Stories
Slash Boxes
Comments
Search

News for nerds, stuff that matters

Slashdot Log In

Log In

Create Account  |  Retrieve Password

OpenBSD 4.1 Released

Posted by kdawson on Wed May 02, 2007 02:42 AM
from the hot-bits dept.
Operating Systems Software Upgrades BSD
adstro writes to quote from the BSD mailing list: "We are pleased to announce the official release of OpenBSD 4.1. This is our 21st release on CD-ROM (and 22nd via FTP). We remain proud of OpenBSD's record of ten years with only two remote holes in the default install. As in our previous releases, 4.1 provides significant improvements, including new features, in nearly all areas of the system."
+ -
story
This discussion has been archived. No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.

OpenBSD 4.1 Released 50 Comments More /

 Full
 Abbreviated
 Hidden
More
Loading... please wait.

  • Just curious... (Score:5, Interesting)

    by darnok (650458) on Wednesday May 02 2007, @02:49AM (#18953491)
    My OpenBSD firewall box is several years old now (version 3.x), just keeps working and probably will until the 8yo hardware finally dies. Although I'm interested in the features in 4.1, and congratulate the developers on what'll doubtless be another good release, ultimately I'll probably stick with my existing setup. I *love* OpenBSD, for precisely one reason; it does what it's supposed to, and in my experience it *never* fails. However, I'm very unlikely to upgrade to any new version; why change something that works perfectly?

    For those of you using OpenBSD, how many of you are in a similar situation?
    • I recently upgraded my firewall from a 3.x to 4.0 because the version I was running had a bug that didn't allow ALTQ rules to be unloaded from pf.

      Now, the standard kernel is too big. Programs keep running out of memory. The machine is from, like, 1993. It's a 75MHz Pentium with 16MB of RAM.

      Oops.
      • The machine is from, like, 1993. It's a 75MHz Pentium with 16MB of RAM.

        Just drop by, I'll have another 16MB of EDO RAM for you; and you'll be fine (the 75 MHz Pentium is very much okay, even on 4.X).
      • Have you tried building a new kernel? The default is intended to support most hardware. For a limited platform, I would recommend that you make an absolutely minimal kernel config and use that; I do for a Geode box I own, and it's a 266MHz chip with 64MB of RAM...

    • Re: (Score:3, Insightful)

      by asninn (1071320)

      However, I'm very unlikely to upgrade to any new version; why change something that works perfectly?

      Because holes continue to be found in every version and because old versions do not receive fixes anymore. There's only been two remote holes, of course, but there's an emphasis on both "remote" *and* "holes" here - and also an emphasis on "root", which unfortunately isn't even included in the slogan.

      In other words, if you don't upgrade unless/until a new remote root exploit is found, you still have to

      • Re:Just curious... (Score:4, Interesting)

        by Noryungi (70322) on Wednesday May 02 2007, @08:22AM (#18955619) Homepage Journal

        In other words, if you don't upgrade unless/until a new remote root exploit is found, you still have to worry about local users rooting your box (and don't forget that there typically are users like "www" etc. even when no actual person besides you has an account on the box; not a big problem for a firewall, most likely, but servers in general aren't automatically safe), and you still have to worry about remote priviledge escalation, remote denials of service and the like, too.

        True, but you should also read about PrivSep [umich.edu], W^X, security levels [openbsd.org], systrace [openbsd.org] and other important security mechanisms that mitigates those risks (while not entirely eliminating them). All of these (and more) make a well-configured OpenBSD machine a very tough nut to crack. So to speak.


        To me, the best thing about OpenBSD is not that it is perfectly secure (that can't be achieved) but that security is taken seriously and all this mechanisms are activated by default. The excellent documentation, especially manual pages vs the GNU unreadable info pages mess, and reactive developper community are also big pluses in my book.


        • Re:Just curious... (Score:5, Insightful)

          by udippel (562132) on Wednesday May 02 2007, @06:40AM (#18954571)
          And in this case, I'm not using that as a sarcastic reference to a low number, there really have only been two.

          Hmm, sorry, two what ? Two remotely exploitable holes in the default install, or two users running the default install ?
          (For those not in the know: the default install has - drums rolling - ssh enabled. And SMTP on 127.0.0.1. That's it. Over. No http, no ftp, no pop, nothing else.)

          Don't get me wrong, I'm a great OpenBSD fan and run it on my 3 production machines. Still, personally I consider that statement about the two holes more embarassing than impressive.

    • "it does what it's supposed to, and in my experience it *never* fails"

      That was my experience too, until I accidentally typed `postsuper -r all|postfix reload` instead of `postsuper -r all;postfix reload` on my Open BSD 3.5/postfix box. It caused a Kernel panic.

      Other than that, the box ran without a problem for 2.5 years straight.

      • That was my experience too, until I accidentally typed `postsuper -r all|postfix reload` instead of `postsuper -r all;postfix reload` on my Open BSD 3.5/postfix box. It caused a Kernel panic.

        If that's what actually happened (ie: you didn't coincidentally get hit by a cosmic ray at exactly the same time) it's a pretty serious bug. Is it repeatable ?

    • Re: (Score:3, Interesting)

      by raddan (519638)
      I would do the same, but we are affected by some of OpenBSD's recent patches. While it's true that there are only 2 remote holes in the default install in 10 years, there are other bugs like denial of service, database corruption, and local privilege escalation that would have affected us. I've backported a few easy patches to some of the machines that are difficult to take down for maintenance, but in general we make the effort to upgrade every other release.

      OpenBSD is great because maintenance is muc

      • I do wonder whether not upgrading has security implications..
        You wonder? You wonder? Of course it has security implications.

        Sheesh.

        • Re:Just curious... (Score:5, Insightful)

          by Yvanhoe (564877) on Wednesday May 02 2007, @04:06AM (#18953825) Journal

          You wonder? You wonder? Of course it has security implications.
          I think you are missing this :

          We remain proud of OpenBSD's record of ten years with only two remote holes in the default install.
          and the fact that openBSD doesn't use the linux/windows "security" paradigm of "write software quickly, find security bugs, fix them ASAP". Their strategy is instead to be secure out of the box, at the price of a slower pace of development and less features.

          I am quite happy with linux right now. But I know that the day I will run a critical application/server, I will either use openBSD or maybe a stable debian but not a recent linux.
      • I disagree that the grandparent is a troll. To some extent, I agree with him. I don't rush to deploy OpenBSD updates, because the system got to a state where I consider that it does everything I want from a (server) OS some time ago. Of course, new features are nice. I don't want to imply that they should stop developing them, and I do often see new things I might find a use for, but my OpenBSD installs currently work and work very well. I find updates from some other Free Software projects a lot more

  • Yea, but... (Score:4, Funny)

    by Heembo (916647) on Wednesday May 02 2007, @02:53AM (#18953515) Journal
    Yea, but does it run Linux? Oh wait....

    • Re: (Score:3, Informative)

      by LizardKing (5245)

      To which the stock answer is, yes OpenBSD does run Linux - Linunx binaries at any rate (linux_compat(8) [openbsd.org]). I don't know about OpenBSD, but on NetBSD this works very well. Before a native JDK 1.4.2 was available for NetBSD I ran the Linux binaries of it under emulation.

      • Re:Yea, but... (Score:5, Interesting)

        by TheRaven64 (641858) on Wednesday May 02 2007, @07:03AM (#18954731) Homepage Journal
        Sysjail has a nice feature, where you can run everything inside the jail via a foreign system call framework. This means you can set up a sysjail on OpenBSD containing a complete Linux-compiled userland, and users can access it without ever being aware that it's not Linux unless they try to load a kernel module (or use a system call that isn't emulated).
  • so does this mean when i install my bick OS which defaults to turning off your NIC's, i will be able to claim my security is better then anyones?

  • Downloads (Score:4, Interesting)

    by dleigh (994882) on Wednesday May 02 2007, @03:01AM (#18953551) Homepage
    Why not a link to the .iso download page in the article?
    (Yes, that was annoyed sarcasm). I'd rather donate to the project and download an image than get one shipped, I can't believe OpenBSD is still refusing to provide Official ISOs.

    • Re: (Score:3, Insightful)

      by geminidomino (614729) *
      That's the one thing that's hindered my using it, too.

      Keeping in mind who we're dealing with, though, I don't see it changing any time soon.

    • Re:Downloads (Score:5, Informative)

      by astrashe (7452) on Wednesday May 02 2007, @03:05AM (#18953579) Journal
      You can download a very small minimal iso and do a net install. I did it this evening -- the core system is pretty small, and comes down quickly. It's not as inconvenient as you might think.

      • You can also download the installation packages, burn those to a CD, and that along with the installation CD to do an offline install.

        Or you could burn the packages to a CD and then boot bsd.rd.
        • It's still making you jump through hoops for no obvious benefit. SuSe does something similar (or did last time I looked) it was enough to nudge me towards RH.
          • Because OpenBSD create top-notch software and needs money to do so.

            "So why don't they be a friggin' business already," you say. Well, because they want to be open source. "So why not do both?" They do.

            If you don't like it, don't use it. Or create your own ISO and distribute it.

      • You can download a very small minimal iso and do a net install. I did it this evening -- the core system is pretty small, and comes down quickly. It's not as inconvenient as you might think.

        Yeah, but if you do that you won't be able to stick your install CD into a music player any time you like and play the "Puffy Baba and the 40 Vendors" [openbsd.org] 4.1 song.

    • Re:Downloads (Score:5, Informative)

      by Anonymous Coward on Wednesday May 02 2007, @03:08AM (#18953591)
      Why don't people understand that the world of ISOs isn't practical
      for EVERYTHING? They're not "refusing" anything, the OpenBSD people
      provide an easy manner to obtain and install OpenBSD via ftp.

      For beginners, and for people who don't understand try looking here:

      http://www.openbsd101.com/ [openbsd101.com]

      The above site is Linux user friendly.

        • Re: (Score:2, Informative)

          by mindstormpt (728974)

          Not that BSD tools helps output is any useful anyway.


          On the other hand their manpages actually say something.
        • Ummm no. Nobody said "targeted at Linux users." Don't know where you got that BS from. Here are a few tips though.

          1. --help? What the fuck is up with GNU and the ridiculous long options. Try reading the man pages which actually provide information on a BSD system as well as examples. By the way, every command, device, and config file has one on OpenBSD.

          2. Korn shell is nearly a drop in replacement for bash and in some ways a damn sight nicer.

          3. export PAGER=less. And you call yourself a command line user? F

        • Re: (Score:3, Interesting)

          by LizardKing (5245)

          BSD is dead. As long as they have the antique command line tools.

          Well Linux, and every other Unix like OS including Mac OS X, are dead then as they also include "antique" command line tools. In fact Windows must be dead as well, as it includes command line tools, albeit piss-poor ones.

          Think whatever you want, but I cannot live w/o GNU command line. bash alone isn't sufficient - text-tools, file-tools are also important.

          Last time I checked, the ksh that comes with the BSDs can do everything bash ca

    • Re:Downloads (Score:5, Informative)

      by evilviper (135110) on Wednesday May 02 2007, @03:44AM (#18953725) Journal

      Why not a link to the .iso download page in the article?

      For the same reason Linux kernels, and any other files aren't directly linked in /. articles.

      Just for you: ftp://ftp5.usa.openbsd.org/pub/OpenBSD/4.1/i386/cd 41.iso [openbsd.org]

      I can't believe OpenBSD is still refusing to provide Official ISOs.

      Creating an ISO is positively trivial. The file system layout is exactly the same as the FTP tree. Just be sure to make it bootable with mkisofs -b, or whatever "bootable" check-box your Win32 CD burner program has...

      Not to mention that there are dozens of different ways to install, and a bootable CD is rarely the most convenient. FTP install is quite handy.

      It's only for non-x86 systems that creating bootable CDs is somewhat difficult. And even there, I'd much rather create my own multiple system CD than download an x86 ISO, an Alpha ISO, a Sparc ISO, and burn each to several different (mostly-empty) CDs.

      • Re: (Score:3, Informative)

        by kestasjk (933987)

        Creating an ISO is positively trivial. The file system layout is exactly the same as the FTP tree. Just be sure to make it bootable with mkisofs -b, or whatever "bootable" check-box your Win32 CD burner program has...
        If that's too challenging you can also burn the minimal ISO, and burn the install files to another CD. Boot up off the minimal ISO, then use the second CD as the source for the installation tarballs.
        • Now that's a huge waste of CDs, and really no easier, since you still have to get the layout right, and the like.

      • Re: (Score:2, Informative)

        by turing_m (1030530)
        Or you could download everything in the ftp directory on another computer, host it locally, and install from there. Quicker and you don't waste a CDR.

    • Re: (Score:3, Insightful)

      by LizardKing (5245)

      Why don't you download the floppy boot images, do a net install and save having to waste a CDR?

      The reason official downloadable ISO images are not available is to encourage people to buy the prepackaged CDs. The revenue from these sales is a significant reason why OpenBSD continues to flourish, as people like Theo de Raadt have an income that allows them to work full time on the project. Hopefully this will prevent a monoculture of Linux on servers, which in some respects would be as bad as the monoculture

      • Re: (Score:2, Interesting)

        by turing_m (1030530)
        They have no users? They are currently on #52 in the page hit rank on distrowatch. Right below linspire.

  • OpenBSD 4.1 Release Song (Score:5, Interesting)

    by Anonymous Coward on Wednesday May 02 2007, @03:22AM (#18953637)
    You mustn't exclude the OpenBSD 4.1 Release song from this article!

    http://www.openbsd.org/lyrics.html [openbsd.org]
    ftp://ftp.openbsd.org/pub/OpenBSD/songs/song41.mp3 [openbsd.org]

    • Hmm, yes, I think I can sing that:

      #Boo hoo, Linux won't share driver documentation with us, boo hoo boo hoo#

      The last paragraph in the left hand column on that page is frankly nonsense. Linux has more driver support because there are more people working on driver support. I would like to see evidence of any kind that the OpenBSD community has been refused driver documentation which has been given to the Linux community.
  • I setup an OpenBSD box about 3 years ago. It has multiple gigE's and processes a reasonably tough load of network traffic 24 hours a day, even today. It has never ever crashed! it is not just crash proof, it simply doesn't give any other problems of any kind whatsover, heck I dont even know what to write in this darned comment!

    Thanks for this. OpenBSD is rock solid!

  • But... (Score:5, Funny)

    by Arielholic (196983) on Wednesday May 02 2007, @04:38AM (#18953945)
    But.... does it have UAC?

  • No ISO policy (Score:4, Informative)

    by PhotoGuy (189467) on Wednesday May 02 2007, @06:00AM (#18954325) Homepage
    While I hear great things about OpenBSD, and realize it is for a niche market where stability and security are the number one concern, it seems to me that more people would check it out and use it, if not for this policy:

    "The OpenBSD project does not make the ISO images used to master the official CDs available for download. The reason is simply that we would like you to buy the CD sets to help fund ongoing OpenBSD development. The official OpenBSD CD-ROM layout is copyright Theo de Raadt. Theo does not permit people to redistribute images of the official OpenBSD CDs. As an incentive for people to buy the CD set, some extras are included in the package as well (artwork, stickers etc).

    Note that only the CD layout is copyrighted, OpenBSD itself is free. Nothing precludes someone else from downloading OpenBSD and making their own CD. If for some reason you want to download a CD image, try searching the mailing list archives for possible sources. Of course, any OpenBSD ISO images available on the Internet either violate Theo de Raadt's copyright or are not official images. The source of an unofficial image may or may not be trustworthy; it is up to you to determine this for yourself."

    Now, FTP installs are pretty slick in these days of prevalent high speed; still, it seems a bit silly and arbitrary to intentionally restrict ISO distribution, to try and sell a few discs. The people who are willing to pay, would buy regardless of a free ISO being available (corporations and IT departments like having the official discs, and such).

    I guess more than anything, this policy stikes me as a bit of "attitude", which turns me off the distribution, more than the mild inconvenience of not having ISO's readily available.

    • Re:No ISO policy (Score:5, Informative)

      by DaMattster (977781) on Wednesday May 02 2007, @06:23AM (#18954457)
      I understand your frustration with the policy and the attitude that it might imply but let me show you the other side of the story. The OpenBSD team works very hard to produce these releases and get little support in the form of donations from large companies that use pieces of the operating system. Theo De Raadt asked Sun for a donation for one of his hackathons and was not even given the time of day. He was not even answered which is tantamount to a 'no.' Given that OpenBSD provided extensive assistance to Sun in the integration of OpenSSH and voluntarily reported bugs in Sun's version (as well as others), I think it really would have been no skin off of Sun's back to provide a donation. The principle form of income for the project to function comes from sales of OpenBSD CD-ROMS. You could still make your own ISO, but please keep in mind the hard work of this project. Honestly, 50.00 is a drop in the bucket and you help keep the future of a good project stable.

    • Re:No ISO policy (Score:5, Insightful)

      by LittleLebowskiUrbanA (619114) on Wednesday May 02 2007, @07:08AM (#18954767) Homepage Journal
      Have you priced the official disks? Have you ever used OpenSSH? If so, have you ever given anything back to the creators and maintainers of OpenSSH (OpenBSD)?

          This attitude pisses me off. If you were actually using OpenBSD, you'd be willing to fork over a few buck to get the disks. But you're not using it. The amount of time spent to produce such a high quality OS is worth the money in my book.

          The other thing that pisses me off is that OpenBSD doesn't have a millionaire patron. But they do have Sun, Cisco, etc shipping their software (OpenSSH) withouth even bothering to contribute to the foundation. Kinda cheap, huh? Maybe that's why they charge for their install disks.

          You clearly know nothing about OpenBSD.
    • Why do we care, because now people can use the code hex09f91102... oh have we moved on already?

      No idea, they make a nice SSH program though.

    • Re: (Score:2, Funny)

      by Anonymous Coward
      Well, if that is the case then I must be that kid in the movies because I see dead OSs on lots of my servers.

    • ...does it run Linux? Oh wait...

      Of course it does.

      It runs Linux binaries directly, like all the BSDs.

      It also has Qemu, Bochs, BasiliskII, GXEmul, etc. in ports, on which Linux will no-doubt run.

      Insert "In Soviet Russia" "Beowulf Cluster" "I read that as" "??? Profit" and any other completely mindless /. cliches.

    • I have to ask, Linux users...when are you going to stop making yourselves so easy to hate?

      Don't tar all Linux users with the same trollbrush. There are a very few people on both sides who like to stir the old Linux vs. BSD shit for absolutely no good reason other than to rile the "other side". A lot of us also use a BSD, like it, and see the virtues of both OS families without the need to sling mud. I use predominantly Linux on the desktop, not because I hate Windows, but because I genuinely like Fedora Co

        • There's a lot of comments, (including on /. - see article on Dell shipping Ubuntu Linux), about 'Linux' being less suited to the server role than BSD, (requires daily reboots, lock up without reason..)

          The BSD's are a fine family of OS's. This is widely understood now. There's no need to resort to baseless exaggeration to superficially elevate BSD's position in the mind of the reader, who will probably read your comment, in turn, as "the BSD's are so threatened by Linux that I will resort to back-handed ab

        • Whuh?! There are lots of comments on /. about goatsecs too, but I doubt you would use that in support of your stance for/against the subject (I don't want to know). If you have a Linux server (or any server for that matter) that requires daily reboots and you can squarely blame it on the OS, why are you running that OS? I've numerous servers running BSD, Linux, OS X, Solaris and yes, even Windows, that are all quite stable and simply do not require reboots save for an occasional reboot on a Windows or OS
          • I'll reply to the least offensive post. Why do people think that insulting others somehow makes their argument more compulsive?
            The guy asked a question, I gave him a potential reason why people might think that way - look around, guys, I'm just reporting what others are saying. That does not mean that I AGREE with that.

            For the record.

            1. No, really not into Goatsecs.
            2. The only server that I managed that needed frequent reboots was one running Windows NT that I 'inherited' - soon fixed that, (memory leak).

        • Assuming the parent isn't a troll, it should be pointed out that it's much more complicated than this. BSD is not a failure and it is not dying: a considerable portion of webservers run on FreeBSD. OpenBSD is considered by many to be the de facto for routing, network services, etc. The fact is that Linux is more in the public eye now. I think this is because (1) there was all that legal wrangling over BSD in the early-mid 1990s, when Linux was starting to take off, that made the latter more attractive. (2)

    • C'mon, we do not want to start the old song again. You know, most first Linux drivers were ported over from BSD.

      Development of both BSD & Linux isn't commercialized - so word "lifted" is unfit here. It is more about "exchange of ideas" [canonical.org] ;)

All trademarks and copyrights on this page are owned by their respective owners. Comments are owned by the Poster. The Rest © 1997-2009 Geeknet, Inc.