BSD Now

By JT PenningtonNews Education How To Tech News

BSD Now episodes

April 01, 201583: woN DSB
Coming up this week on the show, we'll be talking to Kamila Součková, a Google intern. She's been working on the FreeBSD pager daemon, and also tells us about her initial experiences trying out BSD and going to a conference. As always, all the week's news and answers to your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
Major changes coming in PCBSD 11
The PCBSD team has announced that version 11.0 will have some more pretty big changes (as they've been known to do lately with NTP daemons and firewalls)
Switching from PF to IPFW provided some benefits for VIMAGE, but the syntax was just too complicated for regular everyday users
To solve this, they've ported over Linux's iptables, giving users a much more straightforward configuration
While ZFS has served them well as the default filesystem for a while, Kris decided that Btrfs would be a better choice going forward
Since the FreeBSD kernel doesn't support it natively, all filesystem calls will be through FUSE from now on - performance is Good Enough
People often complain about PCBSD's huge ISO download, so, to save space, the default email client will be switched to mutt, and KDE will be replaced with DWM as the default window manager
To reconfigure it, or make any appearance changes, users just need to edit a simple C header file and recompile - easy peasy
As we've mentioned on the show, PCBSD has been promoting safe backup solutions for a long time with its "life preserver" utility, making it simple to manage multiple snapshots too
To test if people have been listening to this advice, Kris recently activated the backdoor he put in life preserver that deletes all the users' files - hope you had that stuff backed up
***
NetBSD and FreeBSD join forces
The BSD community has been running into one of the same problems Linux has lately: we just have too many different BSDs to choose from
What's more, none of them have any specific areas they focus on or anything like that (they're all basically the same)
That situation is about to improve somewhat, as FreeBSD and NetBSD have just merged codebases... say hello to FretBSD
Within a week, all mailing lists and webservers for the legacy NetBSD and FreeBSD projects will be terminated - the mailing list for the new combined project will be hosted from the United Nations datacenter on a Microsoft Exchange server
As UN monitors will be moderating the mailing lists to prevent disagreements and divisive arguments before they begin, this system is expected to be adequate for the load
With FretBSD, your toaster can now run ZFS, so you'll never need to worry about the bread becoming silently corrupted again
***
Puffy in the cloud
If you've ever wanted to set up a backup server, especially for family members or someone who's not as technology-savvy, you've probably realized there are a lot of options
This post explores the option of setting up your own Dropbox-like service with Owncloud and PostgreSQL, running atop the new OpenBSD http daemon
Doing it this way with your own setup, you can control all the security aspects - disk encryption, firewall rules, who can access what and from where, etc
He also mentions our pf tutorial being helpful in blocking script kiddies from hammering the box
Be sure to encourage your less-technical friends to always back up their important data
***
NetBSD at AsiaBSDCon
Some NetBSD developers have put together a report of what they did at the most recent event in Tokyo
It includes a wrap-up of the event, as well as a list of presentations that NetBSD developers gave
Have you ever wanted even more pictures of NetBSD running on lots of devices? There's a never-ending supply, apparently
At the BSD research booth of AsiaBSDCon, there were a large number of machines on display, and someone has finally uploaded pictures of all of them
There's also a video of an OMRON LUNA-II running the luna68k port
***
Interview - Kamila Součková - [email protected] / @anotherkamila
BSD conferences, Google Summer of Code, various topics
News Roundup
FreeBSD foundation March update
The FreeBSD foundation has published their March update for fundraising and sponsored projects
In the document, you'll find information about upcoming ARMv8 enhancements, some event recaps and a Google Summer of Code status update
They also mention our interview with the foundation president - be sure to check it out if you haven't
***
Inside OpenBSD's new httpd
BSD news continues to dominate mainstream tech news sites… well not really, but they talk about it once in a while
The SD Times is featuring an article about OpenBSD's in-house HTTP server, after seeing Reyk's AsiaBSDCon presentation about it (which he's giving at BSDCan this year, too)
In this article, they talk about the rapid transition of webservers in the base system - apache being replaced with nginx, only to be replaced with httpd shortly thereafter
Since the new daemon has had almost a full release cycle to grow, new features and fixes have been pouring in
The post also highlights some of the security features: everything runs in a chroot with privsep by default, and it also leverages strong TLS 1.2 defaults (including Perfect Forward Secrecy)
***
Using poudriere without OpenSSL
Last week we talked about using LibreSSL in FreeBSD for all your ports
One of the problems that was mentioned is that some ports are configured improperly, and end up linking against the OpenSSL in the base system even when you tell them not to
This blog post shows how to completely strip OpenSSL out of the poudriere build jails, something that's a lot more difficult than you'd think
If you're a port maintainer, pay close attention to this post, and get your ports fixed to adhere to the make.conf options properly
***
HAMMER and GPT in OpenBSD
Someone, presumably a Google Summer of Code student, wrote in to the lists about his HAMMER FS porting proposal
He outlined the entire process and estimated timetable, including what would be supported and which aspects were beyond the scope of his work (like the clustering stuff)
There's no word yet on if it will be accepted, but it's an interesting idea to explore, especially when you consider that HAMMER really only has one developer
In more disk-related news, Ken Westerback has been committing quite a lot of GPT-related fixes recently
Full GPT support will most likely be finished before 5.8, but anything involving HAMMER FS is still anyone's guess
***
Feedback/Questions
Morgan writes in
Dustin writes in
Stan writes in
Mica writes in
***
Mailing List Gold
Developers in freefall
Xorg thieves pt. 1
Xorg thieves pt. 2
***
1 hr 5 min
March 25, 201582: SSL in the Wild
Coming up this week, we'll be chatting with Bernard Spil about wider adoption of LibreSSL in other communities. He's been doing a lot of work with FreeBSD ports specifically, but also working with upstream projects. As usual, all this weeks news and answers to your questions, on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
EuroBSDCon 2015 call for papers
The call for papers has been announced for the next EuroBSDCon, which is set to be held in Sweden this year
According to their site, the call for presentation proposals period will start on Monday the 23rd of March until Friday the 17th of April
If giving a full talk isn't your thing, there's also a call for tutorials - if you're comfortable teaching other people about something BSD-related, this could be a great thing too
You're not limited to one proposal - several speakers gave multiple in 2014 - so don't hesitate if you've got more than one thing you'd like to talk about
We'd like to see a more balanced conference schedule than BSDCan's having this year, but that requires effort on both sides - if you're doing anything cool with any BSD, we'd encourage you submit a proposal (or two)
Check the announcement for all the specific details and requirements
If your talk gets accepted, the conference even pays for your travel expenses
***
Making security sausage
Ted Unangst has a new blog post up, detailing his experiences with some recent security patches both in and out of OpenBSD
"Unfortunately, I wrote the tool used for signing patches which somehow turned into a responsibility for also creating the inputs to be signed. That was not the plan!"
The post first takes us through a few OpenBSD errata patches, explaining how some can get fixed very quickly, but others are more complicated and need a bit more review
It also covers security in upstream codebases, and how upstream projects sometimes treat security issues as any other bug
Following that, it leads to the topic of FreeType - and a much more complicated problem with backporting patches between versions
The recent OpenSSL vulnerabilities were also mentioned, with an interesting story to go along with them
Just 45 minutes before the agreed-upon announcement, OpenBSD devs found a problem with the patch OpenSSL planned to release - it had to be redone at the last minute
It was because of this that FreeBSD actually had to release a security update to their security update
He concludes with "My number one wish would be that every project provide small patches for security issues. Dropping enormous feature releases along with a note 'oh, and some security too' creates downstream mayhem."
***
Running FreeBSD on the server, a sysadmin speaks
More BSD content is appearing on mainstream technology sites, and, more importantly, BSD Now is being mentioned
ITWire recently did an interview with Allan about running FreeBSD on servers (possibly to go with their earlier interview with Kris about desktop usage)
They discuss some of the advantages BSD brings to the table for sysadmins that might be used to Linux or some other UNIX flavor
It also covers specific features like jails, ZFS, long-term support, automating tasks and even… what to name your computers
If you've been considering switching your servers over from Linux to FreeBSD, but maybe wanted to hear some first-hand experience, this is the article for you
***
NetBSD ported to Hardkernel ODROID-C1
In their never-ending quest to run on every new board that comes out, NetBSD has been ported to the Hardkernel ODROID-C1
This one features a quad-core ARMv7 CPU at 1.5GHz, has a gig of ram and gigabit ethernet... all for just $35
There's a special kernel config file for this board's hardware, available in both -current and the upcoming 7.0
More info can be found on their wiki page
After this was written, basic framebuffer console support was also committed, allowing a developer to run XFCE on the device
***
Interview - Bernard Spil - [email protected] / @sp1l
LibreSSL adoption in FreeBSD ports and the wider software ecosystem
News Roundup
Monitoring pf logs with Gource
If you're using pf on any of the BSDs, maybe you've gotten bored of grepping logs and want to do something more fancy
This article will show you how to get set up with Gource for a cinematic-like experience
If you've never heard of Gource, it's "an OpenGL-based 3D visualization tool intended for visualizing activity on source control repositories"
When you put all the tools together, you can end up with some pretty eye-catching animations of your firewall traffic
One of our listeners wrote in to say that he set this up and, almost immediately, noticed his girlfriend's phone had been compromised - graphical representations of traffic could be useful for detecting suspicious network activity
***
pkgng 1.5.0 alpha1 released
The development version of pkgng was updated to 1.4.99.14, or 1.5.0 alpha1
This update introduces support for provides/requires, something that we've been wanting for a long time
It will also now print which package is the reason for direct dependency change
Another interesting addition is the "pkg -r" switch, allowing cross installation of packages
Remember this isn't the stable version, so maybe don't upgrade to it just yet on any production systems
DragonFly will also likely pick up this update once it's marked stable
***
Welcome to OpenBSD
We mentioned last week that our listener Brian was giving a talk in the Troy, New York area
The slides from that talk are now online, and they've been generating quite a bit of discussion online
It's simply titled "Welcome to OpenBSD" and gives the reader an introduction to the OS (and how easy it is to get involved with contributing)
Topics include a quick history of the project, who the developers are and what they do, some proactive security techniques and finally how to get involved
As you may know, NetBSD has almost 60 supported platforms and their slogan is "of course it runs NetBSD" - Brian says, with 17 platforms over 13 CPU architectures, "it probably runs OpenBSD"
No matter which BSD you might be interested in, these slides are a great read, especially for any beginners looking to get their feet wet
Try to guess which font he used...
***
BSDTalk episode 252
And somehow Brian has snuck himself into another news item this week
He makes an appearance in the latest episode of BSD Talk, where he chats with Will about running a BSD-based shell provider
If that sounds familiar, it's probably because we did the same thing, albeit with a different member of their team
In this interview, they discuss what a shell provider does, hardware requirements and how to weed out the spammers in favor of real people
They also talk a bit about the community aspect of a shared server, as opposed to just running a virtual machine by yourself
***
Feedback/Questions
Christian writes in
Stefan writes in
Possnfiffer writes in
Ruudsch writes in
Shane writes in
***
Mailing List Gold
Accidental support
Larry's tears
The boy who sailed with BSD
***
1 hr 29 min
March 18, 201581: Puffy in a Box
We're back from AsiaBSDCon! This week on the show, we'll be talking to Lawrence Teo about how Calyptix uses OpenBSD in their line of commercial routers. They're getting BSD in the hands of Windows admins who don't even realize it. We also have all this week's news and answer to your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
Using OpenBGPD to distribute pf table updates
For those not familiar, OpenBGPD is a daemon for the Border Gateway Protocol - a way for routers on the internet to discover and exchange routes to different addresses
This post, inspired by a talk about using BGP to distribute spam lists, details how to use the protocol to distribute some other useful lists and information
It begins with "One of the challenges faced when managing our OpenBSD firewalls is the distribution of IPs to pf tables without manually modifying /etc/pf.conf on each of the firewalls every time. This task becomes quite tedious, specifically when you want to distribute different types of changes to different systems (eg administrative IPs to a firewall and spammer IPs to a mail server), or if you need to distribute real time blacklists to a large number of systems."
If you manage a lot of BSD boxes, this might be an interesting alternative to some of the other ways to distribute configuration files
OpenBGPD is part of the OpenBSD base system, but there's also an unofficial port to FreeBSD and a "work in progress" pkgsrc version
***
Mounting removable media with autofs
The FreeBSD foundation has a new article in the "FreeBSD from the trenches" series, this time about the sponsored autofs tool
It's written by one of the autofs developers, and he details his work on creating and using the utility
"The purpose of autofs(5) is to mount filesystems on access, in a way that's transparent to the application. In other words, filesystems get mounted when they are first accessed, and then unmounted after some time passes."
He talks about all the components that need to work together for smooth operation, how to configure it and how to enable it by default for removable drives
It ends with a real-world example of something we're all probably familiar with: plugging in USB drives and watching the magic happen
There's also some more advanced bonus material on GEOM classes and all the more technical details
***
The Tor Browser on BSD
The Tor Project has provided a "browser bundle" for a long time, which is more or less a repackaged Firefox with many security and privacy-related settings preconfigured and some patches applied to the source
Just tunneling your browser through a transparent Tor proxy is not safe enough - many things can lead to passive fingerprinting or, even worse, anonymity being completely lost
It has, however, only been released for Windows, OS X and Linux - no BSD version
"[...] we are pushing back against an emerging monoculture, and this is always a healthy thing. Monocultures are dangerous for many reasons, most importantly to themselves."
Some work has begun to get a working port on BSD going, and this document tells about the process and how it all got started
If you've got porting skills, or are interested in online privacy, any help would be appreciated of course (see the post for details on getting involved)
***
OpenSSH 6.8 released
Continuing their "tick tock" pattern of releases alternating between new features and bugfixes, the OpenSSH team has released 6.8 - it's a major upgrade, focused on new features (we like those better of course)
Most of the codebase has gone through refactoring, making it easier for regression tests and improving the general readability
This release adds support for SHA256-hashed, base64-encoded host key fingerprints, as well as making that the default - a big step up from the previously hex-encoded MD5 fingerprints
Experimental host key rotation support also makes it debut, allowing for easy in-place upgrading of old keys to newer (or refreshed) keys
You can now require multiple, different public keys to be verified for a user to authenticate (useful if you're extra paranoid or don't have 100% confidence in any single key type)
The native version will be in OpenBSD 5.7, and the portable version should hit a ports tree near you soon
Speaking of the portable version, it now has a configure option to build without OpenSSL or LibreSSL, but doing so limits you to Ed25519 key types and ChaCha20 and AES-CTR ciphers
***
NetBSD at AsiaBSDCon
The NetBSD guys already have a wrap-up of the recent event, complete with all the pictures and weird devices you'd expect
It covers their BoF session, the six NetBSD-related presentations and finally their "work in progress" session
There was a grand total of 34 different NetBSD gadgets on display at the event
***
Interview - Lawrence Teo - [email protected] / @lteo
OpenBSD at Calyptix
News Roundup
HardenedBSD introduces Integriforce
A little bit of background on this one first: NetBSD has something called veriexec, used for checking file integrity at the kernel level
By doing it at the kernel level, similar to securelevels, it offers some level of protection even when the root account is compromised
HardenedBSD has introduced a similar mechanism into their "secadm" utility
You can list binaries in the config file that you want to be protected from changes, then specify whether those can't be run at all, or if they just print a warning
They're looking for some more extensive testing of this new feature
***
More s2k15 hackathon reports
A couple more Australian hackathon reports have poured in since the last time
The first comes from Jonathan Gray, who's done a lot of graphics-related work in OpenBSD recently
He worked on getting some newer "Southern Islands" and "Graphics Core Next" AMD GPUs working, as well as some OpenGL and DRM-related things
Also on his todo list was to continue hitting various parts of the tree with American Fuzzy Lop, which ended up fixing a few crashes in mandoc
Ted Unangst also sent in a report to detail what he hacked on at the event
With a strong focus on improving SMP scalability, he tackled the virtual memory layer
His goal was to speed up some syscalls that are used heavily during code compilation, much of which will probably end up in 5.8
All the trip reports are much more detailed than our short summaries, so give them a read if you're interested in all the technicalities
***
DragonFly 4.0.4 and IPFW3
DragonFly BSD has put out a small point release to the 4.x branch, 4.0.4
It includes a minor list of fixes, some of which include a HAMMER FS history fix, removing the no-longer-needed "new xorg" and "with kms" variables and a few LAGG fixes
There was also a bug in the installer that prevented the rescue image from being installed correctly, which also gets fixed in this version
Shortly after it was released, their new IPFW2 firewall was added to the tree and subsequently renamed to IPFW3 (since it's technically the third revision)
***
NetBSD gets Raspberry Pi 2 support
NetBSD has announced initial support for the second revision of the ever-popular Raspberry Pi board
There are -current snapshots available for download, and multiprocessor support is also on the way
The NetBSD wiki page about the Raspberry Pi also has some more information and an installation guide
The usual Hacker News discussion on the subject
If anyone has one of these little boards, let us know - maybe write up a blog post about your experience with BSD on it
***
OpenIKED as a VPN gateway
In our first discussion segment, we talked about a few different ways to tunnel your traffic
While we've done full tutorials on things like SSH tunnels, OpenVPN and Tor, we haven't talked a whole lot about OpenBSD's IPSEC suite
This article should help fill that gap - it walks you through the complete IKED setup
From creating the public key infrastructure to configuring the firewall to configuring both the VPN server and client, this guide's got it all
***
Feedback/Questions
Gary writes in
Robert writes in
Joris writes in
Mike writes in
Anders writes in
***
Mailing List Gold
Can you hear me now
He must be GNU here
I've seen some...
***
1 hr 27 min
March 11, 2015 80: The PC-BSD Tour II
We're away at AsiaBSDCon this week, but we've still got a packed episode for you. First up is a sequel to the "PC-BSD tour" segment from a while back, highlighting how ZFS boot environments work. After that, Justin Gibbs joins us to talk about the FreeBSD foundation's 15th anniversary. We'll return next week with a normal episode of BSD Now - which is of course, the place to B.. SD.
This episode was brought to you by
Special segment
Demystifying Boot Environments in PC-BSD
Interview - Justin Gibbs - [email protected] / @freebsdfndation
The FreeBSD foundation's 15th anniversary
Discussion
The story of PC-BSD
1 hr 21 min
March 04, 201579: Just Add QEMU
Coming up this time on the show, we'll be talking to Sean Bruno. He's been using poudriere and QEMU to cross compile binary packages, and has some interesting stories to tell about it. We've also got answers to viewer-submitted questions and all this week's news, on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
AsiaBSDCon 2015 schedule
Almost immediately after we finished recording an episode last week, the 2015 AsiaBSDCon schedule went up
This year's conference will be between 12-15 March at the Tokyo University of Science in Japan
The first and second days are for tutorials, as well as the developer summit and vendor summit
Days four and five are the main event with the presentations, which Kris and Allan both made the cut for once again
Not counting the ones that have yet to be revealed (as of the day we're recording this), there will be thirty-six different talks in all - four BSD-neutral, four NetBSD, six OpenBSD and twenty-two FreeBSD
Summaries of all the presentations are on the timetable page if you scroll down a bit
***
FreeBSD foundation updates and more
The FreeBSD foundation has posted a number of things this week, the first of which is their February 2015 status update
It provides some updates on the funded projects, including PCI express hotplugging and FreeBSD on the POWER8 platform
There's a FOSDEM recap and another update of their fundraising goal for 2015
They also have two new blog posts: a trip report from SCALE13x and a featured "FreeBSD in the trenches" article about how a small typo caused a lot of ZFS chaos in the cluster
"Then panic ensued. The machine didn't panic -- I did."
***
OpenBSD improves browser security
No matter what OS you run on your desktop, the most likely entry point for an exploit these days is almost certainly the web browser
Ted Unangst writes in to the OpenBSD misc list to introduce a new project he's working on, simply titled "improving browser security"
He gives some background on the WX memory protection in the base system, but also mentions that some applications in ports don't adhere to it
For it to be enforced globally instead of just recommended, at least one browser (or specifically, one JIT engine) needs to be fixed to use it
"A system that is 'all WX except where it's not' is the same as a system that's not WX. We've worked hard to provide a secure foundation for programs; we'd like to see them take advantage of it."
The work is being supported by the OpenBSD foundation, and we'll keep you updated on this undertaking as more news about it is released
There's also some discussion on Hacker News and Undeadly about it
***
NetBSD at Open Source Conference 2015 Tokyo
The Japanese NetBSD users group has once again invaded a conference, this time in Tokyo
There's even a spreadsheet of all the different platforms they were showing off at the booth (mostly ARM, MIPS, PowerPC and Landisk this time around)
If you just can't get enough strange devices running BSD, check the mailing list post for lots of pictures
Their next target is, as you might guess, AsiaBSDCon 2015 - maybe we'll run into them
***
Interview - Sean Bruno - [email protected] / @franknbeans
Cross-compiling packages with poudriere and QEMU
News Roundup
The Crypto Bone
The Crypto Bone is a new device that's aimed at making encryption and secure communications easier and more accessible
Under the hood, it's actually just a Beaglebone board, running stock OpenBSD with a few extra packages
It includes a web interface for configuring keys and secure tunnels
The source code is freely available for anyone interested in hacking on it (or auditing the crypto), and there's a technical overview of how everything works on their site
If you don't want to teach your mom how to use PGP, buy her one of these(?)
***
BSD in the 2015 Google Summer of Code
For those who don't know, GSoC is a way for students to get paid to work on a coding project for an open source organization
Good news: both FreeBSD and OpenBSD were accepted for the 2015 event
FreeBSD has a wiki page of ideas for people to work on
OpenBSD also has an ideas page where you can see some of the initial things that might be interesting
If you're a student looking to get involved with BSD development, this might be a great opportunity to even get paid to do it
Who knows, you may even end up on the show if you work on a cool project
GSoC will be accepting idea proposals starting March 16th, so you have some time to think about what you'd like to hack on
***
pfSense 2.3 roadmap
The pfSense team has posted a new blog entry, detailing some of their plans for future versions
PPTP will finally be deprecated, PHP will be updated to 5.6 and other packages will also get updated to newer versions
PBIs are scheduled to be replaced with native pkgng packages
Version 3.0, something coming much later, will be a major rewrite that gets rid of PHP entirely
Their ultimate goal is for pfSense to be a package you can install atop of a regular FreeBSD install, rather than a repackaged distribution
***
PCBSD 10.1.2 security features
PCBSD 10.1.2 will include a number of cool security features, some of which are detailed in a new blog post
A new "personacrypt" utility is introduced, which allows for easy encryption and management of external drives for your home directory
Going along with this, it also has a "stealth mode" that allows for one-time temporary home directories (but it doesn't self-destruct, don't worry)
The LibreSSL integration also continues, and now packages will be built with it by default
If you're using the Life Preserver utility for backups, it will encrypt the remote copy of your files in the next update
They've also been working on introducing some new options to enable tunneling your traffic through Tor
There will now be a fully-transparent proxy option that utilizes the switch to IPFW we mentioned last week
A small disclaimer: remember that many things can expose your true IP when using Tor, so use this option at your own risk if you require full anonymity
Look forward to Kris wearing a Tor shirt in future episodes
***
Feedback/Questions
Antonio writes in
Chris writes in
Van writes in
Stu writes in
***
Mailing List Gold
H
Pay up, mister Free
Heritage protected
Blind leading the blind
What are the chances
***
1 hr 25 min
February 25, 201578: From the Foundation (Part 2)
This week we continue our two-part series on the activities of various BSD foundations. Ken Westerback joins us today to talk all about the OpenBSD foundation and what it is they do. We've also got answers to your emails and all the latest news, on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
BSDCan 2015 schedule
The list of presentations for the upcoming BSDCan conference has been posted, and the time schedule should be up shortly as well
Just a reminder: it's going to be held on June 12th and 13th at the University of Ottawa in Canada
This year's conference will have a massive fifty talks, split up between four tracks instead of three (but unfortunately a person can only be in one place at a time)
Both Allan and Kris had at least one presentation accepted, and Allan will also be leading a few "birds of a feather" gatherings
In total, there will be three NetBSD talks, five OpenBSD talks, eight BSD-neutral talks, thirty-five FreeBSD talks and no DragonFly talks
That's not the ideal balance we'd hope for, but BSDCan says they'll try to improve that next year
Those numbers are based on the speaker's background, or any past presentations, for the few whose actual topic wasn't made obvious from the title (so there may be a small margin of error)
Michael Lucas (who's on the BSDCan board) wrote up a blog post about the proposals and rejections this year
If you can't make it this year, don't worry, we'll be sure to announce the recordings when they're made available
We also interviewed Dan Langille about the conference and what to expect this year, so check that out too
***
SSL interception with relayd
There was a lot of commotion recently about superfish, a way that Lenovo was intercepting HTTPS traffic and injecting advertisements
If you're running relayd, you can mimic this evil setup on your own networks (just for testing of course…)
Reyk Floeter, the guy who wrote relayd, came up a blog post about how to do just that
It starts off with some backstory and some of the things relayd is capable of
relayd can run as an SSL server to terminate SSL connections and forward them as plain TCP and, conversely, run as an SSL client to terminal plain TCP connections and tunnel them through SSL
When you combine these two, you end up with possibilities to filter between SSL connections, effectively creating a MITM scenario
The post is very long, with lots of details and some sample config files - the whole nine yards
***
OPNsense 15.1.6.1 released
The OPNsense team has released yet another version in rapid succession, but this one has some big changes
It's now based on FreeBSD 10.1, with all the latest security patches and driver updates (as well as some in-house patches)
This version also features a new tool for easily upgrading between versions, simply called "opnsense-update" (similar to freebsd-update)
It also includes security fixes for BIND and PHP, as well as some other assorted bug fixes
The installation images have been laid out in a clean way: standard CD and USB images that default to VGA, as well as USB images that default to a console output (for things like Soekris and PCEngines APU boards that only have serial ports)
With the news of m0n0wall shutting down last week, they've also released bare minimum hardware specifications required to run OPNsense on embedded devices
Encouraged by last week's mention of PCBSD trying to cut ties with OpenSSL, OPNsense is also now providing experimental images built against LibreSSL for testing (and have instructions on how to switch over without reinstalling)
***
OpenBSD on a Minnowboard Max
What would our show be without at least one story about someone installing BSD on a weird device
For once, it's actually not NetBSD…
This article is about the minnowboard max, a very small X86-based motherboard that looks vaguely similar to a Raspberry Pi
It's using an Atom CPU instead of ARM, so overall application compatibility should be a bit better (and it even has AES-NI, so crypto performance will be much better than a normal Atom)
The author describes his entirely solid-state setup, noting that there's virtually no noise, no concern about hard drives dying and very reasonable power usage
You'll find instructions on how to get OpenBSD installed and going throughout the rest of the article
Have a look at the spec sheet if you're interested, they make for cool little BSD boxes
***
Netmap for 40gbit NICs in FreeBSD
Luigi Rizzo posted an announcement to the -current mailing list, detailing some of the work he's just committed
The ixl(4) driver, that's one for the X1710 40-gigabit card, now has netmap support
It's currently in 11-CURRENT, but he says it works in 10-STABLE and will be committed there too
This should make for some serious packet-pushing power
If you have any network hardware like this, he would appreciate testing for the new code
***
Interview - Ken Westerback - [email protected]
The OpenBSD foundation's activities
News Roundup
s2k15 hackathon report: dhclient/dhcpd/fdisk
The second trip report from the recent OpenBSD hackathon has been published, from the very same guy we just talked to
Ken was also busy, getting a few networking-related things fixed and improved in the base system
He wrote a few new small additions for dhclient and beefed up the privsep security, as well as some fixes for tcpdump and dhcpd
The fdisk tool also got worked on a bit, enabling OpenBSD to properly wipe GPT tables on a previously-formatted disk so you can do a normal install on it
There's apparently plans for "dhclientng" - presumably a big improvement (rewrite?) of dhclient
***
FreeBSD beginner video series
A new series of videos has started on YouTube, aimed at helping total beginners learn about FreeBSD
We usually assume that people who watch the show are already familiar with basic concepts, but they'd be a great introduction to any of your friends that are looking to get started with BSD and need a helping hand
So far, he's covered how to get FreeBSD, an introduction to installing in VirtualBox, a simple installation or a more in-depth manual installation, navigating the filesystem, basic ssh use, managing users and groups and finally some basic editing with vi and a few other topics
Everyone's gotta start somewhere and, with a little bit of initial direction, today's newbies could be tomorrow's developers
It should be an ongoing series with more topics to come
***
NetBSD tests: zero unexpected failures
The NetBSD guys have a new blog post up about their testing suite for all the CPU architectures
They've finally gotten the number of "expected" failures down to zero on a few select architectures
Results are published on a special release engineering page, so you can have a look if you're interested
The rest of the post links to the "top performers" (ones with less than ten failure) in the -current branch
***
PCBSD switches to IPFW
The PCBSD crew continues their recent series of switching between major competing features
This time, they've switched the default firewall away from PF to FreeBSD's native IPFW firewall
Look forward to Kris wearing a "keep calm and use IPFW" shir- wait
***
Feedback/Questions
Sean writes in
Dan writes in
Florian writes in
Sean writes in
Chris writes in
***
Mailing List Gold
VCS flamebait
Hidden agenda
***
1 hr 10 min
February 18, 201577: Noah's L2ARC
This week on the show, we'll be chatting with Alex Reece and Matt Ahrens about what's new in the world of OpenZFS. After that, we're starting a new tutorial series on submitting your first patch. All the latest BSD news and answers to your emails, coming up on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
Revisiting FreeBSD after 20 years
With comments like "has Linux lost its way?" floating around, a Debian developer was prompted to revisit FreeBSD after nearly two decades
This blog post goes through his experiences trying out a modern BSD variant, and includes the good, the bad and the ugly - not just praise this time
He loves ZFS and the beadm tool, and finds the FreeBSD implementation to be much more stable than ZoL
On the topic of jails, he summarizes: "Linux has tried so hard to get this right, and fallen on its face so many times, a person just wants to take pity sometimes. We’ve had linux-vserver, openvz, lxc, and still none of them match what FreeBSD jails have done for a long time."
The post also goes through the "just plain different" aspects of a complete OS vs. a distribution of various things pieced together
Finally, he includes some things he wasn't so happy about: subpar laptop support, virtualization being a bit behind, a myriad of complaints about pkgng and a few other things
There was some decent discussion on Hacker News about this article too, with counterpoints from both sides
***
s2k15 hackathon report: network stack SMP
The first trip report from the recent OpenBSD hackathon in Australia has finally been submitted
One of the themes of this hackathon was SMP (symmetric multiprocessing) improvement, and Martin Pieuchot did some hacking on the network stack
If you're not familiar with him, he gave a presentation at EuroBSDCon last year, titled Taming OpenBSD Network Stack Dragons
Teaming up with David Gwynne, they worked on getting some bits of the networking code out of the big lock
Hopefully more trip reports will be sent in during the coming weeks
Most of the big code changes should probably appear after the 5.7-release testing period
***
From BIND to NSD and Unbound
If you've been running a DNS server on any of the BSDs, you've probably noticed a semi-recent trend: BIND being replaced with Unbound
BIND was ripped out in FreeBSD 10.0 and will be gone in OpenBSD 5.7, but both systems include Unbound now as an alternative
OpenBSD goes a step further, also including NSD in the base system, whereas you'll need to install that from ports on FreeBSD
Instead of one daemon doing everything like BIND tried to do, this new setup splits the authoritative nameserver and the caching resolver into two separate daemons
This post takes you through the transitional phase of going from a single BIND setup to a combination of NSD and Unbound
All in all, everyone wins here, as there will be a lot less security advisories in both BSDs because of it...
***
m0n0wall calls it quits
The original, classic BSD firewall distribution m0n0wall has finally decided to close up shop
For those unfamiliar, m0n0wall was a FreeBSD-based firewall project that put a lot of focus on embedded devices: running from a CF card, CD, USB drive or even a floppy disk
It started over twelve years ago, which is pretty amazing when you consider that's around half of FreeBSD itself's lifespan
The project was probably a lot of people's first encounter with BSD in any form
If you were a m0n0wall user, fear not, you've got plenty of choices for a potential replacement: doing it yourself with something like FreeBSD or OpenBSD, or going the premade route with something like pfSense, OPNsense or the BSD Router Project
The founder's announcement includes these closing words: "m0n0wall has served as the seed for several other well known open source projects, like pfSense, FreeNAS and AskoziaPBX. The newest offspring, OPNsense, aims to continue the open source spirit of m0n0wall while updating the technology to be ready for the future. In my view, it is the perfect way to bring the m0n0wall idea into 2015, and I encourage all current m0n0wall users to check out OPNsense and contribute if they can."
While m0n0wall didn't get a lot of on-air mention, surely a lot of our listeners will remember it fondly
***
Interview - Alex Reece & Matt Ahrens - [email protected] & [email protected] / @openzfs
What's new in OpenZFS
Tutorial
Making your first patch (OpenBSD)
News Roundup
Overlaying remote LANs with OpenBSD's VXLAN
Have you ever wanted to "merge" multiple remote LANs? OpenBSD's vxlan(4) is exactly what you need
This article talks about using it to connect two virtualized infrastructures on different ESXi servers
It gives a bit of networking background first, in case you're not quite up to speed on all this stuff
This tool opens up a lot of very cool possibilities, even possibly doing a "remote" LAN party
Be sure to check the AsiaBSDCon talk about VXLANs if you haven't already
***
2020, year of the PCBSD desktop
Here we have a blog post about BSD on the desktop, straight from a KDE developer
He predicts that PCBSD is going to take off before the year 2020, possibly even overtaking Linux's desktop market share (small as it may be)
With PCBSD making a preconfigured FreeBSD desktop a reality, and the new KMS work, the author is impressed with how far BSD has come as a viable desktop option
ZFS and easy-to-use boot environments top the list of things he says differentiate the BSD desktop experience from the Linux one
There was also some discussion on Slashdot that might be worth reading
***
OpenSSH host key rotation, redux
We mentioned the new OpenSSH host key rotation and other goodies in a previous episode, but things have changed a little bit since then
djm says "almost immediately after smugly declaring 'mission accomplished', the bug reports started rolling in."
There were some initial complaints from developers about the new options, and a serious bug shortly thereafter
After going back to the drawing board, he refactored some of the new code (and API) and added some more regression tests
Most importantly, the bigger big fix was described as: "a malicious server (say, "host-a") could advertise the public key of another server (say, "host-b"). Then, when the client subsequently connects back to host-a, instead of answering the connection as usual itself, host-a could proxy the connection to host-b. This would cause the user to connect to host-b when they think they are connecting to host-a, which is a violation of the authentication the host key is supposed to provide."
None of this code has been in a formal OpenSSH release just yet, but hopefully it will soon
***
PCBSD tries out LibreSSL
PCBSD users may soon be seeing a lot less security problems because of two recent changes
After switching over to OpenNTPD last week, PCBSD decides to give the portable LibreSSL a try too
Note that this is only for the packages built from ports, not the base system unfortunately
They're not the first ones to do this - OPNsense has been experimenting with replacing OpenSSL in their ports tree for a little while now, and of course all of OpenBSD's ports are built against it
A good number of patches are still not committed in vanilla FreeBSD ports, so they had to borrow some from Bugzilla
Look forward to Kris wearing a "keep calm and abandon OpenSSL" shirt in the near future
***
Feedback/Questions
Benjamin writes in
Mike writes in
Brad writes in
***
Mailing List Gold
Debian Dejavu
Package gone missing
***
1 hr 27 min
February 11, 201576: Time for a Change
This week, we'll be talking to Henning Brauer about OpenNTPD and its recently revived portable version. After that, we'll be discussing different ways to securely tunnel your traffic: specifically OpenVPN, IPSEC, SSH and Tor. All that and the latest news, coming up on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
Strange timer bug in FreeBSD 11
Peter Wemm wrote in to the FreeBSD -CURRENT mailing list with an interesting observation
Running the latest development code in the infrastructure, the clock would stop keeping time after 24 days of uptime
This meant things like cron and sleep would break, TCP/IP wouldn't time out or resend packets, a lot of things would break
A workaround until it was fixed was to reboot every 24 days, but this is BSD we're talking about - uptime is our game
An initial proposal was adding a CFLAG to the build options which makes makes signed arithmetic wrap
Peter disagreed and gave some background, offering a different patch to fix the issue and detect it early if it happens again
Ultimately, the problem was traced back to an issue with a recent clang import
It only affected -CURRENT, not -RELEASE or -STABLE, but was definitely a bizarre bug to track down
***
An OpenBSD mail server
There's been a recent influx of blog posts about building a BSD mail server for some reason
In this fancy series of posts, the author sets up OpenSMTPD in its native OpenBSD home, whereas previous posts have been aimed at FreeBSD and Linux
In addition to the usual steps, this one also covers DKIMproxy, ClamAV for scanning attachments, Dovecot for IMAP and also multiple choices of spam filtering: spamd or SpamAssassin
It also shows you how to set up Roundcube for building a web interface, using the new in-base httpd
That means this is more of a "complete solution" - right down to what the end users see
The series is split up into categories so it's very easy to follow along step-by-step
***
How DragonFlyBSD uses git
DragonFlyBSD, along with PCBSD and EdgeBSD, uses git as its version control system for the system source code
In a series of posts, Matthew Dillon (the project lead) details their internal setup
They're using vanilla git over ssh, with the developers' accounts set to git-only (no shell access)
The maintainers of the server are the only ones with shell access available
He also details how a cron job syncs from the master to a public box that anyone can check out code from
It would be interesting to hear about how other BSD projects manage their master source repository
***
Why not try PCBSD?
ITwire, another more mainstream tech site, published a recent article about switching to PCBSD
They interview a guy named Kris that we've never heard of before
In the article, they touch on how easy it can potentially be for Linux users looking to switch over to the BSD side - lots of applications are exactly the same
"With the growing adoption of systemd, dissatisfaction with Linux has reached proportions not seen in recent years, to the extent that people have started talking of switching to FreeBSD."
If you have some friends who complain to you about systemd all the time, this might be a good article to show them
***
Interview - Henning Brauer - [email protected] / @henningbrauer
OpenNTPD and its portable variant
News Roundup
Authenticated time in OpenNTPD
We recorded that interview with Henning just a few days ago, and it looks like part of it may be outdated already
While at the hackathon, some developers came up with an alternate way to get authenticated NTP responses
You can now add an HTTPS URL to your ntpd.conf in addition to the time server pool
OpenNTPD will query it (over TLS, with CA verification) and look at the date sent in the HTTPS header
It's not intended to be a direct time source, just a constraint to keep things within reason
If you receive regular NTP packets that are way off from the TLS packet, those will be discarded and the server(s) marked as invalid
Henning and Theo also weigh in to give some of the backstory on the idea
Lots more detail can be found in Reyk's email explaining the new feature (and it's optional of course)
***
NetBSD at Open Source Conference 2015 Oita and Hamanako
It's been a while since we've featured one of these trip reports, but the Japanese NetBSD users group is still doing them
This time the conferences were in Oita and Hamanako, Japan
Machines running NetBSD included the CubieBoard2 Allwinner A20, Raspberry Pi and Banana Pi, Sharp NetWalker and a couple Zaurus devices
As always, they took lots of pictures from the event of NetBSD on all these weird machines
***
Poudriere in a jail
A common question we get about our poudriere tutorial is "how do I run it in a jail?" - this blog post is about exactly that
It takes you through the networking setup, zpool setup, nginx setup, making the jail and finally poking the right holes in the jail to allow poudriere to work its magic
***
Bruteblock, another way to stop bruteforce
We've mentioned a few different ways to stop ssh bruteforce attempts in the past: fail2ban, denyhosts, or even just with pf's built-in rate limiting
Bruteblock is a similar tool, but it's not just for ssh logins - it can do a number of other services
It can also work directly with IPFW, which is a plus if you're using that as your firewall
Add a few lines to your syslog.conf and bruteblock will get executed automatically
The rest of the article takes you through the different settings you can configure for blocking
***
New iwm(4) driver and cross-polination
The OpenBSD guys recently imported a new "iwm" driver for newer Intel 7260 wireless cards (commonly found in Thinkpads)
NetBSD wasted no time in porting it over, giving a bit of interesting backstory
According to Antti Kantee, "it was created for OpenBSD by writing and porting a NetBSD driver which was developed in a rump kernel in Linux userspace"
Both projects would appreciate further testing if you have the hardware and can provide useful bug reports
Maybe FreeBSD and DragonFly will port it over too, or come up with something that's partially based on the code
***
PCBSD current images
The first PCBSD -CURRENT images should be available this weekend
This image will be tagged 11.0-CURRENTFEB2015, with planned monthly updates
For the more adventurous this will allow testing both FreeBSD and PCBSD bleeding edge
***
Feedback/Questions
Antonio writes in
Richard writes in
Charlie writes in
Ben writes in
***
Mailing List Gold
A systematic effort
GCC's lunch
Hopes and dreams
***
Discussion
Comparison of ways to securely tunnel your traffic
OpenVPN, OpenBSD IKED, FreeBSD IPSEC, OpenSSH, Tor
***
1 hr 30 min
February 04, 201575: From the Foundation (Part 1)
This week on the show, we'll be starting a two-part series detailing the activities of various BSD foundations. Ed Maste from the FreeBSD foundation will be joining us this time, and we'll talk about what all they've been up to lately. All this week's news and answers to viewer-submitted questions, coming up on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
Key rotation in OpenSSH 6.8
Damien Miller posted a new blog entry about one of the features in the upcoming OpenSSH 6.8
Times changes, key types change, problems are found with old algorithms and we switch to new ones
In OpenSSH (and the SSH protocol) however, there hasn't been an easy way to rotate host keys... until now
With this change, when you connect to a server, it will log all the server's public keys in your known_hosts file, instead of just the first one used during the key exchange
Keys that are in your known_hosts file but not on the server will get automatically removed
This fixes the problem of old servers still authenticating with ancient DSA or small RSA keys, as well as providing a way for the server to rotate keys every so often
There are some instructions in the blog post for how you'll be able to rotate host keys and eventually phase out the older ones - it's really simple
There are a lot of big changes coming in OpenSSH 6.8, so we'll be sure to cover them all when it's released
***
NetBSD Banana Pi images
We've talked about the Banana Pi a bit before - it's a small ARM board that's comparable to the popular Raspberry Pi
Some NetBSD -current images were posted on the mailing list, so now you can get some BSD action on one of these little devices
There are even a set of prebuilt pkgsrc packages, so you won't have to compile everything initially
The email includes some steps to get everything working and an overview of what comes with the image
Also check the wiki page for some related boards and further instructions on getting set up
On a related note, NetBSD also recently got GPU acceleration working for the Raspberry Pi (which is a first for their ARM port)
***
LibreSSL shirts and other BSD goodies
If you've been keeping up with the LibreSSL saga and want a shirt to show your support, they're finally available to buy online
There are two versions, either "keep calm and use LibreSSL" or the slightly more snarky "keep calm and abandon OpenSSL"
While on the topic, we thought it would be good to make people aware of shirts for other BSD projects too
You can get some FreeBSD, PCBSD and FreeNAS stuff from the FreeBSD mall site
OpenBSD recently launched their new store, but the selection is still a bit limited right now
NetBSD has a couple places where you can buy shirts and other apparel with the flag logo on it
We couldn't find any DragonFlyBSD shirts unfortunately, which is a shame since their logo is pretty cool
Profits from the sale of the gear go back to the projects, so pick up some swag and support your BSD of choice (and of course wear them at any Linux events you happen to go to)
***
OPNsense 15.1.4 released
The OPNsense guys have been hard at work since we spoke to them, fixing lots of bugs and keeping everything up to date
A number of versions have come out since then, with 15.1.4 being the latest (assuming they haven't updated it again by the time this airs)
This version includes the latest round of FreeBSD kernel security patches, as well as minor SSL and GUI fixes
They're doing a great job of getting upstream fixes pushed out to users quickly, a very welcome change
A developer has also posted an interesting write-up titled "Development Workflow in OPNsense"
If any of our listeners are trying OPNsense as their gateway firewall, let us know how you like it
***
Interview - Ed Maste - [email protected]
The FreeBSD foundation's activities
News Roundup
Rolling with OpenBSD snapshots
One of the cool things about the -current branch of OpenBSD is that it doesn't require any compiling
There are signed binary snapshots being continuously re-rolled and posted on the FTP sites for every architecture
This provides an easy method to get onboard with the latest features, and you can also easily upgrade between them without reformatting or rebuilding
This blog post will walk you through the process of using snapshots to stay on the bleeding edge of OpenBSD goodness
After using -current for seven weeks, the author comes to the conclusion that it's not as unstable as people might think
He's now helping test out patches and new ports since he's running the same code as the developers
***
Signing pkgsrc packages
As of the time this show airs, the official pkgsrc packages aren't cryptographically signed
Someone from Joyent has been working on that, since they'd like to sign their pkgsrc packages for SmartOS
Using GNUPG pulled in a lot of dependencies, and they're trying to keep the bootstrapping process minimal
Instead, they're using netpgpverify, a fork of NetBSD's netpgp utility
Maybe someday this will become the official way to sign packages in NetBSD?
***
FreeBSD support model changes
Starting with 11.0-RELEASE, which won't be for a few months probably, FreeBSD releases are going to have a different support model
The plan is to move "from a point release-based support model to a set of releases from a branch with a guaranteed support lifetime"
There will now be a five-year lifespan for each major release, regardless of how many minor point releases it gets
This new model should reduce the turnaround time for errata and security patches, since there will be a lot less work involved to build and verify them
Lots more detail can be found in the mailing list post, including some important changes to the -STABLE branch, so give it a read
***
OpenSMTPD, Dovecot and SpamAssassin
We've been talking about setting up your own BSD-based mail server on the last couple episodes
Here we have another post from a user setting up OpenSMTPD, including Dovecot for IMAP and SpamAssassin for spam filtering
A lot of people regularly ask the developers how to combine OpenSMTPD with spam filtering, and this post should finally reveal the dark secrets
In addition, it also covers SSL certificates, PKI and setting up MX records - some things that previous posts have lacked
Just be sure to replace those "apt-get" commands and "eth0" interface names with something a bit more sane…
In related news, OpenSMTPD has got some interesting new features coming soon
They're also planning to switch to LibreSSL by default for the portable version
***
FreeBSD 10 on the Thinkpad T400
BSD laptop articles are becoming popular it seems - this one is about FreeBSD on a T400
Like most of the ones we've mentioned before, it shows you how to get a BSD desktop set up with all the little tweaks you might not think to do
This one differs in that it takes a more minimal approach to graphics: instead of a full-featured environment like XFCE or KDE, it uses the i3 tiling window manager
If you're a commandline junkie that basically just uses X11 to run more than one terminal at once, this might be an ideal setup for you
The post also includes some bits about the DRM and KMS in the 10.x branch, as well as vt
***
PC-BSD 10.1.1 Released
Automatic background updater now in
Shiny new Qt5 utils
OVA files for VM’s
Full disk encryption with GELI v7
***
Feedback/Questions
Camio writes in
Sha'ul writes in
John writes in
Sean writes in (TJ's lengthy reply)
Christopher writes in
***
Mailing List Gold
Special Instructions
Pretending to be a VT220
***
1 hr 26 min
January 28, 201574: That Sly MINIX
Coming up this week, we've got something a little bit different for you. We'll be talking with Andrew Tanenbaum, the creator of MINIX. They've recently imported parts of NetBSD into their OS, and we'll find out how and why that came about. As always, all the latest news and answers to your emails, on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
The missing EuroBSDCon videos
Some of the missing videos from EuroBSDCon 2014 we mentioned before have mysteriously appeared
Jordan Hubbard, FreeBSD, looking forward to another 10 years
Lourival Viera Neto, NPF scripting with Lua
Kris Moore, Snapshots, replication and boot environments
Andy Tanenbaum, A reimplementation of NetBSD based on a microkernel
Kirk McKusick, An introduction to FreeBSD's implementation of ZFS
Emannuel Dreyfus, FUSE and beyond, bridging filesystems
John-Mark Gurney, Optimizing GELI performance
Unfortunately, there are still about six talks missing… and no ETA
***
FreeBSD on a MacBook Pro (or two)
We've got a couple posts about running FreeBSD on a MacBook Pro this week
In the first one, the author talks a bit about trying to run Linux on his laptop for quite a while, going back and forth between it and something that Just Works™
Eventually he came full circle, and the focus on using only GUI tools got in the way, instead of making things easier
He works on a lot of FreeBSD-related software, so switching to it for a desktop seems to be the obvious next step
He's still not quite to that point yet, but documents his experiments with BSD as a desktop
The second article also documents an ex-Linux user switching over to BSD for their desktop
It also covers power management, bluetooth and trackpad setup
On the topic of Gentoo, "Underneath the beautiful and easy-to-use Portage system lies the same glibc, the same turmoil over a switch to a less-than-ideal init system, and the same kernel-level bugs that bring my productivity down"
Check out both articles if you've been considering running FreeBSD on a MacBook
***
Remote logging over TLS
In most of the BSDs, syslogd has been able to remotely send logs to another server for a long time
That feature can be very useful, especially for forensics purposes - it's much harder for an attacker to hide their activities if the logs aren't on the same server
The problem is, of course, that it's sent in cleartext, unless you tunnel it over SSH or use some kind of third party wrapper
With a few recent commits, OpenBSD's syslogd now supports sending logs over TLS natively, including X509 certificate verification
By default, syslogd runs as an unprivileged user in a chroot on OpenBSD, so there were some initial concerns about certificate verification - how does that user access the CA chain outside of the chroot?
That problem was also conquered, by loading the CA chain directly from memory, so the entire process can be run in the chroot without issue
Some of the privsep verifcation code even made its way into LibreSSL right afterwards
If you haven't set up remote logging before, now might be an interesting time to try it out
***
FreeBSD, not a Linux distro
George Neville-Neil gave a presentation recently, titled "FreeBSD: not a Linux distro"
It's meant to be an introduction to new users that might've heard about FreeBSD, but aren't familiar with any BSD history
He goes through some of that history, and talks about what FreeBSD is and why you might want to use it over other options
There's even an interesting "thirty years in three minutes" segment
It's not just a history lesson though, he talks about some of the current features and even some new things coming in the next version(s)
We also learn about filesystems, jails, capsicum, clang, dtrace and the various big companies using FreeBSD in their products
This might be a good video to show your friends or potential employer if you're looking to introduce FreeBSD to them
***
Long-term support considered harmful
There was recently a pretty horrible bug in GNU's libc (BSDs aren't affected, don't worry)
Aside from the severity of the actual problem, the fix was delayed for quite a long time, leaving people vulnerable
Ted Unangst writes a post about how this idea of long-term support could actually be harmful in the long run, and compares it to how OpenBSD does things
OpenBSD releases a new version every six months, and only the two most recent releases get support and security fixes
He describes this as both a good thing and a bad thing: all the bugs in the ecosystem get flushed out within a year, but it forces people to stay (relatively) up-to-date
"Upgrades only get harder and more painful (and more fragile) the longer one goes between them. More changes, more damage. Frequent upgrades amortize the cost and ensure that regressions are caught early."
There was also some discussion about the article you can check out
***
Interview - Andrew Tanenbaum - [email protected] / @minix3
MINIX's integration of NetBSD
News Roundup
Using AFL on OpenBSD
We've talked about American Fuzzy Lop a bit on a previous episode, and how some OpenBSD devs are using it to catch and fix new bugs
Undeadly has a cool guide on how you can get started with fuzzing
It's a little on the advanced side, but if you're interested in programming or diagnosing crashes, it'll be a really interesting article to read
Lots of recent CVEs in other open source projects are attributed to fuzzing - it's a great way to stress test your software
***
Lumina 0.8.1 released
A new version of Lumina, the BSD-licensed desktop environment from PCBSD, has been released
This update includes some new plugins, lots of bugfixes and even "quality-of-life improvements"
There's a new audio player desktop plugin, a button to easily minimize all windows at once and some cool new customization options
You can get it in PCBSD's edge repo or install it through regular ports (on FreeBSD, OpenBSD or DragonFly!)
If you haven't seen our episode about Lumina, where we interview the developer and show you a tour of its features, gotta go watch it
***
My first OpenBSD port
The author of the "Code Rot & Why I Chose OpenBSD" article has a new post up, this time about ports
He recently made his first port and got it into the tree, so he talks about the whole process from start to finish
After learning some of the basics and becoming comfortable running -current, he noticed there wasn't a port for the "Otter" web browser
At that point he did what you're supposed to do in that situation, and started working on it himself
OpenBSD has a great porter's handbook that he referenced throughout the process
Long story short, his browser of choice is in the official ports collection and now he's the maintainer (and gets to deal with any bug reports, of course)
If some software you use isn't available for whatever BSD you're using, you could be the one to make it happen
***
How to slide with DragonFly
DragonFly BSD has a new HAMMER FS utility called "Slider"
It's used to easily browse through file history and undelete files - imagine something like a commandline version of Apple's Time Machine
They have a pretty comprehensive guide on how to use it on their wiki page
If you're using HAMMER FS, this is a really handy tool to have, check it out
***
OpenSMTPD with Dovecot and Salt
We recently had a feedback question about which mail servers you can use on BSD - Postfix, Exim and OpenSMTPD being the big three
This blog post details how to set up OpenSMTPD, including Dovecot for IMAP and Salt for quick and easy deployment
Intrigued by it becoming the default MTA in OpenBSD, the author decided to give it a try after being a long-time Postfix fan
"Small, fast, stable, and very easy to customize, no more ugly m4 macros to deal with"
Check it out if you've been thinking about configuring your first mail server on any of the BSDs
***
Feedback/Questions
Christopher writes in (handbook section)
Mark writes in
Kevin writes in
Stefano writes in
Matthew writes in
***
Mailing List Gold
Not that interested actually
This guy again
Yep, this is the place
***
1 hr 17 min

About BSD Now

From the publisher's feed

Created by three guys who love BSD, we cover the latest news and have an extensive series of tutorials, as well as interviews with various people from all areas of the BSD community. It also serves as…