BSD Now - Episodes Tagged with “File”

96: Lost Technology

JT Pennington — Wed, 01 Jul 2015 08:00:00 -0400

Coming up this week, we'll be talking with Jun Ebihara about some lesser-known CPU architectures in NetBSD. He'll tell us what makes these old (and often forgotten) machines so interesting. As usual, we've also got answers to your emails and all this week's news on BSD Now - the place to B.. SD.

This episode was brought to you by

Headlines

Out with the old, in with the less

Our friend Ted Unangst has a new article up, talking about "various OpenBSD replacements and reductions"
"Instead of trying to fix known bugs, we’re trying to fix unknown bugs. It’s not based on the current buggy state of the code, but the anticipated future buggy state of the code. Past bugs are a bigger factor than current bugs."
In the post, he goes through some of the bigger (and smaller) examples of OpenBSD rewriting tools to be simpler and more secure
It starts off with a lesser-known SCSI driver that "tried to do too much" being replaced with three separate drivers
"Each driver can now be modified in isolation without unintentional side effects on other hardware, or the need to consider if and where further special cases need to be added. Despite the fact that these three drivers duplicate all the common boilerplate code, combined they only amount to about half as much code as the old driver."
In contrast to that example, he goes on to cite mandoc as taking a very non "unixy" direction, but at the same time being smaller and simpler than all the tools it replaced
The next case is the new http daemon, and he talks a bit about the recently-added rewrite support being done in a simple and secure way (as opposed to regex and its craziness)
He also talks about the rewritten "file" utility: "Almost by definition, its sole input will be untrusted input. Perversely, people will then trust what file tells them and then go about using that input, as if file somehow sanitized it."
Finally, sudo in OpenBSD's base system is moving to ports soon, and the article briefly describes a new tool that may or may not replace it, called "doas"
There's also a nice wrap-up of all the examples at the end, and the "Pruning and Polishing" talk is good complementary reading material ***

SMP steroids for PF

An Oracle employee that's been porting OpenBSD's PF to an upcoming Solaris release has sent in an interesting patch for review
Attached to the mail was what may be the beginnings of making native PF SMP-aware
Before you start partying, the road to SMP (specifically, giant lock removal) is a long and very complicated one, requiring every relevant bit of the stack to be written with it in mind - this is just one piece of the puzzle
The initial response has been quite positive though, with some back and forth between developers and the submitter
For now, let's be patient and see what happens ***

DragonFly 4.2.0 released

DragonFlyBSD has released the next big update of their 4.x branch, complete with a decent amount of new features and fixes
i915 and Radeon graphics have been updated, and DragonFly can claim the title of first BSD with Broadwell support in a release
Sendmail in the base system has been replaced with their homegrown DragonFly Mail Agent, and there's a wiki page about configuring it
They've also switched the default compiler to GCC 5, though why they've gone in that direction instead of embracing Clang is a mystery
The announcement page also contains a list of kernel changes, details on the audio and graphics updates, removal of the SCTP protocol, improvements to the temperature sensors, various userland utility fixes and a list of updates to third party tools
Work is continuing on the second generation HAMMER filesystem, and Matt Dillon provides a status update in the release announcement
There was also some hacker news discussion you can check out, as well as upgrade instructions ***

OpenSMTPD 5.7.1 released

The OpenSMTPD guys have just released version 5.7.1, a major milestone version that we mentioned recently
Crypto-related bits have been vastly improved: the RSA engine is now privilege-separated, TLS errors are handled more gracefully, ciphers and curve preferences can now be specified, the PKI interface has been reworked to allow custom CAs, SNI and certificate verification have been simplified and the DH parameters are now 2048 bit by default
The long-awaited filter API is now enabled by default, though still considered slightly experimental
Documentation has been improved quite a bit, with more examples and common use cases (as well as exotic ones)
Many more small additions and bugfixes were made, so check the changelog for the full list
Starting with 5.7.1, releases are now cryptographically signed to ensure integrity
This release has gone through some major stress testing to ensure stability - Gilles regularly asks their Twitter followers to flood a test server with thousands of emails per second, even offering prizes to whoever can DDoS them the hardest
OpenSMTPD runs on all the BSDs of course, and seems to be getting pretty popular lately
Let's all encourage Kris to stop procrastinating on switching from Postfix ***

Interview - Jun Ebihara (蛯原純) - jun@netbsd.org / @ebijun

Lesser-known CPU architectures, embedded NetBSD devices

News Roundup

FreeBSD foundation at BSDCan

The FreeBSD foundation has posted a few BSDCan summaries on their blog
The first, from Steven Douglas, begins with a sentiment a lot of us can probably identify with: "Where I live, there are only a handful of people that even know what BSD is, let alone can talk at a high level about it. That was one of my favorite things, being around like minded people."
He got to meet a lot of the people working on big-name projects, and enjoyed being able to ask them questions so easily
Their second trip report is from Ahmed Kamal, who flew in all the way from Egypt
A bit starstruck, he seems to have enjoyed all the talks, particularly Andrew Tanenbaum's about MINIX and NetBSD
There are also two more wrap-ups from Zbigniew Bodek and Vsevolod Stakhov, so you've got plenty to read ***

OpenBSD from a veteran Linux user perspective

In a new series of blog posts, a self-proclaimed veteran Linux user is giving OpenBSD a try for the first time
"For the first time I installed a BSD box on a machine I control. The experience has been eye-opening, especially since I consider myself an 'old-school' Linux admin, and I've felt out of place with the latest changes on the system administration."
The post is a collection of his thoughts about what's different between Linux and BSD, what surprised him as a beginner - admittedly, a lot of his knowledge carried over, and there were just minor differences in command flags
One of the things that surprised him (in a positive way) was the documentation: "OpenBSD's man pages are so nice that RTFMing somebody on the internet is not condescending but selfless."
He also goes through some of the basics, installing and updating software, following different branches
It concludes with "If you like UNIX, it will open your eyes to the fact that there is more than one way to do things, and that system administration can still be simple while modern." ***

FreeBSD on the desktop, am I crazy

Similar to the previous article, the guy that wrote the SSH two factor authentication post we covered last week has another new article up - this time about FreeBSD on the desktop
He begins with a bit of forewarning for potential Linux switchers: "It certainly wasn't an easy journey, and I'm tempted to say do not try this at home to anybody who isn't going to leverage any of FreeBSD's strong points. Definitely don't try FreeBSD on the desktop if you haven't used it on servers or virtual machines before. It's got less in common with Linux than you might think."
With that out of the way, the list of positives is pretty large: a tidy base system, separation between base and ports, having the option to choose binary packages or ports, ZFS, jails, licensing and of course the lack of systemd
The rest of the post talks about some of the hurdles he had to overcome, namely with graphics and the infamous Adobe Flash
Also worth noting is that he found jails to be not only good for isolating daemons on a server, but pretty useful for desktop applications as well
In the end, he says it was worth all the trouble, and is even planning on converting his laptop to FreeBSD soon too ***

OpenIKED and Cisco CSR 1000v IPSEC

This article covers setting up a site-to-site IPSEC tunnel between a Cisco CSR 1000v router and an OpenBSD gateway running OpenIKED
What kind of networking blog post would be complete without a diagram where the internet is represented by a big cloud
There are lots of details (and example configuration files) for using IKEv2 and OpenBSD's built-in IKE daemon
It also goes to show that the BSDs generally play well with existing network infrastructure, so if you were a business that's afraid to try them… don't be ***

HardenedBSD improves stack randomization

The HardenedBSD guys have improved their FreeBSD ASLR patchset, specifically in the stack randomization area
In their initial implementation, the stack randomization was a random gap - this update makes the base address randomized as well
They're now stacking the new on top of the old as well, with the goal being even more entropy
This change triggered an ABI and API incompatibility, so their major version has been bumped ***

OpenSSH 6.9 released

The OpenSSH team has announced the release of a new version which, following their tick/tock major/minor release cycle, is focused mainly on bug fixes
There are a couple new things though - the "AuthorizedKeysCommand" config option now takes custom arguments
One very notable change is that the default cipher has changed as of this release
The traditional pairing of AES128 in counter mode with MD5 HMAC has been replaced by the ever-trendy ChaCha20-Poly1305 combo
Their next release, 7.0, is set to get rid a number of legacy items: PermitRootLogin will be switched to "no" by default, SSHv1 support will be totally disabled, the 1024bit diffie-hellman-group1-sha1 KEX will be disabled, old ssh-dss and v00 certs will be removed, a number of weak ciphers will be disabled by default (including all CBC ones) and RSA keys will be refused if they're under 1024 bits
Many small bugs fixes and improvements were also made, so check the announcement for everything else
The native version is in OpenBSD -current, and an update to the portable version should be hitting a ports or pkgsrc tree near you soon ***

Feedback/Questions

87: On the List

JT Pennington — Wed, 29 Apr 2015 08:00:00 -0400

Coming up this time on the show, we'll be speaking with Christos Zoulas, a NetBSD security officer. He's got a new project called blacklistd, with some interesting possibilities for stopping bruteforce attacks. We've also got answers to your emails and all this week's news, on BSD Now - the place to B.. SD.

This episode was brought to you by

Headlines

New PAE support in OpenBSD

OpenBSD has just added Physical Address Extention support to the i386 architecture, but it's probably not what you'd think of when you hear the term
In most operating systems, PAE's main advantage is to partially circumvent the 4GB memory limit on 32 bit platforms - this version isn't for that
Instead, this change specifically allows the system to use the No-eXecute Bit of the processor for the userland, further hardening the in-place memory protections
Other operating systems enable the CPU feature without doing anything to the page table entries, so they do get the available memory expansion, but don't get the potential security benefit
As we discussed in a previous episode, the AMD64 platform already saw some major W^X kernel and userland improvements - the i386 kernel reworking will begin shortly
Not all CPUs support this feature, but, if yours supports NX, this will improve upon the previous version of W^X that was already there
The AMD64 improvements will be in 5.7, due out in just a couple days as of when we're recording this, but the i386 improvements will likely be in 5.8 ***

Booting Windows in bhyve

Work on FreeBSD's bhyve continues, and a big addition is on the way
Thus far, bhyve has only been able to boot operating systems with a serial console - no VGA, no graphics, no Windows
This is finally changing, and a teasing screenshot of Windows Server was recently posted on Twitter
Graphics emulation is still in the works; this image was taken by booting headless and using RDP
A lot of the needed code is being committed to -CURRENT now, but the UEFI portion of it requires a bit more development (and the aim for that is around the time of BSDCan)
Not a lot of details on the matter currently, but we'll be sure to bring you more info as it comes out
Are you more interested in bhyve or Xen on FreeBSD? Email us your thoughts ***

MidnightBSD 0.6 released

MidnightBSD is a smaller project we've not covered a lot on the show before
It's an operating system that was forked from FreeBSD back in the 6.1 days, and their focus seems to be on ease-of-use
They also have their own, smaller version of FreeBSD ports, called "mports"
If you're already using it, this new version is mainly a security and bugfix release
It syncs up with the most recent FreeBSD security patches and gets a lot of their ports closer to the latest versions
You can check their site for more information about the project
We're trying to get the lead developer to come on for an interview, but haven't heard anything back yet ***

OpenBSD rewrites the file utility

We're all probably familiar with the traditional file command - it's been around since the 1970s
For anyone who doesn't know, it's used to determine what type of file something actually is
This tool doesn't see a lot of development these days, and it's had its share of security issues as well
Some of those security issues remain unfixed in various BSDs even today, despite being publicly known for a while
It's not uncommon for people to run file on random things they download from the internet, maybe even as root, and some of the previous bugs have allowed file to overwrite other files or execute code as the user running it
When you think about it, file was technically designed to be used on untrusted files
OpenBSD developer Nicholas Marriott, who also happens to be the author of tmux, decided it was time to do a complete rewrite - this time with modern coding practices and the usual OpenBSD scrutiny
This new version will, by default, run as an unprivileged user with no shell, and in a systrace sandbox, strictly limiting what system calls can be made
With these two things combined, it should drastically reduce the damage a malicious file could potentially do
Ian Darwin, the original author of the utility, saw the commit and replied, in what may be a moment in BSD history to remember
It'll be interesting to see if the other BSDs, OS X, Linux or other UNIXes consider adopting this implementation in the future - someone's already thrown together an unofficial portable version
Coincidentally, the lead developer and current maintainer of file just happens to be our guest today… ***

Interview - Christos Zoulas - christos@netbsd.org

blacklistd and NetBSD advocacy

News Roundup

GSoC-accepted BSD projects

The Google Summer of Code people have published a list of all the projects that got accepted this year, and both FreeBSD and OpenBSD are on that list
FreeBSD's list includes: NE2000 device model in userspace for bhyve, updating Ficl in the bootloader, type-aware kernel virtual memory access for utilities, JIT compilation for firewalls, test cluster automation, Linux packages for pkgng, an mtree parsing and manipulation library, porting bhyve to ARM-based platforms, CD-ROM emulation in CTL, libc security extensions, gptzfsboot support for dynamically discovering BEs during startup, CubieBoard support, a bhyve version of the netmap virtual passthrough for VMs, PXE support for FreeBSD guests in bhyve and finally.. memory compression and deduplication
OpenBSD's list includes: asynchronous USB transfer submission from userland, ARM SD/MMC & controller driver in libsa, improving USB userland tools and ioctl, automating module porting, implementing a KMS driver to the kernel and, wait for it... porting HAMMER FS to OpenBSD
We'll be sure to keep you up to date on developments from both projects
Hopefully the other BSDs will make the cut too next year ***

FreeBSD on the Gumstix Duovero

If you're not familiar with the Gumstix Duovero, it's an dual core ARM-based computer-on-module
They actually look more like a stick of RAM than a mini-computer
This article shows you how to build a FreeBSD -CURRENT image to run on them, using crochet-freebsd
If anyone has any interesting devices like this that they use BSD on, write up something about it and send it to us ***

EU study recommends OpenBSD

A recent study by the European Parliament was published, explaining that more funding should go into critical open source projects and tools
This is especially important, in all countries, after the mass surveillance documents came out
"[...] the use of open source computer operating systems and applications reduces the risk of privacy intrusion by mass surveillance. Open source software is not error free, or less prone to errors than proprietary software, the experts write. But proprietary software does not allow constant inspection and scrutiny by a large community of experts."
The report goes on to mention users becoming more and more security and privacy-aware, installing additional software to help protect themselves and their traffic from being spied on
Alongside Qubes, a Linux distro focused on containment and isolation, OpenBSD got a special mention: "Proactive security and cryptography are two of the features highlighted in the product together with portability, standardisation and correctness. Its built-in cryptography and packet filter make OpenBSD suitable for use in the security industry, for example on firewalls, intrusion-detection systems and VPN gateways"
Reddit, Undeadly and Hacker News also had some discussion, particularly about corporations giving back to the BSDs that they make use of in their infrastructure - something we've discussed with Voxer and M:Tier before ***

FreeBSD workflow with Git

If you're interested in contributing to FreeBSD, but aren't a big fan of SVN, they have a Github mirror too
This mailing list post talks about interacting between the official source repository and the Git mirror
This makes it easy to get pull requests merged into the official tree, and encourages more developers to get involved ***