The state of LibreSSL in FreeBSD

#1

Post by attilagyorffy » Sun, Jul 03, 2016, 11:13 AM UTC

The state of LibreSSL in FreeBSD
attilagyorffy.com

Re: The state of LibreSSL in FreeBSD

#2

Post by cm3 » Sun, Jul 03, 2016, 2:09 PM UTC

Outside of the BSDs, Void Linux is a linux distro that uses LibreSSL instead of OpenSSL and they also have a stable musl flavor (no glibc).

Re: The state of LibreSSL in FreeBSD

#3

Post by eatonphil » Sun, Jul 03, 2016, 2:12 PM UTC

cm3 wrote: post #2

Outside of the BSDs, Void Linux is a linux distro that uses LibreSSL instead of OpenSSL and they also have a stable musl flavor (no glibc).

OS X also ships LibreSSL (ssh -v).

Re: The state of LibreSSL in FreeBSD

#4

Post by attilagyorffy » Sun, Jul 03, 2016, 2:29 PM UTC

eatonphil wrote: post #3

cm3 wrote: post #2

Outside of the BSDs, Void Linux is a linux distro that uses LibreSSL instead of OpenSSL and they also have a stable musl flavor (no glibc).

OS X also ships LibreSSL (ssh -v).

I know this is just nitpicking but you may want to use capital V instead: `ssh -V`.

And indeed the SSH command originates from OpenBSD and uses LibreSSL 2.1.8.

Re: The state of LibreSSL in FreeBSD

#5

Post by eatonphil » Sun, Jul 03, 2016, 3:44 PM UTC

attilagyorffy wrote: post #4

eatonphil wrote: post #3

Earlier quoted context omitted.

OS X also ships LibreSSL (ssh -v).

I know this is just nitpicking but you may want to use capital V instead: `ssh -V`. And indeed the SSH command originates from OpenBSD and uses LibreSSL 2.1.8.

Thanks :) I was afk and I hoped someone would correct me.

Re: The state of LibreSSL in FreeBSD

#6

Post by sverige » Sun, Jul 03, 2016, 4:23 PM UTC

Good news for FreeBSD. I agree that LibreSSL is the best bet for the future.

Re: The state of LibreSSL in FreeBSD

#7

Post by azinman2 » Sun, Jul 03, 2016, 5:11 PM UTC

Isn't it not yet ready for production?

Re: The state of LibreSSL in FreeBSD

#8

Post by ivl » Sun, Jul 03, 2016, 5:23 PM UTC

azinman2 wrote: post #7

Isn't it not yet ready for production?

It's not in the base system yet. I would be fine with using it in production, however.

Re: The state of LibreSSL in FreeBSD

#9

Post by aninteger » Sun, Jul 03, 2016, 5:31 PM UTC

azinman2 wrote: post #7

Isn't it not yet ready for production?

This really depends on what your production environment requires. LibreSSL is mostly API compatible with OpenSSL but removes FIPS and support for esoteric platforms. If your production environment requires Windows 3.1 or big endian amd64 then probably LibreSSL is not ready for your production environment. Seriously though some of us are already using LibreSSL in production without problems.

Re: The state of LibreSSL in FreeBSD

#10

Post by attilagyorffy » Sun, Jul 03, 2016, 6:07 PM UTC

azinman2 wrote: post #7

Isn't it not yet ready for production?

This really is a more complex question then it may seem. One of the reasons I haven't yet upgraded my production system is because I want to be able to keep my system up-to-date. Now, having to manually patch the FreeBSD source tree once a new upgrade lands is a bit of a pain. The point of the article is really about exploring where we are and where the FreeBSD community is headed.