change os references to HardenedBSD

pull/129/head
Ad Schellevis 5 years ago
parent 0a18622d0c
commit 34b6ac99a1

@ -5,7 +5,7 @@ Development Manual
.. image:: /development/images/ideas_join_the_development.jpg
The OPNsense® project invites developers to start developing with OPNsense:
"For your own purpose or even better to join us in creating the best FreeBSD
"For your own purpose or even better to join us in creating the best HardenedBSD
based open source firewall available!" The development workflow & build process
have been redesigned to make it more straightforward and easy for developers to
build OPNsense.

@ -111,11 +111,11 @@ socket.
Core system
-----------
The core of OPNsense is powered by an almost standard FreeBSD ® system
The core of OPNsense is powered by an almost standard HardenedBSD ® system
extended with packages using the pkg system. GIT is used for version
control and the repositories are split into 4 parts:
- src : the base (FreeBSD ®) system
- src : the base (HardenedBSD ®) system
- ports : the ports collection containing third party software
- core : the OPNsense gui and system configuration parts
- tools : easy tools to build OPNsense

@ -30,7 +30,7 @@ and used :doc:`components </development/components>`.
-----------------
Ideal Development
-----------------
Our ideal OPNsense system looks like a standard FreeBSD system using our
Our ideal OPNsense system looks like a standard HardenedBSD system using our
pluggable user interface for management, which supports both real users as "machine"
users (REST).

@ -83,9 +83,9 @@ Much work had already been done before the `first official release <https://opns
* The build-tools had been completely rewritten from the ground up
with clear and easy to read build scripts that are portable and small,
* OPNsense is now a package that can be installed on top of our custom FreeBSD
* OPNsense is now a package that can be installed on top of our custom HardenedBSD
build (you can literally do pkg remove opnsense and are left with an almost
standard FreeBSD base system),
standard HardenedBSD base system),
* The firmware upgrade process is now done with pkgng,

@ -8,7 +8,7 @@
Welcome to OPNsense's documentation!
====================================
`OPNsense® <https://opnsense.org>`__ is an open source,
easy-to-use and easy-to-build FreeBSD based firewall and routing platform.
easy-to-use and easy-to-build HardenedBSD based firewall and routing platform.
**OPNsense** includes most of the features available in expensive commercial
firewalls, and more in many cases. It brings the rich feature set of commercial

@ -13,7 +13,7 @@ how to :doc:`contribute`.
Welcome to OPNsense's documentation!
------------------------------------
`OPNsense® <https://opnsense.org>`__ is an open source,
easy-to-use and easy-to-build FreeBSD based firewall and routing platform.
easy-to-use and easy-to-build HardenedBSD based firewall and routing platform.
**OPNsense** includes most of the features available in expensive commercial
firewalls, and more in many cases. It brings the rich feature set of commercial
@ -39,10 +39,10 @@ Feature set
The feature set of OPNsense includes high-end features such as forward caching
proxy, traffic shaping, intrusion detection and easy OpenVPN client setup.
The latest release is based on a recent FreeBSD for long-term support and uses a
The latest release is based on a recent HardenedBSD for long-term support and uses a
newly developed MVC-framework based on Phalcon. OPNsenses focus on security
brings unique features such as the option to use LibreSSL instead of OpenSSL
(selectable in the GUI) and a custom version based on HardenedBSD.
(selectable in the GUI).
The robust and reliable update mechanism gives OPNsense the ability to provide
important security updates in a timely fashion.

@ -25,8 +25,7 @@ We like the BSD license, a simple two clause license that gives freedom to the
audience we want to serve.  It basically gives you the right to do whatever you
want to do with the code, even fork it and take it from there.
OPNsense is available under the BSD 2-Clause “Simplified” or “FreeBSD”
license:
OPNsense is available under the BSD 2-Clause “Simplified” license:
`OPNsense® <http://opnsense.org>`__ is Copyright © 2014 2019 by
Deciso B.V.
@ -53,8 +52,8 @@ LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
OPNsense is based on `FreeBSD <https://www.freebsd.org>`__
Copyright © The FreeBSD Project. All rights reserved.
OPNsense is based on `HardenedBSD <https://hardenedbsd.org/>`__
Copyright © The HardenedBSD Project. All rights reserved.
OPNsense is a fork of `pfSense® <https://www.pfsense.org>`__
(Copyright © 2004-2014 Electric Sheep Fencing, LLC. All rights

@ -167,7 +167,7 @@ Network interface cards
.. rubric:: Supported hardware
:name: supported-hardware
The FreeBSD 11.1-RELEASE is the base of OPNsense. All FreeBSD drivers
The HardenedBSD 11.2-RELEASE is the base of OPNsense. All HardenedBSD drivers
are included in the OPNsense kernel, and the hardware compatibility is
the same.
@ -177,8 +177,8 @@ the same.
For further help and support, see
- `FreeBSD 11.1-RELEASE Hardware Compatibility
List <https://www.freebsd.org/releases/11.1R/hardware.html>`__
- `FreeBSD 11.2-RELEASE Hardware Compatibility
List <https://www.freebsd.org/releases/11.2R/hardware.html>`__
- `OPNsense Forum <https://forum.opnsense.org/>`__
.. rubric:: List of references

@ -12,7 +12,7 @@ Supported devices
-----------------
In general, OPNsense should support all cellular modems that are supported by the
respective FreeBSD kernel. However, not all devices behave the same way, you might
respective HardenedBSD kernel. However, not all devices behave the same way, you might
have to tweak your card with specific AT commands, for example in the init string.
The screenshots in this guide are for a Huawei ME909u-521 miniPCIe cellular modem.
@ -35,7 +35,7 @@ be considered, see for example `this guide <https://www.specialistantennas.co.uk
.. Note::
Make sure to connect the antenna to the cellular modem once you start
Make sure to connect the antenna to the cellular modem once you start
configuring the modem in OPNsense. There is little chance that you
get any signal without antenna.
@ -47,8 +47,8 @@ First, we need to figure out what device is accepting AT commands on your modem.
the Huawei modem used in this example the device is ``/dev/cuaU0.0``, other modems
might provide the AT interface on another device.
On FreeBSD, ``/dev/cuauN`` devices are call-out ports that are used for modems instead
of terminals, see section `26.2.1 <https://www.freebsd.org/doc/handbook/serial.html>`_ in the FreeBSD manual.
On HardenedBSD, ``/dev/cuauN`` devices are call-out ports that are used for modems instead
of terminals, see section `26.2.1 <https://www.freebsd.org/doc/handbook/serial.html>`_ in the FreeBSD manual.
The best way to locate the correct port is to send AT commands to it. This can be
tested using the utility ``cu``:
@ -58,7 +58,7 @@ tested using the utility ``cu``:
cu -l /dev/cuaU0.2
Connected
AT (<-type that)
OK
OK
Once you see ``Connected`` type ``AT``. If you do not get an ``OK``
back, enter ``~.`` to quit and try the next device. In this particular example, a
@ -80,7 +80,7 @@ have been detected or you might have a pin on the SIM.
Once the SIM card is ready, quit ``cu`` with ``~.``.
.. Note::
To get rid of the pin, first check if it is valid with ``AT+CPIN="1234"``
where ``1234`` is the pin of your SIM card. To get rid of the pin, enter
``AT+CLCK="SC",0,"1234"``. The pin should now be gone.
@ -161,7 +161,7 @@ providers required factory resets (for whatever reason) to get them to work prop
in the first step of this tutorial to make sure everything is prepared properly.
.. Note::
Some Sierra Wireless modems still seem to need a specific init string to work
properly. One that seems to work for multiple users and LTE cards is ``&F0E1Q0 +CMEE=2``. In any case you should first try without init string and only give it
a try if you could not get any connection without. You can add this in **Interfaces->Point-to-Point->Devices->Your particular device->Advanced Options->Init String**.
@ -176,4 +176,4 @@ network connection is not working well.
In case you were not successful, you might have to check manually what is going
on. Read the `Troubleshooting PPP Connections <https://www.freebsd.org/doc/handbook/ppp-troubleshoot.html>`_ section in the FreeBSD manual for more information and
consult the OPNsense support forum.
consult the OPNsense support forum.

@ -22,8 +22,8 @@ The device name can differ per system and per serial device. Examples of names a
* /dev/ttyS0 (serial port, Linux)
* /dev/ttyUSB0 (usb-to-serial, Linux)
* /dev/cuau0 (serial port, FreeBSD)
* /dev/cuaU0 (usb-to-serial, FreeBSD)
* /dev/cuau0 (serial port, FreeBSD or HardenedBSD)
* /dev/cuaU0 (usb-to-serial, FreeBSD or HardenedBSD)
* /dev/tty.usbmodem1112421 (usb-to-serial, macOS)
* COM1, COM2, ... (Windows)

@ -38,7 +38,7 @@ The main differences between an embedded image and a full image are:
+-----------------------+-----------------------+
| Embedded | Full |
+=======================+=======================+
| Uses NanoBSD | Uses FreeBSD |
| Uses NanoBSD | Uses HardenedBSD |
+-----------------------+-----------------------+
| Writes to RAM disk | Writes to local disk |
+-----------------------+-----------------------+
@ -106,7 +106,7 @@ to get the public key from include:
* https://opnsense.org/blog/
* https://github.com/opnsense/changelog/tree/master/doc
* https://lists.opnsense.org/pipermail/announce/ (also available via mail so your HTTP(S) is not intercepted)
* https://pkg.opnsense.org (/<FreeBSD version & archtecture>/<release version>/sets/changelog.txz) (lands signed and verified in the GUI of the running software)
* https://pkg.opnsense.org (/<HardenedBSD version & architecture>/<release version>/sets/changelog.txz) (lands signed and verified in the GUI of the running software)
Note that only release announcements with images (typically all major
releases) contain the public key. I.e. 18.7 would have a copy of the public
@ -244,11 +244,11 @@ apply to both. If you need to know more about using the serial interface,
consult the :doc:`serial access how-to<how-tos/serial_access>`.
Write the image to a USB flash drive (>=1 GB) or an IDE hard disk,
either with dd under FreeBSD or under Windows with physdiskwrite
either with dd under FreeBSD, HardenedBSD or under Windows with physdiskwrite
Before writing an (iso) image you need to unpack it first (use bunzip2).
**FreeBSD**
**FreeBSD, HardenedBSD**
::
dd if=OPNsense-##.#.##-[Type]-[Architecture].img of=/dev/daX bs=16k

@ -15,7 +15,7 @@ different options to utilize IPv6. Currently these scenarios are known to work:
.. Warning::
NAT64, IPv4 <-> IPv6 Network address translations, is currently not supported
by FreeBSD.
by HardenedBSD.
-----------
Configuring

@ -12,7 +12,7 @@ interface. Both USB and (mini)PCIe cards are supported.
-----------------
Supported Devices
-----------------
While all devices supported by FreeBSD will likely function under OPNsense their
While all devices supported by HardenedBSD will likely function under OPNsense their
configuration depends on a AT command string that can differ from device to device.
To make thing easier some of these strings are part of a easy selectable profile.

@ -5,7 +5,7 @@ Netflow Export & Analyses
.. image:: images/netflow_analyzer_insight.png
:width: 100%
Netflow is a monitoring feature, invented by Cisco, it is implemented in the FreeBSD
Netflow is a monitoring feature, invented by Cisco, it is implemented in the HardenedBSD
kernel with ng_netflow (Netgraph). Since Netgraph is a kernel implementation it
is very fast with little overhead compared to softflowd or pfflowd.

@ -23,8 +23,8 @@ maintained by a large community.
-----------------------
Relations with OPNsense
-----------------------
OPNsense is build on top of FreeBSD. The aim of the OPNsense team is to stay as
close to the original FreeBSD source as possible. OPNsense can be installed on
OPNsense is build on top of HardenedBSD which is a fork of FreeBSD. The aim of the OPNsense team is to stay as
close to the original HardenedBSD source as possible. OPNsense can be installed on
a standard FreeBSD installation, this way a hosted system can be converted
easily to run OPNsense. A bootstrap script is available to make the installation
process a joy full experience.

@ -8,39 +8,58 @@ HardenedBSD
Introduction
------------
Founded in 2014 by Oliver Pinter and Shawn Webb, HardenedBSD is a
security-enhanced fork of FreeBSD. The HardenedBSD Project is implementing many
exploit mitigation and security technologies on top of FreeBSD.
The project started with Address Space Layout Randomization (ASLR) as an initial
focal point and is now implementing further exploit mitigation techniques.
HardenedBSD is a fork of FreeBSD, founded in 2014, that implements
exploit mitigations and security hardening technologies. The primary
goal of HardenedBSD is to perform a clean-room re-implementation of
the grsecurity patchset for Linux to HardenedBSD.
-----------------
Why Fork FreeBSD?
-----------------
HardenedBSD forked the FreeBSD codebase for ease of development. Prior to
HardenedBSD's founding, Oliver and Shawn worked on separate repositories,
occasionally causing collaboration issues. Unifying the codebases was a natural
step in efficient, effective collaboration between the two individuals.
Two years have passed since the unification of the work and HardenedBSD is
growing faster than ever.
Work on HardenedBSD began in 2013 when Oliver Pinter and Shawn Webb
started working on an implementation of Address Space Layout
Randomization (ASLR), based on PaX's publicly-available documentation,
for FreeBSD. At that time, HardenedBSD was meant to be a staging area
for experimental development on the ASLR patch. Over time, as the
process of upstreaming ASLR to FreeBSD became more difficult,
HardenedBSD naturally became a fork.
HardenedBSD completed its ASLR implementation in 2015 with the
strongest form of ASLR in any of the BSDs. Since then, HardenedBSD has
moved on to implementing other exploit mitigations and hardening
technologies. OPNsense, an open source firewall based on FreeBSD,
incorporated HardenedBSD's ASLR implementation in 2016.
HardenedBSD exists today as a fork of FreeBSD that closely follows
FreeBSD's source code. HardenedBSD syncs with FreeBSD every six hours.
-------------------
HardenedBSD's Goals
-------------------
HardenedBSD aims to implement innovative exploit mitigation and security
solutions for FreeBSD. We will work with FreeBSD and any other FreeBSD-based
project to include our innovations.
HardenedBSD aims to provide the BSD community with a clean-room
reimplementation of the publicly-documented portions of the grsecurity
patchset for Linux.
-------------------
Who is HardenedBSD?
-------------------
HardenedBSD's core team consists of Oliver Pinter and Shawn Webb.
Contributions have been made by many individuals around the globe.
-------------------------
Cooperation with OPNsense
-------------------------
In May 2015, HardenedBSD announced their cooperation with OPNsense.
A HardenedBSD-flavored version of OPNsense is available as of June 2015.
In May 2015, HardenedBSD announced collaboration with OPNSense. A
HardenedBSD-flavored version of OPNsense was published early on as a
proof-of-concept work. As the proof-of-concept proved stable, robust,
and scalable, OPNsense migrated to HardenedBSD with the support of
HardenedBSD's core team.

Loading…
Cancel
Save