Slashdot Mirror

serviscope_minor writes: The OpenBSD people forked and heavily cleaned up OpenSSL to create LibreSSL due to dissatisfaction with the maintainance of OpenSSL, culminating in the heartbleed bug. The emphasis has been on cleaning up the code and improving security, which includes removing things such as SSL2 which has fundamental security flaws. As a result, LibreSSL is not affected by the DROWN bug. LibreSSL is largely compatible with OpenSSL. The main exceptions are in the cases where programs use insecure functions removed from libreSSL, or require bug compatiblity with OpenSSL.

McGruber writes: Microsoft has donated a considerable amount of money to the OpenBSD Foundation, becoming its first-ever Gold level contributor in the process. From the OpenBSD Journal: "The OpenBSD Foundation is happy to announce that Microsoft has made a significant financial donation to the Foundation. This donation is in recognition of the role of the Foundation in supporting the OpenSSH project. This donation makes Microsoft the first Gold level contributor in the OpenBSD Foundation's 2015 fundraising campaign."

Noryungi (70322) writes Theo De Raadt roundly criticized NTP due to its recent security advisories, and pointed out that OpenBSD OpenNTPD was not vulnerable. However, it also had not been made portable to other OS in a long time. Brent Cook, also known for his work on the portable version of LibreSSL (OpenBSD cleanup and refactoring of OpenSSL) decided to take the matter in his own hands and released a new portable version of OpenNTPD. Everyone rejoice, compile and report issues!

New submitter CrAlt (3208) writes with this news snipped from BSD news stalwart undeadly.org: "After the news of heartbleed broke early last week, the OpenBSD team dove in and started axing it up into shape. Leading this effort are Ted Unangst (tedu@) and Miod Vallat (miod@), who are head-to-head on a pure commit count basis with both having around 50 commits in this part of the tree in the week since Ted's first commit in this area. They are followed closely by Joel Sing (jsing@) who is systematically going through every nook and cranny and applying some basic KNF. Next in line are Theo de Raadt (deraadt@) and Bob Beck (beck@) who've been both doing a lot of cleanup, ripping out weird layers of abstraction for standard system or library calls. ... All combined, there've been over 250 commits cleaning up OpenSSL. In one week.'" You can check out the stats, in progress.

First time accepted submitter Iarwain Ben-adar (2393286) writes "The OpenBSD has started a cleanup of their in-tree OpenSSL library. Improvements include removing "exploit mitigation countermeasures", fixing bugs, removal of questionable entropy additions, and many more. If you support the effort of these guys who are responsible for the venerable OpenSSH library, consider a donation to the OpenBSD Foundation. Maybe someday we'll see a 'portable' version of this new OpenSSL fork. Or not."

Freshly Exhumed writes "Today the OpenBSD mailing list carried a plea from Theo de Raadt for much needed financial aid for the OpenBSD foundation: 'I am resending this request for funding our electricity bills because it is not yet resolved. We really need even more funding beyond that, because otherwise all of this is simply unsustainable. This request is the smallest we can make.' Bob Beck, of the OpenBSD Foundation, added: 'the fact is right now, OpenBSD will shut down if we do not have the funding to keep the lights on.'" The electricity bill in question is $20,000 a year for build servers located in Canada.

First time accepted submitter ConstantineM writes "Inspired by a recent Google initiative to adopt ChaCha20 and Poly1305 for TLS, OpenSSH developer Damien Miller has added a similar protocol to ssh, chacha20-poly1305@openssh.com, which is based on D. J. Bernstein algorithms that are specifically optimised to provide the highest security at the lowest computational cost, and not require any special hardware at doing so. Some further details are in his blog, and at undeadly. The source code of the protocol is remarkably simple — less than 100 lines of code!"

badger.foo writes "OpenBSD-current just turned 5.0-beta, providing us a preview of what the upcoming release (slated for November 1st) will look like. Peter Hansteen takes us through the main new features and explains the development process that has consistently turned out high-quality releases on time, every six months for more than a decade."

HipToday writes "As posted on the OpenBSD Journal, OpenSSH 5.4 has been released: 'Some highlights of this release are the disabling of protocol 1 by default, certificate authentication, a new "netcat mode," many changes on the sftp front (both client and server) and a collection of assorted bugfixes. The new release can already be found on a large number of mirrors and of course on www.openssh.com.'"

HipToday writes "As posted on the OpenBSD Journal, OpenSSH 5.4 has been released: 'Some highlights of this release are the disabling of protocol 1 by default, certificate authentication, a new "netcat mode," many changes on the sftp front (both client and server) and a collection of assorted bugfixes. The new release can already be found on a large number of mirrors and of course on www.openssh.com.'"

Ste sends along the cheery little story of Otto Moerbeek, one of the OpenBSD developers, who recently found and fixed a 33-year-old buffer overflow bug in Yacc. "But if the stack is at maximum size, this will overflow if an entry on the stack is larger than the 16 bytes leeway my malloc allows. In the case of of C++ it is 24 bytes, so a SEGV occurred. Funny thing is that I traced this back to Sixth Edition UNIX, released in 1975."

bsdphx writes "OpenSSH developers Damien Miller and Markus Friedl have recently added a nifty feature to make life easier for admins. Now you can easily lock an SSH session into a chroot directory, restrict them to a built-in sftp server and apply these settings per user. And it's dead simple to do. If you need to allow semi-trusted people on your computers, then you want this bad!"

Sunnz writes "The leaner, lighter, faster, and most importantly, BSD Licensed, Compiler PCC has been imported into OpenBSD's CVS and NetBSD's pkgsrc. The compiler is based on the original Portable C Compiler by S. C. Johnson, written in the late 70's. Even though much of the compiler has been rewritten, some of the basics still remain. It is currently not bug-free, but it compiles on x86 platform, and work is being done on it to take on GCC's job."

bsdphx writes "While Theo may have a reputation of being "difficult" in some circles, this response to the recent relicensing controversy is thoughtful and well penned. Through this whole process I've learned some new things about both GPL and BSD licensing, and especially about combining the two."

bsdphx writes "After years of encouragement from the OpenBSD community for others to use Reyk Floeter's free Atheros wireless driver, it seems that the Linux world is finally listening. Unfortunately, they seem to think that they can strip the BSD license right out of it."

NormalVisual writes "The mailing lists were buzzing recently when Michael Buesch, one of the maintainers for the GPL'd bc43xx Broadcom wireless chip driver project, called the OpenBSD folks to task for apparently including code without permission from his project in the OpenBSD bcw project, which aims to provide functionality with Broadcom wireless chips under that OS. It seems that the problem has been resolved for now with the BSD driver author totally giving up on the project and Theo De Raadt taking the position that Buesch's posts on the subject were 'inhuman.'" More commentary from the BSD community is over at undeadly.org.

Undeadly Halloween writes, "On October 18th, OpenBSD celebrated its 11th birthday and ten years of punctual biannual releases. Now it's time for OpenBSD 4.0, which includes tons of new drivers for wireless, network, and storage chips. Consider helping the project by buying the new goodies (CD set, t-shirt, poster, Audio CD). And discover what's new and what battles developers must face daily to support new hardware in the traditional interview featuring nearly 20 developers."

Michael Knudsen writes, "Intel still refuses to work with open source projects such that they can provide their users with proper support for Intel's hardware products. As he has done before, Theo de Raadt once again asks users to take action by contacting Intel, telling them what they think of their current policy of not releasing hardware documentation and granting open source projects the right to distribute hardware firmware with their products. Failing to do so only harms users in the way that they risk having unsupported or malfunctioning hardware in their operating system of choice." Read more below.

It's really important that people understand that Intel is only trying to cooperate just enough to make people believe that they're open and doing the right thing. Don't fool yourselves: They are not.

What we need all users of open source software to do is contact Intel and let them know what you think of their current behaviour. If you run a big department and chose another vendor's products over Intel's because it doesn't work in your operating system, let them know, along with how many units they could have sold you. If you are an end user who has had problems when using Intel hardware because of poor support, let them know.

Let them know that their current lack of support will only harm them in the long run because you will be avoiding their products. Let them know that you want your hardware to work out of the box when you have installed your operating system of choice, and how Intel is preventing this with their lack of support.

Intel is not doing you a favor by requiring you to go to a website and download firmware for your hardware. You paid for the hardware, and Intel is thanking you by making it difficult for you to use it. Let Intel know what you think of this.

eklitzke writes to tell us the OpenBSD journal is reporting that the Mozilla Foundation is donating $10,000 USD to the OpenSSH project. This comes as good news after the recent reported financial troubles from the OpenBSD and by extension the OpenSSH team. It seems that quite a few people have answered the call for aid made by OpenBSD's de Raadt.

DieNadel writes "In an entry to the OpenBSD Journal, Marco, from the OpenBSD project, warns about the somewhat disturbing financial situation in which they are now. The OpenBSD team is the one that also develops the OpenSSH suite, used nowadays almost everywhere. From the entry: 'What I want to point out what a lot of people don't seem to realize is that OpenSSH development is paid from the same pool of money as OpenBSD. OpenSSH is in use by millions around the world however the revenue stream just simply isn't there. This is where other projects could help. Without naming entities or projects by name there are others out there that are sitting on some cash. It would be wonderful if these entities could share some of the wealth to keep us going.'"

Eh-Wire writes to tell us OpenBSD Journal is reporting that OpenBSD is officially ten-years-old today. After some confusion, it was decided that 10 years ago today marked the birth of OpenBSD when Theo de Raadt committed his makefile to CVS.

jpkunst writes "As reported on undeadly.org: an interesting interview with OpenBSD developer Marc Espie about the internals of and the philosophy behind the OpenBSD ports and packages system."

Sam writes "The OpenBSD cvs server has a failing RAID array. Users of the projects on that array: OpenBSD, OpenSSH, OpenBGPD, OpenNTPD, and the upcoming OpenCVS are all invited to contribute towards the $12,500 cost of a suitably high-spec replacement. OpenBSD Journal article, and original request (thread)."

44BSD writes "As noted at undeadly, the OpenBSD Project has announced an BSD-licensed implementation of the Border Gateway Protocol, BGP. Project details, design goals, documentation, and more are at the project web site. BGP is documented in RFC 1771. Lucky for Cisco, BSD is dying..."

grey writes "The Age has a story up about how the OpenBSD community has been contacting wireless chipset vendors to license their firmware binaries under terms that would allow for free redistribution. This is important, because even with existing GPL and BSD licensed drivers for these chipsets, the drivers don't function without first loading onerously licensed firmware binaries which can only be acquired from the vendor, not shipped by an OSS provider." (Read more, below.)

grey continues "This means that currently, these wireless NIC's don't work out of the box on OSS install or boot media. In just the first 4 days, hundreds of users wrote and called vendors, and already 2 vendors freed their firmware, and several others are in discussions with Theo de Raadt about taking similar steps.

We need your help! TI has still not responded at all. You can call or write to Bill Carney, - Director of Business Development of TI's WNBU to add to the approximately 400 well written messages the OpenBSD community has already sent to TI. We hope that you'll help, and if you do please keep messages polite and to the point. Please remember, we are not asking for the vendors to open source their firmware under the GPL or BSD licenses (though we wouldn't complain if they did). Instead, ask if they would simply email Theo to open discussions on licensing their firmware binaries under terms that allow for free redistribution. If changed, these firmware binaries would then be able to be included with OSS software and function with existing BSD and GPL licensed device drivers from the start.

You can find other contacts for target vendors here, here, here, and here, and it can't hurt to sign this petition. These changes aide all OSS efforts, not just OpenBSD. As you can see from the OpenBSD community's results already, contacting these vendors really does make a difference. We're sure that with the numbers of OSS minded readers in the Slashdot community you can really help with the heavy lifting where fewer numbers of BSD users have already begun to succeed, and all Open Source Software users will benefit."

grey writes "The Age has a story up about how the OpenBSD community has been contacting wireless chipset vendors to license their firmware binaries under terms that would allow for free redistribution. This is important, because even with existing GPL and BSD licensed drivers for these chipsets, the drivers don't function without first loading onerously licensed firmware binaries which can only be acquired from the vendor, not shipped by an OSS provider." (Read more, below.)

grey continues "This means that currently, these wireless NIC's don't work out of the box on OSS install or boot media. In just the first 4 days, hundreds of users wrote and called vendors, and already 2 vendors freed their firmware, and several others are in discussions with Theo de Raadt about taking similar steps.

We need your help! TI has still not responded at all. You can call or write to Bill Carney, - Director of Business Development of TI's WNBU to add to the approximately 400 well written messages the OpenBSD community has already sent to TI. We hope that you'll help, and if you do please keep messages polite and to the point. Please remember, we are not asking for the vendors to open source their firmware under the GPL or BSD licenses (though we wouldn't complain if they did). Instead, ask if they would simply email Theo to open discussions on licensing their firmware binaries under terms that allow for free redistribution. If changed, these firmware binaries would then be able to be included with OSS software and function with existing BSD and GPL licensed device drivers from the start.

You can find other contacts for target vendors here, here, here, and here, and it can't hurt to sign this petition. These changes aide all OSS efforts, not just OpenBSD. As you can see from the OpenBSD community's results already, contacting these vendors really does make a difference. We're sure that with the numbers of OSS minded readers in the Slashdot community you can really help with the heavy lifting where fewer numbers of BSD users have already begun to succeed, and all Open Source Software users will benefit."

grey writes "The Age has a story up about how the OpenBSD community has been contacting wireless chipset vendors to license their firmware binaries under terms that would allow for free redistribution. This is important, because even with existing GPL and BSD licensed drivers for these chipsets, the drivers don't function without first loading onerously licensed firmware binaries which can only be acquired from the vendor, not shipped by an OSS provider." (Read more, below.)

grey continues "This means that currently, these wireless NIC's don't work out of the box on OSS install or boot media. In just the first 4 days, hundreds of users wrote and called vendors, and already 2 vendors freed their firmware, and several others are in discussions with Theo de Raadt about taking similar steps.

We need your help! TI has still not responded at all. You can call or write to Bill Carney, - Director of Business Development of TI's WNBU to add to the approximately 400 well written messages the OpenBSD community has already sent to TI. We hope that you'll help, and if you do please keep messages polite and to the point. Please remember, we are not asking for the vendors to open source their firmware under the GPL or BSD licenses (though we wouldn't complain if they did). Instead, ask if they would simply email Theo to open discussions on licensing their firmware binaries under terms that allow for free redistribution. If changed, these firmware binaries would then be able to be included with OSS software and function with existing BSD and GPL licensed device drivers from the start.

You can find other contacts for target vendors here, here, here, and here, and it can't hurt to sign this petition. These changes aide all OSS efforts, not just OpenBSD. As you can see from the OpenBSD community's results already, contacting these vendors really does make a difference. We're sure that with the numbers of OSS minded readers in the Slashdot community you can really help with the heavy lifting where fewer numbers of BSD users have already begun to succeed, and all Open Source Software users will benefit."

agent dero writes "Naysayers beware, at the recent Calgary OpenBSD Hackathon, there has been some major improvements in OpenBSD's SMP support which was recently merged with -current. According to this recent article at undeadly.org the code is ready for testing, but the OpenBSD team could really use some permanent AMD64 SMP hardware for testing. Notable achievments include a kernel compile in around 80 seconds."

agent dero writes "Naysayers beware, at the recent Calgary OpenBSD Hackathon, there has been some major improvements in OpenBSD's SMP support which was recently merged with -current. According to this recent article at undeadly.org the code is ready for testing, but the OpenBSD team could really use some permanent AMD64 SMP hardware for testing. Notable achievments include a kernel compile in around 80 seconds."

A number of people dropped e-mails this morning saying that OpenBSD has now got SMP, according to a post from Niklas Hallqvist.

ubiquitin writes "Existence of the Secure Architectures with OpenBSD text was first made public on the OpenBSD Journal in early April 2004. The OpenBSD Journal, also known as deadly.org and now undeadly.org, recently changed hands from James Phillips to Daniel Hartmeier amid several more or less obscure references to Pogues lyrics. The peaceful transfer of the site is a good thing, as it means that the several-hundred articles posted to the journal will remain in publicly-accessible archives for the foreseeable future and the occasion gave Hartmeier, known for his development of packet filtering (pf) and network DVD playing (kissd) software, a reason to try his hand at building a content management system. Jose Nazario is both an author of the book under review here and a contributor to the OpenBSD Journal web site, which seems to be a watering hole for unix hackers, having something of the flavor that Slashdot had in the late nineties." (Jose is also an occasional Slashdot book reviewer, and a good cook.) Read on for the rest of ubiquitin's review. Secure Architectures with OpenBSD author Brandon Palmer, Jose Nazario pages 515 publisher Addison Wesley Professional rating 9/10 reviewer Mathew Caughron ISBN 0321193660 summary Overview of BSD systems administration practices

The godfather of OpenBSD, Theo De Raadt, was given space on the cover for a snarky comment, his blessing apparently, that the book "works in tandem with OpenBSD's manual pages. As a result it will help many users grow..."

This comment is apropos, since the OpenBSD man pages, beginning with man afterboot, are some of the best getting-started OS documentation available anywhere on the net. So it is perhaps fair that a certain justification be offered for texts on this topic. This book gives many example configurations, some shell scripts, and an organizational approach that are simply beyond what one can realistically expect from the online manual pages. So yes, Theo, this book is destined to help mere mortals grow in knowledge and skill.

One nice feature of this book is that its authors refer to Linux equivalents where appropriate, e.g., in terms of configuration and system file locations and names. This makes it an ideal text for a Linux sysadmin who wants to take OpenBSD for a test drive on the public network. Two chapters covering the OpenBSD packet filter (pf) and IPSec are the gems of this text and even advanced Linux users will likely benefit from alternative approaches to solving the same problems in the alternate universe of a different operating system.

The Start-Up and Shutdown chapter has a careful and complete walk-through of /etc/rc, the equivalent of Linux's inittab. I found this to be a useful part of the book, because the various parts of this script are not always obvious from a first read through of the shell commands. Palmer and Nazario break it down into 41 sections, each with a discrete purpose. After running through the primary boot process run commands script, a brief explanation is given of each of the seven default OpenBSD processes.

Although a close examination of a minimalistic OS setup shouldn't be foreign to any mildly accomplished sysadmin, even those of the Microsoft camp, reviewing exactly what it is that the process list tells you is always a worthwhile exercise.

Like other opera omnia, the work falls into three parts, in this case: I. Getting Started, II. Configuration and Administration, and III. Advanced Features. The index and contents occupy only 25 or so pages out of the total 500 and will readily direct the casual reader into an appropriate chapter of her choice. The index entry for chroot, for instance, will direct the reader to the section on the most commonly encountered chroot issue: dynamic content generation under apache.

Coverage of the X Window System is as minimal as it should be on a platform where the benefits derived from its use have little immediate relevance for client-side GUI applications. Mac OS X users might find the book helpful, since OpenBSD can be installed, for those willing to undergo the hassle of repartitioning, on pretty much all current hardware from Apple. Many of the recipes (apache, sshd, gdb, sudo) are directly relevant to their own Darwinian flavor. Windows users will also find various parts of this book useful, since the Services for Unix product from Microsoft/Interix is widely known to be based upon an early version of OpenBSD. Note: Microsoft here joins a very long list of BSD-license adherents in opposing the world of GPL functionality, whether this be for better or for worse. So although the audience for this text is decidedly directed at those who are taking the plunge with Puffy the Blowfish, other audiences will benefit from the insights into basic systems administration activities.

This text may also serve as potent advocacy for the systems-administration practices of BSD masters. For instance, the process of user removal from a Red Hat or Debian system versus OpenBSD's rmuser script. The lifecycle of user accounts on long-lived systems does, after all, have an end as well as a beginning, so this process deserves attention, though it may occur less frequently in growing systems it nonetheless deserves attention. Note also the detailed description of rate-limiting, packet-scrubbing, transparent filtering, and load-balancing features of the platform's packet filter. It hardly seems fair to criticize snort2pf for being immature when pf itself is a novel feature with the 3.4 openbsd kernel.

Backup and Housekeeping chapters are particularly well laid out, and include strategies, not merely howto recipes. This is an important and often-neglected body of sysadmin knowledge. The Towers of Hanoi strategy backup script that uses key-based authentication to remotely backup servers will likely be a useful tool for readers of the text who are administering a remote server that needs to have routine off-site transfer of its contents.

An explanation of how to modify the default send-only setup of sendmail starts off the chapter on mail administration. Unfortunately, there is no mention of how to set up certificates for secure IMAP or POP authentication. This is an obviously necessary part of administering an email server in which passwords are not sent in the clear and I consider it to be the most egregious omission of the book. Perhaps the authors don't see email services as a place in which BSD actively or effectively contributes. X.509 key generation is covered in the Apache section for SSL and then again under the IPSec chapter, but configuration of the popular mail serving daemons to use cryptographic authentication surely deserves a place in this text which claims "secure architectures" as its purpose.

The appendices may be worth the price of the book alone for junior sysadmins first discovering the joys of BSD. These include a walk-through of CVS basics, how to use patch and diff, kernel tuning with sysctl, how to make sense of dmesg output, and the basics of core file analysis, interpretation of RAM dumps by gdb produced at crash time. If pkg file creation were given similar treatment, it may help the *BSD package system find a broader appeal.

If you take a "hold forever" approach to your investment in books, it might be worth waiting until the second edition. Brandon Palmer indicated in a posting to the OpenBSD journal that a rewrite of the book would likely include greater coverage of spamd administration as well as BGP and some of the high-availability features in CARP. No timing on the second edition is available and it should be noted that everything in the text is appropriate for OpenBSD 3.4, i.e., the Robin Hood puffinfish, not the 3.5 Monty Python puffinfish. I'd expect that in two more release cycles, summer 2005, it will be time to ask around about an update to this text. The IPv6 chapter will likely need a dramatic rewrite by then since it gives helpful configuration parameters for a handful of the current crop of IPv6 v.6 applications. As it is, the book stands on its own: current and relevant. A year and a half is many generations of kernel compiles in Linux-land but only a few rounds of planned upgrades for the slower-paced approach of BSD admins.

Attention to documentation seems to be the distinguishing mark of a mature project. In that vein, the recent round of OpenBSD texts can be seen as an argument that the platform is destined for greater mainstream use. Listed here are a few other recent texts on OpenBSD. The most direct competitor to this text is Absolute BSD: Unix for the Practical Paranoid by Michael Lucas and Jordan Hubbard which has been available in bookstores now for more than a year. For greater detail on the packet filter, refer to Building Firewalls with OpenBSD and PF by Jacek Artymiak or OpenBSD Firewalling by Jorg Kutemeier which is so far only available in German. Brian Carter's text OpenBSD: Implementing the Secure UNIX Platform was not available to the reviewer at the time of this writing but is expectedly to be out in distribution shortly.

Daniel Hartmeier's quotation on the back cover stating that the book's organization will help you save time is right on target. Although time will tell whether this book becomes the de facto standard as a systems handbook or complete text on OpenBSD, it is a book you can confidently recommend to anyone who wants their first experience with OpenBSD to include learning the ropes of minimalistic, and therefore robust, secure server administration practices.

Postscript: Addison Wesley has made the index of the book available. You can purchase the Secure Architectures with OpenBSD from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, carefully read the book review guidelines, then visit the submission page.

ubiquitin writes "Existence of the Secure Architectures with OpenBSD text was first made public on the OpenBSD Journal in early April 2004. The OpenBSD Journal, also known as deadly.org and now undeadly.org, recently changed hands from James Phillips to Daniel Hartmeier amid several more or less obscure references to Pogues lyrics. The peaceful transfer of the site is a good thing, as it means that the several-hundred articles posted to the journal will remain in publicly-accessible archives for the foreseeable future and the occasion gave Hartmeier, known for his development of packet filtering (pf) and network DVD playing (kissd) software, a reason to try his hand at building a content management system. Jose Nazario is both an author of the book under review here and a contributor to the OpenBSD Journal web site, which seems to be a watering hole for unix hackers, having something of the flavor that Slashdot had in the late nineties." (Jose is also an occasional Slashdot book reviewer, and a good cook.) Read on for the rest of ubiquitin's review. Secure Architectures with OpenBSD author Brandon Palmer, Jose Nazario pages 515 publisher Addison Wesley Professional rating 9/10 reviewer Mathew Caughron ISBN 0321193660 summary Overview of BSD systems administration practices

The godfather of OpenBSD, Theo De Raadt, was given space on the cover for a snarky comment, his blessing apparently, that the book "works in tandem with OpenBSD's manual pages. As a result it will help many users grow..."

This comment is apropos, since the OpenBSD man pages, beginning with man afterboot, are some of the best getting-started OS documentation available anywhere on the net. So it is perhaps fair that a certain justification be offered for texts on this topic. This book gives many example configurations, some shell scripts, and an organizational approach that are simply beyond what one can realistically expect from the online manual pages. So yes, Theo, this book is destined to help mere mortals grow in knowledge and skill.

One nice feature of this book is that its authors refer to Linux equivalents where appropriate, e.g., in terms of configuration and system file locations and names. This makes it an ideal text for a Linux sysadmin who wants to take OpenBSD for a test drive on the public network. Two chapters covering the OpenBSD packet filter (pf) and IPSec are the gems of this text and even advanced Linux users will likely benefit from alternative approaches to solving the same problems in the alternate universe of a different operating system.

The Start-Up and Shutdown chapter has a careful and complete walk-through of /etc/rc, the equivalent of Linux's inittab. I found this to be a useful part of the book, because the various parts of this script are not always obvious from a first read through of the shell commands. Palmer and Nazario break it down into 41 sections, each with a discrete purpose. After running through the primary boot process run commands script, a brief explanation is given of each of the seven default OpenBSD processes.

Although a close examination of a minimalistic OS setup shouldn't be foreign to any mildly accomplished sysadmin, even those of the Microsoft camp, reviewing exactly what it is that the process list tells you is always a worthwhile exercise.

Like other opera omnia, the work falls into three parts, in this case: I. Getting Started, II. Configuration and Administration, and III. Advanced Features. The index and contents occupy only 25 or so pages out of the total 500 and will readily direct the casual reader into an appropriate chapter of her choice. The index entry for chroot, for instance, will direct the reader to the section on the most commonly encountered chroot issue: dynamic content generation under apache.

Coverage of the X Window System is as minimal as it should be on a platform where the benefits derived from its use have little immediate relevance for client-side GUI applications. Mac OS X users might find the book helpful, since OpenBSD can be installed, for those willing to undergo the hassle of repartitioning, on pretty much all current hardware from Apple. Many of the recipes (apache, sshd, gdb, sudo) are directly relevant to their own Darwinian flavor. Windows users will also find various parts of this book useful, since the Services for Unix product from Microsoft/Interix is widely known to be based upon an early version of OpenBSD. Note: Microsoft here joins a very long list of BSD-license adherents in opposing the world of GPL functionality, whether this be for better or for worse. So although the audience for this text is decidedly directed at those who are taking the plunge with Puffy the Blowfish, other audiences will benefit from the insights into basic systems administration activities.

This text may also serve as potent advocacy for the systems-administration practices of BSD masters. For instance, the process of user removal from a Red Hat or Debian system versus OpenBSD's rmuser script. The lifecycle of user accounts on long-lived systems does, after all, have an end as well as a beginning, so this process deserves attention, though it may occur less frequently in growing systems it nonetheless deserves attention. Note also the detailed description of rate-limiting, packet-scrubbing, transparent filtering, and load-balancing features of the platform's packet filter. It hardly seems fair to criticize snort2pf for being immature when pf itself is a novel feature with the 3.4 openbsd kernel.

Backup and Housekeeping chapters are particularly well laid out, and include strategies, not merely howto recipes. This is an important and often-neglected body of sysadmin knowledge. The Towers of Hanoi strategy backup script that uses key-based authentication to remotely backup servers will likely be a useful tool for readers of the text who are administering a remote server that needs to have routine off-site transfer of its contents.

An explanation of how to modify the default send-only setup of sendmail starts off the chapter on mail administration. Unfortunately, there is no mention of how to set up certificates for secure IMAP or POP authentication. This is an obviously necessary part of administering an email server in which passwords are not sent in the clear and I consider it to be the most egregious omission of the book. Perhaps the authors don't see email services as a place in which BSD actively or effectively contributes. X.509 key generation is covered in the Apache section for SSL and then again under the IPSec chapter, but configuration of the popular mail serving daemons to use cryptographic authentication surely deserves a place in this text which claims "secure architectures" as its purpose.

The appendices may be worth the price of the book alone for junior sysadmins first discovering the joys of BSD. These include a walk-through of CVS basics, how to use patch and diff, kernel tuning with sysctl, how to make sense of dmesg output, and the basics of core file analysis, interpretation of RAM dumps by gdb produced at crash time. If pkg file creation were given similar treatment, it may help the *BSD package system find a broader appeal.

If you take a "hold forever" approach to your investment in books, it might be worth waiting until the second edition. Brandon Palmer indicated in a posting to the OpenBSD journal that a rewrite of the book would likely include greater coverage of spamd administration as well as BGP and some of the high-availability features in CARP. No timing on the second edition is available and it should be noted that everything in the text is appropriate for OpenBSD 3.4, i.e., the Robin Hood puffinfish, not the 3.5 Monty Python puffinfish. I'd expect that in two more release cycles, summer 2005, it will be time to ask around about an update to this text. The IPv6 chapter will likely need a dramatic rewrite by then since it gives helpful configuration parameters for a handful of the current crop of IPv6 v.6 applications. As it is, the book stands on its own: current and relevant. A year and a half is many generations of kernel compiles in Linux-land but only a few rounds of planned upgrades for the slower-paced approach of BSD admins.

Attention to documentation seems to be the distinguishing mark of a mature project. In that vein, the recent round of OpenBSD texts can be seen as an argument that the platform is destined for greater mainstream use. Listed here are a few other recent texts on OpenBSD. The most direct competitor to this text is Absolute BSD: Unix for the Practical Paranoid by Michael Lucas and Jordan Hubbard which has been available in bookstores now for more than a year. For greater detail on the packet filter, refer to Building Firewalls with OpenBSD and PF by Jacek Artymiak or OpenBSD Firewalling by Jorg Kutemeier which is so far only available in German. Brian Carter's text OpenBSD: Implementing the Secure UNIX Platform was not available to the reviewer at the time of this writing but is expectedly to be out in distribution shortly.

Daniel Hartmeier's quotation on the back cover stating that the book's organization will help you save time is right on target. Although time will tell whether this book becomes the de facto standard as a systems handbook or complete text on OpenBSD, it is a book you can confidently recommend to anyone who wants their first experience with OpenBSD to include learning the ropes of minimalistic, and therefore robust, secure server administration practices.

Postscript: Addison Wesley has made the index of the book available. You can purchase the Secure Architectures with OpenBSD from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, carefully read the book review guidelines, then visit the submission page.

hext0r writes "Open Hosting provider metawire.org administrator Daniel Selans recently wrote an informative article for the OpenBSD Journal about the difficulties and successes in running a free hosting provider using OpenBSD. It's an informative read for anyone considering starting any type of hosting company using free technologies."

hext0r writes "Open Hosting provider metawire.org administrator Daniel Selans recently wrote an informative article for the OpenBSD Journal about the difficulties and successes in running a free hosting provider using OpenBSD. It's an informative read for anyone considering starting any type of hosting company using free technologies."