• Lengthy article by security expert Richard Bejtlich on how to keep a FreeBSD server up to date
• FreeBSD filesystem encryption by Jacques Manukyan
• How to build a search engine by RootBSD customer Diego Montalvo / BuildaSearch
• … and much more!

Let’s start off by looking at, what we believe is, the biggest difference in the two.
First off, Linux itself is a kernel, not an OS!   Distributions (Red Hat, Debian, Suse and others) provide the installer and bundle lots of other open source software.  There are easily well over 300 different Linux distributions. While this gives you a lot of choices, the existence of so many distributions also makes it difficult to use different distros since they are all a little bit different. Distributions don’t just differ in ease-of install and available programs; they also differ in directory layout, configuration practices, default software bundles, and most importantly the tools and prorcedures for software updates and patches.

FreeBSD is a complete operating system (kernel and userland) with a well-respected heritage grounded in the roots of Unix development. Since both the kernel and the provided utilities are under the control of the same release engineering team, there is less likelihood of library incompatibilities. Security vulnerabilities can also be addressed quickly by the security team. When new utilities or kernel features are added, the user simply needs to read one file, the Release Notes, which is publicly available on the main page of the FreeBSD website.

Now, lets look at performance.
With constant development of both Linux and FreeBSD, performance has come a long way with both.  In many applications, a FreeBSD server will use less RAM than a Linux server running the same applications and load.  FreeBSD’s network performance is also bar none, as one would expect since BSD networking code has been used by many other vendors including Juniper to make the foundation of their network operating system JUNOS.  Companies such as Yahoo!, Qwest, and many others utilize FreeBSD simple because of it’s ability to handle heavy network traffic with high performance and rock solid reliability.

One of the most important issues for an OS today is Security.
FreeBSD supports access control lists (ACLs) and mandatory access control (MAC) modules. The latter is of course accessible only to systems administrators and managers, but it enables small businesses to run networks with fine-grained security measures that apply to subsets of the system exposed to the outside world. UFS V2 has excellent ACL support via extended attributes; you must configure UFS V1 separately if ACLs are a requirement. Both FreeBSD and Linux have very robust packet filtering firewall systems, with FreeBSD’s version including intrusion detection tools.

FreeBSD Ports Collection.
The FreeBSD ports system uses Makefiles laid out in a directory hierarchy so software can be built, installed and uninstalled with the make command. When installing an application, very little (if any) user intervention is required after issuing a beginning command such as make install or make install clean in the ports directory of the desired application. In most cases the software is automatically downloaded from the Internet, patched and configured if necessary, then compiled, installed and registered in the package database. If the new port has needed dependencies on other applications or libraries, these are installed beforehand automatically.  This gives many benefits in being able to easily install software and also customize it as needed.

Most ports are already configured with default options which have been deemed generally appropriate for most users. However, these configuration options can sometimes be changed with the make config command before installation or through an ncurses interface allowing the user to graphically select the desired options.

Each port (or software package) is maintained by an individual person called a port maintainer who is responsible for staying current with the latest software developments. Anyone is welcome to become a port maintainer by contributing their favorite piece of software to the collection, currently there are over 20,000 ports.

In summary, many users find that the FreeBSD operating system is the best Unix OS for a server environment since it is one centrally managed project with consistency through all aspects of the kernel and userland.

Read how to test and update your system in this knowledgebase article.

All new VPS deployments we make as of December 3 will have the necessary updates to mitigate this vulnerability.

RootBSD is pleased to announce that FreeBSD 8.0-RELEASE is now available on all of our Xen VPS Products. If you are an existing customer and need help upgrading to the latest release, please let us know, we will be happy to assist you with the upgrade.

Don’t forget we are still running several promotions on our products page.

First, as a company which provides FreeBSD VPSs running on Xen the support for running FreeBSD as a paravirtualized guest in Xen is of major interest to us. We currently run our VPSs using Xen’s support for full virtualization (known as HVM mode in Xen lingo). This mode allows unmodified guest operating systems to run in Xen and is, most familarly, how Windows is support in Xen. Paravirtualized guests however, are ported to run within the Xen hypervisor, and since the guest is designed to operate in Xen and cooperate with the hypervisor the guest can run much more efficiently and quickly. To our customers the greatest boost in performance will be seen in disk and network throughput so we are eagerly anticipating this support in FreeBSD 8.

By the looks of it there will be other improvements in almost every part of FreeBSD. The ULE scheduler which first appeared in FreeBSD 7.0 and became the default with 7.1 has received a number of improvements which will boost performance particularly for the SMP configurations that ULE was designed to handle. The inclusion of stack-smashing protection also gives FreeBSD an edge in security by protecting the system from a number of common exploits used to attack software vulnerabilities. Light weight kernel threads are also to appear in FreeBSD 8 which will mean that kernel threads will consume less resources and be less resource intensive to create and destroy.

Seems like FreeBSD 8 will be another great release for our favorite operating system. For a look at all the other features planned for FreeBSD 8 see the original post at http://ivoras.sharanet.org/freebsd/freebsd8.html

Official announcement:

http://www.freebsd.org/releases/7.2R/announce.html

Highlights:

• support for fully transparent use of superpages for application memory
• support for multiple IPv4 and IPv6 addresses for jails
• csup(1) now supports CVSMode to fetch a complete CVS repository
• Gnome updated to 2.26, KDE updated to 4.2.2
• sparc64 now supports UltraSparc-III processors

Release Announcement

• The ULE scheduler is now the default in GENERIC kernels for amd64 and i386 architectures. The ULE scheduler significantly improves performance on multicore systems for many workloads.
• Support for using DTrace inside the kernel has been imported from OpenSolaris. DTrace is a comprehensive dynamic tracing framework.
• A new and much-improved NFS Lock Manager (NLM) client.
• Boot loader changes allow, among other things, booting from USB devices and booting from GPT-labeled devices.
• The cpuset(2) system call and cpuset(1) command have been added, providing an API for thread to CPU binding and CPU resource grouping and assignment.
• KDE updated to 3.5.10, GNOME updated to 2.22.3.
• DVD-sized media for the amd64 and i386 architectures

(1) A rewrite of the TTY layer (traditional UNIX interface), making it easier to maintain and extend.
(2) An increase in the kernel memory limit to 6GB.
(3) The introduction of “lightweight” kernel threads that consume less low-level resources.
(4) procstat, a process inspection utility useful for debugging.
(5) Text dumps that extract commonly needed information in the event of a kernel panic as well as reduces trash by not storing the actual dump file.
(6) A new version of the ULE scheduler with additional functionality and performance improvements.
(7) The implementation of “superpages” after an analysis of known issues and a plan for effectively using these large-sized memory pages.
(8) DTrace, a tool developed by Sun, to help debug and profile operating systems.
(9) The network stack visualization project intends to maintain multiple independent instance of networking state, allowing for complete independence between network jails.
(10) A substantial increase in bandwidth due to ECMP routing.
(11) Improvement to the Berkeley Packet Filter, allowing increased efficiency in memory copy operations.
(12) An NFS lock manager in the kernel to improve synchronized file access.
(13) Support for booting from GPT partitions.
(14) bsdlabel extended to a limit of 26 partitions.
(15) User-controllable CPU/IRQ binding and CPU-thread binding with support for CPU sets.

So stay tuned! It looks like FreeBSD is only getting better, and by this time next year we may have even more security and better performance.