OpenBSD 3.2 Readies For Release, pf Matures

An anonymous reader writes "Just over a year ago, OpenBSD creator Theo de Raadt ripped ipfilter out of the OpenBSD code leaving "the world's most secure OS" temporarily without a packet filter. Here's an interesting interview with Daniel Hartmeier, author of pf, the stateful packet filter developed as a replacement. Now just over a year old, it sounds like pf has already become a serious contendor in the world of stateful packet filtering. This interview is of particular relevance with OpenBSD 3.2 to be released on Friday, 11/1."

Comments

so is there a packet filter or not?

[meshko]

Is it me, or is this story confusing? They took ipfilter out, but there is pf, so how is it without packet filter?
And what's up with that "the most secure os" sarcasm? OpenBSD *is* secure.

Re:so is there a packet filter or not?

[aridhol]

When they took ipfilter out, OpenBSD didn't have a packet filter. In order to address this issue, pf was written. After pf was written, OpenBSD had a packet filter. There was a time, after ipfilter was removed, but before pf was added, that OpenBSD didn't have a packet filter.

Re:so is there a packet filter or not?

[Anonymous Coward]

It is you. "Just over a year ago, ...Theo ... ripped out ipf. ...pf, ...developed as a replacement. Just over a year old, pf is ..."

It is you. Sorry if all of those other words confused you.

Re:so is there a packet filter or not?

[a ( h 3 r 0 n]

The reasons for ripping IPF out of OpenBSD are documented elsewhere, but what it basically boils down to is a licensing issue. Darren Reed, author of IPF, changed its license to something incompatible with the stated goals of OpenBSD, so it was removed. Daniel (incredibly) came up with a replacement in record time. The 3.2 release boasts a lot of things, besides improvements to PF. These includes things like a nonexec stack, a chrooted apache, a reduction in the number of setuid binaries, and more 'secure' filesystem mount options by default. Theres no sarcasm implied, I'm sure. OpenBSD truly IS among the most secure operating systems in the world.

Re:so is there a packet filter or not?

[jbolden]

OpenBSD truly IS among the most secure operating systems in the world.

I think its probably fairer to say something like, "OpenBSD truly IS among the most secure Unixes in the world". There are fundamental security flaws with Unixes that run very deep which prevent it from being really really secure. Look at an OS like Z-OS or Eros to see how much further security can go when you break from Unix security flaws like:

- The existence of a filesystem
- Having any individual have much real authority over the system ....

Re:so is there a packet filter or not?

[Anonymous Coward]

But was there ever a RELEASE of OpenBSD that didn't contain a packet filter? I don't think there was, but I could be wrong here.

Re:so is there a packet filter or not?

[Trusty Penfold]

you break from Unix security flaws like:
- The existence of a filesystem
- Having any individual have much real authority over the system ....

That sounds really bloody useful ... I can't do anything with my computer; and even if I could there's nothing I could do it to.

If you don't mind, I'm off to assert my authority over some files now ( TieMeUp.Jpg doesn't know what is has coming!)

Re:so is there a packet filter or not?

[jbolden]

A lot of very high end stuff runs on systems with distributed administration (like most of America's transaction processing, accounting, etc...) Back in the late 70's - early 80's capability systems were a huge percentage of the market.

You don't need a file system to have data -- for an example you are likely familiar with think of palm OS. Data is just stored in internal program specific data structures and "swapped" out of ram to disk. The important thing is that the disk is just a bunch of sectors with a zillion different data formats; but to understand the organization of the date requires running the system which imposes the security model...

Re:so is there a packet filter or not?

[Anonymous Coward]

only the -current development branch was lacking a packet filter. obviously the stable branch and existing installations still had a functioning packet filter implementation. also note that ipf patches were made against OpenBSD CVS after theo pulled it, provoking a somewhat amusing debate on misc@.

Re:so is there a packet filter or not?

[Anonymous Coward]

except that saying that would be an abuse of the X/Open Group's trademark on the term 'UNIX Operating System'. (you insensitive clod).

Re:so is there a packet filter or not?

[Anonymous Coward]

no, there was not. OpenBSD 2.9 included ipf as the packet filter. OpenBSD 3.0 and 3.1 included pf and lacked ipf.

Re:so is there a packet filter or not?

[Anonymous Coward]

at the other end of this envelope is Bell Labs' Plan 9 which carries the UNIX principle that states "everything is a file" to the logical extreme while distributing privileges sanely, unlike UNIX with its all-powerful root. apparently this system runs a significant portion of the telephone systems in the US, at least. the design principles are sound, anyway; witness Sun's Trusted Solaris and the DARPA-funded TrustedBSD project.

Re:so is there a packet filter or not?

[Anonymous Coward]

Basically the license said that if you applied security patches to ipfilter and openbsd that it gave the author of ipfilter permission to install any software he wants on your computer and to take control of any media you may have (DRM)

Re:so is there a packet filter or not?

[afidel]

but to understand the organization of the date requires running the system which imposes the security model.

NO, that would simply be security through obscurity which does not work. Any modern capabilities based OS would have strong cryptography at its core so that you could not access those data items that you do not have a key to. In fact a cool way to do it (not sure if this is done in any real system) would be to have 2 keys, one for the runlevel and one your private key which is protected by your login, that way you could not access things outside your runlevel and you could not access other data in your runlevel unless it was explicitly given permission to you by using your public key (think ACL's but the creator of the data would have to add your key to the files encryption)

Re:so is there a packet filter or not?

[jbolden]

Cryptography is obvious. The problem is how do the apps get their keys? If you have a file system then the keys are stored in some file and so someone else can get the keys....

OTOH if the app stores the key in memory and is always running (though possibly swapped out) then you don't have any problems with storing keys securely.

Remember capabilities are useful but you also have to secure the system against someone just taking the hard drive out.

As for your ideas with dual keys it is done (hate to mention this) but for example Palladium uses that strategy (though they don't call it run levels)

Re:so is there a packet filter or not?

[Waffle Iron]

That sounds really bloody useful ... I can't do anything with my computer; and even if I could there's nothing I could do it to.

I don't know about Z-OS, but I've read a little about EROS. EROS doesn't need a filesystem. That's because everything in EROS is persistent. The system saves a complete snapshot of its virtual memory to disk every couple of minutes. There is no "rebooting" of the OS. If you pull the plug, it comes back up exactly in the state of the last snapshot.

For me, it took a little while for that concept to sink in. They're saying that there's no need to redundantly keep information in permanent storage and volatile storage. Just make it all permanent, and you don't need the filesystem concept at all. In one step, you eliminate whole classes of bugs (parsing, file permissions, sharing files, filesystem namespace problems, etc.)

Their authority model also makes sense. Think of your system as a large building. Normal OSes treat security like doors with electronic badge readers; you're allowed to do things based on who you are. Naturally, a lot of doors must be programmed to let you through if you're going to get around the building to do your work. It's hard to ensure that each person is never able to get into a room that they shouldn't be in.

EROS is more like a building full of unique old-fashioned key locks. You have no automatic authority to go through any door. You must obtain the individual key for each door. You get these keys on an as-needed by the people in various rooms you interact with as you do your work. Each person with keys to hand out individually determines if you are worthy to go through the next door.

Reading up on EROS really expanded my view of how an OS could work. You can check it out at www.eros-os.org.

Re:so is there a packet filter or not?

[dvdeug]

Look at an OS like Z-OS or Eros

Which sites are run off of these operating systems? Which organizations run these operating systems? Or are they merely theoretically secure, with little use under fire?

Having any individual have much real authority over the system ....

Back to real life, short of hard cryptography, one individual usually has complete access to everything on the system. If I can run another OS on the system, I can copy or change anything and everything. Without custom hardware or always having to have someone else with the admin in the computer room, sooner or later the admin will get the chance to boot into god mode and do as he wills.

Re:so is there a packet filter or not?

[Anonymous Coward]

cluebat: Z-OS is otherwise known as IBM OS/390 and holds something like 80% of the world's business data.

Meanwhile openbsd.org doesn't even eat their own dogfood. (and don't give us any shit about an Internet connection being some scarce resource in 2002)

Re:so is there a packet filter or not?

[Anonymous Coward]

I'm sure. OpenBSD truly IS among the most secure operating systems in the world.

Except for the fact that it's
(1) Unix
(2) Implemented in C

Neither of which were designed for security.

The fact is that OBSD relys on superhuman Unix/C implementation skills, and not even they are perfect, and security bugs slip through now and again. Not to mention that they can't even conceptualize "security" outside of the limited Unix model.

Basically OpenBSD is at the place where Windows will be after BillG spends a few million programming hours fixing shitty C/C++ bugs and dumb marketing requirements. It's a fairly low bar.

Re:so is there a packet filter or not?

[Sunner]

The reasons why openbsd.org doesn't run on an OpenBSD box are documented in the FAQ, but I guess that's just too much reading for some people.

Go troll somewhere else.

Re:so is there a packet filter or not?

[popeyethesailor]

Z-OS is the latest in the series of operating systems for IBM Mainframes, which I would assume are run by quite a few organisations.

While it's true that one may not come across a Mainframe-based webserver on the internet, they still rule the datacenters, and are generally considered pretty secure.

Re:so is there a packet filter or not?

[dazdaz]

Out of the box yes, however don't forget that it must be security hardened after the install to get the full merits of OpenBSD's hardness.

Re:so is there a packet filter or not?

[jbolden]

People have already commented that pretty much every major organization runs Z-OS :-) As for Eros its based on the ideas of Multics which were used by many organizations as well as the US Army for secure computing. Until recently (late 70's-95) the direction was away from security and this was the period where Unixes thrived. Its only with the pervasive internet and the desire to create systems robust enough to handle constant attack from hostile users that security is making a strong come back.

Anyway as for cryptography; cryptography itself doesn't solve your problem. Where are the keys stored? If they are stored on hardware you can pull the keys off pretty easily by just picking your data; if they are stored in a hardware / software mix then the software component can be taken off by a root user.

That's why no filesystem is important. Sure you can boot into god mode using some other OS but you won't be able to understand the data since the data itself is owned by applications the cryptograhy keys are mixed at multiple levels... In other words to get to the data you need to boot the OS and then you get the OS's security. The box in a raw form can't extract the application specific data, so god mode doesn't do you any good.

Re:so is there a packet filter or not?

[dvdeug]

Where are the keys stored?

In the only safe place: the users' head.

In other words to get to the data you need to boot the OS

You could have said that about NTFS, before the Linux NTFS filesystem. If software took it apart, then software can put it back together - if necessary, take the OS, remove all security code, and boot that.

Re:so is there a packet filter or not?

[Anonymous Coward]

secure, but not terrbily usfeful, as compared to any Linux, MacOS X, or FreeBSD.

Re:so is there a packet filter or not?

[Lozzer]

Is what you are describing really true? Your talking got a little bit fast in the last paragraph. If I can boot in another operating system I can see all the data on the disk (Having no filesystem is just a red herring - the data is still there). The machine will bootstrap through normal BIOS procedures (at least in EROS which is i386 based). So I can follow all the code through.

The question then arises as to whether when the code wants to check for its first key, whether I can get that key or not. I'd wager that if booting EROS normally, someone has that key then I'd be able to get the same key when shadowing from a separate operating system

In other words what you say smacks of security through obscurity, though feel free to show me otherwise.

Re:so is there a packet filter or not?

[Shanep]

In the only safe place: the users' head.

I have a .45 semi-auto that can remove even those keys, one way or the other. They can either come out of their mouth or fingers, or then theres the other option, splattering those keys all over a wall. ;)

Re:so is there a packet filter or not?

[arkanes]

Maybe your analagy is just bad, but I'm not sure how a central key authority is inherently any more secure than a distributed one. If I get this right, you "knock" on the door and see if the person inside lets you in. This sounds very much to me like object level security permissions, which isn't really any different than file-level permissions. One of the reasons why we invented things like group level permissions was because of the administrative nightmare associate with individually coding security into every object, so I don't see how this is really a gain...

Re:so is there a packet filter or not?

[jbolden]

Think more like the virtual memory system then the NTFS filesystem. The data to interpret the filesystem isn't stored in a truly fixed place in a regular manner.

As for encryption stored away from the system; any data that the system itself can't access might as well be public you don't need security for that kind of data.

Re:so is there a packet filter or not?

[jbolden]

I'll grant you can rip the disk out and copy and image. I'm not trying to argue you can't get to the disk. Its the "red herring" I'm arguing is helpful. Because once you get the disk image what does that get you? You have disconnected blotches of data encrypted in a range of ways and stored in applications specific ways. Pretty nasty stuff.

I agree there is some obscurity involved but essentially this amounts to the computer equivelent of encryption + shredding. That's pretty yucky to deal with. Yes with infinite time and money you can beat it but...

Re:so is there a packet filter or not?

[evilviper]

Bull. OpenBSD is a blank slate, it is as secure as you choose to make it.

If you want to set all your programs to run as root, you can do that, though it will not be secure.

If you want to run your services as non-privlidged users and seriouly limit it's permissions, you can do that as well.

If a service needs root pormissions, you can go the way of OpenSSH, and give it privlidge seperation.

You can have any system in place that you want. The only common denominator in 'Unix' is it's method of most everything being a file or a system call. So, unless you believe that something like printf() or /dev/null is exploitable, you really can't use a blanket statement that Unix systems are flawed.

Root's privlidges can be shared, and then you can make it so no one can login as root. And I fail to see how having a filesystem leads to insecurity.

Re:so is there a packet filter or not?

[dvdeug]

Think more like the virtual memory system then the NTFS filesystem.

And you dump the virtual memory, I can piece it together. First you find the kernel, then the page and process tables, and then you can put the rest together without much trouble.

Re:so is there a packet filter or not?

[jbolden]

Agreed. If you go to that much trouble (i.e. multiple application specific file systems / data systems) you can get the data out. Any security can be broken given a large enough quantity of the product of:

inside knowledge * time * money

the goal is just to boost that figure :-)

Re:so is there a packet filter or not?

[dvdeug]

Any security can be broken given a large enough quantity of the product of: inside knowledge * time * money

the goal is just to boost that figure :-)

But standard cryptography, given a secure password, achieves more security, without changing all the base rules.

Re:so is there a packet filter or not?

[Lozzer]

All you are saying is given code and data that people can't reverse engineer. This is blatantly not true. Now because EROS is not mainstream there won't necessarily be any script kiddie tools to help you out, but we aren't talking the kind of infinite time and money scenario here, we're not even talking the long time that encryption gives you, unless there is some reason why its not just (albeit hard) reverse engineering.

Now whether EROS and a physical security policy is more secure, or easier to secure than another OS and a physical security policy is a different argument.

Poppycock!

[Mr_Icon]

Codswallop, January 11th is a Saturday!

Re:Poppycock!

[Ctrl-Z]

What exactly is wrong with a Saturday release?

Re:Poppycock!

[Skyfire]

(Yes I know this is offtopic) Speaking of which, does anyone know why the US uses MM/DD and everywhere else uses DD/MM? And please don't use the typical "Because USians give a rats ass about the rest of the world" (even though its true)

Re:Poppycock!

[Anonymous Coward]

because it makes more sense. month, then day. increasing specificity.

but then they go fuck it up and put the year at the end.

it should be: year, month, day

that's what the Goddess intended. praise the Goddess for her wisdom.

Re:Poppycock!

[Shanep]

because it makes more sense. month, then day. increasing specificity.

I think it doesn't make more sense, because as you say, the year is on the end.

DDMMYYYY makes a lot more sense than MMDDYYYY.

Medium significance, lower significance and then higher significance makes little sense.

Of course, the most logical approach is, YYYYMMDD, with significance than follows closer the way we count.

Re:Poppycock!

[RAMMS EIN]

I was confused by this, too. I stick to the convention of writing either ``1 November 2002'' or ``2002-10-01''. I use the first notation for absoulte clarity and consistency with how I pronounce dates (1st of November, 2002). I use the second notation for speed or when space is tight. It is consistent with the notation I use for time (most significant first, least significant last). Cheers.

Re:Poppycock!

[Arandir]

Because that's how we speak in 'Merica. When someone asks me when I'll visit next, I say "November second", and not "second of November".

Re:Poppycock!

[Christopher Whitt]

Of course, the most logical approach is, YYYYMMDD, with significance than follows closer the way we count.

Not only is this the most logical approach, it's the standard approach. ISO 8601 to be exact. Not only is it logical, but it is also very computer friendly since sorting datestamps that are in this format is easy: an ascending sort is a chronological sort.

Re:Poppycock!

[Shanep]

Not only is it logical, but it is also very computer friendly since sorting datestamps that are in this format is easy: an ascending sort is a chronological sort.

Oh tell me about it. Today I was at a client site who complained that they couldn't find their latest backup files. Reason being, that they were naming their backup files with alpha numerics mixed throughout the files and more importantly without leading zeroes.

Result being, files being naturally sorted in WinNT 4 Windows Explorer that did not go in the order the dates did.

The users backups were there, but so hard to find that they called me in because they were worried that their backups were not working!

They were only weekly backups, so if they saved them as apYYYYWW.zip all would have appeared to be fine. Where ap is an abreviation of the application data being backed up, YYYY obviously year and WW the week of the year. apYYYYMMWWDD would be nicer so that in the future, referencing particular backup dates could be quicker.

Thanks for that link BTW. Now I have extra ammo. ; )

Re:Poppycock!

[flimflam]

I think it's because it's closer to how we talk. We say "November 11th, 2002" not "2002, November 11th" or typically "11th of November, 2002" (unlike those pesky Brits.)

Save you the effort...

[Fnkmaster]

Dear Slashdotters,

I decided to save you the effort of replying to this article by summarizing all of the posts you are about to make.

1) BSD is dead poster: BSD is dead! Only 13 people use OpenBSD and they all live in their parent's basements!
2) Dumb Karma Whore: Packet filtering? What's that? Can somebody explain why pf is a better packet filter than the alternatives?
3) De Raadt Hater: Theo sucks! Burn in hell, Theo, you self-righteous prick. FreeBSD 0wnz!

Re:Save you the effort...

[Anonymous Coward]

what a stereotype!

not everyone has a basement, you know.

Re:Save you the effort...

[Anonymous Coward]

Not everyone has a house/apartment/domicile, either. Just look at RMS.

Re:Save you the effort...

[ImpTech]

Funny... while I don't live in my parents' basement, my OpenBSD box does, so I guess the first poster is half right.

Re:Save you the effort...

[ELiTeUI]

Thats too funny.

I also do not live in my parents basement, however one of my OpenBSD boxes does..

I guess it is a small world after all.

ELiTeUI

Re:Save you the effort...

[isolenz]

first off, yes I was one of those 13 people running openbsd (2.8, why fix something when it ain't broke... yet) but I moved outta my parent's basement 2 months ago, so can I ask you what category I've moved into now?
Anyways, as I previously stated I'm still running 2.8, it runs great, I can't see myself replacing it with anything but maybe 3.2 when it's released.
Also, I live in Calgary, home of Theo De Raadt, and am looking forward to the first seminar I can see of his.

Have a good time dissing other distros. let me guess darwin, net and the countless different linux distros suck too?

-isolenz

Re:Save you the effort...

[King of the World]

The funny thing is that you're the same person with split personalities. One goes to sleep, the other wakes up. Does the hilarity ever stop? I think not!

*guitar-solo*

Re:Save you the effort...

[Anonymous Coward]

you forgot

youngest of 13: BSD rules linux sucks!

Re:Save you the effort...

[CBravo]

of course, there is a reason that that box is in the basement. It does not go down.

Re:Save you the effort...

[Anonymous Coward]

Another strange coincidence is that both of you guys are currently wearing star trek uniforms and neither of you have kissed a girl!

I guess it is a small world after all.

Re:Save you the effort...

[Anonymous Coward]

But wait! RMS actually wrote applications and setup a framework by which more are created. Theo just takes other people's code and "audits" it, that's a gas. [let's "audit" (steal, rewrite, reengineer) other people's code and say we're the best!]

Re:Save you the effort...

[Dark Lord Seth]

Heathen, you forgot three of them!

Imagine a Beowulf cluster of packet filters!

1. Develop a packet filter.
2. ???
3. Profit!

( ) CowboyNeal is my packet filterer! You insensitive clod!

Re:Save you the effort...

[Anonymous Coward]

i think he has a GNU/House

Re:Save you the effort...

[Anonymous Coward]

I'm just waiting until the trolls combine the "Stephen King is dead" troll with the "BSD is dead" & we get "the BSD is dead troll is dead!"

Re:Save you the effort...

[jbolden]

QA guys do real work. There is a huge difference between software that sort of works and software that works perfectly everytime. Theo led a team to do a tremendous job of cleaning up many of the standard open source apps.

Project managers, systems analysts, developers, QA, tech writers, business analysts... are all on the same team; why the backbiting? Don't IS/IT people have enough problems without turning on each other?

Re:Save you the effort...

[Anonymous Coward]

QA guys do real work.

This QA guy is currently reading Slashdot. Why did no one tell me that this counts as real work?!? ;)

Re:Save you the effort...

[Anonymous Coward]

HAHAHAHAHA.

OpenBSD? Cleanups? HAHAHAHA. 10 people use it, and say its great. and You take their word for it.

Its such fucking crap. He acked NetBSD and now at the end of it all NetBSD has SMP, OpenBSD doesnt. Some clean up. Yes lets clean out all thos features. They suck.

OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

Use FreeBSD instead. Or if its old and shitty and single processor, use NetBSD. OpenBSD is fucking hype. The only good thing about it is SSH. Its performance sucks and its the only non SMP BSD left.

Theo, you are a jerk, and no one likes working with you. The NetBSD guys were assholes to kick you out, but whine all you want about that, OpenBSD sucks. Sorry. I tried several times to give OpenBSD a chance. Sorry, pal, "secure" is a relative term even for you mist priv sep zealot (nice job hackin in privsep and causing a root exploit) and trojaned tarballs.

Good job, Rat. We dont care aboutn OpenBSD. FreeBSD or die.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

I usually don't feed the trolls, but...

OpenBSD is fucking hype. The only good thing about it is SSH.

Yeah - SSH... and isakmpd, systrace, pf, altq, chrooted apache and whole-of-tree audits.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

- broken drivers stolen from other BSD
- no RX polling for network drivers. Linux and FreeBSD have this. I'm sorry if you don't know what RX polling is for, but it is to prevent livelock in an interrupt driven kernel.
- no SMP. I would venture to guess that that's considerably more difficult that "auditing" (snicker) code. Its always easier to complaint than create, something Theo has mastered.
- no reasonable way of updating the OS. Solaris has it. RedHat has it. Even Microsoft has it. Theo's way, buy a new CD, or compile the patches yourself in a way which is not extensible. Smart.

I would never, ever use this in production. If you think I'm a Slashbot, all I have to say is. ... Sure, you hit the nail on the head, yeah that's it! What, Sigmund Freud to the rescue.

Just a note to you idiots out there, Juniper uses FreeBSD for their JuneOS on some very high end equipment. The engineers would probably urinate themselves laughing if you suggested putting OpenBSD on an M160. Oh, don't know what Juniper or an M160 is? That's what I thought.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

- no SMP
Because border devices soo need SMP.

- broken drivers stolen from other BSD
Evidence?

- broken drivers stolen from other BSD
Evidence?

- no reasonable way of updating the OS. Solaris has it.
Upgrades work fine, didn't your mommy teach you how to type "cvs update"?

Juniper uses FreeBSD for their JuneOS
Bleeting about a proprietary fork of an OS they had to basically rewrite from scratch to get it to perform is not going to fool anyone.

Pretty poor trolling, if you ask me. Funny that the code stolen by FreeBS as it tries to be remotely secure is much greater than the flow in the other direction.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

Pretty poor trolling, if you ask me. Funny that the code stolen by FreeBS as it tries to be remotely secure is much greater than the flow in the other direction.

At least they didn't get r00ted this summer

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

Can somebody tell me how the hell these *BSD Is Dying trolls got started?

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

- no SMP - because no one who is smart enough to deal with SMP kernels would ever tolerate Theo de Raadt.

- check out the fxp driver. If you can't tell they rip and port, you must be incapable of reading. Funny also that the fxp driver on FreeBSD supports polling. Funny also that FreeBSD cleanly supports more hardware and oh gee, APIC on UP boxes!

- no response to the RX polling. FreeBSD's polling implementations was by the Xorp ROUTER project. I have also performed throughput tests with OpenBSD. Trust me, at gigabit line speeds you either need to poll or have lots of CPU to deal with ingress packets - especially if the packet size is small. Show what you know about performance. Nothing.

- cvsup would be nice, more efficient.. Or binary packages for the server things like root exploits in SSH. People with jobs don't have time to compile things. OpenBSD is just behind the times. Painfully so.

So SMP not needed up there for border devices (yeah, right, that why GSR routers and every other router worth its salt use network processors dedicated for every interface)? So if a machine doesn't have a network processor for each interface, how exactly then is a uni-processor OpenBSD box without polling going to deal with 6 gigabit cards? Interesting. You don't know. The FreeBSD in Juniper was a convenient and effective way for Juniper to have a full, coherent well documented BSD implementation professionally done.

I love people, zealots, who try and defend OpenBSD but they cant even get SMP working. Real kernel hackers probably snicker and giggle about Theo de Ass, but Linus and other k-hackers are just too polite.

And please, man, for the love of god. Please stop considering a good box to put in front of a 1.5mbps link a good networking box. You sound like a fucking fool.

BTW, in lab tests, OpenBSD is fairly trivial to DOS, without RX polling, ingress packets always generate interrupts even if they get dropped by filters. No CPU left or userland = livelock. Oh! Wait, you've *never* tested these kind of things because you are either unemployed or worthless to your company [poor company to have to put up with you].

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

FLAMEBAIT? Hardly. You know what's funny. Theo has people running a spinlock on this story so bad.

He cant take criticism. And anyone who has used a myriad of systems know OpenBSD is niche, thus its sparse usage.

But venting frustration, and in the thread that ensues, is clearly useful. It is obvious only Theo zealots and flame moderators come here to feast on those tackling real issues - quickly censoring anyone who doesn't subscribe to groupthink.

*SAD*.

Good job, /. , for allowing zealots to win time and time again. Don't say anything bad about anybody lest it be called flamebait.

I get all you down moderators in metamod SO BAD.

Keep it up, every time you hit that -1, I metamod your ass. 95% of what is modded down here isn't deserving of it. And if you fools would use your 5 to mod up, the 0's and 1's would be left in the dust for decent stuff. As it is not, reading /. at anything above 0 is like watching television, its censored, not funny, never really tackles the issues, interviews never last long enough, and has fucking ads every thirty seconds that pop up in your fucking face.

Screw you, you fucking Hitler youths and little young communists. Your both extreme left and right, and they meet at the bottom of the circle. Fucking totalitarian SCUM.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

Yes, chrooted apache. And we would be running a non SMP webserver? I guess performance isnt an issue. That explains all the 1U Application/Webservers with SMP. Yes, Sun, IBM, Dell, HP are all fucking idiots for making SMP boxes. We should use UP cheesy shit and run chrooted Apache for our webservers.

AHAHAHAHAHAH.

And code auditing? Try not distributing trojaned tarballs, asshole. The get to the complicated part, telling other people who have written useful things they suck.

What the fuck is wrong with you?

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

that is insightful? oookaaaay.

I would make a motion to tranfer all the mod point from that idiot to the parent. "trolls" can be right, you know.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

LOL you just smoked the original poster's ass like a cheap cigar

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

so like, totally whatever, so if like border devices like dont need SMP like totally, then why did Juniper rewrite liek FreeBSD to like perform better and like use network processors. Like DUH. Whatever.

Even a valley girl can see this guy is a lampoon.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

funny. i've been running freebsd for years and its open on the net. funny. i dont ever recall being rooted. funny.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

Theo's own account got rooter. HAHAHAHAHA.
Secure by Default. And the stupid, arrogant ass got his day of infamy. What a tool.

OpenBSD co-founder Theo de Raadt, cited as a top el8 target, angrily refused to discuss the compromise in late July of a file server maintained by the open-source, Unix-based operating-system project. On Aug. 1, a dangerous Trojan horse program was discovered amid the code for OpenBSD, which is used by thousands of organizations and renowned for its security.

While de Raadt wouldn't comment on whether there were any suspects in the case, the lead article in the latest el8 newsletter, published in early July, contains an obvious smoking gun. The article begins with several lines of screen-display from what appears to be an OpenBSD.org system. The "w-command" output suggests that attackers had access to one of de Raadt's accounts.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

when openbsd came out and people thought of openbsd as a BSD, and well, since it sucks so horribly it only made sense, if openbsd was a bsd, then all BSD must suck bad. its sad that openbsd has to suck so bad as to ruin the reputation of other more viable BSD systems. oh well. i just hope Theo de Raadt gets prostate cancer and dies.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

yeah, they got rooted like two years ago...

Re:OpenBSD is crap, heres why - vermillion

[theLOUDroom]

funny. i've been running freebsd for years and its open on the net. funny. i dont ever recall being rooted. funny.

Wanna post your ip address? ;)
I didn't think so.

disclaimer for the humor impaired: I don't actually want to root this guy's box. I am not a terrorist, nor a member of al-qaeda.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

I might consider it but for the following. You put up an IP and people dont portscan and hack (and you can make portscanning painfully slow with some easy tweaks). You know what they do, they DOS and DDOS the shit out of you. rooting is rarely done on demand, most people dumpster dive and social engineer or again physical access for passwords or stumble across ridiculously old boxes unpatched and root that then get inside then root stuff thats unprotected. Its really funny that Theo's own citadel was rooted, and hes freeekin ready for it.

That being said, I cant recall when FreeBSD or any of its mirrors got rooted, or yahoo for that matter, oh, yeah, Yahoo uses lots of FreeBSD boxes.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

Until Theo posts his IP, you can shut up.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

yeah, but the trojaned tarballs was just the other day. theo is an idiot, no one likes him, and he is a snot who makes a bloody mess of other people's code and no one notices the bad job they do because no one cares about OpenBSD. Now get another shirt, and a CD with stickers, and walk around proudly with thos fucking lame anime shirts and stickers, and the rest of your coworkers that do work for a living will laugh at your sexless ass.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

Yeah, so how's that SMP polling working out for you on FreeBSD?

And polling was introducted when again? Oh yeah, it's been there forever, thoroughly tested, just like KSE and all the rest of the kernel.

and "people with jobs don't have time to compile things." So where do you get all your FreeBSD fixes? Or maybe you just don't patch them?

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

- The developer responsible for implementing polling will give you the SMP sane version for a fee - OH, no! He could make money doing *work*? The humanity! Can handle DIY, then you have to pay someone to do it for you.

- If you read the code for polling, it's fairly trivial to make it SMP sane yourself. By the way, it works great!

- FreeBSD's method of patching can be taken care of *easily*. There is an efficient way of dealing with errata, and releases are made regularly and frequently. Notice OpenBSD stops supporting "old" versions at a furious pace. It's sad to see Theo abuse his community in this manner. FreeBSD makes small security and reliability changes to each release for some time. People with jobs sure don't like compiling and installing fixes, but FreeBSD's are so trivial and small per release, its not as annoying as, say, you are right now.

I give you credit for trying to find out polling isn't SMP safe. Took you a while though. And just to know, it can be made SMP safe, or are you only good at reading things between /* */ ?

Also note that the author of polling thinks that "two CPUs should be enough to service ingress interrupts." Obviously this isn't always the case. He made an assumption based on his design goals. This does not mean the code is unusable or cruft.

Now back to your pathetic dodge. UP kernels need polling more than anything else. So instead of explaining why OpenBSD sucks for high performance applications, you try to find fault with a feature FreeBSD has that OpenBSD doesn't. I find this laughable and amusing. I also find it amusing that you try and insinuate that FreeBSD's superior cvsup is somehow "just as bad" as OpenBSD's?

How long have you been out of work? No, pterodactyls don't exist anymore and we don't have any keyboards with hieroglyphics, sorry. Maybe you and Dvorak can come up with something new, Grok?

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

heh. lots of linux drivers have RX polling drivers now too. looks like Fag Theo and the asspack are way the fuck behind everyone else.

Oh, ever notice they lag the futhest on the hardest features to write?

You are a fag.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

openbsd stops supporting old releases at the rate of exactly one old version every six months. That's not what I call furious. How many FreeBSD releases are expired every six months?

FreeBSD only supports 4.5 and up. So that's only going back 11 months. If I installed FreeBSD at the same time I installed OpenBSD 3.0, I'd already be running an unsupported version.

Back to polling, again, it's hardly been there for that long. You talk about it like it was developed ages ago and everybody's using it. OpenBSD doesn't have it yet, true, but polling is new enough you can't call something antiquated because it lacks polling.

And now back to patching. How exactly is downloading a FreeBSD patch so much easier than downloading an OpenBSD? They have basically identical support structures going back the same amount of time.

SMP, well, it's kinda sad it's missing, I admit. But since I use OpenBSD on computers with only one processor, it's not such a big deal (to me or 95% of the people out there). There are more computers in the world than multiprocessor gigabit routers you know.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

Upgrades work fine, didn't your mommy teach you how to type "cvs update"?

Wait, I have to install a complete compiler toolchain on my server in order to keep upto date? How do I check the MD5 sums of that CVS source I've just downloaded? I can't? How do I know if its trojaned? I don't?

Thought so.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

Just an fyi

RELENG_2_2, RELENG_3 and RELENG_4 are all "Open".

Not "officially" supported is a CYA thing - they arent going to bust ass to fix it but they arent going out of the way to avoid fixing it like Theo does. But stuff that is needed gets put in there all the time.

OpenBSD, OTOH, officially and specifically doesnt support older OpenBSDs. The CVS is frozen in time. Often its an amusing testament to how bad that OS really is.

OpenBSD is basically a bad example.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

you seem adept at saying useles things, your above post a testament to that. in fact, that is far more useless that the parent you complained about, which should be moderated +99, informative. too bad the moderators dont know what OpenBSD is. (else they would be inclined to agree, no wait, /. moderators suck! they just mark anything sensible down)

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

you've got to be kidding me. if i run freebsd 2.2, it's got all the security fixes rolled back into it? it's just as secure as 4.7?

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

Q: Hey! If theo and his Rat Pack are so freekin' good at auditing, why dont they submit patches back to the application maintainers they audit?

A: 90% of the time they would get laughed at, berated, asked to get more schooling, ignored.

- If you cant tell OpenBSD isnt intended to be used and that its basically a staging ground for OpenSSH (another thing ripped off like NetBSD, Tatu-SSH - but screw tatu, he is an ass) then you are such an Athlon kiddie using D-Link network cards.

Tell me how bad ass national semiconducter is as a networking company, cmon!

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

Tatu Yl*nen is a fucking prick. But unlike Theo de Stupid and ihs Raadt cabal of morons, he has managed to make a living off of software.

No one would actually pay for OpenBSD. (Notice no DAARPA contracts, McAfee deals, etc)

To speak of a Devil, even RedHat makes a living off of a festering heap of non standard nuts and bolts called Linux.

Re:OpenBSD is crap, heres why - vermillion

[Craig Davison]

There were bugs in Apache, SSH, sendmail, BIND, etc. that you were vulnerable to regardless of what UNIX you were running. The apache chunked-encoding bug, in particular, had a working Free/OpenBSD exploit before any other OS.
I think you "not being rooted" had more to do with you being a competant admin (whatever that means - keeping shit up-to-date and turning unneeded services off? configuring untrusted services to only run on trusted interfaces?) than FreeBSD being secure.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

8.18 - Why does www.openbsd.org run on Solaris?
Although none of the developers think it is particularly relevant, this question comes up frequently enough in the mailing lists that it is answered here. www.openbsd.org and the main OpenBSD ftp site are hosted at a SunSITE at the University of Alberta, Canada. These sites are hosted on a large Sun system, which has access to lots of storage space and Internet bandwidth. The presence of the SunSITE gives the OpenBSD group access to this bandwidth. This is why the main site runs here. Many of the OpenBSD mirror sites run OpenBSD, but since they do not have guaranteed access to this large amount of bandwidth, the group has chosen to run the main site at the University of Alberta SunSITE.

HAHAHAHAHAHAHA. OMFG. HAHA HAHA snort snicker snicker snort. HAHAHAHAHA.

Let me answer that question:

Why does www.openbsd.org. run on Solaris.

A number of reasons. First and foremost, we needed a good piece of hardware with multiple CPUs and large array storage support. Since OpenBSD handles memory poorly, does not support SMP and has terrible support for storage options we could not use it. Also, we needed a binary patching method. OpenBSD doesn't support this, so when new exploits come out we find it very easy to patch the system, and we don't even need the entire compiler and its tool chain installed! Also, and this tends to be the most annoying. We would essentially be a honeypot. We would get every script kiddie and asshole trying to get in. And we would be rooted time and time again. Most kiddie don't know SunOS and SPARC too well, so we hide behind them. Also, often times OpenBSD's drivers fall apart under load. This is has been a problems for years though many releases and a cursory inspection of the results from Google indicates if one puts many networks cards in an OpenBSD system, things go wrong. We know this from experience! Now, we could collocate a box at SunSITE, but we are a fucking pussies who refuse to battle test our cruddy wares. Thank you and have a nice day. Make sure to buy a TShirt! ;p

All I have to say to you, Theo and friends. HAHAHAHAHAHA.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

SMP, well, it's kinda sad it's missing, I admit.

You said it, not me. And 95% wasnt good enough to get a man on the moon. 110% was.

I hate when its okay to be shitty because no one needs it.

No one needs a 0-60 car in 3.2 seconds. No one needs SMP because games arent SMP (cept quake barely). No one needs ....

Why do zealots point out what we dont need in order to avoid the truth - that something sucks shit but we dont need it better.

Re:OpenBSD is crap, heres why - vermillion

[Anonymous Coward]

I dont know, I dont run 2.2, but did you take a look at the commits?

And if you bought into the 4.x FreeBSD in March of 2000, you could be all the way up to 4.7+STABLE today. Oh, can OpenBSD "become" a superior version in just 1 reboot?

Thats what I thought. Now go back to your gay love, snoodling, choad licking and felching.

pf ported to Debian?

[Centinel]

Does anyone know if anyone has ported the OpenBSD pf over to Debian?

Re:pf ported to Debian?

[Anonymous Coward]

there's something called 'iptables.'
Heard of it?

pf has some nice additional features like skiprules which iptables may, or may not have (I dunno), but the netfilter architecture is superior and unlikely to be superceded anytime soon.

Re:pf ported to Debian?

[krmt]

Well, I don't see it in the userspace program list in aptitude anywhere, not that I expected it, since in the interview with the pf creator he says that it is hooked in to the OpenBSD kernel directly. Your best hope of getting it with Debian soon was the project to port Debian to OpenBSD, but since that was just abandoned you'll have to wait a while or do the work yourself.

Re:pf ported to Debian?

[Centinel]

if I wanted to hear "use google you lazy n00b" I'd have asked #openbsd on efnet

Re:pf ported to Debian?

[jhunsake]

Then why didn't you?

Re:pf ported to Debian?

[peter]

There were plans to create a Debian GNU/FreeBSD operating system. (Maybe not just FBSD, without the GNU/. (They would probably use the FBSD C library, but most things would be the existing Debian packages. I guess there would be some new packages with FreeBSD software.)) I can't remember what I saw most recently about the Debian on FreeBSD project, but I don't think it's totally abandoned.

Anyway, pf is specific to OpenBSD's kernel, and I don't think it is likely to be ported to other kernels.

Re:pf ported to Debian?

[neroz]

What a shame. Lets hope the {Net|Free}BSD ports dont follow suit - they are a lot futher along.
Heres the post from the Debian GNU/OpenBSD porter:
---
Subject: status debian/openbsd
From: Andreas Schuldei
Date: Tue, October 22, 2002 4:50 pm
To: debian-bsd

There are several indications that openbsd's security is more or
less up to the level what can be achived with todays debian
gnu/linux.

The kernel code seems to have severe race conditions and the
userspace seems to be bitten by a compareable number of security
incidents as e.g. a stabel debian with a correspondig software
base.

Since my reason for this port is primary to provide a more secure
environment for debian users with the same feel, right now this
port seems not to be worthwhile.

OpenBSD seems to make efforts to change to elf binary format some
time in the future. When this happend and the audit efforts show
further results i will reevaluate the situation.

Everyone who wants to carry on with this port is welcome to take
over.
---

Re:pf ported to Debian?

[LordHunter317]

Other way around. The whole point of any GNU/*anything* port, Debian or not, is to get the entire GNU toolchain running on said kernel.

The debian part would obviously be porting as much stuff as possible to run on said GNU/*anything*.

So GNU/OpenBSD would run pf but not iptables. See?

This is the one point where the GNU/*OS* thing makes sense. Though I think GNU Debian *OS*/*arch* would be better, as in GNU Debian Linux/i386 or GNU Debian OpenBSD/i386.

Re:pf ported to Debian?

[peter]

yeah, that's what I was trying to say, but got sidetracked half way through :(. Of course they would use pf where Debian on linux uses iptables. However, the C library, as an interface between the kernel and user space, takes a lot of work to get working on a different kernel, or a different architecture. However, some GNU software is designed to run on a GNU system, and uses things like getline() instead of fgets(). (read the GNU libc info page if you don't know about this.) Most major pieces of software are portable to non-GNU systems, so they could get by without the GNU C extensions.

I agree...

[SargeZT]

That OpenBSD is the most secure OS in the world, but even though it dosent have it's precious packet filter, I still think it whips any other in the security area.

oh GREAT

[Anonymous Coward]

I had never before done any kernel programming, but I knew C

Great... I'm going to recommend to my boss that we replace all our FreeBSD and Linux servers with OpenBSD! With that kind of kernel programming experience on the team, you know it's gonna be SOLID! Check it.. he didn't say he "heard of" C, or "dabbled in" C, or even "thought there was a language called" C, he KNEW C! Inside and out!

And hey, did you read the interview, the man owns TWO, count 'em, TWO cats! Between the three of them, they should hammer out some sweet packetfilter code.

(hey it's a joke. but I'm still not giving up FreeBSD)

Re:oh GREAT

[Anonymous Coward]

Yeah, but maybe they're really smart cats.

Re:OpenBSD's Security is Overrated

[Anonymous Coward]

so basically, you're saying: OpenBSD is the most secure OS out there, as long as you don't install it on a computer?

if you are going to upgrade to 3.2 ahead of time

[congiman]

Its already out there in the source tree... and has been for a while (beginning of october).

You can grab the main .tgzs from:
ftp.usa.openbsd.org/pub/OpenBSD/snapshots/i 386

I'm pretty sure you can do this install by getting the floppys (.fs) files and selecting FTP install.

If you have 3.1 (or any other version) you can upgrade the source tree (this is how I did it)

set your cvsroot:
setenv CVSROOT anoncvs@anoncvs.usa.openbsd.org:/cvs
cd /usr
cvs -q get -rOPENBSD_3_2 -P src

You can then follow along here:

http://www.openbsd.org/faq/upgrade-minifaq.html

Make sure you do all the steps,
Be especially sure you do 1.5, 1.8, 3.1.* before you do a make build..

(note: if you are doing it from something earlier than 3.1 you should do the other changes (3.0.* etc. etc.)

-- C

WARNING: SNAPSHOTS ARE NEWER THAN RELEASE

[honold]

this information is bad, as the 3.2 snapshots are now further ahead in development than the 3.2 release code. there is no supported method for backtracking from -current to -release.

for the impatient, the best method is to check out the 3.2 sources from cvs (as described) and build from source

Re:WARNING: SNAPSHOTS ARE NEWER THAN RELEASE

[congiman]

The snapshots on ftp.usa.openbsd.org are still 10/3/2002.....

But, I'll also grant you that that seems weird in that it usually changes more often.

If all else fails, wait 3 days and you can find it at:

ftp://ftp.usa.openbsd.org/pub/OpenBSD/3.2
(THIS LINK WILL NOT WORK UNTIL FRIDAY)
(this is posted in PST, so Friday is still 3 days away).

Yeah the best way would be to grab 3.1
ftp://ftp.usa.openbsd.org/pub/OpenBSD/3.1

install it
and then src code upgrade

-- C

Re:WARNING: SNAPSHOTS ARE NEWER THAN RELEASE

[Anonymous Coward]

this is great if you happen to be in north america. a true karma whore would link to the mirror list.

OBSD Support !!!

[SuperDuG]

I think the one thing that everyone absolutely always neglects to realize is that Open BSD is the absolute perfect firewall/router solution for any network. All serious networks I've ever seen or worked with use Open BSD as their router/firewall solution and for good reason, it's perfect. It's stable, secure, and BSD Free, what more could you possibly want. Open BSD is made for security and it does its job wonderfully.

Re:OBSD Support !!!

[Anonymous Coward]

I think the one thing that everyone absolutely always neglects to realize is that Open BSD is the absolute perfect firewall/router solution for any network.

Not necessarily a perfect solution for any network. I still think the most secure systems are ASIC solutions with specific firmware. OS is an overhead and Achilles heel in terms of firewall protection.

--
darkskies

Re:OBSD Support !!!

[Anonymous Coward]

I think the one thing that everyone absolutely always neglects to realize is that Open BSD is the absolute perfect firewall/router solution for any network.

Yeah that's what you zealots have been saying from years.

Although I find it funny that you could throw out all all that "perfect" pf code, tell everyone that it sucked, and start from scratch, and gee whiz, OpenBSD is still "Perfect"! Wow! Now, what are the chances of that?

I guess either writing a packetfilter isn't the brain surgery that OpenBSD makes it out to be, or that the entire OS really has hinged it's entire marketing reputation on one single task (that's crowded with commercial competitors, thus ensuring that any claims of perfection are usually ignored).

Re:OBSD Support !!!

[Anonymous Coward]

What, the single CPU bitty box thats sat in your basement on a 10Mbit Realtek card serving MP3's to you over a Samba share? Because OpenBSD sure as hell isn't any good in a high traffic enviroment!

Re:OBSD Support !!!

[Churchill]

All serious networks I've ever seen or worked with use Open BSD as their router/firewall solution and for good reason, it's perfect.

You're right! Managing hundreds of OpenBSD firewalls in dozens of locations, all the while maintaining a cohesive security policy is a BREEZE with the excellent OpenBSD pf management software! Er, no. What kind of serious networks are you working on, anyway?

Re:OBSD Support !!!

[SuperDuG]

Not networks that serve. Man everyone who posts is really a moron. Not every network on the internet is meant to serve. When I said serious networks I was talking companies that provide net access to every desk type networks. OBSD is the perfect solution for these situations as it can serve as the firewall/router/webserver/email server. It's all stable and secure and works perfectly for your average small to mid-size business. I'd recommend a midrange PC with Open BSD anyday before I recommended a cisco solution.

Re:OBSD Support !!!

[Anonymous Coward]

I'll post this as an AC so as not to reveal where I'm talking about and piss the various admins off...

I've been in most bank and financial institutions (who shall remain nameless) computer rooms in a certain major city (which shall remain nameless), as a part of my job.

Most of the banks were using OpenBSD firewalls (usually bridged) and many of the financial places were also.

OpenBSD does actually get serious usage by serious big businesses. It's just that most security paranoid companies with a lot to loose don't go around advertising what firewalls they're running. Regardless of how secure they're beleived to be. They have nothing to gain and everything to loose by doing so. They can gain little extra credibility by advertising that they're running a super secure OS+pf because 99.9% of people have either never heard of OpenBSD or don't understand the security issues it is capable of protecting against.

It's like all the USA's B1-B's carrying 6 x 1 gigatonne neutron nukes backed up by a starwars project that was FINISHED 10 YEARS AGO. People don't need to know about it.

Re:OBSD Support !!!

[c13v3rm0nk3y]

Well, I can report that my (publicly traded) corp is pretty OBSD friendly. Almost all our edge hosts on our international VPN or the DMZ are OpenBSD. It does most routing, all email and spam filtering.

It isn't doing the VPN proper right now, because we've invested too much in a commercial VPN. Also, most of our discrete host access to the VPN (over dialup or broadband) is Microsoft PPTP (which is lingua franca in terms of client access). We use NT exclusively for authentication/authorization (except for the NIS stuff on all our UNIX boxes), but we are switching to Active Directory. This got us thinking about running arbitrary LDAP services on OBSD and falking out all the Windows 2K client boxes. Shades of Samba!

There is talk about switching our web and ftp server(s) to OBSD. We've already made the jump from Netscape to Apache (on Solaris), and IBM is *most* happy to supply us with OS-free Netfinity servers to run this stuff on. We still have a lot of value left in our Sparcs, but as they age it looks less and less like they will be replaced with newer hardware.

The main obvious benefit for me is that I get to tag on a t-shirt or two onto our corporate orders. I mean, having stable email is all well and good, but a new OBSD t-shirt every 6 months! That rings my bell.

Re:OBSD Support !!!

[mindstrm]

You are a troll.

I run some very serious networks, and we don't use openbsd. What is so superior about PF?

Openbsd can't do policy routing, and PF is quite limited.

And a serious network doesn't run the mail server and webserver and router on the firewall.

What do I add to my sources.list ?

[Anonymous Coward]

What mirror sites are available for these outdated packages?

Why no easy installer?

[browser_war_pow]

What I don't get is why don't these projects realize the kind of coup they could score by releasing a Mandrake/RedHatesque installer that even the average marketting drone could use to setup a fully operational installation. I'd love to use OpenBSD if I thought I could get it working. I'm still just a novice with *NIX though so some of this is a bit too hardcore for people like me right now. But still, getting OpenBSD an installer that **just works** for the average person would take it to a whole new level.

Re:Why no easy installer?

[Anonymous Coward]

actually, if you have the installation instructions, the install process is very easy, especially in comparison to other free operating systems such as debian. marketing drones perhaps should not be installing operating systems, eh?

Re:Why no easy installer?

[dirtyeye]

You may be surprised how easy it is to install. If you follow the install doc, there is only a small number of choices. don't be scared of using the keyboard.

Re:Why no easy installer?

[krmt]

Making a good installer is hard work. OpenBSD just doesn't have its priorities there, and rightly so. If someone really felt strongly enough about the issue to write a nice graphical installer, or port one of the Linux ones over, there's nothing stopping them from doing so. It's just obviously not that important right now.

That said, if you want an easy install, there are plenty of alternatives for you. You've already mentioned Redhat and Mandrake, and there's also the very notable OSX. These might not be products focused primarily on security, but if you're really concerned about security then you're going to have to be willing to do some work of your own. Even OpenBSD doesn't guarantee security in the absence of knowledge. So if you're willing to put in the work to learn to be effectively secure (and thus actually use the system properly) then you're certaintly willing to learn how to install the thing.

Re:Why no easy installer?

[Dog and Pony]

First off, anything is easy compared to installing Debian (typical that I *do* run it, anyways... sigh.) Well, slackware's worse.

And second, no marketing drone has ever, as long as humans has kept track, installed anything except the latest email worm. For all the other software, they grab whoever is close and not wearing a tie. Usually it is some guy that would rather shoot himself in the foot than use up the afternoon installing windows Me, but there you go.

Re:Why no easy installer?

[psxndc]

If you buy the CD, the insert has a walkthrough of an install. OpenBSD is actually one of the easiest installs if you follow the documentation.

psxndc

Re:Why no easy installer?

[coene]

It's MUCH easier than you think... It just takes some reading (just a tad, which is all stuff you NEED to administer the system anyways).

You want:

http://www.openbsd.org/faq/faq4.html [Installing OpenBSD]

and

http://www.openbsd.org/faq/index.html [The entire FAQ]

Re:Why no easy installer?

[Anonymous Coward]

The install is cryptic to keep the lamers out, you see. That way only l33t peeps can install obsd cuz they 0wnz j00!

Re:Why no easy installer?

[dave_f1m]

I agree with the other replies that it is relatively easy to install. The disk partitioning is different, so that slowed me down (slices?!?). But I love "man afterboot" - it reminds you of all the other crap you need to do to a system after it's installed. Mandrake, et.al. could use that.

- dave f.

Re:Why no easy installer?

[alain1234]

About Debian and OpenBSD, a quote from the latest Debian weekly news :

Debian/OpenBSD ceased. Andreas Schuldei announced that he is discontinuing the effort to combine OpenBSD and Debian. He found out that there are several indications that security in OpenBSD is mostly at the same level as it is in Debian. Since the reason to work on this port was primary to provide a more secure environment for Debian users this port doesn't seem to be worthwhile anymore.

Re:Why no easy installer?

[evilviper]

Personally, I find OpenBSD's installer to be simpler than ony other. Who needs a GUI?

Do you want to setup networking? [Y, n]
Do you expect to run XFree86? [Y, n]

What could be more simple than that? I can install OpenBSD in the time it takes most GUI installers just to load.

The one place it needs work is FDISK, and that's not a problem unless you say 'NO' when asked if you'd like to 'use the entire hard drive'.

The installer has some nice perks too. You can use wild cards when selecting your packages, so a simple "-x*" will unselect all the X packages. Just "*" selects everything (one of the few OSes where you almost always want EVERYTHING-there's no junk in the distro), or you can always go with the default, minimum, install.

That's why I like OpenBSD, it isn't a bunch of shinny things, it's just a very simple and elegant Operating System. Installer and all.

Re:Why no easy installer?

[aussersterne]

Well, slackware's worse.

<rant type="stream of consciousness">

I couldn't let this slide. I've been using Linux since 1993 -- longer than many, not as long as some others... and I was a SunOS guy before that.

I have always found the Slackware installer to be reasonably friendly, extremely well-thought out, both elegant and consistent.

ON the other hand, I avoid dselect like the plague. Even if you know what you're doing, dselect is a ponderously huge set of choices; just browsing through them to locate the ones you want while looking at the package name column and nothing else requires enough reading and keying to slow the process down to a crawl. Better to bypass dselect entirely... just install the base system and then use apt to get the stuff you want. It's not that I dislike Debian -- in fact, I use Debian/Sparc on a whole mess of Sparc 10 and Sparc 20 workstations that I administrate and it performs nicely.

But I can't imagine how new home PC users must feel when confronted with a huge, text-only interface with no obvious onscreen guide to keys and very counterintuitive behavior. For example, try running dselect on a 386 or a 68k mac (both supported platforms). Hit PgDn and five or six seconds later the screen finally updates. Bet new users hit it three or four times, wondering why it isn't working. Oops! Same goes for entering and leaving dependency resolution... Press Enter once your selections are made and watch... nothing happen for 30 seconds until the package list is finally displayed once more. Bet new users hit Enter 10 or 12 times. Maybe they even hit reset, thinking they've frozen!

The OpenBSD and NetBSD install systems and the Slackware install system are much, much better than dselect, which is an utter dog that has been completely overwhelmed by the growth of Linux and the sheer number of Debian packages available.

</rant>

Re:Why no easy installer?

[RAMMS EIN]

I don't wanna boast, be elitist, troll, whatever here, but I actually think the OpenBSD 3.1 installer is one of the best installers I've ever seen. Sure enough, it doesn't have a GUI, but it fits on one 1.44 MB diskette and uses little RAM.

The installation process is as simple as answering questions that are in plain English. The one thing that sucks about it is the disklabel part. I think it would be helpful to do some ad-hockery to come up with sensible defaults here. Nevertheless, help is available in clear English and a swap and root partition (and whatever more you deem necessary) are soon enough created.'

Now I am going to abuse the rest of this post for stating what other improvements (besides the disklabel editor already mentioned) I would like to see in OpenBSD. The default install ships with many services (fully or nearly completely) preconfigured but commented out. This is a Good Thing. However, although SMTP and POP3 are mostly set up this way, the same is not true for their secure (tunneled over SSL) versions. I think that OpenBSD, especially with its focus on security, should really offer this.

Another thing that would be good for OpenBSD to have is a secure distributed filesystem. This applies to other operating systems as well, and I know there are various options that work, each with serious drawbacks. Two options that I consider of special interest are Coda and SFTP. Coda is said to be in alpha stage (and has been, for a long time), but is reported to work quite nicely. SFTP is not technically a filesystem, but can be used as one by Linux with LUFS. I think a LUFS-equivalent for [Open]BSD would be a huge win.

Re:Why no easy installer?

[sheriff_p]

In truth, it's been a while since I installed OpenBSD (3.0 was the last one I tried), and I found it ... easy. I'm certainly not a particularly competent user, and although I'll admit the disk partitioning tripped me up, the rest was really simple.

Additionally, the OpenBSD FAQ sets the standard for docs. Once installed, I had dhcpd/NAT/ipfw and a load of other goodies set up in under half an hour.

I would suggest that people who say installing OpenBSD is hard just haven't tried it. If you have, be more specific: ugh eez too hardt is hardly a good bug report, or the kind of thing that'll get over-worked developers to make changes.

Re:Why no easy installer?

[Sn4xx0r]

ROFL. Finally good justification for wearing a tie. It's just to stay out of the hands of the marketing drones! Really!

Re:Why no easy installer?

[debilo]

I don't really mind there not being a real GUI-based installer. Although I would appreciate the comfort in having one, I've found OpenBSD installs extremely painless and easy, the installation on my (slightly dated) router box takes no more than 15 minutes. Even as a beginner, a quick read-through of the really excellent FAQ provides all the information you need to get started in no time.

But then, there's this article I stumbled across on Deadly:

G.O.B.I.E, a "Graphical OpenBSD Installer Engine", and I have to say the screenshots look pretty damn slick. They are also working on other cool things. From the web site:

[G.O.B.I.E] wishes to add some value to the product by developing installation modules to known servers such as Bind, Sendmail, Inn Apache..

Among them, you will find help to configure PF(Packet Filter), authpf, altq and some other tools.

We have planed to build a kernel configuration tool too !!!

I think that sounds like an interesting project and (though IMHO not absolutely needed) I would like to see it being officially presented as an alternative to the current installer.

Re:Why no easy installer?

[Anonymous Coward]

what?

as a slackware user i find the debian install a lot harder! i recently also tried installing openbsd with great success! having people tell me the installer is a bitch, i found it easy going.

debian on the other hand....

Re:Why no easy installer?

[dazdaz]

There is a fantastic graphical installer for OpenBSD, it's just not in the default install, yet. See the GOBIE project.

http://www.gobie.net/

Re:Why no easy installer?

[Dog and Pony]

Well Duh.

First you tell me that you've been using *NIXes for at least 10 years (assuming SunOS was only one year) and then you ask what the new home PC user would think about dselect??

I can tell you that. I can *also* tell you what said user think about slackware, as I was that user not long ago, at least when it comes to installing and setting up linux.

Said user will think that dselect takes forever to go through - and be correct. Depending on stamina, he/she will spend X minutes selecting stuff that sounds cool and/or useful, then give up and use apt-get for the rest of their days. Yes, dselect is bloated beyond recognition. Then comes the real fun. Finding the idiotically^Wobscurely named packages. Befoer anyone argues: Set someone that knows linux, but not debian, and ask them to get mod_perl installed. Took me hours to find the friggin package. And then it didn't work. :)

Now slackware... wow. It has a friendly installer in that sense that it uses english (which I can read) and that it asks me what I want to do. End of friendliness. Thanks to a semi-good linux how-to, I actually managed to get through the install on the Xth try, when I finally got working partitions in. Other Linuxes help you with this. Not this one.

When I finally got it up and running, I spent the next week:

* Learning how to edit XF86Config manually to get my language on the keyboard (was not available in slackware as an only), get my mouse working and get my monitor to go over 640x480.

* Recompiling the kernel to get the mouse to work. This is one of the things the home PC guy wants to try first of all. Not.

* Realizing that all Linux howtos are worthless because this is Sys-V. Have you noticed that Slackware guys does not write documentation?

* Giving up and throwing the crap out. All of the above is fun and good to know how to, but not to be able to use the system at all. Save that for later.

There's your home PC guy for ya.

Now, how is this better to someone without 10+ years of unix experience?

Debian is hard, but slackware is worse.

Or you have to put in that 10 years disclaimer.

Re:Why no easy installer?

[Anonymous Coward]

The advantage of the OpenBSD console installer is that it's very efficient and fast to use. OpenBSD can be installed in 10 minutes over a good link! A GUI sure makes some things easier for some people (not for me though, I couldn't install Red Hat 8.0), but they are slower.

OpenBSD's current installer should be replicated by all other OSes: 10 minutes from boot to "install complete", very nice!

Re:Why no easy installer?

[Ratbert42]

OpenBSD is one of the easiest installers. Try FreeBSD or even worse, Solaris. Then come back to OpenBSD.

Re:Why no easy installer?

[ryanvm]

Usually it is some guy that would rather shoot himself in the foot than use up the afternoon installing windows Me

I thought installing Windows ME was shooting yourself in the foot.

Re:Why no easy installer?

[Dog and Pony]

Nope. You'll notice that the pain isn't as sharp and not as lasting when using a common gun.

Re:Why no easy installer?

[Anonymous Coward]

First off, anything is easy compared to installing Debian (typical that I *do* run it, anyways... sigh.) Well, slackware's worse.

Admit it, you used Slackware WAAAYYYYY back when it first came out. Since Debian started, you haven't touched it. So your only experience with Slackware installs was when installing Linux was difficult and required some blood, sweat, and tears (and Slackware was the easiest of all the distros at the time). And you continue to think Slackware is difficult because of it. If you don't think Debian users kept repeating this lie that Slackware is difficult to use, then ask apt in #debian on irc.freenode.net (or whatever they call themselves these days...) what it thinks of Slackware. If you haven't used slackware in the last few years, then you need to get off of your high horse.

Re:Why no easy installer?

[Cro Magnon]

The one place it needs work is FDISK, and that's not a problem unless you say 'NO' when asked if you'd like to 'use the entire hard drive'.

Unfortunately, that one problem killed OBSD for me. Surely, it's not uncommon to want to dual-boot OBSD with something else.

Re:Why no easy installer?

[TheSync]

I found OpenBSD to be an easy install EXCEPT for the disklabel editor. The editor should be able to present to the user a reasonable default partitioning scheme for servers(isn't that what OpenBSD is all about - having a secure, working system from the default install?)

Moreover, from reading the documentation, it appears that there is no warning about the creation of a partitioning scheme that is potentially unbootable. This is silly!

Re:Why no easy installer?

[tbuskey]

The default install isn't easy????
It's not graphical, but it is easy.

Anyways, I run OBSD headless on my sparc LX. No graphics installed. I install via serial port.

It sounds like you haven't tried an install.

Re:Why no easy installer?

[friscolr]

SFTP is not technically a filesystem, but can be used as one by Linux with LUFS [sourceforge.net]. I think a LUFS-equivalent for [Open]BSD would be a huge win

if NetBSD's mount_portal was ported to OpenBSD then i think it would be simple. right now OpenBSD (and FreeBSD) uses an older mount_portal which isn't as robust as NetBSD's.

anyone know the linux equivalent of mount_portal?

Re:Why no easy installer?

[friscolr]

OpenBSD is one of the easiest installers. Try FreeBSD or even worse, Solaris.

isn't Solaris the one OS that requires more reboots than Windows to install? i had to reboot 5 times the last time i installed Solaris8/x86

Re:Why no easy installer?

[pmz]

What I don't get is why don't these projects realize the kind of coup they could score by releasing a Mandrake/RedHatesque installer that even the average marketting drone could use to setup a fully operational installation.

1) Do you really want a "marketing drone" establishing your critical network infrastructure? Average people shouldn't be meddling with the systems that can really make or break a company. This is serious stuff.

2) The OpenBSD installer really is quite easy when you sit back and think about it. It's basically a well-thought-out shell script with prompts for necessary information. It's also very quick; OpenBSD installations are fast, since there isn't a quasi-stable GUI driving everything. It's also more dependable than a GUI. GUIs are complex from a software engineering point of view, and it is harder to guarantee their function. If you have questions about how OpenBSD goes about it's business...just look a the scripts.

I'm still just a novice with *NIX...

Don't let OpenBSD intimidate you, as it can provide a very fruitful learning experience about UNIX systems. OpenBSD really is one of the most directly and thoughtfully documented systems out there (at least for the userland stuff), but it just isn't an in-your-face system like Red Hat. Once the system installs, there is a helpful e-mail sitting in the root inbox, the installation CDs have very good README files, and the 'intro' and 'afterboot' man pages are also good. The OpenBSD website hosts a FAQ and links to mailing list archives that covers many questions for new users.

Re:Why no easy installer?

[3Bees]

What I don't get is why don't these projects realize the kind of coup they could score by releasing a Mandrake/RedHatesque installer that even the average marketting drone could use to setup a fully operational installation.

Unwittingly, you have answered your own question. They will probably never release an easy installer for OpenBSD because a marketing drone is not their target audience. If you are in an organization where a marketing drone is responsible for setting up firewalls and routers (the two general systems that will most frequently be running OpenBSD), than your organization is in deep doo-doo! :-)

OpenBSD is targeted at the audience that knows enough about their systems to feel comfortable without an installer, who will probably feel more comfortable without an installer. See, the thing about installers is that you have to trust what they are doing. Most admins who are worried about security enough to want to install OpenBSD will probably not want to put a whole lot of faith in any installer that they have not scripted/written themselves. (this is all IMO, of course, as there are probably large numbers of OpenBSD users that would not fit my stereotypes)

Re:Why no easy installer?

[evilviper]

Surely, it's not uncommon to want to dual-boot OBSD with something else.

It's not a very common occurance actually.

I don't setup any of my servers to dual-boot.

As for workstations:

An extra hard drive is cheap.

Few people just 'play around' with OpenBSD. It usually replaces the other OSes, and not many people are concered about co-existance.

FDISK is easy enough to use if you read the (very detailed) man page. From the docs on the CD, from the man pages on OpenBSD.org, even from within fdisk-you can easilly access the man page.

I mentioned fdisk only because it is the most complicated part of the entire OpenBSD system, not because it's complexity is significantly over and above any other installer OSes' installer. It may take a few minutes to figure it out, but it is more powerful than any other fdisk program I've seen, and gives you a better picture of what's actually happening than any other program.

Note For non-BSD users: FDISK is the program that modifies the (up to) four primary partitions. If you tell the installer to use the full disk, you don't even need te run fdisk. Within one of those primary partitions you create (or had the installer automatically create) is where you use DISKLABEL to allocate space for each mount point (/, /tmp, /usr, /usr/local, /home, ETC.).

I wouldn't want non-BSD users to get the impression that setting your hard drive is difficult, from this conversation, just because the job of fdisk is different on other platforms.

Re:Why no easy installer?

[Bishop]

OpenBSD does have one of the best installers going.

A general concensus seems to be that your first OpenBSD install will be a throw away. Your second will be good, Your 3rd and nth (n>=4) will be painless.

The best part about the OpenBSD installer is that a default install has everything that should be part of a Unix install and nothing more. The rest can be added painlessly from binary packages, source packages (ports), or compiled and installed by hand. (The worst part is disklabel.)

I have written this before: If you are a unix sysadmin make the time and learn how to install OpenBSD. It is not hard, and it will help you proffesionally. Even if you can't use OpenBSD officially. A quick OpenBSD install may be exactly what you need to tftp the backups to the primary database server that crashed hard 15 minutes before running the payroll. I am sure you can think of other, more mundane, issues that a quick Unix install can help solve.

Re:Why no easy installer?

[insomaniac]

Even if you know what you're doing, dselect is a ponderously huge set of choices; just browsing through them to locate the ones you want while looking at the package name column and nothing else requires enough reading and keying to slow the process down to a crawl.

heh, sounds a bit like 'make menuconfig' now THATS a bitch

Re:Why no easy installer?

[aussersterne]

Take 'make menuconfig' and multiply it by 150 or so and you'll have dselect. It really is a pig. I tried using it about twice on Debian installs and then just gave up.

Hint to Debian developers: When it's quicker to just bypass the installer altogether and then install packages one by one by hand, you know your installer is not helping anyone.

pf? Mature?

[Istealmymusic]

I'd hardly call pf mature. Hell, its only been in the CVS for less than a month. I commend OpenBSD as much as the next guy, but if Theo isn't careful he is going to end up with another root exploit in the default install.

Re:pf? Mature?

[dirtyeye]

um, its been there for over a year.

Re:pf? Mature?

[atrus]

If you actuaky read the interview, pf appeared in the 3.0 release. Which is about a year ago.

Re:pf? Mature?

[psxndc]

uhhh... pf isn't enabled in the default install. You have to enable it via /etc/sysctl.conf or manually, both of which require root privs to begin with.

psxndc

Re:pf? Mature?

[Anonymous Coward]

You are surprised that you need root privs to change the firewall rules?

Re:pf? Mature?

[psxndc]

No, but the poster said that a hole in pf would cause a root exploit in the default install. Since you'd have to be root to enable pf in the first place, why bother with the exploit? My point was that since pf _wasn't_ enabled by default, there would be no exploit in the default install without having the root password already.

psxndc

Re:if you are going to upgrade to 3.2 ahead of tim

[Anonymous Coward]

Be careful. The 3.2 errata hasn't been commited to CVS. So while you're running the 3.2 RELEASE, 3.2 STABLE won't exist until the actual release.

If you really want an early 3.2, you need to port the relevant 3.1 errata to your 3.2 tree.

Correction

[Anonymous Coward]

Actually I think the Net people hate him more.

Why pf sounds great

[capedgirardeau]

Excellent interview and responses, a very educational read for anyone who deals with firewalls and packet filtering. It should become part of the pf docs.

He is very modest, but I like the sounds of some of the things he is doing. Here are some solid, specific things pf is doing that I dont think other packet filters are doing, ask your vendor how they are handling these same types of issues.

This is why pf sounds like it will be very good (direct quotes from the article):

... [about the kernel integration] ... we just call a single function, pf_test(), from ip_input() and ip_output(), where all packets from network interfaces pass. Additionally, the function is called from the bridge code and after encapsulated packets are unwrapped, so encapsulated packets pass through pf at every layer. [security enhancement]

... The stateful connection tracking is based directly on Guido van Rooij's work (which is also the basis for IPFilter). ... To prevent attackers from tearing down connections, for instance with spoofed RSTs, the packet filter checks the sequence numbers in each TCP packet. Only the two peers involved in the connection (and the hops in between them) know the right sequence numbers. Guido's work shows how to keep lower and upper bounds on the sequence numbers given only the (incomplete) information the packet filter has, with a precision and beauty similar to the one you can find in a mathematic proof. [security enhancement]

... pf can randomize sequence numbers for hosts that have predictable ISN [initial sequence number] generators. [security enhancement]

... Fragment reassembly and normalization (eliminating ambiguities in packets that a receiver might interpret in different ways) was written by Niels Provos, based on Vern Paxson's work. This is something very useful I haven't seen implemented in a packet filter before ... Reassembling fragments allows the filter to deal only with complete packets, reducing the rule set complexity. In my opinion, it's well worth the additional cost. pf allows to specify what packets to normalize in which ways, so you can handle notoriously fragmented but otherwise known-good traffic separately. [security enhancement]

... pf implicitly creates state for all translated [NAT'ed] connections and stores the information needed for translation in the state entry. This simplifies and reduces lookups. [speed/security enhancement]

... [Skip Steps] And this is what skip steps are. For each parameter in each filter rule, the number of subsequent rules that specify the exact same value are counted. When, during evaluation of a rule, a parameter is found to not match, evaluation is not necessarily continued on the very next rule, but all subsequent rules that can't possibly match are skipped. [speed enhancement]

Re:Why pf sounds great

[roybadami]

This is something very useful I haven't seen implemented in a packet filter before ... Reassembling fragments allows the filter to deal only with complete packets,

Linux has been able to do this for a long time.

Re:Why pf sounds great

[hummassa]

Please, could you elaborate on this? How do I control the reassembly? via iptables? thanks...

Re:Why pf sounds great

[roybadami]

I don't know off hand how it's done these days. In 2.2 kernels, you used to say:

echo 1 > /proc/sys/net/ipv4/ip_always_defrag

Re:Why pf sounds great

[roybadami]

Hmm, thinking about this a bit more, I seem to recall that in 2.4 fragment reassemply is enabled whenever you use connection tracking in iptables.

I couldn't immediately find this in the doc, though. The bottom line is that 2.2 could always do this (configured as a global option), so I'd be astonished if this functionality isn't there somewhere in 2.4 and iptables.

Comment removed

[account_deleted]

Comment removed based on user account deletion

Re:OpenBSD's Security is Overrated

[sporty]

Which you realize, is more secure. OSX is similar in this respect. sshd, ftpd, all the services.. off by default. even sharing.. until you enable it.

If you start randomly turning on services on obsd w/o knowing what you are doing, who's fault is it for being insecure after the install?

Re:OBSD Support !!!-Patent trouble.

[Anonymous Coward]

I think the more important question is the Cisco Patent. Is there any way around it?

Re:OpenBSD's Security is Overrated

[a ( h 3 r 0 n]

The BSD community should take a hint and start gearing toward usability rather than "superior" security.

If usability is what you're looking for, try FreeBSD instead. One of OpenBSD's goals is to be Secure by Default. Whereas other BSD variants and most Linux distros take an approach of 'turn everything on and let the admin turn off what he doesn't need', OpenBSD takes the opposite approach. In my experience as an admin, theres no difference in effort between locking down, say, a Redhat install, or enabling what I need after install on OpenBSD. The difference is, the more clueless among us will be more protected by the default install of OpenBSD than by Redhat.

Re:Here it is

[Anonymous Coward]

Why didn't you warn me?

It's not that difficult

[_KhlER3L]

I don't think installing OpenBSD is any more difficult than installing a Windows box. You have to do it a couple times before you get everything right. But OBSD has one thing going for it: The initial install is really simple, comprised of only a few steps. If you can wrap your head around the disk partitioning (you can if you try), there's really nothing to it. A from-CD install takes only 5-10 minutes.

From there, /usr/ports makes available a tonne of software (some of which even works -- amazing!).

I'm speaking as a guy who hasn't installed X (tried once and mostly failed), but enjoys the commandline quite a bit. If you like working on the 'NIX commandline, or would like to learn, OBSD is a great system to play with.

khl

or VAX/VMS

[wotevah]

Or VMS which from what I heard is still being used by banks and such despite the fact that it was such a perverse OS and that TCP/IP was an optional package. Did that thing have any bugs at all !?

Re:or VAX/VMS

[Anonymous Coward]

Yes, VMS had bugs, but they were all very well-documented. Consult manuals B-127J0 through B-141J7 for more information.

pF

[LeiraHoward]

Wow.. you know you've been doing too much electronics homework when you look at "pF" and read it as "picoFarad" and wonder what that had to do with anything....

Re:if you are going to upgrade to 3.2 ahead of tim

[jolan]

You can grab the main .tgzs from:
ftp.usa.openbsd.org/pub/OpenBSD/snapshots/i 386

Those are snapshots of 3.2-current, not of what will be released as 3.2.

Daniel Hartmeier'

[Futurepower(R)]

The article is one of the best resumes I've ever seen.

You don't need root

[iamacat]

Just disable the root account and install setuid programs or daemons to do specific functions for your administrator. If you have physical security, nobody will be able to actually login as root. Install an IP filter that only allows packets from priviliged ports if you don't want user's processes to user network directly. As for filesystem security, have users login to a chrooted account that only contains or mounts directories that they are supposed to access. How will this Unix installation be less secure than OSes you mentioned? Perhaps you mean that default UNIX distributions you saw are not very secure. Or that system calls supported by your OSes encourage secure application design. But it should be still easier to write a library for this purpose under Linux than to write a whole new OS. What am I missing?

Re:You don't need root

[wotevah]

You are missing all the bugs that might be in the code still running as uid 0. Your daemons, the kernel, all of them are vulnerable. I haven't seen many exploits that actually get root by doing "su" to it, so "disabling" that account will not achieve more than, for example, a good password.

A "secure" OS in this context means an OS with well-known "clean", stable code that has been reviewed for flaws etc etc. There isn't much you can do from an administration point of view if the services/daemons you have to use are flawed.

I think sprinkling setuids around is not a great idea at all. Especially custom-written ones. Beautiful things can happen accidentally linking against the wrong library in a chrooted dir :)

Chroot is *not* 100% secure. It is not a sandbox. You can still access ports, memory and processes and kernel functions, you can talk to daemons, starve the system of resources or convince the parent process to do things it will regret.

Plus if you chroot users you'd still have to give them most of the OS somewhere unless they login to not do any work, and that will soon get boring when you'll have to upgrade all of it.

A truly secure machine requires hardware support. A better CPU design. If the 8086 did not mix stack with code and data we would not have had so many problems today.

Re:You don't need root

[iamacat]

Well, I suggested disabling root account to avoid abuse by an individual, as a parent post implied. By giving your admin targetted setuid tools rather than root access you increase the chance that users' e-mail will be private. It's the easiest to reply to your last paragraph. Indeed, exploits will be more difficult if only read-only pages would be executable by the CPU. But it's always possible to emulate the "required" secure hardware by running a VM. Java programs running on x86 will not have stack overrun problems, even if they are compiled to native code with gcj. As for security of setuids and daemons - yes the code needs to be inspected, but no more than the equivalent kernel code of the "secure" OSes. If anything, most misuse will simply cause them to crash rather than bringing down the whole system as in the case of kernel bugs. And despite danger, setuid executables can provide very fine grained access control - such as truncating a specific log file, only if it's bigger than a certain size. Even a secure OS will only provide more basic priviliges that someone might find a way to escalate. I think providing a standard set of setuid programs that have been carefully reviewed and letting knowlegable people write more is better than hardcoding access control in the OS. UNIX has hit the mark as a "meta-OS" on top of which one can build a very secure or a very flexible environment. You may have some point with chroot, but I don't see how kernel memory and processes will be compromized if you only have /dev/tty and don't mount /proc. If your IP filter works with loopback, you can deny access to your daemons from non-priviliged ports. Otherwise, they would indeed need to watch out for access from an chroot()ed process. I don't see what you can do to your parent process if it doesn't let you inherit any unintended file descriptors and simply calls wait(). As for giving users most of the OS, I assume that in a secure environment your users will only be able to access a fixed set of applications. Those executable files will be on a read-only filesystem, with the rest of the environment mounted as noexec,nodev. And UNIX does have process priorities and limits on memory, files, processes and so on. There may be bugs, but the basic concept is sound. All I am saying is that it's possible to create a very secure UNIX distribution using standard system calls but carefully selected/reviewed user software. You will still get all the drivers and performance benefits of a general-purpose OS and have fine-grained options for balancing security and functionality.

Re:You don't need root

[jbolden]

How will this Unix installation be less secure than OSes you mentioned?
If you have physical security, nobody will be able to actually login as root
What am I missing? [reordered by editor]


What you are missing is that the OSes I was mentioning assume an administrator might be in on the data theft. That is you don't have physical security; so you need to protect the system against someone simply copying the data directly from the harddrive.
What you list creates an OS which is very secure againt any sort of user attack. BTW openbsd is actually moving towards what you described with lots of the setuid processes chrooted.

Re:You don't need root

[PetiePooo]

I agree that chroot isn't the best sandbox out there. I prefer Virtual Machines, although they're a little more resource intensive (& not free).

I've been considering running a machine with two interfaces but not assigning it any IP addresses, at least for the "host" OS. Then, I could run one or more servers within virtual machines. For instance, the firewall VM would have access to both interfaces, and have IP addresses on them both. DNS and DHCP servers would only need a LAN interface.

I'd need a decent processor with lots of RAM to pull this off, but imagine the possibilities. Running snort in the host OS on the WAN port would give me stealth IDS capabilities. Running it on the LAN port listening for packets on port 514 would give me a stealth syslogger. Since there's no IP addresses to access the host OS, there's no target to hack!

Now, lets take it a step further and imagine this scenario: The stealth IDS detects with some certainty that my BIND DNS server was once again compromised and a hax0r l0ser is launching a DDoS attack from it. Since the IDS is running on the host OS, it shuts down the offending VM, restores the VM's disk to a known good one and restarts it. Insta-restore!

One other method I've been contemplating that I consider somewhere between VMs and chroots is running the servers under User-mode Linux. I haven't had a chance to play with that yet, so don't know the security imiplications. I can't imagine it would be worse than chroot, and it wouldn't tie up resources as much as VMs do.

Re:You don't need root

[iamacat]

Now this one I am curious about. You can encrypt the filesystem, but then you need to store the key somewhere. Won't tamper-resistant hardware be more important than software at that point? Maybe Linux has a use for Palladium after all.

Re:You don't need root

[jbolden]

Here is an example
1 - Every program keeps its data in memory
2 - the virtual memory system uses encryption
3 - programs use a private encryption key when passing live ram to the virtual memory system
(so in effect data on the drive is double encrypted).
4 - there is no true "shutdown" just something that acts like NT hibernate

You shut the system down / hibernate. Remember there is no file system and the allocation blocks table in ram (like for a virtual memory system) so without restarting the OS all you have is double encrypted sectors of harddrive in no reasonable order without a clear key.

Re:You don't need root

[Anonymous Coward]

>I agree that chroot isn't the best sandbox out
> there. I prefer Virtual Machines, although
> they're a little more resource intensive
> (& not free).

Plex86, and the PC emulator Bochs are both free. (I'd link to Plex86, but the site seems to be down.)

Re:You don't need root

[evilviper]

There isn't much you can do from an administration point of view if the services/daemons you have to use are flawed.

That's completely false. By no means do you need to run anything with blanket root permissions. systrace works great, chroot does fairly well, and you can run many services as a normal user.

You can still access ports, memory and processes and kernel functions, you can talk to daemons, starve the system of resources or convince the parent process to do things it will regret.

Most services I've seen don't just chroot themselves... the almost always drop their root permissions, meaning it's running as a normal user, inside a chroot. There's very little an attacker can do with that.

if you chroot users

Why would you want to chroot users? That doesn't make much sense to me.

If the 8086 did not mix stack with code and data we would not have had so many problems today.

That would only make overflows more difficult (OpenBSD has a non-exec stack), and even then, it wouldn't address any of your concerns.

Re:OpenBSD's Security is Overrated

[Anonymous Coward]

I hate when people say that OpenBSD is the most secure OS.

Its fucking bullshit and everyone knows it. Stop pretending! Its like the pink fucking elephant in the living room that no one wants to talk about!

OpenBSD hasnt had a remote exploit in its default install because OpenBSD doesnt fucking install anything in the default install. The default install is a shell of an operating system. If you care that much about security your computer shouldnt be connected to a network in the first place.

answer: because they don't want THOSE users

[honold]

the project is not commercial, and has no dreams of having millions of users. it only seeks to do what it does well - which it has for some time.

most of the users and all of the developers would probably scoff at the idea of upgrading the installer because development resources aren't cheap, and they feel the time would be better spent elsewhere since the installer does work just fine.

the 'rustic' install (complete with MANUAL PARTITIONING!!!) serves as a barrier to entry, keeping the mailing lists more clean of 'how do i mount a floppy?' questions.

Daniel Hartmeier's resume

[Futurepower(R)]

The article is one of the best resumes I've ever seen.

Prospective employer: What have you done?
Daniel: I wrote the stateful firewall in OpenBSD. Here's a kerneltrap.org article.
Employer: (Silence while recovering from amazement.) What pay do you expect?


I hit a key accidentally, and Mozilla posted my comment above.

Re:OpenBSD's Security is Overrated

[Anonymous Coward]

If you follow these OpenBSD zealots line of reasoning then the most secure operating system is the one that does not exist.

Does anyone take them seriously?

Re:Here it is

[Anonymous Coward]

Your clever ploys aren't going to fool me. I refuse to NOT click on the link!

( Read More... | 2 of 1416 comments | BSD )

[mackstann]

seriously though, it seems that attempting to discuss bsd here at slashdot is a difficult proposition at best, can anyone recommend some sites where there is some intelligent discussion of bsd news and issues, without the annoying "BSD is dying" crap? deadly.org is the only one i know of and its pretty slow.

any links / suggestions would be greatly appreciated, thanks!

Don't Forget

[SlickMickTrick]

The intergration. All of these features in a powerful package with an installer targetted at admins.

The only thing I would ever ask of them is to take some of the lessons learned from the Gentoo Portage System.

Re:Don't Forget

[FuzzyMan45]

The only thing I would ever ask of them is to take some of the lessons learned from the Gentoo Portage System.

Such as?

Re:Don't Forget

[blkwolf]

>>The only thing I would ever ask of them is to take some of the lessons learned from the Gentoo Portage System.

>Such as?

Integrating the entire OS with the ports tree, not just 3rd party applications. This would allow easy upgrading of the system to keep up with security patches etc (i.e. emerge -u world)

aliases or commands to access the ports tree from anywhere. Instead of having to cd /usr/ports/somedirectory/someapp; make install you could instead emerge someapp and be done with it.

portage has improved alot on the database tracking installed software and the ability to find software in the portage tree, all from the one command.

I love OpenBSD and it's ports tree, but that doesn't mean there isn't any room for improvment and/or new features. Gentoo looked at the *BSD ports systems and said "how can we make this even better" and came up with some pretty good ideas imho anyways.

Nothing wrong with the *BSD's finding ideas they like that Gentoo has improved on and then incorporating them back into their own trees.

Re:Don't Forget

[Anonymous Coward]

You "love" OpenBSD? whats the matter with you. its inanimate. i like FreeBSD, but dont love it. Thats a sign of zealotry right off.

the OS should be a coherent system, integrating "world" and ports is a bad idea. I have yet to see Gnetoo productionable. And I want it to do well. Why? RedHat sucks compared to FreeBSD and Linux needs a real attempt at system, badly. Gentoo isnt it. Everything builds, but nothing is tested.

FreeBSD is subtle, the marketing idiots at stupid .com companies and never understood it. Its quietly sitting in the corner, kicking ass. Linux is embarassingly floudering around with a kernel whose boss things its cute to not dist it with a system, so library and compiler wars fragment Linux into a pathetic mess. Everyone is doing it any way they feel like and its a mess. I will say Open, Net and Free are similiar enough so that you dont get pissed moving from machine to machin. OpenBSD still sucks, but has similar L&F.

Moving from Linux box to box, including Gentoo, is annoying and counterproductive. And Gentoo has not a prayer in hell to "be better" than LSB. LSB is lame, and its lameness will be mandated.

I only hope there continues to be room for FreeBSD to continue growing. Laughably, all the Line-Sux companies including VA Linusux systems, Slashdots owner, are all doing horribly.

Linux is a bear that needs a trainer, its been pissing and shitting where ever. I disagree that Gentoo is better than FreeBSD, would you bet your production on it? Where is Gentoo -CURRENT, -STABLE?

Gentoo is about where Slackware is. A script kiddie OS for people with too much time on hand. FreeBSD is stable, well tested, and run by a bunch of people (who at times are annoying themselves). But at least there is none of this zealot or totalitarian shit like Linux "likes" (FUCK YOU LINUS) and Theo de Raadt whim of the day. These people are a far cray from Thompson/Ritchie/Kernighan you wouldnt know it from the arrogant rhetoric.

Certain single people can do a lot. Sometimes one man leadership ceases to scale. This has happened with many projects. Linux has been enabled by a foolish industry who is prisoner to one man's whims. Sounds like Germany 1939.

We, the computing public, are tired of one man bands and zealorty. I just need the thing to work. FreeBSD works. And I constantly poll anything newer or better, constantly. And I never find a reason to leave FreeBSD on junk hardware (2-way or smaller). Its its real iron, the vendors OS usually does just fine.

Re:Don't Forget

[blkwolf]

> You "love" OpenBSD? whats the matter with you. its inanimate. i like FreeBSD, but dont love it. Thats a sign of zealotry right off.

Okay maybe I shouldn't have said love, but I do enjoy it quite alot as an OS, along with various distributions of Linux, AIX and other unices. a zealot I'm definetly not.

What about OpenBSD sucks compared to FreeBSD?
Personally, the last time I tried FBSD overall I liked it, but got very ticked at it when I wasn't able to get my simple SB16 soundcard to work correctly in it. Even with the awesome FBSD Handbook, which I consider one of the best OS docs I've read.

On the other hand OpenBSD just detects my hardware and it works. simple as that, if it's supported it works. no need for messing with modules or configuration settings, (unless your configuring your nic or X), just use the device and forget about it.

> Linux is a bear that needs a trainer, its been pissing and shitting where ever. I disagree that Gentoo is better than FreeBSD, would you bet your production on it? Where is Gentoo -CURRENT, -STABLE?

Funny I dont recall saying Gentoo was better than FBSD or any other OS. I did say they have made some improvments to the ports system and I'll stick by that. Face it the ports systems uses by any of the BSD's has been stagnent for some time, not to say that's bad in of itself, but why ignore improvments when they do come along?

Also as to your question: 1.2 is stable, 1.4rc1 is devel pretty simple actually, and yes I have moved all my companies production linux servers over to Gentoo (the others run OpenBSD). And so far, like FBSD it just works.

Where are you getting all this zealotry stuff? Personally I see it in all the distro's and/or OS's. You name it, Windows, Solaris, AIX vs HP-UX, linux vs the BSD's, BSD's vs the BSD's. Just because a vocal minority tend to go overboard doesn't really mean anything as far as the quality of the OS.

Personally I dont agree with your assessment of the the linux industry being prisoner to anyone let alone Linus. Linus controls the kernel, that's it. If the industry doesn't like what he does, they are more than welcome to 1. elect someone else to direct kernel development 2. Fork the kernel and go play in their own field 3. Replace it with somthing else entirely (see HURD).

As far as Theo, well OBSD is his project, it follows his goals and what he wants out of it. Granted it's easy for people to find him arrogant or worse, but they are more than welcome to basically follow the same choices as stated above (see projects like EMBSD, MicroBSD) or use somthing else entirely.

Right now Theo's goals and direction of OpenBSD follow along with what I want out of an OS. A stable codebase that is as simple and clean as possible with security as one of the number 1 goals of the project. It's not perfect, and no one I know says it is. It works for those of us who use it and we are happy with it.

That doesn't mean I dont think it can hurt to improve certain areas like the ports tree which was the whole point of my original post.

Re:Don't Forget

[Anonymous Coward]

lets not pretend. openbsd ports *suck*

and notice that theo says ports are "tainting" a secure system and that security is not guarunteed if you use ports.

what the fuck does OpenBSD do without any ports again? almost nothing? oh, i forgot, its good at running SMP hardware in UP mode without using the APIC too!

oh what one letter can do

[Anonymous Coward]

anyone else notice how its just one letters location that seperates a reference to the most insecure OS and the most secure OS?

OBSD
BSOD

ehh past my bedtime i think

Re:( Read More... | 2 of 1416 comments | BSD )

[isolenz]

yes, a great slash based bsd site is

daily.daemonnews.org

same thing as /., but without much of the bsd bashing (I believe microsoft bashing is a religion there too though, but hey, I'm all for that)

-isolenz

haha

[Anonymous Coward]

Needless to say, I had our quad Xeons back running OpenBSD by the end of the week. Gerbil is back on its way to another glorious 3 years of uptime.

no you didn't. openbsd only runs on a single processor.

thank you, come again.

A nice birthday gift

[jtharpla]

Yay! Just in time for my birthday. :-) Actually, I'll probably wait a bit...just finished my upgrade to 3.1 STABLE. I wish every OS upgrade was as smooth...cvs update, compile, then do some diffs of etc. Nothing to it.

Re:Don't Forget FreeBSD sucks a lot less.....

[Anonymous Coward]

..than gentoo. You would be braindamaged to think that cvsup and ports dont lead to a real, stable, coherent well documented productionable system and that Gentoo leads to ANY of those said qualities.

Gentoo is not stable, audited, coherent, documented and its certainly not production ready.

OpenBSD isnt even on the radar.

Maybe its me..

[bobdole34]

and my fear of change; but having worked on many unix and other firewalls: ipf has worked very well, I'm sure there are good reasons to add pf(ctl), but keep ipf for my sake! ;^)

Re:Maybe its me..

[Anonymous Coward]

ipf has worked very well, I'm sure there are good reasons to add pf(ctl), but keep ipf for my sake! ;^)

After Darren Reed and Theo's egos having their dick-waving contest, I think it's safe to say that ain't gonna happen...might as well use Net/FreeBSD if you want ipf

easy?

[rsax]

What's your definition of an easy installer? I would rather have something functional over easy/GUI. When I first installed OpenBSD I had only used Debian since then (only for a year or so). I printed out the entire FAQ and read it back and forth whenever I had some free time. If you read it, you will notice that it walks you through the entire installation procedure. If I was able to install OpenBSD using their excellent text installer just by reading the documentation available on their site then I'm sure anyone (who's willing to do research) can. It also helps to have an old box to install on first, play around, install again.. rinse and repeat as required.

OpenBSD 3.2 availability soon

[Anonymous Coward]

As for the OpenBSD project, there are some nice 3.2 goodies you can pre-order now, shipping starts by the end of the week it seems.

Support the OpenBSD developers by getting a 3.2 CD 3.2 CD $40 or for Europe EUR 45

The new new 3.2 poster is very nice too, get it for $10 US or EUR 14 in Europe

Re:Isn't the Most Secure OS... It had recent explo

[peter]

10 seconds with google was all it took to find evidence to prove you wrong. This is just a DoS, but you just said exploit, not run arbitrary code or anything like that. There's also the Mac Attack: send a certain 40 byte UDP packet to a MacOS computer, and it sends a 1500 byte ICMP packet to the source address of the UDP packet. There is a Mac security website that looks useful for people interested in making a Mac secure (rather than raving on /.)

Cool Mac software that I found while looking for info: ssh and sftp for mac with SSH2 support. License? Well, there's a GNU head on the website :)

OpenBSD Spinlock and the OBSD method to solve BKL

[Anonymous Coward]

Theo has the best way to make BKL a bygone issue. NEVER SUPPORT SMP! I can't believe everyone hasn't thought of this first. My god. This is revolutionary

Re:( Read More... | 2 of 1416 comments | BSD )

[Shanep]

can anyone recommend some sites where there is some intelligent discussion of bsd news and issues

I prefer mailing lists. In fact, after signing up to some interesting OpenBSD lists (mostly just reading) I found I was reading OpenBSD a lot less and reading www.deadly.org a lot more (and wishing it had a lot more articles and discussion).

Re:( Read More... | 2 of 1416 comments | BSD )

[Shanep]

Bugger, sorry. That should read "I found I was reading /. a lot less and reading www.deadly.org a lot more".

OpenBSD is so l33t...

[Anonymous Coward]

...that its site is hosted on Solaris -- w00t!

http://uptime.netcraft.com/up/graph/?mode_u=on&mod e_w=on&site=www.openbsd.org

Operating System and Web Server for www.openbsd.org

The site www.openbsd.org is running Apache/1.3.26 (Unix) PHP/4.2.1 mod_perl/1.27 on Solaris.

Re:OpenBSD is so l33t...

[linuxbaby]

RTFFAQ:
http://www.openbsd.org/faq/faq8.html#wwwsolaris

8.18 - Why does www.openbsd.org run on Solaris?

www.openbsd.org and the main OpenBSD ftp site are hosted at a SunSITE at the University of Alberta, Canada. These sites are hosted on a large Sun system, which has access to lots of storage space and Internet bandwidth. The presence of the SunSITE gives the OpenBSD group access to this bandwidth. This is why the main site runs here. Many of the OpenBSD mirror sites run OpenBSD, but since they do not have guaranteed access to this large amount of bandwidth, the group has chosen to run the main site at the University of Alberta SunSITE.

Re:OpenBSD is so l33t...

[Anonymous Coward]

Look at *where* it is hosted. Then think.
Perhaps you would like to donate so they can afford the bandwidth needed themselfs?
There are also Linux mirrors there. Exactly WTF is your point?

Re:( Read More... | 2 of 1416 comments | BSD )

[Sn4xx0r]

Go to your slashdot preferences, the homepage tab, and on the lower part of the page is "Customize Slashboxes". Enable some of the bsd sites to see their headlines while reading slashdot.

Like Shanep said, OpenBSD Journal (at deadly.org) is a good one.

Re:Don't Forget FreeBSD sucks a lot less.....

[Anonymous Coward]

Not stable?

Try installing it and using it before you comment!
Gentoo 1.2, and then 1.4rc1, have been running my web/mail/shell server for months now, and it has NEVER not been stable. I never have to reboot it (apart from the very occasional kernel upgrade) and it never falters.

So i disagree with your uninformed comment completely!

Re:Don't Forget FreeBSD sucks a lot less.....

[Anonymous Coward]

your personal web/mail/shell server. i have been following gentoo since before you were probably aware of it. try loading that baby up. your personal web/mail server doesnt count. and if you are using that in production, whoooo-weeee. you are one risky kind of guy [aka reckless]

now, what was your max uptime, mr reboot the system to tinker the kernel? thats what I thought. "Gee, I havent left it up for more than 3 days at a time because Marcelo releases yet another broken 2.4.20[pre/rc] update!" Come to think of it, a k-tard like yourself would love something like Gentoo, its great for bored people looking for an excuse to reboot.

vermillion speaking of stealing,openbsd started it

[Anonymous Coward]

the whole fucking thing a half assed fork of NetBSD.

At least FreeBSD is original. (oh, and scalable, faster, more featured, has better ports, is secure -i dont know what the fuck or how the fuck SSH is better on OBSD, is coherent and respectful of 4.4BSD without being a fucking lunatic and keeping the shit that should have gone years ago there

Theo de Craap. He stole SSH from Tatu, OpenBSD from NetBSD, most of the drivers from FreeBSD. The pf/ipf series was probably inspired by work done elsewhere since he set a precedent for being incapable of being original, or better.

New song!

[Improv]

Although I'm looking forward to the release,
and will upgrade eventually, I'm *REALLY* looking
forward to the next song..

Re:Isn't the Most Secure OS... It had recent explo

[Anonymous Coward]

Said "Mac Attack" is ancient and only affects very old versions of Mac OS 9.

"What more could you possibly want?"

[Akardam]

An embedded, dedicated solution?

Don't get me wrong, though I've personally not used a BSD as a firewall, I know people who have, and they're happy with it, completely happy. But I really prefer something which was built from the ground up to be a firewall and ONLY a firewall.

I've worked extensively with the Sonicwall devices, and I've also heard some good things about the WatchGuard Firebox series. Then again, if you want to go gung ho all out and out, you can get a Cisco PIX.

Basically, for me, it boils down to having a specific device for a specific job, as opposed to having a general purpose piece of software running on commodity hardware for a specific job.

Re:"What more could you possibly want?"

[Anonymous Coward]

Commodity hardware, yeah, have you ever cracked open one of those Watchguard boxes? I did once. 150MHz Pentium Processor, 3 3Com3C905 nic cards. So, I slapped some OpenBSD on that thing. It runs headless. I think it's funny though turning a $2000 boutique firewall into a $50 commodity firewall.

Re:"What more could you possibly want?"

[AngryRodent]

While I am happy that you like the Sonicwall and Watchguard firewalls, and seem to think PIXen are nice, I would have to disagree. Having used all of these products, and several others as well as home-grown firewalls, I do not hold any of these three in high regard.

Perhaps more relevant however, is that Watchguard firewalls are Intel and Linux based, Pixen (at least the older ones) are Intel based (they were originally made by Network Translations. I have heard from reliable sources that Sonicwalls are VxWorks based.

Now perhaps, these devices meet the definition of being built from the ground up to do a specific task- having worked for several equipment vendors who have sold appliances as well as custom-hardware based network devices, I have a more jaded view of what this really means in practice.

One of the few security devices that is primarily custom-hardware based is the netscreen product line. I have no idea if they use VxWorks or another embedded OS, but would be somewhat surprised if they run a fully home-grown software package.

So, in general, I see value in your argument about specific device for specific jobs- if only from an auditability and management perspective.

However, most of the specific-job devices in fact run on essentially commodity hardware and are based in large part on general purpose software- no matter how much people in marketing want you to believe otherwise.

Re:"What more could you possibly want?"

[Anonymous Coward]

Well having taken Watchguards out of the network at my current employment (and replacing them with OpenBSD) I don't see what the difference is.

Unless you are willing to spend a fortune any firewall you get is not dedicated H/W. What do you think is in a Watchguard, PIX, or other firewall? A CPU, ethernet interfaces, RAM, etc.

How is that any different from a locked-down OpenBSD solution (with a write-protected hard disk)?

I worked on a firewall product. There is nothing mystical about it. OpenBSD has a decent packet filter. It is a very good choice for a lot of networks. Especially ones that need remote admin (something a locked-down firewall can't really give you without being just as insecure as a PC running OpenBSD).

For the record, the watchguards we had crashed under load repeatedly. Granted, we were pumping streaming video (OVC) test streams through them. But they crashed. Replaced two of them with an OpenBSD box and no more problems!

The most secure OS

[octogen]

And what's up with that "the most secure os" sarcasm? OpenBSD *is* secure.

This definition depends on what you call "secure".

Theo calls an OS with a very limited, trusted set of applications "secure" - however, running secure applications with root privileges has nothing to do with OS level security. That's application level security.

I'd call an OS secure, if you can only hack it by exploiting a bug inside the OS kernel. That means, there is no way of gaining 'root' privileges or something like that by hacking into some highly privileged daemon, provided that the system is configured properly.

To achieve this level of security, it is neccessary to have fine grained privilege and compartmentalization controls instead of the superuser/world distinction built into the OS kernel - and that's still missing in OpenBSD.

What means "secure"?
"[...] Put another way, "secure system" means safe enough to protect some real world information from some real world adversary that the information owner and/or user care about. [...]"
- SE Linux FAQ, NSA

-----

There are mainly two types of secure Operating Systems.
a) Everything up to the C2 level of security
b) Everything from B1 up to A1 (never ever reached by any OS)

The difference is information labeling.
You only get a B1 security certificate, if your OS has mandatory access controls. It must be able to automatically prevent users from mixing secret data with public data. This is often called a "Trusted OS".

Most people don't need information labeling/mandatory access control, because all their data has the same level of sensivity.

TCSEC C2 does not say much about how the OS has to handle privileges, so a C2-level OS can still be very insecure, but it can also be very secure - almost impenetrable - and it still can't ever become certified at B1 or above, because it simply can't handle multiple levels of sensivity.

-----

Let's look at NON-Trusted-OSs first, because most people don't need a Trusted OS:

OpenBSD lacks an uninterceptable audit trail and access control lists as required by TCSEC C2. It distinguishes between world and root privileges.

VMS has an audit trail, access control lists, and a privilege model.

AS/400s have an audit trail, access control lists, a privilege model, an object-based security model with type enforcement and hardware-supported pointer-in-memory-protection because of the single level storage address space, but that does not matter much (think about it as something which is similar to protect-mode on an x86, but based on objects and pointer to objects instead of segments and segment descriptors).

VMS is clearly superior to OpenBSD, mainly because of the privilege model. If a process does not have many privileges, then an attacker can't gain many privileges by hacking it. Simple, isn't it?

An AS/400 is (VMS users listen carefully) clearly superior to both, OpenBSD and VMS. It has a superset of the security features of VMS, and additionally it has object-based protection. Therefore, you can't write to a program object, and you can't execute a data file or things like that.

Now let's look at Trusted OSs:

SE-VMS has an audit trail, access control lists, a privilege model, information labeling and compartment mode.

Solaris with Argus Pitbull has an audit trail, access control lists, fine grained privilege controls plus inheritance rules (proxy privilege sets and so on), a trusted computing base, information labeling and compartment mode (mandatory access controls).

Both are clearly superior to the non-trusted OSs mentioned above, because applications can be totally separated from each other by putting them in separate compartments.
If someone hacks into an application in compartment A, then he/she still can't access an application in compartment B, so he/she is locked down into a jail.

Solaris with Pitbull is clearly superior to VMS, because of the much more sophisticated privilege model. It's more fine-grained and it has inheritance controls, so certain applications will only gain their privileges if they can inherit those privileges from another process. By default, executing another application always drops all privileges.

-----

What I'd like to say is .. 2 things:

1. What about "OpenBSD is the world's most secure OS"? It has a pretty good verified kernel, but it's security mechanisms are simply not powerful enough. A bug-free kernel does not help alot, when you have to run things as root, because the kernel does not have appropriate security mechanisms like privilege controls or compartment mode...

2. What about "Unix can't be secure"? I get really bored by VMS users comparing Standard-Linux with VMS; maybe compare the most secure setup of either Operating System and then let's talk about security again.
HERE is TCSEC B3 certified Unix (Linux-compatible, too).

regards,
octogen

Re:The most secure OS

[foofboy]

Point of order re:
b) Everything from B1 up to A1 (never ever reached by any OS).
There are several OS's rated B1 or above.

From Dynamoo:
B - Mandatory Protection Division B specifies that the TCB protection systems should be mandatory, not discretionary. B1 - Labelled Security Protection As C2 plus:

• Mandatory security and access labelling of all objects, e.g. files, processes, devices etc.
• Label integrity checking (e.g. maintenance of sensitivity labels when data is exported).
• Auditing of labelled objects.
• Mandatory access control for all operations.
• Ability to specify security level printed on human-readable output (e.g. printers).
• Ability to specify security level on any machine-readable output.
• Enhanced auditing.
• Enhanced protection of Operating System.
• Improved documentation.
• Example OSes are: HP-UX BLS, Cray Research Trusted Unicos 8.0, Digital SEVMS, Harris CS/SX, SGI Trusted IRIX.

B2 - Structured Protection As B1 plus:

• Notification of security level changes affecting interactive users.
• Hierarchical device labels.
• Mandatory access over all objects and devices.
• Trusted path communications between user and system.
• Tracking down of covert storage channels.
• Tighter system operations mode into multilevel independent units.
• Covert channel analysis.
• Improved security testing.
• Formal models of TCB.
• Version, update and patch analysis and auditing.
• Example systems are: Honeywell Multics, Cryptek VSLAN, Trusted XENIX.

B3 - Security Domains As B2 plus:

• ACLs additionally based on groups and identifiers.
• Trusted path access and authentication.
• Automatic security analysis.
• TCB models more formal.
• Auditing of security auditing events.
• Trusted recovery after system down and relevant documentation.
• Zero design flaws in TCB, and minimum implementation flaws.
• The only B3-certified OS is Getronics/Wang Federal XTS-300.

A - Verified Protection Division A is the highest security division. A1 - Verified Protection As B3 plus:

• Formal methods and proof of integrity of TCB.
• These are the only A1-certified systems: Boeing MLS LAN, Gemini Trusted Network Processor, Honeywell SCOMP.

A2 and above Provision is made for security levels higher than A2, although these have not yet been formally defined. No OSes are rated above A1.

Re:The most secure OS

[octogen]

There are several OS's rated B1 or above.

i c, my fault, should've been:
Everything from B1 up to A1 (A1 never ever reached by any OS).

Boeing MLS LAN and Gemini Trusted Network Processor are Network Components, not Operating Systems. Honeywell SCOMP is an integrated computing platform, running Getronics XTS/300.

XTS/300 without SCOMP is only evaluated at the B3 level.

Re:The most secure OS

[Anonymous Coward]

You completely miss the point. OpenBSD is secure, and it's *free*. You only mention operating systems which are secure, but aren't free available at all. So what's the point comparing the security of OpenBSD with multi-million$-security-audited operating systems? You buy me a copy of VMS? I sometimes wonder why people don't see the facts and start flaming at a single small and simple sentence ...

Re:The most secure OS

[evilviper]

I have to say that the only place we are in agreement is: depends on what you call "secure".

Theo calls an OS with a very limited, trusted set of applications "secure"

No, that's what he has called 'Secure By Default'. The extensive audits of the kernel, and continual task of removing privlidges wherever possible, IS security IMHO.

I'd call an OS secure, if you can only hack it by exploiting a bug inside the OS kernel.

So, stick everything into the kernel (apache, OpenSSH, etc), and you've got your wish. May I suggest you work on a new definition of a secure OS...

it is neccessary to have fine grained privilege and compartmentalization controls instead of the superuser/world distinction built into the OS kernel

No. In fact, something like systrace can do the job even better than sticking it in the kernel. Besides that, 99.9% of programs could be run as normal users (not root) if OpenBSD had TCP/UDP port ACLs. If that was done, you could finely control the permissions for each account, thereby each service. I do this for many programs that don't bind to privlidged ports, and it works nicely. For programs that need privlidges, chroot does a good job of limiting the privlidge of a service. One again, the job of chrooting services is not the kernel's, but a regular program.

OpenBSD lacks an uninterceptable audit trail and access control lists as required by TCSEC C2.

Hmm, isn't that just what remote-syslog would provide? Besides, for there to be a hidden store of information locally, that means you have to begin removing some of the power and flexibility that Unix gives you. I like remote logging much better than my OS limiting what I am allowed to do.

you can't write to a program object, and you can't execute a data file or things like that.

That doesn't sound like much of an advantage to me. Regular users already can't write to root-owned programs. If we are talking about root privlidges, then I'd like to be able to strip my executables, and otherwise modify them as I see fit. Besides, where's the security advantage there? I just don't see it.

A bug-free kernel does not help alot, when you have to run things as root, because the kernel does not have appropriate security mechanisms like privilege controls or compartment mode...

You DO NOT have to run much of anything as root, and if you do, you can pretty well secure it.

You have a kernel fettish. Get over it.

TCSEC B3 certified

How's this: You call an OS with a high NSA rating "secure" - however, I find their methods of classification have nothing to do with real security.

As a matter of fact, an OS could have a blaringly obvious, devestatingly bad security hole in it, while still acheiving just as high of a rating. My point is only that their sole criteria for ratings are not the only factors in security. They are more like a NSA wishlist of things they wish to have. Let's not forget that the NSA is part of the US government... the largest bureaucracy in the world.

Many people consider ACLs to be more secure than Unix style permissions. Despite that, Unix permissions are just as secure, (almost) as flexible, and just as fine-grained as ACLs.

Both the capabities of Unix permissions, and the options for Unix (non-mandatory) access control, goes to show that there is more than one method that results in security. Many people just have tunnel-vision, and don't recognize the alternatives.

If you like the idea of sticking everything in the kernel, fine, but it is not a prereq. for security. Indeed, those functions can very effectivly be done in much simpler ways...

Re:OpenBSD Spinlock and the OBSD method to solve B

[Anonymous Coward]

Following in Theo The Rats footsteps, I intend to write the most secure OS in the world. It will support no CPU's! It will be revolutionary! No executable stacks, no kernel buffer overflows, no race conditions, no starvation problems, no privelege escalations, nothing!

However, also like Theo The Rat, I can't code for shit, especially hard stuff like an Operating System, so I'll just wait for someone else to do it while I cross post to everyone elses mailing lists with flames. Guys?

Re:Why no easy installer? - Simple answer

[nurb432]

Its due to the intended audience/market.

If the installer is too complex/confusing for you, then you are not the intended audience.

Not meant as an insult, just reality.

OBSD isn't intended for the 'average' person, but one slightly above that level.

Actually

[waspleg]

I live in my girlfriend's parents basement

and my openbsd server is humming along right beside me, can i be lucky #13?

Re:Actually

[Anonymous Coward]

"server"

What's on there, your grocery list database?

JK.

Re:OpenBSD's Security is Overrated

[Anonymous Coward]

Redhat has not enabled services by default since the early days of 7.0(that was back in 2000.) Here's something which most of us have known for quite some time, but you can call it news if you like: Recent News

So basically, you're whole post is moot because Redhat hasn't enabled services by default for nearly 2 years now.

Theo has a cold

[drwho]

OpenBSD is dying, because Theo has a cold.

Heh...just kidding. But really, we're too dependant on him, and his whims. We need a less ego in the BSD world. Theo DeRaadt, Darren Reed, Dan Bernstein et al can be fine programmers but what's the damn point if they can't get along. OpenBSD's development has too much power concentrated in the hands of too few people. This leads to all sorts of boo-boos and the inability to maintain older code (3.0 just died...ugh!).

I think that licenses are important. They need to be unconfusing. Project developers should find an existing, popular, and well understood license that most closely suit their needs and put their work under that license, rather than create their own. Here is where I fault DJB and Reed for their licensing quirks.

What license is irritating me the most right now is PINE's.

Re:Theo has a cold

[mindstrm]

There is nothing preventing anyone else form developing it further, or continuing to support 3.0

Mirror of the interview

[Zigg]

Daniel has a mirror of the interview at his site.

Re:You don't need root Plex86 is here now.

[Zeio]

Plex 86 is locate here now - http://savannah.nongnu.org/projects/plex86

Old site is down....
RvnPhnx - 2002-Oct-06 22:30 - 0 messages
The old plex86 web site is no more. I was wondering how long it would take for them to take it down, but it is now--the wondering is over. In any case, this is where the work happens--so be it. I have the old cvs still, in case anybody wants to play with it. I may get it posted here, and then branched/modularized, etc.--but the development is going to focus more on the plex86-release stuff for now.

Re:so is there a packet filter or not? cluebat.

[Anonymous Coward]

Look at an OS like Z-OS or Eros

Which sites are run off of these operating systems? Which organizations run these operating systems? Or are they merely theoretically secure, with little use under fire?

--- or --

cluebat: Z-OS is otherwise known as IBM OS/390 and holds something like 80% of the world's business data.


Okay, who is the troll. Some fucking fool doesnt know what a mainframe OS is, or someone who rather politely points it out.

You are a fucking idiot. You are the troll. And an OpenBSD zealot asshole.

Re:Save you the effort... whatever

[Anonymous Coward]

hi.

if he cleans stuff up so well why doesnt he submit patches back to the orginal "offenders?"

thats why i thought. he doesnt. so get back to trying to suck your own dick, jbolden cockeater.

systrace, setGid, ***Cheap OBSD CDs***

[Mana Mana]

These includes things like a nonexec stack, a chrooted apache, a reduction in the number of setuid binaries

Ahemmm! set[ug]id, both. Also, the addition of Provos' systrace(1), which has been coming along for some time is tres cool, man. Listen, read:

Systrace enforces system call policies for applications by constraining the application's access to the system. The policy is generated interactively. Operations not covered by the policy raise an alarm and allow an user to refine the currently configured policy.

Provos' (the author) systrace webpage on the subject.

CTS. Someone bitched about the installer, and how cooler it'd be, how more ``popular'' OBSD'd be if it came with a purdier installer, cotton candy, and power seats. This flies in the face of how OBSD developers feel about the audience of their OS. `Fuck popular! Popular only brings unwashed numbers and wastes time; they don't handhold anyone.' `Read gaddammit, read!' `If you wont read the fucking excellent manpages, or wont read other included documentation, if you wont search list archives for the same repeated questions (and they will be if you are that stupid) you're a fucking slacker, if you read them and don't understand them, you're a fucking luser.' Sound like an OS that gives a shit about being popular or tolerant of stupid newcomers? I don't think so.

If you're prepared to do the hard work, not expecting handholding and waste anyone's time, you'll be alright. Not for everyone, as it should be.

I have extra new copies of Official OpenBSD CDs, selling them for a song, too. ;) It comes with a dozen OBSD stickers (not sold anywhere else), printed installation instructions, which make installing OBSD a breeze for those not use to this new OS. Just that is worth the price of the regular priced CDROMs, but I'm selling them way below that. $10.98. See sig for details.

Re:OpenBSD's Security is Overrated

[MobyTurbo]

The BSD community should take a hint and start gearing toward usability rather than "superior" security.

If usability is what you're looking for, try FreeBSD instead. One of OpenBSD's goals is to be Secure by Default. Whereas other BSD variants and most Linux distros take an approach of 'turn everything on and let the admin turn off what he doesn't need'

NetBSD, at least as of 1.6, has most of its services turned off by default as well, has an extremely lean install, and runs on even more architectures than OpenBSD. It tends to be optimized towards stability more than security though. Actually, Debian doesn't turn on much by default among the Linuxes I've tried, but it probably isn't as secure as *BSD. (It doesn't have the group "wheel" to protect against root access for a well-known simple difference between BSD and SySV clones.)

Re:Why no easy installer? - Simple answer

[Demonicbunny]

They should really make you use blocks. If you can't convert blocks to megs, then you shouldn't be using OpenBSD.

Re:OpenBSD's Security is Overrated

[Anonymous Coward]

Gentoo Linux has the wheel user as BSD.

I use NetBSD right now and for years, but it fails when it comes to Flash support on the web.

OpenBSD 3.2 supposedly released on 1 Nov 2002

[Anonymous Coward]

So OpenBSD 3.2 is released today, where can I buy this from in London, UK?

Unfortunately...

[jhantin]

the Smith & Wesson extraction method destroys the keys. If you need a copy of the clear data, and you're dealing with someone who maintains that "you can have my keys when you pry them from my cold, dead fingers", shooting them won't do you much good. You'll have to either use some sort of subterfuge to sneak off with a copy of the keys or break the keyholder's will with some form of duress.