DiscoverBSD

Home m0n0wall

Showing posts with label m0n0wall. Show all posts

BSD News 09/03/2015

JH 3:06 AM Add Comment

Last week in BSD

GhostBSD, OpenBSD, BSDSec, FreeBSD, Google Summer of Code, DragonFly BSD, PC-BSD, m0n0wall, s2k15, BSDnow, NetBSD,

BSDSec

FreeBSD 10.0-RELEASE End of Life
errata for X server infoleak
LibreSSL 2.1.4 released

Releases

seems to be none

Other news

Ted Unangst: Improving Browser Security

In a recent post to misc@, Ted Unangst (tedu@), outlined some of his upcoming work on improving browser security. Ted writes,

A few words about a project I've started working on today with support from the OpenBSD Foundation.

Summer of Code 2015 Project Ideas Announced

The OpenBSD foundation has published its Project Ideas List for this year's Google-sponsored Summer of Code. If you're a student with an appropriate background, this could be your chance to take a stab at contributing to the OpenBSD code base, with OpenBSD developers as your mentors.
The Foundation and the OpenBSD project do not guarantee that SOC projects are accepted into the OpenBSD code base, but it's worth trying, isn't it?
Check out the list and see if there's something there you want to spend most of the summer hacking on.

Just Add QEMU | BSD Now 79

Watch here: http://youtu.be/ohf_Dp55O9I

Coming up this time on the show, we'll be talking to Sean Bruno. He's been using poudriere and QEMU to cross compile binary packages, and has some interesting stories to tell about it. We've also got answers to viewer-submitted questions and all this week's news, on BSD Now - the place to B.. SD.

Tarsnap Mastery book out

Michael W. Lucas’s Tarsnap Mastery book is out, in electronic form. While not a strictly BSD news items, it’s a service built on BSD, so worth looking at if you care about that – or about encryption.

Code Stuff

GhostBSD Development News - 03/01/2014
A look at the upcoming features for PC-BSD 10.1.2
s2k15 Hackathon Report: Jonathan Gray on X Graphic Acceleration Improvements, afl fuzzer
s2k15 Hackathon Report: tedu@ on UVM SMP
In Other BSDs for 2015/03/07
CI20 reaches userland

Interesting Articles

End of the m0n0wall project and alternatives
cache line aliasing effects, or "why is freebsd slower than linux?"

Wallpaper of the week

as found at http://hdw.eweb4.com/out/637260.html

End of the m0n0wall project and alternatives

JH 5:32 AM Add Comment

So what's m0n0wall?

m0n0wall is a project aimed at creating a complete, embedded firewall software package that, when used together with an embedded PC, provides all the important features of commercial firewall boxes (including ease of use) at a fraction of the price (free software).

m0n0wall is based on a bare-bones version of FreeBSD, along with a web server, PHP and a few other utilities. The entire system configuration is stored in one single XML text file to keep things transparent.

m0n0wall is probably the first UNIX system that has its boot-time configuration done with PHP, rather than the usual shell scripts, and that has the entire system configuration stored in XML format.

Unfortunately, on 2/15/2015 - End of the m0n0wall project was announced with official reason "there are now better solutions available and under active development".

So where to move now?

As m0n0wall maintainer suggested, people have 2 options, depending on what they need:

the same light firewall
don't mind more robust solution

Let's start with people who don't mind migrating to more robust solution "like pfSense, FreeNAS and AskoziaPBX. The newest offspring, OPNsense ... and I encourage all current m0n0wall users to check out OPNsense and contribute...".

"If you are happy with the current feature set of m0n0wall and just need a security patch, bug fix, hardware compatibility update or minor improvement now and then, there are two nascent projects started by former m0n0wall developers/users that may have something for you: SmallWall and t1n1wall."

So what are those projects and what they wanna do?

t1n1wall

According to forum, at the moment, the only list of plans is to:

Fix the ipsec bug when l2tp is enabled
Fix an outstanding RA announce problem that fills logs
Add support for ippools
Possibly update DDNS to support NAT and Cloudflare

As author says: "I don't have any plans to change from what m0n0wall was, stay using a RAM based disk system, and keep it small. I hope to keep it up to date, squash bugs and apply security fixes, and hopefully get the 10.1 version completed , so it supports more hardware."

You can get snapshots at: http://sourceforge.net/projects/t1n1wall/files/snapshots/

SmallWall

Project philosophy according to website

Small, lean and elegant code - There is no need for bloat
Do one thing, and do it well - This is a security device, not a print server
Simple is good - Doing things the right way should be easy
Form Follows Function - I like pretty, but not at the expense of performance

And:

"But this is not going to be m0n0wall unchanged. There are some things that I would like to see changed.

Re-basing to support newer hardware
Adding newer VPN support
More attractive UI
Easier integration with IDS/SEM systems"

You may download it http://smallwall.org/download.html.

So, what is your escape plan?

BSD News 02/03/2015

JH 8:34 AM Add Comment

Last week in BSD
Releases: OPNsense
Other news: DragonFly BSD, BSDSec, SCALE, pfSense, OpenBSD, ZFS, m0n0wall, BSDTalk

BSDSec
FreeBSD Security Advisory FreeBSD-SA-15:05.bind
FreeBSD Security Advisory FreeBSD-SA-15:04.igmp

Releases

OPNsense version 15.1.6.1 Released
OPNsense version 15.1.7 Released

Change Log 15.1.6.1:

Don’t clobber user and group settings when running opnsense-update. Caused e.g. dhcpd to refuse operation.
Fix a regression that would prevent e.g. sshd from starting.
Install opnsense-update by default.

This is the official change log for 15.1.7:

Merged the latest FreeBSD 10.1-p6 patches:

Disabled OpenSSH’s High Performance SSH/SCP and None-Cipher extensions to follow up on several security-related discussions.
Switched from a heavy Bind installation to a lightweight one to reduce attack surface.
Removed and replaced the legacy `check_reload_status’ daemon with a Python-based rewrite.
Fixed the auto-login console lockout regression introduced in 15.1.6.1.
Fixed a problem associated with OpenVPN not being able to read passwords from files.
Notable ports upgrades: bind-tools 9.10.2, strongswan 5.2.2_1, curl 7.41 plus our LibreSSL fixes for mpd4/mpd5/libpdel.
Removed PHP-FPM remnants from IPv6 and OpenVPN scripts.
Fixed several OpenSSL invokes to use the latest port version as opposed to the base version.
Improved memory/disc/swap usage on the dashboard.
Properly set DNS Resolver Advanced defaults.
Fixed append of custom Unbound scrips.
Modified the root menu shell to pass through to a real shell when arguments are given.
Zapped the spurious “Array” prefix in user-defined aliases.
Moved the bogons files fetch location to a local mirror.
The core.git development boot hook has been improved to properly include /usr/local/etc/rc changes.
All of our packages are now annotated as coming from our mirror as well as additional safeguards potentially allowing you to use additional FreeBSD packages on top of OPNsense.

Other news

Final message - mailing list and forum frozen

As announced earlier, the m0n0wall mailing list and forum are now frozen. This is the final message, and I would like to take the opportunity to thank all those who have sent me emails with kind words and expressions of gratitude. They were too numerous for me to reply to individually, but they were all very much appreciated!
There have been some questions on what the way forward is for current m0n0wall users. If you are happy with the current feature set of m0n0wall and just need a security patch, bug fix, hardware compatibility update or minor improvement now and then, there are two nascent projects started by former m0n0wall developers/users that may have something for you: SmallWall and t1n1wall.
For a more feature-rich alternative that is still based on FreeBSD and has the same roots, both pfSense and OPNsense (which is a fork of the former) are excellent choices. They have higher hardware requirements than m0n0wall, but on the other hand, a lot of new embedded hardware has recently become available, with 2 GB or more of memory and 1 GHz or faster CPUs, at a similar price as earlier platforms. It makes sense (pun intended) to use these additional resources - something that m0n0wall hasn't been particularly good at in recent times. Just keep that in mind for your next hardware upgrade.

DragonFly GUI resurrected

Michael Neumann has switched out pkgsrc packages for dpkg packages for building DragonFly with a GUI. There’s no built image to download right now, but I’m optimistic the next release will have it. You can build it now on a DragonFly system using src/nrelease. With all this video work going in lately, it will give us something to show.

OpenBSD Foundation 2014/2015 News & Fundraising

Ken Westerback (krw@) wrote in on behalf of the OpenBSD Foundation to let us know what happened last year, and what's in store for us now:

2014 was the most successful year to date for the OpenBSD Foundation. Both in the amount of money we raised and in the support we provided for the OpenBSD and related projects. We are extremely grateful for the support shown by our contributers large and small.
A detailed summary of the Foundation's activities in 2014 can be seen at
http://www.openbsdfoundation.org/activities.html
But here are some highpoints.

Read more...

From the Foundation (Part 2) | BSD Now 78

This week we continue our two-part series on the activities of various BSD foundations. Ken Westerback joins us today to talk all about the OpenBSD foundation and what it is they do. We've also got answers to your emails and all the latest news, on BSD Now - the place to B.. SD.

bsdtalk251 - Verisign and FreeBSD: Internet Scale Services at 10 Gigabits per Server presented by Mike Bentkofsky, Marc de la Gueronniere, Julien Charbon

A talk from vBSDCon in 2013 titled Verisign and FreeBSD: Internet Scale Services at 10 Gigabits per Server presented by Mike Bentkofsky, Marc de la Gueronniere, Julien Charbon

File info: 47Min, 22MB

Ogg link: https://archive.org/download/bsdtalk251/bsdtalk251.ogg

Code stuff
Radeon updates, too
Did you upgrade DragonFly on the 25th?
In Other BSDs for 2015/02/28

Interesting articles
SCALE 13x Trip Report: Michael Dexter
SCALE 2015 Recap
Further (a roadmap for pfSense)
FreeBSD From the Trenches: ZFS, and How to Make a Foot Cannon

Wallpaper of the week

as fount at http://technology.desktopnexus.com/wallpaper/845709/

BSD News 23/02/2015

JH 8:20 AM Add Comment

Last week in BSD
OPNsense, pfSense, m0n0wall, HardenedBSD, Lumina Desktop, BSDnow, NetBSD, s2k15, DragonFly BSD

Releases
there seems to be none, let me know if I am wrong

Other news

Request For Testing: OPNsense on FreeBSD 10.1

As most of you know FreeBSD 10.0 is approaching End Of Life at the end of this month. OPNsense is still based on FreeBSD 10.0, but the necessary custom patches have been forward-ported to FreeBSD 10.1 in the past week. We would love to push out our next stable release 15.1.6 on top of FreeBSD 10.1 including a new feature for base system upgrades which is one of our current weak points for delivering quick and easy security updates for your running installations.
In order to ship FreeBSD 10.1 we ask you to participate in this request for testing by trying the following snapshot for amd64:
https://pkg.opnsense.org/snapshots
i386 snapshots can be produced based on demand.
Please let us know how the snapshot works for you (bad *and* good) right here in this thread, or use one of the following alternatives.
https://twitter.com/opnsense
#opnsense on Freenode IRC
project@opnsense.org

End of the m0n0wall project

After 12 years, the m0n0wall project has officially ended. No development will be done anymore, and there will be no further releases.

Lumina Desktop 0.8.2 Released!

The next version of the Lumina desktop environment has just been released! Version 0.8.2 is mainly a “spit-and-polish” release: focusing on bugfixes, overall appearances, and interface layout/design. The FreeBSD port has already been updated to the new version, and the PC-BSD “Edge” repository will be making the new version available within the next day or two (packages building now). If you are creating/distributing your own packages, you can find the source code for this release in the “qt5/0.8.2″ branch in the Lumina repository on GitHub.
The major difference that people will notice is that the themes/colors distributed with the desktop have been greatly improved, and I have included a few examples below. The full details about the changes in this release are listed at the bottom of the announcement.
Reminder: The Lumina desktop environment is still considered to be “beta-quality”, so if you find things that either don’t work or don’t work well, please report them on the PC-BSD bug tracker so that they can get fixed as soon as possible.

Noah's L2ARC | BSD Now 77

This week on the show, we'll be chatting with Alex Reece and Matt Ahrens about what's new in the world of OpenZFS. After that, we're starting a new tutorial series on submitting your first patch. All the latest BSD news and answers to your emails, coming up on BSD Now - the place to B.. SD.

Code stuff
HEADS UP: pkg will eat itself
s2k15 Hackathon Report: mpi@ on network stack SMP
s2k15 Hackathon Report: krw@ on improvements in dhclient(8), fdisk(8) and more
FreeBSD Random Number Generator Vulnerability and HardenedBSD
memtemp(4) update
In Other BSDs for 2015/02/21
FreeBSD on the POWER8: it’s alive!

Interesting articles
pfSense Donations
Find Out Why TrueNAS Is Replacing NetApp & EMC Every Day
Regular test runs down to zero unexpected failures on multiple architectures

Wallpaper of the week
this wallpaper was found in FreeBSD forums

BSD News 29/09/2014

JH 2:21 AM Add Comment

Last week in BSD
Releases: FreeBSD
Other news: Unix, OpenBSD, BASH, PC-BSD, DragonFly BSD, BSDnow, FreeBSD, m0n0wall, pfSense, EuroBSDCon

Releases

FreeBSD 10.1-BETA3 Now Available

The third BETA build of the 10.1-RELEASE release cycle is now available on the FTP servers for the amd64, armv6, i386, ia64, powerpc, powerpc64 and sparc64 architectures.

This is expected to be the final BETA release of the 10.1-RELEASE cycle.

The image checksums follow are included in the original announcement email.

Installer images and memory stick images are available here.

Other news

OpenBSD: Faster snapshots packages synch

Marc Espie (espie@) wrote to tech@:

I've just committed changes to pkg_create that will help mirrors synch by using much less bandwidth.

Read more...

Beastly Infrastructure | BSD Now 56

This week we're on the other side of the Atlantic, attending EuroBSDCon. For now, we've got an awesome interview with Peter Wemm about the FreeBSD web cluster and infrastructure. It's an inside look that you probably won't hear about anywhere else! We'll also get to a couple of your emails today, and be back next week with all the usual goodies, on BSD Now - the place to B.. SD.

Code stuff
In Other BSDs for 2014/09/27

BASH
BASH shell bug

Bash vulnerability; check your dports
pfSense and the CVE-2014-6271 (“shellshock”) bash exploit.
m0n0wall not affected by Bash vulnerability
Bash Vulnerability in FreeBSD

Interesting Articles
EuroBSDCon 2014 Papers Online
Unix: stat -- more than ls
The Open Source Software Engagement Award

JH 11:11 PM Add Comment

FreeBSD 10.0-RC4
FreeBSD 10.0-RC5

FreeBSD 10.0-RELEASE

Some of the highlights:

GCC is no longer installed by default on architectures where clang(1) is the default compiler.
Unbound has been imported to the base system as the local caching DNS resolver.
BIND has been removed from the base system.
make(1) has been replaced with bmake(1), obtained from the NetBSD Project.
pkg(7) is now the default package management utility.
pkg_add(1), pkg_delete(1), and related tools have been removed.
Major enhancements in virtualization, including the addition of bhyve(8), virtio(4), and native paravirtualized drivers providing support for FreeBSD as a guest operating system on Microsoft Hyper-V.
TRIM support for Solid State Drive has been added to ZFS.
Support for the high-performance LZ4 compression algorithm has been added to ZFS.

See the full 10.0-RELEASE announcement here.

PC-BSD 10.0-RC3
PC-BSD 10.0-RC5

PC-BSD 10.0-RELEASE

10.0-RELEASE notable features

Includes FreeBSD 10.0-RELEASE
Updated KMS / AMD driver support
ISO file is a hybrid USB file, and can be “dd“ed to a USB media.
New text-based installer
Able to select between GRUB/BSD loaders during installation
New desktops! Gnome 3, Mate (Replaces Gnome2) and Cinnamon

For a more complete list, checkout the What’s New in 10.0.

m0n0wall 1.8.1

Change log highlights (see the SVN change log for the full details):

add scheduler ("Croen") service with many different job types (enable/disable interface or shaper rule, Wake on LAN, reboot, reconnect WAN, execute command etc.)
improved IPv6 support, including IPsec, DHCPv6-PD, RDNSS and DNSSL, and NDP info on the ARP diagnostic page
major overhaul of wireless LAN support. On some cards, it is now also possible to create multiple APs at the same time. To reflect this change, the wireless settings have moved to the Interfaces: assign page, where WLAN subinterfaces can be created much like for VLANs.
DNS forwarder: add option to log DNS queries, add aliases (CNAMEs) and MXs
Add AES-256, SHA-256/384/512 and additional DH group options to IPsec
Make rule moving and deletion on shaper rules page work like for firewall rules.
Initial support for USB modems
enable CPU hardware crypto support
automatically reassign available physical network interfaces if none of the assigned interfaces in the configuration can be found on the system (i.e. for a new installation, or when moving an existing config to new hardware)
the "embedded" image is gone; generic-pc-serial should now be used for PC Engines and Soekris boards
console speed for serial images is fixed to 9600 baud (no longer tries to use BIOS preset value)
introduction of an automated build system that allows one to build m0n0wall from scratch with almost no manual intervention on a standard FreeBSD 8.4 system
countless bug fixes and improvements in UI and system configuration code

pfSense 2.1.1-PRERELEASE Snapshots

FreeNAS 9.2.1-RC

NetBSD 6.1.3, NetBSD 6.0.4, NetBSD 5.2.2, and NetBSD 5.1.4 patch releases

BSD News 21/01/14

JH 11:41 PM Add Comment

Last week in BSD
Releases: m0n0wall, pfSense
Other news: BSDnow, portmgr@, OpenBSD, ruBSD, DragonFly BSD, PC-BSD

Follow us at Twitter at @janhovancik. Read interview with new writer.

Releases

m0n0wall 1.8.1 released

Change log highlights (see the SVN change log for the full details):

add scheduler ("Croen") service with many different job types (enable/disable interface or shaper rule, Wake on LAN, reboot, reconnect WAN, execute command etc.)
improved IPv6 support, including IPsec, DHCPv6-PD, RDNSS and DNSSL, and NDP info on the ARP diagnostic page
major overhaul of wireless LAN support. On some cards, it is now also possible to create multiple APs at the same time. To reflect this change, the wireless settings have moved to the Interfaces: assign page, where WLAN subinterfaces can be created much like for VLANs.
DNS forwarder: add option to log DNS queries, add aliases (CNAMEs) and MXs
Add AES-256, SHA-256/384/512 and additional DH group options to IPsec
Make rule moving and deletion on shaper rules page work like for firewall rules.
Initial support for USB modems
enable CPU hardware crypto support
automatically reassign available physical network interfaces if none of the assigned interfaces in the configuration can be found on the system (i.e. for a new installation, or when moving an existing config to new hardware)
the "embedded" image is gone; generic-pc-serial should now be used for PC Engines and Soekris boards
console speed for serial images is fixed to 9600 baud (no longer tries to use BIOS preset value)
introduction of an automated build system that allows one to build m0n0wall from scratch with almost no manual intervention on a standard FreeBSD 8.4 system
countless bug fixes and improvements in UI and system configuration code

Refer to the installation instructions for information on how to install these files on the various platforms.

pfSense 2.1.1-PRERELEASE Snapshots Available

For those who are inclined to try such things, 2.1.1-PRERELEASE snapshots are up for testing at http://snapshots.pfsense.org/

Update URLs for use in firmware update settings:
http://snapshots.pfsense.org/FreeBSD_RELENG_8_3/amd64/pfSense_RELENG_2_1/.updaters/
http://snapshots.pfsense.org/FreeBSD_RELENG_8_3/i386/pfSense_RELENG_2_1/.updaters/

The current set of builds have the new Intel drivers for em/igb/ixgb/ixgbe (Thanks Ermal!) and should support i210 and i354 and others, and should hopefully fix issues that have been observed with ixgb/ixgbe drivers.

Give them a spin, especially if you have hardware that could benefit from the new drivers.

A list of changes between 2.1 and 2.1.1 may be found here:
https://doc.pfsense.org/index.php/2.1.1_New_Features_and_Changes

Other news

Bhyve Mind | BSD Now 20

download (size: 502 MB )

It’s our big 20th episode! We’re going to sit down for a chat with Neel Natu and Peter Grehan, the developers of bhyve. Not familiar with bhyve? Our tutorial will show you all you need to know about this awesome new virtualization technology. Answers to your questions and all the latest news, here on BSD Now – the place to B.. SD.

pfSense talk at “Tokyo FreeBSD Benkyokai” February 17

Isaac (.ike) Levy, Senior Unix System Administrator at National Hockey League (http://www.linkedin.com/in/dotike) will be presenting “pfSense Practical Experiences: from home routers, to High-Availability Datacenter Deployments” at the Tokyo FreeBSD Benkyokai (FreeBSD Study Session) Group on February 17, 2014.
http://atnd.org/events/47084
Ike states that his main objective in Tokyo is to get some real help with the Japanese translation of pfSense.
Ike recently committed “Phase 1″ (machine translation) of this effort, which you can view at GitHub.

Joe Marcus Clarke has stepped down

Joe Marcus Clarke, aka marcus@, has stepped down from his duties on theÂ FreeBSD Ports Management Team.
Joe was our longest serving member of the team. Among his manyÂ accomplishments was being the repocopy source of authority, instrumental inÂ championing tinderbox development and maintaining portlint.
On behalf of the Ports Management team, we would like to thank Joe for hisÂ many years of service and dedication.
Thomas
on behalf of portmgr@

ruBSD: interviews with Theo and Henning

Last December Russian tech giant Yandex organised first ruBSD event in Moscow. OpenBSD developers Theo de Raadt, Henning Brauer and Mike Belopuhov gave three talks on different topics. There were interviews with Theo and Henning recorded as well. Theo spoke about current adoption of mitigation techniques in other OSes and state of OpenBSD project. Henning gave a history overview of PF.
All talks and interviews available online and for download.
Theo de Raadt: Exploit Mitigation Techniques: an Update After 10 Years (slides, video and interview)
Henning Brauer: OpenBSD's pf: Design, Implementation and Future (slides, video and interview)
Mike Belopuhov: OpenBSD: Where is crypto headed? (slides and video)

32-bit DragonFly 3.7 and dports

There are no binary packages built for dports, on DragonFly 3.7, for 32-bit machines, at this time. Pierre Abbat found this out. You can build from source, of course, or just use 3.6 packages. Don’t forget -DBATCH to avoid getting asked for build options when building from source.

Code stuff
DragonFly BSD - Other network improvements
DragonFly BSD - Trackpad support summary
DragonFly BSD - Testing USB4BSD
DragonFly BSD - ACPI updates and power states
FreeBSD security advisories
PC-BSD Weekly Feature Digest
In Other BSDs for 2014/01/18

Interesting articles
Hal, dbus, and VMWare tip. Also pkg locking
BlueVM KVM and NetBSD I.
Unix: Writing more efficient shell scripts

Subscribe to: Posts ( Atom )