OpenBSD 3.6 Released! 194
dspisak writes "The people over at OpenBSD have released version 3.6 containing significant new features such as: SMP support for i386 and amd64 archs, the ability to optimize pf rulesets, better hotplug support, in addition to more robust encryption and vpn functionality. This is in addition to more recent hardware support, for a full list of changes take a look at the 3.6 changelog. Don't forget to use the mirrors!"
Actually (Score:5, Informative)
Little Late (Score:3, Informative)
Well, come to think of it, this article was on time...
Don't forget the most important part.... (Score:2, Informative)
A new BSD song!
Yeah!!!!!!
Not just for routing. (Score:5, Informative)
If you like Unix (as opposed to hating Microsoft), give it a shot.
--saint
Re:Is there a such thing as... (Score:3, Informative)
So yes, there is.
Comment removed (Score:5, Informative)
Re:About Slashdot BSD Logo (Score:3, Informative)
If you had ordered the CD's... (Score:5, Informative)
If you have not tried OpenBSD please do. While I will not speak on the idea of OpenBSD on the desktop I will speak to how great it is as a firewall. If you have struggled with IPTABLES it is time to give a try to PF. Have a look. It should be easy to understand:
ext_if="xl0"
int_if="fxp0"
# clean up the packets
scrub in all
# nat the internal network to the external interface
nat on $ext_if from !($ext_if) -> ($ext_if:0)
# setup a table of RTBL IP's for spammers
table persist
#redirect any IP's in the the RTBL to spamd
rdr pass inet proto tcp from to any port smtp -> 127.0.0.1 port 8025
# ftp proxy
rdr pass on $int_if proto tcp to port ftp -> 127.0.0.1 port 8021
# redirect any internal user to squid
rdr on $int_if inet proto tcp from any to ! $int_if port 80 -> 127.0.0.1 port 3128
# pass extenal web request to the internal www server
rdr on $ext_if proto tcp from any to any port http -> 192.168.0.2
# pass extenal web request to the internal www server
rdr on $ext_if proto tcp from any to any port https -> 192.168.0.2
# drop everything
block in log
# allow out and keep track
pass out keep state
# allow anything to the loopback and internal interface
pass quick on { lo $int_if }
# no RFC 1918 spoofing (quick - do it now!)
antispoof quick for { lo $int_if }
# allow external ssh in
pass in log on $ext_if proto tcp to ($ext_if) port ssh keep state
# allow smtp in
pass in log on $ext_if proto tcp to ($ext_if) port smtp keep state
# allow the www forwarding
pass in log on $ext_if proto tcp to 192.168.0.2 port http keep state
# allow the www forwarding
pass in log on $ext_if proto tcp to 192.168.0.2 port https keep state
# allow outbound smtp
pass out log on $ext_if proto tcp from ($ext_if) to port smtp keep state
Very simple and clean. If you need a firewall give it a try!
Re:i notice... (Score:3, Informative)
Re:i notice... (Score:2, Informative)
Re:Firewall ? (Score:3, Informative)
The way you build your rules is a little different.
I don't think there's much difference for Joe User (who wants to protect his home network beind cable/dsl).
The features in pf that I like are:
- packet normalization (scrub in all)
- ISN modification (modulate state)
I think you should rather use OpenBSD/pf if you intend to have a firewall with enhanced VPN capabilities, since OpenBSD has pretty good security features.
But the bottom line is: choose the one you're comfortable with. Both can be secure only if well configured!
Re:It's like a BSD golden age lately (Score:5, Informative)
Seems like lots of choices for BSD users.
hotplugd is neat (Score:5, Informative)
It's also mentioned in a recently slashdotted interview with some OpenBSD devs here:
http://www.onlamp.com/pub/a/bsd/2004/10/28
Re:About Slashdot BSD Logo (Score:4, Informative)
Ok, the current icon for a generic BSD story on /. right now is the Daemon, right? Everyone I know associates the Daemon with BSD regardless of flavor. NetBSD has attempted to single themselves out as a seperate distro from the rest of the BSD group/stables. Why would it make any sense to use their new logo as the *generic* BSD logo? If the /. story is 100% devoted to NetBSD, then sure, use the flag like Apple has their own logo. But I don't think it would be worthwhile to replace the Daemon with the NetBSD flag on a story dealing with OpenBSD.
Re:If you had ordered the CD's... (Score:5, Informative)
It might just be that I'm a little thick up top, but I've found it easier and quicker to use PF instead of iptables for routers. The main thing I like about it is that you can do your packet shaping and filtering with the same config file. You can also track state connections by IP address (source tracking).
Re:OpenBSD impossible to update? (Score:5, Informative)
Re:If you had ordered the CD's... (Score:3, Informative)
Re:OpenBSD impossible to update? (Score:5, Informative)
As for updating files in
Re:If you had ordered the CD's... (Score:4, Informative)
## Webserver (http/https)
rdr pass on $ext_if proto tcp from any to ($ext_if) port http -> 10.0.0.8 port http
rdr pass on $ext_if proto tcp from any to ($ext_if) port https -> 10.0.0.8 port https
I like this better than having two seperate rules, as you know youve included both!
custom iso I made : (Score:2, Informative)
Re:SMP (Score:2, Informative)
I asked about SMP for Sparc32 (I have a quad SS20!) but there was no take on that. SMP for Sparc64 maybe coming..
OpenBSD is great for learning, too (Score:5, Informative)
I have never seen such a clear, concise, and easy to understand configuration file as that of pf.conf (IP filter).
The files for the boot-up configuration rc.conf and rc.local are also very clear and easy to understand.
Everything has very _good_ man pages and sample configuration files with lots of comments.
The faq on openbsd.org is quite good, too.
One aspect of security is simplicity, which implies easily understood configuration files.
Another aspect of security is that you learn about the fundamentals of your system
You simply _have_ to learn about your system to be able to operate it, but at the same time learning is made easy, by great documentation.
And if anybody is put off by OpenBSD's (in)famous penchant for straight/rude talking developers: Don't worry, I found people friendly and helpful. They are only put off, by questions that are very obvious and have been covered in the documentation extensively. But I am also the kind of person who loathes to ask for help in a D.I.Y. shop such as Home Depot, preferring to find things unaided so that I learn more and more about the products they offer, so that I will be more knowledgeable when doing my next project.
Marcus
Re:i notice... (Score:4, Informative)
not sure of any command line utils
sysinternals has many other cool free apps and many of those have source code
Re:On Address Space Randomization... (Score:4, Informative)
Re:SMP support (Score:5, Informative)
Don't forget SMP opens up new opportunities for security problems, and the OpenBSD devs will be treading very cautiously and conservatively with their implementation. For them security outweighs performance.
Don't expect it to compete with Linux 2.6 or FreeBSD 5 in terms of performance and scalability anytime soon (if ever).
Re:It's like a BSD golden age lately (Score:2, Informative)
Re:It's like a BSD golden age lately (Score:2, Informative)
Re:If you had ordered the CD's... (Score:2, Informative)
http://www.openbsd.org/faq/upgrade36.html [openbsd.org]
As the author of the above, my opinion of its value may be biased, however. :)
Re:i notice... (Score:1, Informative)