation on how to setup UPnP-IGD with NetBSD and IPfilter.

[Tags: Docs, igd, ipfilter, upnp]

The article starts easy with an overview of poossible approaches, but then goes quickly into details of the autoconfiguration system, kernel startup, bus operations, interrupts and drivers for the system clock and the serial chip. He concludes with his Observations and Comparison with Linux Porting Efforts: ``I've done a few Linux ports before, and the adaptation of NetBSD went at least as smoothly as any of the Linux efforts. In fact, I found NetBSD to have several advantages that made it substantially easier to port to a new platform than Linux, especially for a "newbie" like myself with no previous NetBSD porting experience.''

What else to say? (Nothing, right! :)

While at the topic of porting NetBSD and adding device drivers: One thing that needs doing in that process is choosing major/minor device numbers and sort them into tables for block/character devices. The article mentions an interesting webpage that's relevant here: The Auto-Generation Block/Character Device Switch Tables by config(8) by MAEKAWA Masahide. Yai!

[Tags: arm, Docs, embedded]

        Checking special files and directories.
        etc/named.conf:
                type (file, link) 

       ./etc/named.conf     type=link

(If someone wants to include Jochen's text into the NetBSD Internals Guide, that'd be great... just like any other work in that area. Any takers? Send your patches to netbsd-docs@, feel free to CC: me!)

[Tags: Docs, kernel, openbsd]

• Part 1: Embedded Linux cross-development
• Part 2: An introduction to eCos
• Part 3: Porting a screen-management utility to eCos
• Part 4: Interfacing with flash and avoiding file systems
• Part 5: Porting NetBSD to the TAMS 3011
• Part 6: Booting NetBSD on new hardware, the saga begins

If someone wants to give a similar presentation about pkgsrc somewhere, feel free to get in touch with me. E.g. for showing off pkgsrc at the OpenSolaris Developer Conference 2007 in Berlin.

[Tags: Docs, pkgsrc, presentations]

``Stateful packet filtering, Network Address Translation (NAT), port forwarding, passive operating system fingerprinting, packet queueing and Quality of Service, load balancing, and redundant firewalls are available with OpenBSD's PF system. PF is known to be a proven, high-performance, and innovative packet filtering system. The PF sub-systems and related interfaces have been ported to the NetBSD, FreeBSD and DragonFly operating systems. This book introduces the common features and capabilities of PF and its related tools with many examples and steps for configuring and using PF on these operating systems. The book includes ample cross-referencing and a detailed index for easy research and reading.''

Check out the book's website for more information.

[Tags: books, Docs]

Update: I should have done more research, apparently it's only one chapter that's online. As a reparation, here's really a full version of another book that you may consider worthwhile to have a look at: Ross Anderson: Security Engineering, found via Fefe's blog (well, actually Stefan pointed it at me before I could have my daily dose ;).

[Tags: books, Docs]

After reading the CGD chapter of the NetBSD Guide I had a rough idea on how to do the whole thing on a disk partition, but I wanted to keep everything in a file so I would not have to re-partition my laptop. Ignoring the Guide's warning that cgd(4) on vnd(4) doesn't work (and proving it wrong, for me :-), I've used vnd(4) happily since for the task.

Below, I'll outline the tasks for

1. setting up my "CryptoGraphicFile" (CGF) using cgd-in-vnd,
2. what to do to use the data
3. what to do to stash things away again

1) Setting up my CryptoGraphicFile (CGF)

1. Decide on a place for the actual data and the amount of data you want to protect. "du -sm ~/.ssh ~/.gnupg" tells me that 10MB is plenty, and I'll use these values here.

        # base=$HOME/S
        # size=10 

   Also, the (decrypted) data will be mounted on /secure.

2. The first step of creating a $size MB big file and making it accessible as vnd(4) device is pretty easy:

        # dd if=/dev/zero of=$base bs=1m count=$size
        10+0 records in
        10+0 records out
        10485760 bytes transferred in 0.479 secs (21890939 bytes/sec)
        # chmod go-rwx $base
        # vnconfig vnd0 $base
        #
        

3. Next we create a parameter file for cgd(4). We use AES encryption with 256 bit:

        # cgdconfig -g -V disklabel -o $base.cgd aes-cbc 256
        

   If this step fails with

        cgdconfig: could not calibrate pkcs5_pbkdf2
        cgdconfig: Failed to generate defaults for keygen 

   make sure that you have enough bits of entropy available for /dev/random. Just open up an xterm and run something like "ls -lR /" in it.

4. Next, the disk can be configured and newfs'd. This is the step where the password for the CGF is set, and you'd better not forget this:

        # cgdconfig -V re-enter cgd0 /dev/vnd0a $base.cgd
        /dev/vnd0a's passphrase:
        re-enter device's passphrase:
        # newfs /dev/cgd0a
        /dev/cgd0a: 10.0MB (20480 sectors) block size 4096, fragment size 512
   	     using 4 cylinder groups of 2.50MB, 640 blks, 1184 inodes.
        super-block backups (for fsck_ffs -b #) at:
   	 32,  5152, 10272, 15392,
        

5. Now the CGF can be mounted:

        # mount /dev/cgd0a /secure
        # df -h /secure
        Filesystem    Size      Used     Avail Capacity  Mounted on
        /dev/cgd0a    9.4M     512B      8.9M     0%    /secure
        # ls /secure
        #
        

6. Of course there's nothing on the newly created CGF. Let's undo things for the first-time configuration to finish our first step:

        # umount /secure
        # cgdconfig -u cgd0
        # vnconfig -u vnd0
        

   If you get a "Filesystem busy" in the first step, remember to "cd /". :)

2) Using the encrypted data

After we have created a secure filesystem inside a file in $HOME/S now, we can configure it for using with the following steps:

     # base=$HOME/S
     # vnconfig vnd0 $base
     # cgdconfig -V none cgd0 /dev/vnd0a $base.cgd
     # fsck -p /dev/cgd0a
     # mount /dev/cgd0a /secure
     # 
     

After these steps, /secure is accessible again, and will be so until you shutdown the system or unconfigure it as shown below.

Before repeating how to unconfigure the CGF, the disk should probably be populated with a few precious files. To still make the files accessible in a transparent way (when /secure is mounted!), symlinks can be used. E.g the following will put an especially precious SSH key onto this secure file:

     # mv ~feyrer/.ssh/important_key /secure
     # ln -s /secure/important_key ~feyrer/.ssh
     

Other examples I've used this with is are PGP keys, my private addres database, calendar and some other files I prefer to have near me when traveling.

3) What to do to stash things away again

To make things safe again, either shutdown the system, or run these steps:

     # umount /secure
     # cgdconfig -u cgd0
     # vnconfig -u vnd0
     

One such place where the above commands can be very handy is when suspending a laptop via APM: Place them into /etc/apm/suspend, and you won't have to worry about your files when your laptop is in suspended state. When you need your secured files again, a script with the commands noted under 2) can be run.

I'm using this setup on my laptop, and I'm quite happy with things that way. Maybe you will be, too!

Update: Curt Sampson wrote me about a nice way to lock the machine in case someon un-suspends it: simply run xlock *on suspend*. When X is started in a way that it won't get back to the shell upon ctrl-alt-backspace, this won't allow access to any file in case the machine gets stolen.

One other precaution that could be taken is to use encrypted swap, to prevent sensitive data getting into swap, and a mallicious hacker getting it from there after taking the disk out of the machine. A good hint, from someone (name forgotten) on #NetBSD.

[Tags: cgd, cgf, Docs, Security]

I love the one about why it's called /rescue!

[Tags: Docs]

See the guide's section on mail and news for what needs to be updated, and appendixes B. Contributing to the NetBSD guide and C. Getting started with XML/DocBook for docs on how to get started with hacking the NetBSD Guide. If you have something for review, I recommend posting to the netbsd-docs@ list, final patches should go to www@. TIA!

P.S.: General updates for the next major major release, NetBSD 4.0 (based on today's NetBSD-current) will be appreciated just as well!

[Tags: Docs, todo]

• Stoned Elipot: System Administration with pkgsrc
• Joerg Sonnenberger: pkgsrc on DragonFly -- or Fighting the Windmills
• Roland Illig: pkglint: Static Analyzer For Pkgsrc
• Roland Illig: Why Pkgsrc Sucks
• Emile 'iMil' Heitor: pkg_select -- So Many Packages, So Few Columns
• Thomas Klausner: Roundtable Discussion: Updating Packages
• Adrian Portelli: pkgsrc security one year on...
• Dieter Baron and Thomas Klausner: pkg_install Rewrite
• Johnny Lam: Roadmap for Development

The tutorial's focus is on FreeBSD, but there are many comments and examples that show NetBSD and OpenBSD to make this a worthwhile ressource for people new to the topic.

PDFs are available for the tutorial (mirror, original) and the presentation slides (mirror, original)

This was noticed by Julian Suschlik on netbsd-advocacy@, and Julian also points at a chance to add NetBSD-related papers to the onetbsd Wiki.

[Tags: Docs, kernel]

Looking at "normal" mount(8) output is pretty familiar, e.g. on my Sun SPARCstation 5 that has two local partitions and an NFS mount from another machine:

smaug# mount 
/dev/sd0a on / type ffs (local)
/dev/sd0e on /usr type ffs (local)
procfs on /proc type procfs (read-only, local)
kernfs on /kern type kernfs (read-only, local)
server.ipv6.fh-regensburg.de:/disk5 on /disk5 type nfs 

smaug# mount -v
/dev/sd0a on / type ffs (local, root file system, fsid: 0x700/0x78b, \
	reads: sync 475428 async 32, writes: sync 79953 async 7238)
/dev/sd0e on /usr type ffs (local, fsid: 0x704/0x78b, reads: sync \
	711144 async 65, writes: sync 2 async 24)
procfs on /proc type procfs (read-only, local, fsid: 0x1b01/0x1ae1b, \
	reads: sync 0 async 0, writes: sync 0 async 0)
kernfs on /kern type kernfs (read-only, local, fsid: 0x8b01/0x1d28b, \
	reads: sync 0 async 0, writes: sync 0 async 0)
server.ipv6.fh-regensburg.de:/disk5 on /disk5 type nfs (fsid: 0xb01/0x70b, \
	reads: sync 0 async 0, writes: sync 0 async 0) 

But there is more information, if you use "-v" twice (long lines continued with \ again):

smaug# mount -vv
mount_ffs: /dev/sd0a on /: specified device does not match mounted device
/dev/sd0a on / type ffs (local, root file system, fsid: 0x700/0x78b, reads: \
	sync 475441 async 32, writes: sync 79953 async 7240)
/dev/sd0e on /usr type ffs (local, fsid: 0x704/0x78b, reads: sync 711205 \
	async 65, writes: sync 2 async 24)
procfs on /proc type procfs (read-only, local, fsid: 0x1b01/0x1ae1b, reads: \
	sync 0 async 0, writes: sync 0 async 0, [procfs: version=1, \
	flags=0x0])
kernfs on /kern type kernfs (read-only, local, fsid: 0x8b01/0x1d28b, reads: \
	sync 0 async 0, writes: sync 0 async 0)
server.ipv6.fh-regensburg.de:/disk5 on /disk5 type nfs (fsid: 0xb01/0x70b, \
	reads: sync 0 async 0, writes: sync 0 async 0, [nfs: \
	addr=2001:638:a01:5:125:2aff:fe82:cade, port=2049, addrlen=28, \
	sotype=2, proto=0, fhsize=0, flags=0x8281, \
	wsize=8192, rsize=8192, readdirsize=8192, timeo=300, retrans=10, \
	maxgrouplist=16, readahead=2, leaseterm=30, deadthresh=9]) 

Enjoy!

[Tags: Docs, hubertf]

A paper (PDF) and the presentation slides are available.

[Tags: Articles, backup, Docs]

Given that the NSLU2 devices are available fairly cheap at around $80US, the sound like a sexy addition to the local network. Now adding a second network device, e.g. via USB, would make it a sexy alternative for a DSL router.

[Tags: Docs, embedded, nslu2]

Al has prepared and posted HOWTOs that help setting up things in a few easy steps. The HOWTOs are available directly in ASCII and PDF

[Tags: Docs, iscsi]

• DHCP-Server einrichten
• DSL konfigurieren
• Kernel erstellen
• iBook installieren (englisch)
• System updaten
• Transparenter squid
• Transparentes mutt
• veriexec
• NetBSD Tilde (~)
• pkgsrc-Pakete in einer chrooted sandbox kompilieren
• using the cryptographic filesystem on NetBSD (englisch)
• NetBSD und XEN 2.0
• NetBSD-stable mit Sets oder Quellen updaten

As a general overview on how to approach and deploy IPv6, Pietr Meyer has send me this nice link to an IPv6 Deployment Guide (PDF!) which specifically mentions NetBSD (and of course others!) when it comes to various details. Very much recommended!

[Tags: Docs, ipv6]