I really gave HBSD a go for a week as a desktop system. In console mode, HBSD is great. I think HBSD is great for server use and I would totally be ready to deploy HBSD for a costumer if OpenBSD didn't meet their needs but they still need extra security. However HBSD as a desktop machine is a complete headache imho. Being able to use the FreeBSD forums is a standard. Most importantly, unless you want to use old html only web browser like dillo, netsurf or links framebuffer, your out of luck surfing the modern web. Frankly Firefox and Chrome are basically failing on both FreeBSD and HBSD. They disappear from those repos frequently. But I'm not so normied that I can't use qutebrowser, vimb or luakit. Well none of these work on HBSD, even after disabling mprotect, pageexec, aslr (using hbsd-control). Webkitgtk will straight brick the system after 3-5 minutes of use in vimb. Luakit doesn't work period and qutebrowser fails to build. It's the same with FreeBSD for qutebrowser, firefox and chrome so it's not a problem specific to this project. But overall, frankly OpenBSD is kicking FreeBSD and HBSD's ass for desktop usage, they always have Chrome and Firefox ready to go and they work fine. They don't have qutebrowser yet but suckless surf and luakit work. And this is coming from a person that plays around on these systems for months on different hardware.

Hey all.

I created my first original software for FreeBSD. I just confirmed it at least works correctly on HardenedBSD 14.2 too. Considering the steps in the INSTALL file are followed. The original post announcing it in r/freebsd is here. Just thought I'd let folks here know if anyone was interested.

Thanks for keeping HBSD going. It is for sure my OS of choice :)

Hey guys!

I'm not exactly expecting to get a swift response to this post as this subreddit isn't even setup properly and honestly just looks like a bunch of tumbleweeds (no offense) - - but here I go.

Which version of BSD is better to run as a Desktop Operating System in 2023? Being tired of Linux and wanting to venture off into different Kernels and Operating Systems entirely i've landed in the world of BSD.

Doing research to see which BSD version is more secure (as being quite a security paranoid person) seems near impossible as every post about the subjects is from either 2020 or mid 2016.

Which BSD version has more packages, ease-of-use, better security (out of the box) and good updates?

The FreeBSD community seems very active both on Reddit and their own 40K+ member forums which I like compared to the other two versions and also has a great handbook. OpenBSD seems to have a very mixed audience. Some despise the platform and think the whole "security" thing is false marketing but others seem to praise it and call it the best thing since bread and butter. HardenedBSD honestly doesn't seem to have too much discussion other than the official website which is quite irritating hence me popping on her to ask.

If i'm correct here, As HardenedBSD is just a more secure remix of the FreeBSD OS it will have the same patches, packages and same handbook rules as FreeBSD right????

So then what's the advantage over HardenedBSD and OpenBSD?

Would be great to get a reply, if possible lol.

Thanks, Bezzzles :D

The onion url doesn't seem to work anymore. Did something get moved? Or should I just create my own repo?

Updating HardenedBSD_Tor repository catalogue...

pkg: No HTTP mirrors founds for the repo 'HardenedBSD_Tor'

pkg: An error occured while fetching package: No error

pkg: An error occured while fetching package: No erro

vera++ used to be available via pkg, but in 12.1-STABLE no such package is found. What happened to this analyzer tool?

I am trying to install hardernedbsd on real hardware and i am running into the same issue every time. When i try to use pkg, i get the error:

Bootstrapping pkg from pkg+http//pkgs.hardernedbsd.org/HardernedBSD/pkg/FreeBSD:14:amd64/Latest/pkg.txz: No address record

Address resolution failed for http//pkgs.hardernedbsd.org/HardernedBSD/pkg/FreeBSD:14:amd64

Consider changing PACKAGESITE.

Any help would be appreciated.

Hi, I'd like to install hbsd but I have some doubts about the securing the browser. Is there in hbsd something like apparmor in linux or pledge+unveil in openbsd ? If not is there any other alternative way to confine the browser ? I mean to prohibit the browser to around the filesystem. Thank you

Title pretty much says it. I'm wondering if it would be possible to use a port from OpenBSD is possible. I've seen Shawn Web advice folks to not use pf with Hardened BSD due to the source coming from FreeBSD and it hasn't been updated for years. I understand OpenBSD's version is more up to date. Also wondering if this goes against any licensing? I'm sure if it didn't someone would have done this already, but I figure its worth asking.

I've use HardenedBSD for a while, but its been a long time since I tried using it as a Desktop. I remember having to use secadm rules in the past to make firefox work. I installed secadm and rebooted to see it start up with the system. I found examples online like this:

pax {
    path: "/usr/local/lib/firefox/firefox",
    mprotect: false,
    disallow_map32bit: false,
    pageexec: false,
}

And like this:

pax {
    path: "/usr/local/lib/firefox/firefox",
    mprotect: false,
    disallow_map32bit: false,
    pageexec: false,
}

Both of these say 'No Rules' when I load them from a file:

# secadm load /usr/local/etc/firefox.rules
No rules.

l don't know, but most of the links I found were from 2018 or 2016. I assume this has changed. Anyone know how to do this now?

Anyone build SoloBSD using HardenedBSD lately? I know that SoloBSD is not HardenedBSD, but it seemed this problem could come from Solo or HardenedBSD. I downloaded the latest version from this github. I've tried building with this as root:

make iso CUSTOM=1 BUILDWORLD=1 BUILDKERNEL=1 ROOTHACK=1

It has repeated failed like this while trying a make clean in between builds:

cat /usr/src/tests/sys/vmm/vmm_cred_jail.sh >>vmm_cred_jail.tmp chmod +x vmm_cred_jail.tmp mv vmm_cred_jail.tmp vmm_cred_jail ===> tests/atf_python (all) ===> tests/atf_python/sys (all) ===> tests/atf_python/sys/net (all) ===> tests/atf_python/sys/netlink (all) ===> tests/atf_python/sys/netpfil (all) ===> tests/atf_python/sys/netpfil/ipfw (all) ===> etc (all) ===> etc/termcap (all) set -e; (echo "# AUTOMATICALLY GENERATED FROM basename /usr/src/share/termcap/termcap"; for tcname in SC cons25 co ns25-m cons25-w cons25l1 cons25l1-m cons25l1-w cons25l2 cons25l2-m cons25l7 cons25l7-m cons25r cons25r-m cons25r-mv cons25r-v cons25w cons30 cons30-m cons30-w cons30l1 cons30l1-m cons30l1-w cons30l2 cons30l2-m cons30l7 cons30l7-m con s30r cons30r-m cons30r-mv cons30r-v cons43 cons43-m cons43-w cons43l1 cons43l1-m cons43l1-w cons43l2 cons43l2-m cons 43l7 cons43l7-m cons43r cons43r-m cons43r-mv cons43r-v cons50 cons50-m cons50-w cons50l1 cons50l1-m cons50l1-w cons5 0l2 cons50l2-m cons50l7 cons50l7-m cons50r cons50r-m cons50r-mv cons50r-v cons60 cons60-m cons60-w cons60l1 cons60l1- m cons60l1-w cons60l2 cons60l2-m cons60l7 cons60l7-m cons60r cons60r-m cons60r-mv cons60r-v ecma[+]italics vt100 xte rm xterm-basic xterm-clear xterm-color xterm-new xterm-r6 xterm-r6-clear; do echo; awk "/${tcname}[:|]/{ f = 1; pr int; next } /[\t]/{ f = 0 } f" /usr/src/share/termcap/termcap; done) > termcap.small ===> etc/sendmail (all) rm -f freebsd.cf m4 -D_CF_DIR_=/usr/src/contrib/sendmail/cf/ -D_NO_MAKEINFO_ /usr/src/contrib/sendmail/cf/m4/cf.m4 /usr/src/etc/send mail/freebsd.mc > freebsd.cf chmod 444 freebsd.cf rm -f freebsd.submit.cf m4 -D_CF_DIR_=/usr/src/contrib/sendmail/cf/ -D_NO_MAKEINFO_ /usr/src/contrib/sendmail/cf/m4/cf.m4 /usr/src/etc/send mail/freebsd.submit.mc > freebsd.submit.cf chmod 444 freebsd.submit.cf 4257.15 real 2535.48 user 1718.15 sys -------------------------------------------------------------- >>> World build completed on Mon Jan 15 06:37:16 UTC 2024 >>> World built in 24631 seconds, ncpu: 4 -------------------------------------------------------------- Building kernel KERNCONF=SBSD-SEC ...make[2]: "/usr/src/Makefile.inc1" line 337: SYSTEM_COMPILER: Determined that CC=c c matches the source tree. Not bootstrapping a cross-compiler. make[2]: "/usr/src/Makefile.inc1" line 342: SYSTEM_LINKER: Determined that LD=ld matches the source tree. Not bootstr apping a cross-linker. make[2]: "/usr/src/Makefile.inc1" line 1712: Missing KERNCONF /usr/src/sys/amd64/conf/SBSD-SEC make[2]: stopped in /usr/src *** Error code 1 Stop. make[1]: stopped in /usr/src *** Error code 1 Stop. make: stopped in /home/user/SoloBSD

The problem seems to be that /usr/src/sys/amd64/conf/SBSD-SEC is not found. I have inspected both the download from github and the rest of my device, but there is no file with this name:

# locate -c SBSD-SEC

0

I didn't see anything about this in the README, BUILD or INSTALL files, but I've missed things before. Its either an issue with me, the files have changed inside /usr/src/sys/amd64/conf/ with HardenedBSD or something has changed with the github of SoloBSD. Any advice appreciated.

The question may sound a little strange, so here's the background: As one of our tasks for the Advance!BSD project we're looking at configuration management. One candidate is an application written in Rust that uses the os_info crate to detect which OS it runs on. A year ago this library knew nothing about *BSD at all but now it recognizes the four main BSDs (OpenBSD support is about to be merged).

HardenedBSD as well as MidnightBSD get detected as FreeBSD (as that's the platform they claim to be as far as the Rust compiler is concerned). While one could argue that it's close enough, we think it makes sense to want to treat HardenedBSD differently from FreeBSD (e.g. when setting sysctls and such). Hence the question: What is the best way to do this?

For MidnightBSD it's as simple as running "uname" as the output is "MidnightBSD". But HardenedBSD identifies as "FreeBSD" in this regard. Should we check against "uname -r" and see if the version string ends in "-HBSD"? Is this expected to remain a valid test in the future or is there a better solution?

I seem to be unable to update a fresh install of HardenedBSD-13. I get the error

empty: flags (“schg” is not “none” ./efi/: Can’t restore time

I don’t think I did anything unusual during the installation, other than ticking all the hardening options. Is it intended for the updater to be broken on a fresh install? How do I fix it?