Slashdot Mirror
Absolute OpenBSD
OpenBSD is not your average open source operating system, and consequently it does not have an average user community supporting it on the Internet. Absolute OpenBSD (AOB) by Michael W. Lucas, bills itself as "the definitive guide to OpenBSD." In addition to detailing the operating system (OS), Lucas does a wonderful job of illustrating and preparing new users for the different community surrounding OpenBSD.
A book like AOB is going to introduce many new users to OpenBSD, and it would be a disservice both to the existing community and the newcomers to not explain OpenBSD's culture. Thus, the first two chapters discuss the OpenBSD philosophy and also show the user how to become self-supporting when it is time to solve problems rather than flooding the mailing lists with easily answerable questions.
Critics may feel OpenBSD's rugged individualism is an indictment of its usability, but then they may be better served by a different OS.
The next few chapters focus on the installation of OpenBSD. AOB covers both dedicated and multi-boot installations. Most serious users will likely choose the dedicated installation, however Lucas points out that may not be an option for someone looking to sample OpenBSD, or for those users who wish to share a common data partition. Both types are covered, allowing the reader to decide which is most appropriate. Important installation caveats are also mentioned, such as OpenBSD's requirement that its root partition must be completely contained within the first 8 gigabytes of the hard drive. Although OpenBSD supports several different hardware platforms, when specifics are required Lucas focuses on the i386 platform. Lucas does a good job explaining the concepts, so users of non-Intel hardware should have minimal difficulty installing on their particular hardware.
Following the installation discussion, Chapter 6 covers OpenBSD's booting process and its /etc/rc scripts. Lucas' explanations go beyond simply itemizing these different aspects, choosing instead to provide the reader with the reasons a certain option may be needed. Expert users will already know when they wish to boot in single-user mode, but others will appreciate the discussion on how to boot alternate kernels, run fsck, and boot from alternate hard disks.
OpenBSD is promoted as a secure OS, and AOB is diligent in covering this aspect. File flags and securelevels are introduced and discussed. Lucas does a good job explaining what they do and what acceptable scenarios would be for their application. OpenBSD's systrace utility is explained in detail. Writing systrace policies, generating them using the policy-generation tool, and obtaining predefined policies from the Internet is described in depth.
OpenBSD administrative information receives attention as well. Chapters 11 and 12 cover configuring and building custom kernels. The treatment in Chapter 13 of compiling ports and installing packages is very helpful-- and in fact necessary for those looking to install essential utilities such as fortune.
OpenBSD's ports system was originally adapted from that in FreeBSD, and users of that OS may see some similarities. Users from a different background will appreciate the primer.
Three chapters of AOB are devoted to OpenBSD's in-kernel packet filter, pf. This is arguably one of OpenBSD's best features, and Lucas suitably spends a lot of time discussing it. Chapter 17 covers basic pf usage, such as explaining pf's configuration file, tables, and macros. In addition, Lucas takes a timeout to also explain pf's suitability for particular tasks. Chapter 18 describes advanced applications of pf, including network address translation, load balancing, and bandwidth management. Chapter 19 concludes with managing live pf execution. Correctly managing a live firewall on-the-fly is important for sites requiring high uptime, and Lucas does well in explaining the various methods available for logging, viewing statistics, and rule management. Wrapping up, AOB also describes how to configure authenticated pf access by authorized users. "pf" has a lot of power, and spreading the material over 3 chapters worked well in presenting the reader with information at a manageable rate.
One of the strengths of an OS-specific book such as AOB is that the material covered benefits from a more focused approach. If it doesn't apply to OpenBSD, it doesn't need to be covered. Lucas has an experienced background in system administration, and this experience shines through well in the material. His remarks about the dangers of a system with open access via RPC seem especially prophetic in light of current events -- and not mindless ranting.
Overall, AOB is a well-written book that hits its market squarely on target. Those new to OpenBSD will appreciate the comprehensive approach that takes them from concept to functional execution. Existing and advanced users will benefit from the discussion of OpenBSD-specific topics such as the security features and pf administration. Lucas does well in his attempt to increase the number of those who would be practical paranoids.Marius's turn: Reviewer Marius Aamodt Eriksen also liked some aspects of Absolute OpenBSD, but found more faults in it; his critique may help you decide whether this book is for you (and he disagrees about the match between the book and its audience). He writes:
The book covers a very broad area, but it lacks depth in some parts. Perhaps my biggest problem with Absolute OpenBSD is that it should have focused more the features that make OpenBSD unique: its security features. For example, it does not cover IPsec. Many of the various security features of OpenBSD are mentioned, but few are covered in much detail.
Michael Lucas' writing style is quite relaxed and informal. However, this often gets in the way of content. The numerous rants about how Windows security sucks simply get irritating. It is distracting from the focus of the book and simply unneccessary. Also, the tangents on TCP/IP and various other underlying technologies likewise deviate from the focus of the book. Lucas also does not hesitate to express personal opinions and views on a range of subjects. Though I typically have no problems with authors expressing their views, Lucas' tend to be unfounded and not well argued; they too are simply distracting. At times, it almost felt like Lucas was trying to put down less experienced people, teaching them lessons they "should know." I cannot imagine that this is what the typical audience of the book are looking for.
Absolute OpenBSD makes little effort to cover the various architectures that are supported by OpenBSD. The install section only covers i386; though probably not an issue for most users, it would be nice to have a more complete reference.
Otherwise, I would consider the contents of the book to be quite complete, and most definitely sufficient to provide a good introduction to OpenBSD and many of its neat features. An entire chapter is devoted to how to find more help, covering the various documentation, man pages and mailing lists. This is an excellent idea, and makes up for most of the (content) shortcomings of the book.
The PF (Packet Filter) section was very good; it covered a very broad set of features that PF provides, while carrying sufficient technical detail. The examples were very illustrative and appropriate for the text.
I spotted a few technical errors while reading the book. The editing also seems a bit rushed: in addition to the technical errors, there a number of typos. Unfortunately, there isn't an errata section on the book's website; I strongly recommend Lucas and his publisher make one available.
My biggest problem with Absolute OpenBSD is that it is not true to its audience. I imagine that the audience is one which would like to know how to do something in OpenBSD without being told how "real system administrators" do it, or how much Microsoft sucks. My recommendation to Lucas would be to write Absolute System Administration and leave it out of Absolute OpenBSD. I do not mean to sound harsh, merely critical. The book has very many good sides, and by many counts is an excellent reference for people looking to migrate to OpenBSD. I would not have any problems recommending it to anyone who wanted to migrate to OpenBSD or see what it's about -- just be wary of the distractions.
You can purchase Absolute OpenBSD from bn.com. Slashdot welcomes readers' book reviews -- to see your own review here, read the book review guidelines, then visit the submission page.
$12 cheaper at Amazon!!! That's 30%!!!
I find it interesting that /. always has links to Barnes & Noble - why not Amazon or Bookpool?
Not a troll - just curious.
But I met both of them, and they seemed perfectly nice.
Do you travel to foriegn lands and tell them to speak your language? No, you learn their's. You obviously learned how to use Linux language, so learn BSD's language.
I'm not drunk, I just have a speech impediment. And a stomach virus. And an inner ear infection.
Online documentation is usually of little help if you are setting up a new system from scratch. Also useless if you are trying to figure out how to connect to the 'net. And since you've written half the book already, why not just finish it?
:)
Also, sometimes it's just easier to use off-line references (books, mags, etc) I'm sure just about every bit of information in my collection of OO and C++ books is available in some form online, but does that mean I should get rid off them? Of course not.
Oh, and in case IHBT, oh well
Here is a good guide to setting up a nat / firewall with openBSD. The page says openBSD 2.9, but I did it with 3.3 easily. Just put what they say to put in /etc/nat.conf into your /etc/pf.conf file. The default install doesn't include emacs, so you'll have to suffer through vi.
Jeff: Critics may feel OpenBSD's rugged individualism is an indictment of its usability, but then they may be better served by a different OS.
Marius: At times, it almost felt like Lucas was trying to put down less experienced people, teaching them lessons they "should know." I cannot imagine that this is what the typical audience of the book are looking for.
... And yet this is the friendly face of OpenBSD towards its newbies. These line says it all about the OpenBSD culture, which is arguably the most hostile towards newbies of any of the major open source OSes. Requesting better usability means that you're an idiot who should use RedHat or one of those other "toy OSes." If you have a question that doesn't involve a honest need for a code change (for purposes other than usability), then you're a time-wasting moron who should've read more first. They don't just suffer no fools; they suffer nothing less than other true, dyed-in-the-wool experts on the system. I'll grant the system it's amazing technical merits, but the worst thing about OpenBSD is its vocal users.
This is *the* book to get if you know a little about *NIX/*BSD and want to flesh out what you know. Maybe if I was some expert guru, I'd find the book's informalness and coverage over basics to be a distraction, but no book of this ilk is ever everything for everybody. I'd call this a sort of "middle knowledge" book: not for raw newbies, not for hardcore experts, but for a lot of people in between.
Part of the problem I have had with OpenBSD is a lot of people in the OpenBSD community are strict RTFMA about any help, and the book even mentions that OpenBSD people ARE a bit aloof, and even WHY this is (a good explanation, IMHO, without making OpenBSD people look like eltist snobs). I think if people are told, "Look, this is an OS *by* hard-core programmers who don't have time to answer 'WTF is pf scroood up R wat? LOL!!' or 'set up my sendmail for me, or I'll have a tantrum,' but want more intelligent questions about in-depth subjects," they'd be more understanding, and maybe start with FreeBSD, and work their way towards OpenBSD. Or do like I did, and found some more newbie-friendly OpenBSD people to share accomplishments with.
OpenBSD is a great complement to the *BSD family, and this book can really teach you a lot about how it works, the philosophy behind it, and why things are the way they are.
________________________________________________
www.punkalrus.com - OpenBSD user for over two years
Q: Why can't it be more like Linux?
A: Because OpenBSD doesn't suck.
That's like asking why doesn't everybody drive the same car?
The BSD license is more attractive to some, while others prefer the GPL. Each OS has strengths, and people use them for many different reasons.
OpenBSD security
NetBSD portability
RedHat Corporate acceptance
Mandrake User Friendly
Debian Strong ties to FSF
Gentoo Customization
Some people don't agree with those characterizations. People don't agree on many things. That's why there are choices.
As for whether it's worth having all these? It's survival of the fittest. If enough people don't like an support an OS/Distro, it will die.
-thoolihan
http://unmoldable.com W:"No one of consequence" I:"I must know" W:"Get used to disappointment"
Maybe I'm biting at a troll, but I'll do it anyway...
There are a few basic areas where OpenBSD is "unique" to my knowledge. It is certainly unique among the BSDs in these respects. The first is proactive security. They audit all code going into the OS and all code that was legacied (is that a word?) into the OS. I can't count the number of times I've heard something like "This problem was fixed in OpenBSD 6 months ago in a routine audit" as the page linked above states. Hell, people in the OpenBSD community were actually complaining about the routine security fixes not being released as actual security patches with alerts. The fact of the matter was that they had no idea if the old code could lead to an exploit or not; it was flawed so they fixed it. This leads into a second part of this aspect, which is full disclosure. Anytime there is any kind of exploit or potential exploit, you hear about it along wiith a bugfix immediately. None of this waiting 3 months for it to be recognized by the vendor and then another two for the patch to be publicly available.
The second part is integrated cryptography. This doesn't mean just including IPsec. This means using 128-bit AES on the *swap* partitions to prevent them from being used against the system administrator in cases where the regular filesystem is also encrypted. I have never seen encrypted *swap* in an OS before. The design is ingenious; I've been looking at it very closely with an eye for porting it to another OS, and it's way cool.
The third aspect, and perhaps the most important in my mind, is the ridiculously detailed and useful man pages. They are the best I've seen in any Unix, period. The FAQ on the website will answer almost any question you can think of for getting started. And if the man pages don't answer your question, you are probably looking in the wrong place or asking the wrong question. Well, that's what it's been any time I couldn't find stuff there.
Oh and then there's the "Only one remote hole in the default install, in more than 7 years!" thing. Anyone can screw up a system, but OpenBSD sets you up for success where with the others it is truly a challenge to get the system as secure.
"He's more machine now than man, twisted and evil."
The following two sentances basically say it all:
The OpenBSD i386 boot loaders (biosboot(8) and boot(8)) also have their own internal 8G limitation, from an older BIOS limit.
For this reason, the entire /bsd file (the kernel) must be located on the disk within the boot ROM addressable area, or within the first 8G of the disk,
Its just a "stupid" limitation that noone has seen a need to fix or work around in this case. But the results of violating this limit can be disasterous, as once the
Another good reason for partitioning your disks is so that a runaway process writing tonnes of log entries into