Slashdot Mirror
OpenBSD Now Nine Years Old
NekkidBob writes "OpenBSD, my personal favorite *BSD, turns 9 years old today. And with only 1 remote hole in the default install, I'd say that is a pretty good acheivement. The first commit was at 16:36 MST on Saturday, October 14, 1995. Happy birthday OpenBSD!"
The BSD distributions were thought of as good kernel bases for the Debian userspace applications during 1999-2002. So Debian maintainers would rip out the Linux kernel infrastructure and replace it with a BSD variant.
A similar attempt has been ongoing with the HURD kernel for at least the last decade.
Packaging attempts were made with FreeBSD and OpenBSD.
I don't know the status of the Debian/FreeBSD port but the Debian/OpenBSD port was abandoned when Andreas Schuldei, the maintainer of the port, realised that the kernel had shitloads of race conditions and offered no real advantages on its own over properly configured Linux kernels (such as those from Debian itself).
He also believed that the Debian/Linux userspace was not any better or worse in any real sense over the OpenBSD userspace (the ports and packages systems on OpenBSD are not audited, for the most part).
========================================
Death will come, and will have your eyes
-- Pavese
I've always been a firm believer in running BSD systems. I still stand by my beliefs. BSD operating systems have always been fun from the software packging systems to the firewalls. PF has made its way to all the widely free BSD systems. I thank OpenBSD and all the developers for doing such a great job at design. I'll always love reading what others have to say on the mailing lists.
Let the Birthday party begin!
David Ross
dross logged on
freenode.net - Join the #openbsd channel
the song has been out. Download it here
/* oops I accidentally made a comment, sorry */
"He" does not understand that in context of licenses, they are very far appart. OpenBSD have replaced several GPL licensed utilities with a free alternative. They still use alot of GPL (LGPL) like the tool chain from the gcc project, but the spirit is there. Just witness the fork of Apache 1.3 and XFree86, as well as making their own packet filter. Their OpenNTP work just fine as well :-)
Have you ever installed and used it? Try it, you might like it.
/* oops I accidentally made a comment, sorry */
The point of OpenBSD is SANE defaults (i.e. not running telent, ftp, and rsh by default). Turning on Apache (bundled by default) is really simple, and because they've gone through and clobbered most buffer overflows and built everything with ProPolice, what were on other systems are root holes turn into non-events or program crashes (which can in theory be used to do a DoS, but that's a huge improvement).
The policy of the United States is worse than bad---it is insane. -- Ludwig von Mises, Economic Policy(1959)
Have you ever installed and used it? Try it, you might like it.
I have, and do. But I favor freebsd for my servers, and linux for personal use. But for my work I use Solaris (with clustering).
I just find the comment amusing, soon as you add in server applications, you decrease the security.
I think you're thinking Debian GNU/NetBSD:
http://www.debian.org/ports/netbsd/
this doesn't mean your final system won't have holes, but it means you're not already starting "in the hole"; it doesn't sound like much, and yet how many other systems out there can make this claim? OpenBSD isn't the end-all, be-all, it's just a good tool for your toolbox
But, what good is the default install?
Drop a fresh OpenBSD installation into a hostile environment such as the internet.
Drop a fresh WindowsXP installation into the same environment.
You won't ask that question again.
Don't you want it to be doing something?
No I want it to do as little as possible. It is ready to serve when I say it is and no sooner. This lets you patch first and not everyone has the luxury of installing a box in a secure network.
It's suffered the same Apache/SSL/FTP/PHP errors as everyone else.
More or less, yes, the same problems. Thats why these services are off by default, to let you patch them first, and enable only what you need.
I know if you search cert for openbsd you get lots of hits, so there are wholes in the applications.
No one has ever suggested otherwise.
A radio maverick jumps to internet only. The Future of Rock n Roll
FTP is not on by default, so it doesn't count.
Anyways, that kind of comments like the grandparent post come from time to time from people that can't see the importance of a secure by default OS installation.
How much does it take to hack into any Windows box just installed and connected to Internet? Make the numbers. How about a Red Hat Linux?
With the "Secure by default" and the "Only one remote exploit ..." slogans OpenBSD is not claiming it is the most secure OS, but that you can be reasonably sure that it won't be hacked just after you have finished downloading the patches.
It has had so good results that some vendors, including Microsoft and Red Hat, have adopted it.
Can we now push the dicussion level a bit higher?
The best way to predict the future is to invent it
Fortunately, that's where you are wrong.
It's quite common to search through bugtraq or another security list, and find it in the list as the only OS "unaffected". Now, that's not always the case, but it's surprisingly common.
OpenBSD is more secure than other OSes, not just out of the box, but with major services enabled too... When you install Apache on Linux/FreeBSD, you just get the plain vanilla version. With OpenBSD, you get a version that has been audited by the team, and lots of changes have been made.
Plus, about a year ago, Propolice, W^X, and other protection measures have be included by OpenBSD, which does negate most bugs, and does protect your OTHER services against software bugs.
BTW, most of my machine have only SSHD enabled (which is one of a few services enabled by default), so the default install can be very useful for a great many things. SSH handles log-in, file transfer, plus port forwarding. So any other services can run on 127.0.0.1, and only be accesses remotely (via SSH) if you have an account.
Of course, but baring that, OpenBSD is a very good choice.
Slashdot gets worse every day... Pipedot: News for nerds, without the corporate slant
That's a good thing. Someone else already mentioned where the 1 exploit comes from, so I won't go there. With all of the defaults enabled in other OS's, OpenBSD gives you a level place to start from. Everything installed by default is chrooted, that includes apache, BIND 9, FTP, etc... OpenBSD does install these by default jsut doesn't turn them on. When I first switched to Linux years ago, it took me months before I figured out that I didn't need saslauthd, postfix, apache, named, ws_ftp (later proftpd) and a few others that were installed and running by default. OpenBSD was a breath of fresh air. I still love to run 'ps ax' when I boot up OpenBSD after a fresh install.
/sbin/init /var/named/dev/log -a /var/empty/dev/log /usr/sbin/sshd /usr/bin/perl /usr/ports/sysutils/webmin/webmin-1.150 /usr/libexec/getty suncons console
Here's a ps ax from my primary DNS server (which is very busy).
# ps ax
PID TT STAT TIME COMMAND
1 ?? Is 0:01.11
5741 ?? Is 0:06.49 syslogd: [priv] (syslogd)
3517 ?? I 1:13.56 syslogd -a
24875 ?? Is 0:00.03 named: [priv] (named)
10792 ?? I 320:27.22 named
25379 ?? Is 0:00.25 inetd
12780 ?? Is 4:13.98
23171 ?? Is 11:22.04 sendmail: accepting connections (sendmail)
15125 ?? Is 0:06.28 ntpd: [priv] (ntpd)
9037 ?? I 9:36.04 ntpd: ntp engine (ntpd)
26494 ?? Is 5:11.57
10568 ?? Is 0:36.80 cron
8249 ?? Is 0:00.33 sshd: root@ttyp0 (sshd)
4537 a Is+ 0:00.05
32091 p0 Is 0:00.10 -sh (sh)
20044 p0 R+ 0:00.02 ps -ax
Here's a netstat -ss from that same machine
# netstat -ss
ip:
11272118 total packets received
12 with data size data length
6741 fragments received
6726 fragments dropped after timeout
7 packets reassembled ok
10332389 packets for this host
318009 packets for unknown/unsupported
###
Had to truncate because of some retarded junk filter.
/* oops I accidentally made a comment, sorry */
My comment was, and is, a basic install unix type OS box are almost always secure, and yes even redhat. apparently you've never typed "redhat worm" into google.
soon as you add in server applications, you decrease the security.
No shit?!
The point with OpenBSD, is that it has so many active security mechanisms, that a [insert network daemon] exploit might allow a remote root on your FreeBSD, Solaris and Linux machines, but only result in a DoS of that particular service on OpenBSD.
Already we are not only seeing open source OS' take leafs out of OpenBSD's book, but also Microsoft and Sun.
The multitude of active and passive security measures in OpenBSD is very impressive.
Plus the point is, that an OS should be locked down from the initial install and then built on from there as the admin requires, not as the OS maintainers think you will require.
Presumptuous people who build operating systems, do not make secure operating systems.
War crimes, torture, lies, illegal spying... Would someone give Bush a blowjob, already, so he can be impeached?
Given how little (that is, nothing) is turned on in the default install, one remote root hole is pretty damned bad. Remember that that's a remote root hole with *no* services running... Now, if they had only one remote root hole including sshd, a webserver, a mailserver and so on, that'd be something to brag about.
You speak with such authority, for someone who obviously knows nothing about the subject.
OpenSSH has been ON by default at some stage after or including OpenBSD 2.6 and only recently has the option to disable it within the install script, become an option for users. That's about 5.5 years out of that 8.
The foundation of your rant is completely non-existent.
Nowdays, even if you do enable popular daemons, your typical worst case is likely to be a DoS instead of a remote root, thanks to OpenBSD.
I take, "Only one remote hole in the default install, in more than 8 years!", as a fact that is representative of the mindset of the developers behind the project, not as an absolute gauge of overall project security. Anyone who does or thinks that is what it is supposed to represent, is stupid.
Take that statement for what it is. Reading more into it is your problem.
War crimes, torture, lies, illegal spying... Would someone give Bush a blowjob, already, so he can be impeached?
It depends what you're doing, doesn't it?
its the applications which by default have the applications, thus the exploits.
Not sure what you mean by "the applications which by default have the applications", but if you meant "the applications which by default have the holes" (or "wholes" as you call them), no they don't. Stop spewing nonsense and spend 5 minutes at openbsd.org and read about the auditing work that goes into many of the specific versions of the applications included in the OS - Apache on OBSD is NOT the same as Apache on RedHat by default, etc.
A uber secure box sitting there doing nothing, is still, doing nothing.
Okay, you've no idea what's included in the "default install" of OpenBSD, we believe you already, no more evidence required.