Slashdot Mirror
Absolute OpenBSD
OpenBSD is not your average open source operating system, and consequently it does not have an average user community supporting it on the Internet. Absolute OpenBSD (AOB) by Michael W. Lucas, bills itself as "the definitive guide to OpenBSD." In addition to detailing the operating system (OS), Lucas does a wonderful job of illustrating and preparing new users for the different community surrounding OpenBSD.
A book like AOB is going to introduce many new users to OpenBSD, and it would be a disservice both to the existing community and the newcomers to not explain OpenBSD's culture. Thus, the first two chapters discuss the OpenBSD philosophy and also show the user how to become self-supporting when it is time to solve problems rather than flooding the mailing lists with easily answerable questions.
Critics may feel OpenBSD's rugged individualism is an indictment of its usability, but then they may be better served by a different OS.
The next few chapters focus on the installation of OpenBSD. AOB covers both dedicated and multi-boot installations. Most serious users will likely choose the dedicated installation, however Lucas points out that may not be an option for someone looking to sample OpenBSD, or for those users who wish to share a common data partition. Both types are covered, allowing the reader to decide which is most appropriate. Important installation caveats are also mentioned, such as OpenBSD's requirement that its root partition must be completely contained within the first 8 gigabytes of the hard drive. Although OpenBSD supports several different hardware platforms, when specifics are required Lucas focuses on the i386 platform. Lucas does a good job explaining the concepts, so users of non-Intel hardware should have minimal difficulty installing on their particular hardware.
Following the installation discussion, Chapter 6 covers OpenBSD's booting process and its /etc/rc scripts. Lucas' explanations go beyond simply itemizing these different aspects, choosing instead to provide the reader with the reasons a certain option may be needed. Expert users will already know when they wish to boot in single-user mode, but others will appreciate the discussion on how to boot alternate kernels, run fsck, and boot from alternate hard disks.
OpenBSD is promoted as a secure OS, and AOB is diligent in covering this aspect. File flags and securelevels are introduced and discussed. Lucas does a good job explaining what they do and what acceptable scenarios would be for their application. OpenBSD's systrace utility is explained in detail. Writing systrace policies, generating them using the policy-generation tool, and obtaining predefined policies from the Internet is described in depth.
OpenBSD administrative information receives attention as well. Chapters 11 and 12 cover configuring and building custom kernels. The treatment in Chapter 13 of compiling ports and installing packages is very helpful-- and in fact necessary for those looking to install essential utilities such as fortune.
OpenBSD's ports system was originally adapted from that in FreeBSD, and users of that OS may see some similarities. Users from a different background will appreciate the primer.
Three chapters of AOB are devoted to OpenBSD's in-kernel packet filter, pf. This is arguably one of OpenBSD's best features, and Lucas suitably spends a lot of time discussing it. Chapter 17 covers basic pf usage, such as explaining pf's configuration file, tables, and macros. In addition, Lucas takes a timeout to also explain pf's suitability for particular tasks. Chapter 18 describes advanced applications of pf, including network address translation, load balancing, and bandwidth management. Chapter 19 concludes with managing live pf execution. Correctly managing a live firewall on-the-fly is important for sites requiring high uptime, and Lucas does well in explaining the various methods available for logging, viewing statistics, and rule management. Wrapping up, AOB also describes how to configure authenticated pf access by authorized users. "pf" has a lot of power, and spreading the material over 3 chapters worked well in presenting the reader with information at a manageable rate.
One of the strengths of an OS-specific book such as AOB is that the material covered benefits from a more focused approach. If it doesn't apply to OpenBSD, it doesn't need to be covered. Lucas has an experienced background in system administration, and this experience shines through well in the material. His remarks about the dangers of a system with open access via RPC seem especially prophetic in light of current events -- and not mindless ranting.
Overall, AOB is a well-written book that hits its market squarely on target. Those new to OpenBSD will appreciate the comprehensive approach that takes them from concept to functional execution. Existing and advanced users will benefit from the discussion of OpenBSD-specific topics such as the security features and pf administration. Lucas does well in his attempt to increase the number of those who would be practical paranoids.Marius's turn: Reviewer Marius Aamodt Eriksen also liked some aspects of Absolute OpenBSD, but found more faults in it; his critique may help you decide whether this book is for you (and he disagrees about the match between the book and its audience). He writes:
The book covers a very broad area, but it lacks depth in some parts. Perhaps my biggest problem with Absolute OpenBSD is that it should have focused more the features that make OpenBSD unique: its security features. For example, it does not cover IPsec. Many of the various security features of OpenBSD are mentioned, but few are covered in much detail.
Michael Lucas' writing style is quite relaxed and informal. However, this often gets in the way of content. The numerous rants about how Windows security sucks simply get irritating. It is distracting from the focus of the book and simply unneccessary. Also, the tangents on TCP/IP and various other underlying technologies likewise deviate from the focus of the book. Lucas also does not hesitate to express personal opinions and views on a range of subjects. Though I typically have no problems with authors expressing their views, Lucas' tend to be unfounded and not well argued; they too are simply distracting. At times, it almost felt like Lucas was trying to put down less experienced people, teaching them lessons they "should know." I cannot imagine that this is what the typical audience of the book are looking for.
Absolute OpenBSD makes little effort to cover the various architectures that are supported by OpenBSD. The install section only covers i386; though probably not an issue for most users, it would be nice to have a more complete reference.
Otherwise, I would consider the contents of the book to be quite complete, and most definitely sufficient to provide a good introduction to OpenBSD and many of its neat features. An entire chapter is devoted to how to find more help, covering the various documentation, man pages and mailing lists. This is an excellent idea, and makes up for most of the (content) shortcomings of the book.
The PF (Packet Filter) section was very good; it covered a very broad set of features that PF provides, while carrying sufficient technical detail. The examples were very illustrative and appropriate for the text.
I spotted a few technical errors while reading the book. The editing also seems a bit rushed: in addition to the technical errors, there a number of typos. Unfortunately, there isn't an errata section on the book's website; I strongly recommend Lucas and his publisher make one available.
My biggest problem with Absolute OpenBSD is that it is not true to its audience. I imagine that the audience is one which would like to know how to do something in OpenBSD without being told how "real system administrators" do it, or how much Microsoft sucks. My recommendation to Lucas would be to write Absolute System Administration and leave it out of Absolute OpenBSD. I do not mean to sound harsh, merely critical. The book has very many good sides, and by many counts is an excellent reference for people looking to migrate to OpenBSD. I would not have any problems recommending it to anyone who wanted to migrate to OpenBSD or see what it's about -- just be wary of the distractions.
You can purchase Absolute OpenBSD from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
I find it interesting that /. always has links to Barnes & Noble - why not Amazon or Bookpool?
Not a troll - just curious.
Do you travel to foriegn lands and tell them to speak your language? No, you learn their's. You obviously learned how to use Linux language, so learn BSD's language.
I'm not drunk, I just have a speech impediment. And a stomach virus. And an inner ear infection.
I'd get laughed at if I complained about the lack of Smitty for Linux.
On second thoughts, I'd get laughed at for wanting smitty on any OS.
Jeff: Critics may feel OpenBSD's rugged individualism is an indictment of its usability, but then they may be better served by a different OS.
Marius: At times, it almost felt like Lucas was trying to put down less experienced people, teaching them lessons they "should know." I cannot imagine that this is what the typical audience of the book are looking for.
... And yet this is the friendly face of OpenBSD towards its newbies. These line says it all about the OpenBSD culture, which is arguably the most hostile towards newbies of any of the major open source OSes. Requesting better usability means that you're an idiot who should use RedHat or one of those other "toy OSes." If you have a question that doesn't involve a honest need for a code change (for purposes other than usability), then you're a time-wasting moron who should've read more first. They don't just suffer no fools; they suffer nothing less than other true, dyed-in-the-wool experts on the system. I'll grant the system it's amazing technical merits, but the worst thing about OpenBSD is its vocal users.
This is *the* book to get if you know a little about *NIX/*BSD and want to flesh out what you know. Maybe if I was some expert guru, I'd find the book's informalness and coverage over basics to be a distraction, but no book of this ilk is ever everything for everybody. I'd call this a sort of "middle knowledge" book: not for raw newbies, not for hardcore experts, but for a lot of people in between.
Part of the problem I have had with OpenBSD is a lot of people in the OpenBSD community are strict RTFMA about any help, and the book even mentions that OpenBSD people ARE a bit aloof, and even WHY this is (a good explanation, IMHO, without making OpenBSD people look like eltist snobs). I think if people are told, "Look, this is an OS *by* hard-core programmers who don't have time to answer 'WTF is pf scroood up R wat? LOL!!' or 'set up my sendmail for me, or I'll have a tantrum,' but want more intelligent questions about in-depth subjects," they'd be more understanding, and maybe start with FreeBSD, and work their way towards OpenBSD. Or do like I did, and found some more newbie-friendly OpenBSD people to share accomplishments with.
OpenBSD is a great complement to the *BSD family, and this book can really teach you a lot about how it works, the philosophy behind it, and why things are the way they are.
________________________________________________
www.punkalrus.com - OpenBSD user for over two years
It says in the review: ...such as OpenBSD's requirement that its root partition must be completely contained within the first 8 gigabytes of the hard drive.
I've just set up OpenBSD 3.3 on a not-very-critical server, and, not knowing about this limitation, I've just created one big root partition of about 58GB. It's ran fine for the past four days though. Am I likely to run into problems, or has something been changed since the book was published?
I know that there are good reasons for splitting your filesystem across multiple partitions, but is there a particular reason why I need to keep that root partition under 8GB in OpenBSD?
You might want to read my journal if you're interested in why people use OSS OSes. I use FreeBSD becuase it is a very robust, free, secure server operating system and I've come to know it very well. I choose it over Linux distributions because I like the BSD kernel much better, the filesystem layout, and myriad other reasons. There are many choices of software in Linux, BSD and other OSS OSes. I simply find that FreeBSD fits my needs more aptly than other choices. Your choice of operating system obviously has lots to do with your needs. Why do you use the OS you use?
www.sitetronics.com/wordpress
Although I don't have any moral objections to any arrangements made between Slashdot and one particular online retailer, I feel that any website that purports to be in the business of disseminating "news" ought to be obligated to voluntarily divulge any links to for-profit enterprises that appear appended to articles and reviews.
While an arrangement between Slashdot and Barnes & Nobel might not necessarily alter the objectivity of an article/review, it introduces some interesting questions. For instance, does Slashdot receive compensation for links to Barnes & Nobel merchandise appearing in published reviews? Would Slashdot turn down a reader submitted book review if a book was sold by Amazon -- but not stocked or sold by Barnes & Noble?
Again, there isn't anything inherently wrong (in my mind) with Slashdot consistently linking to one retailer's products. However, if Slashdot readers consistently ask about the nature of any alleged relation between the Slashdot news site and another company, then perhaps Slashdot editors should make an effort to disclose any relevant details.
Insects and Grafitti Photos
This reminds me very much of the things I did before my first Linux installation in '96. I bought the book, "Red Hat Linux Unleashed", which just happened to have a RH 3.0.3 distro on one CD in a little envelope inside the cover. Skipping very few details, I read all 1100ish pages before even trying. I ran into enough troubles that I didn't regret the investment in time. As someone who hadn't taken any open systems courses in college, this was the way to go. It seems that a "paranoid operating system" would have all the same incentives in place for quite a few folks that were the situation was for me as a 100% Un*x newbie with DOS skills. YMMV of course.
Maybe I'm biting at a troll, but I'll do it anyway...
There are a few basic areas where OpenBSD is "unique" to my knowledge. It is certainly unique among the BSDs in these respects. The first is proactive security. They audit all code going into the OS and all code that was legacied (is that a word?) into the OS. I can't count the number of times I've heard something like "This problem was fixed in OpenBSD 6 months ago in a routine audit" as the page linked above states. Hell, people in the OpenBSD community were actually complaining about the routine security fixes not being released as actual security patches with alerts. The fact of the matter was that they had no idea if the old code could lead to an exploit or not; it was flawed so they fixed it. This leads into a second part of this aspect, which is full disclosure. Anytime there is any kind of exploit or potential exploit, you hear about it along wiith a bugfix immediately. None of this waiting 3 months for it to be recognized by the vendor and then another two for the patch to be publicly available.
The second part is integrated cryptography. This doesn't mean just including IPsec. This means using 128-bit AES on the *swap* partitions to prevent them from being used against the system administrator in cases where the regular filesystem is also encrypted. I have never seen encrypted *swap* in an OS before. The design is ingenious; I've been looking at it very closely with an eye for porting it to another OS, and it's way cool.
The third aspect, and perhaps the most important in my mind, is the ridiculously detailed and useful man pages. They are the best I've seen in any Unix, period. The FAQ on the website will answer almost any question you can think of for getting started. And if the man pages don't answer your question, you are probably looking in the wrong place or asking the wrong question. Well, that's what it's been any time I couldn't find stuff there.
Oh and then there's the "Only one remote hole in the default install, in more than 7 years!" thing. Anyone can screw up a system, but OpenBSD sets you up for success where with the others it is truly a challenge to get the system as secure.
"He's more machine now than man, twisted and evil."
Like how to mount a native floppy. Stuff so basic it never occurred to anybody to put in an obvious form.
I usually put my questions in the form: "I know this is basic, and here's what steps I've taken to find the answer....any clues to share?"
I may have just lucked out or caught people at propitious times in their meds routine.
My big project at the moment is setting up some sparc boxes with the newest rev. with some lovely anti stack-smashing, not avail on x86.
Yes, but the linux version uses loopback crypto, which is a lot slower and doesn't use volatile (I think that's the term) keys. It's basically done by making the swap partition on a loopback encrypted drive.
The OpenBSD version is done at the pager level, with each key being used only as long as it is needed. This has much less overhead (which is necessary for something that is done thousands of times per minute), and is inherently more secure.
"He's more machine now than man, twisted and evil."