Show Notes: linuxunplugged.com/402

The post Our Worst Idea Yet | LINUX Unplugged 402 first appeared on Jupiter Broadcasting.

Show Notes/Links: https://www.bsdnow.tv/317

The post Bots Building Jails | BSD Now 317 first appeared on Jupiter Broadcasting.

Show Notes: techsnap.systems/395

The post The ACME Era | TechSNAP 395 first appeared on Jupiter Broadcasting.

This time on the show, we’ll be talking some ZFS with Sean Chittenden. He’s been using it on FreeBSD at Groupon, and has some interesting stories about how it’s saved his data. Answers to your emails and all of this week’s headlines, on BSD Now – the place to B.. SD.

Thanks to:

• Get Paid to Write for DigitalOcean

Direct Download:

Video | HD Video | MP3 Audio | OGG Audio | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | HD Vid Feed | HD Torrent Feed

– Show Notes: –

Headlines

More BSDCan 2015 videos

• Almost as if we said it would happen last week, more BSD-related presentation videos have been uploaded
• Alexander Motin, Feature-rich and fast SCSI target with CTL and ZFS
• Daichi Goto, FreeBSD for High Density Servers
• Ken Moore, Lumina-DE
• Kevin Bowling, FreeBSD Operations at Limelight Networks
• Maciej Pasternacki, Jetpack, a container runtime for FreeBSD
• Ray Percival, Networking with OpenBSD in a virtualized environment
• Reyk Floeter, Introducing OpenBSD’s new httpd
• Still more to come, hopefully

OpenBSD httpd rewrite support

• One of the most-requested features of OpenBSD’s new HTTP daemon (in fact, you can hear someone asking about it in the video just above) is rewrite support
• There were concerns about regex code being too complicated and potentially allowing another attack surface, so that was out
• Instead, Reyk ported over an implementation of lua pattern matching while on the flight back from BSDCan, turning it into a C API without the lua bindings
• In the mailing list post, he shows an example of how to use it for redirects and provides the diff if you’d like to give it a try now
• It’s since been committed to -current, so you can try it out with a snapshot too

SSH 2FA on FreeBSD

• We’ve discussed different ways to lock down SSH access to your BSD boxes before – use keys instead of passwords, whitelist IPs, or even use two-factor authentication
• This article serves as a sort of “roundup” on different methods to set up two-factor authentication on FreeBSD
• It touches on key pairs with a server-side password, google authenticator and a few other variations
• While the article is focused on FreeBSD, a lot of it can be easily applied to the others too
• OpenSSH has a great security record, but two-factor authentication is always a good thing to have for the most important systems

NetBSD 7.0-RC1 released

• NetBSD has just announced the first release candidate for the 7.0 branch, after a long delay since the initial beta (11 months ago)
• Some of the standout features include: improved KMS/DRM with support for modern GPUs, SMP support on ARM, lots of new ARM boards officially supported, GPT support in the installer, Lua kernel scripting, a multiprocessor USB stack, improvements to NPF (their firewall) and, optionally, Clang 3.6.1
• They’re looking for as much testing as possible, so give it a try and report your findings to the release engineering team

Interview – Sean Chittenden – seanc@freebsd.org / @seanchittenden

FreeBSD at Groupon, ZFS

News Roundup

OpenSMTPD and Dovecot

• We’ve covered a number of OpenSMTPD mail server guides on the show, each with just a little something different to offer than the last
• This blog post about it has something not mentioned before: virtual domains and virtual users
• This means you can easily have “user1@domain.com” and “user2@otherdomain.com” both go to a local user on the box (or a different third address)
• It also covers SSL certificates, blocking spam and setting up IMAP access, the usual
• Now might also be a good time to test out OpenSMTPD 5.7.1-rc1, which we’ll cover in more detail when it’s released…

OctoPkg, a QT frontend to pkgng

• A PC-BSD user has begun porting over a graphical package management utility from Arch linux called Octopi
• Obviously, it needed to be rewritten to use FreeBSD’s pkg system instead of pacman
• There are some basic instructions on how to get it built and running on the github page
• After some testing, it’ll likely make its way to the FreeBSD ports tree
• Tools like this might make it easier for desktop users (who are used to similar things in Ubuntu or related distros) to switch over

AFL vs. mandoc, a quantitative analysis

• Ingo Schwarze has written a pretty detailed article about how he and other OpenBSD developers have been fuzzing mandoc with AFL
• It’s meant to be accompanying material to his BSDCan talk, which already covered nine topics
• mandoc is an interesting example to stress test with fuzzing, since its main job is to take and parse some highly varying input
• The article breaks down the 45 different bugs that were found, based on their root cause
• If you’re interested in secure coding practices, this’ll be a great one to read

OpenZFS conference video

• Videos from the second OpenZFS conference have just started to show up
• The first talk is by, you guessed it, Matt Ahrens
• In it, he covers some ZFS history, the Oracle takeover, the birth of illumos and OpenZFS, some administration basics and also some upcoming features that are being worked on
• There are also videos from Nexenta and HGST, talking about how they use and contribute to OpenZFS

Feedback/Questions

• Bryson writes in
• Kevin writes in

• Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv

The post Bitrot Group Therapy | BSD Now 95 first appeared on Jupiter Broadcasting.

This week on the show, we’ll be starting a two-part series detailing the activities of various BSD foundations. Ed Maste from the FreeBSD foundation will be joining us this time, and we’ll talk about what all they’ve been up to lately. All this week’s news and answers to viewer-submitted questions, coming up on BSD Now – the place to B.. SD.

Thanks to:

• Get Paid to Write for DigitalOcean

Direct Download:

Video | HD Video | MP3 Audio | OGG Audio | Torrent | YouTube

RSS Feeds:

MP3 Feed | OGG Feed | iTunes Feed | Video Feed | HD Vid Feed | HD Torrent Feed

– Show Notes: –

Headlines

Key rotation in OpenSSH 6.8

• Damien Miller posted a new blog entry about one of the features in the upcoming OpenSSH 6.8
• Times changes, key types change, problems are found with old algorithms and we switch to new ones
• In OpenSSH (and the SSH protocol) however, there hasn’t been an easy way to rotate host keys… until now
• With this change, when you connect to a server, it will log all the server’s public keys in your known_hosts file, instead of just the first one used during the key exchange
• Keys that are in your known_hosts file but not on the server will get automatically removed
• This fixes the problem of old servers still authenticating with ancient DSA or small RSA keys, as well as providing a way for the server to rotate keys every so often
• There are some instructions in the blog post for how you’ll be able to rotate host keys and eventually phase out the older ones – it’s really simple
• There are a lot of big changes coming in OpenSSH 6.8, so we’ll be sure to cover them all when it’s released

NetBSD Banana Pi images

• We’ve talked about the Banana Pi a bit before – it’s a small ARM board that’s comparable to the popular Raspberry Pi
• Some NetBSD -current images were posted on the mailing list, so now you can get some BSD action on one of these little devices
• There are even a set of prebuilt pkgsrc packages, so you won’t have to compile everything initially
• The email includes some steps to get everything working and an overview of what comes with the image
• Also check the wiki page for some related boards and further instructions on getting set up
• On a related note, NetBSD also recently got GPU acceleration working for the Raspberry Pi (which is a first for their ARM port)

LibreSSL shirts and other BSD goodies

• If you’ve been keeping up with the LibreSSL saga and want a shirt to show your support, they’re finally available to buy online
• There are two versions, either “keep calm and use LibreSSL” or the slightly more snarky “keep calm and abandon OpenSSL“
• While on the topic, we thought it would be good to make people aware of shirts for other BSD projects too
• You can get some FreeBSD, PCBSD and FreeNAS stuff from the FreeBSD mall site
• OpenBSD recently launched their new store, but the selection is still a bit limited right now
• NetBSD has a couple places where you can buy shirts and other apparel with the flag logo on it
• We couldn’t find any DragonFlyBSD shirts unfortunately, which is a shame since their logo is pretty cool
• Profits from the sale of the gear go back to the projects, so pick up some swag and support your BSD of choice (and of course wear them at any Linux events you happen to go to)

OPNsense 15.1.4 released

• The OPNsense guys have been hard at work since we spoke to them, fixing lots of bugs and keeping everything up to date
• A number of versions have come out since then, with 15.1.4 being the latest (assuming they haven’t updated it again by the time this airs)
• This version includes the latest round of FreeBSD kernel security patches, as well as minor SSL and GUI fixes
• They’re doing a great job of getting upstream fixes pushed out to users quickly, a very welcome change
• A developer has also posted an interesting write-up titled “Development Workflow in OPNsense“
• If any of our listeners are trying OPNsense as their gateway firewall, let us know how you like it

Interview – Ed Maste – board@freebsdfoundation.org

The FreeBSD foundation‘s activities

News Roundup

Rolling with OpenBSD snapshots

• One of the cool things about the -current branch of OpenBSD is that it doesn’t require any compiling
• There are signed binary snapshots being continuously re-rolled and posted on the FTP sites for every architecture
• This provides an easy method to get onboard with the latest features, and you can also easily upgrade between them without reformatting or rebuilding
• This blog post will walk you through the process of using snapshots to stay on the bleeding edge of OpenBSD goodness
• After using -current for seven weeks, the author comes to the conclusion that it’s not as unstable as people might think
• He’s now helping test out patches and new ports since he’s running the same code as the developers

Signing pkgsrc packages

• As of the time this show airs, the official pkgsrc packages aren’t cryptographically signed
• Someone from Joyent has been working on that, since they’d like to sign their pkgsrc packages for SmartOS
• Using GNUPG pulled in a lot of dependencies, and they’re trying to keep the bootstrapping process minimal
• Instead, they’re using netpgpverify, a fork of NetBSD’s netpgp utility
• Maybe someday this will become the official way to sign packages in NetBSD?

FreeBSD support model changes

• Starting with 11.0-RELEASE, which won’t be for a few months probably, FreeBSD releases are going to have a different support model
• The plan is to move “from a point release-based support model to a set of releases from a branch with a guaranteed support lifetime”
• There will now be a five-year lifespan for each major release, regardless of how many minor point releases it gets
• This new model should reduce the turnaround time for errata and security patches, since there will be a lot less work involved to build and verify them
• Lots more detail can be found in the mailing list post, including some important changes to the -STABLE branch, so give it a read

OpenSMTPD, Dovecot and SpamAssassin

• We’ve been talking about setting up your own BSD-based mail server on the last couple episodes
• Here we have another post from a user setting up OpenSMTPD, including Dovecot for IMAP and SpamAssassin for spam filtering
• A lot of people regularly ask the developers how to combine OpenSMTPD with spam filtering, and this post should finally reveal the dark secrets
• In addition, it also covers SSL certificates, PKI and setting up MX records – some things that previous posts have lacked
• Just be sure to replace those “apt-get” commands and “eth0” interface names with something a bit more sane…
• In related news, OpenSMTPD has got some interesting new features coming soon
• They’re also planning to switch to LibreSSL by default for the portable version

FreeBSD 10 on the Thinkpad T400

• BSD laptop articles are becoming popular it seems – this one is about FreeBSD on a T400
• Like most of the ones we’ve mentioned before, it shows you how to get a BSD desktop set up with all the little tweaks you might not think to do
• This one differs in that it takes a more minimal approach to graphics: instead of a full-featured environment like XFCE or KDE, it uses the i3 tiling window manager
• If you’re a commandline junkie that basically just uses X11 to run more than one terminal at once, this might be an ideal setup for you
• The post also includes some bits about the DRM and KMS in the 10.x branch, as well as vt

PC-BSD 10.1.1 Released

• Automatic background updater now in
• Shiny new Qt5 utils
• OVA files for VM’s
• Full disk encryption with Geli v7

Feedback/Questions

• Camio writes in
• Sha’ul writes in
• John writes in
• Sean writes in (TJ’s lengthy reply)
• Christopher writes in

Mailing List Gold

• Special Instructions
• Pretending to be a VT220

• Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv – if you’re doing anything cool with BSD, either at work or just as a hobby, let us know about it
• If you have someone specific you’d like to see interviewed, or a tutorial you’d like to see, we’re just an email away
• Watch live Wednesdays at 2:00PM Eastern (19:00 UTC)

The post From the Foundation (Part 1) | BSD Now 75 first appeared on Jupiter Broadcasting.