Messages

The patch is in since 17.1, and we haven't heard a complaint since. Sadly no positive feedback as well.


Cheers,
Franco

Although that is good news, /boot/loader.conf modifications are not permanent. Please select the VT driver under System: Settings: Administration to make it permanent.


Cheers,
Franco

Hi T,

Bitte mal im System: Log File schauen was da los ist. Auch unter Services: Diagnostics prüfen ob "configd" läuft und eventuell neu starten.

Die Konsolen-Updates (Option 12) sollten trotzdem gehen.


Grüsse
Franco

Hi all,

Suricata 3.2.1 came out today and we've put up a test package for amd64:

# pkg -fA https://pkg.opnsense.org/snapshots/suricata-3.2.1.txz

This one is compatible with 17.1.

There is, however, good news for all the Suricata users with Hyperscan trouble on non-SSSE3 CPUs: starting with Hyperscan 4.4.0, Suricata will (at least that is what I understood from the release notes and patches) select the appropriate default and prevent Hyperscan loading when inappropriate, which should obsolete the need to a separate "suricata-no-hs" package some of you have been using. This change will make it to 17.1.2 on a separate track. Testing looks good so far.


Cheers,
Franco

Sorry, we are circling back to a default of net.pf.share_forward=0 and a GUI override to in 17.1.2 to get to see underlying base OS update issues first, then improve shared forwarding further.

A few notes from Shawn on the particular attack:

https://github.com/lattera/articles/blob/master/infosec/Exploit%20Mitigations/ASLR/2017-02-15_anc/article.md

We are circling back to using the default pf/ipfw behaviour with 17.1.2, with an additional GUI firewall setting for using the new behaviour.

That should be permanent enough and accommodate for both kinds of users/use cases. :)


Cheers,
Franco

Realtek released the FreeBSD driver version 1.93 with built-in support for FreeBSD 11.0. All the more reason to go forward, I've queued it up for 17.1.2.

Thanks to everyone for the discussion and testing!


Cheers,
Franco

Welcher Crash? pfSense 2.3 funktioniert? Wenn es in FreeBSD 11.0 ist/bleibt, kann es gut sein, dass es dann auch bei 2.4 problematisch wird. :/

Hi Bert,

There are some loose ends still, sorry. We're also weighing the option of releasing new images, because of e.g. Hyper-V disks not being available. Hopefully around 17.1.3 or 17.1.4.


Cheers,
Franco

Der Author ist leider in den Ferien in der kommenden Woche soweit ich weiß, aber erst einmal die vorläufigen Dokumentationen:

https://github.com/opnsense/plugins/pull/66 (erste Version von Let's Encrypt)
https://github.com/opnsense/plugins/pull/71 (zweite Version von Let's Encrypt mit HAproxy Integration)


Grüsse
Franco

I said I did not have the time to do it then. ;)

But now it's up for amd64:

# opnsense-update -kr 17.1.1-re


Cheers,
Franco

Hallo Dominik,

Eigentlich wollte ich schon früher schreiben, aber bin nicht dazu gekommen. :(

Hatte mir die Stelle angeschaut, aber der Patch war nicht direkt für die selbe Stelle, oder?

Besteht Interesse den korrekten Fix in OPNsense zu übernehmen?


Grüsse
Franco

Alright, thanks!

Es hat wohl mit einem spezifischen Microsoft Bugfix-Release bei 2012R2 zu tun.