51–60 of 83 posts
Is there a router/firewall distro or administration tool for OpenBSD that's recommendable (e.g. like pfsense without all the enterprisey bloat, or like securityrouter without the licensing stuff)?
A (highly subjective) selection of things that seemed interesting, sorted from most to least noteworthy in my opinion -- - A lot of code has been removed or simplified to make the transition to multi-processor easier. - printf(3) family of formatting functions now report to syslog when the %s format is used with a NULL pointer. - When sending TCP streams they are locally stored in large mbuf clusters to improve memor…
Also: - The iwm(4) driver now supports 802.11n MIMO (MCS 0-15). - Enforcement of userland W^X on OCTEON Plus and later. Is the EdgeRouter Lite an Octeon "Plus"? - LLVM/Clang 4.0.0 (+ patches) Looks like they shipped LLVM 4 into an actual stable release before FreeBSD! (because it's the first LLVM for them) - New tpm(4) driver for Trusted Platform Module devices. But that one was in FreeBSD since 2010 :P
Looks like:
ben@edge:~$ cat /proc/cpuinfo
system type : UBNT_E100
processor : 0
cpu model : Cavium Octeon+ V0.1Maybe this isn't the best place to ask this, but how does OpenBSD handle "real world" security these days? Last time I checked, OpenBSD was heavily audited, with emphasis on shipping a secure base system. The problem, to me, is that every running system in the world has many packages installed to make it useful as an e.g. server. What use is a secure base system if installable packages aren't audited to the same degr…
So, you could run an HTTPS site, with a Perl fastCGI site, sending emails, all out of Base
Plus you get privsep'd X (xenocara)
Sadly I don't often get to play with OpenBSD, but every time I do I'm impressed by how coherent an operation system it is. You really get the feeling that the developers care about delivering a system with a unified expression, where everything is meant to be used together. It's not just kernel bundled with a bunch of tools/programs which sort of seem to work together, but not in the same manor. Even FreeBSD have som…
Do any VPS providers offer an OpenBSD image?
It's the first release without an official CD set [1], and OpenBSD was probably one of the last operating systems to provide official installation discs. I wonder if they'll start recommending third-party sellers of installation CDs and DVDs like Debian does [2]. [1] https://www.openbsd.org/orders.html [2] https://www.debian.org/CD/vendors/
Weren't these mostly just a nice way to contribute to the project and get something tangible in return, or did they not sell the disks at a profit?
Earlier quoted context omitted.
You may already be familiar with but just in case: https://wiki.debian.org/UnattendedUpgrades You can specify the types of updates to auto install (ie I use security updates only automatically).
I keep running into a weird issue where my Debian servers won't shut down ("A start job is running for Unattended Upgrades") when I enable unattended upgrades as described at [1]. It is especially weird since my Debian systems are otherwise pretty bare-bones, yet the issue occurs on several of them. The solutions listed on Stack Exchange [2] seem rather hacky. [1] https://wiki.debian.org/UnattendedUpgrades#automatic_…
I'm not sure this has been reported before / correctly:
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=837155 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=719597
Maybe give the maintainers a prod with a link to that thread?
Maybe this isn't the best place to ask this, but how does OpenBSD handle "real world" security these days? Last time I checked, OpenBSD was heavily audited, with emphasis on shipping a secure base system. The problem, to me, is that every running system in the world has many packages installed to make it useful as an e.g. server. What use is a secure base system if installable packages aren't audited to the same degr…
There is a lot of functionality in Base that some aren't aware of: ldapd, httpd, IPSec + iked (VPN), pf (firewall, NAT), dhcpd, ntpd, smtpd, snmpd, radiusd, relayd (load balancer), tftpd, sshd, nfs, nsd and unbound (DNS) So, you could run an HTTPS site, with a Perl fastCGI site, sending emails, all out of Base Plus you get privsep'd X (xenocara)
Sadly I don't often get to play with OpenBSD, but every time I do I'm impressed by how coherent an operation system it is. You really get the feeling that the developers care about delivering a system with a unified expression, where everything is meant to be used together. It's not just kernel bundled with a bunch of tools/programs which sort of seem to work together, but not in the same manor. Even FreeBSD have som…
Heh, as a FreeBSD user primarily, OpenBSD sometimes feels kinda empty to me. No ZFS, no DTrace, no jails, no mandatory access control, no CloudABI, no Linux compat layer…
Both are valid, and result in very different operating systems. These days most of my work can be fit into the OpenBSD envelope, which makes me feel especially good.
Sadly I don't often get to play with OpenBSD, but every time I do I'm impressed by how coherent an operation system it is. You really get the feeling that the developers care about delivering a system with a unified expression, where everything is meant to be used together. It's not just kernel bundled with a bunch of tools/programs which sort of seem to work together, but not in the same manor. Even FreeBSD have som…
Heh, as a FreeBSD user primarily, OpenBSD sometimes feels kinda empty to me. No ZFS, no DTrace, no jails, no mandatory access control, no CloudABI, no Linux compat layer…
ZFS is large and complicated. http://www.tedunangst.com/flak/post/ZFS-on-OpenBSD
DTrace would be nice to have, but I believe there are CDDL license concerns.
Jails are a way of isolating services so that they cannot do (much) damage to the system in the event they are compromised. The closest alternative in OpenBSD is probably pledge(2), which allows a program to voluntarily renounce the ability to invoke a set of syscalls. There is also chroot if all you need is filesystem virtualization.
MAC can be complicated to implement. This comment explained things very well: https://news.ycombinator.com/item?id=8893749
> OpenBSD doesn't support a MAC framework because they believe the best approach to security is correctness, rather than trying to achieve security by adding features which results in more complexity, making it more difficult to ensure correctness. A common mistake people make is thinking that OpenBSD's primary goal is security; their primary goal is correctness. This just happens to result in better security more often than not.
Linux compat is a similar story. OpenBSD dropped it in the 6.0 release due to complexity and security concerns.
I don't know a whole lot about CloudABI.