DiscoverBSD

Showing posts with label OpenSSH. Show all posts

Last week in BSD

Releases:OPNsense, HardenedBSD, SoloBSD, FreeBSD
Other news:BSDnow, BSDSec, OpenSSH, OPNsense, FreeBSD, ZFS, VAX, OpenBSD, Netflix

BSDSec

OpenSSH Security Advisory: xauth command injection

Releases

HardenedBSD-stable 10-STABLE v42.1

HardenedBSD-10-STABLE-v42.1 - https://github.com/HardenedBSD/hardenedBSD-stable/releases/tag/HardenedB...

SoloBSD 10.3-PRERELEASE-v42.1

There is a new build of SoloBSD 10.3-PRERELEASE based on the latest HardenedBSD stable branch version 42.1
- Changelog v42.1

Marius Strobl has announced the availability of the second release candidate for the upcoming stable release of FreeBSD 10.3: "The second release candidate build of the 10.3-RELEASE release cycle is now available. Noteworthy changes since 10.3-RC1: under certain circumstances, 'zfs send -i', i. e. incremental ZFS send, could lead to data corruption, which has been addressed by importing an upstream fix; boot loaders and kernel have been taught to handle ELF sections of type SHT_AMD64_UNWIND just the same as SHT_PROGBITS when loading modules; while not directly relevant for 10.3-RELEASE, CLANG as of version 3.8 started to produce sections of the former type in amd64 modules and this changes will simplify upgrades from 10.3-RELEASE to 11.0-RELEASE later on; as part of closing or syncing a hash(3)-based database file, fsync(2) now is called on the latter - this ensures that changes are on disk when shutting down a machine, which previously was not always the case with soft updates in place." See the complete release announcement for further details. Download the amd64 and i386 installation DVD images from here: FreeBSD-10.3-RC2-amd64-dvd1.iso (2,636MB, SHA256), FreeBSD-10.3-RC2-i386-dvd1.iso (2,446MB, SHA256).

OPNsense 16.1.6

This time around, DHCP and DNS have been freshened up thoroughly, removing both potential and real problems from the GUI and underneath. Additionally, the proxy server gained ICAP support and a category-based remote block list selection. Our firmware mirror support has finally been extended so that it is now possible to pull all updates from a single mirror, which will very soon make it possible to run a local mirror for your internal installations. We are also shipping the original FreeBSD OpenSSL patch, although the security issues cannot not surface on OPNsense.

News

New Video Tutorial on the Pipelight Plugin and Netflix in PC-BSD

We recently looked at the pipelight port that recently received a patch in the ports tree and made a video for you guys.
I’ll just leave this here…
Watching Netflix in PC-BSD

The VAX platform is no more

After much internal discussion, OpenBSD has officially discontinued support for the VAX architecture. In a series of commits, Theo de Raadt puts the platform to rest. Read more...

Scaling up with BSD | BSD Now 132

This week, Allan & I are away at AsiaBSDCon! (If you aren’t there, you are missing out). We will be back with a live episode next week. However, we’ve been asked for Allan to tell us about ScaleEngine’s use of BSD for a while now & we want to take this time to share it with you.
That & some Beastie Bits for your consumption, all this week on BSDNow.

View attached file (417 MB, video/mp4)

Code stuff

Improvements for kqueue and per-CPU caching

Hammer not show

New CPUTYPE variables

In Other BSDs for 2016/03/12

Interesting articles

PlayOnBSD (run Windows software)

How-To: Install FreeBSD (with Gui!)

How-To: Add failed HDD back into a ZFS mirror

BSD News 08/06/2015

JH 3:55 AM Add Comment

Last week in BSD

Releases: OPNsense
Other news: DragonFly BSD, nginx, FreeBSD, HardenedBSD, freeNAS, DragonFly BSD, OpenSSH

BSDSec

[FreeBSD-Announce] HEADS UP: FreeBSD 8.4 EoL coming soon

Releases

OPNsense version 15.1.11.2 Released

notable ports upgrades: pcre 8.37, pkg 1.5.3, ca_root_nss 3.19.1
aliases: fix javascript error that prevented aliases from working
traffic shaper: rewrote the feature using standard components on top of the new MVC framework/API (see Firewall: Traffic Shaper)
system: enabled first few hundred translations of Simplified Chinese to help the community to progress and review said translation (see System: Settings: General)
vpn: all GUI files underwent a thorough coding style refresh
firmware: prevent spurious “Module already loaded” errors while upgrading PHP packages

OPNsense version 15.1.11.3 Released

config: improved the deletion of backups
wifi: do not launch FreeBSD’s rc scripts on 802.11 attach/detach
ipfw: always forward traffic coming from localhost
system: apply PSR2 coding style to GUI pages
captive portal: apply PSR2 coding style to GUI page

Other news

Nginx and DragonFly

If you’re using nginx on DragonFly, version 1.9.1 has specific DragonFly speedup options built in.

Microsoft Announces Support for SSH

Windows admins rejoice! Microsoft's PowerShell Team announced future support for SSH, specifically OpenSSH:

[T]he PowerShell team realized the best option will be for our team to adopt an industry proven solution while providing tight integration with Windows; a solution that Microsoft will deliver in Windows while working closely with subject matter experts across the planet to build it. Based on these goals, I’m pleased to announce that the PowerShell team will support and contribute to the OpenSSH community - Very excited to work with the OpenSSH community to deliver the PowerShell and Windows SSH solution!
A follow up question the reader might have is When and How will the SSH support be available? The team is in the early planning phase, and there’re not exact days yet. However the PowerShell team will provide details in the near future on availability dates.

Emphasis in the original. Wider adoption of secure technologies can only benefit the community. Hopefully that future is actually near, both for deployment and 'support and contribution'.

BSD After Midnight | BSD Now 92

Coming up this week, we'll be chatting with Lucas Holt, founder of MidnightBSD. It's a slightly lesser-known fork of FreeBSD, with a focus on easy desktop use. We'll find out what's different about it and why it was created. Answers to your emails and all this week's news, on BSD Now - the place to B.. SD.

KMS/console in master for DragonFly

Those changes I mentioned yesterday for text console support? They’re in DragonFly-master now, along with a loader tunable to turn it on and off.

Code stuff

DragonFly Radeon updates
HardenedBSD secadm 0.2.3 Released
USB ethernet adapters and DragonFly
In Other BSDs for 2015/06/06

Interesting articles

libvirt/libxl on FreeBSD
FreeNAS 10 Hackathon
OpenStack on FreeBSD/Xen Proof of Concept

Wallpaper of the week

via +RandyBelk (album)

BSD News 23/03/15

JH 10:36 AM Add Comment

Last week in BSD

Releases: pfSense, GhostBSD, DragonFly, BSDrp
Other news: BSDSec, FreeNAS, DragonFly, LibreSSL, NetBSD, AsiaBSDCon, BSDnow, OpenBSD, OpenSSH, HardenedBSD,

BSDSec

LibreSSL 2.1.5 released
LibreSSL 2.1.6 released
libxfont errata
libre/openssl patches available
[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-15:06.openssl
[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-15:06.openssl [REVISED]
NetBSD Security Advisory 2015-003: NTPd multiple vulnerabilities (CVE-2014-929[3-6])
NetBSD Security Advisory 2015-004: Two vulnerabilities in the compatibility layers
NetBSD Security Advisory 2015-005: buffer overflow in libevent (CVE-2014-6272)
NetBSD Security Advisory 2015-006: OpenSSL and SSLv3 vulnerabilities

Releases

BSD Router Project

BSDRP 1.55 is out: It includes latest FreeBSD security fixes and pmacct.

2.2.1 RELEASE Now Available

pfSense® software 2.2.1 release is now available, bringing a number of bug fixes and some security fixes.

DragonFly 4.0.5 out

I’ve tagged version 4.0.5 of DragonFly, and it’s available at your nearest mirror. This revision is mostly to incorporate the newest OpenSSL security bump.

GhostBSD 10.1 Alpha 2 now available

Changes and fix between 10.1-ALPHA1 and 10.1-ALPHA2 include:

The PCDM theme file as been fixed which was creating blinking black screen.
Macro windows decoration has been fixed.
The installer GPT partition problem has been found and fixed in pc-sysintall.
Some installer text error has been fix.
The user shell selection has been fix from the last change to have csh by default since fish have a bug from the ports.

Other news

NetBSD ported to Hardkernel ODROID-C1

The Hardkernel ODROID-C1 is a quad-core ARMv7 development board that features an Amlogic S805 SoC (quad-core Cortex-A5 @ 1.5GHz), 1GB RAM and gigabit ethernet for $35 USD.
The ODROID-C1 is the first Cortex-A5 board supported by NetBSD. Matt Thomas (matt@) added initial Cortex-A5 support to the tree, and based on his work I added support for the Amlogic S805 SoC.
NetBSD -current (and soon 7.0) includes support for this board with the ODROID-C1 kernel.

Puffy in a Box | BSD Now 81

We're back from AsiaBSDCon! This week on the show, we'll be talking to Lawrence Teo about how Calyptix uses OpenBSD in their line of commercial routers. They're getting BSD in the hands of Windows admins who don't even realize it.

Introducing NoExec

Over the past few months, Oliver has been busy writing a new exploit mitigation feature for HardenedBSD: NoExec. The first part of this project was merged into master tree, and there are still ongoing issues to solve. Our implementation is inspired by PaX's. NoExec prevents pages that are marked as writable from being marked executable as well. It also prevents using mprotect(2) to change a non-executable page to an executable one. This, of course, can cause issues with applications that expect to be able to mark existing pages as executable. Firefox is a good example. You will need to either jail the application in a jail with NoExec turned off or use secadm to turn off NoExec for that application.
This feature bumps the HardenedBSD version number up to 17. We're doing a new package build as well. You'll also get some applications built as Position-Independent Executables (PIEs) with this package build.

Donation request for network SMP development

Martin Pieuchot (mpi@) writes in about what's needed for further SMP improvements in the network stack:

If you've been following my contributions to OpenBSD's kernel, you already know that in the past years I've been working on the Network Stack to make it more SMP friendly. All the network hackers present at s2k15 agreed to volunteer me to work on the next step: properly integrate the pseudo-drivers (carp(4), vlan(4), trunk(4)...) in order to take ether_input() out of the kernel lock.

bsdtalk252 - devio.us with Brian Callahan

An interview with devio.us admin Brian Callahan. http://devio.us is a free shell provider that runs on OpenBSD.
File Info: 18Min, 8MB.
Ogg Link: https://archive.org/download/bsdtalk252/bsdtalk252.ogg

Code stuff

DRM 3.8 update committed
New sshlockout option
OpenSSH 6.8 Released
In Other BSDs for 2015/03/21

Interesting articles

The FreeNAS Hardware Guide You’ve Asked For | Does ZIL Size Matter? Issue #18
Unifying Mesa ports’ configure
AsiaBSDCon 2015 Recap

Wallpaper of the week

as found at http://ghostbsd.org/wallpaper

BSD News 11/11/13

JH 1:16 AM Add Comment

Last week in BSD
Releases: FreeBSD, GhostBSD, Security Router
Other News:DragonFly BSD, portmgr@ , OpenBSD, OpenSSH, b2k13 hackathon, BSDnow, PC-BSD

Releases

FreeBSD 10.0-BETA3 now available

The third BETA build of the 10.0-RELEASE release cycle is now available on the FTP servers for the amd64, i386, ia64, powerpc, powerpc64 and sparc64 architectures.

ISO images and, for architectures that support it, the memory stick images are available here or at any of the FreeBSD mirror sites.

Checksums for the installation images are available in the announcement email.

Changes between -BETA2 and -BETA3 include:

Several small fixes for the amd64 minidump code.
Add a 'pkg bootstrap' command which will bootstrap pkg(8) without forwarding any command to it after installation.
Fix make(1) warning output with 'make delete-old' and 'make delete-old-libs'
Add kernel side support for large TLB on BERI/CHERI.
Fix compatibility function for old daily_status_security_${name}_enable variables.
Add loader.conf(5) entries to import bootpool after boot when using full-disk encryption and ZFS.
Switch the default mtree to nmtree our new NetBSD derived mtree.
Remove the (unused) isf(4) driver.
Separate WITHOUT_CLANG and WITHOUT_CLANG_IS_CC.
Add atse(4), a driver for the Altera Triple Speed Ethernet MegaCore.
Fix a deadlock when trying to power off a USB device.
Support checking signature for pkg bootstrap from remote and for 'pkg add ./pkg.txz'
Fix long-standing issue with incorrect radix mask calculation.
Add support for using "pkg+http://" for the PACKAGESITE.
Add driver for POWER hypervisor interpartition ethernet.
Fix panic in the tap driver when a tap and vmnet interface were created after each other.

Pre-installed virtual machine images for 10.0-BETA3 are also available for amd64 and i386 architectures.

GhostBSD 3.5 “Levi” released

Eric Turgeon has announced, on behalf of the GhostBSD team, GhostBSD 3.5 Levi. Levi is the third release of the 3.* branch which improves GhostBSD 3.1 and introduces some new features.
Some of the new features are included in the last stable version are:

OpenSSL has been updated to version 0.9.8y.
DTrace hooks have been enabled by default in the GENERIC kernel.
DTrace has been updated to version 1.9.0.
OpenSSH has been updated to version 6.2p2.
Gnome 2.32 has been replace by Mate 1.6.
Xfce 4.10 is now part of desktop choice.
GhostBSD BSM theme with custom Faenza icon.
Mate, Xfce and LXDE contain a more uniform set of software.
Gimp is now install by default.
Shotwell is now install by default.
The installer GBI as been updated to 1.3.

The Coding Studio has a number of GhostBSD 3.5 screenshots, should you be interested to see how it looks without having to install it.

Security router 3.2 based on OpenBSD 5.4

Today we’ll release version 3.2 (winter) of our security router. The reason for the 3.1-to-2 bump is the update from OpenBSD 5.3 to 5.4; signalling the fact that despite having few new features, it represents a major bump in under-the-hood changes, which results in a very large “binary diff” compared to minor version updates.
OpenBSD 5.4 was released only a few days ago, but because the code has been mostly frozen for several months, we’ve had plenty of time for testing. There are several reasons for why we closely track the OpenBSD and FreeBSD project’s progress and releases;

Our products benefit from advances in those projects, such as new features and improved hardware support.
Because we offer root login and modularity, our users appreciate the fact that the base system isn’t outdated.
Modernisation of our own code; utilising better and more efficient system APIs, following their style and conventions, and making our daemons and utilities fit into OpenBSD as good as possible.
Because we share all our patches, we can minimise our number of patches because they are continuously incorporated into OpenBSD.

Other News

DragonFly 3.6 branched

Branched, not released. The release should happen in two weeks. One major bug has been squished, and remember the upgrade process from 3.4 to 3.6 is a little different from normal.

Getting to know your portmgr@ — Mathieu Arnold

In this interview, we take a short break from the usual, and interview a portmgr-lurker@, Mathieu Arnold. He was one of the founding members of perl@ back in the day.

DragonFly developer interview

DragonFly developer Francois Tigeot was interviewed on linuxfr.org. As you can probably guess from the names, it’s a French site, but don’t let that stop you if you’re an Anglophone.

OSPF over IPsec

Maxim Bourmistrov (maxim<at>unixconn<dot>com) wrote in to tell us about his Open Shortest Path First (OSPF) over IP Security Protocol (IPsec).

While looking for a solution for OSPF over IPsec, I found a lot of articles about how to do this over gre(4). The other possibility is to use gif(4) instead. I've tested both and was not quite happy with results. The gre(4) approach had some generic issues and the gif(4) approach had problems with multicast at times. Yet, I need to have "OSPF over IPsec" up and running.
Luckily, I remembered Theos' presentation about vether(4). While Theos' presentation was mostly written from developer perspective and not from administrators point of view, he left some clues about how this can be done.
The info below is how I do "OSPF over IPsec", or should I say "OSPF on top on vether on top of gif on top of IPsec".

Read more...

OpenSSH Security Advisory

b2k13 hackathon report: Henning Brauer (henning@) on Lazy IP Checksumming

Henning Brauer (henning@) just sent in his report from the b2k13 hackathon, but there's also a short interview with Henning over on ioexception.de which you might enjoy.

Berlin was a really convenient hackathon location for me, since getting there from Hamburg feels like a little longer S-Bahn ride. The fast ICE train makes it only a 90 minute trip. I arrived half a day later than intended due to work interfering, but I quickly got going.