Slashdot Mirror

← Back to Stories (view on slashdot.org)

OpenBSD 3.0 Release, Interview with Theo

Posted by michael on from the wuftpd-not-installed-by-default dept.

mvw writes: "Here is an interview with OpenBSD's Theo de Raadt. Interesting is his comment on Soft Updates and the comparison to the rivaling Journaling file systems technology. Further he links to a very interesting paper by some Soft Updates researchers." And although OpenBSD 3.0 has an "official" release date of December 1 for whatever reason, it seems to be available by FTP or CD already. Lots of changes since 2.9.

5 of 307 comments (clear)

  1. The origin of OpenBSD by Gopher · · Score: 5, Informative
    As I sit here waiting for my copy of OpenBSD 3.0 to arrive, I've been reading the exchange of emails between Theo and the NetBSD core team, which is a history of how OpenBSD came to be.

    If you haven't read them before, it's quite a read, and a good lesson of how personal politics can fragment a collaborative project.

    Here's the link: http://zeus.theos.com/deraadt/coremail

  2. pf : an excellent packet filter by chrysalis · · Score: 5, Informative
    The big new feature in OpenBSD 3.0 is pf.
    • Interesting stuff in pf over ipf : the configuration file accepts a very similar syntax, but with very handy shortcuts, especially expansion. For instance you can write { pop,smtp,imap } in a rule to specify a list of ports, instead of creating multiple rules. It also accepts macro substitutions. You can easily write very clean configuration files.
    • Interesting stuff in pf over ipfw/ipfiler/iptables :
      • scrub : just give an interface name, and pf will "normalize" everything coming to this interface. Packets will get cleaned up and reconstructed : your local network will only see clean packets, nothing that could be dangerous for badly written IP stacks.
      • tcp state modulation : this feature dynamically remaps tcp sequence numbers, to give the excellent entropy of OpenBSD stack to all your traffic. It means that servers running Windows, badly configured Solaris or older FreeBSD versions can be protected from session hijacking, even through their stack has weak sequence randomization.

    pf seems to be very stable so far. Just don't forget to apply the related errata if you're planning to use IPv6.
    Another great feature of OpenBSD 3.0 regarding network filtering/routing is the integration of AltQ, that brings quality of service to your IP traffic. It basically has the same (but very flexible and efficient) algorithms and class system that Linux has. But it's very nice to see it in OpenBSD.

    --
    {{.sig}}
    1. Re:pf : an excellent packet filter by chrysalis · · Score: 5, Informative

      * For NAT:

      OpenBSD 3.0 has a transparent ftp proxy called "ftp-proxy". You have to run it through inetd (or any super server. I use it with tcpserver) . It listens to a local port, and you just have to redirect outgoing traffic for port 21 to the local ftp proxy port. It allows active and passive connections to NATed internal hosts.

      If it can help, my /etc/nat.conf file is :

      rdr on vr1 proto tcp from any to any port 21 -> 127.0.0.1 port 8081
      nat on vr0 from 10.1.1.0/24 to any -> 195.132.209.36

      I start ftp-proxy like this :

      /usr/local/bin/tcpserver -H -R -q 127.0.0.1 8081 /usr/libexec/ftp-proxy &

      *WARNING*
      ftp-proxy has a nice security feature to only accept anonymous sessions (-A). But don't trust it : clients can bypass the restrictions with some buggy servers (the flaw works with proftpd and ncftpd. it doesn't work with pureftpd) .

      * For firewalling (without NAT) :

      You have to explicitely open some ports for active connections. For the minimum number of ports : choose at least twice the max number of simultaneous sessions you need. Open them on the firewall. Then, force your FTP server to only use these ports. On Pure-FTPd, it's with '-p :', example :

      pure-ftpd -4 -p 50000:51000 &

      (don't forget '-4' for OpenBSD) .


      --
      {{.sig}}
  3. ISO download by Syberghost · · Score: 5, Informative

    As Theo says himself in his interview, people who don't like his model of selling the ISOs are free to make their own. This will hopefully quiet the stupidity that usually follows this announcement:

    As usual, ISO images here.

  4. Re:file systems by mvw · · Score: 5, Informative
    Some links: