Coming up this time on the show, we'll be speaking with Christos Zoulas, a NetBSD security officer. He's got a new project called blacklistd, with some interesting possibilities for stopping bruteforce attacks. We've also got answers to your emails and all this week's news, on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
New PAE support in OpenBSD
OpenBSD has just added Physical Address Extention support to the i386 architecture, but it's probably not what you'd think of when you hear the termIn most operating systems, PAE's main advantage is to partially circumvent the 4GB memory limit on 32 bit platforms - this version isn't for thatInstead, this change specifically allows the system to use the No-eXecute Bit of the processor for the userland, further hardening the in-place memory protectionsOther operating systems enable the CPU feature without doing anything to the page table entries, so they do get the available memory expansion, but don't get the potential security benefitAs we discussed in a previous episode, the AMD64 platform already saw some major WX kernel and userland improvements - the i386 kernel reworking will begin shortlyNot all CPUs support this feature, but, if yours supports NX, this will improve upon the previous version of WX that was already thereThe AMD64 improvements will be in 5.7, due out in just a couple days as of when we're recording this, but the i386 improvements will likely be in 5.8***
Booting Windows in bhyve
Work on FreeBSD's bhyve continues, and a big addition is on the wayThus far, bhyve has only been able to boot operating systems with a serial console - no VGA, no graphics, no WindowsThis is finally changing, and a teasing screenshot of Windows Server was recently posted on TwitterGraphics emulation is still in the works; this image was taken by booting headless and using RDPA lot of the needed code is being committed to -CURRENT now, but the UEFI portion of it requires a bit more development (and the aim for that is around the time of BSDCan)Not a lot of details on the matter currently, but we'll be sure to bring you more info as it comes outAre you more interested in bhyve or Xen on FreeBSD? Email us your thoughts***
MidnightBSD 0.6 released
MidnightBSD is a smaller project we've not covered a lot on the show beforeIt's an operating system that was forked from FreeBSD back in the 6.1 days, and their focus seems to be on ease-of-useThey also have their own, smaller version of FreeBSD ports, called "mports"If you're already using it, this new version is mainly a security and bugfix releaseIt syncs up with the most recent FreeBSD security patches and gets a lot of their ports closer to the latest versionsYou can check their site for more information about the projectWe're trying to get the lead developer to come on for an interview, but haven't heard anything back yet***
OpenBSD rewrites the file utility
We're all probably familiar with the traditional file command - it's been around since the 1970sFor anyone who doesn't know, it's used to determine what type of file something actually isThis tool doesn't see a lot of development these days, and it's had its share of security issues as wellSome of those security issues remain unfixed in various BSDs even today, despite being publicly known for a whileIt's not uncommon for people to run file on random things they download from the internet, maybe even as root, and some of the previous bugs have allowed file to overwrite other files or execute code as the user running itWhen you think about it, file was technically designed to be used on untrusted filesOpenBSD developer Nicholas Marriott, who also happens to be the author of tmux, decided it was time to do a complete rewrite - this time with modern coding practices and the usual OpenBSD scrutinyThis new version will, by default, run as an unprivileged user with no shell, and in a systrace sandbox, strictly limiting what system calls can be madeWith these two things combined, it should drastically reduce the damage a malicious file could potentially doIan Darwin, the original author of the utility, saw the commit and replied, in what may be a moment in BSD history to rememberIt'll be interesting to see if the other BSDs, OS X, Linux or other UNIXes consider adopting this implementation in the future - someone's already thrown together an unofficial portable versionCoincidentally, the lead developer and current maintainer of file just happens to be our guest today…***
Interview - Christos Zoulas -
[email protected]blacklistd and NetBSD advocacy
News Roundup
GSoC-accepted BSD projects
The Google Summer of Code people have published a list of all the projects that got accepted this year, and both FreeBSD and OpenBSD are on that listFreeBSD's list includes: NE2000 device model in userspace for bhyve, updating Ficl in the bootloader, type-aware kernel virtual memory access for utilities, JIT compilation for firewalls, test cluster automation, Linux packages for pkgng, an mtree parsing and manipulation library, porting bhyve to ARM-based platforms, CD-ROM emulation in CTL, libc security extensions, gptzfsboot support for dynamically discovering BEs during startup, CubieBoard support, a bhyve version of the netmap virtual passthrough for VMs, PXE support for FreeBSD guests in bhyve and finally.. memory compression and deduplicationOpenBSD's list includes: asynchronous USB transfer submission from userland, ARM SD/MMC & controller driver in libsa, improving USB userland tools and ioctl, automating module porting, implementing a KMS driver to the kernel and, wait for it... porting HAMMER FS to OpenBSDWe'll be sure to keep you up to date on developments from both projectsHopefully the other BSDs will make the cut too next year***
FreeBSD on the Gumstix Duovero
If you're not familiar with the Gumstix Duovero, it's an dual core ARM-based computer-on-moduleThey actually look more like a stick of RAM than a mini-computerThis article shows you how to build a FreeBSD -CURRENT image to run on them, using crochet-freebsdIf anyone has any interesting devices like this that they use BSD on, write up something about it and send it to us***
EU study recommends OpenBSD
A recent study by the European Parliament was published, explaining that more funding should go into critical open source projects and toolsThis is especially important, in all countries, after the mass surveillance documents came out "[...] the use of open source computer operating systems and applications reduces the risk of privacy intrusion by mass surveillance. Open source software is not error free, or less prone to errors than proprietary software, the experts write. But proprietary software does not allow constant inspection and scrutiny by a large community of experts."The report goes on to mention users becoming more and more security and privacy-aware, installing additional software to help protect themselves and their traffic from being spied onAlongside Qubes, a Linux distro focused on containment and isolation, OpenBSD got a special mention: "Proactive security and cryptography are two of the features highlighted in the product together with portability, standardisation and correctness. Its built-in cryptography and packet filter make OpenBSD suitable for use in the security industry, for example on firewalls, intrusion-detection systems and VPN gateways"Reddit, Undeadly and Hacker News also had some discussion, particularly about corporations giving back to the BSDs that they make use of in their infrastructure - something we've discussed with Voxer and M:Tier before***
FreeBSD workflow with Git
If you're interested in contributing to FreeBSD, but aren't a big fan of SVN, they have a Github mirror tooThis mailing list post talks about interacting between the official source repository and the Git mirrorThis makes it easy to get pull requests merged into the official tree, and encourages more developers to get involved***
Feedback/Questions
Sean writes inBryan writes inSean writes inCharles writes in***
View all episodes
