Slashdot Mirror
OpenBSD 2.7 Released
dragonfly_blue writes: "Just wanted to let you know, OpenBSD 2.7 is out, with significant advances; including OpenSSH2, better Linux binary emulation, DSA encryption, and (my personal favorite) support for encrypting your swap space. Theo and the gang have also expanded the ports and packages collections considerably, so get 'em while they're hot!"
(More.)
ocipio contributed some more tidbits, writing: " ... OpenBSD 2.7 improves support for high end system boards, SCSI controllers, ethernet interfaces, and adds gigabit ethernet drivers and IPv6 networking. OpenBSD's cryptography has been further enhanced by encrypting virtual memory swap space, and by more flexible ISAKMPD key exchange and operating modes for IP Security networking." To keep things interesting in BSD Land, he adds "According to Jordan Hubbard, FreeBSD's release engineer, FreeBSD 3.5 will be released June 20th."
Cool on all counts. Way to go, BSD crew! (And Thanks! to everyone who pointed out this release.)
Actually you have your wires crossed. The TrustedBSD project (www.trustedbsd.org) is intended to add POSIX.1e security features to the FreeBSD system, including capabilities, MAC and kernel event auditing. It's not a code audit project - thats a separate project which also exists.
/usr/src/contrib which isn't actually compiled (contrib/ accounts for about 120M of that figure).
As for the amount of code to audit, OpenBSD includes a lot of "extra" stuff as well compared to e.g. FreeBSD: for example, apache, lynx, mg (an emacs-alike editor), etc. Checking the sizes of my OpenBSD and FreeBSD source trees, I show OpenBSD to be 335M, and FreeBSD to be something less than 370M (I have extra crap in my tree). Thats not that different, considering FreeBSD probably includes more code in
Oops, slashdot ate my cookie. The parent comment was posted by me (I don't like to hide as an AC)
I'd like to do that to a mission-critical prodction server! ;-)
Regards, Tommy
Sorry. I'm cranky. I have to write a program in its entirity before tomarrow morning. I mean to include the :), really I did.
A deep unwavering belief is a sure sign you're missing something...
How much swap is truly necessary when you have large amounts of RAM?
My home machine - a dual PII/400 - has 512Mb of PC100 memory. I'm considering installing Debian 2.2 on it when it is released. Do I really even need swap space?
No alpha port this time due to lack of support from users. Check out http://www.openbsd.org/want.html :
:)
"If we do not get some of these very soon, we are not going to ship OpenBSD/alpha on the 2.7 CD-ROM (it isn't worth our effort)."
Makes a lot of sense to me... unlike Linux distros and developers, who are backed by VC, IPOs, and cushy jobs, the OpenBSD team actually have to work for a living
jason
1. Theo's beef is with NetBSD, not FreeBSD.
2. If you don't wanna pay 25$ (miniscule), download it. Periodic CVS updates are recommended.
On September 20, when the #@$%#$@% RSA patent expires, it should be possible to ship OpenSSH as standard in the USA.
YESSSSS!!! That's only 3 more months! Wheee!!! Is anyone planning a party???
No. Do basic math: Swapping means at least 5 ms delay to throw data to disk, which is about as slow as anything can get. In these 5ms, you can encrypt quite a lot of data even with something as slow as DES. Blowfish would be blazingly fast.
In short: Encryption performance is about as fast as drive I/O, and initial delay on IO makes it unnoticeable.
Interesting...donated hardware or hosting perhaps?
Swap is never really reused anyway. Swap is encrypted to protect from stolen-harddrive-attack.
I'm not trying to belittle you, but the general attitude here at slashdot is that no one thinks they should pay for anything, just ask RMS about commercial software.
http://tlug.linux.or.jp/rms.html
"The only good thing about the unauthorized copy is that you avoid giving money to the owner. This is good, because the owner does not deserve a reward for making software proprietary"
If you are worried about distro cost cheapbytes sells the OpenBSD cd for $4.99.
Only the State obtains its revenue by coercion. - Murray Rothbard
My problem with linux has been (lately) that when I try to install redhat, the install terminates.
This happens to me a lot on a lot of different machines, and in fact I couldn't get redhat to install even the minimal setup on my Celeron 366, nor could I get debian to even boot into the installer. OpenBSD, on the other hand, installed with no problems and very quickly.
If I were going to point a newbie at unix for the first time, though, I wouldn't send them to BSD. There's just not as many people out there willing to help a BSD newbie as there are those willing to help the linux kiddies. Then again, if you get on #linux as root, expect some hax0r1ng...
"You're right," Fisheye says. "I should have set it on 'whip' or 'chop.'"
Swap partition, no. Swap file, yes.. Encrypted loopback, or an encrypted filesystem holding said swap file..
Now this is off the cuff; This prolly won't work, and even if it did, it's be as slow as Windows95 on a 386.. But it is food for thought.. Ramdisk in memory, containing the 'swap space' mounted via a encrypted loopback. Make the ramdisk size close to physical, and you now have encrypted DRAM..
Or switch platforms; The AS/400, the S/80 and a variety of other IBM midranges are capable of it, even if they don't come out of the box that way..
.sig: Now legally binding!
Why stop there? Let's encrypt everything to the point of all we get on our screen will be a bunch of useless characters. We won't know what is going on, but the important part is neither will THEY! Encode our swap space, maybe that is exactly what they want us to do. Ever think about that?
You say you set your 486 up as a cable-sharing gateway using FreeBSD. As I also want to setup a 486 for the exact same purpose, I'm exploring various options. Possible candidates I have in mind are Debian and OpenBSD. So, I have some questions:
1. What about speed? Do you know how the various BSD's compare to linux when serving as a gateway on a 486? What is your experience running FreeBSD on it?
2. Why did you pick FreeBSD instead of OpenBSD in your particular situation?
3. Any other suggestions? I'm perfectly willing to spend time learning something new, but I really don't feel like installing and configuring more than one os.
If there is hope, it lies in the trolls.
This document makes a teensy error; it completely ignores the fact that the Linux swap space is not included in the Linux native file system; it has to be allocated on a separate partition with a different file system.
No, it doesn't ignore that; and no, it doesn't have to be on a seperate partition.
If you're not going to read the article, at least do a search for "swap" on it and read those lines.
Here's one for you from the article:
You will notice that I don't have a linux swap partition visible. My linux setup currently uses the OpenBSD swap area.
That's one way. Another is the use of a swap file on the Linux partition (or even on the BSD partition), which Linux can easily do.
How do you classify that as "ignoring" the question of swap space?
--
Check out: http://www.openbsd.org/ports.html for generat information on the ports, and http://www.openbsd.org/cgi-bin/cvsweb/ ports/ to browse (via cvs) the ports tree. Good luck.
I am the king... of No Pants! www.penny-arcade.com
I have the encrypted loopback working very nicely. I use it with reiser files systems. (a patch on a patch :o)
I was looking for your solution for the dynamic key generation and automounting of the swap device more than anything else.
Thanks for the reply though.
Is there anyway to do a encrypted file system on OpenBSD?
"`Ford, you're turning into a penguin. Stop it.'" -THHGTTG
Without encrypted swap, an application with sensitive data may be swapped out at some point to the disk. Even if the process zeros its own memory eventually, this disk copy may be left around for prying eyes (another process does a large malloc and scans this dirty memory for keys/passwords).
It seems to me that zeroing the swap before reuse would be a cheaper alternative to this. Here is the argument for why I think encryption doesn't buy you any security that zeroing doesn't:
My reasoning is that another process would never get your old "dirty" memory with your key after a malloc. They would have to resort to spying in your memory in realtime.
As for someone looking at your actual memory in realtime, encrypted swap isn't going to stop that. If they are sufficiently powerful to do this, they are sufficiently powerful to go into the kernel, extract the swap encryption key and read things anyway.
Could someone more in the know explain what encryption buys you that kernel-level zeroing doesn't?
Yes I agree. The "Paranoid" option, with crypto installed is fairly locked down IMHO. It also illustrates the point that restricting access and functionality to what is required fr basic operation is the first step to securing a system.
Would't a program running as a normal user be unable to access the raw swap partition?
Yea true, just like a normal user (or user program) can't grab a raw dump of kernel memory. Buy back in old Solaris or late SunOS, one of Sun's version shiped with incorrect premission on the kernel memory device, which allowed users (and user programs) to read any (or all) of the "primary" memory...
It is better to have a "backup" or "fail safe" plan when dealing with security. If my firewall is completly cracked, I still have tcpwrappers to defend off with. If I set the incorrect read permission on a senastive file, I still have it encrypted to defend off with. If some how anyone can start connecting to the telnet port, most of the users accounts have
The fact is, things do screw up, and when dealing with security it is a good idea to setup atleast 2 (if possiable) methods (if not more) incase the "main line" defense gets expoilted or breaks.
Also what if someone takes the swap drive out at night, dumps it, puts it back in without you noticing? OK that is super paranoid, but that it what I love about OpenBSD.
"`Ford, you're turning into a penguin. Stop it.'" -THHGTTG
Anyone know if this will be integrated into the Mac OS X (more specifically, the Darwin) code base?
Arthropoid, the Right Clam for the Job
This is not OpenBSD specific, but the best firewall book I've ever read is Firewalls and Internet Security (Repelling the Wily Hacker) by Cheswick and Bellovin. Published by Addison-Wesley. Good luck.
I am the king... of No Pants! www.penny-arcade.com
It could be his machine. True, the package selection system is easier than Win98 or NT in many respects, and if he is confused, well... maybe he would be happier with this manufacturer, as they make excellent machines with a very spiffy, powerful, and easy-to-use OS.
Nevertheless, I am usually not one to blame problems with a user interface on the user. That is a developer's trap. What we need to do is keep trying to make the interfaces as intuitive as possible. It is true there will always be some that will not want to think for themselves at all, but that is what defaults are for.. let the developer and the computer think for them and they should be happy... IF the defaults are sane!
"Patience is a virtue, afforded those with nothing better to do." - I don't remember
This is why it is better to use an OS for what it's intended. OpenBSD is not for playing games. It is not for using applications, generally, though it will apparently run linux apps with binary compatability and most others with a recompile. I can't speak for that personally, and to be honest I don't see the point. Adding applications adds instability and decreases security.
Basically, give NT to the Pointy-Haired Boss (though they will never admit they really need a Mac), Macintosh to the graphic designers (who *want* a Mac), use Linux for workstations and possibly web servers, and OpenBSD for firewalls and secure web servers.
Using BSD as your box to play Quake on is like driving a tank to work.
Ok, zero-ing out the swap file is a good idea, but a couple of questions. What happens if the machine is shutdown unexpectly? For example, if you zero out the swap file in the shutdown run level, that is alright. But what if you say YANK the power cord from the wall, that bypasses the shutdown run level on the system and the swap is never zero-ed out?
"`Ford, you're turning into a penguin. Stop it.'" -THHGTTG
It really depends on what you are doing. Obviously if you are not hitting swap a lot, you will not see a decrease in performance. If your disk is slow, the proc being locked up doing encryption calculations is less noticable.
There are lies, damn lies, and benchmarks.
Wow, it supports all the components that you will likely find in high-end servers, except for the most important ones! When are they finally going to support multiple processors?
Friends don't let friends use multiple inheritance.
www.openbsd.org is actually
openbsd.sunsite.ualberta.ca, www.usa.openbsd.org
is actually running OpenBSD itself.
Sure, I'd be glad to explain. You're wondering why www.OpenBSD.org is running on a Solaris server. See this comment from the misc OpenBSD mail archive.
Basically www.OpenBSD.org runs on a University of Alberta server. The bandwidth is provided free. OpenBSD is looking for venture capital and funds are limited so why look a gift horse in the mouth?
While you're looking around the site, check out their T-shirts. I like the fish-cipher t-shirt t-shirt that any open source guy would like. It has the Blowfish code printed on the t-shirt's back.
I've read all of the books mentioned so far and I'd have to say first place goes to Orielly's even though it's a tad out of date. Second goes to Ziegler's book even though it's for Linux. It explains some important info in a very easy to understand layout that you need to get your firewall running.
Most importanly, don't forget the indespensable IPFilter FAQ someone mentioned above.
Good luck, LiNT
4.0-S is still not considered "stable", as it is recommended for people who depend on the stability to wait for version 4.1-S. I have had no complaints on my 4.0 systems, but vinum still causes kernel panics when i have brain farts while setting up new arrays :0
I said above: Basically www.OpenBSD.org runs on a University of Alberta server. The bandwidth is provided free. OpenBSD is looking for venture capital and funds are limited so why look a gift horse in the mouth?
I meant to write the OpenBSD group is NOT, repeat, NOT looking for venture capital, and they're not like other distros like Red Hat who are more able to spend money on bandwidth and not worry about how it will affect the project's overall finances. Basically the OpenBSD project has limited financial resources so they want to use all the free resources they can get.
While IPv6 is supported in the linux kernel, I havn't seen too much work (yet) go into a full userland support
How about you all stop being stupid? Archie's right, paying $30 for extremely nice operating system is not that bad. I mean, how much did you pay for the hardware? Did you bitch about that too? How are the OpenBSD people supposed to fund their project without money? And using the whole 'leave the girl alone' angle was just boring and old.
i think they dropped support for alpha due to lack of funding/hardware. i don't feel like digging through the archives, but if you take a little time i'm sure you'll find it.
Actually (ignoring the fact that your entire post is incorrect and filled with bogus information) OpenBSD is far more relevant than Solaris. Being operating systems, both are condemned to suck, but OpenBSD sucks far, far less. Solaris is slow, obsolete, and has more security holes than an unpatched Red Hat 5.0 [note to ignorant: that's a LOT]. OpenBSD is small, secure, and fast. If you're going to compare the relevance of OpenBSD, please compare it against that of a product with a future.
The Dallas Semiconductor 5002FP encrypts the address and data buses. It's an Intel 8051 compatible microprocessor, so forget about running Linux or *BSD.
Mea navis aericumbens anguillis abundat
How soon are any of these ideas going to make it to Linux distributions?
In particular, I think it'd be great to have ssh ship with every Linux distribution.
I don't think I'm paranoid enough to encrypt my swap, though....
This page accidentally left blank
No, just that one. Actually, anyone who doesn't know can't call himself a unix admin anyway.
Would that be to prevent your users from seeing what is in swap space? Or is this a paranoid "If the feds take my box..." kind of thing?
BlackNova Traders
Well, im glad to see you like IRIX. (I like, and Use IRIX daily as well).
:)
As far as threading in irix, it didn't work with shit until 6.4. NFS on irix has been problematic at times, leading to pesky things like kernel panics, etc. The 32->64 bit migration on irix has been pretty amusing, unless you've actually had to use 3rd party tools or libs for anything, in which case, its been nightmarish. (n32 tools are better, vendiors love to ship o32... sound familiar ?)
IRIX has faults just like any other OS. I still like it. There is a pretty wide market niche for solaris to fill, one that IRIX wouldn't fill as well. Namely, Solaris has the right mix of "stable", "easy", and "thorough" to make it a very viable operating system. Outside of the world of slashdot, there are plenty of people that agree with me
IIRC, the largest IRIX installtion is ASCI-Blue mountain, at 6144 processsors. This is _not_ a single machine image. O2k machines have only been implemented upto 256 cpus with a single image, althoug the O2k architecture should support 4096 (see Lewis and Berg: Pthreads)
XFS _is_ a fast file-system. But if you were a hardcore irix user then you know its taken XFS a while to be what it is. Back in the day when we were running 5.3 + XFS, things were different. Back then there was no xfs_check. They just assumed it would alwasy work. This is in the XFS design papers, btw. Or like the time when XFS patches broke any possibility of conveniently booting a downed SGI machine (all the media was 6.2, effectivly patchlevel zero, but subsequent patches to the OS made the on-disk XFS file-system unreadable and thus unrepairable to the on-cd kernel and tools)
These sorts of things tend to not happen with solaris. It's not nearly as esoteric, so it doesn't have the bleeding edge performance of IRIX. On the other hand, it is very feature rich, and very stable as well.
Like i said, right mix of stabl, easy, and thorough. Might as well add "cheap".
My opinions are my own, and do not necessarily represent those of my employer.
Well, not for all applications...for example, databases, you have no control over what gets paged in and out...it is more up to the database. So unless you make your own db that doesn't use any paging (which will be a rather useless database since dbs usually require a lot of memory), sensitive information in the database will always be in some sort of swap file/partition or temporary file.
Just curious, but what happened to the Alpha port? I noticed that all the previous versions included it, even bootable on the CD, but not 2.7. Any ideas? Theo overclock his Alpha and toast in in testing out the encrypted swap space or what?
-"Zow"
its an olivetti-5030 server with four 486 boards in it. the motherboard has no processor slot on it, rather they sit on expansion cards.
:)~~~~
i think you can get dual, maybe quad too, 486 motherboards for a VERY hefty price IIRC.
and i would kill for a 16 proc pentium mobo
,
faeryman
i believe linux is getting a replacement for ipchains in the 2.3/2.4 series. i think it is actually the ipnat that you are talking about.
btw: did apache have a remote exploit lately when they got the 'powered by apache' logo replaced with the back office one? i read something like that somewhere....
Of course. Proof that IRIX-targeting proprietary vendors are just as idiotic as Linux-targeting ones (libc5, yeah that'll make me buy your shit).
This is _not_ a single machine image. O2k machines have only been implemented upto 256 cpus with a single image, althoug the O2k architecture should support 4096
I'm familiar with the architecture. 256 is still four times as many as Sun offers. The Craylink technology used to link partial SGIs is also highly impressive. It's really a blazing-fast network, with hubs and so forth. Quite flexible.
These sorts of things tend to not happen with solaris. It's not nearly as esoteric, so it doesn't have the bleeding edge performance of IRIX.
IRIX 6.5, which has been around for quite a while really, is rock solid. I've had plenty of annoying problems with earlier versions, just like you. 6.2 and 6.3 would lock up, 6.1 was complete garbage, NFS had issues, and so on. But you have to compare equivalent systems - we're not comparing Solaris 2.8 with IRIX 6.2. Solaris versions less than 2.4 had a number of serious problems; it's generally conceded today that Solaris < 2.4 is effectively unusable. I'm not recommending that anyone use IRIX 5.3 any more than that they use Solaris 2.3. When comparing IRIX 6.5.[5-8] with Solaris 2.8, IOW contemporaneous operating systems, I think you'll find that IRIX comes out looking quite good for stability, ease of use, and feature set. Naturally YMMV but I'm disinclined to allow problems with earlier versions of IRIX to bew brought up in a comparison with more recent versions of (something else).
I get some mail from Theo (not to me personally, to the lists), and, although I'm not sure how long it will last, he is generally civil and forthcoming in them...
I don't know what to say about the packet filtering; is FreeBSD still filtering out packets from the OpenBSD networks, as they claim? "We won't stop filtering packets from the OpenBSD networks until Theo is out". Heh, it's fun to read archived threads sometimes.
Well, thanks for being honest; it's important for me to know how OpenBSD got its reputation. You seem like a good person, with very valid reasons for not using OpenBSD.
Free music from Jack Merlot.
True, $30 isn't much, but it's not as nice as free. It's like if you were to go to Costco, and they had fuzzy peach slices on for $30 a bag, but they were giving away licorice for free. If I was only strong enough to carry home one back of candy, I'd probably go for the licorice, even though I'd prefer to have the fuzzy peach slices.
So it's the same thing, I'd say. There's nothing wrong with not wanting to pay $30 when there's a perfectly valid alternative available gratis.
Go grab a new 2.4.0-test1-ac* kernel, apply the 2.3.42 kerneli patches (which aren't available on ftp.kerneli.org, ironically. Check the linux-kernel archives.), handle the conflicts, and update the kernel utilities. If you don't want to mess with all this, you can get a 2.2 patch from ftp.kerneli.org and use it.
# losetup -e
[ various OpenBSD vs. FreeBSD comments snipped ]
But you leave out the big kicker: what if I'm not using an x86 or Alpha based system?
In this case, FreeBSD does me no good at all, and NetBSD or OpenBSD are my *BSD flavors to choose between.
I'd love to use FreeBSD (more experience with it from a prior job) on my old Mac IIci, but it just ain't gonna happen.
-LjM
Did you have IP forwarding off?
Proxy Server is just that...a proxy sever...and an okay firewall.
But it is NOT a NAT.
Turning IP Forwarding on on a box with PS 2.0 is not a good idea...basically you're leaving yourself open to attack...even with Dynamic Packet Filtering turned on.
I just know that PS, when used correctly, is pretty damn well secure.
-Kevin, MCSE+I, MCT
My posts don't reflect the opinion of my employer, and my employer's opinion doesn't influence the content of my posts.
if i want my disks to be encrypted (a la mitnick) how do i go about doing this anyway?
This document makes a teensy error; it completely ignores the fact that the Linux swap space is not included in the Linux native file system; it has to be allocated on a separate partition with a different file system.
The Second Amendment Sisters
Finding God in a Dog
I can pick up a Gigabit Ethernet card in Akihabara for around $US250. The real problem is the switches
1. Speed is a non-issue. The 486 _easily_ handles all the packets going through, even when NAT-ing. I've got one IBM NE2000 card and a D-link 10/100 with a Realtek chipset. BSDs actually have two fairly mature methods for setting up NAT. They're easy to configure, even if you only have the man pages at your disposal. Having never used FreeBSD, I had my gateway up and running within a day.
I had absolutely no problems with FreeBSD. For the most part I was running this machine sans monitor or keyboard. I did all my administration remotely (well, except for once when I accidentally flushed the firewall ruleset). I was able to run X apps on a remote display all without problems. I even got a little adventurous and set up my own mail server using sendmail. No performance problems at all. And this is a Frankenstein 486-66 with 24 megs ram.
2. Serendipity. I was just pissed at Redhat for failing to install and /. ran a story on FreeBSD that day. So I grabbed the ISO online and liked it right off the bat. The ability to upgrade the OS via ftp made sense in a machine where I planned to remove the CD-ROM. To be honest, I didn't look too much at OpenBSD, simply because I wasn't too concerned about the security/stability issues at the time. I didn't plan to have the system running for very long (ended up running it for 5 months) and I just wanted to give BSD a whirl.
3. Remember that *BSD is a BSD-Unix implementation. As such it differs in some ways from SVR4 Unix like Linux or the newer Solarises (?). For the most part, I find that it's not really all that different. The kernel is incredibly easy to modify and compile. I built several custom kernels, all using only vi and make. No need for fancy graphical kernel configuration. Not only that, but FreeBSD (not sure about the other BSDs) has a dynamic kernel. For example, I can compile the kernel without CD-ROM support (I mean _without_, not as a module) and when I try to access the CD-ROM, it will dynamically load the Cd-rom module. Neat stuff.
All in all, for someone with a little Linux/Unix know-how, BSD is very easy to install and run. Personally, I think it's a lot more mature than any of the Linux distributions I've seen and much easier to configure and run stably.
--
If the encryption were well done, a major benefit to this would be that even if the same clear text data were written to the same location, the encrypted data written would be 'random' from one boot to the next. This is a Good Thing(TM) in preventing more esoteric data recovey efforts from being effective.
Are you feeling lucky, punk?
Back under your bridge Troll.
Fawking Trolls!
"Going to war without France is like going deer hunting without your accordion." - Jed Babbin
The other strong point in OpenBSD's favour is the code auditing process, but FreeBSD is now going along the same path of tightening up its codebase. Again, the distinctions between the two main BSDs are becoming blurred. If this continues, will there still be a need for OpenBSD? Given the history between Theo and the FreeBSD camp, I can't ever see the projects merging. And with the price differential between Open and Free (admittedly not much, but still significant) I think Theo may have to relinquish his stranglehold on the official ISO image to the distro if OpenBSD is to survive. Despite the advantages of OpenBSD, I am still put off by the prospect of paying $25 (?) every 6 months, when I can get FreeBSD for more-or-less the cost of distribution.
- Lita
Well, the tech. preview for IPv6 under W2K is available here: presumably the 9x series and NT4 will both be patchable (it's no more than a new WinSock i.e a new TCP/IP stack). It's also, AFAIK, in the 2.3 and 2.4 kernel series.
--
Cheers
Cheers
Jon
Even if you are under NDA, go to your contractor and say "Hey our products uses OpenBSD, OpenBSD has some problems, here they are *3* count em *3* vulnerabilites, can I place in a bug report with the OpenBSD so that they will fix them and make our product run better?"
Any your contractor will say "*3*, you mean *3* vulnerabilites !?!?"
And you say "*3* count em *3*, I said *3*, count em again *3* vulnerabilites, do you care if I put in *3* could em *3* bug reports to the OpenBSD team?"
And your contractor will say "*3* why *3* bug reports?"
And you say "*3* count em *3* bug reports because there are *3* count em *3* bugs to report and you can't put it on *1* count it *1* bug report, it has to be *3* count em *3* differant and seprate bug reports"
And you contractor will say "Ok, as long as it makes our *1* count it *1* product run better under OpenBSD *2.7* count it *2.7*"
And if you contractor says no, call up Theo in the middle of the night from a pay phone (works best if it is raining and have this converastion)
You: "I seen how you did device drivers on the x86"
Theo: [yawning] "What, who is this, what do you want"
You: "I seen how you did your device drivers on the PC platform the x86"
Theo: "Good, why the hell are you calling so late, email me about it I will reply in the morning"
You: "You did it in x86 ASM launage, you thought no one would see it"
Theo: [nervous] "uh, uhhhh it was for preformance reasons"
You: "Ahh you didn't think anyone would go to the trouble of reading obfused x86 asm did you?"
Theo: "No what are you talking about, it wasn't mean, it was for performance reasons, who are you"
You: "like a seti@home, distrubated computing power, but you didn't think anyone would notice, it is in there theo, I have seen it, but you thought you could hide it, and guess what i can expolit it theo, you know what theo?"
Theo: "What do you want"
You: "The public has to know, they will know, I will make sure. One question though Theo? What does it do? I want the truth"
Theo: "You can't handle the truth"
You: "come on theo"
Theo: "It is a seti like process embedded in the x86 version dammit, it gathers data and processes usefull results, it was funded by the DOD"
You: "What type of results"
Theo: "It is processing a %100 high res movie of the effect of hot grits being poured down someone's pants, fluid dynamics, burn data, everything you would want to know"
"`Ford, you're turning into a penguin. Stop it.'" -THHGTTG
I have OpenBSD 2.6 on a 486dx33 running in the kind of configuration you are looking for. I choose Open as that is what I had used before. Speed is a non-issue if you are just passing packets. Even my cheap ISA ne2000 cards can keep up with the cable modem. Even if you want to serve a few pages with apache or ftp a 486 is up to the task. If you want a system that you can install and forget, OpenBSD may be a better choice then FreeBSD. The 3 years without a remote exploit in the default install (which includes apache and sendmail) is comforting. I assume that FreeBSD can be secure as well, but they have always said that performance was their main concern whereas OpenBSD has always said that security is their main concern.
Compared to Linux I prefer OpenBSD as a gateway. I really like IPFilter and IPNat over IPchains. I find the configuration files much easier to read. For example the following blocks and logs all attempts to telnet to my gateway:
(The above is a quick'n'dirty example. Please consult the docs before making your own rules).IPFilter and IPNat do lack the proxies that come with Linux IP-MASQ. Generally this is not a problem as the IPFilter 'keep state' rule and IPNat seem to be smarter then Linux IP-MASQ. However I have not used Linux as a gateway for over a year so I could be wrong. If you IRC get the tircproxy package (look on freshmeat.net) and set it up as a tranparent proxy. Tircproxy proxies DCC connections and I recommend it to anyone using using IP-MASQ or *BSD IPNat
A good OpenBSD resource site is www.deadly.org
ftp://releng4.freebsd.org/pub/FreeBSD/snapshots/i3 86/4.0-20000608-STABLE/ thats -STABLE ?
Too bad for them. I like IRIX. And BSD. And Linux, sometimes. Solaris, however, sucks my ass. IRIX has all the features you attribute to solaris, but it's actually fast. XFS is infinitely better than Solaris standard UFS, and you get it out of the box without paying extra. IRIX's thread implementation is functional, fast, and standards-compliant. NFS, including v3, works great. Intelligent SMP support? Well, IRIX runs on the 8k+-CPU nuke simulators and other massive Origin 2000 systems. Solaris can do 64 CPUs, but slowly (well, it can't do any number of CPUs quickly). I could go on, but I'm convinced the world is blind to Solaris's failings, which are many and severe.
Your point is? WinDOS has almost 90% market share. Does that mean it doesn't suck? Solaris takes a beautifully-designed lightning-fast million dollar system and makes it run like a 386 with a flaky memory module. IMHO, that qualifies as "sucks." I guess your definition is different. Just remember me when you're trading up your expensive Sun box again to make up for the failings of Solaris; I'll buy the old system from you, put UltraLinux on it, and get the same performance you will at half the price. I wish BSD had SMP support, but it's still worth using if you have a UP system lying around. Linux on SMP UltraSPARC, however, is a thing of beauty.
Theo de Raadt said in a recent article that he was getting at least one venture capitalist calling him a week - and that he's turning down the offers. He's just not interested in going that route at all. I would think the GNU-like minded folks might respect that, but who knows?
Here's the qoute from the upside interveiw with de Raadt (Its down at the bottom of the page):
Next to shooting down potential investors -- "I'm basically getting somebody trying to offer us venture capital once a week"
--Theo de Raadt
OpenBSD 2.7 improves support for high end system boards, SCSI controllers, ethernet interfaces, and adds gigabit ethernet drivers and IPv6 networking.
:)~ ). If not, visit Day 2 of our trip for a few picks. Look for the scanned custom badges that they were handing out.
The first three were of no surprise, but the last two were mind boggling. Gigabit ethernet drivers? Be awhile before I actually pick one of these up...or for anyone else for that matter. And IPv6 protocols? I had no idea someone was trying to implement it. Do you know how much of a problem MS is going to have implement this? A new OS will be needed, I don't think a backwards compatible patch is possible for all of Windows 9X and NT.
Linux will most likely not have a problem implementing this, but it might be awhile before it happens because it is not needed yet.
I'll admit though, there is one thing that BSD has that Linux does not. Girls looked damned good in skin tight, red leather and tiny red horns. (Anyone who was at the Linux World Expo in NY knows what I am talking about
http://geeksinnewyork.n3.net
"Imagination is the only weapon in the war against reality." -Jules de Gautier
Why? Linux has done encrypted swap and filesystems for years.
OpenBSD did not have procfs installed by default where as *BSD did. And from what I understand from my security junkie programming buddies, FBSD is still probably vulrable to a procfs exploit (although it hasn't been written yet). OpenBSD worked really hard on this one and fixed the problem right.
Code junkies wanna check out the code? OBSD procfs patch
FBSD procfs patch
Swap partition, no. Swap file, yes.
this ain't true: there's absolutely no problem using a loopback-ecrypted patition as swap-device.
Ramdisk in memory
absolutely pointless, since the encryption keys have to remain in (unencrypted) memory anyway.
I have the impression that some guy's miss the point here: encrypted partitions are not (primarily) meant to protect against intruders on a running system (a 2nd reason why encrypted ram is basically pointless) but to protect against theft, confiscation, seizuere (or whatever the legal pretext of the day may be called) of your hardware. It's about ensuring that once the power is turned off, there remains absolutely no recoverable data on the system.
Therefor it is, btw, reasonable to encrypt the swap partition with a random key transparently generated on startup (I've patched losetup to provide this very option.)
Why not try the OS for youself? If you like the features then use it. Don't try and pretend linux will always do everything you need. Use the right tool for the right job.
Only the State obtains its revenue by coercion. - Murray Rothbard
I have built an OpenBSD Firewall, and it has been chugging away on a $10.00 salvage 486 with two spare NICs for a few months now. OpenBSD uses the IPFilter packet filtering program for firewalling, and for Network Address Translation (having multiple machines share a single IP), you have IPNAT.
Both are included in the base install of OpenBSD, but need to be activated. From the OpenBSD FAQ at http://www.usa.openbsd.org/faq/faq6.ht ml#6.2 you can check out the IPFilter and IPNAT sections - this helped me to get running from practically step zero. The MAN pages in OpenBSD are also the best in the business, with example code and config files, and they are consistently getting better with each release.
To develop your rule base for IPFilter, you can't beat the IPFilter HOWTO located at http://www.obfuscation.org/ipf/. This has everything you need to know about creating a solid firewall without being an expert in TCP/IP packet routing.
So since you can get all the info for free, try downloading OpenBSD 2.7 and give it a shot. When it works for you WAY easier than you expected, take the cash that you would have spect on the firewall book and purchase the CD (and yes, mine is on the way...)
Good Luck and Enjoy!
They do not -and I think, will not- add things such as KDE to their ports... OpenBSD is not built for beauty... It is built for rock-solid security. You can still add KDE, using the built-in Linux emulation, but IMHO you are defeating OpenBSD's reason to exist.
On where to find a list of ports, anyway... You can find a list at ftp.openbsd.org/pub/OpenBSD/2.7/ ports.tar.gz.
There is Freshports, it's similar to Freshmeat.
thanks, I think I'll check it out. My decision to use OpenBSD was highly influenced by the "secure by default" ethos of Theo & crew, and the fact that its been years since the last OpenBSD box has been rooted. So for me the Linux vs. OpenBSD discussion is kinda moot, but I'm sure I'll enjoy it anyway.
No, Thursday's out. How about never - is never good for you?
True.... What we need are encrypted core dumps
encrpted swap is nice...but the big problem with memory is the core dump. If someone has local access to a box, and can get a core dump, there's a change they can get login-name/password-hash combo's, and it's trivial to run a word-list through a program like crack.
on improperly configured boxes, local access isn't even required as long as their running apache, because apache let's you enter the '..' directory in path names.
For IRC get tircproxy (look on freshmeat.net) and set it up as a transparent proxy. I would recommend this to Linux IP-MASQ users as well. I didn't bother with the oidentd part to tircproxy to set the usernames.
For ftp there is the 'proxy ftp' option for IPNat. I haven't really tested in though as my FTP client (lukemftp) is set to use passive by default. Netscape ftp seems to work though and I have no idea if it uses passive or not.
I feel compelled to agree with this comment. I too, must say that I really love Linux. That being said, it is _not_ a new user's operating system.
I feel that any of the *BSDs are very solid and production ready. I can't say that about a number of Linux machines. Linux can be made to be a very secure, wonderful, and easy Operating system, but for people wanting to get started, BSD is a better choice.
BSD's _biggest_ advantage is the weath of excellent documentation on general usage. OpenBSD's documentation is the man page system. Anything that you could possibly want to know about OpenBSD is in the man pages. This makes it very easy to find what you are looking for.
For those who also like "handbook" style docs, FreeBSD combines excellent man pages (sometimes Linux's manpages are a stretch) with a handbook that gives you a general overview of how to do basic administrative functions.
I advocate new users starting with FreeBSD because of the very user-friendly docs. FreeBSD's website has documentation that starts by teaching a user how to login! Seriously, read the "FreeBSD for people new to both FreeBSD and UNIX" documentation and tell me that wouldn't be good for _any_ new user.
OpenBSD is not quite so basic, but the docs are more friendly than anything I've seen from the Linux Documentation Project. I really like the LDP, but OpenBSD has some really great man pages.
If you are a linux user, check out one of the BSDs. You'll be glad you did. I started with Debian and Slackware circa kernel 1.2.13, and started using BSD last August. I'm hooked!
-Peter
. Penguins Surely Ca
Building Internet Firewalls, Second Edition Zwicky, Cooper, Chapman. This will provide you with more background information, but nothing on OpenBSD. (I was, not so much disappointed, as surprised, at this, for the first time with an O'Reilly book).
The best, in my very humble opinion, references are online, but they aren't as nice to read as the Building Linux and OpenBDS Firewalls book, but are an excellent suppliment.
http://coombs.anu.edu.au/ipfilter
http://www.obfuscation.org/ipf/
See the prior of the web pages for a mailing list (Majordomo). The author (Darren Reed) of IPFilter actively participates in this mailing list, which is helpful, and often appreciated.
Hope that helps
Brian
Hey. I'm running NetBSD on a Mac SE/30. I am thinking of running OpenBSD on a second SE/30 I've aquired for such adventures. Did you really think I'm doing that because I can't afford a '486?
Coolness matters. The geek factor matters.
There's an SMP branch in the CVS repository.
There's a few information available here.
If you install from the FreeBSD CD, just do a minimum installation, then, ftp to one of the ftp sites and install the ports from there, then, you'll have all the latest upgraded stuff, the most current upgrades at the time of your installation, but you need a broadband connection for that. Way cool and effcient. Alex
Sounds like a Redh*t problem...but then you said you tried Debian, too. Back in the day, I started with SLS, then went to Slackware...nowadays, I'm using SuSE. (I took a quick detour into Corel Linux (based on Debian), but I couldn't get it dialed in just the way I wanted and didn't want to waste the time to figure it out when I knew how SuSE is configured.) I've installed SuSE on everything from a Cyrix 5x86 up to a K6-III and have never run into problems. I can't say that I've ever used Redh*t, but it seems that when someone posts to comp.os.linux.* or /. with a "Linux problem," it often ends up being a Redh*t problem.
I tried one of the BSDs (don't remember which one) a few years ago...there didn't seem to be anywhere near as much activity swirling around it as for Linux, so it didn't stay on my computer long. Now that my NetWare server setup is trashed (flaky i430VX-based motherboard, not a software problem...funny how most of the hardware problems I've run across have been with Chipzilla hardware, not stuff from this underdog or that underdog) and the machine it was on is fixed, maybe it's time for another trip into "BSD-land."
_/_
/ v \
(IIGS( Scott Alfter (remove Voyager's hull # to send mail)
\_^_/
20 January 2017: the End of an Error.
They grind code slowly but exceeding fine.
Seriously, it's a different philosophy with different priorities. Linux developers in general are more interested in rapid growth, a rapid release cycle, lots of feedback to fix stuff. BSD developers in general take a more "autocratic" (if you don't agree) or "controlled" (if you do) approach. And the OpenBSD team takes an "extraordinarily careful" approach, which is why we never hear about OpenBSD boxen getting cracked...
------
------
You are in a twisty little maze of open source licenses, all different.
Rebuild a kernel with Linux is very hard work by comparision.
-Alex
Woo! Great stuff. Now if only I could encrypt my BIOS...
------
------
You are in a twisty little maze of open source licenses, all different.
It was suggested to me by another good tech that there would be an issue of this chewing up CPU cycles. I'm wondering how this problem was addressed, and weither it could be ported to Linux easily?
Fawking Trolls!
"Going to war without France is like going deer hunting without your accordion." - Jed Babbin
I'm working my way through the Wiley book and finding it very good. There's a high-level (i.e. no code) overview of the various kinds of attacks and exposures, and what firewalls can (or not) do about each.
Then theres a, umm, diplomatic discussion of the choice parameters between using Linux or OpenBSD. It struck me as plain enough, between the lines, that they think OpenBSD has it all over Linux save in the level of support of some hardware, and possibly ease-of-install.
A fair bit of the book is devoted to the install of each, and configuration of the firewalls. I don't know if the book gives you anything about the actual setup that you can't get from OpenBSD's own documentation or the fine howto's at the "obfuscation" site, but I really benefitted from the textbook learning of the background of how IP packets work, and how lies inside them are the basis of most kinds of attacks.
PS: Good sense of humour in it, too. Buffer Overflow attacks are in a paragraph headed "Buffer: The IP Slayer".
( Read More... | 736 bytes in body | 6 of 66 comments )
Damn satanic OS...
Chris
An Education is the Font of All Liberty
I see OpenBSD has VLAN support. Very nice. Does anyone know when Linux will have this in the stock kernel? Linux or OpenBSD would be great as VLAN routers.
Any technology which is distinguishable from magic is not sufficiently advanced.
- A.P.
--
"One World, one Web, one Program" - Microsoft promotional ad
"Remember when the U.S. had a drug problem, and then we declared a War On Drugs, and now you can't buy drugs anymore?"
this person doesn't know what they're talking about, OpenBSD has nothing to do with Solaris other than their (ancient) BSD heritage. It is a completely separate project not affiliated with Sun.
Big thanks to the /. crew for the BSD Icon!
Are you trolling? Solaris is System V, OpenBSD is BSD, SunOS is BSD...
OpenBSD is based off NetBSD, which NetBSD is based of BSD Lite 4.4, which comes without restrications or royalties.
Solaris was based (and extremely hacked up) from SunOS, which SunOS was based off (help me here) BSD Fat(??) OpenBSD
"`Ford, you're turning into a penguin. Stop it.'" -THHGTTG
The /. community is mostly Linux-centric, the BSD section doesnt get a lot of readers (as opposed to other sections).
:)
A lot of people seem to have some misconceptions about OpenBSD vs. FreeBSD vs. Linux Distros. (I don't have a lot of experience with NetBSD)
OpenBSD's primary purpose in life is to provide the most secure operating system availible. I personally think it has succeeded very well in this respect. Its the only operating system I would ever let touch my servers. OpenBSD works alright as a workstation OS, but IMHO there are better choices, depending on your needs. It works great as a router or firewall, and with the inclusion of RTMX O/S it is sure to only get better.
FreeBSD is meant to be, much like most Linux distros, an all purpose OS, which works well on workstations, as well as servers, and in many ways is, along with OpenBSD, superior to most Linux distros.
Linux distros are unique. I personally wouldn't run anything but Debian, which is partially an exception to the point Im about to make. Most Linux distros (ala RedHat) are geared more to try to be everything to everyone. This often times leaves a Linux distro very, very open by default (ala RedHat). Linux works decently as a server OS, lacking some more advanced crypto support (by default, these things can always be installed manually, or packaged), and works extremely well as a workstation OS.
OpenBSD isn't designed to be a workstation OS, as RedHat and others seem to be geared (You really shouldn't need a server running X by default). OpenBSD is designed to be secure, and -- as Theo claims -- hasn't had a remote root exploit in the DEFAULT install in three years. THATS why I choose OpenBSD for my servers. Ports really don't matter as much to me in OpenBSD as in FreeBSD, et al, because I simply don't need them. I really don't use anything other than xntp (which is now packaged) that isn't installed by default, or that I don't compile from source myself (i.e. not from a port).
The right tool for the right job, Linux doesn't need to be everything to everyone.
(I am not responsible for my bad spelling and grammer
Seriously, wouldn't encrypting the swap space take a serious toll on speed?
Visit me on #weirdness on the Galaxynet.
WTF slash ate my comment! Dammit, oh wow just found a bug, anyways the above post should of said:
Are you trolling? Solaris is System V, OpenBSD is BSD, SunOS is BSD...
OpenBSD is based off NetBSD, which NetBSD is based of BSD Lite 4.4, which comes without restrications or royalties.
Solaris was based (and extremely hacked up) from SunOS, which SunOS was based off (help me here) BSD Fat(??) less than 4.4 code (before all the lawsuits) in which Sun pay a one time huge (undisclosed) amount to AT&T to use AT&T/BSD code.
I don't see how you make the connection from Solaris OpenBSD
"`Ford, you're turning into a penguin. Stop it.'" -THHGTTG
I just know I'm gonna get flamed for asking a Linux question in a BSD article, but is there any way to encrypt a Linux swap partition? Also, are there any ways to encrypt the data in physical RAM, in any OS?
defacto servers in 90% of the enterprise market
Sadly yes. But do you think this is because Sun Sales Managers and PR reps brother the CEO and stroke him off, or do you think it is because the CEO knows what he is talking about on a techinal level?
Go up to any CEO and say "Sun Microsystems", they will say "The Dot in the Dot com people, right?", then say "OpenBSD Project" and they will say "So that is S&M Sex, right?"
It is not because Solaris is a better OS (which it is a DAM FINE one), but because Sun has a bettering marketing powers over CEO's that could even rival Microsofts PR (in some cases). What marketing power does OpenBSD have? A blurb on slashdot and maybe someone in #linux at 4 oclock in the morning saying something about it.
Just because something has a lot of users doesn't mean it is good *COUGH*****COUGH*
Solaris is good, but don't rate it basiced on number of users, basic it on techinal facts...
"`Ford, you're turning into a penguin. Stop it.'" -THHGTTG
I've got Linux on my machine, and I'd like to try out BSD. Is there a "HOWTO" or some such document somewhere that outlines how to instal OpenBSD on a system that's already got Linux, so that I could dual-boot?
Also, does OpenBSD have ext2 support? Since it's got Linux binary emulation, it would be nice if I could just load the Linux executables off of my existing ext2 filesystem...
I fart in your general direction!
Im just wondering i use FreeBSD 5.0-current and 4.0-release... and 4.0 is -stable so why would they come out with 3.5? Im a little confused..
SSL was merged into the -current tree of NetBSD yesterday (probably in time to ship with the 1.5 release expected to branch from -current soonish).
As far as SSH is concerned NetBSD takes the hey those are ports! approach.
--
two-thousand-zero-zero
party over, it's out of time
I figure that if you're security-paranoid, and you're programming an app, then you'd make sure that you never wrote sensitive info to disk. Say, you decrypt something, but only to (volatile) memory, so it can't be retrieved. Now... if that memory is written to swap, all of a sudden, you could probably go through that partition bit by bit and see what was there, as long as it had not been overwritten.
:)
This is completely off the top of my head, and may very well be wrong.
---
www.dubbele.com has a free netbsd based firewall. Also, on the web site there's a good list of resources you may want to check out.
-John
OpenBSD
The only thing thats safer:
An air-gap firewall
Well, for me, buying the CD is pretty much a given. :) But thanks much for the info.
No, Thursday's out. How about never - is never good for you?
I went to the grocery store and those bastards had the gall to make me pay for merchandise! Then I went to the gas station and had a heart attack when I found out gas wasn't free.
Things in this world cost money. OpenBSD still has less security holes than Free|NetBSD|Linux. I don't mind paying $25 for a good product, how else would they keep the project going? What does an ISO image have to do with its survival? You can download everything seperate. Why clog up bandwidth with a 600 meg file when you will be using 1/10 of its contents? I doubt you intent to install it on every architecture. Nothing is stopping you from making your own ISO image, so stop complaining.
Only the State obtains its revenue by coercion. - Murray Rothbard
Now of course I could've done it by hand and all that... but it just got me tired. Sure, call it easy and so, but unless the auto functions work, why have them at all? I havent tried it again after that, I probably will when I get some more time over this summer.
Tomorrow will be cancelled due to lack of interest
I personally had to ditch efforts to run Linux on a DEC 486 I picked up after it was decommisioned at my school. Just about everything on this PC was in awful shape, from the RAM to the HDs to the BIOS. Nevertheless, I managed to install FreeBSD 3.4 on the first shot! After a little tinkering, I had this box running _beautifully_ as a cable-sharing gateway with a few auxillary services.
IMHO, BSD has really gotten the shaft in terms of public opinion. If you ask me, it really is the better operating system. It just doesn't have the hordes of fanatics. =)
--
Can you really get quad 486 motherboards? What about 16 proc orginal pentium boards, that would be cool.
"`Ford, you're turning into a penguin. Stop it.'" -THHGTTG
there is now a -STABLE branch to the cvs tree,
good for those who dont like applying patches by hand.
Just picked up a Thinkpad iSeries 1450 last week, and i've been having problems getting everything running under RH6.2 -- During my epic saga of a search for a fix, I found this page, which was tremendously helpful:
*NIX On The IBM Thinkpad
This page has a run-down of several free *NIX'es, and how they compare against eachother on the Thinkpad. Turns out OpenBSD 2.6 wins hands down.
Now I may rest.
Bowie J. Poag
Bowie J. Poag
ever notice OpenBSD shirts and cd cases are lame. I use OpenBSD and really like it, but the "image" it puts off reminds me of a badly made ceral box..
"`Ford, you're turning into a penguin. Stop it.'" -THHGTTG
Seriously. For those of you who haven't tried *BSD but like Linux - you should give one of the BSDs a go. Installing FreeBSD is dead easy, OpenBSD aswell. What you get is a solid and functional OS.
My first impression of OpenBSD was that "Man, they've really put some thought into this". Redhat/Mandrake and the others cram in loads of weird programs on your harddrive but the default *BSD install is very slick and slim lined. You get what you need and if you want more then go for the ports.
The ports system rocks! For those of us with fast connections it's far better than RPM. No problems with missing libraries and no hassle.
Enough of the rant. Now TRY it!
j0hn
I'm running an OpenBSD 2.6 firewall at home for half a year now, but I miss Linux' "plugins" (ip_masq_ftp et alii). It's really a nat issue, not firewalling, but it's till annoying having to switch on FTP passive mode every time, and not being able to initiate a DCC chat/send with IRC.
Is there anything I can do with OpenBSD to alleviate this?
--
"Negative on that, I'm a meat popsicle."
This is slightly off-topic, but some time ago, I heard that Debian was looking to do a FreeBSD port of Debian. How difficult would it be to also do this for OpenBSD?
Is anyone even considering this anymore?
-Chris
> FBSD is still probably vulrable to a procfs
> exploit (although it hasn't been written yet)
Hrumph - there's nothing like jumping to conclusions. Do you really think FreeBSD coders are idiots and don't know how to fix bugs when they see them?
IIRC, OpenBSD was just as vulnerable to the problem as FreeBSD if you enabled procfs, the only difference being they didn't enable it in the default kernel.
-Jon
this is my sig.
OpenBSD is fantastic for servers, especially if you don't need to run KDE or Gnome apps (although, I'm sure you could figure out how to run some o' them new-fangled window managers, if you are so inclined.) If you are looking for a desktop system, though, I'd look elsewhere. Personally I don't even install X11 if I can help it.
The encrypted swap feature is not one of the points that initially sold me on OpenBSD (although it does sound über-sexy at cocktail parties). =P
It's the other, shall I say, more practical (OK, all right, probably more boring, too; but...) features that I like. Like SSH built-in, and everything locked down by default. Not necessarily cutting-edge, but nice. I sleep well at night.
Free music from Jack Merlot.
Riiiiiighhht........
Muslim community leaders warn of backlash from tomorrow morning's terrorist attack.
Oh my, I feel so pathetic. We poor americans have a lot to feel bad about. I mean we produce more food than any other country on earth. Our industrial capacity is also the biggest anywhere. Also our economy is the largest as well as the fastest growing on earth. Then there is the fact that our military capability is the greatest the world has ever known. Being the birthplace of modern democracy doesn't help much either.
God, we suck!!!
I think that other countries like France, Germany, or Great Britain, who once had vast empires only to lose them, are by far superior to this country. But then again maybe they aren't and the people who live there are simply jealous? I really can't say for sure, since I've never been to those countries. But I'd be willing to bet that most of the people there who point out how much we suck have never been to America either.
I guess the only thing that sucks more than being an american is being someone whose inferiority complex is set off by americans.
Lee
Muslim community leaders warn of backlash from tomorrow morning's terrorist attack.
Now i have something to play with at work before they fire me!!!!!!!!
... And yours seems to be filled with a bit of zealotry.
I've heard alot of nasty things about solaris, including slow and insecure. However, I've _not_ heard "obsolete" before. How do you figure solaris as being obsolete ? Is it that bit about working kernel level threads ? Or intelligent SMP support ? Maybe you were talking about the obselete man pages that fully document the thread safety of nearly any function call. Perhaps you meant the obsolete software/hardware integration w.r.t. fault tolerance features. Maybe you were upset about solaris's obsolete NFS performance, which by the way, destroys that of both linux _and_ OpenBSD.
I won't make a judgement about which OS "sucks less", both are critical in what I do every day. OpenBSD is not the end-all be-all operating system, you should of course be wise enough to know that no operating system is. Until *BSD and Linux can pick up some of the features I've mentioned above, there is plenty of future left for solaris, and some of the other top-tier Sys-V based unicies.
As an amusing postscript, Ironically enough, where is Linux getting major patches and work done on some of these "enterprise" and scalability issues ? From SGI of course.. makers of IRIX.. the most universally loathed UNIX amongst free unix/BSD zealots.
My opinions are my own, and do not necessarily represent those of my employer.
Can anyone recommend a good firewall book for OpenBSD? In particular, I've got the O'reilly book, Building Internet Firewalls, and I was considering Building Linux and OpenBSD firewalls, from Wiley.
Any comments or suggestions?
No, Thursday's out. How about never - is never good for you?