Showing posts with label pfSense. Show all posts
Showing posts with label pfSense. Show all posts

BSDNews 11/12/2017

BSDNews 11/12/2017

Last week in BSD

News: BSDSec, Dragon Fly, BSDNow, pfSense, OpenBSD. s2k17
Releases: Dragon Fly BSD, OPNsense

BSDSec

[FreeBSD-Announce] FreeBSD Security Advisory FreeBSD-SA-17:12.openssl
[FreeBSD-Announce] FreeBSD 11.0 end-of-life
OpenBSD Errata: December 10th, 2017 (mpls)

Releases

DragonFly 5.0.2 released

DragonFly 5.0.2 is released.  As you may guess from the version number, this is a bugfix release.  The release tag has the full details.  Update through the normal process of a buildworld/buildkernel, at your leisure.

OPNsense 17.7.9 released

XSS vulnerability in the certificate manager is being fixed that is based on a crafted certificate being imported into the system. PHP was finally updated from 7.0 to 7.1 which should make things a bit faster. Last but not least, the HAProxy plugin by Frank Wall receives a major update for improved usability, several new features and two bug fixes.

News

Compile once, debug twice | BSD Now 223

Picking a compiler for debuggability, how to port Rust apps to FreeBSD, what the point of Docker is on FreeBSD/Solaris, another EuroBSDcon recap & network manager control in OpenBSD.

Application Detection on pfSense® Software

Thanks to the Snort package and OpenAppID, pfSense is now application-aware.

arm64 platform now officially supported [and has syspatch(8)]

arm64 is now an officially supported platform for OpenBSD. As some readers will have noticed, there's now syspatch(8) support, too.

Code stuff

Boggle, banner, tetris added to Dragon Fly
In Other BSDs for 2017/12/09
Network driver changes: ix, faith
pledge() work in progress

s2k17 Hackathon

OpenBSD is holding hackathons as an attempt to get new changes into the source tree quickly. Here are some reports from the latest:
s2k17 Hackathon Report: Stefan Sperling (stsp@) on wireless (iwm(4), athn(4) and more) progress

Pic of the week


source: https://www.gnome-look.org/p/1076051/


BSD News 27/11/2017

Last week in BSD

Releases: OPNsense, pfSense
News: BSDSec, DragonFly BSD, BSDnow, OpenBSD, Lumina Desktop, BSD Router, p2k17, Wallpaper

BSDSec

FreeBSD Security Advisory FreeBSD-SA-17:08.ptrace [REVISED]
FreeBSD Security Advisory FreeBSD-SA-17:10.kldstat [REVISED]
[Security-announce] pfSense-SA-17_09.webgui
[Security-announce] pfSense-SA-17_08.webgui
[Security-announce] [UPDATED] pfSense-SA-17_07.packages

Releases

OPNsense 17.7.8 released

A shiny new update is available, addressing the recent security advisories from FreeBSD, OpenSSL, Sudo and a number of minor bugs.
To all our 18.1-BETA testers we say this: thank you! The results have been thoroughly positive. If you would like to participate as well, please take a closer look:
https://forum.opnsense.org/index.php?topic=6257.0

pfSense 2.4.2-RELEASE now available

pfSense software version 2.4.2 is a maintenance release bringing security patches and stability fixes for issues present in previous pfSense 2.4.x branch releases.

News

Remember: don’t kldload i915 too soon

I just wasted an hour trying to figure out why xorg had strange output but no errors on this laptop, and it’s because I had i915_load=”YES” in /boot/loader.conf instead of i915_load=”YES” in /etc/rc.conf.  I’m almost nearly sure I’ve mentioned that before, but if not: here you go.
(though if you never plan to run X, you can put it in loader.conf and everything will just work.)


BSD in Taiwan | BSD Now 221


Allan reports on his trip to BSD Taiwan, new versions of Lumina and GhostBSD are here, a bunch of OpenBSD p2k17 hackathon reports & more!

Pre-DragonFly 4.4 users, take note

If you happen to be running an old version of DragonFly, you may need to do an intermediate upgrade to move to releases after 5.0.  This is in part because of commits to support C++14.  This only applies to version of DragonFly before 4.4.

Code stuff

The strongest KASLR, ever? (latest developments in the Kernel ASLR district)
Lumina Version 1.4.0 Released
Areca update: arcmsr(4)
In Other BSDs for 2017/11/25

Interesting articles

DragonFly: Locking microtests
How to build a BSDRP router lab - [Virtualbox]
Digging into /usr/share/examples

p2k17 Hackathon

OpenBSD is holding hackathons as an attempt to get new changes into the source tree quickly. Here are some reports from the latest:
Reflections on Hackathons
p2k17 Hackathon report: Antoine Jacoutot on ports+packages progress

Wallpaper of the week



BSD News 29/08/2016

BSD News 29/08/2016

Last week in BSD

Releases: FreeBSD, pfSense
Other news: BSDNow, OpenBSD


BSDSec

there seems to be none SA

Releases

FreeBSD 11.0-RC2 Available

The second RC build for the FreeBSD 11.0 release cycle is now available. ISO images for the amd64, armv6, i386, aarch64, powerpc, powerpc64 and sparc64 architectures are available on most of our FreeBSD mirror sites.

2.4 pre-alpha snapshots now available.

pfSense® software version 2.4 pre-alpha snapshots are now available.
pfSense 2.4 will use FreeBSD 11 as a base, and 11.0-RELEASE has not yet occurred.  There will be additional work to use 11.0-RELEASE as a base.
More work at “reduction of technical debt” is occurring in 2.4.  We have decided to not carry forward the kernel patches for Captive Portal.  Instead, it is being re-written to use stock IPFW.  That work is only about 75% complete.  Simultaneously, work is occurring to convert several subsystems (e.g. radius) to use the PEAR equivalents:
There appears to be a bug in pf (likely due to the interaction of one of our patches).  This only manifests under high usage.
New features and changes are listed here.
Full change list:
source and build tools
ports
FreeBSD source
Outstanding bugs/features/todo items:
Everything else
We advise that you do not use this on a production system yet. If you have the time and interest, we encourage you to try this on a scratch system or VM and provide feedback for any issues you find.

News

The Fresh BSD experience | BSD Now 156

This week on BSDNow, Allan is back from his UK trip & we’ll get to hear his thoughts on the developer summit. That plus all the latest news & an interview with Drew Gurkowski discussing tutorial writing for FreeBSD. Keep it tuned to your place to B...SD!

Code stuff

BSD News 25/07/2016

BSD News 25/07/2016

Last week in BSD

Releases: pfSense, FreeBSD, PacBSD, DragonFlyBSD
Other news: NetBSD, BSDnow, PC-BSD, Lumina Desktop, DragonFlyBSD, n2k16, BSDSec,


BSDSec


Releases

pfSense 2.3.2-RELEASE Now Available!


We are happy to announce the release of pfSense® software version 2.3.2!
This is a maintenance release in the 2.3.x series, bringing a number of bug fixes. The full list of changes is on the 2.3.2 New Features and Changes page.
This release includes fixes for 60 bugs, 8 features and 2 todo items completed.
If you haven’t yet caught up on the changes in 2.3.x, check out the Features and Highlights video. Past blog posts have covered some of the changes, such as the performance improvements from tryforward, and the webGUI update.
As always, you can upgrade from any prior version directly to 2.3.2. The Upgrade Guide covers everything you’ll need to know for upgrading in general.  There are a few areas where additional caution should be exercised with this upgrade if upgrading from 2.2.x or an earlier release, all noted in the 2.3 Upgrade Guide.
For those upgrading from a 2.3 beta or RC version who have not yet upgraded to 2.3-RELEASE, please see this post.
While, nearly all of the common regressions between 2.2.6 and 2.3-RELEASE have been fixed in subsequent releases, the following still exist:
  • IPsec IPComp does not work. This is disabled by default. However in 2.3.1, it is automatically not enabled to avoid encountering this problem. Bug 6167
  • IGMP Proxy does not work with VLAN interfaces, and possibly other edge cases. Bug 6099. This is a little-used component. If you’re not sure what it is, you’re not using it.
  • Those using IPsec and OpenBGPD may have non-functional IPsec unless OpenBGPD is removed. Bug 6223
Compared to pfSense 2.2.x, the list of available packages in pfSense 2.3.x has been significantly trimmed.  We have removed packages that have been deprecated upstream, no longer have an active maintainer, or were never stable. A few have yet to be converted for Bootstrap and may return if converted. See the 2.3 Removed Packages list for details.  pfSense 2.3.2 does bring back ntopng, and the vnstat (traffic totals) package is new.
Downloads are available on the mirrors as usual.
Downloads for New Installs and Upgrades to Existing Systems – note it’s usually easier to just use the auto-update functionality, in which case you don’t need to download anything from here. Check the Firmware Updates page for details.


FreeBSD 11.0-BETA2

The development of the upcoming major version of FreeBSD, whose final release is scheduled for early September, continues at a fast pace. Although delayed by a week, the 11.0-BETA2 build was finally announced yesterday: "The second BETA build of the 11.0-RELEASE release cycle is now available. A summary of changes since 11.0-BETA1 includes: several build- and toolchain-related fixes; WITNESS and INVARIANTS have been disabled on powerpc, powerpc64, arm and armv6 architectures; freebsd-update(8) has been updated to allow '*-dbg' distribution sets; ctld(8) no longer exits when reloading the configuration with invalid initiator-portal clauses; GENERIC-NODEBUG kernel configurations have been removed; the callout code has been updated to avoid a system panic with TCP timers; several other changes." See also the (incomplete) release notes which are still work-in-progress. Quick links to download the amd64 and i386 installation DVD images: FreeBSD-11.0-BETA2-amd64-dvd1.iso (2,479MB, SHA512), FreeBSD-11.0-BETA2-i386-dvd1.iso (2,203MB, SHA512).

New PacBSD ISO Available

A new iso is available for testing for 64bit. Currently there are two install media, one for DVD/CD and one for USB devices. Be sure to select the right media. Dot img for usb and dot iso for CD/DVD.
Download is available here
Currently the main packages available for testing are: LXDE, chromium, Xorg, wine, transmission and a few Window Managers. New Packages are added daily and more DE should be available in a few days.
xfce4, firefox and vlc will be next uploaded. Though there are multiple PKGBUILD for these already available at
Github
Also you can view daily reports of the repository, which includes broken packages, packages which fail to pull in dependencies, outdated packages (Checked against freebsd ports) and other information:
Repository Report
Installation help can be found at:
ZFS Install Guide
If You need additional help, feel free to join irc.freenode.net ‪#‎pacbsd‬-dev as this is quite active. All new uploaded packages, git commits, repository reports are posted here daily.
One more note, any issues can be reported to us directly on #pacbsd-dev on IRC, or on our bug tracker.
Bug Tracker

DragonFly 4.6 release candidate 2 available

DragonFly 4.6 release candidate 2 has been tagged.  You can pull it directly from the master site in img or iso form (check your local mirror instead if possible), or shift to the new tag.
“Where is RC1?” you may ask?  I tagged the first release candidate some days ago, and this bug was immediately found right after.  It was easier to go right to RC2 once a fix was found.
This candidate will probably lead directly to a release version, so if you want to run the release version exactly, wait a few days.

News

New Security Advisory: NetBSD-SA2016-006 (mail.local)

A new security advisory was published:
You can find more information about them on the Security and NetBSD page.

Fuzzy Auditing | BSD Now 151

This week on BSDNow, we have all sorts of interesting news, including a Kernel Fuzzing audit done for OpenBSD, a much improved ‘C’ client for LetsEncrypt, an interview with Dru Lavigne and more! Stick around for your place to B...SD!

Code stuff


Interesting articles


BSD News 18/07/2016

BSD News 18/07/2016

Last week in BSD

Releases: HardenedBSD, SoloBSD, OPNsense, 
Other news: BSDsec, DragonFly BSD, pfSense, BSDnow

BSDSec


Releases

OPNsense 16.7-RC2 released

16.7-RC2 is here and brings major additions to amd64 architectures: Intel’s Hyperscan library to speed up Suricata rule matching and UEFI boot support! It also brings language packs to their correct 16.7 state, with Japanese already having been completed by the amazing Chie Taguchi. The mirrors have been expanded to allow trackers of -stable or -devel packages to upgrade to the release candidate. Users of LibreSSL wanting to upgrade can now switch to OpenSSL instead of seeing upgrade errors until LibreSSL becomes available again and their systems move back to LibreSSL automatically.
Otherwise, only minor issues have been reported and fixed. This likely means there will not be another release candidate.
New images are available from all known mirrors with all checksums listed after this announcement:
https://opnsense.org/download/
 

New stable release: HardenedBSD-stable 10-STABLE v46.5

HardenedBSD-10-STABLE-v46.5 - https://github.com/HardenedBSD/hardenedBSD-stable/releases/tag/HardenedB...
security updates for: expat, libarchive, file, coverity related fixes
bigger updates for: hyper-v, zfs

SoloBSD 10.3-STABLE-v46.5

There is a new build of SoloBSD 10.3-STABLE based on the latest HardenedBSD stable branch version 46.5
Changelog v46.5
Now with heal-harddrive.sh script included from Martin Sugioarto. Check Instructions of use.
You can grab it from Here. (48.4 Mb)
 root password: solobsd

News

Any Mono/DragonFly users out there?

This is a specialized use case, but Mono 4.x has some issues on DragonFly.  Some minor testing has been done, but if you are already using it, please contribute.

pfSense moves to Apache License

With the pending departure of Chris Buechler, we wanted to find a way to express to the community our continued commitment to keep pfSense® software open source.
As such, pfSense is moving to the Apache License 2.0  in order to align the goals of the project with other (unannounced) offerings from Netgate.  The Apache License 2.0 is a permissive license similar to the MIT License. The main conditions of this license require preservation of copyright and license notices.
Where the 2-Clause and 3-Clause BSD licenses provides no direct language around the areas of copyright, patents and trademarks, the Apache License does. The Apache License is very clear that individual contributors grant copyright license to anyone who receives the code, that their contribution is free from patent encumbrances (and if it is not, that they license that patent to anyone who receives the code,) and that use of Trademarks extends only as far as is necessary to use the product.  As a reminder, only genuine pfSense software can bear the registered trademark of pfSense. It also includes a patent termination clause, should a lawsuit arise.
The Apache License 2.0 is the third most popular license on github. Android, Apache, Chef, DockerOpenStackSalt Stack, and Swift use the Apache License 2.0.
Now pfSense does as well.

Sprinkle A Little BSD Into Your Life | BSD Now 150

Today on the show, we are going to be talking to Jim Brown (of BSD Cert Fame) about his home-brew sprinkler system… Wait for it… That runs FreeBSD!
That plus news & of course your feedback, keep it tuned to BSD Now, the place to B...SD!

UEFI booting and manual installation


karu.pruun shares a story of manually installing DragonFly on a UEFI-booting machine.  In this case, it’s a Macbook, though there’s other non-fruit UEFI machines out there?

Code stuff


Interesting articles


BSDNews 20/06/2016

BSDNews 20/06/2016

Last week in BSD

Releases: BSDSec, pfSense,
Other news:pfSense, OPNsense, HardenedBSD, BSDCan, BSDnow, FreshPorts, DragonflyBSD


BSDSec

 [Security-announce] pfSense-SA-16_08.webgui 
 [Security-announce] pfSense-SA-16_07.webgui 
 [Security-announce] pfSense-SA-16_06.squid 

Releases 

GhostBSD 10.3 BETA1 is ready for testing

This first BETA development release is ready for testing and debugging new feature in GhostBSD 10.3, MATE and XFCE is available on SourceForge for the i386, amd64, and amd64-uefi architectures.

OPNsense 16.1.17 released


Today we offer complementary improvements and fixes to your swinging installation in the hopes that they will make your daily experience even better, rounded off with a pinch of SSL crypto updates.
In other news, we are getting ready for a first 16.7 release candidate after having finished the full work on the FreeBSD 10.3 base system including the addition of HardenedBSD’s ASLR. More on this next week.

Here is the change log for 16.1.17:
  • ports: isc-dhcp-server 4.3.4[1], syslogd 10.3, libressl 2.3.6[2], openssl 1.0.2_13[3]
  • system: fix OTP QR code link to amend the first request
  • system: allow to override TRIM apply at boot time via /etc/fstab[4]
  • dashboard: fix OpenVPN test data display
  • dashboard: gateway widget style updated
  • interfaces: allow debug option for dhcp6 client
  • interfaces: allow to delete WAN as well
  • interfaces: properly restart the respective proxy ARP daemon
  • firewall: fixed HTML errors in NAT edit page
  • services: fixed unbound custom option handling
  • services: allow RA send behaviour to be configured
  • services: show correct dynamic DNS type when editing an existing entry
  • openvpn: bring back authentication method selector
  • openvpn: create interfaces at boot time and even when disabled
  • power: separate menu for power off and reboot functions
  • intrusion detection: allow to drop/reset log files
  • plugins: can now create local logging sockets for chroot environments
  • plugins: new HAProxy version 1.3 with assorted fixes (contributed by Frank Wall and Manus Freedom)
  • lang: major updates for Russian (contributed by Smart-Soft Ltd.)
  • lang: assorted translation fixes (contributed by Fabian Franz)
  • lang: minor updates to Chinese, German and French

 

pfSense 2.3.1 Update 5 Available

2.3.1 Update 5 (2.3.1_5) is now available. Note that updates 2 through 4 were internal-only. This includes two security fixes to the web GUI, and 7 other bug fixes. The 2.3.1-RELEASE change list has been updated with an Update 5 section specifying the changes.
This update will reboot the system after installing.

New stable version: HardenedBSD-stable 10-STABLE v46.4

HardenedBSD-10-STABLE-v46.4 - https://github.com/HardenedBSD/hardenedBSD-stable/releases/tag/HardenedB...
* libarchive updates
* hbsd-update updates
* coverity fixes
* sfxge updates
* hyperv updates


News 

BSDCan 2016 Presentations Online

The BSDCan 2016 conference in Ottawa has just concluded, with a number of OpenBSD-themed talks. These are the talks by OpenBSD developers: Reyk Flöter: An OpenFlow implementation for OpenBSD - Introducing switchd(8) and more about SDN (slides)
Henning Brauer: Running an ISP on OpenBSD - Why OpenBSD and several uncommon uses of it (slides)
Peter Hessler: Bidirectional Forwarding Detection (BFD) implementation and support in OpenBSD. Or: A new protocol actually did improve our routing. (slides)
Mike Belopuhov: Implementation of Xen PVHVM drivers in OpenBSD (slides)
Antoine Jacoutot: OpenBSD rc.d(8) (slides)
Sebastian Benoit: Opensource Routing - Running an enterprise network on OpenBSD (slides)
In addition, two OpenBSD-centric tutorials were offered by people who are not themselves OpenBSD developers:
Peter Hansteen: Building The Network You Need With PF, The OpenBSD Packet Filter (slides)
Aaron Poffenberger: OpenSMTPD for the Real World (slides)

Music to Beastie’s ears | BSD Now 146

Kris is on vacation this week, so allan flies solo, provides a recap of BSDCan & covers a boatload of news including Microsoft providing support & SLAs for BSD, how terrible select() may be, an interview with Hans Petter Selasky about designing the USB drivers for FreeBSD & more!
View attached file (412 MB, video/mp4)

Quarterly branches are available

This afternoon, Bert JW Regeer wished that FreshPorts “would show information from the quarterly branches too…”. I knew I had done some work on this and that there was a way to display branch information. I check the source code and found the ?branch= parameter, but there was nothing in the database for this branch. [...]
 

Code stuff 


Interesting articles



BSD News 31/05/2016

BSD News 31/05/2016

Last week in BSD

Releases: pfSense, NetBSD, OPNsense, GhostBSD, SoloBSD,
Other news: Talks, OpenBSD, BSDnow, DragonFly BSD


BSDSec



Releases

pfSense 2.3.1 Update 1 Available

2.3.1 Update 1 (2.3.1_1) is now available. This includes one security fix to the web GUI, and 7 other bug fixes. The 2.3.1-RELEASE change list has been updated with an Update 1 section specifying the changes.
This update will reboot the system after installing.

NetBSD 7.0.1 released

The NetBSD Project is pleased to announce NetBSD 7.0.1, the first security/bugfix update of the NetBSD 7.0 release branch. It represents a selected subset of fixes deemed important for security or stability reasons. If you are running an earlier release of NetBSD, we strongly suggest updating to 7.0.1.
For more details, please see the release notes.
Complete source and binaries for NetBSD are available for download at many sites around the world. A list of download sites providing FTP, AnonCVS, SUP, and other services may be found at http://www.NetBSD.org/mirrors/

OPNsense 16.1.15 released

Here are the full patch notes for 16.1.15:
  • system: make authentication fallback configurable
  • system: settings cleanup and prettify
  • system: added explicit ETC timezone selection
  • high availability: add page for remote service control
  • high availability: properly enforce authentication
  • firmware: reboot and poweroff API actions
  • firmware: only kill GUI process, not captive portal
  • firmware: show errors in update window
  • firmware: keep polling for progress even when GUI restarts
  • backend: skip failing templates on bootup
  • trust: fix CA certificate count in overview
  • trust: allow key size up to 8192 bits
  • firewall: fix invalid NPT rule generation
  • firewall: speed up filter log pages
  • firewall: do not allow to change virtual IP mode after creation
  • firewall: moved settings page and rearranged settings accordingly
  • interfaces: unhook all but the last custom PHP module functions
  • interfaces: moved settings page and rearranged settings accordingly
  • dhcp: do not override RA settings after save
  • dns: resolver outgoing interface section moved to advanced as it will break setups with dynamic interfaces selected there
  • load balancer: sticky mode from firewall / system split off as separate setting
  • snmp: do not allow unicode in system location
  • intrusion detection: remove deprecated rbn-malvertisers.rules set
  • intrusion detection: add promiscuous mode / physical interface selection
  • overall: fix menu width on small size screens
  • overall: numerous translation fixes (contributed by Frederic Lietart)
  • overall: numerous translation fixes (contributed by Fabian Franz)
  • plugins: assorted bugfixes for HAProxy (contributed by Frank Wall)
  • mvc: fix translations by adding an escaping wrapper

GhostBSD 10.3 ALPHA2 is ready for testing

This second ALPHA development release is for testing and debugging new feature in GhostBSD 10.3, MATE and XFCE is available on SourceForge for the i386, amd64, and amd64-uefi architectures.

SoloBSD 10.3-STABLE-v46.1

There is a new build of SoloBSD 10.3-STABLE based on the latest HardenedBSD stable branch version 46.1
You can grab it from Here. (61.6 Mb)
root password: solobsd


News

FreeBSD Now Has Initial Graphics Support For Bhyve

Bhyve, the hypervisor developed by FreeBSD that supports running BSD/Linux/Windows guests, has initial graphics support...

Most Free/Open Source Software users run Linux as their operating system of choice, choosing one (or more) of the 300 or so distros currently active on DistroWatch. Not as many have crossed the street, rhetorically speaking, and taken a look at the other Open Source operating system, BSD and its many variants.
As a long time and current Linux user new to PC-BSD — essentially the BSD equivalent to Linux Mint — my intention is to:
· Outline the (many) similarities and (few) differences between Linux and BSD,
· Walk the audience through the process of moving from Linux to BSD, unless the audience is in a hurry, then I’ll run them through it,
· Describe the ease-of-use and pitfalls of day-to-day use of PC-BSD for the average user, and
· How to pitch in and make code and other contributions (e.g., documentation, translation) to BSD variants, even while doing the same for Linux distributions,
· And more!

Privilege Separation and Pledge (video)

This year's dotSecurity conference featured a presentation from OpenBSD founder Theo de Raadt, titled "Privilege Separation and Pledge." The video is now available here, in addition to the slides.

One small step for DRM, one giant leap for BSD | BSD Now 143

This week on BSDNow, we have an interview with Matthew Macy, who has some exciting news to share with us regarding the state of graphics on FreeBSD. That plus all the latest news on BSDNow, the place to B...SD!
View attached file (770 MB, video/mp4)

OpenBSD ARMv7 now has a bootloader

Progress on the armv7 platform continues, and Jonathan Gray writes in to the arm@ mailing list with some promising news:
There is now a bootloader for armv7 thanks to kettenis@ Recent armv7 snapshots will configure disks to use efiboot and install device tree dtb files on a fat partition at the start of the disk. u-boot kernel images are no longer part of the release but can still be built for the time being. We are going to start assuming the kernel has been loaded with a dtb file to describe the hardware sometime soon. Those doing new installs can ignore the details but here they are. 


Code stuff



Interesting articles


BSD News 23/05/2016

BSD News 23/05/2016

Last week in BSD

Releases: HardenedBSD, SoloBSD, SmallWall, pfSense, OPNsense, 
Other news: BSDSec, BSDnow, BSD Magazine, DragonFlyBSD, p2k16, freeNAS, OpenBSD

BSDSec


Releases

HardenedBSD-stable 10-STABLE v46.1

HardenedBSD-10-STABLE-v46.1
----------------------------------------
https://github.com/HardenedBSD/hardenedBSD-stable/releases/tag/HardenedB...
https://github.com/HardenedBSD/hardenedBSD-stable/commits/HardenedBSD-10...
This release fixes CVE-1541 and CVE-2015-2304 in libarchive, a lot of Coverity warnings / programing errors and an overflow in amd64's sysarch system call (00696f0, eac2aab, bd784f7).

SoloBSD 10.3-STABLE-v46

There is a new build of SoloBSD 10.3-STABLE based on the latest HardenedBSD stable branch version 46
You can grab it from Here. (61.7 Mb)
root password: solobsd

SmallWall 1.8.4b10 beta release

Just released a new beta with updated mini-httpd, and many t1n1wall changes ported in.

New stable version: HardenedBSD-stable 11-CURRENT v46.2

HardenedBSD-11-CURRENT-v46.2 - https://github.com/HardenedBSD/hardenedBSD-stable/releases/tag/HardenedB...
UPDATE TO THIS RELEASE IS STRONGLY ADVISED!
This release fixes two locally exploitable security issue, namely the followings:
https://security.freebsd.org/advisories/FreeBSD-SA-16:19.sendmsg.asc
https://security.freebsd.org/advisories/FreeBSD-SA-16:18.atkbd.asc

pfSense 2.3.1-RELEASE Now Available!

We are happy to announce the release of pfSense® software version 2.3.1!
This is a maintenance release in the 2.3.x series, bringing a number of bug fixes, two security fixes in the GUI, as well as security fixes for OpenSSL, OpenVPN and FreeBSD atkbd and sendmsg. The full list of changes is on the 2.3.1 New Features and Changes page.
This release includes a total of 103 bug fixes. 79 regressions in 2.3 have been fixed, mostly minor issues in the new GUI. Several of these are significant issues, and have resolved nearly all the post-upgrade problems encountered in 2.3-RELEASE. 24 issues affecting 2.2.x and prior versions have also been fixed.
If you haven’t yet caught up on the changes in 2.3.x, check out the Features and Highlights video. Past blog posts have covered some of the changes, such as the performance improvements from tryforward, and the webGUI update.

OPNsense 16.1.14 released

How about an update with your new NetFlow remote export. Or your local reporting frontend? Well, you can always use both if you like. Read all about it here: https://docs.opnsense.org/manual/netflow.html
Furthermore, we have added the brand new AQM CoDel version 0.2.1 to the mix, yesterday’s FreeBSD security advisories, released the HAProxy plugin, bundled a full Japanese translation.
There is also a refreshed website for our general viewing pleasure.
https://opnsense.org/

News

Diving for BSD Perls | BSD Now 142

This week on the show, we have all the latest news and stories! Plus an interview with BSD developer Alfred Perlstein, that you won’t want to miss. Sit tight, the show starts now on your place to B...SD!
 

BSD Magazine for May 2016 out

The May issue of BSD Magazine is available now.  There’s articles on ZFS, OpenBSD’s arc4random, an interview of Fernando Rodríguez of KeepCoding, and more.  It’s a free PDF download if you didn’t know.

eX, clisp, and DragonFly

DragonFly versions of TeX have been available for some time now.  However, Nelson Beebe, who is part of the TeX project, is having trouble building some related binaries – asymptote and clisp.  He could use help from anyone interested, to match up with this summer’s release of TeX 2016.

Mounting as non-root

Read this email thread for how to mount devices (e.g. USB drives) in DragonFly when you aren’t root.

Code stuff 

p2k16 Hackathon Report: pirofti@ on octeon and TPM

Interesting articles


BSD News 02/05/2016

BSD News 02/05/2016

Last week in BSD

Releases: FreeBSD, BSDSec, OpenBSD, BSDnow, CheriBSD, BSDTalk, NFS, p2k16
Other news: SoloBSD, GhostBSD, OPNsense, pfSense, HardenedBSD


BSDSec


Releases

New stable release: HardenedBSD-stable 10-STABLE v44.3

New stable release: HardenedBSD-stable 10-STABLE v44.4

New stable version: HardenedBSD-stable HardenedBSD-11-CURRENT v46

HardenedBSD-11-CURRENT-v46 - https://github.com/HardenedBSD/hardenedBSD-stable/releases/tag/HardenedB...
 

pfSense 2.3 Update 1 Available

Since the new pkg system enables us to update pieces of the system individually, rather than the monolithic updates of the past, we have released a patch that fixes the NTP CVEs covered by FreeBSD SA 16:16.ntp. Updating ntpd from 4.2.8p6 to 4.2.8p7 is the only change.
This update appears as 2.3_1, for update 1. This should not be confused with 2.3.1, which is a full maintenance release coming soon. 2.3_1 is only available for those already running 2.3 release.
Note for this update, your version number will remain the same afterwards, still showing as 2.3-RELEASE.
This update does not trigger a reboot. The NTP service needs to be manually restarted under Status>Services afterwards.

OPNsense 16.1.12 released

The progress for our upcoming version 16.7 now accumulates to 3 full months. To that end we are making the transition from ALPHA to BETA on the 16.7 development series. And since we have been asked to incorporate development change logs as well, look no further (well, look below).
Anyway, 16.1.12 brings a handful of anticipated additions like FreeBSD’s package manager version 1.7.2 and the ability to use CoDel / FQ-Codel in the traffic shaper. We have also started to move services to the plugin framework instead of having them in the base installation. And, maybe as a last point, initial work for fixing the trusty apinger utility for gateway monitoring has surfaced.
Het bericht OPNsense 16.1.12 released verscheen eerst op OPNsense.

GhostBSD 10.3 ALPHA1 is now ready for Testing

Yes we skip 10.2 for 10.3 since was FreeBSD 10.3 was coming we thought we should wait for 10.3. This is the first ALPHA development release for testing and debugging for GhostBSD 10.3, only as MATE been released yet which is available on SourceForge and for the amd64 and i386 architectures.

SoloBSD 10.3-STABLE-v44.3

SoloBSD 10.3-STABLE-v44.4

There is a new build of SoloBSD 10.3-STABLE based on the latest HardenedBSD stable branch version 44.4
You can grab it from Here. (45.8 Mb)
root password: solobsd

News

Cheri-picking BSD | BSD Now 139

This week, Allan is out of town, but since when has that ever stopped us from bringing you a new episode of BSDNow? We have news, feedback & an excellent interview with Brooks Davis telling us about CheriBSD that you won’t want to miss.
View attached file (449 MB, video/mp4)

bsdtalk264 - Down the Gopher Hole

Playing around with the gopher protocol.   Description of gopher from the 1995 book "Student's Guide to the Internet" by David Clark. Also, at the end of the episode is audio from an interview with Mark McCahilll and Farhad Anklesaria that can be found at https://www.youtube.com/watch?v=oR76UI7aTvs
Check out http://gopher.floodgap.com/gopher/
File Info: 27 Min, 13 MB.
Ogg Link:https://archive.org/download/bsdtalk264/bsdtalk264.ogg

Code stuff 


Interesting articles



BSD News 18/04/2016

Last week in BSD

Releases: pfSense, OPNsense
Other news: BSDSec, HardenedBSD, freeNAS, xhyve, FreeBSD


BSDSec

 

Releases

pfSense 2.3-RELEASE

The most significant changes in this release are a rewrite of the webGUI utilizing Bootstrap, and the underlying system, including the base system and kernel, being converted entirely to FreeBSD pkg. The pkg conversion enables us to update pieces of the system individually going forward, rather than the monolithic updates of the past.  The webGUI rewrite brings a new responsive look and feel to pfSense requiring a minimum of resizing or scrolling on  a wide range of devices from desktop to mobile phones.
For the highlights, check out the Features and Highlights video. Past blog posts have covered some of the changes, such as the performance improvements from tryforward, and the webGUI update.
The full list of changes is on the 2.3 New Features and Changes page.
To get to a release, we’ve closed 760 total tickets.  While the majority of these were related to the Bootstrap conversion, 137 are fixed bugs impacting 2.2.6 and earlier releases.
Downloads for New Installs
Downloads to Upgrade Existing Systems – note it’s usually easier to just use the auto-update functionality, in which case you don’t need to download anything from here. Check the Firmware Updates page for details.

OPNsense 16.1.9 released

There is tremendous progress in the translations. It just so happens that we now have a comprehensive Russian translation as well which is going to be completed in the upcoming weeks. Many thanks to Smart-Soft Ltd. for making this happen. The contender is Japanese through the work of Chie Taguchi, who did most of the translation that we have had for a year. It is going to be a close race to the finish line for both languages. Then again, the whole translation team is doing an amazing job.
As polarising as it may be, we have added HTTPS support in the proxy server. Another noteworthy item is StrongSwan 5.4.0, which helps to address IPSec status page hangs that some have observed with complex setups. We are looking for feedback for these items, please do write in.

OPNsense 16.1.10 released

It has been a quite uneventful week. Suricata and Squid have been
upgraded to their latest versions and you can find their individual
change logs below. The next part of the Russian translation brings
it to number one with a dreamy 83% completed. Otherwise only small
fixes and improvements have been made and those will not even require
a reboot.

OPNsense 16.1.11 released

We are skipping a bit ahead with 16.1.11 to address a CSRF vulnerability, which shows us the good path we have been on since we started[1] and we will surely continue this security-aware trend.
In other news, this update includes native GeoIP alias support, captive portal voucher customisations requested by many and the last batch of Russian, effectively bringing it to 100% completed.


News

Introducing Full PIE Support

We at HardenedBSD have added support in 11-CURRENT for compiling nearly all of base as Position-Independent Executables (PIEs, for short). This work bumps hardening.version to 45. We've enabled PIE base for amd64 and i386 and hope to enable it for arm64 before or during BSDCan 2016. Compiling an application as a PIE enables it to take full advantage of ASLR. Without PIE support, the application itself is loaded at a fixed address, determined at compile time. As of this writing, only nine applications are not compiled as PIEs. At least two of them must stay that way (/sbin/init and /sbin/init.bak), so that leaves the outstanding list at seven. This is a huge leap forward for HardenedBSD. We have tested PIE base on several amd64 systems, both virtualized and bare metal. We have done multiple amd64 package builds with success. We would like to thank Bryan Drewery for his help.
An hbsd-update(8) update archive has been published for 11-CURRENT/amd64 with the "PIEified" base. Update at your leisure.
PIE base is enabled by default for amd64 and i386. We hope to enable it for ARM64 before or during BSDCan. Speaking of ARM64, we will be bringing ten Raspberry Pi 3 devices (which are ARM64) with us to BSDCan, eight of which will be given out to lucky individuals. We want the BSD community to hack on them and get ARM64/Aarch64 fully functional on them.

FreeNAS Mini XL | BSD Now 137

This week on BSD Now, I’m out of town for the week, but we have a special unboxing video to share with you that you won’t want to miss. That, plus the latest BSD news, is coming your way right now!


Code stuff


Interesting articles


Wallpaper of the week 


 from http://freebsdwallpapers.blogspot.cz/

BSDNews 04/04/2016

Last week in BSD

Releases:OpenBSD, SoloBSD, pfSense,
Other news:pfSense, BSDnow, DragonFlyBSD, FreeBSD


BSDSec


Releases

OpenBSD 5.9 released (early!)

The release of OpenBSD 5.9, previously scheduled for the usual May 1st, has just been officially announced!
We are pleased to announce the official release of OpenBSD 5.9.
This is our 39th release on CD-ROM (and 40th via FTP/HTTP).  We remain
proud of OpenBSD's record of more than twenty years with only two remote
holes in the default install.
The release page mentions most of the major improvements, and the detailed changelog has a much longer list. Here are some of the bigger things incorporated into 5.9 that we're excited about. Read more...

SoloBSD 10.3-PRERELEASE-v44

There is a new build of SoloBSD 10.3-PRERELEASE based on the latest HardenedBSD stable branch version 44
You can grab it from Here. (45.8 Mb)
root password: solobsd

pfSense 2.3 Release Candidate

We are proud to announce pfSense® software version 2.3 Release Candidate is now available!
The most significant changes in this release are a rewrite of the webGUI utilizing Bootstrap, and the underlying system being converted entirely to FreeBSD pkg (including the base system and kernel). The pkg conversion enables us to update pieces of the system individually going forward, rather than the monolithic updates of the past.
For the highlights, check out the Features and Highlights video. Past blog posts have covered some of the changes, such as the performance improvements from tryforward, and the webGUI update.
The full list of changes is on the 2.3 New Features and Changes page.
In the process of getting here, we’ve closed out 742 total tickets, with most of those being items related to the Bootstrap conversion. Of those, 136 bugs have been resolved that affect 2.2.x and prior versions.
New Installs
Upgrades
You can upgrade straight to 2.3 from any previous release. Check the Upgrade Guide for details.

News

Speciality MWL | BSD Now 135

This week on the show, we interview author Michael W Lucas to discuss his new book in the FreeBSD Mastery series: “Specialty Filesystems”. That plus the latest news, feedback & more!
 

Features and Highlights of pfSense 2.3

Unless you’ve been completely out of the loop, you know that the official release of pfSense 2.3 is on the horizon. In anticipation of that event, Netgate, host of the pfSense® open-source software community and technical leader of the pfSense project, has put together a video that highlights many of the new and exciting changes in this release. Incalculable hours of engineering and testing time has been invested in this release. It’s certainly our biggest yet. As soon as it’s released, you can get it on official pfSense hardware at netgate.com. Enjoy!


Code stuff



Interesting articles

talks about blacklistd

Wallpaper


 from https://plus.google.com/u/0/b/112370801182816491936/+UlisesMAlvarez/posts/WgEbZrktsy9

BSD News 28/12/2015


Last week in BSD

Releases: pfSense, OPNsense
Other news:bsda, DragonFly BSD, OPNsense, BSDnow, Talks,


Releases

pfSense 2.2.6-RELEASE Now Available!

pfSense® software version 2.2.6 is now available. This release includes a few bug fixes and security updates.
The bug fixes and changes in this release are detailed here.


OPNsense 15.7.23 Released

Here are the full patch notes:
  • ports: bind 9.10.3-P2[1], python 2.7.11[2], openvpn 2.3.9[3]
  • traffic shaper: page is now properly translated (Contributed by Fabian Franz)
  • system: all remaining pages in this section have been reworked for clarity
  • logs: split up the old VPN multi-log page into their respective parts (L2TP, PPTP, PPPoE)
  • logs: added filtering option to all logs that previously missed it
  • certificates: now supports different extensions (Key Usage, Subject Alternative Name) and usage types
  • dhcp: allow commas in advanced DHCP client options (Contributed by Simon van der Linden)
  • firewall: add direction indication icon to floating rules
  • firewall: lock port numbers on protocols that are not TCP/UDP
  • firewall: fix apply button on outbound NAT page in translation mode
  • traffic shaper: add TCP ACK/non-ACK matching options
  • proxy: two fixes for non-local authentication

News 

 

Next Year's resolution is to learn more BSD.

And we will start right with the January 1st. 
DiscoverBSD Talks is a community based website where people can watch and discuss videos from BSD conferences, and thus learn.
As of now, new video is released every 2 weeks.
You might want to subscribe to get notified when new video is released (via email or rss).

 

New BSDA Study DVD (Spring / Summer 2016) is out

The BSDCG is happy to announce the release of the latest BSD Associate Study DVD, available immediately from the Store. 
 

BSDA Associate Certification Requirements Updated

The BSD Certification Group (BSDCG) is pleased to announce the publication of the updated version of the official examination objectives for the BSD Associate (BSDA) Certification.
The 59 page document outlines 7 knowledge domains, each containing a number of objectives, that form the basis of the certification. The objectives have been updated to reflect changes to the operating systems being tested, including FreeBSD's switch to pkg and bsdinstall, the addition of ZFS to NetBSD, and OpenBSD's switch to doas. The BSDA Requirements document is available as a downloadable PDF in English.

xz images for DragonFly

For those of you that are very bandwidth-constrained, or just impatient, there are xz-compressed images of DragonFly 4.4 available.  (see ‘download live image’ area)  The mirrors should have them too.


All your hyves are belong to us | BSD Now 121

This week on the show, we are going to be talking to Trent Thompson, the founder and lead developer of the new ‘iohyve’ utility. Stick around, so you can find out the exciting direction of virtualization on FreeBSD. That, plus the latest news, heading your way right now.


Code stuff



Wallpaper of the week 

 from talks.discoverbsd.com

BSD News 09/11/2015

BSD News 09/11/2015

Last week in BSD

Releases: HardenedBSD, OPNsense, pfSense
Other news: BSDnow, BSDSec, FreeBSD, HardenedBSD, LibreSSL, OPNsense. DragonFly BSD, pfSense,


BSDSec


Releases 

 

HardenedBSD-stable 10-STABLE and 11-CURRENT amd64 installers

10-STABLE
git git clone --single-branch --branch hardened/10-stable/master https://github.com/hardenedbsd/hardenedbsd-stable/ hardenedbsd-10-stable
installers http://installer.hardenedbsd.org/releases/hardened_10_stable_master-LAST/
11-CURRENT
git git clone --single-branch --branch hardened/current/master https://github.com/hardenedbsd/hardenedbsd-stable/ hardenedbsd-current
installers http://installer.hardenedbsd.org/releases/hardened_current_master-LAST/

 

OPNsense 15.7.18 Released


It took a while to track down a NTP regression with FreeBSD that turned out to be a flaw in the kernel itself. That’s now fixed for all FreeBSD versions. Thanks everyone for helping out here again. :)
This update brings quite a few fixes, especially with regard to VMware and Xen virtualisation plugins. If you are in need of such plugins for seamless guest support the installation is quite painless:
# pkg install os-vmware
# pkg install os-xen
In case of VMware, the masterplan is that vmx network devices will be persistent after reboot so that such devices can be embedded into the config.xml. Let us know how that works for you guys. Needless to say, we’ll keep working on making plugins accessible through the GUI with our next major version that is 16.1.
We’ve also been working on ironing out further IPsec hiccups and adding more features to the captive portal in the development version. Oh, and this: fresh images based on 15.7.18 will be available a couple of days after this release.
Here are the full patch notes:
  • plugins: updated the VMware plugin to support early boot for persistent vmx(4) device access
  • plugins: added the Xen plugin for automatic guest support
  • openvpn: fix server not saving interface without IP
  • crash reporter: remember email for continuous feedback
  • crash reporter: Suhosin PHP module no longer triggers crash reports
  • crash reporter: fixed 10 assorted crash reports
  • languages: fix all apply button prompts for non-English translations
  • languages: updated German and French via https://translate.opnsense.org
  • backend: added simple plugin hooks for boot up, early boot up and shutdown
  • GUI: hooked up the authentication backend rewrite
  • dhcp: remove illegal ifconfig tag in custom dhclient script
  • virtual ips: make subnet selectable on ipalias
  • ipsec: flip ipv4/ipv6 subnet options in phase2
  • ipsec: fix issue when using both tunnels and roadwarrior
  • ipsec: listen to disabled ipsec nat entries
  • ipsec: do not overwrite settings for rekey/reauth
  • proxy: fix error on saving special URL characters
  • aliases: fix missing url table items
  • aliases: hide minus when not applicable
  • ntp: don’t trigger set_gps_default on page load
  • captive portal (development): clean rewrite of RADIUS authentication/accounting
  • captive portal (development): added a session overview feature to the new
  • captive portal (development): fixed template download file name in Google Chrome
  • src: Implement pubkey support for pkg(7) bootstrap [1]
  • src: rpcbind remote denial of service [2]
  • src: Applications exiting due to segmentation violation on a correct memory address [3]
  • src: tzdata updated to 2015g [4]
  • ports: ntp 4.2.8p4 [5]
  • ports: pkg 1.6.1 [6] [7]
  • ports: sqlite 3.9.1 [8]
  • ports: suricata 2.0.9 [9]
  • ports: php 5.6.15 [10]

 

2.2.5-RELEASE Now Available!

 pfSense® software version 2.2.5 is now available. This release includes a number of bug fixes and some security updates.
Today is also the 11 year birthday of the project. While work started in late summer 2004, the domains were registered and the project made public on November 5, 2004. Thanks to everyone that has helped make the project a great success for 11 years. Things just keep getting better, and the best is yet to come.
Security Fixes and Errata
  • pfSense-SA-15_08.webgui: Multiple Stored XSS Vulnerabilities in the pfSense WebGUI
    • The complete list of affected pages and fields is listed in the linked SA.
  • Updated to FreeBSD 10.1-RELEASE-p24
    • FreeBSD-SA-15:25.ntp Multiple vulnerabilities in NTP [REVISED]
    • FreeBSD-SA-15:14.bsdpatch: Due to insufficient sanitization of the input patch stream, it is possible for a patch file to cause patch(1) to run commands in addition to the desired SCCS or RCS commands.
    • FreeBSD-SA-15:16.openssh: OpenSSH client does not correctly verify DNS SSHFP records when a server offers a certificate. CVE-2014-2653 OpenSSH servers which are configured to allow password authentication using PAM (default) would allow many password attempts.
    • FreeBSD-SA-15:18.bsdpatch: Due to insufficient sanitization of the input patch stream, it is possible for a patch file to cause patch(1) to pass certain ed(1) scripts to the ed(1) editor, which would run commands.
    • FreeBSD-SA-15:20.expat: Multiple integer overflows have been discovered in the XML_GetBuffer() function in the expat library.
    • FreeBSD-SA-15:21.amd64: If the kernel-mode IRET instruction generates an #SS or #NP exception, but the exception handler does not properly ensure that the right GS register base for kernel is reloaded, the userland GS segment may be used in the context of the kernel exception handler.
    • FreeBSD-SA-15:22.openssh: A programming error in the privileged monitor process of the sshd(8) service may allow the username of an already-authenticated user to be overwritten by the unprivileged child process. A use-after-free error in the privileged monitor process of the sshd(8) service may be deterministically triggered by the actions of a compromised unprivileged child process. A use-after-free error in the session multiplexing code in the sshd(8) service may result in unintended termination of the connection.
The bug fixes and changes in this release are detailed here.

News 

OpenBGPd and route filters

Many moons ago, OpenBGPd was extensively used throughout the networking world as a Route Server. However, over the years, many have stopped using it and have migrated away to other implementations. Recently, I have been getting more involved with the networking community, so I decided to ask "why?" Read more...

Call For Donations Update

On 11 July 2015, we announced a Call For Donations. The community has been very gracious towards us. As of today, we have now exceeded our goal. We are grateful to each and every one of our donors, no matter the amount they contributed or in what form. HardenedBSD is growing and we need all the help we can get. We would especially like to thank Xinuos and ISC for their sizable contributions.
Here's what we've managed to do so far with the donations provided:
  • Replace two failing hard drives in the package building server along with ordering two extra for hot spares.
  • Purchase multiple ARM and ARM64 development boards for porting and testing efforts.
  • Stickers!
  • Minor expenses for conferences.
  • Hosting expenses.
  • Other hardware replacement and acquisition.
In January of 2016, work will start for becoming a 501(C)(3) not-for-profit organization in the United States. This will mean that US-based donations will be tax-deductible, giving a tangible incentive for donations.
We couldn't have done all of this had it not been for all the generous contributions, large and small. Even though we've reached our goal, we're still accepting donations. The more that comes in, the more that we can accomplish. We look forward to the coming year and the advancements we'll make.


BSD-Schooling | BSD Now 114

Allan is out of town this week at another Developer Summit but we have a great episode coming up with Brian Callahan where we discuss BSD in education. Also, news & a lot of user feedback to get to, so sit back & relax, more BSD is coming your way right now!

Code stuff