Slashdot Mirror
OpenBSD 3.6 Released!
dspisak writes "The people over at OpenBSD have released version 3.6 containing significant new features such as: SMP support for i386 and amd64 archs, the ability to optimize pf rulesets, better hotplug support, in addition to more robust encryption and vpn functionality. This is in addition to more recent hardware support, for a full list of changes take a look at the 3.6 changelog. Don't forget to use the mirrors!"
..it was released on 29th of October already, as you can read here. When download, please don't forget to use the torrent!
I wish there was someone in real life who knew what OpenBSD was so they could share my enthusiasm =(
There was an excellent paper at CCS last week on the limits of address space randomization. If you want address space randomization to be effective, use a 64 bit architecture and native 64 bit binaries for your OpenBSD system.
Test your net with Netalyzr
i noticed under new features:
tcpdrop(8), a command to drop TCP connections.
this looked like an awesome idea, and I'm wondering what the windows / linux equivalent is... anyone know?
-judging another only defines yourself
OpenBSD has a reputation for being the ideal platform for making into a router or firewall. That's true, but it's also a really nice general server OS for low power tasks. I run it at home as a file/web server, and it's really quite nice.
If you like Unix (as opposed to hating Microsoft), give it a shot.
--saint
Comment removed based on user account deletion
...you would have 2 servers up and running already. Got my CD's last week and have 1 new box up and one old 3.5 box upgraded. May thanks to Theo and the team for such great software.
If you have not tried OpenBSD please do. While I will not speak on the idea of OpenBSD on the desktop I will speak to how great it is as a firewall. If you have struggled with IPTABLES it is time to give a try to PF. Have a look. It should be easy to understand:
ext_if="xl0"
int_if="fxp0"
# clean up the packets
scrub in all
# nat the internal network to the external interface
nat on $ext_if from !($ext_if) -> ($ext_if:0)
# setup a table of RTBL IP's for spammers
table persist
#redirect any IP's in the the RTBL to spamd
rdr pass inet proto tcp from to any port smtp -> 127.0.0.1 port 8025
# ftp proxy
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
# redirect any internal user to squid
rdr on $int_if inet proto tcp from any to ! $int_if port 80 -> 127.0.0.1 port 3128
# pass extenal web request to the internal www server
rdr on $ext_if proto tcp from any to any port http -> 192.168.0.2
# pass extenal web request to the internal www server
rdr on $ext_if proto tcp from any to any port https -> 192.168.0.2
# drop everything
block in log
# allow out and keep track
pass out keep state
# allow anything to the loopback and internal interface
pass quick on { lo $int_if }
# no RFC 1918 spoofing (quick - do it now!)
antispoof quick for { lo $int_if }
# allow external ssh in
pass in log on $ext_if proto tcp to ($ext_if) port ssh keep state
# allow smtp in
pass in log on $ext_if proto tcp to ($ext_if) port smtp keep state
# allow the www forwarding
pass in log on $ext_if proto tcp to 192.168.0.2 port http keep state
# allow the www forwarding
pass in log on $ext_if proto tcp to 192.168.0.2 port https keep state
# allow outbound smtp
pass out log on $ext_if proto tcp from ($ext_if) to port smtp keep state
Very simple and clean. If you need a firewall give it a try!
There are more BSD's distros than the top3 (Free/Net/Open), you have PicoBSD, Firefly BSD, Debian GNU/BSD, Gentoo BSD, BSDi, BSD-OS and Darwin.
Seems like lots of choices for BSD users.
hotplugd is pretty damned neat on the user end. It allows you to define actions performed when a device is plugged in, such as a digital camera (ala cp /mnt/camera/* ~/pictures/$DATE/).
/ openbsd _3_6.html
It's also mentioned in a recently slashdotted interview with some OpenBSD devs here:
http://www.onlamp.com/pub/a/bsd/2004/10/28
I've got OpenBSD running as a little personal webserver, DNS server and so on. It's running OpenBSD3.1, because at least back then, it was absolutely impossible to update. Every up understanddate involves going through and manually mucking with endless configuration files, etc. I use Debian for most everything, and have grown so used to the ability to run an apt-get update; apt-get dist-upgrade.
The inability to easily update OpenBSD, to me, nullifies any benefit one gets from it being "secure". If I'm running a two year old version of Apache because it's such a pain in the butt to update, how iss that secure? I think automatic security updates are imperative for a secure system.
And, furthermore, the automatic updating system should be secure as well.
Top 10 reasons IPTABLES is better than PF:
/var/log.
10. Parsing IPTABLES config files excellent preparation for subsequent
learning of Asian pictograph-based languages.
9. Standard logging via syslogd helps eliminate clutter in
8. GPL prevents Steve Jobs from stealing your code.
7. Simplistic man pages encourage development of social skills via mailing
lists.
6. Multiple distributions, versions, kernels, modules, plugins, etc. keep
hackers confused as to exactly what they're attacking.
5. "Mangle" just sounds so much more 133+ than "Scrub".
4. Complexity of structure leads to more opportunities for obfuscation and
subsequent job security.
3. New and experimental kernel modules make life exciting again.
2. GUI and Web based utilities mean that anyone can set one up without knowing
what they're doing.
And the number one reason IPTABLES is better than PF:
1. No distracting arguments about whether to port it to OpenBSD.
Shamelessly stolen from the pf mailinglist.
Reality has a notoriously liberal bias -- Stephen Colbert
I want to recommend OpenBSD to anyone who wants to build a small server and it is a must for a firewall/NAT box.
/network. OpenBSD's lack of graphical configuration aids is a great help here.
I have never seen such a clear, concise, and easy to understand configuration file as that of pf.conf (IP filter).
The files for the boot-up configuration rc.conf and rc.local are also very clear and easy to understand.
Everything has very _good_ man pages and sample configuration files with lots of comments.
The faq on openbsd.org is quite good, too.
One aspect of security is simplicity, which implies easily understood configuration files.
Another aspect of security is that you learn about the fundamentals of your system
You simply _have_ to learn about your system to be able to operate it, but at the same time learning is made easy, by great documentation.
And if anybody is put off by OpenBSD's (in)famous penchant for straight/rude talking developers: Don't worry, I found people friendly and helpful. They are only put off, by questions that are very obvious and have been covered in the documentation extensively. But I am also the kind of person who loathes to ask for help in a D.I.Y. shop such as Home Depot, preferring to find things unaided so that I learn more and more about the products they offer, so that I will be more knowledgeable when doing my next project.
Marcus
I do not deploy Linux. Ever.
The developers admit it's pretty crude. It just uses the one big lock technique that most first time SMP projects seem to.
Don't forget SMP opens up new opportunities for security problems, and the OpenBSD devs will be treading very cautiously and conservatively with their implementation. For them security outweighs performance.
Don't expect it to compete with Linux 2.6 or FreeBSD 5 in terms of performance and scalability anytime soon (if ever).