OpenBSD

The simple web-stack.

The OpenBSD httpd(8) is my obvious choice. It's small, easy to configure and designed from the ground up to use privilege separation. It does however lack a way to add custom HTTP-headers. To solve this problem, I run relayd(8) infront of httpd(8) and lets it handle TLS acceleration and adding proper caching headers...

https://ifconfig.se/simple-web-stack.html

#httpd #relayd

Running DNS over TLS on OpenBSD.

https://pre-prod.chown.me/blog/running-dot-on-openbsd.html

#dns #dot

OpenBSD GeoIP pf – filter by country.

https://doublefault0.wordpress.com/2018/01/05/openbsd-geoip-pf-filter-by-country/

#firewall

Configuring mail server on OpenBSD 6.5.

This guide is mostly notes for myself rather than something readable, but it may be useful anyway. It contains an example of working configuration for OpenSMTPD, SpamPD, SpamAssassin, DKIM Proxy and Dovecot with Sieve support on OpenBSD...

https://ch1p.io/blog/11/

#mail #opensmtpd

CVE-2019-8460.

Reuven Plevinsky and Tal Vainshtein of Check Point Software Technologies Ltd. discovered that OpenBSD kernel (all versions, including 6.5) can be forced to create long chains of TCP SACK holes that cause very expensive calls to tcp_sack_option() for every incoming SACK packet which can lead to a denial of service.

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8460

#security #cve

Upgrading OpenBSD with Ansible.

This article is best enjoyed with basic knowledge of OpenBSD autoinstall and Ansible...

https://chown.me/blog/upgrading-openbsd-with-ansible.html

#ansible #system

Building an accessible OpenBSD laptop. https://www.youtube.com/watch?v=Ma_Y1hVmK8o

#desktop #video

UTMFW.

UTMFW is a UTM firewall running on OpenBSD. UTMFW is expected to be used on production systems. The UTMFW project provides a Web User Interface (WUI) for monitoring and configuration.

https://github.com/sonertari/UTMFW

#firewall #security #network

Portable OpenSSH.

This is a port of OpenBSD's OpenSSH to most Unix-like operating systems, including Linux, OS X and Cygwin. Portable OpenSSH polyfills OpenBSD APIs that are not available elsewhere, adds sshd sandboxing for more operating systems and includes support for OS-native authentication and auditing (e.g. using PAM).

https://github.com/openssh/openssh-portable

#ssh

fnaify 2.0-beta

FNA is a reimplementation of the Microsoft XNA Game Studio 4.0 Refresh libraries. Thanks to the great work by Ethan Lee (flibitijibibo) games using FNA are highly portable and can even run on OpenBSD: https://github.com/rfht/fnaify

* Refer to https://fna-xna.github.io/ for more information about FNA.

#games #fun

Edge OpenBSD PF Firewall. Securing the first gate of your network.

OpenBSD comes with a built-in firewall called PF, short for Packet Filter. PF is ideal for firewalling in your DMZ zone. This blog post will show you how to create a robust edge firewall setup with OpenBSD 6.5...

https://cryptsus.com/blog/edge-openbsd-pf-firewall-securing-the-first-gate-of-your-network.html

#pf #firewall #security

sxxu - a tool to help build OpenBSD siteXX files.

The goals of sxxu are to help you:

- Keep configuration for your systems in a source control
- Recover from a disaster more quickly
- Do a matching install on a secondary system so you can:
- - Upgrade between versions of OpenBSD with the ability to revert
- - Replace aging hardware
- - Build a test environment before pushing changes to a production system

https://github.com/afresh1/sxxu

#github

OpenBSD on the Lenovo ThinkPad X1 Carbon (7th Gen).

https://jcs.org/2019/08/14/x1c7

#desktop

https://twitter.com/JobSnijders/status/1161619756027404288

#art

OpenBSD stable binary packages.

"We are pleased to announce that we now also provide selected binary packages for the most recent release. These are built from the -stable ports tree which receives security and a few other important fixes..."

https://marc.info/?l=openbsd-announce&m=156577865917831&w=2

#packages #system

WireGuard implementation for the OpenBSD kernel

https://git.zx2c4.com/wireguard-openbsd/

#wireguard #vpn

Caesonia - OpenBSD Email Service.

Root your Inbox with a free-email alternative OpenBSD Email Service.

https://github.com/vedetta-com/caesonia

#mail

OpenBSD MAC address randomization daemon.

Just a tiny OpenBSD daemon to change periodically MAC addresses.

https://github.com/gpicchiarelli/macrandr

#github

Mini review of tog: the OpenBSD source control system.

tog has log, diff, blame, and tree views. You can start in any of the views by calling tog with appropriate sub-command, or start from default log mode and switch to tree by hitting t, blame (enter), or diff (enter on a line with a hash)...

http://akpoff.com/archive/2019/mini_review_of_tog.html

#tog