I installed FreeBSD, I found the Free part, but where is the BSD?

rdr: I think the BSD is hidden in the kernel mainly, and the base userland. The Ports are a mixed bag

xd

ant-x Create your own AI that consumes all official docs and man pages. Not that hard.

Hello all

how is everyone at 04:47:08 EST

ant-x I wrote this pasted on your comment, you could also add handbook search as well, and you'd have a pretty good FreeBSD knowledge source that's grounded in official docs 0x1eef.github.io/posts/how-to-build-a-man-page-agent

I was looking at network filesystems and got a little despressed when I realised just how insecure it gets

so NFSv4 is "secure" but is rarely used, NFSv3 being the main one in use, but most of the time its on local networks so its fine, ditto smb/cifs

but recently a group of people I know have been having issues sharing files

mainly recordings, and the best way to share them is to upload it to a single network share...

but that opens a massive tin of worms

NFS+wireguard, smb+wireguard, webdav (with it without wireguard, as it has tls encryption)

sshfs also exists, but isn't fun to use if you aren't on Linux or BD

BSD*

NFS support for other OS I am not too sure about, but I know smb and webdav works natively on Windows/MacOS

smb being the best supported, but security concerns, so wireguard is the only real choice here, and then webdav just works (same protocol used for nextcloud network shares for those who are unaware) but it requires importing a module into nginx, which gets annoying as its not always in the repos of many distros

I dont know about freebsd support for any of this shit either...

tl;dr, what do you folks use? If you had to network share over clearnet what would you do?

(has to be normie friendly too)

polarian: NFSv4 is no more secure than NFSv3, both support Kerberos. in NFSv4 you get TLS as well, but that's still pretty uncommon

also no one should be using NFSv3 anymore... the only common implementation i'm aware of that doesn't do NFSv4 is the Windows client, but there's a third-party client (ms-nfs) that does v4

ivy: afaik NFSv3 does not have TLS, NFSv4 supporting TLS makes it somewhat viable to clearnet it

the issue with NFSv4 is nobody fucking uses it

NFSv3 "just works"

ivy: Windows is one major reason for NFSv3's continued use, as you said, no native support, and the average company is hesistant to adopt something not natively supported

i don't think that's accurate... based on questions i see on fs@, more people there are using NFSv4

the Windows server does support v4, it's only the client that doesn't

ivy: yes tech nerds who know a thing or two about security

afaik the industry still uses NFSv3 because "it just works"

also a lot of industry use of NFS is on local networks, not over WAN, thus the lack of encryption is less of an issue

NFSv3 doesn't lack encryption...

I thought it does?

security with NFS is nearly always done with Kerberos - TLS is still not widely used, although i think adoption is increasing

and NFSv3 works fine with Kerberos

ivy: wasn't Kerberos support added in v4 though?

hmmm

no

didn't know that

you can also secure NFS with IPsec, but i've never seen anyone actually do that in practice (but i'm sure someone is)

I did list above wireguard, which I would prefer over IPsec

IPsec is just more complicated, thats all

ivy: also isn't smb better supported than nfs on Windows/MacOS?

I honestly haven't used NFS on a non-unix system

Windows yes, Mac is terrible at both

lol

Apple explicitly states it supports smb though :p

*sigh* whenever Apple enters into a conversation it is never for a good reason :(

also, IPsec can be easier for a large number of systems because you can automatic key negotiation with IKE ... Wireguard doesn't really have a good equivalent to that

sure, but small group of people

wireguard much easier for that :)

ivy: webdav just works though

I know that

but I really hate web

I have seen webdav work on all 3 major os

the annoying thing is you need an nginx module, and httpd (openbsd) doesn't support webdav, so you typically need to run two webservers on OpenBSD for it :/

or use relayd

and correct me if I am wrong but I dont see the nginx dav module within the port tree :/

maybe its within the nginx port as an option

ahhh it is, okay that makes it easier

yeah, I just feel like WebDAV is like that one friend where someone will go "I mean... I guess we could invite WebDAV..." and everyone kinda squirms and goes "yeah, I guess we could..." and tries to look for an excuse not to

and HTTP_DAV is within the default options too, so this is actually piss easy to do on FreeBSD

hodapp: but it just works :p

how do you mount webdav? fuse?

yes

theres a fuse module for it

fusefs-webdavfs

polarian: yet SOMEHOW, no one ever wants to invite WebDAV

yup its a "ugh" moment :p

surprisingly a lot of people I have spoken about webdav with didnt realise you can use nginx to setup webdav, and you DONT need to use nextcloud

and webdav is used a lot with nextcloud as nextcloud struggles to handle big files through its web UI

so you inevitably mount it as a network share

I am glad to have just shitcanned NextCloud some months back

but yeah network sharing seems like a hell of a tin of worms

it was full of things that just never ever quite worked right

ivy's suggestion is what I essentially knew, overlay the protocol with encryption

there's also mod_dav in apache

I was curious if anyone else had some fancy alternative

gbon121: who uses apache anymore?

even little things like wanting to put it behind my reverse proxy with TLS, and most things handle this fine, and NextCloud just goes "NOW YOU JUST HOLD THE FUCK ON" and random things fail left and right

i use apache everywhere, works fine, does everything

ivy: seriously?

I thought nginx killed apache

I haven't seen someone use apache for years :p

so I switched to Immich for photo stuff, and Radicale for CalDAV/CardDAV

polarian: I thought caddy killed nginx

oh there is one issue with nginx webdav though...

hodapp: lol

I dont see caddy much, I know it has a loyal userbase

I set it up internally and the built-in "automagically renews your goddamn certs" support is very very handy

re: issue with nginx webdav, is basic auth

ugh

basic auth is a pain in the arse

I use nginx webdav for a maven repository, as its more simple and lightweight than all the bloated solutions

however the most annoying thing is hashing the user and password, and ensuring not to catch the whitespace in the string

so many userspace commands will insert a \n and you dont want that hashed

the number of times I have forgotten the \n and smashed my head on the desk not understanding why I am getting authentication errors :p

sorry forgotten to remove the \n :p

hodapp: I hate tls cert renewals, always breaks, and I get why people like caddy for that, but when you run email, and irc etc... you end up deploying a different solution anyways...

caddy renewals are useful if you are only doing web

acme.sh used to be good, but in the last 1-2 years its throws errors like crazy, and none of the dns api's I use work

polarian: it's been reliable for me, even for DNS-01 so I can have a wildcard cert for an internal-only subdomain I made

certbot just works, but I dont like how it shits into /etc

I am a fan of OpenBSD's acme-client

sweet and simple

at one point I was doing an internal CA but was just so sick of Apple's dumb rules on custom CAs/certs

but in all honesty I haven't found a good acme solution yet, I am on the verge of writing my own

i wrote my own ACME client using uacme, using GSS-TSIG (Kerberos nsupdate) for dns-01

works pretty well

I use jails and vms a lot, and need to share certs between them, so I have been tempted for years to attempt my own basic acme client, which has a master (the host) and then can distribute certs to jails and vms with some sort of ACL to grant permission to each cert or something

idk, it would make life so much easier, right now I have it scripted

i use ACLs on the DNS server for that

but this requires root to inject the cert into the filesystem of the jail

and I dont like doing that

and for VMs, it has to be done over sftp, and that means all vms MUST run ssh

and thats just annoying

ivy: wdym?

like explain with more depth

im interested

polarian: dns-01 uses TXT records, so i use ACLs to control which hosts can create which txt records

ah right

ivy: your uacme is different than the public uacme?

the well known one

or is it that?

e.g. update-policy { grant EXAMPLE.ORG. krb5-selfsub . TXT; }; means any host can create records for its own hostname

polarian: it uses the normal uacme which is in ports

ivy: oh wow, thats your project?

no, i wrote my own client that *uses* uacme

OHHHHHHHH

mine is security/lfacme

im stupid

:p

I notice sthen has contributed to uacme O.O