<feed xmlns="http://www.w3.org/2005/Atom"><title>BSD Audit</title><link href="https://bsd-audit.com/atom.xml" rel="self" type="application/atom+xml"/><link href="https://bsd-audit.com/"/><id>https://bsd-audit.com/</id><updated>2026-07-19T20:23:05+00:00</updated><author><name>Michael Boelen</name><email>michael.boelen@cisofy.com</email></author><rights>Copyright 2026, Michael Boelen</rights><entry><title>Latest changes</title><link href="https://bsd-audit.com/website/latest-changes/"/><id>https://bsd-audit.com/website/latest-changes/</id><author><name>Michael Boelen</name></author><published>2023-05-13T00:07:52+02:00</published><updated>2026-07-19T20:23:05+00:00</updated><content type="html">&lt;p>This page contains the most recent changes to the blog.&lt;/p>
</content></entry><entry><title>Sustainable web design</title><link href="https://bsd-audit.com/sustainable-web-design/"/><id>https://bsd-audit.com/sustainable-web-design/</id><author><name>Michael Boelen</name></author><published>2026-07-19T14:11:38+00:00</published><updated>2026-07-19T14:11:41+00:00</updated><content type="html"><![CDATA[<p>We want our blog to provide much value to our readers. With our origins in open source, we share almost everything that we know. At the same time we want it to be a good experience, so easy to read, quick to load, and not invading any privacy. For that reasons, we made some extreme decisions a while back. No tracking and no cookies are just a few examples. With a changing climate we want to go a few steps further. So while overhauling this blog in 2024, we also focused on being more sustainable and applying eco-friendly measures wherever we can.</p>
<h2 id="focus-on-reducing-cpu-cycles">Focus on reducing CPU cycles</h2>
<p>Every action costs an amount of energy, from development up to you as reader looking at this page. Let&rsquo;s have a look at some of the following measures that we implemented:</p>
<ul>
<li>Static website generator</li>
<li>Reduce number of systems</li>
</ul>
<h3 id="static-generator">Static generator</h3>
<p>This website uses <a href="https://gohugo.io/">Hugo</a><img class="m-l-sm" src="/images/icons/up-right-from-square.svg" height="16" width="16" loading="lazy" alt="External link" title="This link points to an external source">

  , a static website generator, to create and publish the website.</p>
<h3 id="development-systems">Development systems</h3>
<p>Our development systems are also optimized to limit their CPU usage, including running tasks on low-energy devices. Where possible we consolidated systems, unless this was in conflict with security principles that we apply. Some higher risk environments will be separated, but otherwise consolidation is one of the ongoing objectives.</p>
<h2 id="reducing-bandwidth">Reducing bandwidth</h2>
<ul>
<li>System fonts</li>
<li>Compressing assets</li>
<li>Increase caching</li>
<li>Rate-limit bots</li>
<li>Block outdated or misbehaving systems</li>
<li>WebP images</li>
</ul>
<h3 id="using-default-system-fonts">Using default system fonts</h3>
<p>This blog now uses system fonts only. By using a so-called font stack that only contains fonts that are commonly available, readers will get typically a font that is optimized for reading text. The additional benefit is speed, as no external font has to be downloaded and processed.</p>
<h3 id="compressing-assets">Compressing assets</h3>
<p>Most file formats can be compressed. The result is much smaller data transfers, at the cost of some CPU cycles to compress and decompress. In the past we let our web server compress almost all files (except images) using Gzip compression. That means that the web server was doing this so called &lsquo;on-the-fly&rsquo; compression all day. Even for files that were requested thousands of times a day. Nowadays we pre-compress all files and then offer it when a client supports it. For maximum coverage we now support both Brotli and Gzip. This one-time compress action will be done using the best possible compression options, to save bandwidth as much as possible.</p>
<h3 id="increase-caching-possibilities">Increase caching possibilities</h3>
<p>In the past we had somewhat limited possibilities when it came to caching. So with the 2024 overhaul, we simplified the configuration of our web server yet enhanced caching settings. Based on the content type (MIME types), we provided a hint to clients how long they should cache resources. This way less requests have to be made over the long term.</p>
<h3 id="rate-limits">Rate-limits</h3>
<p>With the overhaul we implemented more strict rules when it comes to our bandwidth. Our traffic pool is big, but that doesn&rsquo;t mean we can be more progressive in reducing it further. Clients (including bots) that misbehave, get rate-limited. The response returned is HTTP 429 with a message indicating that rate-limiting was applied. When the client does not resolve their issue, we go a step further and block it. We already saw a lot of tools waste a lot of resources, including bandwidth, CPU cycles, and energy.</p>
<h3 id="blocking-outdated-clients">Blocking outdated clients</h3>
<p>This website was made with the &ldquo;open&rdquo; mindset of the web. Almost any client should be able to connect, as long as it is fairly modern. For that reason, we don&rsquo;t use the most strict protocol set. This way somewhat older systems can still connect. At the same time, clients that are outdated or simply don&rsquo;t support basic protocols or technologies, will be blocked. For example, this website will only allow HTTPS connections. Older TLS versions are disabled, as well as older ciphers. Does your client not support at least HTTP 1.1 and content encoding, chances are big that it won&rsquo;t be allowed. These older clients should be updated, so they support the modern web. The benefit is also that less data is required to retrieve content.</p>
<h3 id="webp-and-svg-for-images">WebP and SVG for images</h3>
<p>Before we used mostly files in JPEG or PNG format. With WebP being introduced in 2010 and available for some time now, most modern browsers support it. Screenshots and other images were converted to WebP and are the preferred resource. Only if the browser does not support it yet, we provide a fallback to PNG or JPEG. Icons and our logo are now Scalable Vector Graphics (SVG), which provides a much sharper result and a reduced file size.</p>
<h2 id="more-green-energy-in-the-mix">More green energy in the mix</h2>
<p>With the development of the blog, we also looked at how we can increase the amount of green energy. This is energy from renewable sources, including our own solar panels. That is also why we moved some tasks to during the afternoon, when the most solar energy is available, such as some backup tasks.</p>
<h2 id="reducing-data-storage">Reducing data storage</h2>
<p>Every website will quickly grow when it comes to storage on the disk or in a database. Although we no longer use a database engine, the storage is still a thing. For that reason, we simplified our backup strategy, including the usage of snapshots. Now we can go back longer in time, while reducing the overall storage needs. Also, the backup structure has been simplified, as everything is now in one directory together. With WordPress this was a combination including the WordPress software, plugins, templates, images on the disk, and the database export. With a much simpler disk structure, it is easier to replicate data or make a standalone copy. For example, for disaster recovery we still want to have multiple types of backups and in different locations.</p>
<h3 id="duplicate-data-reduction">Duplicate data reduction</h3>
<p>The backups above are the only exception now when it comes to duplicate data. While building up our internal website structure, we removed as much as possible to limit data duplicates. So we don&rsquo;t have a development, test, and production environment for the website. One system does the development and testing, the output (generated by Hugo) is then synced to production system. Obviously with an optimized method to reduce time, bandwidth, and CPU cycles.</p>
<h2 id="user-experience-design-ux">User Experience Design (UX)</h2>
<p>We want the best possible experience when browsing our website, so we applied multiple measures to improve the blog and its interface.</p>
<ul>
<li>User interface</li>
<li>Focus on performance</li>
<li>Reduce errors in HTML and CSS</li>
<li>Limit JavaScript usage</li>
<li>Error handling</li>
</ul>
<h3 id="user-interface">User interface</h3>
<p>When redesigning the blog, we applied the Mobile First approach. Articles should be readable (and fast) on a mobile phone, so all clutter was removed. A simple header, content area, and footer is what remains. On larger screens, the content area will be capped to ensure that the article is still easy to read.</p>
<h3 id="html-and-css">HTML and CSS</h3>
<p>Using HyperText Markup Language (HTML) and Cascading Style Sheets (CSS) most of the pages are formatted and styled. This blog uses HTML5 and we tried to minimize errors in the syntax. This way it should show correctly on as many devices as possible.</p>
<h3 id="limited-use-of-javascript">Limited use of JavaScript</h3>
<p>JavaScript allows developers to use powerful events within a website. Our focus is on getting articles clearly on your screen without JavaScript when possible. The only exception is our search engine, that runs on the client system itself. It requires some logic processing that by default HTML does not support. For that single page we tried to find a small library that allows you to search in all articles, without any overhead on our systems.</p>
<h3 id="performance-of-the-pages">Performance of the pages</h3>
<p>Using the proper HTML and CSS syntax is a good start, but not enough. Keeping it as small as possible decreases the overhead on the client. After all, there is less to process, resulting in pages that load and show quicker. So where we can, we stripped out useless HTML tags and don&rsquo;t use a CSS framework. Instead, we only add CSS when needed for proper display. When adding new pieces, we look directly on how to consolidate and decrease overhead. In this case there is additional value in it, as all CSS is available in a &lt;style&gt; tag. The browser does not have to do an extra HTTP request, but can directly start processing the page. This helps with speeding up the page rendering. For those readers active in web design, magic words like Above the Fold, First Paint, First Contentful Paint (FCP), and Largest Contentful Paint (LCP). In simplified terms that would mean that the shorter the time it takes to achieve these, the quicker a website loads and shows on your screen.</p>
<h3 id="error-handling">Error handling</h3>
<p>If a page does not exist (404), we point you to the search engine on the website and a link to main page. This way you can easily navigate to a point that works and might help to find you the information that you were looking for.</p>
<p>For search engines we started to respond to outdated pages or assets with HTTP 410 (Gone). This way we want to signal them that they should not retry, and instead focus on pages that do exist.</p>
<h2 id="questions-or-suggestions">Questions or suggestions?</h2>
<p>Do you have any feedback for our initiative to make this blog more eco-friendly? Let us <a href="/contact/">know</a>!</p>
]]></content></entry><entry><title>Show memory information on OpenBSD</title><link href="https://bsd-audit.com/openbsd/memory-information-on-openbsd/"/><id>https://bsd-audit.com/openbsd/memory-information-on-openbsd/</id><author><name>Michael Boelen</name></author><published>2026-07-15T20:44:45+00:00</published><updated>2026-07-16T14:19:06+00:00</updated><content type="html"><![CDATA[<p>Finding memory information and usage on OpenBSD requires a few commands and the right places to look. If you are used to Linux, then commands like <code>free</code> are no longer available. Let&rsquo;s have a look at memory details on OpenBSD.</p>
<h2 id="memory-capacity">Memory capacity</h2>
<p>One of the easiest methods to find the memory sizes is by using the output of <code>dmesg</code>, which will include hardware information. Filter out the lines that are related to memory and the total and available amount of memory will be displayed.</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-plaintext" data-lang="plaintext"><span class="line hl"><span class="cl"># dmesg | grep -i mem
</span></span><span class="line"><span class="cl">real mem = 1056952320 (1007MB)
</span></span><span class="line"><span class="cl">avail mem = 998526976 (952MB)
</span></span></code></pre></div><p>Another option is using <code>sysctl</code> and retrieve the key <strong>hw.physmem</strong> to find the</p>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-plaintext" data-lang="plaintext"><span class="line hl"><span class="cl"># sysctl hw.physmem
</span></span><span class="line"><span class="cl">hw.physmem=1056952320
</span></span></code></pre></div><h2 id="memory-usage">Memory usage</h2>
<div class="highlight"><pre tabindex="0" class="chroma"><code class="language-plaintext" data-lang="plaintext"><span class="line hl"><span class="cl"># top -d 1
</span></span><span class="line"><span class="cl">load averages:  0.11,  0.09,  0.08    mail.example.org 14:09:32
</span></span><span class="line"><span class="cl">58 processes: 1 running, 56 idle, 1 on processor  up 11 days 02:14:21
</span></span><span class="line"><span class="cl">CPU states:  0.0% user,  0.0% nice,  0.1% sys,  0.0% spin,  0.9% intr, 99.0% idle
</span></span><span class="line"><span class="cl">Memory: Real: 286M/623M act/tot Free: 338M Cache: 192M Swap: 9296K/1264M
</span></span><span class="line"><span class="cl">
</span></span><span class="line"><span class="cl">  PID USERNAME PRI NICE  SIZE   RES STATE     WAIT      TIME    CPU COMMAND
</span></span><span class="line"><span class="cl">56989 _rspamd    2    0  114M   93M sleep     kqread   11:27  0.00% rspamd
</span></span><span class="line"><span class="cl">91511 _redis     2    0   18M 4588K sleep     kqread    7:34  0.00% redis-server
</span></span><span class="line"><span class="cl"> 1803 _rspamd    2    0   98M   79M sleep     kqread    6:58  0.00% rspamd
</span></span><span class="line"><span class="cl">33019 _unwind    2    0   16M   21M sleep     kqread    2:48  0.00% unwind
</span></span><span class="line"><span class="cl">51184 _rspamd    2    0   62M   29M sleep     kqread    2:06  0.00% rspamd
</span></span><span class="line"><span class="cl">70802 www        2    0 2488K 5536K idle      kqread    0:56  0.00% httpd
</span></span><span class="line"><span class="cl">83309 www        2    0 2508K 5520K idle      kqread    0:55  0.00% httpd
</span></span><span class="line"><span class="cl">29351 www        2    0 2504K 5532K idle      kqread    0:54  0.00% httpd
</span></span><span class="line"><span class="cl">94015 root       2    0   48M 5560K sleep     kqread    0:29  0.00% rspamd
</span></span><span class="line"><span class="cl">19307 _ntp       2  -20 1172K 1248K sleep     kqread    0:12  0.00% ntpd
</span></span><span class="line"><span class="cl">81934 james     28    0 1888K 3252K run       -         0:09  0.00% sshd-session
</span></span><span class="line"><span class="cl">31135 _pflogd    4    0 1016K  928K sleep     bpf       0:07  0.00% pflogd
</span></span><span class="line"><span class="cl">25823 _unbound   2    0   13M   13M idle      kqread    0:07  0.00% unbound
</span></span><span class="line"><span class="cl">73436 _unwind    2    0 2492K 3484K idle      kqread    0:06  0.00% unwind
</span></span><span class="line"><span class="cl">18631 root       2    0 1140K 1124K idle      kqread    0:04  0.00% cron
</span></span><span class="line"><span class="cl"> 3003 _syslogd   2    0 1492K 1460K sleep     kqread    0:03  0.00% syslogd
</span></span><span class="line"><span class="cl">76375 _smtpd    10    0   46M 4740K sleep     thrslee   0:03  0.00% filter-senderscore
</span></span><span class="line"><span class="cl">28284 _smtpd     2    0 5120K 7896K idle      kqread    0:01  0.00% smtpd
</span></span></code></pre></div>]]></content></entry><entry><title>About</title><link href="https://bsd-audit.com/about/"/><id>https://bsd-audit.com/about/</id><author><name>Michael Boelen</name></author><published>2026-07-15T20:38:09+00:00</published><updated>2026-07-15T20:38:36+00:00</updated><content type="html"><![CDATA[<p>If you are interested in BSD, this is the place for you. It&rsquo;s a sister blog of <a href="https://linux-audit.com/">Linux Audit</a><img class="m-l-sm" src="/images/icons/up-right-from-square.svg" height="16" width="16" loading="lazy" alt="External link" title="This link points to an external source">

   :-)</p>
<h2 id="goals">Goals</h2>
<p>Our goal is to write high-quality content and make it freely available. This way you can use it to secure your systems. Missing a particular subject on the blog or found something that is relevant? Let us <a href="/contact/">know</a>!</p>
<h2 id="who-is-writing">Who is writing?</h2>
<p>Many of the articles are written by security specialist <a href="https://michaelboelen.com/">Michael Boelen</a><img class="m-l-sm" src="/images/icons/up-right-from-square.svg" height="16" width="16" loading="lazy" alt="External link" title="This link points to an external source">

  . Michael is a security developer and founder of CISOfy. He covers topics within Linux security, from system hardening to compliance and regulations.</p>
<h2 id="about-cisofy">About CISOfy</h2>
<p>This blog is sponsored by <a href="https://cisofy.com/">CISOfy</a><img class="m-l-sm" src="/images/icons/up-right-from-square.svg" height="16" width="16" loading="lazy" alt="External link" title="This link points to an external source">

  . Resources are invested into this blog to make BSD and Linux security accessible to a wider audience, from system administrators to auditors and developers.</p>
<h2 id="feedback">Feedback</h2>
<p>Your comments, ideas, and feedback are welcome! If there is a particular subject you want to see covered in an article, then contact us. Please send us an email at blog @ cisofy.com.</p>
<h2 id="about-cisofy-1">About CISOfy</h2>
<h3 id="lynis">Lynis</h3>
































<figure>
    <picture>
      <source srcset="images/lynis-screenshot-800x600.webp" type="image/webp">
<img 
  sizes="(min-width: 35em) 1200px, 100vw"
  srcset='
  
    /about/images/lynis-screenshot-800x600_hu_e6c5837968eabfec.png 500w
  
  
    , /about/images/lynis-screenshot-800x600_hu_d9af1e875f50d54c.png 800w
  
  
  '
   src="/about/images/lynis-screenshot-800x600.png"
 alt="Lynis (Linux/Unix auditing tool) screenshot" loading="lazy">
    </picture>
    
    <figcaption>
      <p><i class="caption">Screenshot of a Unix security audit performed with Lynis.</i></p>
    </figcaption>
    
</figure>

<p>Lynis is a battle-tested technical security <a href="https://cisofy.com/lynis/">audit tool</a><img class="m-l-sm" src="/images/icons/up-right-from-square.svg" height="16" width="16" loading="lazy" alt="External link" title="This link points to an external source">

  . It is <a href="https://github.com/CISOfy/lynis/">open source</a><img class="m-l-sm" src="/images/icons/up-right-from-square.svg" height="16" width="16" loading="lazy" alt="External link" title="This link points to an external source">

  , freely available, and used by system administrators all over the world. Other users include IT auditors, security professionals like pentesters. Lynis can also be used as a client component in the Lynis Enterprise solution.</p>
<h3 id="lynis-enterprise-suite">Lynis Enterprise Suite</h3>
<p>For those who maintain more than 10 systems, there is the Lynis Enterprise Suite. It is much more than just Lynis. It includes a central management interface, additional plugins for Lynis, reporting capabilities, a custom implementation guide and more helpful information. For example, it contains extended information regarding each security control. Besides that, it will show you how to solve a finding, manually or with ready-to-use hardening snippets.</p>
]]></content></entry><entry><title>Contact details</title><link href="https://bsd-audit.com/contact/"/><id>https://bsd-audit.com/contact/</id><author><name>Michael Boelen</name></author><published>2026-07-15T20:35:30+00:00</published><updated>2026-07-15T20:35:51+00:00</updated><content type="html"><![CDATA[<p>Want to share feedback or just want to know more about a particular article or topic? There are a few ways to get in contact.</p>
<ul>
<li>Mastodon: <a href="https://mastodon.social/@mboelen">mboelen</a><img class="m-l-sm" src="/images/icons/up-right-from-square.svg" height="16" width="16" loading="lazy" alt="External link" title="This link points to an external source">

  </li>
<li>E-mail: <a href="mailto:blog@cisofy.com">blog@cisofy.com</a></li>
</ul>
<h2 id="guest-bloggers">Guest bloggers</h2>
<p>In all the years, no single proposal was received with the intention to create a dedicated article without any commercial incentive. For that reason, guest blog posts are closed till further notice.</p>
]]></content></entry></feed>