Lots of security content: July 2013 BSD Magazine

Yes, you have to give them your e-mail address. And yes, like many publications, there are a bunch of advertisements. Every once in a while, BSDMag covers a lot of security-related topics, and this is one of those. Click below to get the latest issue.

 

Flexible operating systems

A while ago, John from TAOSSA mentioned something under his breath (or as much as one can do so with a keyboard) about Gentoo Linux. I replied with the fact that I learned the (very) hard way that if you think you want to play with Gentoo, you actually want to play with Arch Linux.

Gentoo is flexible -- perhaps maybe a bit too much so for most people. And it requires a lot of setup. Arch starts small, but it's not minimalist. There's a specific philosophy to most distribution families. It so happens that Arch Linux' philosophy is similar to that of another OS that I love: OpenBSD.

Arch values code correctness and cleanliness over convenience. They start you out with a small but powerful core that doesn't have a GUI or many fancy apps installed, but they provide you with everything you need in order to have your ideal setup running pretty quickly. While most Linux distributions make broad-sweeping assumptions about what the end-user will want or need to do. Flexible operating systems do no such thing. They might require a little bit more work to get set up, but what you end up with will be precisely what you want, not just something that you can make work.

Also, HiR got about 3.5 seconds of fame via Mubix on Hak 5 Episode 621 (a little after the 3:00 mark). Mubix mentioned most of what he was doing with FreeBSD was shell stuff. All of the BSDs require some work to get all configured and ready to use with a GUI, they don't go too overboard on assumptions.

For example, the things I do first on both ArchLinux and OpenBSD:

• Set up package repositories. In OpenBSD, set PKG_PATH to the URL of a package mirror. In Arch, un-comment some lines in /etc/pacman.d/mirrorlist
• Install sudo and give the %wheel group sudo access.
• Create a user-level account, place it in the wheel group.
• Log off, log on with my user-level account
• Start adding packages and setting things up!

It's up to you to figure out what packages you want. X.org, a window manager, web browser, IM client, a word processor, and your favorite CLI tools are probably the first things you'll want to set up. Or maybe you just want an AMP web server. Flexible OSes do both of these things well and without much fanfare. Truly, you make your own distribution with every install.

Arch Linux is interesting in that there is no "release" schedule. You just perform "pacman -Syu" to upgrade all the packages to the latest stable version. Upgrading OpenBSD can be a bit more of a pain, so I genuinely like how Arch handles it.

Minimalist distributions (DSL, TinyCore and Puppy Linux come to mind) still make too many assumptions. Although they're tuned for systems that have limited resources and they can be tweaked and expanded quite a bit, you may find that the partitions aren't configured the way you want, that the organizer included applications that you don't need, or worse: they compete with the applications you'd rather be using.

Guest Post: Setting up a Pfsense firewall

This is a guest post by BIOSshadow. You can follow him on Twitter and at his blog, Geek Crack.

Pfsense is a free, as in speech and beer, firewall for home, business, and any other purpose you can think of. It's based on FreeBSD, so it's very stable and has a very good TCP/IP stack. It has a serious feature list.

I have to explain how little PfSense needs in the hardware department. My setup is an old desktop computer that a client gave me because it "went bad." The power supply unit blew out during a lightning storm in the middle of the night. Anyway, it's a single core Intel processor, I am not sure what speed, with 512 MB of RAM, and a 40 GB hard drive. Now the only reason I have 40 gig is because it was easier to keep in there than fight the case, and put in a 10 gig I had around. So any basic computer you have around will work. But as with any computer, the more memory the better. I will get into that later.

You will need a video card/monitor and keyboard and of course a Pfsense CD. USB keyboard will work, a PS/2 won't need to load extra drivers. After the install and a little configuring is done, you can remove the video card/monitor and the keyboard, you can do everything through the web panel or SSH connection, if you turn it on.

Now onto the setup. (Note: For the screenshots I am using VirtualBox. This for the screenshots only). When it boots up to the bootloader, you want to boot with default, either by waiting for the timer to run out or by hitting enter.



Now if you have two NICs, which I recommend, you do not need to setup VLANs, but you can. If you only have one NIC, you need to setup at least two VLANs.


Now this is one of the great things about Pfsense that I can't find anywhere else: You unplug the ethernet cables, and it askes you to plug in the LAN cable into the LAN NIC. Then it does the same for the WAN cable and NIC. Now if you want to setup a DMZ with third NIC this where it do it.



Pfsense will ask you if you want to proceed and then build the config files and startup all the daemons, like the Web Panel and others. Congrats! You have running Pfsense firewall, but everything is in memory and running from the CD. If you want run it like this then you are set, but if the power goes out you will have to set it up again using a backup config file or from scratch. If you want to install to a hard drive you will need to type "99" and hit enter to continue.


The hard drive installation is menu-driven and easy to use. If you are having issues, feel free to edit the setting and accept when done.


Select "Install PfSense" and select the hard drive you want to use. Format the disk and select "use this Geometry".








If you are lucky enough to have a muilti-processor system or are using a embedded system, select those options. Now remember this is "muilti processor" not "muilti-core processor".


Now Pfsense is installed and ready to go. Just restart it and remove the disc.


After the reboot, we will need to setup local IPs and their ranges. Unless, of course, you have a separate DHCP server, then set it up to connect to the server.


The IP settings are all up to you, I used a normal home setup for the sanity of my family (networked printers, NAS, and etc.) just remember the IP you give Pfsense, because you will need it to access the Web Panel.










Now you are all set up. You can unplug the monitor and keyboard, and other stuff were using for set up.


Now back on your computer, open up a browser and go to the IP of Pfsense. The default username is "admin" and the default password is "pfsense".


Of course, you want to change the password and if you want, you can change the username as well. To do so on the red navigation bar at the top, hover over system and click on General.


To enable SSH, which I recommend, you need to go the the Advanced section of the System Menu.


If your ISP is like mine, your MAC address is tied to the account and if you use it, you don't get access to the Internet. To edit it Go to Interfaces and then WAN.



Now you have working Pfsense firewall, have fun!


There are a few things Pfsense lacks, like a Squid proxy and A/V scanner. But it makes it up with its packages. It has quite a few packages, but remember: the more packages, processes and packets it handles, the more memory it uses and the lag increases. But they have packages for Snort, Squid, SquidGuard, and an A/V scanner.






Well there it is: a completely setup and configured Pfsense, with A/V scanning, proxy and traffic monitor.

VirtualBox: full-screen resolution for OpenBSD (FreeBSD?)

One thing I love about VirtualBox is the Guest Additions package, for Windows and Linux guests. It allows you to resize the window and get an instant resolution change to go along with it. When you start playing with some of the more obscure OSes, though, there's no guest additions. This includes OpenBSD.

To get OpenBSD's guest to run X at full-tilt, I had to do some hacking and tinkering. First, I had to set a custom video mode in VirtualBox. Use the VBoxManage utility on the host platform (VBoxManage.exe on Windows, VBoxManage on Linux, /Applications/VirtualBox.app/Contents/MacOS/VBoxManage on OS X) and do the following where [VM-name] is the name of the VM and [WxHxBPP] is the resolution and bit-per-pixel you're running your host OS at, such as 1280x800x16. In my case, my MacBook's native resolution is 1280x800 and I really don't mind running X.org at 16bpp for a guest OS.

VBoxManage setextradata [VM-name] CustomVideoMode1 [WxHxBPP]

Next, boot OpenBSD or FreeBSD in the VM and use the block of text below as your /etc/X11/xorg.conf file. Backup your existing one if it exists. By default, OpenBSD 4.6 doesn't ship with an xorg.conf file, just using the default config. Be sure to modify the Depth, DefaultDepth and Modes toward the end of the configuration file to match the resolution and BPP you set with VBoxManage. As this will be the only resolution and depth in the configuration file, it should be forced to use this mode if it's supported.

Section "ServerLayout"
 Identifier     "X.org Configured"
 Screen      0  "Screen0" 0 0
 InputDevice    "Mouse0" "CorePointer"
 InputDevice    "Keyboard0" "CoreKeyboard"
EndSection

Section "Files"
 ModulePath   "/usr/X11R6/lib/modules"
 FontPath     "/usr/X11R6/lib/X11/fonts/misc/"
 FontPath     "/usr/X11R6/lib/X11/fonts/TTF/"
 FontPath     "/usr/X11R6/lib/X11/fonts/OTF"
 FontPath     "/usr/X11R6/lib/X11/fonts/Type1/"
 FontPath     "/usr/X11R6/lib/X11/fonts/100dpi/"
 FontPath     "/usr/X11R6/lib/X11/fonts/75dpi/"
EndSection

Section "Module"
 Load  "dbe"
 Load  "dri"
 Load  "extmod"
 Load  "glx"
 Load  "freetype"
EndSection

Section "InputDevice"
 Identifier  "Keyboard0"
 Driver      "kbd"
EndSection

Section "InputDevice"
 Identifier  "Mouse0"
 Driver      "mouse"
 Option     "Protocol" "wsmouse"
 Option     "Device" "/dev/wsmouse"
 Option     "ZAxisMapping" "4 5 6 7"
EndSection

Section "Monitor"
 Identifier   "Monitor0"
 HorizSync    31-80
 VertRefresh  30-100
 VendorName   "Monitor Vendor"
 ModelName    "Monitor Model"
EndSection

Section "Device"
 Identifier  "Card0"
 Driver      "vesa"
 VendorName  "InnoTek"
 BoardName   "VirtualBox Graphics Adapter"
 BusID       "PCI:0:2:0"
EndSection

Section "Screen"
 DefaultDepth  16
 Identifier "Screen0"
 Device     "Card0"
 Monitor    "Monitor0"
 SubSection "Display"
  Viewport   0 0
  Depth     16
  Modes     "1280x800"
 EndSubSection
EndSection

When you launch startx, you should get full screen resolution in a huge window, but may need to use the [HostKey]-F key combo to switch to full-screen mode.

Enjoy!

Holy War: BSD Vs. Linux

Ah, holy wars. vi vs. emacs. Mac vs. Windows. Marmite vs. starving to death. Who doesn't love a good, old-fashioned battle royale? Today, we're pitting BSD vs. Linux.

Background
Whilst in college, I was living in a bachelor pad with two other hackers. I'd been running Red Hat Linux 5.2 on my new PC for a few months when one of my roomies introduced me to FreeBSD 2.2.8. This single event sparked my love for BSD in general. Later, I'd come to really settle on OpenBSD. Over the last 15 years, I've written quite a bit about various operating systems including the BSDs. I by no means hate Linux. I still have to use it for some things. I simply have my gripes about it.

Leading up to the release of OpenBSD 4.5, I got in a few debates -- holy wars, kind of.

Wednesday, I got into a Linux/BSD debate with Mubix.

Then Ben, the instigator that he is, brought up a decent point in the public info-sec fora that is Twitter:
"... Why should I try [OpenBSD]? What advantages does it have over Linux?"

I, always ready to inject semantics to prove a point, started with the obvious: Linux is a kernel, not an operating system. I also quickly pointed out that Holy Wars are hard to do on Twitter. So here I am. Ben really wanted a comparison of OpenBSD vs. his current solution of Debian Linux.

Really, though, semantics have a lot to do with it. Linux is not a complete operating system.

Lineage of Linux
The Linux kernel itself is maintained by a core of kernel developers. Almost all Linux distributions come with the GNU system -- the so-called "userland environment" -- which was itself designed to replace the proprietary UNIX userland in the 1980s. The GNU system and the Linux kernel are developed independently of one another. In fact, Linus Torvalds was completing work on the Linux Kernel around the same time as The Free Software Foundation was putting the finishing touches on GNU. With these two free software components combined, a truly free operating system could be rolled out. This is, of course, why The Free Software Foundation prefers that people use "GNU/Linux" when talking about Linux as an operating system, rather than simply Linux as a kernel. Debian led the charge in adopting the GNU/Linux name.

This was all unfolding in the early 1990s, with the first distributions accessible to the masses around 1992 and 1993 with the popularity of dial-up Internet in the home and CD-ROM drives and media becoming less expensive and widely used.

Linux Distributions
While GNU and Linux combined make a bare-bones operating system with just enough tools to log in and compile software, it's not enough to be useful to the average person. To that end, groups package the GNU system, the Linux kernel and sometimes up to thousands of third-party packages into distributions. These distributions are complete operating systems: many of them are somewhat secure, stable, and usable for their given purpose.

Ubuntu, one of the more popular distributions, gathers praise for being one of the easiest for non-technical people to use. It also gets criticized by many technical folks who prefer something more svelte and minimalist. Those technical folks often choose Linux distributions that fit their needs: Arch Linux, Debian, or Gentoo. Likewise, corporations often spring for enterprise-supported distributions like SUSE Linux Enterprise Server or Red Hat Enterprise Linux. There are literally hundreds of active distributions, all of which loosely fall under the Linux umbrella. I do not have time to list them all, however I've touched on some of the more popular ones.

Configuration and package management
Package management systems, configuration tools, and other details vary widely between them. A sysadmin that uses SLES at work, for example, will probably have to spend some time figuring out how things with on Arch Linux or Debian GNU/Linux. Most Linux distros use a System V-style init based on runlevels. Configuring services and daemons usually involves messing with files and subdirectories in /etc/init.d/. The automated tools to do this, however, differ between families of Linux distributions.

Popular Linux package-management systems
RedHat Package Manager (Red Hat, SUSE, Fedora)
Debian Package (Debian, Ubuntu)
PacMan (Arch, Frugalware)
BSD-Derived Ports-like systems (Arch Build System, Gentoo)

Lineage of the BSDs
Berkeley Software Distribution (BSD) started as an additional package to go with Bell Labs' Unix Version 6. By the end of 1979, 3BSD was a complete operating system (kernel and userland) designed to run on DEC VAX systems. By late 1983, BSD had implemented TCP/IP. Legal troubles surrounding copyright of the source code held back BSD's development in the early 1990s, but by 1994, a portable, free operating system (4.4BSD-Lite) existed: a kernel and userland wrought from a very mature code-base written by a comparatively small group of developers. Development of BSD at Berkeley win 1995.

A more mature and unified kernel / userland code-base, and smaller development community are two major things that separate BSD-derived operating systems from Linux distributions. All BSD operating systems still package many other open-source tools such as X.org, Apache Web Server and perl. Many of the BSDs come with some or all of the above included by default. To that end, even BSD flavors are similar to Linux Distributions in that the release team can pick and choose what gets rolled in with the base operating system.

BSD Flavors
During the legal battle encumbering official development on BSD, a team of developers ran with some existing free software from the official 4.3BSD release, 386BSD and some GNU code as well. The result was FreeBSD. FreeBSD now focuses on cutting-edge hardware support, performance and scalability. More "liberal" than the other BSDs, FreeBSD isn't vehemently against closed-source binary drivers and allowing developers to sign Non-Disclosure Agreements with hardware vendors in the name of functionality -- practices that Linux developers regularly partake in.

Around the same time, NetBSD was also underway. Today, NetBSD focuses on clean kernel code that is extremely portable and easy to compile across almost every 32-bit computing platform. If your kitchen sink had a CPU, it could probably run NetBSD.

OpenBSD forked from NetBSD shortly after NetBSD's 1.0 release, mostly due to a falling out between Theo DeRaadt and the rest of the NetBSD developers. OpenBSD's primary focus has always been on security and freedom of code. Strict code audits, re-writing open-source replacements for proprietary services, and refusal to use closed-source binary "blob" drivers or sign NDAs are some key factors.

Configuration
FreeBSD and NetBSD have a somewhat "hybrid" init for services and daemons. For the most part, "easy" system configuration tools are only found in the installation tools and scripts. Configuration is typically done by modifying human-readable files and scripts in /etc that are well-documented with comment lines. The syntax of the system tools often varies slightly from the GNU equivalents found in Linux distributions.

Package Management
Binary packages are handled nearly identically across all three major BSD platforms, which borrowed the functionality from FreeBSD.

The Ports Tree is a staple in BSD derivatives. It is a skeletal directory of patches that can automatically fetch, build, and install source code including all dependencies. NetBSD refers to this functionality as "Source packages" because it uses the term "Ports" to describe porting the entire operating system to different architectures.

In praise of Linux
No one had really heard of GNU until the Linux kernel came along. It was the last piece of a huge puzzle. That puzzle was a free operating system that beat BSD to the target market by almost 3 years. It took the Internet by storm, engaging a new wave of passionate coders. As a catalyst, Linux has probably done more for the Free and Open Source Software movement than anything else to date. It also happens to be that Linux's threading is quite efficient, and the kernel scales fabulously from old 386 computers up to bleeding-edge supercomputers. For things where symmetric multi-processing and threading matters, such as databases, Linux can be a very hard competitor to beat.

My Linux gripes
I feel like there are too many cooks in the kitchen sometimes. Updates to the kernel and GNU sources happen fast and frequently from a very, very diverse and loose pool of developers. It's both good and bad. It also seems like every budding techno-junkie has thought that it would be a good idea to learn how to craft their own Linux distribution. There are too many to be useful. Fortunately, there's a relatively small group of distributions that really matter out here in the real world. Still, one has to experience many of them in order to be what I'd consider a Linux expert. When hiring a sysadmin with 3 years of Linux experience you really don't know if they will have any idea what to do with the flavor you've got deployed, without asking. I also dislike the ominous verbiage and forced-open source of the GNU Public License under which most of Linux and all of GNU is licensed. The GPL forces you to share the source code to anything you derive from GPL-licensed work. While it sounds noble, it's actually a restriction on what you can and cannot do. The license itself is incompatable with some other popular licenses, so you may not be able to use code from two different projects if you plan on releasing the end result to the masses.

In praise of BSD
I'm an OpenBSD fanboy, but I like NetBSD and FreeBSD as well. If you've used one, you will probably be comfortable using the others. They are fast and come installed with a fairly minimal set of tools, but it's very east to install the things you want and need in order to build your system up the way you want it. I don't know anyone who's tried BSD coming from another UNIX-like operating system background and not at least liked it. The BSD license has less restrictions on what you can do with the code. While a smaller core of developers generally means the BSDs have less support than Linux for bleeding-edge hardware, I like the fact that the BSD flavors are more mindful of what is allowed into the base operating system. In the case of NetBSD and OpenBSD, I see a lot of benefits that come from a strict code auditing framework. Recently, FreeBSD has been working on scaling CPU performance, but it's taken them a long time to catch up to Linux on enterprise server class hardware.

My BSD gripes
With few exceptions, BSD is usually slow to the game for adding exciting new features and hardware support. Because of this, there are still places where the BSD kernel lacks the performance of Linux. BSD is therefore often playing catch-up with Linux on performance, while Linux is busy adding new features. The BSDs are often a pain in the ass to patch, too. And just like Linux, OpenBSD releases patches as soon as they fix a problem. They don't release binary patches, though, so you have to have a kernel and userland source tree available, manually patch and re-compile components, and move them into place. This is an arduous procedure that's arisen because of the portability of the source code. Still, I wish that official binary patches were released for popular architectures, such as x86. See: OpenBSD FAQ on Patching.

To answer Ben's original questions:
Why should I use OpenBSD?
If you are the kind of person who likes a lean environment for your desktop or servers, you will probably like any of the BSDs. I'd recommend starting with FreeBSD, or if you're a die-hard command-line commando, OpenBSD. If you're serious about security and stability, OpenBSD is a good choice. BSD isn't for everyone, and there are some things that it's simply harder to to on BSD than it is to do on Linux. Running Mozilla with Flashplayer, for example. I honestly don't miss having flash. It's an annoyance to me, most of the time. Exception: When someone sends me a really funny video on YouTube.

What advantages does it have over Linux?
I think I've made plenty of points and counterpoints regarding the technical advantages of Linux and BSD. It's difficult to compare Linux (in general) and all the BSD flavors side-by-side. So my initial comment stands: "Seriously, more geeks should give this operating system a try!" You might just like it!

OpenBSD's philosophy and ease of use are what keep me coming back. Are those advantages over Linux? No. It's about personal preference.

Operating System Junkie

I've talked about the computers in the Lab-O-Ratory before. Today, the laboratory is really, really noisy -- more so than usual. I'm always working on something and I'm coming to realize that I'm pretty much a hopeless operating system junkie.

The photo is from a few months ago. The SparcStation 20 on the top of that photo used to be my OpenBSD 4.1 DMZ box until the hard drive died. I shelved it for a while and replaced it with a fresh install of OpenBSD 4.4 on one of the noisy 1U rackmount cluster servers from the startup I worked at in early '06. That 1U now sits in the SS20's old spot on top of the Sun Ultra 5 (which happens to be one of my primary workstations, running Solaris 10)

A few weeks ago, a friend of mine gave me a pile of old SCA-80 hard drives -- 4GB, 9GB stuff that was going to get landfilled. I put some of them in the SS20 again, and decided to try NetBSD. I used this for the SSH Reverse Tunneling article. It's now on the top of the lower stack, below the FON and Jornada and on top of the beige low-profile server.

That's an IBM RS/6000 Model 250 -- 80 MHz (yes, really) with 256MB of RAM and a 36GB SCSI hard drive. Initially made to run IBM's AIX 3.x operating system, it still runs AIX 5.1 quite well as long as you keep the GUI from trying to start. After AIX 5.1, IBM dropped all support for Micro-Channel Architecture. Still, having AIX 5 to tinker with is beneficial to me. I have to deal with AIX (as well as Linux and Solaris) at my real job. Don't forget all the cool freeware that's been ported to AIX and Solaris!

The Dell PowerEdge server below it was going to be an AMP (Apache/MySQL/PHP) server for a client of mine who never ended up needing it. It gets re-purposed whenever I need a reasonably powerful machine or one with a lot of storage to test something on. I just installed FreeBSD 7 on it last night. This one's even more noisy than the 1U cluster server.

My wife bought a 4U rackmount case from Frogman back in the day, and it was originally built up as a telnet MUD server. Now, it's kind of the communal Windows 2000 test box. It's the HiR OpenArena server for the time being.

Then, there's the Dell Optiplex mini-tower out of frame that's still running BackTrack -- although after Mubix wrote about it, I plan on downloading Sumo very soon!

With so many of my own little projects going on and utilizing all these boxes, I'm currently running all of this in my apartment's second-bedroom-turned-laboratory:

• OpenBSD 4.4 / x86
• Solaris 10 / ultrasparc
• jLime Linux (Mongo) / arm
• Openwrt Linux 7.09 / mips
• NetBSD 4.0.1 / sparc
• AIX 5.1 / ppc
• FreeBSD 7.0 / x86
• Backtrack Linux 3 / x86
• Windows 2000 SP4 / x86

That's not even considering that my wife's laptop is running Vista, and I'm running Mac OS Leopard on my own. I'm no stranger to lesser-known OS's either. I've written about OpenSolaris before. I used to run BeOS as my main platform at work. I've used Plan 9 before (in the late 90s) and I even helped a little bit with the now-defunct V2OS project in 2001.

What's next? I think I need to mix it up with ReactOS (Windows clone) or Haiku (BeOS clone) or perhaps try Plan 9 again...

Sysadmin Sunday: Encrypted Swap Space in FreeBSD

New research shows that cold boot attacks can compromise encryption by giving you access to the RAM's contents. This even applies to full-disk encryption that encrypts swap space and whatnot. We'll probably talk more about that in our podcast.

Physical access almost always means that a total compromise of security is somehow possible. Sensitive data could be at risk long after the data in RAM decays into oblivion. Encryption keys, large documents, and other files containing data you don't want falling into the wrong hands will almost certainly see their fair share of time in virtual memory. That means pages of RAM will be written, for better or worse, to the hard drive.

Encrypting just your swap space can be easier than switching to full-disk encryption and makes it more difficult for an attacker to obtain sensitive data as it gets shuffled in and out of RAM.

OpenBSD encrypts swap by default without any further action. To the best of my knowledge it's alone in that fact. I can't outline how to encrypt swap space in every operating system, but since FreeBSD's the flavor-du-jour, I'll show you how easy it can be.

First, disable swap:

[axon@floaty-fbsd ~]$ sudo swapoff -a
swapoff: /dev/ad0s1b: Cannot allocate memory

Whoops! If there's too much stuff running to fit in RAM without swap, you'll need to cut back. Close your applications, stop the X Window system or whatever you have to do. Let's try that again.

[axon@floaty-fbsd ~]$ sudo swapoff -a

Now, find the swap partition and over-write it using dd(1) to stream /dev/urandom to it. It could take a while depending on the size of the swap partition. Yes, this is a paranoia countermeasure and nothing more. Keep in mind that only freshly-used parts of swap will be encrypted once we're finished. Right now, there could be (ab)usable data out there. Not for long!

[axon@floaty-fbsd ~]$ grep swap /etc/fstab
/dev/ad0s1b none swap sw 0 0
[axon@floaty-fbsd ~]$ sudo dd if=/dev/urandom of=/dev/ad0s1b
dd: /dev/ad0s1b: end of device
464657+0 records in
464656+0 records out
237903872 bytes transferred in 88.835558 secs (2678025 bytes/sec)

To enable GEOM ELI on your swap partition, edit /etc/fstab and add ".eli" to the end of the swap device.

[axon@floaty-fbsd ~]$ sudo vi /etc/fstab
change this line:
/dev/ad0s1b none swap sw 0 0
to this:
/dev/ad0s1b.eli none swap sw 0 0

You have to reboot for this to take effect. Once it comes back online, use kldstat and swapinfo to verify that the geom_eli.ko module is loaded and that the new swap device is being used.

[axon@floaty-fbsd ~]$ kldstat
Id Refs Address Size Name
1 10 0xc0400000 7b2d2c kernel
2 1 0xc0bb3000 6974 snd_ich.ko
3 2 0xc0bba000 239a8 sound.ko
4 1 0xc0bde000 5c304 acpi.ko
5 1 0xc1f19000 e000 geom_eli.ko
6 1 0xc1f27000 19000 crypto.ko
7 1 0xc1f40000 a000 zlib.ko
8 1 0xc21ec000 2000 warp_saver.ko
[axon@floaty-fbsd ~]$ swapinfo
Device 1K-blocks Used Avail Capacity
/dev/ad0s1b.eli 232328 0 232328 0%

Voila!

Homebrew geeky UNIX screen saver

For the past 7 years or so, I've been doing fun things with XScreensaver to make custom screen savers that display useful information. My favorite XScreensaver mode is Phosphor, which renders olde-school green text on your screen. By default, it just displays information about your system such as system load and host name. While that's fun and all, it's pretty boring for a desktop system.

So, I'm a weather geek. Part of the reason is because I like being outdoors, but even when I'm cowering inside on a blustery February morning, I like to know what the weather is doing. On my FreeBSD lab machine, I configured Phosphor to display the hourly National Weather Service data for my area.

Obviously, you need to download and install XScreensaver first. You can do this using whatever means you want, but on FreeBSD, it's as simple as "sudo pkg_add -r xscreensaver".

Then, I put an entry in my crontab that looks like this (all on one line, though):

7 * * * * /usr/local/bin/lynx -dump -nolist "http://www.crh.noaa.gov/product.php?site=EAX&issuedby=EAX&product=RWR&format=txt" | tail +16 | head -n 15 > ~/.wx.txt

This fetches the weather data (without a list of links and stripped of HTML) for the eastern KS/northwest MO region, grabs the lines I want, then puts it in the .wx file in my home directory. This runs 7 minutes after the hour, every hour, every day.

Of course, you could use a similar script to do an hourly scrape of the front page of your favorite news site, or run any program that will generate a text file for Phosphor on a regular basis.

Now that we have the weather data (or whatever else you want) coming to us every hour, it's time to configure xscreensaver. First, make sure "xscreensaver&" is included before the window manager starts up in your .xinitrc or .xsession file, depending on if you're using an X Display manager or just startx to launch X.

Run "xscreensaver-demo" to access the configuration screen, and set it up to use only one screen saver, choose Phospor, then tell it to read the text file ~/.wx, as shown in the screen shots below:





Notice how the display has that cheesy-yet-familiar phosphor persistent delay? I love it!





Sorry this didn't capture very much of the screensaver, I'm trying to figure out why xvidcap keeps crashing on FreeBSD.

More FreeBSD love and some fun stuff

I'm working on a fun project for HiR that involves a little bit of CAD (computer aided design/drafting) work. QCAD Community Edition is the GPL version of RibbonSoft's inexpensive QCAD software. It comes without RibbonSoft's technical support and lacks certain features that they reserve for QCAD Professional.

RibbonSoft claims that QCAD is usable right out of the gate even by people who have never used CAD before. I haven't touched CAD since I tinkered with AutoCAD Lite back in 8th grade shop class. I'd like to think I'm technically minded as well. QCAD is NOT easy to get the hang of. Maybe compared to AutoCAD or CADKey, but you can ask my wife and she'll tell you I've spent the better part of three whole days just getting my bearings straight with QCAD. I think I've got it mostly figured out now, though.

By the way, QCAD is available as a binary package or in the Ports tree for both FreeBSD 6.2 and OpenBSD 4.2. I've been using it on both platforms. FreeBSD works really well with QCAD despite my somewhat anemic workstation. My Logitech Revolution VX is a life-saver for precision CAD work. With its smooth-scrolling wheel and high-resolution laser optical tracker, it fits the bill perfectly. I'm really glad that FreeBSD and XOrg play nice with this mouse.

As for the project I'm working on, I'll just say it's mischievous and delightfully fun. I'll release the .DXF file for this project when the time comes.

FreeBSD 6.3 on the desktop - Update

This is part of an ongoing series of reviews of FreeBSD 6.3 on the desktop.  

Well, FreeBSD isn't as peppy as I originally thought.  It's no worse than any other Desktop OS would be on this kind of hardware.  AJAX-based web pages and applications are sluggish.  Heavy media  applications like VideoLAN VLC and Amarok run fine as long as they're the only things running.  I'll admit, the slowness keeps sending me back to my happy MacBook on occasion.  This might be easily resolved by building a new(er) computer from parts that aren't about 5 years old.

Yesterday, I got to spend some quality time with FreeBSD, though.   Still enamored with the simplicity of Free's package management, I got gtkam to work quickly and easily to get some photos off of my Canon PowerShot A540 with ease.  That surprised me quite a bit, but gtkam is definitely no replacement for my beloved iPhoto.  FreeBSD had some trouble with one of my SD card readers, but I managed to get it worked out by making sure the card was inserted before attaching the reader.  

I had to build VLC from source via the ports tree, and that took several hours but worked without any problems.  Amarok is a slick audio player, almost as nifty as iTunes or Windows Media Player for my MP3 collection.  It's just terribly bloated.  

I'm also disappointed that secure shell isn't enabled by default.  I needed to get some data from this machine earlier today, and was unable to reach it.  It's alive, but SSHd isn't up and running.  I guess I'm all for leaving as many services disabled as possible, but even OpenBSD asks if you want to enable SSH during the installation.  That's not so much a gripe about FreeBSD on the desktop as it is about its network services out of the box, though.

I'm pleased, but I wish I had a little better machine to throw at the project.  My relatively powerful notebook has spoiled me.

FreeBSD 6.3 - Initial Impact

So, I've been playing with FreeBSD 6.3 for a few days and there are certainly some good things, and definitely some bad things. All in all, though, I like what I've seen. A few days isn't long enough to really get a feel for an operating system on the desktop, so this is the first in a series of reviews I'll be giving FreeBSD 6.3 as I shoe-horn it into my daily life as my main desktop operating system at home. Keep in mind that while I'm on the go, I'm dealing exclusively with Mac OS X on my MacBook, and OpenBSD 4.2 within Parallels when the task at hand calls for something more serious than what OS X can deliver.

The Good:

• The package management woes I had with 5.0 are completely gone. pkg_add -r [package-name] (ex: bash, firefox, windowmaker, nmap, etc) just works right out of the box. The problem I was having before was that they had converted to bzipped packages (.tbz) however pkg_add was still, for some reason, expecting gzipped packages (.tgz). That's all over now, and probably has been for a long time.
• The installation is a breeze. I mentioned this before as well, but the textmode-driven menu really does just work. No, it's not as intuitive as a GUI installer, but it's not as sluggish as GUI, either.
• The OS and Xorg find my snazzy wireless Logitech VX Revolution mouse and all the major features (left, right, center click and vertical scrolling) work without any configuration changes at all. Mouse setup used to be a bit of a chore with FreeBSD.
• It is oh-so-peppy. As lean and mean as I remember it, I'm not exactly running FreeBSD on a powerhouse workstation. It's a lowly Pentium 3 desktop with a mere half-gigabyte of RAM. Compared to Kubuntu, which was installed prior to this, FreeBSD simply hauls ass.
  

The Bad:

• Where in the hell is xorgcfg, the graphical Xorg configuration tool? And why isn't there a somewhat working xorg.conf file installed by default? OpenBSD handles Xorg by default just fine. Playing with FreeBSD 6.2, I know I used xorgcfg to get Xorg up and running, but it's nowhere to be found in 6.3 (at least the way I installed it!) Fortunately, I'm good with xorgconfig, the text configuration tool for Xorg, and got X up and running on my lab machine on the second try.
• Mozilla Firefox, when installed from binary packages, for some reason creates the .mozilla directory in your homedir owned by root the first time you run it, and then can't start. The easy fix, of course, is to change the owner back to yourself before starting Firefox again, but this boggles my mind. What's more peculiar is that after creating a second user to test this with, Firefox starts fine. Hmm...
• I really, really miss OpenBSD's monolithic kernel and on-the-fly reconfiguration. FreeBSD forces you to enable kernel modules to get a lot of "optional" hardware to work.
  

Alas, I digress.

To get sound working, I had to go into /boot/defaults/loader.conf and set the proper sound module to "YES" (in my case, it was the snd_ich_load line) The "proper" way to do this would be to add snd_ich_load="YES" to /boot/loader.conf, but I am lazy and this works. I cheated again and just manually loaded the module from the command-line (kldload snd_ich) and voila! My MP3 player software worked like a charm. To get a guess as to what sound driver you'll need, run pciconf -lv and look for your sound device. Then look through the nondescript driver files (/boot/GENERIC/snd_*.ko) to see if there's a logical choice. Experimenrt if needed.

Despite what a pain in the butt it is, it's little things like this that remind me why I chose FreeBSD in the first place. It really is back to basics. At the same time, projects like OpenBSD are certainly just as minimalist but without the same kind of impact on out-of-box usability. Unfortunately, I've been spoiled, and OpenBSD is now the gold standard by which I measure things of this nature. It's not looking too good for FreeBSD with that minor exception of truly elegant binary package management. And oh, their package management is slick. It's admittedly low-tech, even. But it simply works well, and that's all I ask of it.

With what seems to be all of the major out-of-box problems solved (graphical interface, sound, boot options), I'm hopefully free of any more show-stoppers. Stay tuned next week to see how things are progressing.

Giving FreeBSD another shot

I fell in love with FreeBSD for the first time around the early part of 1998. Although I'd heard of FreeBSD before, my roommate, Xeroline, introduced me to it formally. I'd been tinkering with Red Hat Linux and had grown tired of both the wild-goose-chase of RPM dependencies as well as the patchwork of software compiles that often had their own dependency problems. FreeBSD seemed, at the time, to be the answer to my prayers.

FreeBSD 2.2.8 was lean, mean, and very basic. It also brought with it the concept of the Ports system: a skeletal tree of software directories where one could simply utter the words "make install" and then sit back -- often for a very long time -- and watch software compile automatically and usually error-free. Initially, that's all I wanted. It was FreeBSD that pried me away from my Linux addiction, and I'd say that it's also FreeBSD that shaped much of what I've come to expect from a UNIX desktop OS. In short, I didn't want an easy, graphical install. I wanted an OS that would get up and running quickly, be quick on its toes, and give me as clean of a slate as possible from which to begin my adventures. I wanted a system that could be wrought from bare metal.

As time passed, FreeBSD got better, then worse. I had been using OpenBSD for servers since early 1999, and Shortly after the 5.x series came out, I got sick of FreeBSD and switched to OpenBSD 3.2 on the desktop and some of my laptops. That was more than 5 years ago. I seriously haven't touched FreeBSD since February of 2003. Until now.

I almost messed with FreeBSD 6.2 a few months ago. I downloaded the ISO images but never got around to burning them. The target install environment was going to be my Pentium 3 lab box, but at the time I was using it to do research for my Linux LVM2 article. The very same machine, in fact, kept getting re-purposed for various HiR research projects. The time has come, though, for me to square off against my quondam favorite desktop OS.

I've only been tinkering with it for about a day now, so I still have a way to go before I'm ready to give this a full review. All I can say is to stay on the lookout for some more FreeBSD love. I can immediately tell that they've worked out some of the major kinks in their package installation tools. The installation doesn't seem like it's changed much since the 4.x releases. For that, I'm thankful. It's just friendly enough for almost anyone to figure out, but not made of bloated graphics like the Ubuntu installer that takes forever to load.

I have a feeling I might start really liking FreeBSD again. Did anyone else feel alienated by the 5.x series, only to come back and try 6.2 or 6.3 and really like it?