Showing posts with label OpenBSD. Show all posts
Showing posts with label OpenBSD. Show all posts

BSD News 05/02/2018

Las week in BSD

Releases: OPNsense
News: BSDSec, BSDNow, OpenBSD, NetBSD, DragonFly

BSDSec

OpenBSD Errata: February 2nd, 2018 (kernel)

Releases

OPNsense 18.1.1 released

18.1.1 addresses a few issues in the previous release, while also updating the packages and plugins. Most notably, a Python library change made intrusion detection rules fetch fail previously and we fixed GUI and backend behaviour for two special NAT cases.

News

Unix Architecture Evolution | BSD Now 231

We cover an interview about Unix Architecture Evolution, another vBSDcon trip report, how to teach an old Unix about backspace, new NUMA support coming to FreeBSD & stack pointer checking in OpenBSD.

The OpenBSD Foundation 2018 Fundraising Campaign

Details of the 2018 campaign have been added to the Foundation's website. The goal for the year is for $300,000. The total for "smaller" donations has already taken the OpenBSD community to bronze level sponsorship! Please show your support by contributing.

Code stuff

NetBSD The LLVM Sanitizers stage accomplished
DragonFly Microcode updates for AMD
DragonFly Default kernel config changes

Interesting articles

Remi Locherer's EuroBSDcon 2017 Talk

BSD News 15/01/2018

Last week in BSD

Releases: OPNsense
News: OpenBSD, OPNsense, Meltdown, Spectre, Dragon Fly, FreeBSD, Bhyve


BSDSec

OpenBSD Errata: January 14th, 2018 (libssl)

Releases


OPNsense® 18.1 Release Candidate 1

For more than 3 years now, OPNsense is driving innovation through modularising and hardening the open source firewall, with simple and reliable firmware upgrades, multi-language support, HardenedBSD security, fast adoption of upstream software updates as well as clear and stable 2-Clause BSD licensing. Over the second half of 2017 well over 500 changes have made it into this first release candidate. Most notably, the firewall NAT rules have been reworked to be more flexible and usable via plugins, which is going to pave the way for subsequent API works on the core firewall functionality. Meltdown and Spectre patches are currently being worked on in FreeBSD, but there is no reliable timeline.


News

An update on Meltdown and Spectre

We have previously issued a short statement with preliminary analysis of Meltdown and Spectre vulnerabilities. This post is an update now that we have an official statement from the FreeBSD project.

Dragonfly More Meltdown fixes

If you’re on the bleeding edge of DragonFly and already updated for Meltdown fixes, there’s a few more commits you’ll want to get. Matthew Dillon wrote a summary of the current status, noting there’s not much you can do for Spectre beyond new hardware.   There is an update to the “defensive browser setup” plan for DragonFly (using –site-per-process) that can help at least with Javascript versions of Spectre.

Dragonfly Even more Meltdown

Are you tired of hearing about Meltdown/Spectre yet?  Doesn’t matter!  The two sysctls for controlling mitigation in DragonFly have been renamed:

machdep.meltdown_mitigation
machdep.spectre_mitigation

They go to hopefully sensible defaults, but Matthew Dillon has done some testing to show the effects of each in various combinations.   (Update: more changes and tests.)  Note that this is not the final mitigation work; compilers (i.e. gcc) are being updated to include workarounds for this, so new gcc -> new compiler in DragonFly -> new defenses.  No silver bullet there, though.

OpenBSD-current now has 'smtpctl spf walk'

If you run a mail service, you probably like to have greylisting in place, via spamd(8) or similar means. However, there are some sites that simply do not play well with greylisting, and for those it's useful to extract SPF information to identify their valid outgoing SMTP hosts.
Now OpenBSD offers a straightforward mechanism to do that and fill your nospamd table, right from the smtpctl utility via the subcommand spf walk. Gilles Chehade (gilles@) describes how in a recent blog post titled spfwalk.
This feature is still in need of testing, so please grab a snapshot and test!

The Spectre of Meltdown | BSD Now 228

We review the information about Spectre & Meltdown thus far, we look at NetBSD memory sanitizer progress, Postgres on ZFS & show you a bit about NomadBSD.




Code stuff

In Other BSDs for 2018/01/13
Microcode updates on DragonFly
IBRS and IBPB support in DragonFly
CPU microcode update code for amd64 for OpenBSD
HAMMER1, mounted and unmounted cleanup

Interesting articles

Handling of CPU bugs disclosure 'incredibly bad': OpenBSD's de Raadt
Running CentOS with Bhyve
July-September 2017 FreeBSD Status Report

BSD News 08/01/2018

Last week in BSD

News: DragonFly BSD, NetBSD, BSDSec, HardenedBSD, Meltdown, Spectre, MirOS, OpenBSD, FreeBSD, BSDnow, 
Releases: HardenedBSD

BSDSec

NetBSD Security Advisory 2018-002: Local DoS in virecover
NetBSD Security Advisory 2018-001: Several vulnerabilities in context handling 

Releases

HardenedBSD-stable 10-STABLE v1000050.1

Downloads here, release notes here.

News

OpenBSD Response to the "Meltdown" Vulnerability

A message to tech@ from Philip Guenther (guenther@) provides the first public information from developers regarding the OpenBSD response to the recently announced CPU vulnerabilities:

 So, yes, we the OpenBSD developers are not totally asleep and a handful of
us are working out how to deal with Intel's fuck-up aka the Meltdown
attack.  While we have the advantage of less complexity in this area (e.g.,
no 32bit-on-64bit compat), there's still a pile of details to work through
about what has to be *always* in the page tables vs what can/should/must be
hidden.
Read it.

Meltdown and Spectre and DragonFly

By now you’ve probably heard of the Meltdown/Spectre attacks.  (background rumors, technical note)  Matthew Dillon’s put together a Meltdown mitigation in DragonFly, done in four commits.
It’s turned off and on by the sysctl machdep.isolated_user_pmap – and defaults to on for Intel CPUs.  Buildworld tests show about a 4-5% performance hit, but that’s only one form of activity, measured, so there will surely be other effects.
Note that Spectre is not mitigated by this commit series, and as I understand it, cannot be realistically fixed in software.
Update: Matthew Dillon posted a summary to users@.

MirOS - The Intelpocalypse

The unveiling of the three new CPU bug classes, collected in the two brandbugs “Meltdown” and “Spectre”, has mostly shocked the BSDs; I’ve got it on some authority that even FreeBSD was not informed ahead of time, left alone the others. Thanks to laffer1 from MidnightBSD for a couple of heads-up warnings into our direction!
Here’s what I could gather until now (please do correct me if I’m wrong):
Meltdown is specific to Intel® CPUs with out-of-order execution, that is, all P6-class (Pentium Pro/MMX, Pentium Ⅱ, but not Pentium Ⅰ/MMX) or newer (except old Atom) CPUs. It appears to allow user processes to read kernel memory, but not across VMs, nor to attack a hypervisor. A variant for ARM exists but AMD’s x86 CPUs are supposedly safe. The KAISER/FUCKWIT/UASS/KPTI patches for Linux fix this, at huge performance cost on x86, not so much on ARM, and no cost for unaffected CPU models (runtime detected).
Spectre affects x86, ARM, POWER CPUs and possibly others. I’ve not yet found information on whether it is also limited to CPUs with out-of-order executions, but it seems likely. SPARC CPUs might be safe; Solaris/SPARC64 is safe due to the way its memory addressing works. If the OOO execution assumption is true, 80486 and P5 class x86 CPUs are also safe. This one does allow cross-VM and hypervisor attacks, so if the bare metal CPU is vulnerable, SOL. There does not yet seem to be a generic fix; some hint at having to patch the compiler and recompile everything with a workaround that has a performance cost, even if the CPU is not affected, or was fixed with a microcode update. AMD’s x86 CPUs are partially hit, one of the variants does not work on them.
“CERT recommends throwing away your CPU and buying an non-vulnerable one” (thanks to El Reg), but nobody states which CPUs are not vulnerable.
At the present time, we suggest any MirBSD/i386 instances that run on any CPU other than an 80486 or P5-class (Pentium Ⅰ or a non-PPro MMX) to be restricted to single user or trusted user access only, and no untrusted software including ECMAscript to be run on them.
Watch this space for updates. Oh, and, if you know what you’re (and I’m) talking about, please, again, do provide me with information necessary to provide those updates, both to MirBSD and to this space.

FreeBSD About the Meltdown and Spectre attacks

FreeBSD was made aware of the problems in late December 2017. We're working with CPU vendors and the published papers on these attacks to mitigate them on FreeBSD. Due to the fundamental nature of the attacks, no estimate is yet available for the publication date of patches.

HardenedBSD announcing the 2018 donation run

We've just published our goals for 2018. We've got a number of new goals planned, some that require new infrastructure. In 2018, we plan to migrate at least 90% of our infrastructure to a single data center in addition to expanding out existing infrastructure.

Hello, HelBUG

More user group news: Helsinki, Finland, has a new BSD User Group: HelBUG.  First meeting is February 7th.  There’s no mailing list/site that I know of, yet.

The long core dump | BSD Now 227

We walk through dumping a PS4 kernel in only 6 days, tell you the news that NetBSD 7.1.1 has been released, details on how to run FreeBSD on a Thinkpad T470 & there’s progress in OpenBSD’s pledge.


Code stuff

NetBSD: the LLVM Memory Sanitizer support work in progress
In Other BSDs for 2018/01/06

BSD News 03/12/2017

BSD News 03/12/2017

Last week in BSD

Releases: HardenedBSD
News: BSDSec, FreeBSD, OpenBSD, DragonFly BSD, BSDnow, NetBSD, Vagrant

BSDSec

[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-17:11.openssl
OpenBSD Errata: December 1st, 2017 (fktrace)

Releases

Stable release: HardenedBSD-stable 11-STABLE v1100054.1

Highlights:
- fixed syslogd - restore host name handling in UDP case
- fixed ARM64 control flow problem
- fixed MAP_GUARRD issues
- upgrade to Unicode 10.0.0
- ZFS fixes
(side note: the recent OpenSSL security issues (FreeBSD-SA-17:11.openssl) are already fixed in previous releases)
Download

News

scfb support in DragonFly

If you’re booting DragonFly in UEFI mode, and you have unsupported video (i.e. NVIDIA), there’s the scfb driver for xorg.  It doesn’t support NVIDIA chipsets either, but it gives more options than the generic vesa driver.  It appears to be present in all the BSDs to some extent.

How Netflix works | BSD Now 222

We take a look at two-faced Oracle, cover a FAMP installation, how Netflix works the complex stuff & show you who the patron of yak shaving is.

Code stuff
In Other BSDs for 2017/12/02
World without sharing
The LLVM Thread Sanitizer has been ported to NetBSD

Interesting articles

DragonFly on Vagrant with shared folders

Pic of the week

Fixed the apple root bug.

from https://twitter.com/nehalist/status/937337658707202048/photo/1

BSD News 27/11/2017

Last week in BSD

Releases: OPNsense, pfSense
News: BSDSec, DragonFly BSD, BSDnow, OpenBSD, Lumina Desktop, BSD Router, p2k17, Wallpaper

BSDSec

FreeBSD Security Advisory FreeBSD-SA-17:08.ptrace [REVISED]
FreeBSD Security Advisory FreeBSD-SA-17:10.kldstat [REVISED]
[Security-announce] pfSense-SA-17_09.webgui
[Security-announce] pfSense-SA-17_08.webgui
[Security-announce] [UPDATED] pfSense-SA-17_07.packages

Releases

OPNsense 17.7.8 released

A shiny new update is available, addressing the recent security advisories from FreeBSD, OpenSSL, Sudo and a number of minor bugs.
To all our 18.1-BETA testers we say this: thank you! The results have been thoroughly positive. If you would like to participate as well, please take a closer look:
https://forum.opnsense.org/index.php?topic=6257.0

pfSense 2.4.2-RELEASE now available

pfSense software version 2.4.2 is a maintenance release bringing security patches and stability fixes for issues present in previous pfSense 2.4.x branch releases.

News

Remember: don’t kldload i915 too soon

I just wasted an hour trying to figure out why xorg had strange output but no errors on this laptop, and it’s because I had i915_load=”YES” in /boot/loader.conf instead of i915_load=”YES” in /etc/rc.conf.  I’m almost nearly sure I’ve mentioned that before, but if not: here you go.
(though if you never plan to run X, you can put it in loader.conf and everything will just work.)


BSD in Taiwan | BSD Now 221


Allan reports on his trip to BSD Taiwan, new versions of Lumina and GhostBSD are here, a bunch of OpenBSD p2k17 hackathon reports & more!

Pre-DragonFly 4.4 users, take note

If you happen to be running an old version of DragonFly, you may need to do an intermediate upgrade to move to releases after 5.0.  This is in part because of commits to support C++14.  This only applies to version of DragonFly before 4.4.

Code stuff

The strongest KASLR, ever? (latest developments in the Kernel ASLR district)
Lumina Version 1.4.0 Released
Areca update: arcmsr(4)
In Other BSDs for 2017/11/25

Interesting articles

DragonFly: Locking microtests
How to build a BSDRP router lab - [Virtualbox]
Digging into /usr/share/examples

p2k17 Hackathon

OpenBSD is holding hackathons as an attempt to get new changes into the source tree quickly. Here are some reports from the latest:
Reflections on Hackathons
p2k17 Hackathon report: Antoine Jacoutot on ports+packages progress

Wallpaper of the week



BSD News 20/11/2017

BSD News 20/11/2017

Last week in BSD

News: BSDSec, FreeBSD, OpenZFS, BSDnow, OpenBSD, DragonFly BSD, C5, p2k17
Releases: HardenedBSD


Releases

Stable release: HardenedBSD-stable 11-STABLE v1100054

Tthis is a security update and reinstallation of pkgs/ports are required due LibreSSL upgrade!
Highlights:
- Changed AT_PAXFLAG auxvector position (4c04e4a613679510cd16bb13d7974c18e3f54460)
- Properly bzero kldstat structure to prevent kernel information leak. (3ff3ec467d4eb11cdbf706cf386935d5e58c2e91) [FreeBSD-SA-17:10.kldstat, CVE-2017-1088]
- CloudABI 0.17 (cf6ac9b4efa43a9c64c5ab311666080a0e8632b1)
- MFH (r325010): don't bother verifying a password that we know is too long. (b242fe393914310e50673eb62d480ce03706d745) [CVE-2016-6210]
Installer

BSDSec

FreeBSD Security Advisory FreeBSD-SA-17:10.kldstat
FreeBSD Security Advisory FreeBSD-SA-17:09.shm
FreeBSD Security Advisory FreeBSD-SA-17:08.ptrace

News

Opening ZFS in 2017 | BSD Now 220

We have a first PS4 kernel exploit, the long awaited OpenZFS devsummit report by Allan, DragonflyBSD 5.0 is out, we show you vmadm to manage jails, parallel processing with Unix tools & more!

Official OpenBSD 6.2 CD set - the only one to be made!

Our dear friend Bob Beck (beck@) writes:
So, again this release the tradition of making Theo do art has continued!
Up for sale by auction to the highest bidder on Ebay is the only OpenBSD 6.2 CD set to be produced.
The case and CD's feature the 6.2 artwork, custom drawn ans signed by Theo.
All proceeds to support OpenBSD
Go have a look at the auction
As with previous OpenBSD auctions, if you are not the successful bidder, we would like to encourage you to donate the equivalent of you highest bid to the project.

Code stuff

rdist out of DragonFly
DragonFly, IPv6, and direct routes
In Other BSDs for 2017/11/18

Interesting Articles

FreeBSD/EC2 on C5 instances
Never too much RAM for DragonFly

p2k17 Hackathon

OpenBSD is holding hackathons as an attempt to get new changes into the source tree quickly. Here are some reports from the latest: 
Florian Obser on network stack progress, kernel relinking and more
Landry Breuil on Mozilla things and much more

Wallpaper of the week


from http://i1-news.softpedia-static.com/images/news2/security-oriented-openbsd-6-2-os-released-with-better-arm-support-improvements-517978-2.jpg




BSD News 13/11/2017

BSD News 13/11/2017

Last week in BSD

News: BSDSec, p2k17, LibreSSL, DragonFly BSD, BSDnow, Minix, OpenBSD
Releases: DragonFly BSD

BSDSec

LibreSSL 2.6.3 Released

Releases

DragonFly 5.0.1 released

This is a bugfix release, adding HAMMER2 support in initrd, among other cleanup commits.

News

We love the ARC | BSD Now 219

Papers we love: ARC by Bryan Cantrill, SSD caching adventures with ZFS, OpenBSD full disk encryption setup & a Perl5 Slack Syslog BSD daemon.

DragonFlyBSD: kernel ppp gone; ppp still there

The ppp kernel module has been removed. It’s still possible to run ppp(8) in userland, with tun(4), so it’s only a change in strategy, not result.

Dragonfly BSD: sys_pipe reoptimized

sys_pipe has been modified to avoid contention on DragonFly, which means better performance as tasks get handed between processors.

Interesting articles

MINIX — The most popular OS in the world, thanks to Intel

In Other BSDs for 2017/11/11


p2k17 Hackathon

OpenBSD is holding hackathons as an attempt to get new changes into the source tree quickly. Here are some reports from the latest: 
Jeremy Evans on ruby progress, postgresql and webdriver work

BSD News 05/09/2016

BSD News 05/09/2016

Last week in BSD

Releases: DesktopBSD, HardenedBSD, OPNsense, GhostBSD, OpenBSD
Other news: OpenBSD, BSDnow, ZFS, Let's Encrypt, g2k16, DragonFlyBSD,

BSDSec


Releases

DesktopBSD-2.0 Gnome test version

We are pleased to announce that DesktopBSD-2.0 Gnome test version is available,  more flavours will come soon.

Based on FreeBSD-10.3 amd64, mainly because UEFI is supported by FreeBSD only for amd64 architecture.

Before burning the ISO to a DVD, please check the md5 or sha256 of the downloaded ISO against those  from our repo

DesktopBSD ISOs are hybrid, UEFI enabled, and can be written to USB sticks using the 'dd' command:
dd if=DESKTOPBSD-2.0-FBSD-20160903-152502-gnome-amd64.iso of=/dev/daN bs=1M conv=sync

(where /dev/daN is your's usb stick)
Bsdstats is included as in DesktopBSD-1.7 Release, so DesktopBSD will be counted in www.bsdstats.org.
Bsdstats can be launched or is launched from console using bsdstats.send, via rc.conf or via cron from /usr/local/etc/poeriodic/monthly/300.statistics.

We have included tools to:
  • Connect to desktopbsd irc channel to get help using desktopbsd-irc
  • Open bugtracker page in forums using desktopbsd-bug-report
  • Get system information using inxi scripts ported from linux

Inxi can be run from console, terminal and even under irc client to send informations in irc channel directly.
desktopbsd-irc plus inxi are great tools to help users in #desktopbsd channel.

ISOs are installable using gbi (GhostBSD Installer) and includes another GhostBSD tools.
Please notice that Eric Turgeon ( GhostBSD founder and developer ) is also in our's dev team.
 
Please test and send bugs using desktopbsd-bug-report to be able to fix them.

To enable desktop icons on desktop please run dconf-editor and go to org.gnome.desktop.background and check show-desktop-icons. (desktop icons are not enabled by default due to a gnome bug)

We'll use for support www.desktopbsd.weebly.com website, desktopbsd.boards.net forum and #desktopbsd irc channel on irc.freenode.server.


New stable version: HardenedBSD-stable 11-STABLE v46.2

HardenedBSD-11-STABLE-v46.2 - https://github.com/HardenedBSD/hardenedBSD-stable/releases/tag/HardenedB...
Installers: http://installer.hardenedbsd.org/pub/HardenedBSD/releases/amd64/amd64/IS...
Git repo: https://github.com/HardenedBSD/hardenedBSD-stable.git
Highlights:
libarchive update (CVE fixes, FreeBSD SA candidate)
sqlite update (CVE fixes, FreeBSD SA candidate)

OPNsense 16.7.3 released

Patch notes:
  • system: allow selection of secondary console
  • system: added EFI as a console option
  • system: fixed status display of tiered gateway groups
  • system: allow to configure sudo usage for administrators
  • system: package manager can no longer uninstall the GUI package (marked as “vital”)
  • system: also beep on factory reset
  • system: added opnsense-code command line utility
  • interfaces: do not store packet captures in /root
  • interfaces: sort interface listings by name only
  • interfaces: do not prevent configuring an IP used by the PPTP and L2TP plugins
  • firewall: add normalisation options for source port and direction
  • firewall: improved parsing of alias input
  • firewall: fixed nesting of aliases with underscores in their names
  • openvpn: fix script mismatch on export page
  • openvpn: added reneg-sec option to server to allow persistent TOTP sessions
  • openvpn: added option to prevent usage of username-as-common-name
  • services: fix WOL widget link
  • services: aligned backend calls of DNS and DHCP
  • services: fix writing of DNS resolver host entries
  • services: simplify configuring of DNS resolver listening addresses
  • services: allow proxy to match against SSL URLs only (contributed by Fabio Mello)
  • lang: updated Source Sans Pro font to improve the cyrillic experience
  • lang: Italian is now a release language (contributed by Antonio Prado)
  • lang: minor updates for Russian (contributed by Smart-Soft Ltd.)
  • lang: minor updates for German and French
  • ports: haproxy 1.6.8[1], php 5.6.25[2], sqlite 3.14.1[3]
  • ports: openvpn 2.3.12[4], libxml 2.9.4[5]

GhostBSD 10.3 Enoch Finally Available

After a year of development, testing and debugging we are pleased to announce the release of GhostBSD 10.3 MATE & XFCE which is available on SourceForge and torrents for the amd64 and i386 architectures.
What's new in GhostBSD 10.3
  • ZFS support
  • UEFI support
  • Installer custom partition creation subjection
  • VirtualBox support get setup at boot time if needed.
  • 4k partition alignment by default
  • GhostBSD Software will be updated Quarterly which will bring more stability to GhostBSD still user will be able to change it to latest to have the latest software update.
What changed in GhostBSD 10.3
  • The installer partition editor UI and partitioning have been improved
  • VirtualBox additions would be uninstall after installer if it is not runnig in a VirtualBox
  • Slim is replacing GDM.
  • Networkmgr display the full SSID
  • Replaced the HTML/CSS installation slide with a GTK/CSS the slide.
What has been fix.
  • Networkmgr SSID list
  • VirtualBox supports
  • Installer MBR partition issue
  • Some installer text error
  • Keyboard layout after installation with MATE
  • Network Manager slowness to open the menu
  • Network Manager icon tray crash
  • Localtime time as been fix
  • Fix boot partition for GPT to supports freebsd-boot, bios-boot and efi
  • System Update duplicating the whole install under /boot/kernel.old
  • sudo configuration
  • Wifi down by default
  • Locales are not correctly set up on installation
Where to download:
The image checksum's, hybrid ISO(DVD, USB) images are available here:
http://www.ghostbsd.org/download


OpenBSD 6.0 released

September 1st, 2016: The OpenBSD team announces the availability of 6.0!
We are pleased to announce the official release of OpenBSD 6.0.
This is our 40th release on CD-ROM (and 41st via FTP/HTTP).  We remain
proud of OpenBSD's record of more than twenty years with only two remote
holes in the default install.

As in our previous releases, 6.0 provides significant improvements,
including new features, in nearly all areas of the system:
Read more...

News

ZFS, The “Universal” Filesystem | BSD Now 157

This week on BSDNow, we have an interview with Richard Yao, who will be telling us about the experience & challenges of porting ZFS to Linux. That plus the latest news & feedback is coming your way, on your place to B….SD!

Let's Encrypt client imported into -current

Kristaps Dzonsons' Let's Encrypt client, letskencrypt, has been imported into OpenBSD-current as acme-client.
letskencrypt, which has previously been available as a port, is a privilege-separated Let's Encrypt (ACME protocol) client written in C.


Code stuff


Interesting articles


BSD News 29/08/2016

BSD News 29/08/2016

Last week in BSD

Releases: FreeBSD, pfSense
Other news: BSDNow, OpenBSD


BSDSec

there seems to be none SA

Releases

FreeBSD 11.0-RC2 Available

The second RC build for the FreeBSD 11.0 release cycle is now available. ISO images for the amd64, armv6, i386, aarch64, powerpc, powerpc64 and sparc64 architectures are available on most of our FreeBSD mirror sites.

2.4 pre-alpha snapshots now available.

pfSense® software version 2.4 pre-alpha snapshots are now available.
pfSense 2.4 will use FreeBSD 11 as a base, and 11.0-RELEASE has not yet occurred.  There will be additional work to use 11.0-RELEASE as a base.
More work at “reduction of technical debt” is occurring in 2.4.  We have decided to not carry forward the kernel patches for Captive Portal.  Instead, it is being re-written to use stock IPFW.  That work is only about 75% complete.  Simultaneously, work is occurring to convert several subsystems (e.g. radius) to use the PEAR equivalents:
There appears to be a bug in pf (likely due to the interaction of one of our patches).  This only manifests under high usage.
New features and changes are listed here.
Full change list:
* source and build tools
* ports
* FreeBSD source
Outstanding bugs/features/todo items:
* Everything else
We advise that you do not use this on a production system yet. If you have the time and interest, we encourage you to try this on a scratch system or VM and provide feedback for any issues you find.

News

The Fresh BSD experience | BSD Now 156

This week on BSDNow, Allan is back from his UK trip & we’ll get to hear his thoughts on the developer summit. That plus all the latest news & an interview with Drew Gurkowski discussing tutorial writing for FreeBSD. Keep it tuned to your place to B...SD!

Code stuff

BSD News 15/08/2016

BSD News 15/08/2016

Last week in BSD

Releases: GhostBSD
Other news: OPNsense, HardenedBSD, OpenBSD, Linux, BSDnow, n2k16, Wallpaper, DragonFlyBSD

BSDSec



Releases

GhostBSD 10.3 RC1 is ready for testing

This first RC release is ready for testing new feature in GhostBSD 10.3, MATE and XFCE is available on SourceForge for the i386, amd64, and amd64-uefi architectures.
Language Undefined

News

New Core Team Member

The OPNsense project is growing rapidly and it’s with great pleasure that the OPNsense core team may announce that our team will be strengthened with Shawn Webb. Shawn has already  been doing lots of great work and his formal membership is seen as a logical step forward by all of us.
Shawn Webb Over the past year, I have had the wonderful experience of working with the OPNsense core team in porting over HardenedBSD’s robust ASLR
implementation. It is with pleasure and humility that I have accepted their invitation to join the core team. My overarching goal will be to port the main features of HardenedBSD to OPNsense.
Address Space Layout Randomization, or ASLR for short, is an exploit mitigation technology that aims to make certain kinds of vulnerabilities
harder to successfully exploit. In order to fully apply ASLR, applications must be compiled as a Position-Independent Executable (PIE). In the short term, my next goal is to enable PIE fully across OPNsense’s ports tree. I’m using HardenedBSD’s ports tree and package building infrastructure as a test bed prior to importing into OPNsense.
OPNsense is investigating migrating to 11.0-RELEASE for its 17.1 release. The Virtual Memory (VM) subsystem has changed drastically between FreeBSD 10 and FreeBSD 11. Since ASLR deals with the VM subsystem, extreme care must be taken in the update of the codebase from FreeBSD 10.3 to 11.0. I will assist in those efforts by freshly porting over the ASLR implementation from HardenedBSD 11.0 to OPNsense’s FreeBSD 11.0 codebase.
I look forward to being a part of the OPNsense core team. The coordination between HardenedBSD and OPNsense will bring a more solid
foundation on which home users and enterprises alike can build secure and scalable networks.

OpenBSD tmpfs on its last legs

As a result of apparent lack of maintenance, Theo de Raadt has disabled tmpfs.

CVSROOT: /cvs
Module name: src
Changes by: deraadt@cvs.openbsd.org 2016/07/25 13:52:56

Modified files:
 sys/conf       : GENERIC 

Log message:
disable tmpfs because it receives zero maintainance.

You probably didn’t use this anyway

The last bits of Linux emulation have been removed from DragonFly.  It’s 32-bit, so it’s been unsupported since DragonFly went to 64-bit only with the 4.0 release.  Also, some other 32-bit only items are gone, including the cs, ep, ex, fe, and vx network drivers.  It’s almost impossible that anyone was using it, but it’s notable because that’s some… 15-20k lines of code gone?  Removal of unused code is also positive.

Myths, Pi's & Features, oh my! | BSD Now 154

This week on BSDNow, we are taking a look at a few different tutorials, including running your very own RPi web-server. (Come-on, you know you’ve thought of it). Plus we have a GhostBSD tutorial, a look at a GitHub project to run Steam Linux on FreeBSD 11 & more!
You’ll want to stick-around for your place to B...SD!


Code stuff


Interesting articles


BSD News 18/07/2016

BSD News 18/07/2016

Last week in BSD

Releases: HardenedBSD, SoloBSD, OPNsense, 
Other news: BSDsec, DragonFly BSD, pfSense, BSDnow

BSDSec


Releases

OPNsense 16.7-RC2 released

16.7-RC2 is here and brings major additions to amd64 architectures: Intel’s Hyperscan library to speed up Suricata rule matching and UEFI boot support! It also brings language packs to their correct 16.7 state, with Japanese already having been completed by the amazing Chie Taguchi. The mirrors have been expanded to allow trackers of -stable or -devel packages to upgrade to the release candidate. Users of LibreSSL wanting to upgrade can now switch to OpenSSL instead of seeing upgrade errors until LibreSSL becomes available again and their systems move back to LibreSSL automatically.
Otherwise, only minor issues have been reported and fixed. This likely means there will not be another release candidate.
New images are available from all known mirrors with all checksums listed after this announcement:
https://opnsense.org/download/
 

New stable release: HardenedBSD-stable 10-STABLE v46.5

HardenedBSD-10-STABLE-v46.5 - https://github.com/HardenedBSD/hardenedBSD-stable/releases/tag/HardenedB...
security updates for: expat, libarchive, file, coverity related fixes
bigger updates for: hyper-v, zfs

SoloBSD 10.3-STABLE-v46.5

There is a new build of SoloBSD 10.3-STABLE based on the latest HardenedBSD stable branch version 46.5
Changelog v46.5
Now with heal-harddrive.sh script included from Martin Sugioarto. Check Instructions of use.
You can grab it from Here. (48.4 Mb)
 root password: solobsd

News

Any Mono/DragonFly users out there?

This is a specialized use case, but Mono 4.x has some issues on DragonFly.  Some minor testing has been done, but if you are already using it, please contribute.

pfSense moves to Apache License

With the pending departure of Chris Buechler, we wanted to find a way to express to the community our continued commitment to keep pfSense® software open source.
As such, pfSense is moving to the Apache License 2.0  in order to align the goals of the project with other (unannounced) offerings from Netgate.  The Apache License 2.0 is a permissive license similar to the MIT License. The main conditions of this license require preservation of copyright and license notices.
Where the 2-Clause and 3-Clause BSD licenses provides no direct language around the areas of copyright, patents and trademarks, the Apache License does. The Apache License is very clear that individual contributors grant copyright license to anyone who receives the code, that their contribution is free from patent encumbrances (and if it is not, that they license that patent to anyone who receives the code,) and that use of Trademarks extends only as far as is necessary to use the product.  As a reminder, only genuine pfSense software can bear the registered trademark of pfSense. It also includes a patent termination clause, should a lawsuit arise.
The Apache License 2.0 is the third most popular license on github. Android, Apache, Chef, Docker, OpenStack, Salt Stack, and Swift use the Apache License 2.0.
Now pfSense does as well.

Sprinkle A Little BSD Into Your Life | BSD Now 150

Today on the show, we are going to be talking to Jim Brown (of BSD Cert Fame) about his home-brew sprinkler system… Wait for it… That runs FreeBSD!
That plus news & of course your feedback, keep it tuned to BSD Now, the place to B...SD!

UEFI booting and manual installation


karu.pruun shares a story of manually installing DragonFly on a UEFI-booting machine.  In this case, it’s a Macbook, though there’s other non-fruit UEFI machines out there?

Code stuff


Interesting articles


BSD News 27/06/2016

BSD News 27/06/2016

Last week in BSD

Releases: seems to be none
Other news: BSDSec, BSDnow, ubuntuBSD, DragonFly BSD, OpenBSD, Google Summer of Code,


BSDSec


Releases

seems to be none

News

Release all the things! | BSD Now 147

On this episode of BSDNow, we will be talking to Glen Barber & Peter Wemm of the FreeBSD RE and Cluster Admin teams! That plus our re-cap of BSDCan and the latest news, all on your place to B...SD!
View attached file (646 MB, video/mp4)

ubuntuBSD 16.04 to feature a combo of BusyBox and OpenRC, no systemd

For those interested in the latest developments of ubuntuBSD, the developer mentions that the official release will come bundled with BusyBox and OpenRC, sans systemd. You can try out the BETA version from their website. In a series of tweets, ubuntuBSD project leader Jon Boden has announced a few of the technical features coming to […]

HEADS UP: world reneeds rebuilding

If you are running DragonFly 4.5 (i.e. bleeding edge), Sepherosa Ziehau made an ifnet change that will require a full buildkernel/world if you want things like netstat to keep working.
 

Code stuff

 

Interesting articles


BSDNews 06/06/2016

BSDNews 06/06/2016

Last week in BSD

Releases: HardenedBSD, SoloBSD, OPNsense
Other news:BSDSec, BSDnow, OpenBSD, DragonFly BSD, Solaris, pkgsrc


BSDSec

 

Releases

New stable release: HardenedBSD-stable 10-STABLE v46.2

HardenedBSD-10-STABLE-v46.2 - https://github.com/HardenedBSD/hardenedBSD-stable/releases/tag/HardenedB...
This is a security update, but by default none of the currently released FreeBSD SAs affect HardenedBSD, since we fixed the libarchive issue in v46.1 and the COMPAT layers are disabled by default.
https://security.freebsd.org/advisories/FreeBSD-SA-16:22.libarchive.asc
https://security.freebsd.org/advisories/FreeBSD-SA-16:21.43bsd.asc
https://security.freebsd.org/advisories/FreeBSD-SA-16:20.linux.asc

New stable version: HardenedBSD-stable 10-STABLE v46.3

HardenedBSD-10-STABLE-v46.3
https://github.com/HardenedBSD/hardenedBSD-stable/releases/tag/HardenedB...
http://installer.hardenedbsd.org/pub/HardenedBSD/releases/amd64/amd64/IS...
https://www.freebsd.org/security/advisories/FreeBSD-SA-16:24.ntp.asc
This release is an NTPd secuirty update.

SoloBSD 10.3-STABLE-v46.2

There is a new build of SoloBSD 10.3-STABLE based on the latest HardenedBSD stable branch version 46.2
You can grab it from Here. (61.7 Mb)
root password: solobsd

OPNsense 16.1.16 released

It has been a long journey for HardenedBSD and OPNsense, and finally the paths start to merge as the splendid and battle-proven ASLR implementation gets incorporated into the default installation! It is just the beginning as we will start to leverage the extra security by enabling position independent execution in 16.7 and merge more security-related features. We thank again the HardenedBSD team for their continued efforts on making this world a safer place.
In other news, there is a thoroughly revamped dashboard for you to enjoy and a handful of security fixes in FreeBSD and the ports ecosystem. LibreSSL has been updated to the latest production release and the BETA version is progressing nicely as we change our working mode from “rework all the things” to “polish all the things”. A release candidate is coming up soon.


News

[FreeBSD-Announce] 2016 FreeBSD Community Survey

Hi everyone, The FreeBSD Foundation needs your input. Please help us by filling out the 2016 FreeBSD Community Survey. The survey should only take about 10 minutes, and will help us determine the direction of our efforts in supporting the Project and community. Please submit all responses by July, 7, 2016. https://www.surveymonkey.com/r/freebsd2016 We appreciate your feedback! Thanks Anne Anne Dickison Marketing Director FreeBSD Foundation

bsdtalk265 - Sunset on BSD

A brief description of playing around with SunOS 4.1.4, which was the last version of SunOS to be based on BSD.
File Info: 17Min, 8Mb
Ogg Link: https://archive.org/download/bsdtalk265/bsdtalk265.ogg
View attached file (bsdtalk265.mp3, audio/mpeg)
 

The PF life | BSD Now 144

It’s only one-week away from BSDCan, both Allan & I are excited to meet some of you in person! However, the show keeps on chugging & this week we have an interview with Kristof Provost, to tell us about PF improvements in FreeBSD. That plus the latest news, here on your place to B….SD!
View attached file (412 MB, video/mp4)

hbsd-update now installing Integriforce ruleset

We are excited to announce the ability to easily utilize Integriforce with base. From now on, hbsd-update(8) will install a full Integriforce ruleset as /etc/secadm.d/base.integriforce.rules for base. If you include this file in your normal secadm.rules(5) ruleset, you will get full integrity enforcement on all executable files in base. If you include the applications from ports/packages in your secadm.rules(5) file, you can turn on whitelisting mode, in which case, all executable files that aren't protected by Integriforce will be denied execution. If you only utilize applications from base, you can turn on whitelisting mode and get the same results.
Using the Integriforce ruleset is entirely optional, but highly recommended.
An example secadm.rules file might look something like this:

secadm {
    pax {
        path: "/usr/local/lib/firefox/firefox",
        pageexec: false,
        mprotect: false
    }

    .include "/etc/secadm.d/base.integriforce.rules"
}
 

Code stuff

 

Interesting articles

BSD News 31/05/2016

BSD News 31/05/2016

Last week in BSD

Releases: pfSense, NetBSD, OPNsense, GhostBSD, SoloBSD,
Other news: Talks, OpenBSD, BSDnow, DragonFly BSD


BSDSec



Releases

pfSense 2.3.1 Update 1 Available

2.3.1 Update 1 (2.3.1_1) is now available. This includes one security fix to the web GUI, and 7 other bug fixes. The 2.3.1-RELEASE change list has been updated with an Update 1 section specifying the changes.
This update will reboot the system after installing.

NetBSD 7.0.1 released

The NetBSD Project is pleased to announce NetBSD 7.0.1, the first security/bugfix update of the NetBSD 7.0 release branch. It represents a selected subset of fixes deemed important for security or stability reasons. If you are running an earlier release of NetBSD, we strongly suggest updating to 7.0.1.
For more details, please see the release notes.
Complete source and binaries for NetBSD are available for download at many sites around the world. A list of download sites providing FTP, AnonCVS, SUP, and other services may be found at http://www.NetBSD.org/mirrors/

OPNsense 16.1.15 released

Here are the full patch notes for 16.1.15:
  • system: make authentication fallback configurable
  • system: settings cleanup and prettify
  • system: added explicit ETC timezone selection
  • high availability: add page for remote service control
  • high availability: properly enforce authentication
  • firmware: reboot and poweroff API actions
  • firmware: only kill GUI process, not captive portal
  • firmware: show errors in update window
  • firmware: keep polling for progress even when GUI restarts
  • backend: skip failing templates on bootup
  • trust: fix CA certificate count in overview
  • trust: allow key size up to 8192 bits
  • firewall: fix invalid NPT rule generation
  • firewall: speed up filter log pages
  • firewall: do not allow to change virtual IP mode after creation
  • firewall: moved settings page and rearranged settings accordingly
  • interfaces: unhook all but the last custom PHP module functions
  • interfaces: moved settings page and rearranged settings accordingly
  • dhcp: do not override RA settings after save
  • dns: resolver outgoing interface section moved to advanced as it will break setups with dynamic interfaces selected there
  • load balancer: sticky mode from firewall / system split off as separate setting
  • snmp: do not allow unicode in system location
  • intrusion detection: remove deprecated rbn-malvertisers.rules set
  • intrusion detection: add promiscuous mode / physical interface selection
  • overall: fix menu width on small size screens
  • overall: numerous translation fixes (contributed by Frederic Lietart)
  • overall: numerous translation fixes (contributed by Fabian Franz)
  • plugins: assorted bugfixes for HAProxy (contributed by Frank Wall)
  • mvc: fix translations by adding an escaping wrapper

GhostBSD 10.3 ALPHA2 is ready for testing

This second ALPHA development release is for testing and debugging new feature in GhostBSD 10.3, MATE and XFCE is available on SourceForge for the i386, amd64, and amd64-uefi architectures.

SoloBSD 10.3-STABLE-v46.1

There is a new build of SoloBSD 10.3-STABLE based on the latest HardenedBSD stable branch version 46.1
You can grab it from Here. (61.6 Mb)
root password: solobsd


News

FreeBSD Now Has Initial Graphics Support For Bhyve

Bhyve, the hypervisor developed by FreeBSD that supports running BSD/Linux/Windows guests, has initial graphics support...

Most Free/Open Source Software users run Linux as their operating system of choice, choosing one (or more) of the 300 or so distros currently active on DistroWatch. Not as many have crossed the street, rhetorically speaking, and taken a look at the other Open Source operating system, BSD and its many variants.
As a long time and current Linux user new to PC-BSD — essentially the BSD equivalent to Linux Mint — my intention is to:
· Outline the (many) similarities and (few) differences between Linux and BSD,
· Walk the audience through the process of moving from Linux to BSD, unless the audience is in a hurry, then I’ll run them through it,
· Describe the ease-of-use and pitfalls of day-to-day use of PC-BSD for the average user, and
· How to pitch in and make code and other contributions (e.g., documentation, translation) to BSD variants, even while doing the same for Linux distributions,
· And more!

Privilege Separation and Pledge (video)

This year's dotSecurity conference featured a presentation from OpenBSD founder Theo de Raadt, titled "Privilege Separation and Pledge." The video is now available here, in addition to the slides.

One small step for DRM, one giant leap for BSD | BSD Now 143

This week on BSDNow, we have an interview with Matthew Macy, who has some exciting news to share with us regarding the state of graphics on FreeBSD. That plus all the latest news on BSDNow, the place to B...SD!
View attached file (770 MB, video/mp4)

OpenBSD ARMv7 now has a bootloader

Progress on the armv7 platform continues, and Jonathan Gray writes in to the arm@ mailing list with some promising news:
There is now a bootloader for armv7 thanks to kettenis@ Recent armv7 snapshots will configure disks to use efiboot and install device tree dtb files on a fat partition at the start of the disk. u-boot kernel images are no longer part of the release but can still be built for the time being. We are going to start assuming the kernel has been loaded with a dtb file to describe the hardware sometime soon. Those doing new installs can ignore the details but here they are. 


Code stuff



Interesting articles


BSD News 23/05/2016

BSD News 23/05/2016

Last week in BSD

Releases: HardenedBSD, SoloBSD, SmallWall, pfSense, OPNsense, 
Other news: BSDSec, BSDnow, BSD Magazine, DragonFlyBSD, p2k16, freeNAS, OpenBSD

BSDSec


Releases

HardenedBSD-stable 10-STABLE v46.1

HardenedBSD-10-STABLE-v46.1
----------------------------------------
https://github.com/HardenedBSD/hardenedBSD-stable/releases/tag/HardenedB...
https://github.com/HardenedBSD/hardenedBSD-stable/commits/HardenedBSD-10...
This release fixes CVE-1541 and CVE-2015-2304 in libarchive, a lot of Coverity warnings / programing errors and an overflow in amd64's sysarch system call (00696f0, eac2aab, bd784f7).

SoloBSD 10.3-STABLE-v46

There is a new build of SoloBSD 10.3-STABLE based on the latest HardenedBSD stable branch version 46
You can grab it from Here. (61.7 Mb)
root password: solobsd

SmallWall 1.8.4b10 beta release

Just released a new beta with updated mini-httpd, and many t1n1wall changes ported in.

New stable version: HardenedBSD-stable 11-CURRENT v46.2

HardenedBSD-11-CURRENT-v46.2 - https://github.com/HardenedBSD/hardenedBSD-stable/releases/tag/HardenedB...
UPDATE TO THIS RELEASE IS STRONGLY ADVISED!
This release fixes two locally exploitable security issue, namely the followings:
https://security.freebsd.org/advisories/FreeBSD-SA-16:19.sendmsg.asc
https://security.freebsd.org/advisories/FreeBSD-SA-16:18.atkbd.asc

pfSense 2.3.1-RELEASE Now Available!

We are happy to announce the release of pfSense® software version 2.3.1!
This is a maintenance release in the 2.3.x series, bringing a number of bug fixes, two security fixes in the GUI, as well as security fixes for OpenSSL, OpenVPN and FreeBSD atkbd and sendmsg. The full list of changes is on the 2.3.1 New Features and Changes page.
This release includes a total of 103 bug fixes. 79 regressions in 2.3 have been fixed, mostly minor issues in the new GUI. Several of these are significant issues, and have resolved nearly all the post-upgrade problems encountered in 2.3-RELEASE. 24 issues affecting 2.2.x and prior versions have also been fixed.
If you haven’t yet caught up on the changes in 2.3.x, check out the Features and Highlights video. Past blog posts have covered some of the changes, such as the performance improvements from tryforward, and the webGUI update.

OPNsense 16.1.14 released

How about an update with your new NetFlow remote export. Or your local reporting frontend? Well, you can always use both if you like. Read all about it here: https://docs.opnsense.org/manual/netflow.html
Furthermore, we have added the brand new AQM CoDel version 0.2.1 to the mix, yesterday’s FreeBSD security advisories, released the HAProxy plugin, bundled a full Japanese translation.
There is also a refreshed website for our general viewing pleasure.
https://opnsense.org/

News

Diving for BSD Perls | BSD Now 142

This week on the show, we have all the latest news and stories! Plus an interview with BSD developer Alfred Perlstein, that you won’t want to miss. Sit tight, the show starts now on your place to B...SD!
 

BSD Magazine for May 2016 out

The May issue of BSD Magazine is available now.  There’s articles on ZFS, OpenBSD’s arc4random, an interview of Fernando Rodríguez of KeepCoding, and more.  It’s a free PDF download if you didn’t know.

eX, clisp, and DragonFly

DragonFly versions of TeX have been available for some time now.  However, Nelson Beebe, who is part of the TeX project, is having trouble building some related binaries – asymptote and clisp.  He could use help from anyone interested, to match up with this summer’s release of TeX 2016.

Mounting as non-root

Read this email thread for how to mount devices (e.g. USB drives) in DragonFly when you aren’t root.

Code stuff 

p2k16 Hackathon Report: pirofti@ on octeon and TPM

Interesting articles