This week, we'll be talking to Henning Brauer about OpenNTPD and its recently revived portable version. After that, we'll be discussing different ways to securely tunnel your traffic: specifically OpenVPN, IPSEC, SSH and Tor. All that and the latest news, coming up on BSD Now - the place to B.. SD.
This episode was brought to you by
Headlines
- Peter Wemm wrote in to the FreeBSD -CURRENT mailing list with an interesting observation
- Running the latest development code in the infrastructure, the clock would stop keeping time after 24 days of uptime
- This meant things like cron and sleep would break, TCP/IP wouldn't time out or resend packets, a lot of things would break
- A workaround until it was fixed was to reboot every 24 days, but this is BSD we're talking about - uptime is our game
- An initial proposal was adding a CFLAG to the build options which makes makes signed arithmetic wrap
- Peter disagreed and gave some background, offering a different patch to fix the issue and detect it early if it happens again
- Ultimately, the problem was traced back to an issue with a recent clang import
- It only affected -CURRENT, not -RELEASE or -STABLE, but was definitely a bizarre bug to track down
***
- There's been a recent influx of blog posts about building a BSD mail server for some reason
- In this fancy series of posts, the author sets up OpenSMTPD in its native OpenBSD home, whereas previous posts have been aimed at FreeBSD and Linux
- In addition to the usual steps, this one also covers DKIMproxy, ClamAV for scanning attachments, Dovecot for IMAP and also multiple choices of spam filtering: spamd or SpamAssassin
- It also shows you how to set up Roundcube for building a web interface, using the new in-base httpd
- That means this is more of a "complete solution" - right down to what the end users see
- The series is split up into categories so it's very easy to follow along step-by-step
***
- DragonFlyBSD, along with PCBSD and EdgeBSD, uses git as its version control system for the system source code
- In a series of posts, Matthew Dillon (the project lead) details their internal setup
- They're using vanilla git over ssh, with the developers' accounts set to git-only (no shell access)
- The maintainers of the server are the only ones with shell access available
- He also details how a cron job syncs from the master to a public box that anyone can check out code from
- It would be interesting to hear about how other BSD projects manage their master source repository
***
- ITwire, another more mainstream tech site, published a recent article about switching to PCBSD
- They interview a guy named Kris that we've never heard of before
- In the article, they touch on how easy it can potentially be for Linux users looking to switch over to the BSD side - lots of applications are exactly the same
- "With the growing adoption of systemd, dissatisfaction with Linux has reached proportions not seen in recent years, to the extent that people have started talking of switching to FreeBSD."
- If you have some friends who complain to you about systemd all the time, this might be a good article to show them
***
OpenNTPD and its portable variant
News Roundup
- We recorded that interview with Henning just a few days ago, and it looks like part of it may be outdated already
- While at the hackathon, some developers came up with an alternate way to get authenticated NTP responses
- You can now add an HTTPS URL to your ntpd.conf in addition to the time server pool
- OpenNTPD will query it (over TLS, with CA verification) and look at the date sent in the HTTPS header
- It's not intended to be a direct time source, just a constraint to keep things within reason
- If you receive regular NTP packets that are way off from the TLS packet, those will be discarded and the server(s) marked as invalid
- Henning and Theo also weigh in to give some of the backstory on the idea
- Lots more detail can be found in Reyk's email explaining the new feature (and it's optional of course)
***
- It's been a while since we've featured one of these trip reports, but the Japanese NetBSD users group is still doing them
- This time the conferences were in Oita and Hamanako, Japan
- Machines running NetBSD included the CubieBoard2 Allwinner A20, Raspberry Pi and Banana Pi, Sharp NetWalker and a couple Zaurus devices
- As always, they took lots of pictures from the event of NetBSD on all these weird machines
***
- A common question we get about our poudriere tutorial is "how do I run it in a jail?" - this blog post is about exactly that
- It takes you through the networking setup, zpool setup, nginx setup, making the jail and finally poking the right holes in the jail to allow poudriere to work its magic
***
- We've mentioned a few different ways to stop ssh bruteforce attempts in the past: fail2ban, denyhosts, or even just with pf's built-in rate limiting
- Bruteblock is a similar tool, but it's not just for ssh logins - it can do a number of other services
- It can also work directly with IPFW, which is a plus if you're using that as your firewall
- Add a few lines to your syslog.conf and bruteblock will get executed automatically
- The rest of the article takes you through the different settings you can configure for blocking
***
- The OpenBSD guys recently imported a new "iwm" driver for newer Intel 7260 wireless cards (commonly found in Thinkpads)
- NetBSD wasted no time in porting it over, giving a bit of interesting backstory
- According to Antti Kantee, "it was created for OpenBSD by writing and porting a NetBSD driver which was developed in a rump kernel in Linux userspace"
- Both projects would appreciate further testing if you have the hardware and can provide useful bug reports
- Maybe FreeBSD and DragonFly will port it over too, or come up with something that's partially based on the code
***
- The first PCBSD -CURRENT images should be available this weekend
- This image will be tagged 11.0-CURRENTFEB2015, with planned monthly updates
- For the more adventurous this will allow testing both FreeBSD and PCBSD bleeding edge
***
Feedback/Questions
Mailing List Gold
Discussion
Comparison of ways to securely tunnel your traffic
