brnrd - Bernard Spil

Enabling the new ML-DSA44 Ed25519 hybrid Post-Quantum Cryptography host and client keys

Hoping that you won't be struggling like I have, some quick notes on newsyslog

My HomeAssistant install was up and running, but I was not happy with it.

Now that PkgBase is really supported, it is time to revisit my pkgbase use for the host and jails.

Nextcloud PHP upgrade to 8.5, MariaDB upgrade to 12.3 and MySQL SSL issue.

When you're using (many) jails on FreeBSD, you may end up consuming a lot of storage for the pkg(8) cache.

My HomeAssistant install was up and running, but I was not happy with it.

Valkey should be a one-to-one Redis replacement, but there were some snags.

Simplify and modernize my current setup for identity and authentication

Setting up IoTs ("S" for security) at home, apparently HomeAssistant is the tooling to use.

Setting up IoTs ("S" for security) at home, wanted to add Zigbee too.

Rustls 0.15.0 was released earlier this week, adding PQC algorithms.

OpenSSL 3.5 is soon to be released, and brings new Post-Quantum Cryptographic protocols.

Maintaining an up-to-date FreeBSD base with packages.

Decided to build my own forced airflow solution for my convectors around the house.

Updating SSH to use Post-Quantum Crypography, and using Windows Hello as Security-Key

The first Post-Quantum Cryptography algorithms have been selected by NIST.

mod_md is still by far the simplest way to add LetsEncrypt signed certificates to your Apache httpd server.

A memory safe alternative to the OpenSSL based Apache module providing https capability.

By default, Windows Server will generate a self-signed certificate for the Remote Desktop Service.

Everything you need to connect to an SSH server is available in Windows!

Wanted to have a personal, self-hosted git service (ssh-only) that I can use without worrying about keys stored in the repo.

Part 1 of a series demonstrating building a templated Apache httpd configuration to host multiple websites: the basics.

Objective is to create a disposable, minimal Alpine Linux install in FreeBSD bhyve that allows you to run docker containers.

Update on how I get the telemetry from my Goodwe Photovolaic inverter to PVOutput

Many things don't have proper installation docs any longer and are only provided as Docker (or podman) images.

Secure usage of sudo without passwords

The only IoT device in my LAN is the inverter (ca. 400V DC to 230V@50Hz AC) for my solar panels.

After switching from SpamAssassin to rspamd for spam classification I wasn't completely happy yet with the separation I had achieved.

mod_md is by far the simplest way to add LetsEncrypt signed certificates to your Apache httpd server.

Gandi.net doesn't support DynDNS but does have a DNS API.

This should be the final and my definitive guide on using Let's Encrypt and acme-client on FreeBSD.

Recently on Twitter I said I was using jx to run programs in my FreeBSD jails and there were requests to create a port for them.

During the last EuroBSDCon in Belgrade I took maintainership of the OpenSSL port in FreeBSD.

Today I realized that I had actually fixed all outstanding tasks I had for "LibreBSD".

This page describes a setup to renew LetsEncrypt certificates with the LetskEncrypt client which has LibreSSL/libtls as its only dependency, uses chroots and drops privileges.

I've used PasswordSafe for many, many years to keep my passwords safe and make it easy to use unique passwords whereever I can.

HardenedBSD ran an exp-run with LibreSSL in base.

One of the features I've been asked for repeatedly to add to MariaDB is Galera Clustering support.

Wasted a whole weekend creating an additional script to download data from Goodwe's portal and uploading it to PVOutput.

Today's update to LibreBSD is an update tested on FreeBSD 10.3-RC2 and adds libtls and the TLS capable netcat implementation from the LibreSSL distribution.

(How-to Guide) How to replace OpenSSL with LibreSSL in FreeBSD 10.3.

Part 2 of a multi/many part series on building FreeBSD base with LibreSSL as libcrypto/libssl provider, buildworld phase.

With last week's OpenSSL vulnerabilities questions came up when LibreSSL would replace OpenSSL in FreeBSD base.

Something good happened for IT security, OpenSSL disabled SSLv2 by default in the latest release 1.0.2g.

As announdes about a week ago, today a new load of OpenSSL vulnerabilities is disclosed.

Just for fun I decided to port OpenSSL 1.1.0 pre3 (alpha) for FreeBSD.

Coming Tuesday (1 March 2016) OpenSSL will release new versions that fix multiple vulnerabilities, at least one of them rated "High".

OpenSSL 1.1.0 adds configuration options and uses saner defaults

I'll be speaking at BSDCan 2016 on the topic of OpenSSL and LibreSSL in FreeBSD.