Misplaced Pages

#716283

67-608: DirectAccess establishes IPsec tunnels from the client to the DirectAccess server, and uses IPv6 to reach intranet resources or other DirectAccess clients. This technology encapsulates the IPv6 traffic over IPv4 to be able to reach the intranet over the Internet, which still ( mostly ) relies on IPv4 traffic. All traffic to the intranet is encrypted using IPsec and encapsulated in IPv4 packets (if

134-867: A certificate authority , this can be used for IPsec authentication. The security associations of IPsec are established using the Internet Security Association and Key Management Protocol (ISAKMP). ISAKMP is implemented by manual configuration with pre-shared secrets, Internet Key Exchange (IKE and IKEv2), Kerberized Internet Negotiation of Keys (KINK), and the use of IPSECKEY DNS records . RFC 5386 defines Better-Than-Nothing Security (BTNS) as an unauthenticated mode of IPsec using an extended IKE protocol. C. Meadows, C. Cremers, and others have used formal methods to identify various anomalies which exist in IKEv1 and also in IKEv2. In order to decide what protection

201-489: A binary compatibility layer . This is much simpler and faster than emulation ; for example, it allows applications intended for Linux to be run at effectively full speed. This makes BSDs not only suitable for server environments, but also for workstation ones, given the increasing availability of commercial or closed-source software for Linux only. This also allows administrators to migrate legacy commercial applications, which may have only supported commercial Unix variants, to

268-488: A bit more BSD-flavored than SysVish, but it was pretty eclectic. Eric S. Raymond summarizes the longstanding relationship between System V and BSD, stating, "The divide was roughly between longhairs and shorthairs; programmers and technical people tended to line up with Berkeley and BSD, more business-oriented types with AT&T and System V." In 1989, David A. Curry wrote about the differences between BSD and System V. He characterized System V as being often regarded as

335-440: A client that is connected to the Internet directly will use 6to4, but if it is inside a NATed network, it will use Teredo instead. In addition, Windows Server 2012 provides two backward compatibility services DNS64 and NAT64 , which allows DirectAccess clients to communicate with servers inside the corporate network even if those servers are only capable of IPv4 networking. Due to the globally routable nature of IPv6, computers on

402-580: A few incompatible engineering details, although they were conceptually identical. In addition, a mutual authentication and key exchange protocol Internet Key Exchange (IKE) was defined to create and manage security associations. In December 2005, new standards were defined in RFC 4301 and RFC 4309 which are largely a superset of the previous editions with a second version of the Internet Key Exchange standard IKEv2 . These third-generation documents standardized

469-829: A hash, so they cannot be modified in any way, for example by translating the port numbers. A means to encapsulate IPsec messages for NAT traversal {NAT-T} has been defined by RFC documents describing the NAT-T mechanism. In tunnel mode, the entire IP packet is encrypted and authenticated. It is then encapsulated into a new IP packet with a new IP header. Tunnel mode is used to create virtual private networks for network-to-network communications (e.g. between routers to link sites), host-to-network communications (e.g. remote user access) and host-to-host communications (e.g. private chat). Tunnel mode supports NAT traversal. Cryptographic algorithms defined for use with IPsec include: Refer to RFC 8221 for details. The IPsec can be implemented in

536-518: A host-to-host transport mode, as well as in a network tunneling mode. In transport mode, only the payload of the IP packet is usually encrypted or authenticated. The routing is intact, since the IP header is neither modified nor encrypted; however, when the authentication header is used, the IP addresses cannot be modified by network address translation , as this always invalidates the hash value . The transport and application layers are always secured by

603-548: A member of the IPsec protocol suite. It provides origin authenticity through source authentication , data integrity through hash functions and confidentiality through encryption protection for IP packets . ESP also supports encryption -only and authentication -only configurations, but using encryption without authentication is strongly discouraged because it is insecure. Unlike Authentication Header (AH) , ESP in transport mode does not provide integrity and authentication for

670-478: A more modern operating system, retaining the functionality of such applications until they can be replaced by a better alternative. Current BSD operating system variants support many of the common IEEE , ANSI , ISO , and POSIX standards, while retaining most of the traditional BSD behavior. Like AT&T Unix , the BSD kernel is monolithic , meaning that device drivers in the kernel run in privileged mode , as part of

737-427: A native IPv6 connection cannot be established), which means that in most cases, no configuration of firewalls or proxies should be required. A DirectAccess client can use one of several tunneling technologies, depending on the configuration of the network the client is connected to. The client can use 6to4 , Teredo tunneling , or IP-HTTPS , provided the server is configured correctly to be able to use them. For example,

SECTION 10

#1732917169717

804-664: A network encryption device in 1988. The work was openly published from about 1988 by NIST and, of these, Security Protocol at Layer 3 (SP3) would eventually morph into the ISO standard Network Layer Security Protocol (NLSP). In 1992, the US Naval Research Laboratory (NRL) was funded by DARPA CSTO to implement IPv6 and to research and implement IP encryption in 4.4 BSD , supporting both SPARC and x86 CPU architectures. DARPA made its implementation freely available via MIT. Under NRL's DARPA -funded research effort, NRL developed

871-404: A security association is provided for the group, and is duplicated across all authorized receivers of the group. There may be more than one security association for a group, using different SPIs, thereby allowing multiple levels and sets of security within a group. Indeed, each sender can have multiple security associations, allowing authentication, since a receiver can only know that someone knowing

938-658: A security extension for SIPP. This ESP was originally derived from the US Department of Defense SP3D protocol, rather than being derived from the ISO Network-Layer Security Protocol (NLSP). The SP3D protocol specification was published by NIST in the late 1980s, but designed by the Secure Data Network System project of the US Department of Defense . Encapsulating Security Payload (ESP) is

1005-409: A so-called bump-in-the-wire (BITW) implementation of IPsec is possible. When IPsec is implemented in the kernel , the key management and ISAKMP / IKE negotiation is carried out from user space. The NRL-developed and openly specified "PF_KEY Key Management API, Version 2" is often used to enable the application-space key management application to update the IPsec security associations stored within

1072-400: A visiting professor. He helped to install Version 6 Unix and started working on a Pascal implementation for the system. Graduate students Chuck Haley and Bill Joy improved Thompson's Pascal and implemented an improved text editor, ex . Other universities became interested in the software at Berkeley, and so in 1977 Joy started compiling the first Berkeley Software Distribution (1BSD), which

1139-528: Is a discontinued operating system based on Research Unix , developed and distributed by the Computer Systems Research Group (CSRG) at the University of California, Berkeley . Since the original has become obsolete, the term "BSD" is commonly used for its open-source descendants, including FreeBSD , OpenBSD , NetBSD , and DragonFly BSD . BSD was initially called Berkeley Unix because it

1206-407: Is a method of detecting a dead Internet Key Exchange (IKE) peer. The method uses IPsec traffic patterns to minimize the number of messages required to confirm the availability of a peer. DPD is used to reclaim the lost resources in case a peer is found dead and it is also used to perform IKE peer failover. UDP keepalive is an alternative to DPD. The IPsec protocols AH and ESP can be implemented in

1273-409: Is a secure network protocol suite that authenticates and encrypts packets of data to provide secure encrypted communication between two computers over an Internet Protocol network. It is used in virtual private networks (VPNs). IPsec includes protocols for establishing mutual authentication between agents at the beginning of a session and negotiation of cryptographic keys to use during

1340-403: Is also used for both hosts and gateways. However, when retrofitting IPsec the encapsulation of IP packets may cause problems for the automatic path MTU discovery , where the maximum transmission unit (MTU) size on the network path between two IP hosts is established. If a host or gateway has a separate cryptoprocessor , which is common in the military and can also be found in commercial systems,

1407-459: Is constructed and interpreted: The IPsec protocols use a security association , where the communicating parties establish shared security attributes such as algorithms and keys. As such, IPsec provides a range of options once it has been determined whether AH or ESP is used. Before exchanging data, the two hosts agree on which symmetric encryption algorithm is used to encrypt the IP packet, for example AES or ChaCha20 , and which hash function

SECTION 20

#1732917169717

1474-513: Is much more suited to a research environment, which requires a faster file system, better virtual memory handling, and a larger variety of programming languages . Berkeley's Unix was the first Unix to include libraries supporting the Internet Protocol stacks: Berkeley sockets . A Unix implementation of IP's predecessor, the ARPAnet's NCP , with FTP and Telnet clients, had been produced at

1541-510: Is to be provided for an outgoing packet, IPsec uses the Security Parameter Index (SPI), an index to the security association database (SADB), along with the destination address in a packet header, which together uniquely identifies a security association for that packet. A similar procedure is performed for an incoming packet, where IPsec gathers decryption and verification keys from the security association database. For IP multicast

1608-405: Is used to ensure the integrity of the data, such as BLAKE2 or SHA256 . These parameters are agreed for the particular session, for which a lifetime must be agreed and a session key . The algorithm for authentication is also agreed before the data transfer takes place and IPsec supports a range of methods. Authentication is possible through pre-shared key , where a symmetric key is already in

1675-505: The Bullrun program. There are allegations that IPsec was a targeted encryption system. The OpenBSD IPsec stack came later on and also was widely copied. In a letter which OpenBSD lead developer Theo de Raadt received on 11 Dec 2010 from Gregory Perry, it is alleged that Jason Wright and others, working for the FBI, inserted "a number of backdoors and side channel key leaking mechanisms" into

1742-463: The C shell . Some 75 copies of 2BSD were sent out by Bill Joy. A VAX computer was installed at Berkeley in 1978, but the port of Unix to the VAX architecture, UNIX/32V , did not take advantage of the VAX's virtual memory capabilities. The kernel of 32V was largely rewritten to include Berkeley graduate student Özalp Babaoğlu 's virtual memory implementation, and a complete operating system including

1809-655: The IETF standards-track specifications (RFC 1825 through RFC 1827) for IPsec. NRL's IPsec implementation was described in their paper in the 1996 USENIX Conference Proceedings. NRL's open-source IPsec implementation was made available online by MIT and became the basis for most initial commercial implementations. The Internet Engineering Task Force (IETF) formed the IP Security Working Group in 1992 to standardize openly specified security extensions to IP, called IPsec . The NRL developed standards were published by

1876-529: The Simple Network Management Protocol (SNMP) version 2. Authentication Header (AH) is a member of the IPsec protocol suite. AH ensures connectionless integrity by using a hash function and a secret shared key in the AH algorithm. AH also guarantees the data origin by authenticating IP packets . Optionally a sequence number can protect the IPsec packet's contents against replay attacks , using

1943-537: The University of Illinois in 1975, and was available at Berkeley. However, the memory scarcity on the PDP-11 forced a complicated design and performance problems. By integrating sockets with the Unix operating system's file descriptors , it became almost as easy to read and write data across a network as it was to access a disk. The AT&T laboratory eventually released their own STREAMS library, which incorporated much of

2010-481: The application layer , IPsec can automatically secure applications at the internet layer . IPsec is an open standard as a part of the IPv4 suite and uses the following protocols to perform various functions: The Security Authentication Header (AH) was developed at the US Naval Research Laboratory in the early 1990s and is derived in part from previous IETF standards' work for authentication of

2077-583: The sliding window technique and discarding old packets. AH operates directly on top of IP, using IP protocol number 51 . The following AH packet diagram shows how an AH packet is constructed and interpreted: The IP Encapsulating Security Payload (ESP) was developed at the Naval Research Laboratory starting in 1992 as part of a DARPA -sponsored research project, and was openly published by IETF SIPP Working Group drafted in December 1993 as

DirectAccess - Misplaced Pages Continue

2144-540: The "standard Unix." However, he described BSD as more popular among university and government computer centers, due to its advanced features and performance: Most university and government computer centers that use UNIX use Berkeley UNIX, rather than System V. There are several reasons for this, but perhaps the two most significant are that Berkeley UNIX provides networking capabilities that until recently (Release 3.0) were completely unavailable in System V, and that Berkeley UNIX

2211-499: The 9th Edition, which incorporated source code and improvements from 4.3BSD. The result was that these later versions of Research Unix were closer to BSD than they were to System V. In a Usenet posting from 2000, Dennis Ritchie described this relationship between BSD and Research Unix: Research Unix 8th Edition started from (I think) BSD 4.1c, but with enormous amounts scooped out and replaced by our own stuff. This continued with 9th and 10th. The ordinary user command-set was, I guess,

2278-564: The AT&;T code. Within eighteen months, all of the AT&T utilities had been replaced, and it was determined that only a few AT&T files remained in the kernel. These files were removed, and the result was the June 1991 release of Networking Release 2 (Net/2), a nearly complete operating system that was freely distributable. Net/2 was the basis for two separate ports of BSD to the Intel 80386 architecture:

2345-654: The CSRG was dissolved and development of BSD at Berkeley ceased. Since then, several variants based directly or indirectly on 4.4BSD-Lite (such as FreeBSD , NetBSD , OpenBSD and DragonFly BSD ) have been maintained. The permissive nature of the BSD license has allowed many other operating systems, both open-source and proprietary, to incorporate BSD source code. For example, Microsoft Windows used BSD code in its implementation of TCP/IP and bundles recompiled versions of BSD's command-line networking tools since Windows 2000 . Darwin ,

2412-507: The IETF as RFC 1825 through RFC 1827. The initial IPv4 suite was developed with few security provisions. As a part of the IPv4 enhancement, IPsec is a layer 3 OSI model or internet layer end-to-end security scheme. In contrast, while some other Internet security systems in widespread use operate above the network layer , such as Transport Layer Security (TLS) that operates above the transport layer and Secure Shell (SSH) that operates at

2479-491: The IP stack of an operating system . This method of implementation is done for hosts and security gateways. Various IPsec capable IP stacks are available from companies, such as HP or IBM. An alternative is so called bump-in-the-stack (BITS) implementation, where the operating system source code does not have to be modified. Here IPsec is installed between the IP stack and the network drivers . This way operating systems can be retrofitted with IPsec. This method of implementation

2546-576: The NSA compromised IPsec VPNs by undermining the Diffie-Hellman algorithm used in the key exchange. In their paper, they allege the NSA specially built a computing cluster to precompute multiplicative subgroups for specific primes and generators, such as for the second Oakley group defined in RFC 2409. As of May 2015, 90% of addressable IPsec VPNs supported the second Oakley group as part of IKE. If an organization were to precompute this group, they could derive

2613-500: The OpenBSD crypto code. In the forwarded email from 2010, Theo de Raadt did not at first express an official position on the validity of the claims, apart from the implicit endorsement from forwarding the email. Jason Wright's response to the allegations: "Every urban legend is made more real by the inclusion of real names, dates, and times. Gregory Perry's email falls into this category. ... I will state clearly that I did not add backdoors to

2680-579: The OpenBSD operating system or the OpenBSD Cryptographic Framework (OCF)." Some days later, de Raadt commented that "I believe that NETSEC was probably contracted to write backdoors as alleged. ... If those were written, I don't believe they made it into our tree." This was published before the Snowden leaks. An alternative explanation put forward by the authors of the Logjam attack suggests that

2747-541: The System V copyright and the Unix trademark. The USL v. BSDi lawsuit was filed in 1992 and led to an injunction on the distribution of Net/2 until the validity of USL's copyright claims on the source could be determined. The lawsuit slowed development of the free-software descendants of BSD for nearly two years while their legal status was in question, and as a result systems based on the Linux kernel , which did not have such legal ambiguity, gained greater support. The lawsuit

DirectAccess - Misplaced Pages Continue

2814-599: The abbreviation of IPsec to uppercase "IP" and lowercase "sec". "ESP" generally refers to RFC 4303, which is the most recent version of the specification. Since mid-2008, an IPsec Maintenance and Extensions (ipsecme) working group is active at the IETF. In 2013, as part of Snowden leaks , it was revealed that the US National Security Agency had been actively working to "Insert vulnerabilities into commercial encryption systems, IT systems, networks, and endpoint communications devices used by targets" as part of

2881-410: The basis for Apple's macOS and iOS , is based on 4.4BSD-Lite2 and FreeBSD. Various commercial Unix operating systems, such as Solaris , also incorporate BSD code. Starting with the 8th Edition, versions of Research Unix at Bell Labs had a close relationship to BSD. This began when 4.1cBSD for the VAX was used as the basis for Research Unix 8th Edition. This continued in subsequent versions, such as

2948-422: The basis for several open-source operating systems including FreeBSD, OpenBSD, NetBSD, DragonFly BSD, Darwin and TrueOS . These, in turn, have been used by proprietary operating systems, including Apple 's macOS and iOS , which derived from them and Microsoft Windows (since at least 2000 and XP ), which used (at least) part of its TCP/IP code, which was legal. Code from FreeBSD was also used to create

3015-412: The core of the operating system. Several operating systems are based on BSD, including FreeBSD , OpenBSD , NetBSD , MidnightBSD , MirOS BSD , GhostBSD , Darwin and DragonFly BSD . Both NetBSD and FreeBSD were created in 1993. They were initially derived from 386BSD (also known as "Jolix"), and merged the 4.4BSD-Lite source code in 1994. OpenBSD was forked from NetBSD in 1995, and DragonFly BSD

3082-640: The corporate network can also initiate a connection to DirectAccess clients, which allows them to remotely manage (Manage Out) these clients at any time. DirectAccess can be deployed for multiple sites. It allows for a secure encrypted VPN. This is controlled through Group Policies which allows the administrator to maintain a secure network. DirectAccess With Windows Server 2008 R2 or UAG requires: DirectAccess With Windows Server 2012 requires: Smart card certificates, and health certificates for Network Access Protection may be used along with PKI. IPsec In computing , Internet Protocol Security ( IPsec )

3149-601: The early 1970s, the Advanced Research Projects Agency sponsored a series of experimental ARPANET encryption devices , at first for native ARPANET packet encryption and subsequently for TCP/IP packet encryption; some of these were certified and fielded. From 1986 to 1991, the NSA sponsored the development of security protocols for the Internet under its Secure Data Network Systems (SDNS) program. This brought together various vendors including Motorola who produced

3216-453: The entire IP packet . However, in tunnel mode , where the entire original IP packet is encapsulated with a new packet header added, ESP protection is afforded to the whole inner IP packet (including the inner header) while the outer header (including any outer IPv4 options or IPv6 extension headers) remains unprotected. ESP operates directly on top of IP, using IP protocol number 50. The following ESP packet diagram shows how an ESP packet

3283-454: The free 386BSD by William and Lynne Jolitz , and the proprietary BSD/386 (later renamed BSD/OS) by Berkeley Software Design (BSDi). 386BSD itself was short-lived, but became the initial code base of the NetBSD and FreeBSD projects that were started shortly thereafter. BSDi soon found itself in legal trouble with AT&T's Unix System Laboratories (USL) subsidiary, then the owners of

3350-461: The growth of the Internet. Until then, all versions of BSD used proprietary AT&T Unix code, and were therefore subject to an AT&T software license. Source code licenses had become very expensive and several outside parties had expressed interest in a separate release of the networking code, which had been developed entirely outside AT&T and would not be subject to the licensing requirement. This led to Networking Release 1 ( Net/1 ), which

3417-408: The kernel-space IPsec implementation. Existing IPsec implementations usually include ESP, AH, and IKE version 2. Existing IPsec implementations on Unix-like operating systems , for example, Solaris or Linux , usually include PF_KEY version 2. Embedded IPsec can be used to ensure the secure communication among applications running over constrained resource systems with a small overhead. IPsec

SECTION 50

#1732917169717

3484-533: The keys being exchanged and decrypt traffic without inserting any software backdoors. A second alternative explanation that was put forward was that the Equation Group used zero-day exploits against several manufacturers' VPN equipment which were validated by Kaspersky Lab as being tied to the Equation Group and validated by those manufacturers as being real exploits, some of which were zero-day exploits at

3551-470: The keys sent the data. Note that the relevant standard does not describe how the association is chosen and duplicated across the group; it is assumed that a responsible party will have made the choice. To ensure that the connection between two endpoints has not been interrupted, endpoints exchange keepalive messages at regular intervals, which can also be used to automatically reestablish a tunnel lost due to connection interruption. Dead Peer Detection (DPD)

3618-499: The new kernel, ports of the 2BSD utilities to the VAX, and the utilities from 32V was released as 3BSD at the end of 1979. 3BSD was also alternatively called Virtual VAX/UNIX or VMUNIX (for Virtual Memory Unix), and BSD kernel images were normally called /vmunix until 4.4BSD. After 4.3BSD was released in June 1986, it was determined that BSD would move away from the aging VAX platform. The Power 6/32 platform (codenamed "Tahoe") developed by Computer Consoles Inc. seemed promising at

3685-490: The operating systems for the PlayStation 5 , PlayStation 4 , PlayStation 3 , PlayStation Vita , and Nintendo Switch . The earliest distributions of Unix from Bell Labs in the 1970s included the source code to the operating system, allowing researchers at universities to modify and extend Unix. The operating system arrived at Berkeley in 1974, at the request of computer science professor Bob Fabry who had been on

3752-412: The possession of both hosts, and the hosts send each other hashes of the shared key to prove that they are in possession of the same key. IPsec also supports public key encryption , where each host has a public and a private key, they exchange their public keys and each host sends the other a nonce encrypted with the other host's public key. Alternatively if both hosts hold a public key certificate from

3819-457: The program committee for the Symposium on Operating Systems Principles where Unix was first presented. A PDP-11/45 was bought to run the system, but for budgetary reasons, this machine was shared with the mathematics and statistics groups at Berkeley, who used RSTS , so that Unix only ran on the machine eight hours per day (sometimes during the day, sometimes during the night). A larger PDP-11/70

3886-413: The same functionality in a software stack with a different architecture, but the wide distribution of the existing sockets library reduced the impact of the new API . Early versions of BSD were used to form Sun Microsystems ' SunOS , founding the first wave of popular Unix workstations. Some BSD operating systems can run native software of several other operating systems on the same architecture , using

3953-499: The session. IPsec can protect data flows between a pair of hosts ( host-to-host ), between a pair of security gateways ( network-to-network ), or between a security gateway and a host ( network-to-host ). IPsec uses cryptographic security services to protect communications over Internet Protocol (IP) networks. It supports network-level peer authentication, data origin authentication , data integrity , data confidentiality ( encryption ), and protection from replay attacks . Starting in

4020-459: The time of their exposure. The Cisco PIX and ASA firewalls had vulnerabilities that were used for wiretapping by the NSA . Furthermore, IPsec VPNs using "Aggressive Mode" settings send a hash of the PSK in the clear. This can be and apparently is targeted by the NSA using offline dictionary attacks . BSD The Berkeley Software Distribution or Berkeley Standard Distribution ( BSD )

4087-537: The time, but was abandoned by its developers shortly thereafter. Nonetheless, the 4.3BSD-Tahoe port (June 1988) proved valuable, as it led to a separation of machine-dependent and machine-independent code in BSD which would improve the system's future portability. In addition to portability, the CSRG worked on an implementation of the OSI network protocol stack, improvements to the kernel virtual memory system and (with Van Jacobson of LBL ) new TCP/IP algorithms to accommodate

SECTION 60

#1732917169717

4154-469: Was based on the source code of the original Unix developed at Bell Labs . In the 1980s, BSD was widely adopted by workstation vendors in the form of proprietary Unix variants such as DEC Ultrix and Sun Microsystems SunOS due to its permissive licensing and familiarity to many technology company founders and engineers. These proprietary BSD derivatives were largely superseded in the 1990s by UNIX SVR4 and OSF/1 . Later releases of BSD provided

4221-462: Was developed in conjunction with IPv6 and was originally required to be supported by all standards-compliant implementations of IPv6 before RFC 6434 made it only a recommendation. IPsec is also optional for IPv4 implementations. IPsec is most commonly used to secure IPv4 traffic. IPsec protocols were originally defined in RFC 1825 through RFC 1829, which were published in 1995. In 1998, these documents were superseded by RFC 2401 and RFC 2412 with

4288-525: Was installed at Berkeley the following year, using money from the Ingres database project. BSD began life as a variant of Unix that programmers at the University of California at Berkeley, initially led by Bill Joy , began developing in the late 1970s. It included extra features, which were intertwined with code owned by AT&T. In 1975, Ken Thompson took a sabbatical from Bell Labs and came to Berkeley as

4355-400: Was made available to non-licensees of AT&T code and was freely redistributable under the terms of the BSD license . It was released in June 1989. After Net/1, BSD developer Keith Bostic proposed that more non-AT&T sections of the BSD system be released under the same license as Net/1. To this end, he started a project to reimplement most of the standard Unix utilities without using

4422-460: Was released on March 9, 1978. 1BSD was an add-on to Version 6 Unix rather than a complete operating system in its own right. Some thirty copies were sent out. The second Berkeley Software Distribution (2BSD), released in May 1979, included updated versions of the 1BSD software as well as two new programs by Joy that persist on Unix systems to this day: the vi text editor (a visual version of ex ) and

4489-597: Was settled in January 1994, largely in Berkeley's favor. Of the 18,000 files in the Berkeley distribution, only three had to be removed and 70 modified to show USL copyright notices. A further condition of the settlement was that USL would not file further lawsuits against users and distributors of the Berkeley-owned code in the upcoming 4.4BSD release. The final release from Berkeley was 1995's 4.4BSD-Lite Release 2 , after which

#716283