Slashdot Mirror
OpenBSD review at linux.com
nicedream writes "Linux.com is running a feature on BSD, and the latest installment profiles one guy's experience with OpenBSD. Haven't read a thorough review of OpenBSD ever, so it was nice to check this out.
← Back to Stories (view on slashdot.org)
$ dpkg -S /usr/bin/dselect /usr/bin/dselect
dpkg:
$ dpkg -s dpkg
Package: dpkg
Essential: yes
Status: install ok installed
Priority: required
Section: base
Installed-Size: 1017
Maintainer: Ian Jackson and others = 2.1), libncurses4 (>= 4.2-3.1), libstdc 2.10
Description: Package maintenance system for Debian
[etc]
-Yarn - Rio Karma: Excellent
This has the advantage that it's quick and easy to do upgrades, or install new packages, with no nasty side-effects if there are name-clashes, and a guarantee that if there -are- multiple versions, you know exactly where they are.
It also has the disadvantage that it becomes VERY difficult to see what's installed, after a while. The filenames get horribly long, and the directory becomes impossibly cluttered. It also makes it more complex to do audits of what's changed, as you can't just go into the /usr/bin directory and look. You have to go through a multitude of directories to get that information.
IMHO, there is no "perfect" scheme. Everything is a trade-off. The more you split the binaries up, the easier maintenance becomes (especially automatic maintenance), and the easier it is to list what packages you have, even if you don't have a package manager.
OTOH, splitting everything into /, /usr, /usr/X11 and /usr/local keeps the heirarchy uncluttered at the expense of the directories themselves. It's harder to see which program comes from which version of which package, but you -can- be sure where the master copy of a given file is.
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
According to the X11-toolkits page in the FreeBSD ports collection, the current version in the collection is 1.2.6. and, according to the GTK web site and the GTK mirror FTP site I tried, at least, the current version is 1.2.6. (The main site was being too slow; maybe 1.2.7 just came out, but....)
FreeBSD works pretty well for me as a workstation OS; it appeared to be less of a pain to get my plug-and-play ISA sound card to work on it than it would be on Debian 2.1 (the 2.0[.x] kernel patch didn't work out of the box, and I didn't particularly want to spend a lot of time doing kernel debugging; I guess I could've tried the isapnptools stuff, but, at that point, I already had a free OS that handled the sound card, so...).
Your mileage may vary - others may find some particular Linux distribution (or some particular non-free OS, or even some particular non-UNIX-flavored OS) better as a workstation OS, or, for that matter, as a server OS, for their purpose than one of the BSDs, and others might find one of the BSDs better, and so on.
Linux suffers from security-related flaws, but IMHO the most serious ones relate to misconfigurations implemented by the CKI (Chair to Keyboard Interface)..
(And why not use and promote multiple OSes? Two mottos come to mind here.. 'The right tool for the job', and of course, 'There's More Than One Way To Do It!'
Your Working Boy,
Reading this guys experience of installing OpenBSD reminded me of the first time I installed NetBSD. The bewildering lack of documentation, and the archaic partitioning scheme that comes up as the default. Once installed though, I felt the same as this guy in that it was a bare bones Unix, with no cruft.
My only criticism of NetBSD (and I assume this applies to OpenBSD as well), is that the kernel co nfiguration is horrible. *BSD snobs always poke fun at the user friendly kernel configuration tools that come with the Linux source, but this is really unjustified. I never got round to compiling my own NetBSD kernel because of the paucity of documentation and the crap configuration file.
I did recompile my FreeBSD kernel on numerous occcasions, but always had that ``did I do it properly'' feeling that I've never encountered with Linux.
So all in all this OpenBSD review is accurate and fair.
Chris Wareham
What more do you want from a couple of hundred words written by someone installing OpenBSD for the first time. Remember that this article is published on a Linux-centric site, and that most people use Linux as a desktop OS. As the author correctly points out, OpenBSD's raison d'etre is as a potentially secure server OS. Note that I say it is *potentially* secure - it's still up to the end user to configure it correctly. OpenBSD simply gives you an audited set of software that gives you a fighting chance of setting up an almost uncrackable server.
So don't knock this review without noting its context. I feel that he highlights the real differences between Linux and the free BSD flavours - the latters constency, economy of features and steeper learning curve.
Chris Wareham
``The Cheapbytes CD comes with a very clear, step by step guide ...''
;-)
Not much help if you're a total cheapskate and just downloaded NetBSD like I did
Chris Wareham
You are of course completely correct in that flaws are bad both in servers and workstations. Things that are flaws on one role are pretty much always flaws on the other. The point you overlook however is that in different roles different flaws have different importances.
For example, lack of applications could be considered a flaw, as could crashing. Lets say (I don't nececcarly agree, but conventional wisdom which we are analysing has it that) Linux crashes more but has more apps and BSD has less apps but crashes less. In a workstation role, apps are critical. The benfit of more apps outweights the benefits of stability. It is not that crashing is any more "acceptable" in a single-user role, it is just that there are more important concerns. It doesnt matter how little it crashes if it doesnt do what you want!
So, we see that the "Conventional Wisdom" as you put does not say it is OK to crash a little in single-user roles, but just that there are higher priorities.
Of course, then you come to the base assumption of said wisdom which runs along the lines of: Linux has more apps, more drivers, nicer interfaces, and faster paced development but at the cost of stability and 'correctness.'
In my personal experice this is true. I use a Linux workstation every day but when I had to nuke my server (after several years of faithful Linux service) I decided to try FreeBSD. It took me a while to install it, the installation was harder (a priority I consider low on a server, higher on a workstation). But once I finished, I found much the same thing as the reviewer: everything fit together perfectly. make buildworld is an amazing thing to watch. Everything has a place and the documentation is superb. I was very pleased.
Conversely, when it came time to nuke my workstation I didn't even think of BSD. Why? Because its a shitty home-build mutt that has been upgraded over a period of 3 years. FreeBSD did not have all the drivers I needed. In addition, getting apps on FreeBSD is harder. You don't usually need gtk+ on a server, but I sure as hell ain't living without it on my desktop! (I know, gtk is in the ports tree, but it is never up to date).
In summary: you are right. Given infinite development time, there need not be a difference between server OS's and workstation OS's. But, given that there are different priorities in different roles, and given that there are limited developer-hours, having different OS's focus on different roles makes perfect sense.
--Nick
You could get the package manager to keep track of the associated source, docs, etc for each binary. For example:
% rpm --tell-me-aboutGNU grep 9.99, compiled by me@somewhere on 1998-05-14 (it could give more details, eg compiler flags, what the configure script detected)
Source is in grep-9.99.srpm (or in
Manual page is grep(1)
Docs are in
etc...
-- Ed Avis ed@membled.com
I decided some time back that it would be fun to experiment with OpenBSD. I was drawn primarily by it's crypto software. I was installing it on a machine that I tend to use more as a server than anything else. So desktop friendliness was not a major issue.
So first came the install. I ordered my $2- Cheapbytes CD, which came with an installation walk-through. This walk through made it pretty easy. I had a hiccup with my large disk drive ( due to bad bios configuration ) but a post to comp.unix.bsd.openbsd.misc fixed that pretty quickly. The partitioning procedure using the cryptic disklabel tool would have been hell without the walkthrough. However, i just did ( more or less ) what the walk through said, and it went OK.
Which raises another point -- I was surprised to find that the help on Usenet for OpenBSD is on par with usenet linux support. Far from being a bunch of obnoxious RTFM'ers, the OpenBSD crowd are by and large very helpful. I felt honoured that Theo De Raadt himself responded to one of my posts. Regarding support, the "OpenBSD FAQ" is also excellent. It is really more like a users manual than an FAQ. I highly recommend that anyone planning on installing openBSD get a copy of this prior to installation.
Once I had finished the install, I had my openBSD system up and running. I discovered a few things:
First, I was somewhat surprised that the inetd services don't go via TCP wrappers by default. I had to edit inetd.conf to make them do this. I was awfully confused for a little while regarding the fact that my hosts.deny settings ( ALL:ALL ) were not honoured. So I fixed inetd.
What is nice about the default setup is that software such as sudo, skey and kerberos is installed by default. They will be shipping ssh with it in the near future ( 2.6 ), see http://www.openbsd.org/crypto.html#ssh. Until recently, they've had obstructions to shipping this, such as patents. They are actively hacking ssh to remove these obstacles. Crypto is "integrated" into the system. For example, crypt() has built in blowfish encryption ( which is used to encrypt passwords ) See http://www.openbsd.org/crypto.html for more info.
The system also uses shadow passwords out of the box. The ports collection makes it easy to install any other secure software you might want, such as cops, ssh, rsaref, among other things. Just CD to the right directory and type "make install" and openBSD automatically installs the package, *and* looks after any dependencies -- so "make install" always works, even if you don't have some of the required packages to begin with. The ports collection is lean in terms of desktop applications, but contains a good collection of server apps.
However, it's not ideal as a desktop system. The file system is slow ( though very stable ), and the ports collection is somewhat limited compared to FreeBSD and NetBSD. It also trails FreeBSD in hardware support.
Overall, I'd highly recommend it for a user familiar with linux ( in particular, someone not scared of command lines ) who wants to set up a secure server on low end hardware.
Go to your preferences page and turn off der blinkenlighten.
"Cause there's 40 different shades of black, so many fortresses and ways to attack, so why you complainin'?"
I don't think it's quite fair to criticize the "depth" of the review. The author outright says that he's a newbie to BSD and that this is the story of his experience with it.
He tells a tale of the difficulties he had as a fairly Linux savvy person using OpenBSD for the first time, and he speaks as deeply of the benefits of the running system as his experience justifies.
I wouldn't trust hime if he went into more depth. A few days of poking does not an expert make.
BTW, I've been using Linux since 1993 (I first tried the TAMU distribution, anyone else out there use TAMU?) and just this summer installed my first *BSD system, I put FreeBSD on an old 486 on my network. I had a good experience with that. It's up and stable and I use to serve copies of my "Webmaster in a Nutshell Deluxe" and "Java in a Nutshell Deluxe" CD-ROMs to the rest of my network via NFS. It works beautifully, and I haven't had to touch the box for nearly six months now. What else do you want from a server?
So, this guys's story made me keen to try out OpenBSD and see what that could do for me.
I think that's what the article was about, rather than a comprehensive review.
Oh yeah, another commenter said (disparagingly, I think) that people who read that site are all RedHat users. I read this article and I'm a Debian user.
As for file system speed, that's another peculiar complaint. BSD's filesystem is much faster for what I do than Linux's. Test it out by creating equivalent large trees, and running something recursive, like du or ls -R. I have directories with zillions of files in them. BSD is about an order of magnitude faster for this than Linux.
And why do you say that for a desktop machine, the filesystem speed is important? Is this different from what you want in a non-desktop machine? Why?
As for networking, it seems more sensible on BSD. I find that the many Linux versions all have their own little sillinesses that you have to sniff out. They also seem need an extra route that I don't need to remember to do in BSD.
In fact, there's absolutely nothing I want to do that I can do in Linux that I can't do in BSD. Sure, there are kernel threads in Linux, but it's not like they're as robust as on Sun or SGI.
As for games, I find that BSD comes with a lot more than Linux does, which is basically nothing at all. It's nice to be able to just type rogue and it run right out of the box.
The ports stuff is much saner than anything I've ever seen for Linux. I don't understand why people expect absolutely everything pre-installed, or why they always want binaries. It's very scary. There's something very comforting about having a 100% source system, and one where you just type make. You want to know how to make rm stop asking stupid questions? Just cd /usr/src/bin/rm/ and look at rm.c sitting right there. Don't like something? Edit the file, and just type make.
And then there's the fact that /sys is there again, and things are where you expect them to be.
And then there's the fact that all binaries and libraries come with man pages, something that all the Linux operating system bundlers have completely screwed up.
I guess what I'm saying is that BSD is much saner and coherent -- and familiar -- if you're a long-time Unix user than Linux is. Then again, I've been using BSD since 81 or 82, so it's not surprising it makes more sense to me than then Winix stuff you see in Linux.
I'm serious, and I'm not trying to be obtuse. I'm a Unix programmer, not a starry-eyed neophyte in search of eye-candy. I have mailers, newsreaders, web browsers, web servers, editors, admin tools, a complete development environment, etc.
The only bloatware I've got installed on the openbsd systems is netscape. It's also the only non-source program here. I've tried mozilla, but it crashes all the time. I also offer users amaya and lynx.
As far as bloatware goes, I also installed enlightenment and gimp, mostly as a test to see whether I could. And yes, there was no problem. I've a friend who's an Apple user, so put gimp up for them. And enlightenment was semi-interesting, but I've gone back to tvtwm, which suffices for my purposes. I don't know whether these are what you call "desktop applications" or not.
As for /usr/ports, I get this
Although I admit I haven't done an mcs get lately. My only FreeBSD account doesn't haveIt seems to me that it's more important for a machine that has many users to be fast (what kids these days call a "server") than it is for a machine that serves the needs a lone user (what kids seem to call "clients" or "workstations" or "desktops") to be fast. After all, slowness in a shared resource hurts everyone who's sharing it.
As for file system speed, what do you mean? Are you saying that FreeBSD isn't using FFS, or that OpenBSD isn't? If they're both using the regular FFS, why is there a difference? Have you benchmarked this? Are there published numbers? My only experience is comparing OpenBSD and Redhat for ftw stuff, and the former came out way ahead on a hugely bushy file system.
Second, there's simple correctness and completeness. A virgin Redhat installation is so full of crap in the manpages that you want to pop somebody one. They've got catpages installed alongside the manpages (e.g. /usr/man/man1/mailq.1) They've got missing .so links -- try getting a manpage for getnetbyaddr(3); it doesn't work, and if you look, you'll realize why. They've got hundreds of broken SEE ALSO links, as well as thousands (well, around 1700) of missing manpages. They've got a few dozen or so that are simply wrong, all thanks to the Fearless Leaders from you-know-where. It's really completely incoherent.
If you go to bugzilla, look up bug numbers 6043, 6044, 6046, 6049, 6255, and 6315. Redhat has been very responsive to these bug reports. I've even given them a bunch of programs to help with this, but the current situation is pretty darned embarrassing to anyone used to a proper Unix release. (Anyone interested in noman(8), cfman(8), or scatman(8) can pull them from bugzilla or send me mail.)
Like the author of this review, OpenBSD was also my first. I had a Boeing-surplus Sun station I was running on a shoestring budget for an college organization I was in, and when the hard drive blew up before I could procure a back-up device and I didn't have any installation media (I know, I know... playing with fire), I found myself in the un-enviable position of having to find a replacement OS to put on the replacement hard drive. And yet, I was on a shoestring (and spit and chewing gum) budget... so I did some checking around. Wanting to try the OS before dedicating my precious collegiate hours to the installation process, I found that OpenBSD would run on both Sun and Intel platforms, and that there was really good Sun binary compatibility. Actually, I was tossing coins between NetBSD and OpenBSD, but the security audit was a good selling feature.
So I proceeded to install OpenBSD on my 4 year old 486 from floppy images. (I didn't have the funds to buy the CD, either, but I did have some old AOL promo disks.) After a day and some of fiddling, I had the system up and running, although I had many of the same troubles as the author of the review, but without the prior Linux experience to draw upon. I installed X11 and a few other necessary programs, and ba-da-bing, it ran fine.
About a year later, after I was no longer in charge of that organization's computer woes, I transitioned to FreeBSD, since it had better focus on the Intel platform and in particular supported the odd arrangement I was resorting to to drive my CDROM. Still, for a first foray into the wild, wild world of installing and running UNIX from scratch, OpenBSD was pretty good!
quick example. About 6-9 months ago, there were maybe 40-60 people in #FreeBSD on efnet at a time. This number has grown to 170-240 on average. This is similar to the growth in the #linux channels except at a lower order of magnitude. I think we'd have more people in there if the ops didn't get pissed off when someone asked something particularly stupid :). The linux channels on the other hand seem to be more oriented towards setup help (there are some cool people in #FreeBSD ready to help though !).
----------
I've never installed X on OpenBSD -- but to do this on FreeBSD, you:
/stand/sysinstall and go to post install operations -> install additional distributions -> whatever you want on the x menu
a) check to make sure your video card is supported by xfree first
b) run
c)once that's done, go to post install -> configure xfree86 server from which it run XF86Setup (or the command line util if wanted).
d) once you have that running, then post install -> Setup XFree86 Desktop and install your window manager of choice (gnome + enlightenment or afterstrep [doesnt work very good in bsd], windowmaker, fvwm2, or KDE (i'd recommend kde + blackbox or windowmaker or just plain KDE).
All linux XFree setup's I have tried have been similarly intuitive..
----------
OpenBSD has a huge advantage in security, being
from Canada, and not the US of A, it can ship
with heavy encryption enabled, with out
being harrassed.
Someone overseas should take note of the business
model, and make a linux distribution based on
the same ideas.
Right on! That was one of the hardest things I encountered when getting used to Linux. Binaries in /bin, /sbin, /usr/local/bin, etc. In thinking of a better way to set up an OS (yeah, like I'm gonna invent an OS) I figured most binaries will need:
- Source (of course) for available hacking/patching
- Docs/manpages
- configuration files/scripts
- the binary itself
- other stuff
There's two ways to organize this, either every binary has it's own location (in one distinct repository) under which all of the above is included, or the above categories are divided into several locations, such asHaving said that, I wouldn't want Linux to pick up it's development model. Actually, Debian is almost there. The BSD groups are incredibly picky when it comes to what get's put into their OS. The kernel development is a much slower, and much more mature process. If Linux worked that way, we wouldn't see 2.4 until 2005.
A line-by-line audit of Linux's code wouldn't be bad idea, but the state of that code changes so frequently that I don't think it could be done properly without affecting the development process.
-----------
"You can't shake the Devil's hand and say you're only kidding."
Precisely what features are desirable in a "server"? What features are desirable in a "workstation"? What even is the difference between a "server" and a "workstation"? Does optimizing for one of these environments pessimize-- or at least compromise--the other situation? Is there some technical feature that you really want to have in a multi-user situation that you don't care about in a single-user one? What about the other way around?
Here's my conjecture: there is no difference here. You want the same in both, because a soi-disant single-user Unix workstation is still a complete multi-user environment with all the attendant issues thereof.
A system's inadequacies appear more acceptable in a single-user system only because they can thereby annoy only one person at a time. In a multi-user situation, such problems are less tolerable because the pain is multiplied by the number of individuals affected. But inadequacies they remain.
Just as you want a solid, sane, robust system for a computer that provides services for an entire department, so too do you wish the same coherence and correctness on my very own computer that you are the principle user of. For example, you don't expect to reboot a server just because you install some new software, and neither do you expect to do the same on my own machine. Granted, Unix isn't stupid here, the way the Evil Empire is. But by allowing sloppiness in a "single-user" environment that would never be tolerated in a "multi-user" one, we risk relegating ourselves to a plane of Hell not so far removed from the one currently inhabited by gibbering victims of the Horror Out of Redmond.