Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

OpenBSD 6.1 released

marc.info

Post reply on HN
Print view View original

31–40 of 83 posts

Re: OpenBSD 6.1 released

#31

Post by currysausage »

adamrt wrote: post #26
parfe wrote: post #19

Earlier quoted context omitted.

http://man.openbsd.org/syspatch.8 Thanks for highlighting this. For me, OpenBSD releases needed so few fixes that keeping the system up to date wrapped around, and become more of a hassle to deal with! I'd get an email and have to manually rebuild something. Watching yet another flood of compiler output started feeling like a huge waste of time, despite only happening once every month or two. For personal use, on deb…

You may already be familiar with but just in case: https://wiki.debian.org/UnattendedUpgrades You can specify the types of updates to auto install (ie I use security updates only automatically).

I keep running into a weird issue where my Debian servers won't shut down ("A start job is running for Unattended Upgrades") when I enable unattended upgrades as described at [1]. It is especially weird since my Debian systems are otherwise pretty bare-bones, yet the issue occurs on several of them. The solutions listed on Stack Exchange [2] seem rather hacky.

[1] https://wiki.debian.org/UnattendedUpgrades#automatic_call_vi...

[2] http://unix.stackexchange.com/questions/293804/debian-a-star...

Re: OpenBSD 6.1 released

#34

Post by notaplumber »

throwawayish wrote: post #33

Is there a router/firewall distro or administration tool for OpenBSD that's recommendable (e.g. like pfsense without all the enterprisey bloat, or like securityrouter without the licensing stuff)?

Not a distro, but if you're intimidated by the prospect of editing configuration files using vi(1), you might like Chris Cappuccio's nsh project.

http://www.nmedia.net/nsh/

Re: OpenBSD 6.1 released

#35

Post by whitepoplar »

Maybe this isn't the best place to ask this, but how does OpenBSD handle "real world" security these days? Last time I checked, OpenBSD was heavily audited, with emphasis on shipping a secure base system. The problem, to me, is that every running system in the world has many packages installed to make it useful as an e.g. server. What use is a secure base system if installable packages aren't audited to the same degree? Debian handles this by putting all packages (apart from universe) under the maintenance of the Debian Security Team. I would love to use OpenBSD, but want to make sure that the extra effort isn't spent with no real security advantage.

Re: OpenBSD 6.1 released

#36

Post by Gracana »

throwawayish wrote: post #33

Is there a router/firewall distro or administration tool for OpenBSD that's recommendable (e.g. like pfsense without all the enterprisey bloat, or like securityrouter without the licensing stuff)?

TrueOS is making rapid improvements to their sysadm tool (client/server system for managing TrueOS machines), iirc (from a recent BSD Now episode) there's work going into improving the firewall management interface. This isn't really a recommendation to switch to TrueOS, but it is a recommendation to keep an eye on their progress.

[edit] D'oh, for some reason I read "like pfsense" but missed "for openbsd."

Re: OpenBSD 6.1 released

#38

Post by antod »

whitepoplar wrote: post #35

Maybe this isn't the best place to ask this, but how does OpenBSD handle "real world" security these days? Last time I checked, OpenBSD was heavily audited, with emphasis on shipping a secure base system. The problem, to me, is that every running system in the world has many packages installed to make it useful as an e.g. server. What use is a secure base system if installable packages aren't audited to the same degr…

Universe is an Ubuntu thing. Debian doesn't have that distinction. On Ubuntu, universe is basically packages straight from Debian not directly supported by Ubuntu.

Re: OpenBSD 6.1 released

#39

Post by darkengine »

whitepoplar wrote: post #35

Maybe this isn't the best place to ask this, but how does OpenBSD handle "real world" security these days? Last time I checked, OpenBSD was heavily audited, with emphasis on shipping a secure base system. The problem, to me, is that every running system in the world has many packages installed to make it useful as an e.g. server. What use is a secure base system if installable packages aren't audited to the same degr…

Most (all?) ports than run servers get an unprivileged user all to their own (_dovecot, _nginx, etc). Many (including desktop packages like Chromium) also have pledge() support patched in.

Re: OpenBSD 6.1 released

#40

Post by whitepoplar »

antod wrote: post #38
whitepoplar wrote: post #35

Maybe this isn't the best place to ask this, but how does OpenBSD handle "real world" security these days? Last time I checked, OpenBSD was heavily audited, with emphasis on shipping a secure base system. The problem, to me, is that every running system in the world has many packages installed to make it useful as an e.g. server. What use is a secure base system if installable packages aren't audited to the same degr…

Universe is an Ubuntu thing. Debian doesn't have that distinction. On Ubuntu, universe is basically packages straight from Debian not directly supported by Ubuntu.

Gotcha. My bad. Too much time spent with Ubuntu lately!
Post reply on HN