Absolute OpenBSD

DrCarbonite (Jeff Martin) writes "I've used OpenBSD in the past, and benefitted from its extensive online documentation. Sometimes an off-line reference is useful (i.e. required), and Absolute OpenBSD fills this void." Read on for the rest of Martin's review, as well as a more critical one from Marius Aamodt Eriksen. Absolute OpenBSD: UNIX for the Practical Paranoid author Michael W. Lucas pages 489 publisher No Starch Press rating 8 reviewer Jeff Martin, Marius Aamodt Eriksen ISBN 1886411999 summary Well-written guide to administering OpenBSD for the intermediate to advanced user.

OpenBSD is not your average open source operating system, and consequently it does not have an average user community supporting it on the Internet. Absolute OpenBSD (AOB) by Michael W. Lucas, bills itself as "the definitive guide to OpenBSD." In addition to detailing the operating system (OS), Lucas does a wonderful job of illustrating and preparing new users for the different community surrounding OpenBSD.

A book like AOB is going to introduce many new users to OpenBSD, and it would be a disservice both to the existing community and the newcomers to not explain OpenBSD's culture. Thus, the first two chapters discuss the OpenBSD philosophy and also show the user how to become self-supporting when it is time to solve problems rather than flooding the mailing lists with easily answerable questions.

Critics may feel OpenBSD's rugged individualism is an indictment of its usability, but then they may be better served by a different OS.

The next few chapters focus on the installation of OpenBSD. AOB covers both dedicated and multi-boot installations. Most serious users will likely choose the dedicated installation, however Lucas points out that may not be an option for someone looking to sample OpenBSD, or for those users who wish to share a common data partition. Both types are covered, allowing the reader to decide which is most appropriate. Important installation caveats are also mentioned, such as OpenBSD's requirement that its root partition must be completely contained within the first 8 gigabytes of the hard drive. Although OpenBSD supports several different hardware platforms, when specifics are required Lucas focuses on the i386 platform. Lucas does a good job explaining the concepts, so users of non-Intel hardware should have minimal difficulty installing on their particular hardware.

Following the installation discussion, Chapter 6 covers OpenBSD's booting process and its /etc/rc scripts. Lucas' explanations go beyond simply itemizing these different aspects, choosing instead to provide the reader with the reasons a certain option may be needed. Expert users will already know when they wish to boot in single-user mode, but others will appreciate the discussion on how to boot alternate kernels, run fsck, and boot from alternate hard disks.

OpenBSD is promoted as a secure OS, and AOB is diligent in covering this aspect. File flags and securelevels are introduced and discussed. Lucas does a good job explaining what they do and what acceptable scenarios would be for their application. OpenBSD's systrace utility is explained in detail. Writing systrace policies, generating them using the policy-generation tool, and obtaining predefined policies from the Internet is described in depth.

OpenBSD administrative information receives attention as well. Chapters 11 and 12 cover configuring and building custom kernels. The treatment in Chapter 13 of compiling ports and installing packages is very helpful-- and in fact necessary for those looking to install essential utilities such as fortune.

OpenBSD's ports system was originally adapted from that in FreeBSD, and users of that OS may see some similarities. Users from a different background will appreciate the primer.

Three chapters of AOB are devoted to OpenBSD's in-kernel packet filter, pf. This is arguably one of OpenBSD's best features, and Lucas suitably spends a lot of time discussing it. Chapter 17 covers basic pf usage, such as explaining pf's configuration file, tables, and macros. In addition, Lucas takes a timeout to also explain pf's suitability for particular tasks. Chapter 18 describes advanced applications of pf, including network address translation, load balancing, and bandwidth management. Chapter 19 concludes with managing live pf execution. Correctly managing a live firewall on-the-fly is important for sites requiring high uptime, and Lucas does well in explaining the various methods available for logging, viewing statistics, and rule management. Wrapping up, AOB also describes how to configure authenticated pf access by authorized users. "pf" has a lot of power, and spreading the material over 3 chapters worked well in presenting the reader with information at a manageable rate.

One of the strengths of an OS-specific book such as AOB is that the material covered benefits from a more focused approach. If it doesn't apply to OpenBSD, it doesn't need to be covered. Lucas has an experienced background in system administration, and this experience shines through well in the material. His remarks about the dangers of a system with open access via RPC seem especially prophetic in light of current events -- and not mindless ranting.

Overall, AOB is a well-written book that hits its market squarely on target. Those new to OpenBSD will appreciate the comprehensive approach that takes them from concept to functional execution. Existing and advanced users will benefit from the discussion of OpenBSD-specific topics such as the security features and pf administration. Lucas does well in his attempt to increase the number of those who would be practical paranoids.

Marius's turn: Reviewer Marius Aamodt Eriksen also liked some aspects of Absolute OpenBSD, but found more faults in it; his critique may help you decide whether this book is for you (and he disagrees about the match between the book and its audience). He writes:

The book covers a very broad area, but it lacks depth in some parts. Perhaps my biggest problem with Absolute OpenBSD is that it should have focused more the features that make OpenBSD unique: its security features. For example, it does not cover IPsec. Many of the various security features of OpenBSD are mentioned, but few are covered in much detail.

Michael Lucas' writing style is quite relaxed and informal. However, this often gets in the way of content. The numerous rants about how Windows security sucks simply get irritating. It is distracting from the focus of the book and simply unneccessary. Also, the tangents on TCP/IP and various other underlying technologies likewise deviate from the focus of the book. Lucas also does not hesitate to express personal opinions and views on a range of subjects. Though I typically have no problems with authors expressing their views, Lucas' tend to be unfounded and not well argued; they too are simply distracting. At times, it almost felt like Lucas was trying to put down less experienced people, teaching them lessons they "should know." I cannot imagine that this is what the typical audience of the book are looking for.

Absolute OpenBSD makes little effort to cover the various architectures that are supported by OpenBSD. The install section only covers i386; though probably not an issue for most users, it would be nice to have a more complete reference.

Otherwise, I would consider the contents of the book to be quite complete, and most definitely sufficient to provide a good introduction to OpenBSD and many of its neat features. An entire chapter is devoted to how to find more help, covering the various documentation, man pages and mailing lists. This is an excellent idea, and makes up for most of the (content) shortcomings of the book.

The PF (Packet Filter) section was very good; it covered a very broad set of features that PF provides, while carrying sufficient technical detail. The examples were very illustrative and appropriate for the text.

I spotted a few technical errors while reading the book. The editing also seems a bit rushed: in addition to the technical errors, there a number of typos. Unfortunately, there isn't an errata section on the book's website; I strongly recommend Lucas and his publisher make one available.

My biggest problem with Absolute OpenBSD is that it is not true to its audience. I imagine that the audience is one which would like to know how to do something in OpenBSD without being told how "real system administrators" do it, or how much Microsoft sucks. My recommendation to Lucas would be to write Absolute System Administration and leave it out of Absolute OpenBSD. I do not mean to sound harsh, merely critical. The book has very many good sides, and by many counts is an excellent reference for people looking to migrate to OpenBSD. I would not have any problems recommending it to anyone who wanted to migrate to OpenBSD or see what it's about -- just be wary of the distractions.

You can purchase Absolute OpenBSD from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.

Comments

$12 CHEAPER at Amazon!!!

[Anonymous Coward]

$12 cheaper at Amazon!!! That's 30%!!!

Re:Why not Amazon, or others?

[mopslik]

why not Amazon or Bookpool?

Try here for some discussion.

Re:Why not Amazon, or others?

[milest]

some people don't like amazons patent policies. these guys for example

Re:Why can't it be more like Linux?

[Lord_Slepnir]

Here is a good guide to setting up a nat / firewall with openBSD. The page says openBSD 2.9, but I did it with 3.3 easily. Just put what they say to put in /etc/nat.conf into your /etc/pf.conf file. The default install doesn't include emacs, so you'll have to suffer through vi.

Re:Why can't it be more like Linux?

[Punk Walrus]

The default install doesn't include emacs

Easily fixed (on a net connection):

# pkg_add ftp://ftp.openbsd.org/pub/OpenBSD/3.3/packages/i38 6/emacs-21.2.tgz

... assuming you have version 3.3 on an i386, and you want to download off of a Canadian (ftp.openbsd.org's home) server rather than any of the other fine mirrors they offer. Otherwise, substitute the ftp.openbsd.org with the mirror, 3.3 with your version, and i386 with your chip.

Re:I wonder if it's usefull

[thoolihan]

That's like asking why doesn't everybody drive the same car?

The BSD license is more attractive to some, while others prefer the GPL. Each OS has strengths, and people use them for many different reasons.

OpenBSD security
NetBSD portability
RedHat Corporate acceptance
Mandrake User Friendly
Debian Strong ties to FSF
Gentoo Customization

Some people don't agree with those characterizations. People don't agree on many things. That's why there are choices.
As for whether it's worth having all these? It's survival of the fittest. If enough people don't like an support an OS/Distro, it will die.

-thoolihan

Re:I found this book to be valuable

[Homology]

Part of the problem I have had with OpenBSD is a lot of people in the OpenBSD community are strict RTFMA about any help,

If you follow the OpenBSD mailinglists you'll see that it's not quite the case. On the other hand, if you have not read the online FAQ they'll tell you so.

Note that the man-pages in OpenBSD is very good, which is not quite the case for several Linux distros.

As an example, try 'man starttls' on you favorite Linux distro, and compare it with man starttls. Now, which one gives you the best information about how to setup starttls on your mail-server, including how to generate certificates?

I use SuSE on my desktop, but still refer to the OpenBSD man-pages for Linux work.

Re:Why can't it be more like Linux?

[Homology]

The default install doesn't include emacs, so you'll have to suffer through vi.

Just use the 'mg' that is part of the default install. mg is like a stripped down emacs.

Re:I wonder if it's usefull

[worm eater]

to have something like BSD out there at all, what is it that draws people to it? Is it 1337ism or what? Why don't people all use Linux or all use BSD? IS it to spite the other open sourceers or to make sure Linux doesn't reach monopoly status in the open source world, would that be bad in open source?

Although I've never used BSD (Open or Free), I did notice this page on netcraft.com the other day. Basically, the 50 web hosts with the longest uptimes are currently ALL running some form of BSD. Netcraft has some interesting things to say about BSD and its place in the market. There is also the lisence issue, but I'm sure some other slashdotters would be more than willing to fill you in on that.

Re:The OpenBSD Attitude

[saskwach]

I've found that if I do a search of OpenBSD.org for my problem and don't find it quickly, I can ask someone where to look for how to do whatever it is I'm trying to do and they've always been very nice and helpful. The OpenBSD community is not nice to people who want personalized hand holding through the most basic of tasks, but then again, it's not my desktop environment of choice. Furthermore, the online documentation is as good as the OS is solid. This isn't zealotry, I'm too much of a newbie to OpenBSD for that, but asking Theo how to set up NAT kind of deserves a bit of a harsh rebuke. This OS is definitely the best for single cpu servers that I've found, and its community is only harsh because that encourages reading the (extensive, good) documentation.

It really is true that people who can't read a HOWTO shouldn't be setting up servers, and therefore shouldn't be using OpenBSD.

Why is BSD useful?

[emil]

Let me count the ways...

• Here is a list of the RedHat 9 errata. Here is the list of OpenBSD 3.3 errata. Notice a slight difference in the number of errata that have been issued between these distributions?

  I may be generalizing, but when you need hardware compatibility, go with Linux; when you require security, go with OpenBSD.

• If you run OpenBSD, you will immediately notice your Apache process:

  httpd: parent [chroot /var/www] (httpd)

  AFAIK, OpenBSD is the only UNIX(like) distribution with chroot Apache out of the box.

• OpenBSD comes with the spamd daemon/system, which pulls information from spews.org and links it into the local pf routing, pointing spammers at a resource-consuming tarpit at little cost to you.

• More importantly, this software is bound by the BSD license, which gives you much more freedom to do with the code as you will. Apple Mac OS X probably couldn't have been done with a GPL system (excepting gcc), for example. While the GPL is fantastic in that it will eventually destroy Microsoft, if you truly love software freedom, you will prefer BSD.

• All the BSDs continue the legacy of the CSRG at UCB. Each (major version of) BSD is worth preserving for historical purposes alone.

There are quite a few things that I don't like about OpenBSD, but I've learned to live with them.

Re:8GB Root Partition

[Richard_at_work]

For the answer to your question, if you read this OpenBSD faq entry, it details fairly well why you should not have a / larger than 8gb.

The following two sentances basically say it all:

The OpenBSD i386 boot loaders (biosboot(8) and boot(8)) also have their own internal 8G limitation, from an older BIOS limit.

For this reason, the entire /bsd file (the kernel) must be located on the disk within the boot ROM addressable area, or within the first 8G of the disk,

Its just a "stupid" limitation that noone has seen a need to fix or work around in this case. But the results of violating this limit can be disasterous, as once the /bsd kernel file gets written outside this 8gb area, say after you have jsut rebuilt it, then the boot sequence dies with a bad magic error.
Another good reason for partitioning your disks is so that a runaway process writing tonnes of log entries into /var/log/.log over night, while you are asleep and unaware of the issue, wont take down the system by filling up all your diskspace, jsut /var.