From owner-freebsd-current@FreeBSD.ORG  Sun Nov 16 00:26:42 2003
Return-Path: <owner-freebsd-current@FreeBSD.ORG>
Delivered-To: freebsd-current@freebsd.org
Received: from mx1.FreeBSD.org (mx1.freebsd.org [216.136.204.125])
	by hub.freebsd.org (Postfix) with ESMTP
	id 31CEB16A4CE; Sun, 16 Nov 2003 00:26:42 -0800 (PST)
Received: from cheer.mahoroba.org (flets19-018.kamome.or.jp [218.45.19.18])
	by mx1.FreeBSD.org (Postfix) with ESMTP
	id 0980E43F85; Sun, 16 Nov 2003 00:26:40 -0800 (PST)
	(envelope-from ume@mahoroba.org)
Received: from lyrics.mahoroba.org
	(IDENT:SlkvAKb3ly1GJ+jbLDPFH+khqE0FbKea3RFdkVMymcojmlhhc++yyp2xxiwYJzKR@lyrics.mahoroba.org
	[IPv6:3ffe:501:185b:8010:280:88ff:fe03:4841])
	(user=ume mech=CRAM-MD5 bits=0)hAG8OsEU008973
	(version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-SHA bits=256 verify=NO);
	Sun, 16 Nov 2003 17:24:54 +0900 (JST)
	(envelope-from ume@mahoroba.org)
Date: Sun, 16 Nov 2003 17:24:54 +0900
Message-ID: <ygeekw8pvop.wl%ume@mahoroba.org>
From: Hajimu UMEMOTO <ume@mahoroba.org>
To: Terry Lambert <tlambert2@mindspring.com>
In-Reply-To: <3FB6B4FE.4C1AF03C@mindspring.com>
References: <E1AGIbn-0001Ux-7o@cub.org.ua>
	<ygefzgpq508.wl%ume@mahoroba.org>
	<3FB6B4FE.4C1AF03C@mindspring.com>
User-Agent: xcite1.38> Wanderlust/2.11.3 (Wonderwall) SEMI/1.14.5
 (Awara-Onsen) FLIM/1.14.5 (Demachiyanagi) APEL/10.6 Emacs/21.3
 (i386--freebsd) MULE/5.0 (=?ISO-2022-JP?B?GyRCOC1MWhsoQg==?=)
X-Operating-System: FreeBSD 5.1-CURRENT
MIME-Version: 1.0 (generated by SEMI 1.14.5 - "Awara-Onsen")
Content-Type: text/plain; charset=US-ASCII
X-Virus-Scanned: by amavisd-new
X-Spam-Status: No, hits=0.0 required=5.0 tests=none autolearn=no version=2.60
X-Spam-Checker-Version: SpamAssassin 2.60 (1.212-2003-09-23-exp) on 
	cheer.mahoroba.org
cc: FreeBSD-gnats-submit@freebsd.org
cc: Kostyuk Oleg <cub@cub.org.ua>
cc: freebsd-current@freebsd.org
Subject: Re: /etc/rc.d/ipsec starts not in time
X-BeenThere: freebsd-current@freebsd.org
X-Mailman-Version: 2.1.1
Precedence: list
List-Id: Discussions about the use of FreeBSD-current
	<freebsd-current.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-current>
List-Post: <mailto:freebsd-current@freebsd.org>
List-Help: <mailto:freebsd-current-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-current>,
	<mailto:freebsd-current-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sun, 16 Nov 2003 08:26:42 -0000

Hi,

>>>>> On Sat, 15 Nov 2003 15:21:34 -0800
>>>>> Terry Lambert <tlambert2@mindspring.com> said:

> It is not sufficient.  There is setkey(8) in /usr/sbin.  It means that
> we cannot protect NFS exported /usr by IPsec.  If there is no
> objection, I wish to move setkey(8) into /sbin like NetBSD did.

tlambert2> This type of order inversion is common.

tlambert2> Can we simply delay exportation until later in the boot process?
tlambert2> Wouldn't this have the same effect?

Oops, I should explain the situation clearly.  The client which mounts
/usr by NFS cannot use IPsec due to lack of setkey(8).

Sincerely,

--
Hajimu UMEMOTO @ Internet Mutual Aid Society Yokohama, Japan
ume@mahoroba.org  ume@bisd.hitachi.co.jp  ume@{,jp.}FreeBSD.org
http://www.imasy.org/~ume/