LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   *BSD (https://www.linuxquestions.org/questions/%2Absd-17/)
-   -   How do I switch HardenedBSD from OpenSSL to LibreSSL? (https://www.linuxquestions.org/questions/%2Absd-17/how-do-i-switch-hardenedbsd-from-openssl-to-libressl-4175681296/)

noojgog 08-31-2020 03:26 AM

How do I switch HardenedBSD from OpenSSL to LibreSSL?
 
One of the things I like about OpenBSD is its inclusion of LibreSSL
to replace OpenSSL. According to Void Linux, it's a lot more secure.
https://en.wikipedia.org/wiki/Heartbleed

However, upon looking up HardenedBSD, I find it a lot more secure
in areas where OpenBSD isn't.
https://hardenedbsd.org/content/easy-feature-comparison

Thanks to the magic of Open Source software, there's gotta be a way to
replace OpenSSL and implement LibreSSL in my HardenedBSD installation.

Right?

business_kid 09-06-2020 01:32 PM

Quote:

Originally Posted by noojgog (Post 6161052)
One of the things I like about OpenBSD is its inclusion of LibreSSL
to replace OpenSSL. According to Void Linux, it's a lot more secure.
https://en.wikipedia.org/wiki/Heartbleed

However, upon looking up HardenedBSD, I find it a lot more secure
in areas where OpenBSD isn't.
https://hardenedbsd.org/content/easy-feature-comparison

Thanks to the magic of Open Source software, there's gotta be a way to
replace OpenSSL and implement LibreSSL in my HardenedBSD installation.

Right?

Maybe. I was on a hardened system once - HLFS. I compiled the last version, as it happens. On the next version, you couldn't get gcc to compile with key patches applied. It eventually folded over that problem. Once you say 'hardened,' you're dealing with a hardened kernel, Glibc, gcc, etc. All your programs will have been built with on a toolchain with patches applied for the hardened system. You have to have the hardened toolchain before you can build anything.

BSD was paranoid to begin with, so I shudder to think how paranoid it probably is now. Get on the hardened bsd mailing list/forum, and post there. Failing that, grab/get a hardened toolchain and try compiling it. It's probably safer not to deviate from the straight & narrow with any hardened system. Look up any options; I had to specify certain non-standard things when compiling

cynwulf 09-08-2020 02:31 AM

Tbere is an existing freebsd port. Maybe have a look? https://www.freshports.org/security/libressl/


All times are GMT -5. The time now is 12:15 PM.