Staying Current with NetBSD

BSDForums writes "Open source never stands still. Even the flexible and mature BSDs are continuing to evolve. In this article, Michael Lucas looks at the NetBSD upgrade process, demonstrating the most common steps to stay abreast of the current source code. This article isn't a comprehensive tutorial that covers every possible situation; rather, it covers the most common situation: updating your source with CVS, building that source code, and installing it on the build machine."

Secure CVS - how did NetBSD do it?

[hrarbinger]

The article shows you how to get the updates via CVS over SSH with this:

# setenv CVSROOT [e-mail]:/cvsroot
# setenv CVS_RSH ssh
....

Now I'd always heard that CVS' pserver wasn't the most stable or secure thing in the world, and that you should use CVS over SSH instead. However I also heard that the abilities of a CVS user were such that if they were determined enough, they'd be able to get shell-like access through the commands that are available. Thus you were only supposed to give CVS access to users who you also give shell access.

So my question is this: do the NetBSD folks have a page anywhere that describes their anonymous CVS setup? I assume they've done a secure job of locking it down to prevent the entire world from being able to get into their download server for obvious reasons.

Re:Secure CVS - how did NetBSD do it?

[kenfrid]

Except for the (supposed) stability issue, it probably doesn't matter to if anonymous users connect by pserver or ssh. Also remember that there are developers using CVS also, and they probably would not like the passwords for their accounts (with commit priviledges) being sent plain-text.

Re:Secure CVS - how did NetBSD do it?

[Dahan]

What's the point of serving an open source project over ssh?

Obviously the encryption isn't important, but ssh does more than encryption--it also makes sure that you're actually talking to the server you think you're talking to. With ssh, you can avoid someone redirecting your connection to another machine and sending you trojaned source files.

Re:Secure CVS - how did NetBSD do it?

[kjd]

Although there is a comment to the contrary, SSH's encryption (and the inherent integrity checking) is beneficial even with Free source code.

• Helps prevent insertion attacks (attacker modifying your source code on-the-fly while you download)
  
• May help prevent nosy people upstream from knowing that your latest project uses certain software
  
• Compression
  

Re:Secure CVS - how did NetBSD do it?

[Ed Avis]

Sourceforge has special CVS-ssh servers where the only command you can run on the remote end is 'cvs'. So short of an exploit in that program, you don't have general shell access. It would be possible for NetBSD to do the same I suppose.

Re:Secure CVS - how did NetBSD do it?

[rsax]

Here's a link [netbsd.org] from the NetBSD documentation website. And here's [google.com] one provided by a netbsd user, translated from spanish. The second one is better because it incorporates ssh and a chroot jail for the entire repository. I have the actual english version which I downloaded from one of the netbsd mailing lists, don't remember exactly which one though. Search through them, should still be there.

Re:Cool.

[Dahan]

I gather that there is a dependency or two for building cvsup that isn't portable across the various architectures out there, and so it's not very popular in the NetBSD camp.

cvsup is written in Modula-3, and the Modula-3 compiler hasn't been ported to many of the platforms NetBSD supports. I think it's only available for NetBSD/i386, actually...

Re:Mature BSD? When did that happen?

[LizardKing]

That's a fair accessment. To be honest, BSD is mostly a hobby system.

You better go and tell that to Yahoo! and all those ISP's who have server farms running nothing but FreeBSD. You better tell all those embedded companies who have mistakenly chosen NetBSD over some less well featured, closed source alternative. And all those people running critical edge systems (firewalls, routers, etc.) on OpenBSD - better tell them to switch as well. And those amateurs at Apple, what the hell are they doing running a BSD based operating system?

Your post is the most ill informed rubbish I've seen in oh, a couple of hours. Well, since I last checked SplashSnot anyway.

Chris

Re:Mature BSD? When did that happen?

[LizardKing]

Spoken like a fan-boy with an ax to grind. Let me guess, your hobby is BSD?

Nope. My job is *programming* on several BSD's, occasionally Linux and even more occasionally Tru64. My hobbys are much more interesting.

Chris

Re:Mature BSD? When did that happen?

[rsax]

Not to mention the millions of dollars in grants given to the OpenBSD project by DARPA. Must be a pretty expensive hobby.

Re:Mature BSD? When did that happen?

[cant_get_a_good_nick]

To be honest, BSD is mostly a hobby system.

Not sure what you mean here, anymore than Linux is just a hobby system. Linus doesn't sell anything, it's tken from him and the maintainers and packaged by others.

Commercial support for BSD isn't what it is for Linux, thats true. If thats your only criterion for comparison, I guess it is "hobby", much like Linux was. The reason for this is more accident than anything; Linux didn't have to fight a lawsuit over the UNIX name. Linus himself has said that he would have used BSD if it wasn't encumbered at the time. Instead he made Linux.

FreeBSD does have a longer history. For years it had a better VM, so much so that Linux binaries would run better on FreeBSD under load than on a Linux system. Besides a stabler VM, the scheduler is more mature, and they don't tend to do huge changes in the middle of a stable branch (the VM and scheduler changes in the 2.4 branch) nor did they have a file system corruption bug in a stable branch.

I tried to follow the instructions

[Anonymous Coward]

But I couldn't get my PDP-11 to bootstrap using the tape image they provided. Are they still having trouble with the more recent firmware versions (I upgraded to the newest one from June 1979), or do you still have to have at least two terminals connected for it to work?

Also, is there TCP/IP support in this version? UUCP doesn't interoperate very well with our windows systems.

one problem with the article

[MobyTurbo]

There's only one problem I have with the article, it shows how to track -current, the alpha/beta branch of NetBSD. (As -current is with all other *BSDs). It did not show how to track 1.6-STABLE (using "-r netbsd-1-6" in your cvs command line.) It should have mentioned that as most people just want the latest bugfixes and upgrades rather than testing what is going to become 2.0 with all of the changes that implies.