This time on the show, we'll be talking to Ian Sutton about his new BSD compatibility wrappers for various systemd dependencies. Don't worry, systemd is not being ported to BSD! We're still safe! We've also got all the week's news and answers to your emails, coming up on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
Introducing OPNsense, a pfSense fork
OPNsense is a new BSD-based firewall project that was recently started, forked from the pfSense codebaseEven though it's just been announced, they already have a formal release based on FreeBSD 10 (pfSense's latest stable release is based on 8.3)The core team includes a well-known DragonFlyBSD developerYou can check out their code on Github now, or download an image and try it out - let us know if you do and what you think about itThey also have a nice wiki and some instructions on getting started for new usersWe plan on having them on the show next week to learn a bit more about how the project got started and why you might want to use it - stay tuned***
Code rot and why I chose OpenBSD
Here we have a blog post about rotting codebases - a core banking system in this exampleThe author tells the story of how his last days spent at the job were mostly removing old, dead code from a giant projectHe goes on to compare it to OpenSSL and the hearbleed disaster, from which LibreSSL was bornInstead of just bikeshedding like the rest of the internet, OpenBSD "silently started putting the beast into shape" as he puts itThe article continues on to mention OpenBSD's code review process, and how it catches any bugs so we don't have more heartbleeds"In OpenBSD you are encouraged to run current and the whole team tries its best to make current as stable as it can. You know why? They eat their own dog food. That's so simple yet so amazing that it blows my mind. Developers actually run OpenBSD on their machines daily."It's a very long and detailed story about how the author has gotten more involved with BSD, learned from the mailing lists and even started contributing back - he says "In summary, I'm learning more than ever - computing is fun again"Look for the phrase "Getting Started" in the blog post for a nice little gem***
ZFS vs HAMMER FS
One of the topics we've seen come up from time to time is how FreeBSD's ZFS and DragonFly's HAMMER FS compare to each otherThey both have a lot of features that traditional filesystems lackA forum thread was opened for discussion about them both and what they're typically used forIt compares resource requirements, ideal hardware and pros/cons of eachHopefully someone will do another new comparison when HAMMER 2 is finishedThis is not to be confused with the other "hammer" filesystem***
Portable OpenNTPD revived
With ISC's NTPd having so many security vulnerabilities recently, people need an alternative NTP daemonOpenBSD has developed OpenNTPD since 2004, but the portable version for other operating systems hasn't been actively maintained in a few yearsThe older version still works fine, and is in FreeBSD ports and NetBSD pkgsrc, but it would be nice to have some of the newer features and fixes from the native versionBrent Cook, who we've had on the show before to talk about LibreSSL, decided it was time to fix thisWhile looking through the code, he also found some fixes for the native version as wellYou can grab it from Github now, or just wait for the updated release to hit the repos of your OS of choice***
Interview - Ian Sutton -
[email protected]BSD replacements for systemd dependencies
News Roundup
pkgng adds OS X support
FreeBSD's next-gen package manager has just added support for Mac OS XWhy would you want that? Well.. we don't really know, but it's coolThe author of the patch may have some insight about what his goal is thoughThis could open up the door for a cross-platform pkgng solution, similar to NetBSD's pkgsrcThere's also the possibility of pkgng being used as a packaging format for MacPorts in the futureWhile we're on the topic of pkgng, you can also watch bapt's latest presentation about it from ruBSD 2014 - "four years of pkg"***
Secure secure shell
Almost everyone watching BSD Now probably uses OpenSSH and has set up a server at one point or anotherThis guide provides a list of best practices beyond the typical "disable root login and use keys" advice you'll often hearIt specifically goes in-depth with server and client configuration with the best key types, KEX methods and encryption ciphers to useThere are also good explanations for all the choices, based both on history and probabilityMinimal backwards compatibility is kept, but most of the old and insecure stuff gets disabledWe've also got a handy chart to show which SSH implementations support which ciphers, in case you need to support Windows users or people who use weird clients***
Dissecting OpenBSD's divert(4)
PF has a cool feature that not a lot of people seem to know about: divertIt lets you send packets to userspace, allowing you to inspect them a lot easierThis blog post, the first in a series, details all the cool things you can do with divert and how to use itA very common example is with intrusion detection systems like Snort***
Screen recording on FreeBSD
This is a neat article about a topic we don't cover very often: making video content on BSDIn the post, you'll learn how to make screencasts with FreeBSD, using kdenlive and ffmpegThere are also notes about getting a USB microphone working, so you can do commentary on whatever you're showingIt also includes lots of details and helpful screenshots throughout the processYou should make cool screencasts and send them to us***
Feedback/Questions
Camio writes inezpzy writes inEmett writes inBen writes inLaszlo writes in***
Mailing List Gold
Protocol X97My thoughts echoedVulnerability sample***
View all episodes
