Messages

I see, thank you!

The second instance of the CPU identification lines starting with "CPU: Intel(R) Celeron(R) J6412 @ 2.00GHz (1996.80-MHz K8-class CPU)" shows that the plugin ran. If there is an update for your CPU model, it was applied.

Patrick, can you please explain, in what way the referenced line indicates the run of the plugin? - I see a similar line in my dmesg output, but the plugin is not installed.

Code Select Expand

---<<BOOT>>---
Copyright (c) 1992-2025 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
    The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 15.1-RELEASE-p1 stable/26.7-n283674-12334a596709 SMP amd64
FreeBSD clang version 19.1.7 (https://github.com/llvm/llvm-project.git llvmorg-19.1.7-0-gcd708029e0b2)
[1] VT(vga): resolution 640x480
[1] CPU: Intel(R) Atom(TM) CPU C3558 @ 2.20GHz (2200.21-MHz K8-class CPU)
[1]  Origin="GenuineIntel"  Id=0x506f1  Family=0x6  Model=0x5f  Stepping=1
[1]  Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE>
[1]  Features2=0x4ff8ebbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,RDRAND>
[1]  AMD Features=0x2c100800<SYSCALL,NX,Page1GB,RDTSCP,LM>
[1]  AMD Features2=0x101<LAHF,Prefetch>
[1]  Structured Extended Features=0x2294e283<FSGSBASE,TSCADJ,SMEP,ERMS,NFPUSG,MPX,PQE,RDSEED,SMAP,CLFLUSHOPT,PROCTRACE,SHA>
[1]  Structured Extended Features3=0xac000400<MD_CLEAR,IBPB,STIBP,ARCH_CAP,SSBD>
...

Thanks a lot!

Searched for that as well. The only hint I found [1] is the following:

"Layer 2 visibility covers physical connections: switch ports, VLANs, MAC addresses, and access point associations. Layer 3 visibility covers logical connections: IP addresses, routing paths, subnets, and gateway relationships. A tool that only provides Layer 3 maps cannot tell you which physical switch port a specific device is connected to. A tool that only provides Layer 2 maps cannot help you trace a routing problem."

[1]  https://blog.domotz.com/all/network-visualization-tools/  -  (search page for "Layer 3 Visibility")

Ich denke, Du hast Recht!!!!!

Du kannst der Opnsense eine weitere IP-Adresse geben, und diese für DNS-Anfragen verwenden. ;)

In Unbound (Port 53530) wurde eine Weiterleitung definiert für Telematik auf die Adresse des HSK Konnektors (nicht TunnelIP!!).

Bin nicht sicher ob das dein Problem ist, aber der Konnektor beantwortet grundsätzlich keine (DNS-) Anfragen seines Standard-Gateways.

Hi franco,

thank you for your explanation and I understand the reason for that decision.

One of the problems with disabled integrated authentication is that it downgrades password strength through SSH and for the console.  Console is less risk because you need "physical" access, but the game changes in SSH password authentication which should be avoided.

SSH is limited to ssh-keys, password login is not permitted.

For physical systems in server racks I enable auto console log in so I don't have to deal with this at all. The rack or the server room should provide enough protection.  ;)

My boxes are physical systems but located at customers place, so auto login is obviously no option.

Enforce 2FA for all administrators except root, which keeps password authentication, set an e.g. 40 character password and keep it somewhere safe for emergency access. Like failing time synchronisation.

That would be a nice solution (and root does not need direct remote access gui/ssh).

Additional use case:

Loading a customers configuration in a box without internet connection (no ntp server reachable).

Kind regards,
proctor

Hi,

what is the idea behind removing this feature?

I used the feature to force Web-GUI login via 2fa, SSH via keys, but allow console login and su for root without 2fa (sudo disabled). So root can't login (directly) at Web-GUI or SSH (no 2fa and no key). After update to 25.x i am not able to "su root".

Thanks for some explanation and ideas to get a similar setup again

Hallo derbert,

bin auch über das Problem - und dabei über deinen Beitrag - gestolpert. Zumindest in meinem Fall konnte ich feststellen, warum die automatischen Regeln allein nicht reichen. Diese umfassen nur ausgewählte ICMPv6-Typen. In meinem Fall war zusätzlich eine Regel notwendig, welche ICMPv6 Typ 130 (Multicast listener query) mit Ziel ff02::1 beinhaltet. Wozu das Paket benötigt wird, würde mich auch interessieren (DS-Lite?)...

Beste Grüße

Auja! Wir verlinken hier die schönsten Kommentare vom Heise-Forum! Dafür sollten wir ein eigens Board einrichten! :-D

Heise-Forum?

https://www.heise.de/news/APNIC-Chefwissenschaftler-IPv6-Einfuehrung-wohl-obsolet-9995140.html

https://www.heise.de/meinung/Kommentar-IPv6-obsolet-Ich-glaub-ich-steh-im-Wald-9999396.html

Thanks Patrick, my fault.
I was searching for (permanently) changes to the ssh keys to generate when i stumbled upon this question, so i had a "key-bias" in mind...

Hi Scenic3050,

you can configure all you need with the webgui.

Keys:
System \ Access \ Users \ [ Username ] \ Authorized keys

No password:
System \ Settings \ Administration \ Secure Shell \ Authentication Method

Nevertheless, "sshd_config" is located at "/usr/local/etc/ssh/"

Cheers

OPNsense 23.7.12_5

When I use the search field in "Firewall : Log Files : Plain View" it seems I only get events displayed if they fill up a hole page (at least 20).

To reproduce I choose a known target - e. g. "142.250.185.195" (www.google.de) - to search for and get a lot of events.

Code Select Expand


2024-05-30T15:21:05 Informational filterlog 76,,,fae559338f65e11c53669fc3642c93c2,igb1,match,pass,out,4,0x0,,64,49516,0,none,1,icmp,80,192.168.3.2,142.250.185.195,datalength=60
2024-05-30T15:21:05 Informational filterlog 1,,,0,igb1,match,nat,out,4,0x0,,64,49516,0,none,1,icmp,80,192.168.3.2,142.250.185.195,datalength=60
2024-05-30T15:21:05 Informational filterlog 76,,,fae559338f65e11c53669fc3642c93c2,igb1,match,pass,out,4,0x0,,64,0,0,DF,6,tcp,60,192.168.3.2,142.250.185.195,60424,443,0,S,1344628171,,65228,,mss;nop;wscale;sackOK;TS
...


After the resuts are displayed, I extend the seach string about the displayed source port number digit by digit "142.250.185.195,6"

Code Select Expand


2024-05-30T15:21:05 Informational filterlog 76,,,fae559338f65e11c53669fc3642c93c2,igb1,match,pass,out,4,0x0,,64,0,0,DF,6,tcp,60,192.168.3.2,142.250.185.195,60424,443,0,S,1344628171,,65228,,mss;nop;wscale;sackOK;TS
2024-05-30T14:23:18 Informational filterlog 76,,,fae559338f65e11c53669fc3642c93c2,igb1,match,pass,out,4,0x0,,64,0,0,DF,6,tcp,60,192.168.3.2,142.250.185.195,6304,443,0,S,820402105,,65228,,mss;nop;wscale;sackOK;TS
2024-05-29T17:17:46 Informational filterlog 1,,,0,igb1,match,nat,out,4,0x0,,64,0,0,DF,6,tcp,60,192.168.3.2,142.250.185.195,62739,443,0,S,3333951251,,65228,,mss;nop;wscale;sackOK;TS
...


And "142.250.185.195,60" - I know, there is at least one event, but I only get:

Code Select Expand


Loading...


I don't expect this as an intended behavior, how can I find single or seldom events?

Thanks for any hint!

I struggled with that yesterday and it turned out, that my VDSL provider doesn't use VLAN.
So be sure you really need it.

That solved the problem with console login and su for me.

Thanks a lot!