FreeBSD 11.1-Beta1 now available | Hacker News Reader

FreeBSD 11.1-Beta1 now available

lists.freebsd.org

78 pointsvasili11118 comments

From the release notes[0]:

> Support for NAT-T is now enabled by default. The IPSEC_NAT_T kernel configuration option has been removed. [r315514] (Sponsored by Yandex LLC)

All I can say is thank you! I use FreeBSD as, among other things, a VPN server/client and having to recompile my kernel to support IPSec (in 10.3) or to support NAT Traversal (in 11.0) has honestly been my biggest annoyance with FreeBSD. This will make upgrades a LOT easier for me.

Once 11.1 is released, I'm upgrading all of my machines.

[0] https://www.freebsd.org/relnotes/11-STABLE/relnotes/article....

Thank god.

I remember being so excited when 11.0 was released, until I found out that that NAT-ing on the VPN interface wasn't possible without recompiling the kernel.

What is wrong with recompiling the kernel? Last time I used FreeBSD (also NetBSD), all that it took was to edit some config file and call a shell script. Has it changed from that?

You can't use freebsd-update if you have to recompile your kernel, which in turn makes it difficult to manage large fleets of servers without running your own freebsd-update server.

Ah, OK.

This is my biggest issue. Updating is basically a case of install updates, recompile kernel, reboot with fingers crossed. I'm scared to upgrade to a new release because of this.

"a freebsd user with a password of freebsd is available by default for ssh(1) access."

And this is why we need security vulnerability scanners that check for default credentials :-( Instead of telling people to change the password, they should really enforce the change with a one-time script prompting the user on the first login.

Edit: I know, only for arm/armv6, but still doesn't excuse the security sloppiness.

I agree, but for clarity and context, let's note this only applies to arm/armv6 images.

That's only for the arm/armv6 images. The entire excerpt reads:

"Note regarding arm/armv6 images: For convenience for those without console access to the system, a freebsd user with a password of freebsd is available by default for ssh(1) access. Additionally, the root user password is set to root. It is strongly recommended to change the password for both users after gaining access to the system."

I feel that if you are installing FreeBSD on ARM devices your cluefulness is quite high and this shouldn't impact you ...

"this shouldn't impact you"

"should" is a word InfoSec professionals chuckle at.

  Instead of telling people to change the password,
  they should really enforce the change with a
  one-time script prompting the user on the first
  login.

There shouldn't be a need for a script. If the process for installation were enhanced to include something along the lines of 'pw usermod freebsd -p 0', then that would do the trick.

EDIT: removed unneeded ellipses in quote

0 - https://www.freebsd.org/cgi/man.cgi?query=pw&apropos=0&sekti...

>And this is why we need security vulnerability scanners that check for default credentials :-( Instead of telling people to change the password, they should really enforce the change with a one-time script prompting the user on the first login.

SSHD requires RSA encryption and disallows password based auth by default though, so it's meaningless if the attacker doesn't have your key in the first place.

From 2013 on FreeNAS CTO, https://www.wired.com/2013/08/jordan-hubbard/

"...Apple hired Jordan Hubbard, the creator of FreeBSD, a lesser known, but still thriving, open source operating system based on UNIX. It was a better fit: Mac OS X shares conceptual roots with Linux, but it shares honest-to-goodness code with FreeBSD.

Hubbard left Apple last month to return to the world of open source UNIX, taking the chief technology officer post at iXsystems, a company that offers servers and other data center hardware that runs FreeBSD. Apple was quite an education, and now, he wants to bring the "Apple approach" back to the open source game."

He is no longer with iXSystems. But how is this related to FreeBSD 11.1-BETA1?

Was iXSystems a contributor to FreeBSD 11.1-BETA1?

It's really cool to see support for hobbyist SBC boards making it upstream. I've recently bought an Asus TinkerBoard (for Gigabit Ethernet, wifi, and 24bit ADC/DAC) and I hope a similar thing happens with this board.

It might be nice to update some of my old Pis I've setup to the more standard kernels that are coming out now.

With how small a FreeBSD install can be it seems a good choice.

Does it support TCP Fast Open by default yet?

Reply on news.ycombinator.com