Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard in FreeBSD

cgit.freebsd.org

Post reply on HN
Print view View original

21–30 of 84 posts

Re: WireGuard in FreeBSD

#24

Post by spijdar »

rascul wrote: post #16
bragr wrote: post #14

Earlier quoted context omitted.

The " BSD is more secure by default" argument always falls very flat to me. In addition to being completely unsourced and unsupported (who ever links to a study when they make this claim?), even if it is true, once you've configured your BSD box for use, you're pretty far from the default so I'm not really sure what the claim is even supposed to say. Its fine to like BSD, I just wish people were willing to be honest…

I think the claim might be related to openbsd's claim on their website: > Only two remote holes in the default install, in a heck of a long time! https://www.openbsd.org/ I remember a time when it was zero, not two.

This isn't really the right place to launch into a full diatribe on this, but for anyone who isn't familiar and may be confused by this claim, I want to point out this specifically refers to the default install with no extra services running.

I love BSD based OSes, but I've always found this claim to be a little irritating, because it's far less impressive IMO than it sounds to the uninitiated. It's impressive from the perspective of Windows or Solaris which enable huge numbers of network daemons by default and have both suffered numerous high profile remote vulnerabilities on default installs, but OpenBSD isn't really much different from most Linux distros on this. I'm sure most distros have had more remote vulnerabilities, but not that many. Your average Joe out-of-the-box install of Fedora or Ubuntu doesn't really have any open services IIRC, so an exploit would need to directly target the Linux IP stack, or one of the network autoconfig services if that's in scope.

Re: WireGuard in FreeBSD

#25

Post by bongobingo1 »

flatiron wrote: post #20
atonse wrote: post #10

Genuinely curious… Is there any security benefit to moving a WireGuard bastion from fully patched Ubuntu to FreeBSD?

there are no open CVEs against the default install of wireguard on Ubuntu. for all the grief ubuntu gets i find their server has very sane defaults.

  $ openssl version
  OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022)
Until the 1st?

Re: WireGuard in FreeBSD

#27

Post by flatiron »

bongobingo1 wrote: post #25
flatiron wrote: post #20

Earlier quoted context omitted.

there are no open CVEs against the default install of wireguard on Ubuntu. for all the grief ubuntu gets i find their server has very sane defaults.

$ openssl version OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022) Until the 1st?

My server is 20.04 and it’s 1.1.1f. I would think most people aren’t on 22.04 yet as that’s still pretty fresh for a server.

Re: WireGuard in FreeBSD

#28

Post by MojoDwarf »

onedr0p wrote: post #22
c0nsumer wrote: post #2

I'm really looking forward to this making its way into OPNsense and such.

I'm already running the kmod Wireguard on Opnsense unless I'm missing something?

for me OPNSense is installing the go implementation when installing via the plugin system.

Maybe there was a time it was using the old kmod port?

Re: WireGuard in FreeBSD

#29

Post by loeg »

bongobingo1 wrote: post #25
flatiron wrote: post #20

Earlier quoted context omitted.

there are no open CVEs against the default install of wireguard on Ubuntu. for all the grief ubuntu gets i find their server has very sane defaults.

$ openssl version OpenSSL 3.0.2 15 Mar 2022 (Library: OpenSSL 3.0.2 15 Mar 2022) Until the 1st?

Wireguard doesn’t use openssl.
Post reply on HN