Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

WireGuard in FreeBSD

cgit.freebsd.org

Post reply on HN
Print view View original

31–40 of 84 posts

Re: WireGuard in FreeBSD

#31

Post by tomxor »

HorizonXP wrote: post #11
atonse wrote: post #10

Genuinely curious… Is there any security benefit to moving a WireGuard bastion from fully patched Ubuntu to FreeBSD?

Generally, I would trust the defaults of FreeBSD more than the defaults of Ubuntu, but FreeBSD may require more setup of any utilities you might be using. But, I don’t actually know for sure. I plan on using FreeBSD bastions.

This is untrue in my experience.

I've used FreeBSD a fair bit in the past and Ubuntu and Debian more continuously. Unless something radically changed recently. My experience is about 6-8 years old now but FreeBSD requires a lot more configuration when setting up common services, whereas Ubuntu and even Debian have good defaults that you can usually bring up without having to first consume the entire manual for that service.

There's probably a reasonable sounding argument buried behind this like "you cannot run a service securely if you do not fully understand the configuration first." but in practice this just results in poor initial configurations because it takes time to fully understand all of the knobs of configuration on a service.

FreeBSD can be a solid system, but it's less practical in many ways for reasons like this.

Re: WireGuard in FreeBSD

#33

Post by vladvasiliu »

MojoDwarf wrote: post #28
onedr0p wrote: post #22

Earlier quoted context omitted.

I'm already running the kmod Wireguard on Opnsense unless I'm missing something?

for me OPNSense is installing the go implementation when installing via the plugin system. Maybe there was a time it was using the old kmod port?

You can manually install the kmod and the plugin will that instead of the go implementation.

Re: WireGuard in FreeBSD

#34

Post by [deleted] »

flatiron wrote: post #20
atonse wrote: post #10

Genuinely curious… Is there any security benefit to moving a WireGuard bastion from fully patched Ubuntu to FreeBSD?

there are no open CVEs against the default install of wireguard on Ubuntu. for all the grief ubuntu gets i find their server has very sane defaults.

[deleted]

Re: WireGuard in FreeBSD

#35

Post by LargoLasskhyfv »

spijdar wrote: post #24
rascul wrote: post #16

Earlier quoted context omitted.

I think the claim might be related to openbsd's claim on their website: > Only two remote holes in the default install, in a heck of a long time! https://www.openbsd.org/ I remember a time when it was zero, not two.

This isn't really the right place to launch into a full diatribe on this, but for anyone who isn't familiar and may be confused by this claim, I want to point out this specifically refers to the default install with no extra services running . I love BSD based OSes, but I've always found this claim to be a little irritating, because it's far less impressive IMO than it sounds to the uninitiated. It's impressive from…

This is all correct, but in my not so humble opinion all the BSDs profit from having a more compact and cohesive base, which leads to less cognitive load for the sysadmin. Which you can learn and understand without having to resort to searching crack overflow, or whatever else, if you're so inclined. Which in turn can lead to a better understanding of the 'big picture', and the additional services running atop of it, no matter if they are coming from the base, or have been added afterwards. Not necessarily, but it eases the path to that sort of mindset.

I don't see that in any mainstream Linux distribution. There are alternatives, but then you're more or less on your own, necessitating work which could be avoided if some BSD satisfies your needs regarding hardware driver support.

At the end of the day it amounts to https://en.wikipedia.org/wiki/The_Cathedral_and_the_Bazaar

I'm a grumpy old fart and (usually) don't like chaos.

Re: WireGuard in FreeBSD

#36

Post by johnklos »

Between the FreeBSD WireGuard drama and WireGuard's maintainer's (Jason Donenfeld) reaction to the NetBSD implementation, I think it's a good idea to look at not only what's happening, but why and by whom. There's something slightly fishy about it all.

https://mail-index.netbsd.org/current-users/2020/08/20/msg03... https://mail-index.netbsd.org/current-users/2020/08/22/msg03...

Jason Donenfeld has, to this day, never answered direct and simple questions about WHY he felt so strongly that NetBSD's wg implementation should be removed from NetBSD.

Re: WireGuard in FreeBSD

#37

Post by kevans91 »

smoochy wrote: post #5
detaro wrote: post #4

Earlier quoted context omitted.

It adds wireguard support to the kernel.

Okay, but... what difference does it make? Apart from not having to install it manually? Am I missing something?

It depends on how you were running before -- if you had the wireguard-kmod package, then yes, the only difference is that you don't have to install it manually. If you only had the wireguard-go pkg before, then see the other responses where you'll now be using the kernel implementation instead of userspace.

edit to note: we can't really provide wg-quick in base at the moment (uses bash-isms), so that still ends up needing installed manually if wg(8) isn't sufficient for your needs.

Re: WireGuard in FreeBSD

#38

Post by tedunangst »

spijdar wrote: post #24
rascul wrote: post #16

Earlier quoted context omitted.

I think the claim might be related to openbsd's claim on their website: > Only two remote holes in the default install, in a heck of a long time! https://www.openbsd.org/ I remember a time when it was zero, not two.

This isn't really the right place to launch into a full diatribe on this, but for anyone who isn't familiar and may be confused by this claim, I want to point out this specifically refers to the default install with no extra services running . I love BSD based OSes, but I've always found this claim to be a little irritating, because it's far less impressive IMO than it sounds to the uninitiated. It's impressive from…

One might well ask why a default redhat install doesn't have a dozen services running and when did that become the standard?

Re: WireGuard in FreeBSD

#39

Post by normaler »

atonse wrote: post #10

Genuinely curious… Is there any security benefit to moving a WireGuard bastion from fully patched Ubuntu to FreeBSD?

no, there might even be detriment Because of the way FreeBSD modifes openssh. OpenBSD might be an improvement to Ubuntu security wise.

Re: WireGuard in FreeBSD

#40

Post by nix23 »

normaler wrote: post #39
atonse wrote: post #10

Genuinely curious… Is there any security benefit to moving a WireGuard bastion from fully patched Ubuntu to FreeBSD?

no, there might even be detriment Because of the way FreeBSD modifes openssh. OpenBSD might be an improvement to Ubuntu security wise.

No openssl:

https://www.wireguard.com/papers/zinzindohoue-bhargavan-prot...

Post reply on HN