BSD Now

By JT PenningtonNews Education How To Tech News

BSD Now episodes

June 10, 201593: Stacked in Our Favor
We're at BSDCan this week, but fear not! We've got a great interview with Sepherosa Ziehau, a DragonFly developer, about their network stack. After that, we'll be discussing different methods of containment and privilege separation. Assuming no polar bears eat us, we'll be back next week with more BSD Now - the place to B.. SD.
This episode was brought to you by
Interview - Sepherosa Ziehau - [email protected]
Features of DragonFlyBSD's network stack
Discussion
Comparing containment methods and privilege separation
chroot, jails, systrace, capsicum, filesystem permissions, separating users
***
Feedback/Questions
Brad writes in
Anonymous writes in
Benjamin writes in
Jeroen writes in
***
1 hr 9 min
June 03, 201592: BSD After Midnight
Coming up this week, we'll be chatting with Lucas Holt, founder of MidnightBSD. It's a slightly lesser-known fork of FreeBSD, with a focus on easy desktop use. We'll find out what's different about it and why it was created. Answers to your emails and all this week's news, on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
Zocker, it's like docker on FreeBSD
Containment is always a hot topic, and docker has gotten a lot of hype in Linux land in the last couple years - they're working on native FreeBSD support at the moment
This blog post is about a docker-like script, mainly for ease-of-use, that uses only jails and ZFS in the base system
In total, it's 1,500 lines of shell script
The post goes through the process of using the tool, showing off all the subcommands and explaining the configuration
In contrast to something like ezjail, Zocker utilizes the jail.conf system in the 10.x branch
***
Patrol Read in OpenBSD
OpenBSD has recently imported some new code to support the Patrol Read function of some RAID controllers
In a nutshell, Patrol Read is a function that lets you check the health of your drives in the background, similar to a zpool "scrub" operation
The goal is to protect file integrity by detecting drive failures before they can damage your data
It detects bad blocks and prevents silent data corruption, while marking any bad sectors it finds
***
HAMMER 2 improvements
DragonFly BSD has been working on the second generation HAMMER FS
It now uses LZ4 compression by default, which we've been big fans of in ZFS
They've also switched to a faster CRC algorithm, further improving HAMMER's performance, especially when using iSCSI
***
FreeBSD foundation May update
The FreeBSD foundation has published another update newsletter, detailing some of the things they've been up to lately
In it, you'll find some development status updates: notably more ARM64 work and the addition of 64 bit Linux emulation
Some improvements were also made to FreeBSD's release building process for non-X86 architectures
There's also an AsiaBSDCon recap that covers some of the presentations and the dev events
They also have an accompanying blog post where Glen Barber talks about more sysadmin and clusteradm work at NYI
***
Interview - Lucas Holt - [email protected] / @midnightbsd
MidnightBSD
News Roundup
The launchd on train is never coming
Replacement of init systems has been quite controversial in the last few years
Fortunately, the BSDs have avoided most of that conflict thus far, but there have been a few efforts made to port launchd from OS X
This blog post details the author's opinion on why he thinks we're never going to have launchd in any of the BSDs
Email us your thoughts on the matter
***
Native SSH comes to… Windows
In what may be the first (and last) mention of Microsoft on BSD Now...
They've just recently announced that PowerShell will get native SSH support in the near future
It's not based on the commercial SSH either, it's the same one from OpenBSD that we already use everywhere
Up until now, interacting between BSD and Windows has required something like PuTTY, WinSCP, FileZilla or Cygwin - most of which are based on really outdated versions
The announcement also promises that they'll be working with the OpenSSH community, so we'll see how many Microsoft-submitted patches make it upstream (or how many donations they make)
***
Moving to FreeBSD
This blog post describes a long-time Linux user's first BSD switching experience
The author first talks about his Linux journey, eventually coming to love the more customization-friendly systems, but the journey ended with systemd
After doing a bit of research, he gave FreeBSD a try and ended up liking it - the rest of the post mostly covers why that is
He also plans to write about his experience with other BSDs, and is writing some tutorials too - we'll check in with him again later on
***
Feedback/Questions
Adam writes in
Dan writes in
Ivan writes in
Josh writes in
***
1 hr 8 min
May 27, 201591: Vox Populi
This week on the show, we've got something pretty different. We went to a Linux convention and asked various people if they've ever tried BSD and what they know about it. Stay tuned for that, all this week's news and, of course, answers to your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
LUKS in OpenBSD
Last week, we were surprised to find out that DragonFlyBSD has support for dm-crypt, sometimes referred to as LUKS (Linux Unified Key Setup)
It looks like they might not be the only BSD with support for it for much longer, as OpenBSD is currently reviewing a patch for it as well
LUKS would presumably be an additional option in OpenBSD's softraid system, which already provides native disk encryption
Support hasn't been officially committed yet, it's still going through testing, but the code is there if you want to try it out and report your findings
If enabled, this might pave the way for the first (semi-)cross platform encryption scheme since the demise of TrueCrypt (and maybe other BSDs will get it too in time)
***
FreeBSD gets 64bit Linux emulation
For those who might be unfamiliar, FreeBSD has an emulation layer to run Linux-only binaries (as rare as they may be)
The most common use case is for desktop users, enabling them to run proprietary applications like Adobe Flash or Skype
Similar systems can also be found in NetBSD and OpenBSD (though disabled by default on the latter)
However, until now, it's only supported binaries compiled for the i386 architecture
This new update, already committed to -CURRENT, will open some new possibilities that weren't previously possible
Meanwhile, HardenedBSD considers removing the emulation layer entirely
***
BSD at Open Source Conference 2015 Nagoya
We've covered the Japanese NetBSD users group setting up lots of machines at various conferences in the past, but now they're expanding
Their latest report includes many of the NetBSD things you'd expect, but also a couple OpenBSD machines
Some of the NetBSD ones included a Power Mac G4, SHARP NetWalker, Cubieboard2 and the not-so-foreign Raspberry Pi
One new addition of interest is the OMRON LUNA88k, running the luna88k port of OpenBSD
There was even an old cell phone running Windows games on NetBSD
Check the mailing list post for some links to all of the nice pictures
***
LLVM introduces OpenMP support
One of the things that has kept some people in the GCC camp is the lack of OpenMP support in LLVM
According to the blog post, it "enables Clang users to harness full power of modern multi-core processors with vector units"
With Clang being the default in FreeBSD, Bitrig and OS X, and with some other BSDs exploring the option of switching, the need for this potential speed boost was definitely there
This could also open some doors for more BSD in the area of high performance computing, putting an end to the current Linux monopoly
***
Interview - Eric, FSF, John, Jose, Kris and Stewart
Various "man on the street" style mini-interviews
News Roundup
BSD-licensed gettext replacement
If you've ever installed ports on any of the BSDs, you've probably had GNU's gettext pulled in as a dependency
Wikipedia says "gettext is an internationalization and localization (i18n) system commonly used for writing multilingual programs on Unix-like computer operating systems"
A new BSD-licensed rewrite has begun, with the initial version being for NetBSD (but it's likely to be portable)
If you've got some coding skills, get involved with the project - the more freely-licensed replacements, the better
***
Unix history git repo
A git repository was recently created to show off some Unix source code history
The repository contains 659 thousand commits and 2306 merges
You can see early 386BSD commits all the way up to some of the more modern FreeBSD code
If you want to browse through the giant codebase, it can be a great history lesson
***
PCBSD 10.1.2 and Lumina updates
We mentioned 10.1.1 being released last week (and all the cool features a couple weeks before) but now 10.1.2 is out
This minor update contained a few hotfixes: RAID-Z installation, cache and log devices and the text-only installer in UEFI mode
There's also a new post on the PCBSD blog about Lumina, answering some frequently asked questions and giving a general status update
***
Feedback/Questions
Jake writes in
Van writes in
Anonymous writes in
Dominik writes in (text answer)
Chris writes in
***
Mailing List Gold
Death by chocolate
***
1 hr 13 min
May 20, 201590: ZFS Armistice
This time on the show, we'll be chatting with Jed Reynolds about ZFS. He's been using it extensively on a certain other OS, and we can both learn a bit about the other side's implementation. Answers to your questions and all this week's news, coming up on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
Playing with sandboxing
Sandboxing and privilege separation are popular topics these days - they're the goal of the new "shill" scripting language, they're used heavily throughout OpenBSD, and they're gaining traction with the capsicum framework
This blog post explores capsicum in FreeBSD, some of its history and where it's used in the base system
They also include some code samples so you can verify that capsicum is actually denying the program access to certain system calls
Check our interview about capsicum from a while back if you haven't seen it already
***
OpenNTPD on by default
OpenBSD has enabled ntpd by default in the installer, rather than prompting the user if they want to turn it on
In nearly every case, you're going to want to have your clock synced via NTP
With the HTTPS constraints feature also enabled by default, this should keep the time checked and accurate, even against spoofing attacks
Lots of problems can be traced back to the time on one system or another being wrong, so this will also eliminate some of those cases
For those who might be curious, they're using the "pool.ntp.org" cluster of addresses and google for HTTPS constraints (but these can be easily changed)
***
FreeBSD workshop in Landshut
We mentioned a BSD installfest happening in Germany a few weeks back, and the organizer wrote in with a review of the event
The installfest instead became a "FreeBSD workshop" session, introducing curious new users to some of the flagship features of the OS
They covered when to use UFS or ZFS, firewall options, the release/stable/current branches and finally how to automate installations with Ansible
If you're in south Germany and want to give similar introduction talks or Q&A sessions about the other BSDs, get in touch
We'll hear more from him about how it went in the feedback section today
***
Swap encryption in DragonFly
Doing full disk encryption is very important, but something that people sometimes overlook is encrypting their swap
This can actually be more important than the contents of your disks, especially if an unencrypted password or key hits your swap (as it can be recovered quite easily)
DragonFlyBSD has added a new experimental option to automatically encrypt your swap partition in fstab
There was another way to do it previously, but this is a lot easier
You can achieve similar results in FreeBSD by adding ".eli" to the end of the swap device in fstab, there are a few steps to do it in NetBSD and swap in OpenBSD is encrypted by default
A one-time key will be created and then destroyed in each case, making recovery of the plaintext nearly impossible
***
Interview - Jed Reynolds - [email protected] / @jed_reynolds
Comparing ZFS on Linux and FreeBSD
News Roundup
USB thermometer on OpenBSD
So maybe you've got BSD on your server or router, maybe NetBSD on a toaster, but have you ever used a thermometer with one?
This blog post introduces the RDing TEMPer Gold USB thermometer, a small device that can tell the room temperature, and how to get it working on OpenBSD
Wouldn't you know it, OpenBSD has a native "ugold" driver to support it with the sensors framework
How useful such a device would be is another story though
***
NAS4Free now on ARM
We talk a lot about hardware for network-attached storage devices on the show, but ARM doesn't come up a lot
That might be changing soon, as NAS4Free has just released some ARM builds
These new (somewhat experimental) images are based on FreeBSD 11-CURRENT
Included in the announcement is a list of fully-supported and partially-supported hardware that they've tested it with
If anyone has experience with running a NAS on slightly exotic hardware, write in to us
***
pkgsrcCon 2015 CFP and info
This year's pkgsrcCon will be in Berlin, Germany on July 4th and 5th
They're looking for talk proposals and ideas for things you'd like to see
If you or your company uses pkgsrc, or if you're just interested in NetBSD in general, it would be a good event to check out
***
BSDTalk episode 253
BSDTalk has released another new episode
In it, he interviews George Neville-Neil about the 2nd edition of "The Design and Implementation of the FreeBSD Operating System"
They discuss what's new since the last edition, who the book's target audience is and a lot more
We're up to 90 episodes now, slowly catching up to Will...
***
Feedback/Questions
Dominik writes in
Brad writes in
Corvin writes in
James writes in
***
1 hr 14 min
May 13, 201589: Exclusive Disjunction
This week on the show, we'll be talking to Mike Larkin about various memory protections in OpenBSD. We'll cover recent WX improvements, SSP, ASLR, PIE and all kinds of acronyms! We've also got a bunch of news and answers to your questions, coming up on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
OpenSMTPD for the whole family
Setting up a BSD mail server is something a lot of us are probably familiar with doing, at least for our own accounts
This article talks about configuring a home mail server too, but even for the other people you live with
After convincing his wife to use their BSD-based Owncloud server for backups, the author talks about moving her over to his brand new OpenSMTPD server too
If you've ever run a mail server and had to deal with greylisting, you'll appreciate the struggle he went through
In the end, BGP-based list distribution saved the day, and his family is being served well by a BSD box
***
NetBSD on the Edgerouter Lite
We've talked a lot about building your own BSD-based router on the show, but not many of the devices we mention are in the same price range as consumer devices
The EdgeRouter Lite, a small MIPS-powered machine, is starting to become popular (and is a bit cheaper)
A NetBSD developer has been hacking on it, and documents the steps to get a working install in this blog post
The process is fairly simple, and you can cross-compile your own installation image on any CPU architecture (even from another BSD!)
OpenBSD and FreeBSD also have some support for these devices
***
Bitrig at NYC*BUG
The New York City BSD users group has semi-regular meetings with presentations, and this time the speaker was John Vernaleo
John discussed Bitrig, an OpenBSD fork that we've talked about a couple times on the show
He talks about what they've been up to lately, why they're doing what they're doing, difference in supported platforms
Ports and packages between the two projects are almost exactly the same, but he covers the differences in the base systems, how (some) patches get shared between the two and finally some development model differences
***
OPNsense, meet HardenedBSD
Speaking of forks, two FreeBSD-based forked projects we've mentioned on the show, HardenedBSD and OPNsense, have decided to join forces
Backporting their changes to the 10-STABLE branch, HardenedBSD hopes to introduce some of their security additions to the OPNsense codebase
Paired up with LibreSSL, this combination should offer a good solution for anyone wanting a BSD-based firewall with an easy web interface
We'll cover more news on the collaboration as it comes out
***
Interview - Mike Larkin - [email protected] / @mlarkin2012
Memory protections in OpenBSD: WX, ASLR, PIE, SSP
News Roundup
A closer look at FreeBSD
The week wouldn't be complete without at least one BSD article making it to a mainstream tech site
This time, it's a high-level overview of FreeBSD, some of its features and where it's used
Being that it's an overview article on a more mainstream site, you won't find anything too technical - it covers some BSD history, stability, ZFS, LLVM and Clang, ports and packages, jails and the licensing
If you have any BSD-curious Linux friends, this might be a good one to send to them
***
Linksys NSLU2 and NetBSD
The Linksys NSLU2 is a proprietary network-attached storage device introduced back in 2004
"About 2 months ago I set a goal to run some kind of BSD on the spare Linksys NSLU2 I had. This was driven mostly by curiosity, after listening to a few BSDNow episodes and becoming a regular listener [...]"
After doing some research, the author of this post discovered that he could cross-compile NetBSD for the device straight from his Linux box
If you've got one of these old devices kicking around, check out this write-up and get some BSD action on there
***
OpenBSD disklabel templates
We've covered OpenBSD's "autoinstall" feature for unattended installations in the past, but one area where it didn't offer a lot of customization was with the disk layout
With a few recent changes, there are now a series of templates you can use for a completely customized partition scheme
This article takes you through the process of configuring an autoinstall answer file and adding the new section for disklabel
Combine this new feature with our -stable iso tutorial, and you could deploy completely patched and customized images en masse pretty easily
***
FreeBSD native ARM builds
FreeBSD -CURRENT builds for the ARM CPU architecture can now be built natively, without utilities that aren't part of base
Some of the older board-specific kernel configuration files have been replaced, and now the "IMC6" target is used
This goes along with what we read in the most recent quarterly status report - ARM is starting to get treated as a first class citizen
***
Feedback/Questions
Sean writes in
Ron writes in
Charles writes in
Bostjan writes in
***
1 hr 4 min
May 06, 201588: Below the Clouds
This time on the show, we'll be talking with Ed Schouten about CloudABI. It's a new application binary interface with a strong focus on isolation and restricted capabilities. As always, all this week's BSD news and answers to your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
FreeBSD quarterly status report
The FreeBSD team has posted a report of the activities that went on between January and March of this year
As usual, it's broken down into separate reports from the various teams in the project (ports, kernel, virtualization, etc)
The ports team continuing battling the flood of PRs, closing quite a lot of them and boasting nearly 7,000 commits this quarter
The core team and cluster admins dealt with the accidental deletion of the Bugzilla database, and are making plans for an improved backup strategy within the project going forward
FreeBSD's future release support model was also finalized and published in February, which should be a big improvement for both users and the release team
Some topics are still being discussed internally, mainly MFCing ZFS ARC responsiveness patches to the 10 branch and deciding whether to maintain or abandon C89 support in the kernel code
Lots of activity is happening in bhyve, some of which we've covered recently, and a number of improvements were made this quarter
Clang, LLVM and LLDB have been updated to the 3.6.0 branch in -CURRENT
Work to get FreeBSD booting natively on the POWER8 CPU architecture is also still in progress, but it does boot in KVM for the time being
The project to replace forth in the bootloader with lua is in its final stages, and can be used on x86 already
ASLR work is still being done by the HardenedBSD guys, and their next aim is position-independent executable
The report also touches on multipath TCP support, the new automounter, opaque ifnet, pkgng updates, secureboot (which should be in 10.2-RELEASE), GNOME and KDE on FreeBSD, PCIe hotplugging, nested kernel support and more
Also of note: work is going on to make ARM a Tier 1 platform in the upcoming 11.0-RELEASE (and support for more ARM boards is still being added, including ARM64)
***
OpenBSD 5.7 released
OpenBSD has formally released another new version, complete with the giant changelog we've come to expect
In the hardware department, 5.7 features many driver improvements and fixes, as well as support for some new things: USB 3.0 controllers, newer Intel and Atheros wireless cards and some additional 10gbit NICs
If you're using one of the Soekris boards, there's even a new driver to manipulate the GPIO and LEDs on them - this has some fun possibilities
Some new security improvements include: SipHash being sprinkled in some areas to protect hashing functions, big WX improvements in the kernel space, static PIE on all architectures, deterministic "random" functions being replaced with strong randomness, and support for remote logging over TLS
The entire source tree has also been audited to use reallocarray, which unintentionally saved OpenBSD's libc from being vulnerable to earlier attacks affecting other BSDs' implementations
Being that it's OpenBSD, a number of things have also been removed from the base system: procfs, sendmail, SSLv3 support and loadable kernel modules are all gone now (not to mention the continuing massacre of dead code in LibreSSL)
Some people seem to be surprised about the removal of loadable modules, but almost nothing utilized them in OpenBSD, so it was really just removing old code that no one used anymore - very different from FreeBSD or Linux in this regard, where kernel modules are used pretty heavily
BIND and nginx have been taken out, so you'll need to either use the versions in ports or switch to Unbound and the in-base HTTP daemon
Speaking of httpd, it's gotten a number of new features, and has had time to grow and mature since its initial debut - if you've been considering trying it out, now would be a great time to do so
This release also includes the latest OpenSSH (with stronger fingerprint types and host key rotation), OpenNTPD (with the HTTPS constraints feature), OpenSMTPD, LibreSSL and mandoc
Check the errata page for any post-release fixes, and the upgrade guide for specific instructions on updating from 5.6
Groundwork has also been laid for some major SMP scalability improvements - look forward to those in future releases
There's a song and artwork to go along with the release as always, and CDs should be arriving within a few days - we'll show some pictures next week
Consider picking one up to support the project (and it's the only way to get puffy stickers)
For those of you paying close attention, the banner image for this release just might remind you of a certain special episode of BSD Now...
***
Tor-BSD diversity project
We've talked about Tor on the show a few times, and specifically about getting more of the network on BSD (Linux has an overwhelming majority right now)
A new initiative has started to do just that, called the Tor-BSD diversity project
"Monocultures in nature are dangerous, as vulnerabilities are held in common across a broad spectrum. Diversity means single vulnerabilities are less likely to harm the entire ecosystem. [...] A single kernel vulnerability in GNU/Linux that impacting Tor relays could be devastating. We want to see a stronger Tor network, and we believe one critical ingredient for that is operating system diversity."
In addition to encouraging people to put up more relays, they're also continuing work on porting the Tor Browser Bundle to BSD, so more desktop users can have easy access to online privacy
There's an additional progress report for that part specifically, and it looks like most of the work is done now
Engaging the broader BSD community about Tor and fixing up the official documentation are also both on their todo list
If you've been considering running a node to help out, there's always our handy tutorial on getting set up
***
PC-BSD 10.1.2-RC1 released
If you want a sneak peek at the upcoming PC-BSD 10.1.2, the first release candidate is now available to grab
This quarterly update includes a number of new features, improvements and even some additional utilities
PersonaCrypt is one of them - it's a new tool for easily migrating encrypted home directories between systems
A new "stealth mode" option allows for a one-time login, using a blank home directory that gets wiped after use
Similarly, a new "Tor mode" allows for easy tunneling of all your traffic through the Tor network
IPFW is now the default firewall, offering improved VIMAGE capabilities
The life preserver backup tool now allows for bare-metal restores via the install CD
ISC's NTP daemon has been replaced with OpenNTPD, and OpenSSL has been replaced with LibreSSL
It also includes the latest Lumina desktop, and there's another post dedicated to that
Binary packages have also been updated to fresh versions from the ports tree
More details, including upgrade instructions, can be found in the linked blog post
***
Interview - Ed Schouten - [email protected] / @edschouten
CloudABI
News Roundup
Open Household Router Contraption
This article introduces OpenHRC, the "Open Household Router Contraption"
In short, it's a set of bootstrapping scripts to turn a vanilla OpenBSD install into a feature-rich gateway device
It also makes use of Ansible playbooks for configuration, allowing for a more "mass deployment" type of setup
Everything is configured via a simple text file, and you end up with a local NTP server, DHCP server, firewall (obviously) and local caching DNS resolver - it even does DNSSEC validation
All the code is open source and on Github, so you can read through what's actually being changed and put in place
There's also a video guide to the entire process, if you're more of a visual person
***
OPNsense 15.1.10 released
Speaking of BSD routers, if you're looking for a "prebuilt and ready to go" option, OPNsense has just released a new version
15.1.10 drops some of the legacy patches they inherited from pfSense, aiming to stay closer to the mainline FreeBSD source code
Going along with this theme, they've redone how they do ports, and are now kept totally in sync with the regular ports tree
Their binary packages are now signed using the fingerprint-style method, various GUI menus have been rewritten and a number of other bugs were fixed
NanoBSD-based images are also available now, so you can try it out on hardware with constrained resources as well
Version 15.1.10.1 was released shortly thereafter, including a hotfix for VLANs
***
IBM Workpad Z50 and NetBSD
Before the infamous netbook fad came and went, IBM had a handheld PDA device that looked pretty much the same
Back in 1999, they released the Workpad Z50 with Windows CE, sporting a 131MHz MIPS CPU, 16MB of RAM and a 640x480 display
You can probably tell where this is going... the article is about installing NetBSD it
"What prevents me from taking my pristine Workpad z50 to the local electronics recycling facility is NetBSD. With a little effort it is possible to install recent versions of NetBSD on the Workpad z50 and even have XWindows running"
The author got pkgsrc up and running on it too, and cleverly used distcc to offload the compiling jobs to something a bit more modern
He's also got a couple videos of the bootup process and running Xorg (neither of which we'd call "speedy" by any stretch of the imagination)
***
FreeBSD from the trenches
The FreeBSD foundation has a new blog post up in their "from the trenches" series, detailing FreeBSD in some real-world use cases
In this installment, Glen Barber talks about how he sets up all his laptops with ZFS and GELI
While the installer allows for an automatic ZFS layout, Glen notes that it's not a one-size-fits-all thing, and goes through doing everything manually
Each command is explained, and he walks you through the process of doing an encrypted installation on your root zpool
***
Broadwell in DragonFly
DragonFlyBSD has officially won the race to get an Intel Broadwell graphics driver
Their i915 driver has been brought up to speed with Linux 3.14's, adding not only Broadwell support, but many other bugfixes for other cards too
It's planned for commit to the main tree very soon, but you can test it out with a git branch for the time being
***
Feedback/Questions
Bostjan writes in
Hunter writes in
Hrishi writes in
Clint writes in
Sergei writes in
***
Mailing List Gold
How did you guess
***
1 hr 34 min
April 29, 201587: On the List
Coming up this time on the show, we'll be speaking with Christos Zoulas, a NetBSD security officer. He's got a new project called blacklistd, with some interesting possibilities for stopping bruteforce attacks. We've also got answers to your emails and all this week's news, on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
New PAE support in OpenBSD
OpenBSD has just added Physical Address Extention support to the i386 architecture, but it's probably not what you'd think of when you hear the term
In most operating systems, PAE's main advantage is to partially circumvent the 4GB memory limit on 32 bit platforms - this version isn't for that
Instead, this change specifically allows the system to use the No-eXecute Bit of the processor for the userland, further hardening the in-place memory protections
Other operating systems enable the CPU feature without doing anything to the page table entries, so they do get the available memory expansion, but don't get the potential security benefit
As we discussed in a previous episode, the AMD64 platform already saw some major WX kernel and userland improvements - the i386 kernel reworking will begin shortly
Not all CPUs support this feature, but, if yours supports NX, this will improve upon the previous version of WX that was already there
The AMD64 improvements will be in 5.7, due out in just a couple days as of when we're recording this, but the i386 improvements will likely be in 5.8
***
Booting Windows in bhyve
Work on FreeBSD's bhyve continues, and a big addition is on the way
Thus far, bhyve has only been able to boot operating systems with a serial console - no VGA, no graphics, no Windows
This is finally changing, and a teasing screenshot of Windows Server was recently posted on Twitter
Graphics emulation is still in the works; this image was taken by booting headless and using RDP
A lot of the needed code is being committed to -CURRENT now, but the UEFI portion of it requires a bit more development (and the aim for that is around the time of BSDCan)
Not a lot of details on the matter currently, but we'll be sure to bring you more info as it comes out
Are you more interested in bhyve or Xen on FreeBSD? Email us your thoughts
***
MidnightBSD 0.6 released
MidnightBSD is a smaller project we've not covered a lot on the show before
It's an operating system that was forked from FreeBSD back in the 6.1 days, and their focus seems to be on ease-of-use
They also have their own, smaller version of FreeBSD ports, called "mports"
If you're already using it, this new version is mainly a security and bugfix release
It syncs up with the most recent FreeBSD security patches and gets a lot of their ports closer to the latest versions
You can check their site for more information about the project
We're trying to get the lead developer to come on for an interview, but haven't heard anything back yet
***
OpenBSD rewrites the file utility
We're all probably familiar with the traditional file command - it's been around since the 1970s
For anyone who doesn't know, it's used to determine what type of file something actually is
This tool doesn't see a lot of development these days, and it's had its share of security issues as well
Some of those security issues remain unfixed in various BSDs even today, despite being publicly known for a while
It's not uncommon for people to run file on random things they download from the internet, maybe even as root, and some of the previous bugs have allowed file to overwrite other files or execute code as the user running it
When you think about it, file was technically designed to be used on untrusted files
OpenBSD developer Nicholas Marriott, who also happens to be the author of tmux, decided it was time to do a complete rewrite - this time with modern coding practices and the usual OpenBSD scrutiny
This new version will, by default, run as an unprivileged user with no shell, and in a systrace sandbox, strictly limiting what system calls can be made
With these two things combined, it should drastically reduce the damage a malicious file could potentially do
Ian Darwin, the original author of the utility, saw the commit and replied, in what may be a moment in BSD history to remember
It'll be interesting to see if the other BSDs, OS X, Linux or other UNIXes consider adopting this implementation in the future - someone's already thrown together an unofficial portable version
Coincidentally, the lead developer and current maintainer of file just happens to be our guest today…
***
Interview - Christos Zoulas - [email protected]
blacklistd and NetBSD advocacy
News Roundup
GSoC-accepted BSD projects
The Google Summer of Code people have published a list of all the projects that got accepted this year, and both FreeBSD and OpenBSD are on that list
FreeBSD's list includes: NE2000 device model in userspace for bhyve, updating Ficl in the bootloader, type-aware kernel virtual memory access for utilities, JIT compilation for firewalls, test cluster automation, Linux packages for pkgng, an mtree parsing and manipulation library, porting bhyve to ARM-based platforms, CD-ROM emulation in CTL, libc security extensions, gptzfsboot support for dynamically discovering BEs during startup, CubieBoard support, a bhyve version of the netmap virtual passthrough for VMs, PXE support for FreeBSD guests in bhyve and finally.. memory compression and deduplication
OpenBSD's list includes: asynchronous USB transfer submission from userland, ARM SD/MMC & controller driver in libsa, improving USB userland tools and ioctl, automating module porting, implementing a KMS driver to the kernel and, wait for it... porting HAMMER FS to OpenBSD
We'll be sure to keep you up to date on developments from both projects
Hopefully the other BSDs will make the cut too next year
***
FreeBSD on the Gumstix Duovero
If you're not familiar with the Gumstix Duovero, it's an dual core ARM-based computer-on-module
They actually look more like a stick of RAM than a mini-computer
This article shows you how to build a FreeBSD -CURRENT image to run on them, using crochet-freebsd
If anyone has any interesting devices like this that they use BSD on, write up something about it and send it to us
***
EU study recommends OpenBSD
A recent study by the European Parliament was published, explaining that more funding should go into critical open source projects and tools
This is especially important, in all countries, after the mass surveillance documents came out
"[...] the use of open source computer operating systems and applications reduces the risk of privacy intrusion by mass surveillance. Open source software is not error free, or less prone to errors than proprietary software, the experts write. But proprietary software does not allow constant inspection and scrutiny by a large community of experts."
The report goes on to mention users becoming more and more security and privacy-aware, installing additional software to help protect themselves and their traffic from being spied on
Alongside Qubes, a Linux distro focused on containment and isolation, OpenBSD got a special mention: "Proactive security and cryptography are two of the features highlighted in the product together with portability, standardisation and correctness. Its built-in cryptography and packet filter make OpenBSD suitable for use in the security industry, for example on firewalls, intrusion-detection systems and VPN gateways"
Reddit, Undeadly and Hacker News also had some discussion, particularly about corporations giving back to the BSDs that they make use of in their infrastructure - something we've discussed with Voxer and M:Tier before
***
FreeBSD workflow with Git
If you're interested in contributing to FreeBSD, but aren't a big fan of SVN, they have a Github mirror too
This mailing list post talks about interacting between the official source repository and the Git mirror
This makes it easy to get pull requests merged into the official tree, and encourages more developers to get involved
***
Feedback/Questions
Sean writes in
Bryan writes in
Sean writes in
Charles writes in
***
1 hr 22 min
April 22, 201586: Business as Usual
Coming up this time on the show, we'll be chatting with Antoine Jacoutot about how M:Tier uses BSD in their business. After that, we'll be discussing the different release models across the BSDs, and which style we like the most. As always, answers to your emails and all the latest news, on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
Optimizing TLS for high bandwidth applications
Netflix has released a report on some of their recent activities, pushing lots of traffic through TLS on FreeBSD
TLS has traditionally had too much overhead for the levels of bandwidth they're using, so this pdf outlines some of their strategy in optimizing it
The sendfile() syscall (which nginx uses) isn't available when data is encrypted in userland
To get around this, Netflix is proposing to add TLS support to the FreeBSD kernel
Having encrypted movie streams would be pretty neat
***
Crypto in unexpected places
OpenBSD is somewhat known for its integrated cryptography, right down to strong randomness in every place you could imagine (process IDs, TCP initial sequence numbers, etc)
One place you might not expect crypto to be used (or even needed) is in the "ping" utility, right? Well, think again
David Gwynne recently committed a change that adds MAC to the ping timestamp payload
By default, it'll be filled with a ChaCha stream instead of an unvarying payload, and David says "this lets us have some confidence that the timestamp hasn't been damaged or tampered with in transit"
Not only is this a security feature, but it should also help detect dodgy or malfunctioning network equipment going forward
Maybe we can look forward to a cryptographically secure "echo" command next...
***
Broadwell in DragonFly
The DragonFlyBSD guys have started a new page on their wiki to discuss Broadwell hardware and its current status
Matt Dillon, the project lead, recently bought some hardware with this chipset, and lays out what works and what doesn't work
The two main show-stoppers right now are the graphics and wireless, but they have someone who's already making progress with the GPU support
Wireless support will likely have to wait until FreeBSD gets it, then they'll port it back over
None of the BSDs currently have full Broadwell support, so stay tuned for further updates
***
DIY NAS software roundup
In this blog post, the author compares a few different software solutions for a network attached storage device
He puts FreeNAS, one of our favorites, up against a number of opponents - both BSD and Linux-based
NAS4Free gets an honorable mention as well, particularly for its lower hardware requirements and sleek interface
If you've been thinking about putting together a NAS, but aren't quite comfortable enough to set it up by yourself yet, this article should give you a good view of the current big names
Some competition is always good, gotta keep those guys on their toes
***
Interview - Antoine Jacoutot - [email protected] / @ajacoutot
OpenBSD at M:Tier, business adoption of BSD, various topics
News Roundup
OpenBSD on DigitalOcean
When DigitalOcean rolled out initial support for FreeBSD, it was a great step in the right direction - we hoped that all the other BSDs would soon follow
This is not yet the case, but a blog article here has details on how you can install OpenBSD (and likely the others too) on your VPS
Using a -current snapshot and some swapfile trickery, it's possible to image an OpenBSD ramdisk installer onto an unmounted portion of the virtual disk
After doing so, you just boot from their web UI-based console and can perform a standard installation
You will have to pay special attention to some details of the disk layout, but this article takes you through the entire process step by step
***
Initial ARM64 support lands in FreeBSD
The ARM64 architecture, sometimes called ARMv8 or AArch64, is a new generation of CPUs that will mostly be in embedded devices
FreeBSD has just gotten support for this platform in the -CURRENT branch
Previously, it was only the beginnings of the kernel and enough bits to boot in QEMU - now a full build is possible
Work should now start happening in the main source code tree, and hopefully they'll have full support in a branch soon
***
Scripting with least privilege
A new scripting language with a focus on privilege separation and running with only what's absolutely needed has been popular in the headlines lately
Shell scripts are used everywhere today: startup scripts, orchestration scripts for mass deployment, configuring and compiling software, etc.
Shill aims to answer the questions "how do we limit the authority of scripts" and "how do we determine what authority is necessary" by including a declarative security policy that's checked and enforced by the language runtime
If used on FreeBSD, Shill will use Capsicum for sandboxing
You can find some more of the technical information in their documentation pdf or watch their USENIX presentation video
Hacker News also had some discussion on the topic
***
OpenBSD first impressions
A brand new BSD user has started documenting his experience through a series of blog posts
Formerly a Linux guy, he's tried out FreeBSD and OpenBSD so far, and is currently working on an OpenBSD desktop
The first post goes into why he chose BSD at all, why he's switching away from Linux, how the initial transition has been, what you'll need to relearn and what he's got planned going forward
He's only been using OpenBSD for a few days as of the time this was written - we don't usually get to hear from people this early in on their BSD journey, so it offers a unique perspective
***
PCBSD and 4K oh my!
Yesterday, Kris got ahold of some 4K monitor hardware to test PC-BSD out
The short of it - It works great!
Minor tweaks being made to some of the PC-BSD defaults to better accommodate 4K out of box
This particular model monitor ships with DisplayPort set to 1.1 mode only, switching it to 1.2 mode enables 60Hz properly
***
Feedback/Questions
Darin writes in
Mitch writes in
***
Discussion
Comparison of BSD release cycles
FreeBSD, OpenBSD, NetBSD and DragonFlyBSD
***
1 hr 45 min
April 15, 201585: PIE in the Sky
This time on the show, we'll be talking with Pascal Stumpf about static PIE in the upcoming OpenBSD release. He'll tell us what types of attacks it prevents, and why it's such a big deal. We've also got answers to questions from you in the audience and all this week's news, on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
Solaris' networking future is with OpenBSD
A curious patch from someone with an Oracle email address was recently sent in to one of the OpenBSD mailing lists
It was revealed that future releases of Solaris are going to drop their IPFilter firewall entirely, in favor of a port of the current version of PF
For anyone unfamiliar with the history of PF, it was actually made as a replacement for IPFilter in OpenBSD, due to some licensing issues
What's more, Solaris was the original development platform for IPFilter, so the fact that it would be replaced in its own home is pretty interesting
This blog post goes through some of the backstory of the two firewalls
PF is in a lot of places - other BSDs, Mac OS X and iOS - but there are plenty of other OpenBSD-developed technologies end up ported to other projects too
"Many of the world's largest corporations and government agencies are heavy Solaris users, meaning that even if you're neither an OpenBSD user or a Solaris user, your kit is likely interacting intensely with both kinds, and with Solaris moving to OpenBSD's PF for their filtering needs, we will all be benefiting even more from the OpenBSD project's emphasis on correctness, quality and security"
You're welcome, Oracle
***
BAFUG discussion videos
The Bay Area FreeBSD users group has been uploading some videos from their recent meetings
Sean Bruno gave a recap of his experiences at EuroBSDCon last year, including the devsummit and some proposed ideas from it (as well as their current status)
Craig Rodrigues also gave a talk about Kyua and the FreeBSD testing framework
Lastly, Kip Macy gave a talk titled "network stack changes, user-level FreeBSD"
The main two subjects there are some network stack changes, and how to get more people contributing, but there's also open discussion about a variety of FreeBSD topics
If you're close to the Bay Area in California, be sure to check out their group and attend a meeting sometime
***
More than just a makefile
If you're not a BSD user just yet, you might be wondering how the various ports and pkgsrc systems compare to the binary way of doing things on Linux
This blog entry talks about the ports system in OpenBSD, but a lot of the concepts apply to all the ports systems across the BSDs
As it turns out, the ports system really isn't that different from a binary package manager - they are what's used to create binary packages, after all
The author goes through what makefiles do, customizing which options software is compiled with, patching source code to build and getting those patches back upstream
After that, he shows you how to get your new port tested, if you're interesting in doing some porting yourself, and getting involved with the rest of the community
This post is very long and there's a lot more to it, so check it out (and more discussion on Hacker News)
***
Securing your home fences
Hopefully all our listeners have realized that trusting your network(s) to a consumer router is a bad idea by now
We hear from a lot of users who want to set up some kind of BSD-based firewall, but don't hear back from them after they've done it.. until now
In this post, someone goes through the process of setting up a home firewall using OPNsense on a PCEngines APU board
He notes that you have a lot of options software-wise, including vanilla FreeBSD, OpenBSD or even Linux, but decided to go with OPNsense because of the easy interface and configuration
The post covers all the hardware you'll need, getting the OS installed to a flash drive or SD card and going through the whole process
Finally, he goes through setting up the firewall with the graphical interface, applying updates and finishing everything up
If you don't have any experience using a serial console, this guide also has some good info for beginners about those (which also applies to regular FreeBSD)
We love super-detailed guides like this, so everyone should write more and send them to us immediately
***
Interview - Pascal Stumpf - [email protected]
Static PIE in OpenBSD
News Roundup
LLVM's new libFuzzer
We've discussed fuzzing on the show a number of times, albeit mostly with the American Fuzzy Lop utility
It looks like LLVM is going to have their own fuzzing tool too now
The Clang and LLVM guys are no strangers to this type of code testing, but decided to "close the loop" and start fuzzing parts of LLVM (including Clang) using LLVM itself
With Clang being the default in both FreeBSD and Bitrig, and with the other BSDs considering the switch, this could make for some good bug hunting across all the projects in the future
***
HardenedBSD upgrades secadm
The HardenedBSD guys have released a new version of their secadm tool, with the showcase feature being integriforce support
We covered both the secadm tool and integriforce in previous episodes, but the short version is that it's a way to prevent files from being altered (even as root)
Their integriforce feature itself has also gotten a couple improvements: shared objects are now checked too, instead of just binaries, and it uses more caching to speed up the whole process now
***
RAID5 returns to OpenBSD
OpenBSD's softraid subsystem, somewhat similar to FreeBSD's GEOM, has had experimental RAID5 support for a while
However, it was exactly that - experimental - and required a recompile to enable
With some work from recent hackathons, the final piece was added to enable resuming partial array rebuilds
Now it's on by default, and there's a call for testing being put out, so grab a snapshot and put the code through its paces
The bioctl softraid command also now supports DUIDs during pseudo-device detachment, possibly paving the way for the installer to drop the "do you want to enable DUIDs?" question entirely
***
pkgng 1.5.0 released
Going back to what we talked about last week, the final version of pkgng 1.5.0 is out
The "provides" and "requires" support is finally in a regular release
A new "-r" switch will allow for direct installation to a chroot or alternate root directory
Memory usage should be much better now, and some general code speed-ups were added
This version also introduces support for Mac OS X, NetBSD and EdgeBSD - it'll be interesting to see if anything comes of that
Many more bugs were fixed, so check the mailing list announcement for the rest (and plenty new bugs were added, according to bapt)
***
p2k15 hackathon reports
There was another OpenBSD hackathon that just finished up in the UK - this time it was mainly for ports work
As usual, the developers sent in reports of some of the things they got done at the event
Landry Breuil, both an upstream Mozilla developer and an OpenBSD developer, wrote in about the work he did on the Firefox port (specifically WebRTC) and some others, as well as reviewing lots of patches that were ready to commit
Stefan Sperling wrote in, detailing his work with wireless chipsets, specifically when the vendor doesn't provide any hardware documentation, as well as updating some of the games in ports
Ken Westerback also sent in a report, but decided to be a rebel and not work on ports at all - he got a lot of GPT-related work done, and also reviewed the RAID5 support we talked about earlier
***
Feedback/Questions
Shaun writes in
Hrishi writes in
Randy writes in
Zach writes in
Ben writes in
***
Mailing List Gold
Gstreamer hates us
At least he's honest
I find myself in a situation
***
1 hr 21 min
April 08, 201584: pkg remove freebsd-update
On this week's mini-episode, we'll be talking with Baptiste Daroussin about packaging the FreeBSD base system with pkgng. Is this the best way going forward, or are we getting dangerously close to being Linux-like? We'll find out, and also get to a couple of your emails while we're at it, on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
Xen dom0 in FreeBSD 11-CURRENT
FreeBSD has just gotten dom0 support for the Xen hypervisor, something NetBSD has had for a while now
The ports tree will now have a Xen kernel and toolstack, meaning that they can be updated much more rapidly than if they were part of base
It's currently limited to Intel boxes with EPT and a working IOMMU, running a recent version of the -CURRENT branch, but we'll likely see it when 11.0 comes out
How will this affect interest in Bhyve?
***
A tale of two educational moments
Here we have a blog post from an OpenBSD developer about some experiences he had helping people get involved with the project
It's split into two stories: one that could've gone better, and one that went really well
For the first one, he found that someone was trying to modify a package from their ports tree to have fewer dependencies
Experience really showed its worth, and he was able to write a quick patch to do exactly what the other person had been working on for a few hours - but wasn't so encouraging about getting it committed
In the second story, he discussed updating a different port with a user of a forum, and ended up improving the new user's workflow considerably with just a few tips
The lesson to take away from this is that we can all help out to encourage and assist new users - everyone was a newbie once
***
What's coming in NetBSD 7
We first mentioned NetBSD 7.0 on the show in July of 2014, but it still hasn't been released and there hasn't been much public info about it
This blog post outlines some of the bigger features that we can expect to see when it actually does come out
Their total platform count is now over 70, so you'd be hard-pressed to find something that it doesn't run on
There have been a lot of improvements in the graphics area, particularly with DRM/KMS, including Intel Haswell and Nouveau (for nVidia cards)
Many ARM boards now have full SMP support
Clang has also finally made its way into the base system, something we're glad to see, and it should be able to build the base OS on i386, AMD64 and ARM - other architectures are still a WIP
In the crypto department: their PNRG has switched from the broken RC4 to the more modern ChaCha20, OpenSSL has been updated in base and LibreSSL is in pkgsrc
NetBSD's in-house firewall, npf, has gotten major improvements since its initial debut in NetBSD 6.0
Looking to the future, NetBSD hopes to integrate a stable ZFS implementation later on
***
OpenZFS office hours
We mentioned a couple weeks back that the OpenZFS office hours series was starting back up
They've just uploaded the recording of their most recent freeform discussion, with Justin Gibbs being the main presenter
In it, they cover how Justin got into ZFS, running in virtualized environments, getting patches into the different projects, getting more people involved, reviewing code, spinning disks vs SSDs, defragging, speeding up resilvering, zfsd and much more
***
Interview - Baptiste Daroussin - [email protected]
Packaging the FreeBSD base system with pkgng
Discussion
Packaging the FreeBSD base system with pkgng (follow-up)
Feedback/Questions
Jeff writes in
Anonymous writes in
Alex writes in
Joris writes in
***
Mailing List Gold
ok feedback@
***
1 hr 15 min

About BSD Now

From the publisher's feed

Created by three guys who love BSD, we cover the latest news and have an extensive series of tutorials, as well as interviews with various people from all areas of the BSD community. It also serves as…