Slashdot Mirror
OpenBSD Book Suggestions
An anonymous reader writes "An OpenBSD book is being written and the author is looking for content suggestions to include in the book. It would be nice if the slashdot community suggested a bit or two. ;)"
← Back to Stories (view on slashdot.org)
OpenBSD doesn't need a book. OpenBSD is one of the few operating systems that makes a practice of actually maintaining some semblance of documentation.
See "man help" and http://www.openbsd.org/faq/index.html
--Chris http://chris.quietlife.net/
Corrections and additions to my post above:
"...file serving Microsoft OS clients using Linux
I'd like a book to show me exactly how to set up a $200 Microtel PC to be a web server. The total cost of the PC, book, and shipping would be under $300. I'd plug it into a switch connected to DSL and use it with a fast-switch DNS service as a backup when my web host is having problems. I'd use it as a test machine for CGI programs. I'd host low-traffic web sites. It would be great knowing that I was using an extremely secure OS set up by an expert. I would read the book to make adjustments.
What is the true cost of a $50 book that requires 80 hours of work finding additional information? Answer: Thousands of dollars. All the books I find at Powell's technical bookstore drag me over the coals. That's no way to treat a customer.
Okay, now I need a file server for workstations running Microsoft operating systems. In any real-world application, I won't mind paying $300 again for another machine and another book. I certainly don't want to take chances messing with the web server. I would just plug the 2nd computer into another port on the network switch. I'd want true plug and play, so that the biggest problem would be convincing a customer that I was serious when I quoted the cost.
So now I'm really impressed. I've run into situations recently where two ISPs have had problems at different times with their mail servers. I want a backup mail server, with web mail, so that corporate communication is not completely disrupted when the main, commercial mail server is down. Another $300 for another computer and another book is a trivial, trivial expense compared to employees having trouble communicating. I'd issue everyone an emergency mail account and tell them to use it when there was trouble.
Total cost for hardware and books? Less than $1,000, and each computer is a backup for the others.
Once I've got three systems running OpenBSD, I would be in the market for more advanced books. If the three books I'd already bought had served me well, I would want a book from the same publisher.
That may be true, but perhaps the users of OpenBSD do need a book. I started with OpenBSD 2.6 after many years surviving under DOS/NT by installing POSIX shell utilities wherever possible. I knew TCP/IP networking extremely well and x86 hardware inside out. The excellent OpenBSD online documentation was a tremendous help, but it certainly left me hanging on many, many occasions. If you think OpenBSD doesn't need additional materials, it's because you're already an elite member of the OpenBSD cabal. I earned my OpenBSD stripes the hard way, but I'm not so proud of it that I think others need to strike their heals on as many rocks as I did. If every discipline takes that approach, what you end up with is highly fragmented community where no one can afford to have more than three skills and the vast majority of communication takes place between people who already share most of the same knowledge. The world doesn't have to be that way just because you find that acceptable with respect to your own narrow purposes.
For new users setting up an OpenBSD firewall/NAT for their home network, the book needs to stress the importance of configuring the resolvers correctly. I experienced several extremely frustrating days because I didn't understand that portions of the resolver were client side. I mistakenly presumed (for a while) that bind on my firewall was acting on the localhost resolve.conf settings on behalf of the DNS clients. It took me a long time to shake off this small misconception because resolve.conf was being clobbered by
Another thing that bugged me was "Don't log in as root". I completely understood this was a good idea. However, there is a substantial skill set required to work efficiently learning how to configure and admin a Unix box using root only as necessary. New users don't have the magical knowledge the previous poster seems to assume about what operations require root and what operations don't. An 80% confidence level doesn't get you very far. If it takes ten steps to configure something and a new user has an 80% confidence at each step, when it doesn't work the first time (and it is not likely to if you have undertaken ten steps at 80% confidence) you're up the creek without a paddle in knowing where you went wrong.
OpenBSD is actually rather weak in explaining how to dig into the system for corroboration that individual steps have worked successfully. You can find that material easily if you already know what you are looking for. I've complained about this upstream from time to time and the answer seems to be "if you don't know where to look, it's not our problem to help you".
One thing that would have been extremely helpful at the outset was to know how to use netstat to determine which sockets a daemon was binding on and ps to determine what security context that daemon was running under.
Another area where I made many mistakes was not knowing under what conditions a daemon needed a HUP in the ass. I be busy reconfiguring something and forget to HUP a critical process and then I would come to wild and incorrect conclusions about why my syntax was broken when in fact it had been correct already on many occassions. The OpenBSD man pages are not always blunt enough: if you change this file, you must HUP this process.
The area where I would find the most value is advanced security and networking. I've only played a bit with Kerberos, IPv6, and IPsec. I don't know the exact list of things to examine to determine whether a daemon process is chroot exactly the right way to minimize security risks.
OpenBSD is complex enough that you can't learn all the best practices right from day one. I put a lot of effort into mastering the firewire rulesets and OpenSSH. I didn't put the same effort into the Unix security model until a year later. I made some good guesses about what I could defer and some bad guesses. A book to help me make better guesses would have been valuable.
At this point I've installed a dozen OpenBSD systems and most of this stuff comes automatically. I've reached the point where I don't really an OpenBSD book any more. And since I don't need this book, I'm sure no one else does either. A semblence of documenation is adequate for all comers, certainly. My struggles and setbacks were just payment for lack of
intelligence and motivation. The logic of the previous post seems to be along the lines that handing someone a book to teach them to read is either useless or redundant. I don't agree.
A real-world issue for any systems admin: how to get maximum performance out of a system in various application scenarios: web server, database server (please don't focus on MySQL any more than other products), ftp server, packet-filtering router, etc... Discussion should be made of kernel guts related to performance issues - things that can be tweaked and what sorts of results one should expect from such "tweaking". CPU, Filesystem, Memory, Network, etc... should all be addressed.
Here are my recommendations: 1. Since OpenBSD excels at security, why not a section how to install Snort w/Acid. 2. Thorough PF/ALTQ documentation and examples, since PF is OpenBSD specific with specific examples using OpenBSD for bridging, load balancing. 3. A walk-through for maintaining an up to date system with CVS, and how to apply patches. (more details than the FAQ). 4. VPN - step by step with a troubleshooting section. 5. Third party security tools - Stephanie for OpenBSD for example. Anything that can be used to harden, log or supplement to the existing security. 6. How to compile and install from source software that was made for other platforms (FreeBSD, Linux) 7. The usual - quicknotes on replacing sendmail with Postfix, Bind with Maradns or djbdns, how to deal with Apache chrooted, PPPoE... 8. Optimization tricks.
I agree, though it doesn't necessarily need to cover the differences, just maybe tout a few of the traits of the BSD's and OpenBSD specifically. One easy example is the secuity issue. I also think some history from at least 4.4BSD should be covered, since "The Design and Implementation of the 4.4BSD Operating System" is an excellent book and covers the earlier history. Definitely should point out that the OpenBSD camp leans heavily towards security and stability in general.
The book should also cover topics on the basics, configuring services to be run at init, but should avoid trying to be a "Complete Reference", since no book ever really is. Just some basic administrative tasks, things that any sysadmin would do on a regular basis (configuring, building, and testing a new kernel), and the things none of us ever really want to have to do (Recovery of bad slices). Hardware configuration should also be covered, as that is certainly one of the more difficult things for the Win95 and up generation. (What, you mean I actually have to know what I have inside that shiny metal box thingy?) Leave the specifics of major services (DNS, Web, *mail, etc...) up to the books written for them, just overview the services, and give sysadmins a good reference.
That reminds me... If anyone has ever read the Coherent (circa 1994) manuals, those were excellent, and I wish there were something like that now. Complete command references, system architecture overviews, good stuff that is useful to admins and newbies.
This is not a sig. (No really, it's not)
--That's the point of being root, you can do anything you want, even if it's stupid.
Things I would like to see covered in some depth:
- Complete coverage of IPSec VPNs w/ OpenBSD (as well as some client-side examples, perhaps FreeS/WAN, OpenBSD dislup clients, etc)
- Good coverage of PF/ALTQ with lots of examples
- Good security coverage explaining that just because it's OpenBSD doesn't mean it's invulnerable. Take the time to explain some good
practices for securely CONFIGURING services, etc. I'd also like to see some coverage of Stephanie and the newly-added ProPolice.
- More performance tuning information. I've found precious little of this that's OpenBSD specific.
- Good intro to BSD-style kernel configuration and compilation for newbies/linux users.
- Introduction to the OpenBSD ports collection for newbies/linux users. Also, some coverage of packages so that people know they don't have to
compile EVERYTHING.
- An OpenBSD guide to configuring XFree86 and installing some of the "more familliar" desktop environments (KDE, GNOME, etc).
-d
How about "The Design and Implementation of the OpenBSD Operating System" by Theo?