26/09/14

⇒ The Firewall I Never Had to Relearn

A complete home router in twenty-three lines, in a grammar I learned once and have been writing for twenty years. The bill for that arrangement has never arrived. Unix Universe.

• https://vivianvoss.net/blog/pf-twenty-years

26/09/15

⇒ What Was Already Watching

The standard answer to brute force costs a hundred megabytes of interpreter and twenty-seven regular expressions, to work out something the daemon already knew. There are three other answers, and two of them were running before I installed anything. The Bench Marker.

• https://vivianvoss.net/blog/blacklistd-vs-fail2ban

26/09/08

⇒ *Overview of AOOSTAR WTR Pro on BSD

Finding a NAS that provides NVMe and SATA storage while being tiny enough to sit in my 10" rack, have a CPU that’s not hogging, use a small amount of watts and offers usage of a non-proprietary OS is not simple. Especially when you have the “must run any BSD” to the equation.

• https://www.tumfatig.net/2026/overview-of-aoostar-wtr-pro-on-bsd/

26/09/29

⇒ Installing Ubuntu 26.04 Server in an OpenBSD vmm(4) VM

I wanted to run Ubuntu 26.04 Server inside an OpenBSD vmm(4) guest. OpenBSD’s VM console is serial only, and the Ubuntu Server ISO does not boot correctly on a serial console out of the box. This post shows how to rebuild the Ubuntu ISO with the right kernel and GRUB options so it installs cleanly through vmctl console.

• https://rsadowski.de/posts/2026/vmm-ubuntu26-setup/

26/09/28

⇒ GhostBSD is Replacing MATE With a New Desktop Named After a Typo

Eric Turgeon has shown off a new desktop environment that would ship with custom components in GhostBSD.

• https://itsfoss.com/news/ghostbsd-new-desktop/
• https://github.com/mocka-desktop/mocka-dock

@CiotBSD said:

… my newsletters… …

Thanks. I'm curious, are some of those news items aggregated from another area in which you post?

framapiaf.org, maybe?

⇒ FreeBSD Resource Monitoring, Accounting, and Troubleshooting

“The server feels slow.” It is the most common ticket text in the world, and the least useful. Before you can fix anything you need to know whether the box is CPU bound, memory pressured, waiting on disk, saturating a NIC, or simply running a runaway process in one jail that is starving everyone else. On jail hosts, the second half of the problem is attribution: not just what is overloaded, but which jail is responsible…

• https://blog.hofstede.it/freebsd-resource-monitoring-accounting-and-troubleshooting/

ping: https://framapiaf.org/@Larvitz@burningboard.net/116560508989633469

07/01

⇒ Running Garage in a FreeBSD Jail

My work at $DAYJOB that involves a lot of work with data pipeline these days. Particularly the design of new and better ones, which help us serve users with better data (more advanced processing, better cartographic decisions, etc.).

• https://ianwwagner.com//running-garage-in-a-freebsd-jail.html

Call to undefined function filter_var() on FreeBSD

• https://www.rubenerd.au/call-to-undefined-function-filter-var/

26/09/18

⇒ NetBSD on my Netbook

I wanted to try something new and different. I'm running Linux for over 25 years now (and almost 20 years exclusively Linux on my PCs at home), my servers are on OpenBSD for almost ten years, and I had toyed with FreeBSD every now and then. And then there's the distant past with DOS, OS/2, and Windows, of course.

• https://movq.de/blog/postings/2026-09-18/0/POSTING-en.html

26/07/11

⇒ Jails, Not Containers: FreeBSD Isolation Done Right

Containers play a major role in modern infrastructure, but they are not the right answer for every workload. This article explores how FreeBSD jails provide purpose-built isolation, predictable security boundaries, and deep ZFS integration—making them ideal infrastructure-grade services where stability is essential.

• https://klarasystems.com/articles/jails-not-containers-freebsd-isolation-done-right/

=> 662: I need a hero

Cybersecurity Looks Like Proof of Work Now, Compensating for RAM Constraints with L2ARC on ZFS, GhostBSD 26.1, and more...

• https://www.bsdnow.tv/662

Hi,

I've followed https://community.torproject.org/relay/setup/bridge/freebsd/ to install a bridge ( I've run bridges and relays before) on 15.1 aarch64, because my rpi4 was collecting some dust.
I've added ports redirections on my router and the logs indicates that my bridge is seeing traffic :

Sep 20 01:48:32.000 [notice] We now have enough directory information to build circuits.
Sep 20 07:05:46.000 [notice] Heartbeat: Tor's uptime is 1 day 0:00 hours, with 0 circuits open. I've sent 9.21 MB and received 35.22 MB. I've received 204 connections on IPv4 and 0 on IPv6. I've made 49 connections with IPv4 and 0 with IPv6.
Sep 20 07:05:46.000 [notice] While bootstrapping, fetched this many bytes: 14735 (consensus network-status fetch)
Sep 20 07:05:46.000 [notice] While not bootstrapping, fetched this many bytes: 25384721 (server descriptor fetch); 1511 (server descriptor upload); 1262831 (consensus network-status fetch); 186458 (microdescriptor fetch)
Sep 20 07:05:46.000 [notice] Heartbeat: Since last heartbeat message, I have seen 32 unique clients.

But tor metrics is seeing my bridge as red (unhealthy offline). This prompted me to check /var/log/messages and to stumble uppon this line

rpi4 kernel: Limiting tcp reset response from 1663 to 194 packets/sec

My search foo being what it is I'm not fiding anything related to this error, so trying my luck here before going to the FreeBSD forums.

Anyone knows what this is? Anyone knows how to 'fix' this?

Tia
Ludo

#freebsd #kernel #network #tor

⇒ NetBSD Foundation 2026 Annual General Meeting: Board, Core, and Team Reports

The NetBSD Foundation’s 2026 AGM covers progress on NetBSD 11.0 (now at RC5), the CVS-to-Git/Mercurial migration, and infrastructure challenges like LLM scraping and hardware aging. Highlights include five Google Summer of Code projects, CNA onboarding for security advisories, and plans to streamline release cycles. The full IRC log details team updates from core, admins, releng, and security.

• https://blog.netbsd.org/tnf/entry/annual_general_meeting_2026

26/08/18

⇒ Void Linux is very dangerous for FreeBSD on my laptop

This whole thing started because of Stefano and his blog. His guide to installing Void Linux on an encrypted ZFS root with hibernation support was the thing that got me curious enough to actually try it — and, as these things go, curiosity turned into an afternoon spent repartitioning a laptop I use every day. My setup below is simpler than his (no LUKS-encrypted swap, no hibernation), because I just wanted ZFS-on-root dual-booted alongside my existing FreeBSD/GhostBSD/OpenBSD rEFInd menu, but the bones of the approach — and the credit for pointing me at zfsbootmenu in the first place — are his.

• https://vincentdelft.be/post/post_20260918

26/09/18

⇒ Website Migration To OpenBSD!

I had an issue with my previous webserver running Arch Linux where my SSH private key suddenly disappeared from the machine. I'm not sure whether it was due to the OpenSSH update from the prior day or a hack, but I wasn't too keen to find out. The main issue I had with running Arch Linux as a webserver was surrounding the replacement of cron with systemd timer files which I found really annoying to use. I personally don't get why the developers chose to replace a solid well-known tool that is simple to use with a tool that has so much complexity to it.

• https://tech-idea.systems/blog-posts/webserver-migration.html

⇒ Automatic expiry at timeout for pf(4) overload tables

Network-oriented readers will be familiar with the concept of overload tables, commonly used with state tracking options to create adaptive rulesets for such things as punishing password-guessing botnets.

A downside to tables that would tend to fill up indefinitely is that at some point they will be quite full, and the administrator would need to either manually run pfctl expire or set up a crontab entry to weed out old entries at intervals.

• https://undeadly.org/cgi?action=article;sid=20260513064948
• https://marc.info/?l=openbsd-tech&m=177846164902091&w=2

ping: https://framapiaf.org/@openbsdjournal@mastodon.social/116565993077076112

FreeBSD becoming NIST FIPS 140-3 compliant

A key component for FreeBSD becoming NIST FIPS 140-3 compliant was completed when FreeBSD upgraded from OpenSSL 3.0 to 3.5. One of the other requirements for FIPS 140-3 (and post-quantum cryptography) is having sufficient random entropy in the system to generate sufficiently random numbers. NIST SP800-90B provides some guidelines on how to achieve that…

• https://lists.freebsd.org/archives/freebsd-hackers/2026-April/006201.html

PS: This strikes me as a significant development, which is why I am posting it here

Gershwin is a desktop environment based on GNUstep with a not unfamiliar feel for Apple users. In this video they are installing Gershwin on a Mate GhostBSD install, and looking at a FreeBSD Live USB demo install.

• https://www.youtube.com/watch?v=oixYFTC-jI4

⇒ bhyve Prometheus exporter for Sylve on FreeBSD

This post describes how to export metrics from bhyve based virtual machines and Jails managed by Sylve on FreeBSD by my Prometheus exporter. The focus is on collecting reliable data from the host system without relying on tooling that was primarily designed for Linux hypervisors or assumes the existence of hypervisor level counters.

• https://gyptazy.com/blog/bhyve-sylve-freebsd-prometheus-metric-exporter/

26/09/13

⇒ Tunnelling SSH over WireGuard on OpenBSD

Making your access logs cleaner by restricting who can connect to your VPS

• https://nemin.hu/wireguard-ssh/index.html