Messages

1

16.1 Legacy Series / Update broke my setup completely: OPNsense 16.1.15 released Mei 25, 2016

« on: May 25, 2016, 07:22:26 pm »

Just shut ed down my gateway, tried to reset to factory and reassign interfaces, its not working at all. Pings are ok but I can't proceed to web gui, no more after these update.

I using dnscrypt-proxy + unbound + suricata and saving my xml file to google drive, but since I can't enter web gui there is no way to recover my settings or use opnsense. Sadly I end up just switching to raw connection direct to my main PC cause I am tired and have no effort since my monitor is broken and I use TV+VGA+DVI-I mess to work on my PC and no way to use KVM switch for now cause I am tired ;*(

Sorry, strange thing it from factory defaults mixing up interfaces by assign ste0 WAN but its LAN card, and I have re0 on WAN, reassigning it manually helps but seems it does not up web gui after these reassign procedure. But DHCP server works normally from 192.168.1.10 to 192.168.1.100 range....after it I can ping my gateway on WAN through LAN and basically NAT works fine but no more WEB GUI @_@ I found its very strange, never had any problems with opnsense web gui connectivity.....its strange issue really. Please test updates more.

I just ruin everything with these update, having web gui netmap or some kind sort of errors related to packets capturing on my box. I using netmap for analyze network usage and suricata + wide range of features like dnscrypt-proxy package with configured few servers ^_^ its nicely working until of today updates. Even factory reset doesn't help I have no sense on how to deal with these not working web gui.

TLDR but I just gived up on trying to connect to web interface, maybe I should try pfsense again or opnsense but somehow later when I recover my monitor. For now I am just tired on how unreliable updates in both firewalls can be. Sorry. I found its more convenient to use direct connection to my Ubuntu for now. Really

I found that dns resolver means here dnsmasq working much more faster and reliable compared to unbound dns resolver. And the last web gui errors that I was seen was some "netmap connection broken" errors dropped by in black console.....I have all hardware offloads in off state and these setup it works for weeks. I can attach my xml configuration file but I do not think that it was helpful since I've already reset working configuration to factory defaults and it does not help me to proceed to web GUI so I can't configure it no more. I think its not config related issue but something wrong with these update. Sorry. So I do not attach my config xml file ....I just tired and move on.

Have a nice day. Thank you. Anyway you doing nice firewall.

I just bookmark these thread maybe someone experienced the same with these update.

2

General Discussion / Re: Wishlist: Collection of features & strategy proposals for OPNsense

« on: April 04, 2016, 09:57:08 am »

I deal with dnscrypt proxy as described in these guide https://ramirosalas.com/installing-dnscrypt-in-opnsense.html

Pesronally what I want it to see in the future opnsense builds is the ability to use dnscrypt proxy out of the box with conjunction of privoxy or tor services these would be great feature if implemented like in way they does with suricata package that is work for IPS/IDS and can be correctly setting up through GUI.

But I do it for a standard dns port 53 and dhcp on my client sabayon system through network-manager, I issuing then command dig -4 @127.0.0.1 -p 53 slashdot.org and seems all kind of logic dnscrypt provides to my system through DNS Forwarder works fine. I don't know how to check if it going to encrypt my dns queries or not cause not know is there any dns sniffer are availible for freebsd distribution. Well I does also standard steps and setup not just public but official dnscrypt servers from their github file that provides complete list of standard dnscrypt-proxy servers.

3

16.7 Legacy Series / Re: [CALL FOR TESTING] HardenedBSD's ASLR

« on: April 04, 2016, 09:42:17 am »

Code: [Select]

# dmesg | grep HBSD
[HBSD ASLR (compat)] status: opt-out
[HBSD ASLR (compat)] mmap: 14 bit
[HBSD ASLR (compat)] exec base: 14 bit
[HBSD ASLR (compat)] stack: 14 bit
[HBSD ASLR (compat)] vdso: 8 bit
[HBSD LOG] logging to system: enabled
[HBSD LOG] logging to user: disabled
[HBSD ASLR] status: opt-out
[HBSD ASLR] mmap: 30 bit
[HBSD ASLR] exec base: 30 bit
[HBSD ASLR] stack: 42 bit
[HBSD ASLR] vdso: 28 bit
[HBSD ASLR] map32bit: 18 bit
[HBSD ASLR] disallow MAP_32BIT mode mmap: opt-in
It'll show you some basic info about the implementation. If everything continues to work that is about all that there is to it from the user perspective. The next step will be to (selectively) add PIE to main executables in order to take advantage of the full scope of ASLR.

There will be more HardenedBSD additions in the future. OPNsense will likely stay on 10.x for a bit longer than HardenedBSD builds with OPNsense (these use 11-CURRENT), but eventually the two paths will become more similar. As we keep integrating additions and go forward with FreeBSD progress adoption.

Thank you for testing.

Yepp I see the same output and its work now on my machine, thank you.

Code: [Select]

# dmesg | grep HBSD
[HBSD ASLR (compat)] status: opt-out
[HBSD ASLR (compat)] mmap: 14 bit
[HBSD ASLR (compat)] exec base: 14 bit
[HBSD ASLR (compat)] stack: 14 bit
[HBSD ASLR (compat)] vdso: 8 bit
[HBSD LOG] logging to system: enabled
[HBSD LOG] logging to user: disabled
[HBSD ASLR] status: opt-out
[HBSD ASLR] mmap: 30 bit
[HBSD ASLR] exec base: 30 bit
[HBSD ASLR] stack: 42 bit
[HBSD ASLR] vdso: 28 bit
[HBSD ASLR] map32bit: 18 bit
[HBSD ASLR] disallow MAP_32BIT mode mmap: opt-in


4

16.7 Legacy Series / Re: [CALL FOR TESTING] HardenedBSD's ASLR

« on: April 03, 2016, 12:04:37 pm »

OK I am now under new kernel and how do I look what kernel I used up?
The following commands does't provide any detailed information about if it is "hardened" or not:

Code: [Select]

root@home_gateway:~ # ps aux | grep kernel
root       0   0.0  0.0      0   160  -  DLs  12:56PM 0:00.01 [kernel]
root   55148   0.0  0.2  18728  2244  0  S+   12:58PM 0:00.00 grep kernel
root@home_gateway:~ # ps aux | grep kernel | more
root       0   0.0  0.0      0   160  -  DLs  12:56PM 0:00.01 [kernel]
root   55465   0.0  0.2  18728  2248  0  S+   12:58PM 0:00.00 grep kernel
root@home_gateway:~ # freebsd-version -k
10.2-RELEASE-p14
root@home_gateway:~ # freebsd-version -u
10.2-RELEASE-p14
root@home_gateway:~ # uname -mrs
FreeBSD 10.2-RELEASE-p14 amd64
root@home_gateway:~ # getconf LONG_BIT
64
root@home_gateway:~ # uname -a
FreeBSD home_gateway.home 10.2-RELEASE-p14 FreeBSD 10.2-RELEASE-p14 #0 eda6bf2(master): Wed Mar 30 06:11:42 CEST 2016     root@sensey64:/usr/obj/usr/src/sys/SMP  amd64


Can I issue some special command to see if I use hardened kernel over vanilla one? I just google some commands but all of them returns me somehow default results which is not represents the current state of "hardened" or not.

Anyway it's runs normal for me as the home gateway user.

Thank you!

5

16.7 Legacy Series / Re: [CALL FOR TESTING] HardenedBSD's ASLR

« on: April 03, 2016, 11:14:00 am »

Hello everyone,

With the help of Shawn and Olivér from HardenedBSD we have finally incorporated the first piece of their wonderfully crafted improvements: Address Space Layout Randomization, or short ASLR. This change only affects the kernel and is now open for public testing.

Things to be aware of:

This is a call for testing that replaces the kernel. Use with care. The old kernel can still be booted from the early boot menu under option (5), selecting "kernel.old" and then continue the boot with option (1).

The kernel ABI changes, VMware and XEN plugins may not work at the moment. This problem can only be addressed once the kernel is in place and our packages use the new API. Manually compiled drivers may need to be recompiled against the current master of src.git

The impact of the patch is minimal, the system will boot ok, continue to function normally and ASLR will be enables as "opt-out", which means it will be on by default.

The next firmware upgrade will remove the test kernel and switch back to a vanilla version without ASLR. In those cases, the kernel needs to be reapplied.

To switch to the ASLR kernel:

# opnsense-update -kr 16.1.8-aslr && /usr/local/etc/rc.reboot

To switch back to the standard kernel:

# opnsense-update -k && /usr/local/etc/rc.reboot

I will ask Shawn to explain the impact of the patch a bit more as well as what it means for going forward.

On a more or less related note: consider me totally happy about this CFT


Have fun,
Franco

Thank you! I am trying it now.
Hopefully these https://pkg.opnsense.org/snapshots/hbsd-exp-09/ has going to be released as an option like SSL library changing and we able to switch in between vanilla and hardenedbsd firmwares. Most likely I would like to see these feature.

Its funny but pfsense developers released 2.3 alpha too  it would be great to see how competition between two would progress as the time passing by.