Skip to main content.

Episode 072: Common *Sense Approach


Direct Download:

Video | HD Video | MP3 Audio | OGG Audio | Torrent

This episode was brought to you by

iXsystems - Enterprise servers and storage for open sourceTarsnap - online backups for the truly paranoid


Be your own VPN provider with OpenBSD

  • We've covered how to build a BSD-based gateway that tunnels all your traffic through a VPN in the past - but what if you don't trust any VPN company?
  • It's easy for anyone to say "of course we don't run a modified version of OpenVPN that logs all your traffic... what are you talking about?"
  • The VPN provider might also be slow to apply security patches, putting you and the rest of the users at risk
  • With this guide, you'll be able to cut out the middleman and create your own VPN, using OpenBSD
  • It covers topics such as protecting your server, securing DNS lookups, configuring the firewall properly, general security practices and of course actually setting up the VPN

FreeBSD vs Gentoo comparison

  • People coming over from Linux will sometimes compare FreeBSD to Gentoo, mostly because of the ports-like portage system for installing software
  • This article takes that notion and goes much more in-depth, with lots more comparisons between the two systems
  • The author mentions that the installers are very different, ports and portage have many subtle differences and a few other things
  • If you're a curious Gentoo user considering FreeBSD, this might be a good article to check out to learn a bit more

Kernel W^X in OpenBSD

  • W^X, "Write XOR Execute," is a security feature of OpenBSD with a rather strange-looking name
  • It's meant to be an exploit mitigation technique, disallowing pages in the address space of a process to be both writable and executable at the same time
  • This helps prevent some types of buffer overflows: code injected into it won't execute, but will crash the program (quite obviously the lesser of the two evils)
  • Through some recent work, OpenBSD's kernel now has no part of the address space without this feature - whereas it was only enabled in the userland previously
  • Doing this incorrectly in the kernel could lead to far worse consequences, and is a lot harder to debug, so this is a pretty huge accomplishment that's been in the works for a while
  • More technical details can be found in some recent CVS commits

Building an IPFW-based router

  • We've covered building routers with PF many times before, but what about IPFW?
  • A certain host of a certain podcast decided it was finally time to replace his disappointing consumer router with something BSD-based
  • In this blog post, Kris details his experience building and configuring a new router for his home, using IPFW as the firewall
  • He covers in-kernel NAT and NATD, installing a DHCP server from packages and even touches on NAT reflection a bit
  • If you're an IPFW fan and are thinking about putting together a new router, give this post a read

Interview - Jos Schellevis - / @opnsense

The birth of OPNsense

News Roundup

On profiling HTTP

  • Adrian Chadd, who we've had on the show before, has been doing some more ultra-high performance testing
  • Faced with the problem of how to generate a massive amount of HTTP traffic, he looked into the current state of benchmarking tools
  • According to him, it's "not very pretty"
  • He decided to work on a new tool to benchmark huge amounts of web traffic, and the rest of this post describes the whole process
  • You can check out his new code on Github right now

Using divert(4) to reduce attacks

  • We talked about using divert(4) with PF last week, and this post is a good follow-up to that introduction (though unrelated to that series)
  • It talks about how you can use divert, combined with some blacklists, to reduce attacks on whatever public services you're running
  • PF has good built-in rate limiting for abusive IPs that hit rapidly, but when they attack slowly over a longer period of time, that won't work
  • The Composite Blocking List is a public DNS blocklist, operated alongside Spamhaus, that contains many IPs known to be malicious
  • Consider setting this up to reduce the attack spam in your logs if you run public services

ChaCha20 patchset for GELI

  • A user has posted a patch to the freebsd-hackers list that adds ChaCha support to GELI, the disk encryption system
  • There are also some benchmarks that look pretty good in terms of performance
  • Currently, GELI defaults to AES in XTS mode with a few tweakable options (but also supports Blowfish, Camellia and Triple DES)
  • There's some discussion going on about whether a stream cipher is suitable or not for disk encryption though, so this might not be a match made in heaven just yet

PCBSD update system enhancements

  • The PCBSD update utility has gotten an update itself, now supporting automatic upgrades
  • You can choose what parts of your system you want to let it automatically handle (packages, security updates)
  • The update system uses ZFS and Boot Environments for safe updating and bypasses some dubious pkgng functionality
  • There's also a new graphical frontend available for it


Mailing List Gold

  • Send questions, comments, show ideas/topics, or stories you want mentioned on the show to
  • Watch live Wednesdays at 2:00PM Eastern (19:00 UTC)

Latest News

Two Year Anniversary


We're quickly approaching our two-year anniversary, which will be on episode 105. To celebrate, we've created a unique t-shirt design, available for purchase until the end of August. Shirts will be shipped out around September 1st. Most of the proceeds will support the show, and specifically allow us to buy...

New discussion segment


We're thinking about adding a new segment to the show where we discuss a topic that the listeners suggest. It's meant to be informative like a tutorial, but more of a "free discussion" format. If you have any subjects you want us to explore, or even just a good name...

How did you get into BSD?


We've got a fun idea for the holidays this year: just like we ask during the interviews, we want to hear how all the viewers and listeners first got into BSD. Email us your story, either written or a video version, and we'll read and play some of them for...

EuroBSDCon 2014


As you might expect, both Allan and Kris will be at EuroBSDCon this year. They'll be busy hunting down various BSD developers and forcing them to do interviews, but don't hesitate to say hi if you're a listener!...

Episode 190: The Moore You Know


VideoHD VideoMP3 AudioOGG AudioTorrent This episode was brought to you by OpenBSD 6.1 RELEASED Mailing list post We are pleased to announce the official release of OpenBSD 6.1. This is our 42nd release. New/extended platforms: New arm64 platform, using clang(1) as the base system compiler. The loongson platform now supports systems with Loongson 3A CPU and RS780E...

Episode 189 Codified Summer


VideoHD VideoMP3 AudioOGG AudioTorrent This episode was brought to you by Headlines Google summer of code for BSDs FreeBSD FreeBSD's existing list of GSoC Ideas for potential students FreeBSD/Xen: import the grant-table bus_dma(9) handlers from OpenBSD Add support for usbdump file-format to wireshark and vusb-analyzer Write a new boot environment manager Basic smoke test of all base utilities Port...

Episode 188: And then the murders began


Direct Download:VideoHD VideoMP3 AudioOGG AudioTorrent This episode was brought to you by Headlines DragonFly BSD 4.8 is released Improved kernel performance This release further localizes cache lines and reduces/removes cache ping-ponging on globals. For bulk builds on many-cores or multi-socket systems, we have around a 5% improvement, and certain subsystems such as namecache lookups and...

Episode 187: Catching up to BSD


Direct Download:VideoHD VideoMP3 AudioOGG AudioTorrent This episode was brought to you by Headlines NetBSD 7.1 released This update represents a selected subset of fixes deemed important for security or stability reasons, as well as new features and enhancements. Kernel compat_linux(8): Fully support schedsetaffinity and schedgetaffinity, fixing, e.g., the Intel Math Kernel Library. DTrace: Avoid redefined symbol errors when...