BSD Now

By JT PenningtonNews Education How To Tech News

BSD Now episodes

December 23, 2015121: All your hyves are belong to us
This week on the show, we are going to be talking to Trent Thompson,
This episode was brought to you by
iX Systems Mission Complete
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***
Headlines
Review: Guarding the gates with OpenBSD 5.8
Jesse Smith over at DistroWatch treats us this week to a nice review of OpenBSD 5.8, which may be a good introduction for the uninitiated to learn more+ He first walks through some of the various highlights of 5.8, and spends time introducing the reader to a number of the projects that originate from OpenBSD, such as LibreSSL, OpenSSH, doas, the new “file” implementation and WX support on i386.
The article then walks through his impressions of performing a fresh install of 5.8, and then getting up and running in X.
He mentions that you may want to check the installation defaults, since on his 8GB VM disk, it didn’t leave enough room for packages on the /usr partition.
It also includes a nice heads-up for new users about using the pkg_add command, and where / how you can set the initial repository mirror address.
The “doas” command was also praised:“I found I very much appreciated the doas command, its documentation and configuration file. The doas configuration file is much easier to read than sudo's and the available options are well explained. The doas command allowed me to assign root access to a user given the proper password and doas worked as advertised.”
A glowing summary as well:“OpenBSD may be very secure, but I think what sets the operating system apart are its documentation and clean system design. It is so easy to find things and understand the configuration of an OpenBSD system. The file system is organized in a clean and orderly manner. It always takes me a while to get accustomed to using OpenBSD, as for me it is a rare occurrence, but once I get settled in I like how straight forward everything is. I can usually find and configure anything on the system without referring to external documents or searching for answers on-line and that is quite an accomplishment for an operating system where virtually everything is done from the command line. “
***
OpenBSD Hackathon Reports
Alexander Bluhm: multiprocessor networking
“The next step, we are currently working on, is to remove the big kernel lock from forwarding and routing. mpi@ has been doing this for a long time, but some corner cases were still left. I have written a regression test for handling ARP packets to show that all cases including proxy ARP are still working. Another thing that may happen with lock-free routing is that the interface is destroyed on one CPU while another CPU is working with a route to that interface. We finally got this resolved. The code that destroys the interface has to wait until all routes don't use this interface anymore. I moved the sleep before the destruction of the interface is started, so that the routes can always operate on a completely valid interface structure.”
Vincent Gross: ifa_ifwithaddr()
Vincent worked on the function that finds the interface with the specified address, which is used to tell if the machine is the intended recipient of an incoming packet. A number of corner cases existed with broadcast addresses, especially if two interfaces were in the same subnet. This code was moved to the new in_broadcast()
Ken Westerback: fdisk, installbot, and dhclient
Reyk Floeter: Hosting a hackathon, vmd, vmctl
“When I heard that Martin Pieuchot (mpi@) was looking for a place to hold another mini-hackathon for three to four people to work on multiprocessor (MP) enhancements of the network stack, I offered to come to our work place in Hannover, Northern Germany. We have space, gear, fast Internet and it is easy to reach for the involved people. Little did I know that it would quickly turn into n2k15, a network hackathon with 20 attendees from all over the world”
“If you ever hosted such an event or a party for many guests, you will know the dilemma of the host: you’re constantly concerned about your guests enjoying it, you have to take care about many trivial things, other things will break, and you get little to no time to attend or even enjoy it yourself. Fortunately, I had very experienced and welcomed guests: only one vintage table and a vase broke – the table can be fixed – and I even found some time for hacking myself.”
Martin Pieuchot: MP networking
“ We found two kind of MP bugs! There are MP bugs that you fix without even understanding them, and there are MP bugs that you understand but can't fix”
Stefan Sperling: initial 802.11n support
***
Hacking the PS4
As a followup to the story last week about the PS4 being “jailbroken”, we have a link to further information about how far this project has come along
This article also provides some great background information about whats running under the hood of your PS4, including FreeBSD 9, Mono VM and WebKit, with WebKit being the primary point of entry to jailbreak the box.
One particular point of interest, was the revelation that early firmware versions did not include ASLR, but it appears ASLR was added sometime around firmware 1.70. (Wonder if they used HardenedBSD’s implementation), and how they can bypass it entirely. “Luckily for us, we aren't limited to just writing static ROP chains. We can use JavaScript to read the modules table, which will tell us the base addresses of all loaded modules. Using these bases, we can then calculate the addresses of all our gadgets before we trigger ROP execution, bypassing ASLR.“
The article also mentions that they can prove that jails are used in some fashion, and provides examples of how they can browse the file system and dump a module list.
The kernel exploit in question is SA-15:21 from August of this year. The jailbreaking appears to be against an older version of PS4 firmware that did not include this patch
***
Nokia and ARM leading the charge to implement better TCP/IP as part of the 5G standard
“Many believe that a critical success factor for 5G will be a fully revamped TCP/IP stack, optimized for the massively varied use cases of the next mobile generation, for cloud services, and for virtualization and software-defined networking (SDN). This is the goal of the new OpenFastPath (OFP) Foundation, founded by Nokia Networks, ARM and industrial IT services player Enea. This aims to create an open source TCP/IP stack which can accelerate the move towards SDN in carrier and enterprise networks. Other sign-ups include AMD, Cavium, Freescale, Hewlett Packard Enterprise and the ARM-associated open source initiative, Linaro.”
“The new fast-path TCP/IP stack will be based on the open source FreeBSD operating system”
The general idea is to have a fast, open source, user space networking stack, based on the FreeBSD stack
with an “optimised callback-based zero-copy socket API” to keep packet processing in user-space as far as possible
It will be interesting to see a little bit more FreeBSD getting into every mobile and cloud based device.
***
Interview - Trent Thompson - [[email protected]]([email protected]) / @pr1ntf
iohyve
***
News Roundup
First cut of the FreeBSD modularized TCP stack
FreeBSD now has more than one TCP stack, and better yet, you can use more than one at once
Each socket pcb is associated with a stack, and it is possible to select a non-default stack with a socket option, so you can make a specific application use an experimental stack, while still defaulting to the known-good stack
This should lead to a lot of interesting development and testing, without the level of risk usually associated with modifying the TCP stack
The first new module available is ‘fastpath’, which may relate to the Nokia story earlier in the show
There are also plans to support changing TCP stacks after establish a session, which might land as early as January
***
Faces of FreeBSD : Erin Clark
In this edition of “Faces of FreeBSD” the FreeBSD foundation gives us an introduction to Erin Clark, of our very own iXsystems!
Her journey to the BSD family may sound similar to a lot of ours. She first began using Linux / Slackware in the early 2000’s, but in 2009 a friend introduced her to FreeBSD and the rest, as they say, is history.
“I use FreeBSD because it is very solid and secure and has a great selection of open source software that can be used with it from the ports collection. I have always appreciated FreeBSD’s networking stack because it makes a great router or network appliance. FreeBSD’s use of the ZFS file system is also very nice - ZFS snapshots definitely saved me a few times. I also like that FreeBSD is very well documented; almost everything you need to know about working with FreeBSD can be found in the FreeBSD Handbook.”
Originally a sys admin at iXsystems, where she helped managed PC-BSD desktops among others, now she works on the FreeNAS project as a developer for the CLI interface functionality.
***
New Olimex board runs Unix
Looking for some small / embedded gear to mess around with? The Olimex folks have a new Pic32 system now available which runs “RetroBSD”
“The current target is Microchip PIC32 microcontroller with 128 kbytes of RAM and 512 kbytes of Flash. PIC32 processor has MIPS M4K architecture, executable data memory and flexible RAM partitioning between user and kernel modes.”
RetroBSD isn’t something we’ve covered extensively here on BSDNow, so to bring you up to speed, it is a port of 2.11 BSD
Their website lists the following features of this 2.11 refresh:“
Small resource requirements. RetroBSD needs only 128 kbytes of RAM to be up and running user applications.
Memory protection. Kernel memory is fully protected from user application using hardware mechanisms.
Open functionality. Usually, user application is fixed in Flash memory - but in case of RetroBSD, any number of applications could be placed into SD card, and run as required.
Real multitasking. Standard POSIX API is implemented (fork, exec, wait4 etc).
Development system on-board. It is possible to have C compiler in the system, and to recompile the user application (or the whole operating system) when needed.“
For those looking into BSD history, or wanting something small and exotic to play with this may fit the bill nicely.
***
OpenSource.com reviews PCBSD
Joshua over at opensource.com writes up a review of PC-BSD (10.2 we assume)
Some of the highlights mentioned, include the easy to use graphical installer, but he does mention we should update the sorting of languages. (Good idea!)
Along with including nice screenshots, it also covers the availability of various DE’s / WM’s, and talks a fair amount about the AppCafe and Control Panel utilities.
“Thanks to being featured on PC-BSD's desktop, the PC-BSD Handbook is easily located by even the most novice user. There is no need to search through the system's installed applications for a manual, or relying solely on the help documentation for individual components. While not comprehensive, PC-BSD's handbook does a good job as striking a balance between concise and thorough. It contains enough information to help and provides detailed instructions for the topics it covers, but it avoids providing so much information that it overwhelms”
***
BeastieBits
Gandi introduces support for FreeBSD on their IaaS platform, with both ZFS and UFS based images available
Funny commit message from the Linux kernel
FreeBSD Journal, Nov/Dec 2015
Feedback/Questions
Zafer - NetBSD on DO
Richard - FreeNAS Replication
Winston - Android ADP
Alex - Multiple Domains
Randy - Getting Involved
Craig - zprezto
***
1 hr 38 min
December 16, 2015120: I’m talking about the man in the middle
This week on BSDNow, we are going to be talking to Pawel about how his
This episode was brought to you by
iX Systems Mission Complete
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***
Headlines
Note the recent passing of 2 members of the BSD community
Juergen Lock / Nox
Benjamin Perrault / creepingfur Memories from Michael Dexter
Additional Memories
Benjamin and Allan at Ben’s local bar
Benjamin treated Allan and Michael Dexter to their first ever Bermese food
Benjamin enjoying the hallway track at EuroBSDCon 2015
***
NGINX as Reverse Proxy for Apache on FreeBSD 10.2
A tutorial on setting up NGINX as a reverse proxy for Apache
Sometimes your users or application require some feature of Apache, that cannot be easily replicated in NGINX, like .htaccess files or a custom apache module
In addition, because the default worker model in Apache does not accept new work until it is finished sending the request, a user with a slow connection can tie down that worker for a long time
With NGINX as a reverse proxy, it will receive the data from the Apache worker over localhost, freeing that worker to answer the next request, while NGINX takes care of sending the data to the user
The tutorial walks through the setup, which is very easy on modern FreeBSD
One could also add mod_rpaf2 to the Apache, to securely pass through the users’ real IP address for use by Apache’s logging and the PHP scripts
***
FreeBSD and FreeNAS in Business by Randy Westlund
The story of how a Tent & Awning company switched from managing orders with paper, to a computerized system backed by a FreeNAS
“At first, I looked at off-the-shelf solutions. I found a number of cloud services that were like Dropbox, but with some generic management stuff layered on top. Not only did these all feel like a poor solution, they were very expensive. If the provider were to go out of business, what would happen to my dad’s company?”
“Fortunately, sourcing the hardware and setting up the OS was the easiest part; I talked to iXsystems. I ordered a FreeNAS Mini and a nice workstation tower”
“I have r2d2 (the tower, which hosts the database) replicating ZFS snapshots to c3po (the FreeNAS mini), and the data is backed up off-site regularly. This data is absolutely mission-critical, so I can’t take any risks. I’m glad I have ZFS on my side.”
“I replaced Dropbox with Samba on c3po, and the Windows machines in the office now store important data on the NAS, rather than their local drives.”
“I also replaced their router with an APU board running pfSense and replaced their PPTP VPN with OpenVPN and certificate authorization.”
“FreeBSD (in three different incarnations) helped me focus on improving the company’s workflow without spending much time on the OS. And now there’s an awning company that is, in a very real sense, powered by FreeBSD.”
***
Tutorial, Windows running under bhyve
With the recent passing of the world’s foremost expert on running Windows under bhyve on FreeBSD, this tutorial will help you get up to speed
“The secret sauce to getting Windows running under bhyve is the new UEFI support. This is pretty great news, because when you utilize UEFI in bhyve, you don't have to load the operating system in bhyveload or grub-bhyve first.”
The author works on iohyve, and wanted to migrate away from VirtualBox, the only thing stopping that was support for Windows Guests
iohyve now has support for managing Windows VMs
The tutorial uses a script to extract the Windows Server 2008 ISO and set up AutoUnattend.xml to handle the installation of Windows, including setting the default administrator password, this is required because there is no graphical console yet
The AutoUnattended setup also includes setting the IP address, laying out the partitions, and configuring the serial console
A second script is then used to make a new ISO with the modifications
The user is directed to fetch the UEFI firmware and some other bits
Then iohyve is used to create the Windows VM
The first boot uses the newly created ISO to install Windows Server 2008
Subsequent boots start Windows directly from the virtual disk
Remote Desktop is enabled, so the user can manage the Windows Server graphically, using FreeRDP or a Windows client
iohyve can then be used to take snapshots of the machine, and clone it
***
BSD Router Project has released 1.58
The BSD Router project has announced the release of version 1.58 with some notable new features
Update to FreeBSD 10.2-RELEASE-p8
Disabled some Chelsio Nic features not used by a router
Added new easy installation helper option, use with “system install ”
Added the debugging symbols for userland
Includes the iperf package, and flashrom package, which allows updating system BIOS on supported boxes
IMPORTANT: Corrects an important UFS label bug introduced on 1.57. If you are running 1.57, you will need to fetch their fixlabel.sh script before upgrading to 1.58
***
OPNsense 15.7.22 Released
An update to OPNsense has landed this week which includes the important updates to OpenSSL 1.0.2e and LibreSSL 2.2.5
A long-standing annoying bug with filter reload timeouts has finally been identified and sorted out as well, allowing the functionality to run quickly and “glitch free” again.
Some newer ports for curl (7.46), squid (3.5.12) and lighttpd (1.4.38) have also been thrown in for good measure
Some other minor UI fixes have also been included as well
With the holidays coming up, if you are still running a consumer router, this may be a good time to convert over to a OPNsense or PFsense box and get yourself ready for the new year.
***
iXsystems
iXSystems releases vCenter Web Client Plug-in for TrueNAS
Interview - Pawel Jakub Dawidek - [email protected]
News Roundup
Developer claims the PS4 has been jail-broken
While not exactly a well-kept secret, the PS4’s proprietary “OrbOS” is FreeBSD based.
Using this knowledge and a Kernel exploit, developer CTurt (https://twitter.com/CTurtE/) claims he was able jailbreak a WebKit process and gain access to the system.
He has posted a small tease to GitHub, detailing some of the information gleaned from the exploit, such as PID list and root FS dump
As such with these kinds of jailbreaks, he already requested that users stop sending him requests about game piracy, but the ability to hack on / run homebrew apps on the PS4 seems intriguing
***
Sepherosa Ziehau is looking for testers if you have a em(4), emx(4), or igb(4) Intel device
DragonFly Testers wanted! Sephe has posted a request for users of the em(4), emx(4) and igb(4) intel drivers to test his latest branch and report back results
He mentions that he has tested the models 82571, 82574 and 82573 (em/emx); 82575, 82576, 82580 and i350 specifically, so if you have something different, I’m sure he would be much appreciative of the help.
It looks like the em(4) driver has been updated to 7.5.2, and igb(4) 2.4.3, and adds support for the I219-LM and I219-V NICS.
***
OpenBSD Xen Support
Filed under the “Ohh, look what’s coming soon” section, it appears that patches are starting to surface for OpenBSD Xen DOMU support.
For those who aren’t up on their Xen terminology, DomU is the unprivileged domain (I.E. Guest mode)
Right now the patch exists at the link above, and adds a new (commented out) device to the GENERIC kernel, but this gives Xen users something new to watch for updates to.
***
Thinkpad Backlit Keyboard support being worked on
Another reason why Lenovo / ThinkPads are some of the best laptops currently to use with BSD, the kettenis over at the OpenBSD project has committed a patch to enable support for the “ThinkLight”
For those who don’t know, this is the little light that helps illuminate the laptop’s keyboard under low-light situations.
While the initial patch only supports the “real-deal” ThinkLight, he does mention that support will be added soon for the others on ThinkPads
No sysctl’s to fiddle with, this works directly with the ACPI / keyboard function keys directly, nice!
***
Deadline is approaching for Submissions of Tutorial Proposals for AsiaBSDCon 2016
Call for Papers for BSDCAN 2016 now open
The next two major BSD conferences both have their CFP up right now. First up is AsiaBSDCon in Tokyo from March 10th-13th, followed by BSDCan in Ottawa, June 8th-11th.
If you are working on anything interesting in the BSD community, this is a good way to get the word out about your project, plus the conference pays for Hotel / Travel.
If you can make it to both, DO SO, you won’t regret it. Both Allan and Kris will be attending and we would look forward to meeting you.
***
iohyve lands in ports
(http://www.freshports.org/sysutils/iohyve/)
Something we’ve mentioned in passing has taken its first steps in becoming reality for users! “iohyve” has now landed in the FreeBSD ports tree
While it shares a similar name to “iocage” its not directly related, different developers and such. However it does share a very similar syntax and some principles of ZFS usage
The current version is 0.7, but it already has a rather large feature set
Among the current features are ISO Management, resource management, snapshot support (via ZFS), and support for OpenBSD, NetBSD and Linux (Using grub-bhyve port)
***
BeastieBits
hammer mount is forced noatime by default
Show your support for FreeBSD
OpenBSD running in an Amazon EC2 t2.micro
NetBSD's 2015Q4 Package freeze is coming
‘Screenshots from Developers’ that we covered previously from 2002, updated for 2015
Feedback/Questions (slexy was down when I made these, I only did 3, since the last is really long, save rest for next week)
Mark - BSD laptops
Jamie - zxfer
Anonymous - Long Story
***
1 hr 57 min
December 09, 2015119: There be Dragons, BSD Dragons anyway
This week on BSDNow - It’s getting close to christmas and the
This episode was brought to you by
iX Systems Mission Complete
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***
Headlines
n2k15 hackathon reports
tedu@ worked on rebound, malloc hardening, removing legacy code
“I don't usually get too involved with the network stack, but sometimes you find yourself at a network hackathon and have to go with the flow. With many developers working in the same area, it can be hard to find an appropriate project, but fortunately there are a few dusty corners in networking land that can be swept up without too much disturbance to others.”
“IPv6 is the future of networking. IPv6 has also been the future of networking for 20 years. As a result, a number of features have been proposed, implemented, then obsoleted, but the corresponding code never quite gets deleted. The IPsec stack has followed a somewhat similar trajectory”
“I read through various networking headers in search of features that would normally be exposed to userland, but were instead guarded by ifdef _KERNEL. This identified a number of options for setsockopt() that had been officially retired from the API, but the kernel code retained to provide ABI compatibility during a transition period. That transition occurred more than a decade ago. Binary programs from that era no longer run for many other reasons, and so we can delete support. It's only a small improvement, but it gradually reduces the amount of code that needs to be reviewed when making larger more important changes”
Ifconfig txpower got similar treatment, as no modern WiFi driver supports it
Support for Ethernet Trailers, RFC 893, enabled zero copy networking on a VAX with 512 byte hardware pages, the feature was removed even before OpenBSD was founded, but the ifconfig option was still in place
Alexandr Nedvedicky (sashan@) worked on MP-Safe PF
“I'd like to thank Reyk for hackroom and showing us a Christmas market. It was also my pleasure to meet Mr. Henning in person. Speaking of Henning, let's switch to PF hacking.”
“mpi@ came with patch (sent to priv. list only currently), which adds a new lock for PF. It's called PF big lock. The big PF lock essentially establishes a safe playground for PF hackers. The lock currently covers all pf_test() function. The pf_test() function parts will be gradually unlocked as the work will progress.
To make PF big lock safe few more details must be sorted out. The first of them is to avoid recursive calls to pf_test(). The pf_test() could get entered recursively, when packet hits block rule with return-* action. This is no longer the case as ip*_send() functions got introduced (committed change has been discussed privately). Packets sent on behalf of kernel are dispatched using softnet task queue now. We still have to sort out pf_route*() functions. The other thing we need to sort out with respect to PF big lock is reference counting for statekey, which gets attached to mbuf. Patch has been sent to hackers, waiting for OK too. The plan is to commit reference counting sometimes next year after CVS will be unlocked. There is one more patch at tech@ waiting for OK. It brings OpenBSD and Solaris PF closer to each other by one tiny little step.”
***
ACM Queue: Challenges of Memory Management on Modern NUMA System
“Modern server-class systems are typically built as several multicore chips put together in a single system. Each chip has a local DRAM (dynamic random-access memory) module; together they are referred to as a node. Nodes are connected via a high-speed interconnect, and the system is fully coherent. This means that, transparently to the programmer, a core can issue requests to its node's local memory as well as to the memories of other nodes. The key distinction is that remote requests will take longer, because they are subject to longer wire delays and may have to jump several hops as they traverse the interconnect. The latency of memory-access times is hence non-uniform, because it depends on where the request originates and where it is destined to go. Such systems are referred to as NUMA (non-uniform memory access).”
So, depending what core a program is running on, it will have different throughput and latency to specific banks of memory. Therefore, it is usually optimal to try to allocate memory from the bank of ram connected to the CPU that the program is running on, and to keep that program running on that same CPU, rather than moving it around
There are a number of different NUMA strategies, including:
Fixed, memory is always allocated from a specific bank of memory
First Touch, which means that memory is allocated from the bank connected to the CPU that the application is running on when it requests the memory, which can increase performance if the application remains on that same CPU, and the load is balanced optimally
Round Robin or Interleave, where memory is allocated evenly, each allocation coming from the next bank of memory so that all banks are used. This method can provide more uniform performance, because it ensures that all memory accesses have the same change to be local vs remote. If even performance is required, this method can be better than something more focused on locality, but that might fail and result in remote access
AutoNUMA, A kernel task routinely iterates through the allocated memory of each process and tallies the number of memory pages on each node for that process. It also clears the present bit on the pages, which will force the CPU to stop and enter the page-fault handler when the page is next accessed. In the page-fault handler it records which node and thread is trying to access the page before setting the present bit and allowing execution to continue. Pages that are accessed from remote nodes are put into a queue to be migrated to that node. After a page has already been migrated once, though, future migrations require two recorded accesses from a remote node, which is designed to prevent excessive migrations (known as page bouncing).
The paper also introduces a new strategy:
Carrefour is a memory-placement algorithm for NUMA systems that focuses on traffic management: placing memory so as to minimize congestion on interconnect links or memory controllers. Trying to strike a balance between locality, and ensuring that the interconnect between a specific pair of CPUs does not become congested, which can make remote accesses even slower
Carrefour uses three primary techniques:
Memory collocation, Moving memory to a different node so that accesses will likely be local.
Replication, Copying memory to several nodes so that threads from each node can access it locally (useful for read-only and read-mostly data).
Interleaving, Moving memory such that it is distributed evenly among all nodes.
FreeBSD is slowly gaining NUMA capabilities, and currently supports: fixed, round-robin, first-touch. Additionally, it also supports fixed-rr, and first-touch-rr, where if the memory allocation fails, because the fixed domain or first-touch domain is full, it falls back to round-robin.
For more information, see numa(4) and numa_setaffinity(2) on 11-CURRENT
***
Is that Linux? No it is PC-BSD
Larry Cafiero continues to make some news about his switch to PC-BSD from Linux. This time in an blog post titled “Is that Linux? No, its PC-BSD” he describes an experience out and about where he was asked what is running on his laptop, and was unable for the first time in 9 years to answer, it’s Linux.
The blog then goes on to mention his experience up to now running PC-BSD, how the learning curve was fairly easy coming from a Linux background.
He mentions that he has noticed an uptick in performance on the system, no specific benchmarks but this “Linux was fast enough on this machine. But in street racing parlance, with PC-BSD I’m burning rubber in all four gears.”
The only major nits he mentions is having trouble getting a font to switch in FireFox, and not knowing how to enable GRUB quiet mode. (I’ll have to add a knob back for that)
***
Dual booting OS X and OpenBSD with full disk encryption
New GPT and UEFI support allow OpenBSD to co-exist with Mac OS X without the need for Boot Camp Assistant or Hybrid MBRs
This tutorial walks the read through the steps of installing OpenBSD side-by-side with Mac OS X
First the HFS+ partition is shrunk to make room for a new OpenBSD partition
Then the OpenBSD installer is run, and the available free space is setup as an encrypted softraid
The OpenBSD installer will add itself to the EFI partition
Rename the boot loader installed by OpenBSD and replace it with rEFInd, so you will get a boot menu allowing you to select between OpenBSD and OS X
***
Interview - Paul Goyette - [email protected]
NetBSD Testing and Modularity
***
iXsystems
iXsystems Wins Press and Industry Analyst Accolades in Best in Biz Awards 2015
***
News Roundup
HOWTO: L2TP/IPSec with OpenBSD
*BSD contributor Sevan Janiyan provides an update on setting up a road-warrior VPN
This first article walks through setting up the OpenBSD server side, and followup articles will cover configuring various client systems to connect to it
The previous tutorial on this configuration is from 2012, and things have improved greatly since then, and is much easier to set up now
The tutorial includes PF rules, npppd configuration, and how to enable isakmpd and ipsec
L2TP/IPSec is chosen because most operating systems, including Windows, OS X, iOS, and Android, include a native L2TP client, rather than requiring some additional software to be installed
***
DragonFly 4.4 Released
DragonFly BSD has made its 4.4 release official this week!
A lot of big changes, but some of the highlights
Radeon / i915 DRM support for up to Linux Kernel 3.18
Proper collation support for named locales, shared back to FreeBSD 11-CURRENT
Regex Support using TRE “As a consequence of the locale upgrades, the original regex library had to be forced into POSIX (single-byte) mode always. The support for multi-byte characters just wasn't there. ” …. “TRE is faster, more capable, and supports multibyte characters, so it's a nice addition to this release.”
Other noteworthy, iwm(4) driver, CPU power-saving improvements, import ipfw from FreeBSD (named ipfw3)
An interesting tidbit is switching to the Gold linker
***
Guide to install Ajenti on Nginx with SSL on FreeBSD 10.2
Looking for a webmin-like interface to control your FreeBSD box? Enter Ajenti, and today we have a walkthrough posted on how to get it setup on a FreeBSD 10.2 system.
The walkthrough is mostly straightforward, you’ll need a FreeBSD box with root, and will need to install several packages / ports initially.
Because there is no native package (yet), it guides you through using python’s PIP installer to fetch and get Ajenti running.
The author links to some pre-built rc.d scripts and other helpful config files on GitHub, which will further assist in the process of making it run on FreeBSD.
Ajenti by itself may not be the best to serve publically, so it also provides instructions on how to protect the connection by serving it through nginx / SSL, a must-have if you plan on using this over unsecure networks.
***
BSDCan 2016 CFP is up!
BSDCan is the biggest North American BSD conference, and my personal favourite
The call for papers is now out, and I would like to see more first-time submitters this year
If you do anything interesting with or on a BSD, please write a proposal
Are the machines you run BSD on bigger or smaller than what most people have? Tell us about it
Are you running a big farm that does something interesting?
Is your university research using BSD?
Do you have an idea for a great new subsystem or utility?
Have you suffered through some horrible ordeal? Make sure the rest of us know the best way out when it happens to us.
Did you build a radar that runs NetBSD? A telescope controlled by FreeBSD?
Have you run an ISP at the north pole using Jails?
Do you run a usergroup and have tips to share?
Have you combined the features and tools of a BSD in a new and interesting way?
Don’t have a talk to give? Teach a tutorial!
The conference will arrange your air travel and hotel, and you’ll get to spend a few great days with the best community on earth
Michael W. Lucas’s post about the 2015 proposals and rejections
***
Beastie Bits
OpenBSD's lightweight web server now in FreeBSD's ports tree
Stephen Bourne's NYCBUG talk is online
Looking for owner to FreeBSDWiki
HOWTO: OpenBSD Mail Server
A new magic getopt library
PXE boot OpenBSD from OpenWRT
Supporting the OpenBSD project
Feedback/Questions
Zachary - FreeBSD Jails
Robert - Iocage help!
Kjell - Server Management
Brian - NAS Setup
Mike - Radius Followup
Laszlo - Best Stocking Ever
***
1 hr 42 min
December 02, 2015118: BSD is go for Launch
Coming up on BSDNow - We know init systems have been all the rage
This episode was brought to you by
iX Systems Mission Complete
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***
Headlines
Interview with Renato Westphal
An interview with Brazilian OpenBSD developer Renato Westphal
He describes how he first got into OpenBSD, working on a University-Industry partnership program and looking to deploy LDP (Label Distribution Protocol) for MPLS.
He ported OpenBSDs ldpd(8) to Linux, but then contributed his bug fixes and improvements back to OpenBSD
When asked if he was motivated to replace closed-source router implementations with OpenBSD: “Well, I don't administer any network, I work full time as a programmer. I have some friends however that succeeded replacing closed vendor solutions with OpenBSD boxes and that for sure motivates me to keep doing what I'm doing. My biggest motivation, however, is the challenge of resolving complex problems writing trivially simple code that is both secure and efficient.”
They also go on to discuss some of the interesting features of EIGRP, and developing eigrpd(8)
What do you think is missing from routing in OpenBSD: “Implementing new features and protocols while they are in their draft stage in IETF. I'd like to see OpenBSD as the reference platform for the development of new routing and networking technologies in general”
***
Let’s Encrypt on a FreeBSD NGINX reverse proxy
We have a neat guide/story today on how to setup the “Let’s Encrypt” certificates on a FreeBSD / nginx reverse proxy
Backstory: For those who don’t know, “Let’s Encrypt” (https://letsencrypt.org) is a new Certificate Authority, which will allow you to create free and automated certificates.
They have been in closed beta for several months now, and will be opening to a public beta Dec 3rd (tomorrow)
This guide is particularly timely, since by the time most of you are watching this episode, the public beta will be up and running.
Most of the instructions are fairly straight-forward. She starts by installing the lets-encrypt package from ports/pkg and modifying her nginx with a ‘catch-all’ vhost that re-directs traffic to the https versions of a site.
With that done, the certificate creation is just a few commands to get started, in which she shows creating a cert for multiple domains
As a bonus! She includes a nice renewal script which can be run from cron. It will monitor the certs daily, and renew it when it’s 14 days from expiring, or throw an error for somebody to look at.
***
Mike Larkins OpenBSD vmm subsystem now in tree
An openBSD native hypervisor has taken another step closer to reality, with Mike Larkin pushing the initial bits of “vmm” into the base kernel/world
He mentions in the commit message that it still needs a lot of work, and as such is disabled by default.
However for the adventurous among you, it can be turned on and tested
Right now there is no BIOS, and as such it can only be used to boot other OpenBSD instances, although he mentions other BSD’s could be supported fairly quickly (He did a 1 hour port to bootstrap NetBSD)
No big documentation expected for this release, since there is so much ongoing churn. Take a look at the man page for details on getting started.
***
The story of how Yahoo switched to FreeBSD
Yahoo originally started running on SunOS, but quickly found it not able to cope with the high frequency of HTTP requests
“Having spend many frustrating hours trying to install other PC OS's, I was a bit skeptical. I had no intention of spending three days trying to install yet another one. To my surprise I went to the FreeBSD Web site, downloaded the floppy boot image, booted a PC with the created floppy, answered a few install questions, and a few minutes later FreeBSD was installing over the Net. The real surprise was when I came back later to a fully configured system that actually worked.”
“If anything had gone wrong with that install it would likely been the end of that trial. Luckily for us that it was the easiest and most painless OS installs I had ever experienced.”
Just that easily, Yahoo might never have ended up on FreeBSD
“A couple of days later we added a FreeBSD box to our cluster of Web servers. Not only did it out-perform the rest of our machines, but it was more stable.”
From my understanding of stories told over dinner, Yahoo had a few very important perl scripts, and they tended to crash on Linux, but kept running without issue on FreeBSD
Related hackernews thread
***
iXsystems
iXsystem's recap of LISA 2015
***
Interview - Mark Heily - [email protected] / @MarkHeily
relaunchd
***
News Roundup
Inline Intrusion Prevision System is an upcoming OPNSense Feature
The next OPNSense release, 16.1 is around the corner and today we have a sneak peek at their new Inline Intrusion Prevention system
Suricata working with Netmap 2.1 enabled version, which allows Deep Packet Inspection of traffic. Such as looking at each packet individually and only blocking specific ones. They use the example of blocking Warcraft (oh noes!)
Enabling this feature is just a simple mouse-click away, and various default rules are included as part of the Emerging Threats Community rules.
***
Matthew Dillion working on Hardlinks in Hammer2
We have an interesting commit from Matthew Dillon for Hammer2, specifically targeted at hard-links
The backstory he gives us: “The H2 design has had a long-standing problem of losing track of hardlinks when intermediate directories are renamed, breaking the common-parent-directory design for the inode target.”
The implemented fix was one which instead places the hardlink target in the first common parent directory, which is marked with “xlink” via chflag
If no parent directory is marked “xlink”, it will fall-through instead to the root of the mount
They also modified their installworld to set “/” /usr/,/var/,/home/ as “xlink” flagged
This prevents moving hard-links across these directories, but is similar to dealing with multiple partitions / datasets already.
***
Japan's NetBSD User Group showed off some NetBSD machines at the 2015 Tokushima Open Source Conference
It’s been a little while since we’ve shown off a bunch of odd devices running NetBSD, but we have an update from the 2015 Tokushima Open Source Conference.
This time around, we have pictures of the booth, as well as a variety of oddities such as:
ODroid-C1 / Sharp X68030
Sharp NetWalker
Sharp WZero3 (Cell phone)
Give them a look, this time around they have nice cards pictured which details the hardware being used (in english none the less!)
***
One of the three OpenBSD users Blog Post by Adam Wolk
An OpenBSD user comments on a recent interaction with the syncthing project (a dropbox like alternative)
The application has an auto-update feature (which doesn’t mix well with package systems in the first place), but it doesn’t work on OpenBSD because there is no /proc/curproc/file to determine the filename of the executable. This is a trivially easy task, but when the bug was reported, syncthings response was “Maybe one of the three OpenBSD users feel strongly enough about this to propose a patch. :D”
Part of the issue is that many users (especially the type that would run OpenBSD) opt out of reporting metrics, so OpenBSD is under-represented in the metrics the project developers are basing their decisions on
Maybe someone can post a patch to solve the problem. While FreeBSD can provide a linux procfs, it would be better to use a more portable way to get the location of the process binary
***
BeastieBits
DragonFly BSD 4.4 RC branch created
HOWTO: NFS booting bhyve
DragonFly BSD is looking for a 4.4 RC image by the end of November
Support for Atheros QCA953x "Honeybee" has been added to FreeBSD
Top updated in DragonflyBSD to allow the 'c' command
FreeBSD textbook makes appearance on the 6pm news in the Netherlands 12:49
SemiBug gives a recap of its Inaugural meeting and its plans for future meetups
***
Feedback/Questions
Adam - GELI on USB
Noble - Radius on FreeBSD
Jim - Backporting Wifi Code
Mohammad - Zombies!
Miguel - ScaleEngine BTS
***
1 hr 33 min
November 24, 2015117: The Cantrill Strikes Back: ...
This episode was brought to you by
iX Systems Mission Complete
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or
iXsystems hardware, and you could win monthly prizes, and have your story featured
in the FreeBSD Journal!
***
Headlines
Why did I choose the DragonFlyBSD Operating System by Siju George
We have a new article this week by Siju George posted over at BSDMag, talking about his reasons for using DragonFlyBSD in production.
He ran through periods of using both Free/OpenBSD, but different reasons led him away from each. Specifically problems doing port upgrades on FreeBSD, and the time required to do fsck / raid parity checks on OpenBSD.
During his research, he had heard about the HAMMER file-system, but didn’t know of anybody running it in production. After some mailing list conversions, and pointers from Matthew Dillon, he took the plunge and switched.
Now he has fallen in love with the operating system, some of the key strengths he notes at:
Rolling-Release model, which can be upgraded every few weeks or whenever he has the time
No time-consuming fsck after a unclean shutdown
No RAID parity checks while still having redundancy
Able to add volumes to HAMMER on the fly
He also mentions looking forward to HAMMER2, and its potential for easy clustering support, along with eventual CARP implementation so he can run two systems on the same IP.
***
The Devil & BSD - Larry Cafiero
A story that has been making the rounds on social media is by Larry Cafiero, on his reasons for deciding to switch from Linux over to the BSD side of things.
While most of the reasons are over the conflicts surrounding behavior by Linux leaders towards those in the community, he does mention that he has converted his main workstation over to PC-BSD.
According to Larry, “With a couple of hours of adding backup files and tweaking (augmented by a variety of “oh, look” moments which could easily make me the ADHD Foundation Poster Boy), it looks exactly like my personally modified Korora 22 Xfce which graced the machine earlier. “
He also gave a great compliment to the quality of the docs / applications in PC-BSD: “In addition, you have to like a operating system which gives you a book — in this case, the PC-BSD Handbook — which should be the gold standard of documentation. It’s enviable, as in, “man, I wish I had written that.” Also programs like AppCafe provide a plethora of FOSS software, so there’s no shortage of programs. Side by side, there’s nothing on the Linux side of things that is lacking on the BSD side of things.”
Regardless the initial reason for the switch, we are glad to have him and any other switchers join us on the BSD side of FOSS.
***
New resource for BSD-schoolin’
“The initial repository contains all of the material for the practitioner and masters style courses as well as a PDF for the teaching guide. All of the material is licensed under a BSD doc team license, also visible in the repo and on the github site.”
“we expect all other work, including the extension of the practitioner course to 5 days, and the adaptation of the graduate course to undergraduates will be in the github repo”
“Our goal now is to recruit a small number of universities to partner with us to teach this material. We will keep you posted on our progress.”
We are working on getting an interview lined up to talk more about this project
If I somehow find the time, I am try to contribute towards a sysadmin course similar to what I used to teach at an Arts&Tech College here in Canada
***
A Few thoughts on OpenBSD 5.8
A user details their thoughts, reactions, and concerns after upgrading to OpenBSD 5.8
Among the changes:
sudo was removed and replaced as doas. The user decided to make the switch, but ran into a bug with line continuation (\ to escape newline to continue a long line)
The removal of TCP Wrappers support from ssh - this caused a number of rules in hosts.allow to no longer be respected.
The FreeBSD port of openssh-portable has a patch to readd TCP wrappers because many people find it useful, including myself, when the ssh is in a jail and cannot run a firewall
The removal of the pf_rules= rc.conf variable. “I used to just put the default pf.conf rules file in place with each release and upgrade, and keep my changes in a pf.conf.local file that was specified in the pf_rules variable. The effect was that from the period after the upgrade until I noticed the change, my systems were using the default rules and thus more exposed than they were supposed to be”
This is what is often called a “POLA Violation”, Policy of Least Astonishment. When deciding what the system should do after some change or new feature is introduced, it should be the thing that will be the least “surprising” to the user. Having your firewall rules suddenly not apply, is surprising.
“A minor annoying change that was made in 5.8 was putting the file /var/unbound/db/root.key into /etc/changelist, so that the file gets checked daily by the security script. The issue with this is that if you are actually using unbound with DNSSEC, this file changes daily, though only in the comments”
It is very helpful to see a list of feedback like this after a release, so that the next release can be better
I would be interested in seeing similar feedback for the other BSDs
***
Interview - Bryan Cantrill - @bcantrill
Linux Interface Rants
News Roundup
FreeBSD AMI building AMI - Colin’s Corner
Colin Percival (Of TarSnap Fame) has brought us a new article this week on how to create your own custom EC2 AMI builds.
This new tool and instructions allows the creation of AMI files, without needing to go through the hassle of doing a fresh FreeBSD release build each time.
Essentially it works similar to Colin’s previous “de-penguinator” utility, by running a FreeBSD in a memory instance, allowing the disk to be unmounted and prepped for becoming an AMI.
The hope is that this new work allows easier creation of a new variety of “customized” FreeBSD instances, for end users to download and deploy at will.
***
Peter Hessler on OpenBSD / OpenBGPd
Last week a new video landed of Peter Hessler giving us a status update on OpenBSD tech, and OpenBGPd specifically
Of interest, he notes that LibreSSL is being used in iOS / OSX, and of course PF is used all over, Apple, BSD, Solaris and even a Windows port!
OpenNTPD gets a mention as well, still ZERO CVEs for the lifetime of the project
On the OpenBGPd side, it is considered production ready, so no reason to hold back deployment
Very “feature-complete”, able to handle Edge Router, Route server, Multi-RIB. Slew of optional features like route reflector, looking glass, mrt dumps, mpls / mpls vpn.
Bugs fixed, crashers, memory constraints and performance has been improved
Filtering Performance, in example provided, importing 561K rules / 60K prefixes, went from 35 minutes down to 30 seconds.
***
Onion Omega Updates
I have a newer kernel config that will be committed soon that hooks up the system LED, and the three LEDs on the expansion dock via /dev/led
I also have the I2C interface working to talk to the Relay and Servo expansions
I have not determined the exact protocol for the Servo expansions, but the relay expansion is fairly simple to operate
Instructions have been added to the wiki
I have managed to use the GPIO to toggle external LEDs and to read the value from a switch
I have also used the Servo PWM controller to dim an LED and control the speed of a PWM computer case fan
My plan is to operate a 32x32 multi colour LED matrix from the device for an interactive christmas display
***
FreeBSD Mastery: ZFS Book review
Book can be purchased here
or from the list of vendors including directly from the author here
***
Beastie Bits
Computer History Museum is looking for Bell Labs UNIX
ACM Queue Portrait: Robert Watson
Video Collection about BSD History, put together by FreeBSDNews
Minix announces its 2016 conference
Chris Henschen from fP Technologies' talk about BSD is now online
Mike Larkin and Theo de Raadt's talks from Hackfest this year in Quebec are online
FreeBSD on a BeagleBoneBlack with a Touchscreen Display
Dan Langille will be talking at CINLUG
Feedback/Questions
John - Rpi2 and BSD
Roger - Win10 + FreeBSD
Anonymous - Sharing Socket
Brad - Scrub Repaired
Kelly - Automated Provisioning
***
2 hr 14 min
November 18, 2015116: Arcing ZFS
This episode was brought to you by
iX Systems Mission Complete
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
Headlines
How to create new binary packages in the Ports system on OpenBSD
Creating a port is often a great first step you can take to get involved in your favorite BSD of choice, and (often) doesn’t require any actual programming to do so.
In this article we have a great walkthrough for users on creating a new ported application, and eventually binary package, on OpenBSD
As mentioned in the tutorial, a good starting place is always an existing port, which can you use as a template for your new creation. Tip: Try to pick something similar, I.E. python for a python app, Qt for Qt, etc.
This tutorial will first walk you through the process of creating your Makefile and related description about the new port.
Once you’ve created the initial Makefile, there are a bunch of new “make” targets you can begin to run to try building your port, everything from “make fetch” to “make makesum” and “make package”. Using these tests you can verify that your port is correct and results in the installable package/app you wanted.
***
Status update on pledge(2)
OpenBSD has been working very aggressively to convert much of their base system applications to using pledge(2) “Formerly Tame(2))
Theo has provided a great status update on where that stands as of right now and the numbers look like the following:
Out of 600 ELF binaries, 368 of them have been updated to utilize pledge(2) in some manner
This is quite a few, and includes everything from openssl, ping, sftp, grep, gzip and much more
There are still a number of “pledge-able” commands waiting for conversion, such as login, sysctl, nfsd, ssh and others.
He also mentions that there does exist some subset of commands which aren’t viable pledge(2) candidates, such as simple things like “true”, or commands like reboot/mount or even perl itself.
***
FreeBSD booting on the Onion Omega
Tiny $19 MIPS SoC ($25 with dock that provides built in mini-USB Serial interface, power supply, LED lights, GPIO expansion, USB port, etc)
A number of pluggable ‘expansions’ are available, including:
Arduino Dock (connect the Omega device to your existing Arduino components)
Blue Tooth Lower Energy
10/100 Ethernet Port
Relay expansion (2 relays each, can stack up to 8 expansions to control 16 relays)
Servo expansion (control up to 16 PWM servos, like robotic arms or camera mounts)
OLED expansion (1" monochrome 128x64 OLED display)
Thermal Printer Kit (includes all wiring and other components)
The device is the product of a successful Kick Starter campaign from March of this year
Specs:
Atheros AR9330 rev1 400MHZ MIPS 24K
64MB DDR2 400MHz
16MB Flash
802.11b/g/n 150Mbps Atheros Wifi + 100mbps Atheros Wired Ethernet
18 GPIO Pins
USB Controller
Using the freebsd-wifi-build tool, I was able to build a new firmware for the device based on a profile for a similar device based on the same Atheros chip. I hope to have time to validate some of the settings and get them posted up into the wiki and get the kernel configuration committed to FreeBSD in the next week or two
It is an interesting device compared to the TP-Link WDR3600’s we did at BSDCan, as it has twice as much flash, leaving more room for the system image, but only half as much ram, and a slower CPU
***
SSH Performance testing
There has been a discussion about the value of upkeeping the HPN (High Performance Networking) patch to OpenSSH in the base system of FreeBSD
As part of this, I did some fresh benchmarks on my pair of new high end servers
The remaining part to be done is testing different levels of latency
By tweaking the socket buffer sizes, I was able to saturate the full 10 gigabit with netcat, iperf, etc
From the tests that have been done so far, it doesn’t look like even the NONE cipher can reach that level of performance because of the MAC (Message Authentication Code)
It does appear that some of the auto-tuning in HPN is not worked as expected
Explicitly setting -oTcpRcvBuf=7168 (KB) is enough to saturate a gigabit with 50ms RTT (round trip time)
***
iXsystems
iX gives an overview of FreeBSD at SeaGl 2015
On the FreeNAS Blog, Michael Dexter explains the ZFS Intent Log and SLOG
Interview - George Wilson - [email protected] / @zfsdude
OpenZFS and Delphix
***
News Roundup
Nicholas Marriott has replaced the aging version of less(1) in OpenBSD
Sometimes less isn’t more, it’s just less
In this story, we have news that the old version of less(1) in OpenBSD has now been ripped out in favor of the more modern fork from illumos founder Garrett D’Amore.
In addition to being a “more” modern version, it also includes far “less” of the portability code, uses terminfo, replacing termcap and is more POSIX compliant.
***
FreeBSD gets initial support for advanced SMR drives
Kenneth D. Merry [email protected] has developed initial support for Host Managed, and Host Aware Shingled Magnetic Recording drives in FreeBSD, available as a patch against both -current and 10-stable
“This includes support for Host Managed, Host Aware and Drive Managed SMRdrives that are either SCSI (ZBC) or ATA (ZAC) attached via a SAScontroller. This does not include support for SMR ATA drives attached viaan ATA controller. Also, I have not yet figured out how to properly detecta Host Managed ATA drive, so this code won't do that.”
SMR drives have overlapping tracks, because the read head can be much smaller than the write head
The drawback to this approach is that writes to the disk must take place in 256 MB “zones” that must be written from the beginning
New features in the patch:
A new 'camcontrol zone' command that allows displaying and managing drive zones via SCSI/ATA passthrough.
A new zonectl(8) utility that uses the new DIOCZONECMD ioctl to display and manage zones via the da(4) (and later ada(4)) driver.
Changes to diskinfo -v to display the zone mode of a drive.
A new disk zone API, sys/sys/disk_zone.h.
A new bio type, BIO_ZONE, and modifications to GEOM to support it. This new bio will allow filesystems to query zone support in a drive and manage zoned drives.
Extensive modifications to the da(4) driver to handle probing SCSI and SATA behind SAS SMR drives.
Additional CAM CDB building functions for zone commands.
“We (Spectra Logic) are working on ZFS changes that will use this CAM and GEOM infrastructure to make ZFS play well with SMR drives. Those changes aren't yet done.”
It is good to see active development in this area, especially from experts in archival storage
A second patch is also offered, that improves the pass(4) passthrough interface for disks, and introduces a new camdd(8) command, a version of dd that uses the pass(4) interface, kqueue, and separate reader/writer threads for improved performance
He also presents a feature wishlist that includes some interesting benchmarking features, including a ‘sink’ mode, where reads from the device are just thrown away, rather than having to write then to /dev/null
***
Initial implemtnation of 802.11n now in iwm(4)
OpenBSD laptop users rejoice! 802.11n has landed!
Initially only for the iwm(4) driver, support is planned for other devices in the future
Includes support for all the required (non-optional) bits to make 802.11N functional
Adds a new 11n mode to ifmedia, and MCS (modulation coding scheme) that sits alongside the ieee80211_rateset structure.
No support for MIMO / SGI (Short Guard Interval) or 40 MHz wide-channels, but perhaps we will see those in a future update.
They are asking users for testing against a wide variety of any/all APs!
***
Freebsd adds support for Bluetooth LE Security Management
FreeBSD + BlueTooth, not something we discuss a lot about, but it is still under active development.
The most recently added features come from Takanori Watanabe, and adds new LE Security Management.
Specifically, it enables support for BLE Security Manager Protocol(SMP), and enables a userland tool to wait for the underlying HCI connection to be encrypted.
***
Building OpnSense on HardenedBSD
Looking for a way to further Harden your router? We have a tutorial from the HardenedBSD developer, Shawn Webb, about how to build OpnSense on HBSD 10-STABLE.
You’ll need to first be running HBSD 10-STABLE somewhere, in this article he is using bhyve for the builder VM.
The build process itself is mostly pretty straight-forward, but there are a number of different repos that all have to be checked out, so pay attention to which goes where.
+In this example he does a targeted build for a Netgate RCC-VE-4860, but you can pick your particular build.
***
Beastie Bits
1 BTC bounty for chromium bug!
DesktopBSD 2.0 M1 released
By implementing asynchronous pru_attach for UDP, Sepherosa Ziehau has increased connect rate by around 15K connections per second
Stephen Bourne, known for the Bourne Shell, will be giving a talk at NYCBUG this week
Tor Browser 5.0.3 for OpenBSD released
The Tor BSD Diversity Project aim to
Increase the number of Tor relays running BSDs. We envision this happening by increasing the total number of relays, with the addition of more BSD users running relays;
Make the Tor Browser available under BSD operating systems using native packaging mechanisms. Our first target is OpenBSD;
Engage the broader BSD community about the Tor anonymity network and the place that BSD Unix should occupy in the privacy community at large.
Screenshots from Unix People circa 2002
Feedback/Questions
Dominik - Bhyve Setup
John - beadm + GELI
Darrall - ZFS + RAID = Problems
Hamza - Which shell?
Amenia - FreeBSD routing
***
1 hr 58 min
November 11, 2015115: Controlling the Transmissions
Controlling the Transmissions
This episode was brought to you by
iX Systems Mission Complete
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***
Headlines
FreeBSD 2015 Vendor Dev Summit
FreeBSD Quarterly Status Report - Third Quarter 2015
We have a fresh quarterly status report from the FreeBSD project. Once again it almost merits an entire show, but we will try to hit all the highlights.
Bhyve - Porting of the Intel edk2 UEFI firmware, allowing Windows in headless mode, and Illumos support. Also porting to ARM has begun!
Improved Support for Acer C720 ChromeBooks
High Availability Clustering in CTL (Cam Target Layer)
Root Remounting (Similar to pivot_root in Linux). This work allows using “reboot -r” to do a fast-reboot, with a partial shutdown, kill all processes, and re-mount rootfs and boot. Especially useful for booting from mfs or similar then transitioning to iscsi or some other backing storage
OpenCL Support in Mesa, as well as kernel progress on the i915 driver
Improved support for UEFI FrameBuffer on a bunch of recent MacBook Pro and other Macs, in addition to improvements to “vt” framebuffer driver for high resolution displays.
ZFS support for UEFI Boot (Needs testing, but used in PC-BSD for a couple months now), and importing new features from IllumOS (resumable send, receive prefetch, replication checksumming, 50% less ram required for L2ARC, better prefetch)
DTrace SDT probes added to TCP code, to replace the old TCPDEBUG kernel option. Recompiling the kernel is no longer required to debug TCP, just use DTrace
Ongoing work to bring us a native port/package of GitLab
***
Meteor, the popular javascript web application framework has been forked to run on FreeBSD, OpenBSD and NetBSD - FreeBSD testers requested
We have a public call for testing for FreeBSD users of Meteor by Tom Freudenberg
The included link includes all the details on how to currently get meteor boot-strapped on your box and bring up the server
So far the reports are positive, many users reporting that it is running on their 10.2 systems / jails just fine.
Just a day ago the original porter mentioned that OpenBSD is ready to go for testing using the prepared dev bundle.
***
Mike Larkin work continues on an native OpenBSD hypervisor, which he has announced is now booting
Speaking of OpenBSD, we have an update from Mike Larkin about the status of the OpenBSD native hypervisor vmm(4).
His twitter post included the output from a successful VM bootup of OpenBSD 5.8-current, all the way to multi-user
While the code hasn’t been committed (yet) we will keep you informed when it lands so you too can begin playing with it.
***
This is how I like open source
A blog post by FreeBSD Core Team member, and one of the lead developers of pkg, Baptiste Daroussin
One project he has been working on is string collation
Garrett d'Amore (of IllumOS) implemented unicode string collation while working for Nexenta and made it BSD license
John Marino (from Dragonfly) imported the work done on Illumos into Dragonfly, while he was doing that he decided, it was probably a good idea to rework how locales are handled
He discovered that Edwin Groothuis (from FreeBSD) had long ago started a project to simplify locales handling on FreeBSD
He extended the tools written by Edwin and has been able to update Dragonfly to the latest (v27 so far) unicode definitions
John Marino has worked with Bapt many times on various projects (including bringing pkg and ports to Dragonfly)
Bapt decided it was time that FreeBSD got proper string collation support as well, and worked with John to import the support to FreeBSD
Bapt spotted a couple of bugs and worked with John on fixing them: issues with eucJP encoding, issues with Russian encoding (John did most of the work on tracking down and fixing the bugs), Bapt also converted localedef (the tool to generate the locales) into using BSD license only code (original version used the CDDL libavl library which I modified to use tree(3)), fixed issues. I also took the locale generation from Edwin (extended by John)
This work resulted in a nice flow of patches going from Dragonfly to FreeBSD and from FreeBSD to Dragonfly.
And now Garrett is interested in grabbing back our patches into Illumos!
The result of this collaboration is that now 3 OS share the same implementation for collation support! This is very good because when one discovers a bug the 3 of them benefit the fix!
The biggest win here is that this was a lot of work, and not an area that many people are interested in working on, so it was especially important to share the work rather than reimplement it separately.
***
Interview - Hiren Panchasara - [email protected] / @hirenpanchasara
Improving TCP
***
iXsystems
MissonComplete winners
***
News Roundup
LibreSSL 2.3.1 released
LibreSSl keeps on chugging, the latest release has landed, 2.3.1, which is the second snapshot based upon the OpenBSD 5.9 development branch.
Currently they are targeting a stable ABI/API sometime around March 2016 for the 2.3.X series.
Included in this update are ASN. 1 cleanups and some compliance fixes for RFC5280
Switched internally to time_t, with a check that the host OS supports 64bit time_t
Various TLS fixes, including the ability to check cert validity times with tls_peer_cert_not{before|after}
Fixed a reported memory leak in OBJ_obj2txt
***
Guide for Installing Ghost w/ Nginx on FreeBSD
A nice walkthrough for the week, we’ve found an article about how to install the Ghost blogging platform on FreeBSD 10.2.
For those who don’t know, Ghost is a MIT licensed blogging tool, started in 2012 by a former WordPress UI developer and is entirely coded in Node.js
While a port for FreeBSD does not yet exist (somebody get on that please), this tutorial can walk you through the process of getting it deployed manually
Most of the requirements are simple, www/node, www/npm and sqlite3.
With those installed, most of the steps are simply creating the username / home for ghost, and some “npm” setup.
The walkthrough even includes a handy rc.d script, making the possibility of a port seem much more likely
***
Adrian Chadd on 'Why attention to detail matters when you're a kernel developer
Adrian was correctly trolled in the FreeBSD embedded IRC chatroom and started looking at why the bridging performance in MIPS boards was so bad
120-150 mbit/sec is not really enough anymore
Using previous MIPS24k support as a starting point, Adrian managed to get HWPMC (Hardware Performance Monitoring Counters) working on MIPS74k
Using the data collected from the performance counters Adrian was able to figure out that packets were being copied in order to meet alignment requirements of the NIC and the FreeBSD networking stack. It turns out this is no longer a requirement for most modern Atheros NICs, so the workaround could be removed
Now performance was 180 mbit/sec
Next, on the receive side, only the TCP stack requires strict alignment, the ethernet stack does not, so offset the start point by 2 bytes so that TCP ends up aligned, and problem solved. Or not, no performance difference...
The problem appeared to be busdma, Ian Lepore had recently made improves in this area on armv6 and helpfully ported these over to MIPS
Now 420 mbit/sec. Getting better, but not as fast as Linux
After some further investigation, a missing ‘sync’ operation was added, and the memory caching was changed from writethrough to writeback
Things were so fast now, that the descriptor ring was being run through the ring so quickly as to hit the next descriptor that is still being setup. The first was to mark the first descriptor of a multi-descriptor packet as ‘empty’ until the entire chain was setup, so it would not be processed before the latter bits were done being added to the ring.
So now MIPS can bridge at 720 mbit/sec, and route 320 mbit/sec
Adrian wants to improve the routing speed and get it caught up to the bridging speed, but as always, free time is scarce.
***
Switching from OS X to FreeBSD
The story of a user who had used OS X since its beta, but 10.9 and 10.10, became more and more dissatisfied
They found they were spending too much time fighting with the system, rather than getting work done
They cover the new workstation they bought, and the process of getting FreeBSD going on it, including why they chose FreeBSD rather than PCBSD
Also covered it setting up a Lenovo X220 laptop
They setup the i3wm and mutt
The blog is very detailed and goes so far as to share a github repo of dotfiles and configuration files to ease the transition from OS X.
***
BeastieBits
The Stack behind Netflix's scaling
The Amiga port of NetBSD now has xorg support
NetBSD has announced EOL for v5.x to be November 9th
RetroArch ports allow playing PlayStation, Sega, Atari, etc., games on FreeBSD
OpenBSD booting on a 75mhz Cyrex system with 32MB RAM
Matthew Green reports Nouveau Nvidia can support GL with his latest commit
Releases!
OPNsense releases 15.7.18
pfSense releases 2.2.5
Feedback/Questions
Eric
Andrew
Joseph
Sean
Dustin
***
For those of you curious about Kris' new lighting here are the links to what he is using.
Softbox Light Diffuser
Full Spectrum 5500K CFL Bulb
***
1 hr 36 min
November 05, 2015 BSD-Schooling | BSD Now 114
Allan is out of town this week at another Developer Summit but we have a great episode coming up with Brian Callahan where we discuss BSD in education. Also, news & a lot of user feedback to get to, so sit back & relax, more BSD is coming your way right now!
1 hr 30 min
November 04, 2015114: BSD-Schooling
This week, Allan is out of town at another Developer Summit, but we have a great episode coming
This episode was brought to you by
alt="iXsystems - Enterprise Servers and Storage for Open Source" />
title="DigitalOcean">
src="/images/3.png" alt="Tarsnap - Online Backups for the Truly Paranoid" />
iX Systems Mission Complete
Submit your story of how you accomplished a mission with FreeBSD, FreeNAS, or iXsystems hardware, and you could win monthly prizes, and have your story featured in the FreeBSD Journal!
***
Headlines
WhatsApp founder, on how it got so HUGE
Wired has interviewed WhatsApp co-founder Brian Acton, about the infrastructure behind WhatsApp
WhatsApp manages 900 million users with a team of 50, while Twitter needs around 4,000 employees to manage 300 million users.
“FreeBSD has a nicely tuned network stack and extremely good reliability. We find managing FreeBSD installations to be quite straightforward.”
“Linux is a beast of complexity. FreeBSD has the advantage of being a single distribution with an extraordinarily good ports collection.”
“To us, it has been an advantage as we have had very few problems that have occurred at the OS level. With Linux, you tend to have to wrangle more and you want to avoid that if you can.”
“FreeBSD happened because both Jan and I have experience with FreeBSD from Yahoo!.”
Additional Coverage
***
User feedback in the SystemD vs BSD init
We have a very detailed blog post this week from Randy Westlund, about his experiences on Linux and BSD, contrasting the init systems.
What he finds is that while, it does make some things easier, such as writing a service file once, and having it run everywhere, the tradeoff comes in the complexity and lack of transparency.
Another area of concern was the reproducibility of boots, how in his examples on servers, there can often be times when services start in different orders, to save a few moments of boot-time.
His take on the simplicity of BSD’s startup scripts is that they are very easy to hack on and monitor, while not introducing the feature creep we have seen in sysd.
It will be interesting to see NextBSD / LaunchD and how it compares in the future!
***
Learn to embrace open source, or get buried
At the recent “All Things Open” conference, opensource.com interviewed Jim Salter
He describes how he first got started using FreeBSD to host his personal website
He then goes on to talk about starting FreeBSDWiki.net and what its goals were
The interview then talks about using Open Source at solve customers’ problems at his consulting firm
Finally, the talks about his presentation at AllThingsOpen: Move Over, Rsync
about switching to ZFS replication
***
HP’s CTO Urges businesses to avoid permissive licenses
Martin Fink went on a rant about the negative effects of license proliferation
While I agree that having too many new licenses is confusing and adds difficulty, I didn’t agree with his closing point
“He then ended the session with an extended appeal to move the open-source software industry away from permissive licenses like Apache 2.0 and toward copyleft licenses like the GPL”
“The Apache 2.0 license is currently the most widely used "permissive" license. But the thing that developers overlook when adopting it, he said, is that by using Apache they are also making a choice about how much work they will have to put into building any sort of community around the project. If you look at Apache-licensed projects, he noted, "you'll find that they are very top-heavy with 'governance' structures." Technical committees, working groups, and various boards, he said, are needed to make such projects function. But if you look at copyleft projects, he added, you find that those structures simply are not needed.”
There are plenty of smaller permissively licensed projects that do not have this sort of structure, infact, most of this structure comes from being an Apache run project, rather than from using the Apache or any other permissive license
Luckily, he goes on to state that the “OpenSwitch code is released under the Apache 2.0 license, he said, because the other partner companies viewed that as a requirement.”
“HP wanted to get networking companies and hardware suppliers on board. In order to get all of the legal departments at all of the partners to sign on to the project, he said, HP was forced to go with a permissive license”
Hopefully the trend towards permissive licenses continues
Additionally, in a separate LWN post:
RMS Says: “I am not saying that competitors to a GNU package are unjust or bad -- that isn't necessarily so. The pertinent point is that they are competitors. The goal of the GNU Project is for GNU to win the competition. Each GNU package is a part of the GNU system, and should contribute to the success of the GNU Project. Thus, each GNU package should encourage people to run other GNU packages rather than their competitors -- even competitors which are free software.”
Never thought I’d see RMS espousing vendor lock-in
***
Interview - Brian Callahan - [email protected] / @twitter
The BSDs in Education
***
News Roundup
Digital Libraries in Africa making use of DragonflyBSD and HAMMER
In the international development context, we have an interesting post from Michael Wilson of the PeerCorps Trust Fund.
They are using DragonFlyBSD and FreeBSD to support the Tanzanian Digital Library Initiative in very resource-limited settings.
They cite among the most important reasons for using BSD as the availability and quality of the documentation, as well as the robustness of the filesystems, both ZFS and HAMMER.
Their website is now online over at (http://www.tandli.com/) , check it out to see exactly how BSD is being used in the field
***
netflix hits > 65gbps from a single freebsd box
A single socket server, with a high end Xeon E5 processor and a dual ported Chelsio T580 (2x 40 Gbps ports) set a netflix record pushing over 65 Gbps of traffic from a single machine
The videos were being pushed from SSDs and some new high end NVMe devices
The previous record at Netflix was 52 Gbps from a single machine, but only with very experimental settings. The current work is under much more typical settings
By the end of that night, traffic surged to over 70 Gbps
Only about 10-15% of that traffic was encrypted with the in-kernel TLS engine that Netflix has been working on with John-Mark Gurney
It was reported that the machine was only using about 65% cpu, and had plenty of head room
If I remember the discussion correctly, there were about 60,000 streams running off the machine
***
Lumina Desktop 0.8.7 has been released
A very large update has landed for PC-BSD’s Lumina desktop
A brand new “Start” menu has been added, which enables quick launch of favorite apps, pinning to desktop / favorites and more.
Desktop icons have been overhauled, with better font support, and a new Grid system for placement of icons.
Support for other BSD’s such as DragonFly has been improved, along with TONS of internal changes to functionality and backends.
Almost too many things to list here, but the link above will have full details, along with screenshots.
***
A LiveUSB for NetBSD has been released by Jibbed
After a three year absence, the Jibbed project has come back with a Live USB image for NetBSD!
The image contains NetBSD 7.0, and is fully R/W, allowing you to run the entire system from a single USB drive.
Images are available for 8Gb and 4Gb sticks (64bit and 32bit respectively), along with VirtualBox images as well
For those wanting X, it includes both X and TWM, although ‘pkgin’ is available, so you can quickly add other desktops to the image
***
Beastie Bits
After recent discussions of revisiting WX support in Mozilla Firefox, David Coppa has flipped the switch to enable it for OpenBSD users running -current.
Using the vt(4) driver to change console resolution
The FreeBSD Foundation gives a great final overview of the Grace Hopper Conference
A dialog about Compilers in the (BSD) base system
One upping their 48-core work from July, The Semihalf team shows off their the 96-core SMP support for FreeBSD on Cavium ThunderX (ARMv8 architecture
NYC Bug's November meeting will be featuring a talk by Stephen R. Bourne
New not-just-BSD postcast, hosted by two OpenBSD devs Brandon Mercer and Joshua Stein
Feedback/Questions
Stefan
Zach
Jake
Corey
Robroy
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to
[email protected]
1 hr 30 min
October 29, 2015 What’s Next for BSD? | BSD Now 113
Coming up on this week’s episode, we have an interview Jordan Hubbard about the new NextBSD project & the future of BSD. Also Allan's re-cap of the OpenZFS conference & of course your latest news!
2 hr 20 min

About BSD Now

From the publisher's feed

Created by three guys who love BSD, we cover the latest news and have an extensive series of tutorials, as well as interviews with various people from all areas of the BSD community. It also serves as…