netgate – Jupiter Broadcasting

Back in the Freedom Dimension | LINUX Unplugged 398

Wes Payne — Tue, 23 Mar 2021 17:30:00 +0000

Show Notes: linuxunplugged.com/398

The post Back in the Freedom Dimension | LINUX Unplugged 398 first appeared on Jupiter Broadcasting.

Firewall Fun | TechSNAP 421

Wes Payne — Fri, 24 Jan 2020 00:15:00 +0000

Show Notes: techsnap.systems/421

The post Firewall Fun | TechSNAP 421 first appeared on Jupiter Broadcasting.

Common *Sense Approach | BSD Now 72

chris — Thu, 15 Jan 2015 12:55:22 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

This week on the show, we’ll be talking to Jos Schellevis about OPNsense, a new firewall project that was forked from pfSense. We’ll learn some of the backstory and see what they’ve got planned for the future. We’ve also got all this week’s news and answers to all your emails, on BSD Now – the place to B.. SD.

Thanks to:

Direct Download:

RSS Feeds:

– Show Notes: –

Headlines

Be your own VPN provider with OpenBSD

We’ve covered how to build a BSD-based gateway that tunnels all your traffic through a VPN in the past – but what if you don’t trust any VPN company?
It’s easy for anyone to say “of course we don’t run a modified version of OpenVPN that logs all your traffic… what are you talking about?”
The VPN provider might also be slow to apply security patches, putting you and the rest of the users at risk
With this guide, you’ll be able to cut out the middleman and create your own VPN, using OpenBSD
It covers topics such as protecting your server, securing DNS lookups, configuring the firewall properly, general security practices and of course actually setting up the VPN

FreeBSD vs Gentoo comparison

People coming over from Linux will sometimes compare FreeBSD to Gentoo, mostly because of the ports-like portage system for installing software
This article takes that notion and goes much more in-depth, with lots more comparisons between the two systems
The author mentions that the installers are very different, ports and portage have many subtle differences and a few other things
If you’re a curious Gentoo user considering FreeBSD, this might be a good article to check out to learn a bit more

Kernel W^X in OpenBSD

W^X, “Write XOR Execute,” is a security feature of OpenBSD with a rather strange-looking name
It’s meant to be an exploit mitigation technique, disallowing pages in the address space of a process to be both writable and executable at the same time
This helps prevent some types of buffer overflows: code injected into it won’t execute, but will crash the program (quite obviously the lesser of the two evils)
Through some recent work, OpenBSD’s kernel now has no part of the address space without this feature – whereas it was only enabled in the userland previously
Doing this incorrectly in the kernel could lead to far worse consequences, and is a lot harder to debug, so this is a pretty huge accomplishment that’s been in the works for a while
More technical details can be found in some recent CVS commits

Building an IPFW-based router

We’ve covered building routers with PF many times before, but what about IPFW?
A certain host of a certain podcast decided it was finally time to replace his disappointing consumer router with something FreeBSD-based
In this blog post, Kris details his experience building and configuring a new router for his home, using IPFW as the firewall
He covers in-kernel NAT and NATD, installing a DHCP server from packages and even touches on NAT reflection a bit
If you’re an IPFW fan and are thinking about putting together a new router, give this post a read

Interview – Jos Schellevis – project@opnsense.org / @opnsense

The birth of OPNsense

News Roundup

On profiling HTTP

Adrian Chadd, who we’ve had on the show before, has been doing some more ultra-high performance testing
Faced with the problem of how to generate a massive amount of HTTP traffic, he looked into the current state of benchmarking tools
According to him, it’s “not very pretty”
He decided to work on a new tool to benchmark huge amounts of web traffic, and the rest of this post describes the whole process
You can check out his new code on Github right now

Using divert(4) to reduce attacks

We talked about using divert(4) with PF last week, and this post is a good follow-up to that introduction (though unrelated to that series)
It talks about how you can use divert, combined with some blacklists, to reduce attacks on whatever public services you’re running
PF has good built-in rate limiting for abusive IPs that hit rapidly, but when they attack slowly over a longer period of time, that won’t work
The Composite Blocking List is a public DNS blocklist, operated alongside Spamhaus, that contains many IPs known to be malicious
Consider setting this up to reduce the attack spam in your logs if you run public services

ChaCha20 patchset for GELI

A user has posted a patch to the freebsd-hackers list that adds ChaCha support to GELI, the disk encryption system
There are also some benchmarks that look pretty good in terms of performance
Currently, GELI defaults to AES in XTS mode with a few tweakable options (but also supports Blowfish, Camellia and Triple DES)
There’s some discussion going on about whether a stream cipher is suitable or not for disk encryption though, so this might not be a match made in heaven just yet

PCBSD update system enhancements

The PCBSD update utility has gotten an update itself, now supporting automatic upgrades
You can choose what parts of your system you want to let it automatically handle (packages, security updates)
There’s also a new graphical frontend available for it
The update system uses ZFS + Boot Environments for safe updating and bypasses some dubious pkgng functionality

Feedback/Questions

Mailing List Gold

Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv
Watch live Wednesdays at 2:00PM Eastern (19:00 UTC)

The post Common *Sense Approach | BSD Now 72 first appeared on Jupiter Broadcasting.

Conference Connoisseur | BSD Now 66

chris — Thu, 04 Dec 2014 11:40:12 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

This week on the show, we’ll be talking with Paul Schenkeveld, chairman of the EuroBSDCon foundation. He tells us about his experiences running BSD conferences and how regular users can get involved too. We’ve also got answers to all your emails and the latest news, coming up on BSD Now – the place to B.. SD.

Thanks to:

Direct Download:

RSS Feeds:

– Show Notes: –

Headlines

BSD-powered digital library in Africa

You probably haven’t heard much about Nzega, Tanzania, but it’s an East African country without much internet access
With physical schoolbooks being a rarity there, a few companies helped out to bring some BSD-powered reading material to a local school
They now have a pair of FreeNAS Minis at the center of their local network, with over 80,000 books and accompanying video content stored on them (~5TB of data currently)
The school’s workstations also got wiped and reloaded with FreeBSD, and everyone there seems to really enjoy using it

pfSense 2.2 status update

With lots of people asking when the 2.2 release will be done, some pfSense developers have provided a status update
2.2 will have a lot of changes: being based on FreeBSD 10.1, Unbound instead of BIND, updating PHP to something recent, including the new(ish) IPSEC stack updates, etc
All these things have taken more time than previously expected
The post also has some interesting graphs showing the ratio of opened and close bugs for the upcoming release

Recommended hardware threads

A few threads on caught our attention this week, all about hardware recommendations for BSD setups
In the first one, the OP asks about mini-ITX hardware to run a FreeBSD server and NAS
Everyone gave some good recommendations for low power, Atom-based systems
The second thread started off asking about which CPU architecture is best for PF on an OpenBSD router, but ended up being another hardware thread
For a router, the ALIX, APU and Soekris boards still seem to be the most popular choices, with the third and fourth threads confirming this
If you’re thinking about building your first BSD box – server, router, NAS, whatever – these might be some good links to read

Interview – Paul Schenkeveld – freebsd@psconsult.nl

Running a BSD conference

News Roundup

From Linux to FreeBSD – for reals

Another Linux user is ready to switch to BSD, and takes to Reddit for some community encouragement (seems to be a common thing now)
After being a Linux guy for 20(!) years, he’s ready to switch his systems over, and is looking for some helpful guides to transition
In the comments, a lot of new switchers offer some advice and reading material
If any of the listeners have some things that were helpful along your switching journey, maybe send ’em this guy’s way

Running FreeBSD as a Xen Dom0

Continuing progress has been made to allow FreeBSD to be a host for the Xen hypervisor
This wiki article explains how to run the Xen branch of FreeBSD and host virtual machines on it
Xen on FreeBSD currently supports PV guests (modified kernels) and HVM (unmodified kernels, uses hardware virtualization features)
The wiki provides instructions for running Debian (PV) and FreeBSD (HVM), and discusses the features that are not finished yet

HardenedBSD updates and changes

a.out is the old executable format for unix
“The name stands for assembler output, and was coined by Ken Thompson as the fixed name for output of his PDP-7 assembler in 1968”
FreeBSD, on which HardenedBSD is based, switched away from a.out in FreeBSD 3.0
A restriction against NULL mapping was introduced in FreeBSD 7 and enabled by default in FreeBSD 8
However, for reasons of compatibility, it could be switched off, allowing buggy applications to continue to run, at the risk of allowing a kernel bug to be exploited
HardenedBSD has removed the sysctl, making it impossible to run in ‘insecure mode’
Package Building Update: more consistent repo, no more i386 packages

Feedback/Questions

Mailing List Gold

All the tutorials are posted in their entirety at bsdnow.tv
If you’re in New York’s Capital District, there’s a meeting for the BSD users group on December 9th
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv – if there’s a tutorial you’d like to see, or maybe someone you want us to interview, let us know!
Watch live Wednesdays at 2:00PM Eastern (19:00 UTC)
Reminder: just like we ask during the interviews, we want to hear how all the viewers and listeners first got into BSD. Email us your story, either written or a video version, and we’ll read and play some of them for the Christmas episode. You’ve got until December 17th to send them in.

The post Conference Connoisseur | BSD Now 66 first appeared on Jupiter Broadcasting.

The Promised WLAN | BSD Now 55

chris — Thu, 18 Sep 2014 10:26:43 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Coming up this week, we’ll be talking with Adrian Chadd about all things wireless, his experience with FreeBSD on various laptop hardware and a whole lot more. As usual, we’ve got the latest news and answers to all your emails, on BSD Now – the place to B.. SD.

Thanks to:

Direct Download:

RSS Feeds:

– Show Notes: –

Headlines

FreeBSD 10.1-BETA1 is out

The first maintenance update in the 10.x series of FreeBSD is on its way
Since we can’t see a changelog yet, the 10-STABLE release notes offer a glimpse at some of the new features and fixes that will be included in 10.1
The vt driver was merged from -CURRENT, lots of drivers were updated, lots of bugs were fixed and bhyve also got many improvements from 11
Initial UEFI support, multithreaded softupdates for UFS and many more things were added
You can check the release schedule for the planned release dates
Details for the various forms of release media can be found in the announcement

Remote headless OpenBSD installation

A lot of server providers only offer a limited number of operating systems to be easily installed on their boxes
Sometimes you’ll get lucky and they’ll offer FreeBSD, but it’s much harder to find ones that natively support other BSDs
This article shows how you can use a Linux-based rescue system, a RAM disk and QEMU to install OpenBSD on the bare metal of a server, headlessly and remotely
It required a few specific steps you’ll want to take note of, but is extremely useful for those pesky hosting providers

Building a firewall appliance with pfSense

In this article, we learn how to easily set up a gateway and wireless access point with pfSense on a Netgate ALIX2C3 APU
After the author’s modem died, he decided to look into a more do-it-yourself option with pf and a tiny router board
The hardware he used has gigabit ports and a BSD-compatible wireless card, as well as enough CPU power for a modest workload and a few services (OpenVPN, etc.)
There’s a lot of great pictures of the hardware and detailed screenshots, definitely worth a look

Receive Side Scaling – UDP testing

Adrian Chadd has been working on RSS (Receive Side Scaling) in FreeBSD, and gives an update on the progress
He’s using some quad core boxes with 10 gigabit ethernet for the tests
The post gives lots of stats and results from his network benchmark, as well as some interesting workarounds he had to do
He also provides some system configuration options, sysctl knobs, etc. (if you want to try it out)
And speaking of Adrian Chadd…

Interview – Adrian Chadd – adrian@freebsd.org / @erikarn

BSD on laptops, wifi, drivers, various topics

News Roundup

Sendmail removed from OpenBSD

Mail server admins around the world are rejoicing, because sendmail is finally gone from OpenBSD
With OpenSMTPD being a part of the base system, sendmail became largely redundant and unneeded
If you’ve ever compared a “sendmail.cf” file to an “smtpd.conf” file… the different is as clear as night and day
5.6 will serve as a transitional release, including both sendmail and OpenSMTPD, but 5.7 will be the first release without it
If you still need it for some reason, sendmail will live in ports from now on
Hopefully FreeBSD will follow suit sometime in the future as well, possibly including DragonFly’s mail transfer agent in base (instead of an entire mail server)

pfSense backups with pfmb

We’ve mentioned the need for a tool to back up pfSense configs a number of times on the show
This script, hosted on github, does pretty much exactly that
It can connect to one (or more!) pfSense installations and back up the configuration
You can roll back or replace failed hardware very easily with its restore function
Everything is done over SSH, so it should be pretty secure

The Design and Implementation of the FreeBSD Operating System

We mentioned when the pre orders were up, but now “The Design and Implementation of the FreeBSD Operating System, 2nd edition” seems to be shipping out
If you’re interested in FreeBSD development, or learning about the operating system internals, this is a great book to buy
We’ve even had all three authors on the show before!

OpenBSD’s systemd replacement updates

We mentioned last week that the news of OpenBSD creating systemd wrappers was getting mainstream attention
One of the developers writes in to Undeadly, detailing what’s going on and what the overall status is
He also clears up any confusion about “porting systemd to BSD” (that’s not what’s going on) or his code ever ending up in base (it won’t)
The top comment as of right now is a Linux user asking if his systemd wrappers can be ported back to Linux… poor guy

Feedback/Questions

All the tutorials are posted in their entirety at bsdnow.tv
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv – we’d love to hear from you!
Last week we mentioned that Ken was looking for help to port Lumina to other BSDs, and now it’s been done for OpenBSD and DragonFly – so now you can try it out there too
Antoine Jacoutot sent a screenshot of Lumina on OpenBSD
We’ll be at EuroBSDCon soon, so there will be a prerecorded episode next week
When we’re not in Europe, you can usually watch live Wednesdays at 2:00PM Eastern (18:00 UTC)

The post The Promised WLAN | BSD Now 55 first appeared on Jupiter Broadcasting.

Devious Methods | BSD Now 42

chris — Thu, 19 Jun 2014 11:56:15 +0000

To view this video please enable JavaScript, and consider upgrading to a web browser that supports HTML5 video

Coming up this week, we’ll be showing you how to chain SSH connections, as well as some cool tricks you can do with it. Going along with that theme, we also have an interview with Bryce Chidester about running a BSD-based shell provider. News, emails and cowsay turkeys, on BSD Now – the place to B.. SD.

Thanks to:

Direct Download:

RSS Feeds:

– Show Notes: –

Headlines

PIE and ASLR in FreeBSD update

A status update for Shawn Webb’s ASLR and PIE work for FreeBSD
One major part of the code, position-independent executable support, has finally been merged into the -CURRENT tree
“FreeBSD has supported loading PIEs for a while now, but the applications in base weren’t compiled as PIEs. Given that ASLR is useless without PIE, getting base compiled with PIE support is a mandatory first step in proper ASLR support”
If you’re running -CURRENT, just add “WITH_PIE=1” to your /etc/src.conf and /etc/make.conf
The next step is working on the ASLR coding style and getting more developers to look through it
Shawn will also be at EuroBSDCon (in September) giving an updated version of his BSDCan talk about ASLR

Misc. pfSense news

Couple of pfSense news items this week, including some hardware news
Someone’s gotta test the pfSense hardware devices before they’re sold, which involves powering them all on at least once
To make that process faster, they’re building a controllable power board (and include some cool pics)
There will be more info on that device a bit later on
On Friday, June 27th, there will be another video session (for paying customers only…) about virtualized firewalls
pfSense University, a new paid training course, was also announced
A single two-day class costs $2000, ouch

ZFS stripe width

A new blog post from Matt Ahrens about ZFS stripe width
“The popularity of OpenZFS has spawned a great community of users, sysadmins, architects and developers, contributing a wealth of advice, tips and tricks, and rules of thumb on how to configure ZFS. In general, this is a great aspect of the ZFS community, but I’d like to take the opportunity to address one piece of misinformed advice”
Matt goes through different situations where you would set up your zpool differently, each with their own advantages and disadvantages
He covers best performance on random IOPS, best reliability, and best space efficiency use cases
It includes a lot of detail on each one, including graphs, and addresses some misconceptions about different RAID-Z levels’ overhead factor

FreeBSD 9.3-BETA3 released

The third BETA in the 9.3 release cycle is out, we’re slowly getting closer to the release
This is expected to be the final BETA, next will come the RCs
There have mostly just been small bug fixes since BETA2, but OpenSSL was also updated and the arc4random code was updated to match what’s in -CURRENT (but still isn’t using ChaCha20)
The FreeBSD foundation has a blog post about it too
There’s a list of changes between 9.2 and 9.3 as well, but we’ll be sure to cover it when the -RELEASE hits

Interview – Bryce Chidester – brycec@devio.us / @brycied00d

Running a BSD shell provider

Tutorial

Chaining SSH connections

News Roundup

My FreeBSD adventure

A Slackware user from the “linux questions” forum decides to try out BSD, and documents his initial impressions and findings
After ruling out PCBSD due to the demanding hardware requirements and NetBSD due to “politics” (whatever that means, his words) he decides to start off with FreeBSD 10, but also mentions trying OpenBSD later on
In his forum post, he covers the documentation (and how easy it makes it for a switcher), dual booting, packages vs ports, network configuration and some other little things
So far, he seems to really enjoy BSD and thinks that it makes a lot of sense compared to Linux
Might be an interesting, ongoing series we can follow up on later

Even more BSDCan trip reports

BSDCan may be over until next year, but trip reports are still pouring in
This time we have a summary from Li-Wen Hsu, who was paid for by the FreeBSD foundation
He’s part of the “Jenkins CI for FreeBSD” group and went to BSDCan mostly for that
Nice long post about all of his experiences at the event, definitely worth a read
He even talks about… the food

FreeBSD disk partitioning

For his latest book series on FreeBSD’s GEOM system, MWL asked the hackers mailing list for some clarification
This erupted into a very long discussion about fdisk vs gnop vs gpart
So you don’t have to read the tons of mailing list posts, he’s summarized the findings in a blog post
It covers MBR vs GPT, disk sector sizes and how to handle all of them with which tools

BSD Router Project version 1.51

A new version of the BSD Router Project has been released, 1.51
It’s now based on FreeBSD 10-STABLE instead of 10.0-RELEASE
Includes lots of bugfixes and small updates, as well as some patches from pfSense and elsewhere
Check the sourceforge page for the complete list of changes
The minimum disk size requirement has increased to 512MB

Feedback/Questions

All the tutorials are posted in their entirety at bsdnow.tv
A special thanks to our viewer Lars for writing most of today’s tutorial and sending it in
Send questions, comments, show ideas/topics, or stories you want mentioned on the show to feedback@bsdnow.tv
If you want to come on for an interview or have a tutorial you’d like to see, let us know
Watch live Wednesdays at 2:00PM Eastern (18:00 UTC)

The post Devious Methods | BSD Now 42 first appeared on Jupiter Broadcasting.