18.1.1 addresses a few issues in the previous release, while also updating the packages and plugins. Most notably, a Python library change made intrusion detection rules fetch fail previously and we fixed GUI and backend behaviour for two special NAT cases.
We cover an interview about Unix Architecture Evolution, another vBSDcon trip report, how to teach an old Unix about backspace, new NUMA support coming to FreeBSD & stack pointer checking in OpenBSD.
Details of the 2018 campaign have been added to the Foundation's website. The goal for the year is for $300,000. The total for "smaller" donations has already taken the OpenBSD community to bronze level sponsorship! Please show your support by contributing.
As 18.1 is drawing near this stable update for the 17.7 series could be the last one. So whether there will be a hotfix to enable the update path or a full 17.7.13 remains to be seen, but we will keep you informed either way. The targeted release date for 18.1 is January 29.
For now we refrain from letting users upgrade directly to the release candidates, but suffice to say that with the development version accompanying this update it is possible from the console. And again thank you to all early adopters which have made the release candidates a thoroughly enjoyable experience.
We review Meltdown & Spectre responses from various BSD projects, show you how to run CentOS with bhyve, GhostBSD 11.1 is out & we look at the case against the fork syscall.
The commands rcp(1), rlogin(1), rlogind(1), rsh(1) and rshd(1) have been removed from DragonFly. There’s a net/bsdrcmds port if you still need them… though I imagine/hope ssh is filling the void for everyone.
For more than 3 years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing. Over the second half of 2017 well over 500 changes have made it into this first release candidate. Most notably, the firewall NAT rules have been reworked to be more flexible and usable via plugins, which is going to pave the way for subsequent API works on the core firewall functionality. Meltdown and Spectre patches are currently being worked on in FreeBSD, but there is no reliable timeline.
We have previously issued a short statement with preliminary analysis of Meltdown and Spectre vulnerabilities. This post is an update now that we have an official statement from the FreeBSD project.
If you’re on the bleeding edge of DragonFly and already updated for Meltdown fixes, there’s a few more commits you’ll want to get. Matthew Dillon wrote a summary of the current status, noting there’s not much you can do for Spectre beyond new hardware. There is an update to the “defensive browser setup” plan for DragonFly (using –site-per-process) that can help at least with Javascript versions of Spectre.
They go to hopefully sensible defaults, but Matthew Dillon has done some testing to show the effects of each in various combinations. (Update: more changes and tests.) Note that this is not the final mitigation work; compilers (i.e. gcc) are being updated to include workarounds for this, so new gcc -> new compiler in DragonFly -> new defenses. No silver bullet there, though.
If you run a mail service, you probably like to have greylisting in place, via spamd(8) or similar means. However, there are some sites that simply do not play well with greylisting, and for those it's useful to extract SPF information to identify their valid outgoing SMTP hosts.
Now OpenBSD offers a straightforward mechanism to do that and fill your nospamd table, right from the smtpctl utility via the subcommand spf walk. Gilles Chehade (gilles@) describes how in a recent blog post titled spfwalk.
This feature is still in need of testing, so please grab a snapshot and test!
We review the information about Spectre & Meltdown thus far, we look at NetBSD memory sanitizer progress, Postgres on ZFS & show you a bit about NomadBSD.
DragonFly 5.0.2 is released. As you may guess from the version number, this is a bugfix release. The release tag has the full details. Update through the normal process of a buildworld/buildkernel, at your leisure.
XSS vulnerability in the certificate manager is being fixed that is based on a crafted certificate being imported into the system. PHP was finally updated from 7.0 to 7.1 which should make things a bit faster. Last but not least, the HAProxy plugin by Frank Wall receives a major update for improved usability, several new features and two bug fixes.
Picking a compiler for debuggability, how to port Rust apps to FreeBSD, what the point of Docker is on FreeBSD/Solaris, another EuroBSDcon recap & network manager control in OpenBSD.
A shiny new update is available, addressing the recent security advisories from FreeBSD, OpenSSL, Sudo and a number of minor bugs.
To all our 18.1-BETA testers we say this: thank you! The results have been thoroughly positive. If you would like to participate as well, please take a closer look:
https://forum.opnsense.org/index.php?topic=6257.0
pfSense software version 2.4.2 is a maintenance release bringing security patches and stability fixes for issues present in previous pfSense 2.4.x branch releases.
I just wasted an hour trying to figure out why xorg had strange output but no errors on this laptop, and it’s because I had i915_load=”YES” in /boot/loader.conf instead of i915_load=”YES” in /etc/rc.conf. I’m almost nearly sure I’ve mentioned that before, but if not: here you go.
(though if you never plan to run X, you can put it in loader.conf and everything will just work.)
If you happen to be running an old version of DragonFly, you may need to do an intermediate upgrade to move to releases after 5.0. This is in part because of commits to support C++14. This only applies to version of DragonFly before 4.4.
Bsdstats is included as in DesktopBSD-1.7 Release, so DesktopBSD will be counted in www.bsdstats.org.
Bsdstats
can be launched or is launched from console using bsdstats.send, via
rc.conf or via cron from
/usr/local/etc/poeriodic/monthly/300.statistics.
We have included tools to:
Connect to desktopbsd irc channel to get help using desktopbsd-irc
Open bugtracker page in forums using desktopbsd-bug-report
Get system information using inxi scripts ported from linux
Inxi can be run from console, terminal and even under irc client to send informations in irc channel directly.
desktopbsd-irc plus inxi are great tools to help users in #desktopbsd channel.
ISOs are installable using gbi (GhostBSD Installer) and includes another GhostBSD tools.
Please notice that Eric Turgeon ( GhostBSD founder and developer ) is also in our's dev team.
Please test and send bugs using desktopbsd-bug-report to be able to fix them.
To
enable desktop icons on desktop please run dconf-editor and go to
org.gnome.desktop.background and check show-desktop-icons. (desktop
icons are not enabled by default due to a gnome bug)
We'll use for support www.desktopbsd.weebly.com website, desktopbsd.boards.net forum and #desktopbsd irc channel on irc.freenode.server.
After a year of development, testing and debugging we are pleased to
announce the release of GhostBSD 10.3 MATE & XFCE which is available
on SourceForge and torrents for the amd64 and i386 architectures.
What's new in GhostBSD 10.3
ZFS support
UEFI support
Installer custom partition creation subjection
VirtualBox support get setup at boot time if needed.
4k partition alignment by default
GhostBSD Software will be updated Quarterly which will bring more
stability to GhostBSD still user will be able to change it to latest to
have the latest software update.
What changed in GhostBSD 10.3
The installer partition editor UI and partitioning have been improved
VirtualBox additions would be uninstall after installer if it is not runnig in a VirtualBox
Slim is replacing GDM.
Networkmgr display the full SSID
Replaced the HTML/CSS installation slide with a GTK/CSS the slide.
What has been fix.
Networkmgr SSID list
VirtualBox supports
Installer MBR partition issue
Some installer text error
Keyboard layout after installation with MATE
Network Manager slowness to open the menu
Network Manager icon tray crash
Localtime time as been fix
Fix boot partition for GPT to supports freebsd-boot, bios-boot and efi
System Update duplicating the whole install under /boot/kernel.old
September 1st, 2016: The OpenBSD team announces the availability of 6.0!
We are pleased to announce the official release of OpenBSD 6.0.
This is our 40th release on CD-ROM (and 41st via FTP/HTTP). We remain
proud of OpenBSD's record of more than twenty years with only two remote
holes in the default install.
As in our previous releases, 6.0 provides significant improvements,
including new features, in nearly all areas of the system:
This week on BSDNow, we have an interview with Richard Yao, who
will be telling us about the experience & challenges of porting ZFS
to Linux. That plus the latest news & feedback is coming your way,
on your place to B….SD!
This week on BSDNow, Allan is away in the UK for BSDCam, but we
still have a full episode for you! Don’t miss our interview with Myke
Geiger talking about using FreeBSD in the ISP environment & the
latest news, here on your place to B...SD!
This first RC release is ready for testing new
feature in GhostBSD 10.3, MATE and XFCE is available on SourceForge for
the i386, amd64, and amd64-uefi architectures.
The OPNsense project is growing rapidly and it’s with great pleasure that the OPNsense core team
may announce that our team will be strengthened with Shawn Webb. Shawn
has already been doing lots of great work and his formal membership is
seen as a logical step forward by all of us.
Shawn Webb
Over the past year, I have had the wonderful experience of working
with the OPNsense core team in porting over HardenedBSD’s robust ASLR
implementation. It is with pleasure and humility that I have accepted
their invitation to join the core team. My overarching goal will be to
port the main features of HardenedBSD to OPNsense.
Address Space Layout Randomization, or ASLR for short, is an exploit
mitigation technology that aims to make certain kinds of vulnerabilities
harder to successfully exploit. In order to fully apply ASLR,
applications must be compiled as a Position-Independent Executable
(PIE). In the short term, my next goal is to enable PIE fully across
OPNsense’s ports tree. I’m using HardenedBSD’s ports tree and package
building infrastructure as a test bed prior to importing into OPNsense.
OPNsense is investigating migrating to 11.0-RELEASE for its 17.1
release. The Virtual Memory (VM) subsystem has changed drastically
between FreeBSD 10 and FreeBSD 11. Since ASLR deals with the VM
subsystem, extreme care must be taken in the update of the codebase from
FreeBSD 10.3 to 11.0. I will assist in those efforts by freshly porting
over the ASLR implementation from HardenedBSD 11.0 to OPNsense’s
FreeBSD 11.0 codebase.
I look forward to being a part of the OPNsense core team. The
coordination between HardenedBSD and OPNsense will bring a more solid
foundation on which home users and enterprises alike can build secure and scalable networks.
The last bits of Linux emulation have been removed from DragonFly.
It’s 32-bit, so it’s been unsupported since DragonFly went to 64-bit
only with the 4.0 release. Also, some other 32-bit only items are gone,
including the cs, ep, ex, fe, and vx
network drivers. It’s almost impossible that anyone was using it, but
it’s notable because that’s some… 15-20k lines of code gone? Removal of
unused code is also positive.
This week on BSDNow, we are taking a look at a few different
tutorials, including running your very own RPi web-server. (Come-on, you
know you’ve thought of it). Plus we have a GhostBSD tutorial, a look at
a GitHub project to run Steam Linux on FreeBSD 11 & more!
You’ll want to stick-around for your place to B...SD!
16.7-RC2 is here and brings major additions to amd64
architectures: Intel’s Hyperscan library to speed up Suricata rule
matching and UEFI boot support! It also brings language packs to their
correct 16.7 state, with Japanese already having been completed by the
amazing Chie Taguchi.
The mirrors have been expanded to allow trackers of -stable or -devel
packages to upgrade to the release candidate. Users of LibreSSL wanting
to upgrade can now switch to OpenSSL instead of seeing upgrade errors
until LibreSSL becomes available again and their systems move back to
LibreSSL automatically.
Otherwise, only minor issues have been reported and fixed. This likely means there will not be another release candidate.
New images are available from all known mirrors with all checksums listed after this announcement: https://opnsense.org/download/
There is a new build of SoloBSD 10.3-STABLE based on the latest HardenedBSD stable branch version 46.5 Changelog v46.5
Now with heal-harddrive.sh script included from Martin Sugioarto. Check Instructions of use.
You can grab it from Here. (48.4 Mb) root password: solobsd
With the pending departure of Chris Buechler, we wanted to
find a way to express to the community our continued commitment to keep
pfSense® software open source.
As such, pfSense is moving to the Apache License 2.0 in order to align the goals of the project with other (unannounced) offerings from Netgate. The Apache License 2.0
is a permissive license similar to the MIT License. The main conditions
of this license require preservation of copyright and license notices.
Where the 2-Clause and 3-Clause BSD licenses provides no direct
language around the areas of copyright, patents and trademarks, the
Apache License does. The Apache License is very clear that individual
contributors grant copyright license to anyone who receives the code,
that their contribution is free from patent encumbrances (and if it is
not, that they license that patent to anyone who receives the code,) and
that use of Trademarks extends only as far as is necessary to use the
product. As a reminder, only genuine pfSense software can bear the
registered trademark of pfSense. It also includes a patent termination
clause, should a lawsuit arise.
The Apache License 2.0 is the third most popular license on github. Android, Apache, Chef, Docker, OpenStack, Salt Stack, and Swift use the Apache License 2.0.
Now pfSense does as well.
Today on the show, we are going to be talking to Jim Brown
(of BSD Cert Fame) about his home-brew sprinkler system… Wait for it…
That runs FreeBSD!
That plus news & of course your feedback, keep it tuned to BSD Now, the place to B...SD!
The source tree for the Lumina desktop
has just been soft-frozen in preparation for the upcoming release of
version 1.0.0 in mid-August (tentatively targeting August 8th for final
reviews/checks).
This means that all interface elements (GUI’s, widgets, etc) as well
as any text which requires translation may no longer be changed without
approval from both Ken Moore and the documentation team (basically only
things like bug fixes or spelling errors).
This is now the time to go through and perform any translations of
the Lumina desktop in preparation for the release. You can see the
current translation progress and help perform translations on the PC-BSD translations website.
We have also created a new tarball of the Lumina source tree on github (v1.0.0-Beta2)
so that package distributors have time to audit their current build
systems and ensure that the Lumina files/binaries are being packaged
properly (please report any packaging issues ASAP so that we can adjust
things as necessary). This is very important as a few binary names and
install locations for files have changed, and some optional dependencies
have changed as well (“compton” may be used instead of “xcompmgr” for
example).
This week on the show, Allan & I are going to be showing you
a very interesting interview we did talking about using FreeBSD to
drive a Robot! You won’t want to miss this one. That plus all the latest
news, heading your way right now!
Today on the show, we are going to be chatting with Michael
Dexter about a variety of topics, but of course including bhyve! That
plus the latest news is heading your way right now on BSDNow, the place
to B….SD!
In my two previous posts I talked about creating a new port and
copying a port from head to a branch. The goal of this post is the
creation of a new function: CreatePortOnBranch($category_name,
$port_name, $CommitBranch) The failed start I started out with this
stored procedure: Running it gave this message: # select
CreatePort('sysutils', 'bacula-server', [...]
We are pleased to announce the availability of the LibreSSL package
repo for 11-CURRENT/amd64. This repo is based off of the
LibreSSL-in-base branch (hardened/current/master-libressl) that Bernard
Spil has been working on. Going forward, along with providing binary
updates for that branch via hbsd-update(8), we will also
provide binary packages. We will also provide binary packages soon for
the LibreSSL 10-STABLE branch (hardened/10-stable/master-libressl).
Having both the feature branches along with package repos will allow us
to investigate making LibreSSL the standard in HardenedBSD.
We would like to thank Bernard Spil for his continuous hard work.
We're glad to have him on the team. Thanks to him, HardenedBSD is the
first downstream FreeBSD project to have both LibreSSL in base along
with a package repo that matches.
This first BETA development release is ready
for testing and debugging new feature in GhostBSD 10.3, MATE and XFCE is
available on SourceForge for the i386, amd64, and amd64-uefi
architectures.
Today we offer complementary improvements and fixes to your
swinging installation in the hopes that they will make your daily
experience even better, rounded off with a pinch of SSL crypto updates. In other news, we are getting ready for a first 16.7 release
candidate after having finished the full work on the FreeBSD 10.3 base
system including the addition of HardenedBSD’s ASLR. More on this next
week.
Here is the change log for 16.1.17:
2.3.1 Update 5 (2.3.1_5) is now available. Note that updates 2
through 4 were internal-only. This includes two security fixes to the
web GUI, and 7 other bug fixes. The 2.3.1-RELEASE change list has been
updated with an Update 5 section specifying the changes.
This update will reboot the system after installing.
Kris is on vacation this week, so allan flies solo, provides a
recap of BSDCan & covers a boatload of news including Microsoft
providing support & SLAs for BSD, how terrible select() may be, an
interview with Hans Petter Selasky about designing the USB drivers for
FreeBSD & more!
This afternoon, Bert JW Regeer wished that FreshPorts “would
show information from the quarterly branches too…”. I knew I had done
some work on this and that there was a way to display branch
information. I check the source code and found the ?branch= parameter,
but there was nothing in the database for this branch. [...]
It has been a long journey for HardenedBSD and OPNsense, and finally
the paths start to merge as the splendid and battle-proven ASLR
implementation gets incorporated into the default installation! It is
just the beginning as we will start to leverage the extra security by
enabling position independent execution in 16.7 and merge more
security-related features. We thank again the HardenedBSD team for their
continued efforts on making this world a safer place.
In other news, there is a thoroughly revamped dashboard for you to
enjoy and a handful of security fixes in FreeBSD and the ports
ecosystem. LibreSSL has been updated to the latest production release
and the BETA version is progressing nicely as we change our working mode
from “rework all the things” to “polish all the things”. A release
candidate is coming up soon.
Hi everyone,
The FreeBSD Foundation needs your input. Please help us by filling out
the 2016 FreeBSD Community Survey. The survey should only take about 10
minutes, and will help us determine the direction of our efforts in
supporting the Project and community. Please submit all responses by
July, 7, 2016.
https://www.surveymonkey.com/r/freebsd2016
We appreciate your feedback!
Thanks
Anne
Anne Dickison
Marketing Director
FreeBSD Foundation
A brief description of playing around with SunOS 4.1.4, which was the last version of SunOS to be based on BSD.
File Info: 17Min, 8Mb
Ogg Link: https://archive.org/download/bsdtalk265/bsdtalk265.ogg
It’s only one-week away from BSDCan, both Allan & I are
excited to meet some of you in person! However, the show keeps on
chugging & this week we have an interview with Kristof Provost, to
tell us about PF improvements in FreeBSD. That plus the latest news,
here on your place to B….SD!
We are excited to announce the ability to easily utilize Integriforce with base. From now on, hbsd-update(8) will install a full Integriforce ruleset as /etc/secadm.d/base.integriforce.rules for base. If you include this file in your normal secadm.rules(5)
ruleset, you will get full integrity enforcement on all executable
files in base. If you include the applications from ports/packages in
your secadm.rules(5) file, you can turn on whitelisting
mode, in which case, all executable files that aren't protected by
Integriforce will be denied execution. If you only utilize applications
from base, you can turn on whitelisting mode and get the same results.
Using the Integriforce ruleset is entirely optional, but highly recommended.
An example secadm.rules file might look something like this:
2.3.1 Update 1 (2.3.1_1) is now available. This includes one
security fix to the web GUI, and 7 other bug fixes. The 2.3.1-RELEASE
change list has been updated with an Update 1 section specifying the changes.
This update will reboot the system after installing.
The NetBSD Project is pleased to announce NetBSD 7.0.1, the
first security/bugfix update of the NetBSD 7.0 release branch. It
represents a selected subset of fixes deemed important for security or
stability reasons. If you are running an earlier release of NetBSD, we
strongly suggest updating to 7.0.1.
For more details, please see the release notes.
Complete source and binaries for NetBSD are available for download at
many sites around the world. A list of download sites providing FTP,
AnonCVS, SUP, and other services may be found at http://www.NetBSD.org/mirrors/
This second ALPHA development release is for
testing and debugging new feature in GhostBSD 10.3, MATE and XFCE is
available on SourceForge for the i386, amd64, and amd64-uefi
architectures.
Most Free/Open Source Software users run Linux as their operating
system of choice, choosing one (or more) of the 300 or so distros
currently active on DistroWatch. Not as many have crossed the street,
rhetorically speaking, and taken a look at the other Open Source
operating system, BSD and its many variants.
As a long time and current Linux user new to PC-BSD — essentially the BSD equivalent to Linux Mint — my intention is to:
· Outline the (many) similarities and (few) differences between Linux and BSD,
· Walk the audience through the process of moving from Linux to BSD,
unless the audience is in a hurry, then I’ll run them through it,
· Describe the ease-of-use and pitfalls of day-to-day use of PC-BSD for the average user, and
· How to pitch in and make code and other contributions (e.g.,
documentation, translation) to BSD variants, even while doing the same
for Linux distributions,
· And more!
This year's dotSecurity conference featured a presentation from OpenBSD founder Theo de Raadt, titled "Privilege Separation and Pledge."
The video is now available here, in addition to the slides.
This week on BSDNow, we have an interview with Matthew Macy, who
has some exciting news to share with us regarding the state of graphics
on FreeBSD. That plus all the latest news on BSDNow, the place to
B...SD!
Progress on the armv7 platform continues, and Jonathan Gray writes in to the arm@ mailing list with some promising news:
There is now a bootloader for armv7 thanks to kettenis@
Recent armv7 snapshots will configure disks to use efiboot and install
device tree dtb files on a fat partition at the start of the disk.
u-boot kernel images are no longer part of the release but can still
be built for the time being. We are going to start assuming the
kernel has been loaded with a dtb file to describe the hardware sometime
soon. Those doing new installs can ignore the details but here they
are.
We are happy to announce the release of pfSense® software version 2.3.1!
This is a maintenance release in the 2.3.x series, bringing a number
of bug fixes, two security fixes in the GUI, as well as security fixes
for OpenSSL, OpenVPN and FreeBSD atkbd and sendmsg. The full list of
changes is on the 2.3.1 New Features and Changes page.
This release includes a total of 103 bug fixes.
79 regressions in 2.3 have been fixed, mostly minor issues in the new
GUI. Several of these are significant issues, and have resolved nearly
all the post-upgrade problems encountered in 2.3-RELEASE. 24 issues
affecting 2.2.x and prior versions have also been fixed.
If you haven’t yet caught up on the changes in 2.3.x, check out the Features and Highlights video. Past blog posts have covered some of the changes, such as the performance improvements from tryforward, and the webGUI update.
How about an update with your new
NetFlow remote export. Or your local reporting frontend? Well, you can
always use both if you like. Read all about it here:
https://docs.opnsense.org/manual/netflow.html
Furthermore, we have added the brand new AQM CoDel version 0.2.1 to
the mix, yesterday’s FreeBSD security advisories, released the HAProxy
plugin, bundled a full Japanese translation.
There is also a refreshed website for our general viewing pleasure. https://opnsense.org/
This week on the show, we have all the latest news and stories!
Plus an interview with BSD developer Alfred Perlstein, that you won’t
want to miss. Sit tight, the show starts now on your place to B...SD!
The May issue of BSD Magazine is available now.
There’s articles on ZFS, OpenBSD’s arc4random, an interview
of Fernando RodrÃguez of KeepCoding, and more. It’s a free PDF download
if you didn’t know.
