pgilman writes "The release of OpenBSD 4.6 was announced today. Highlights of the new release include a new privilege-separated smtpd; numerous improvements to packet filtering, software RAID, routing daemons, and the TCP stack; a new installer; and lots more. Grab a CD set or download from a mirror, and please support the project (which also brings you OpenSSH and lots of other great free software) if you can."
Does BSD support "Q" yet? Linux stole the "P" code ages ago and implemented "Q" but released it under a restrictive license that prevents the original authors from using the new features. Come on, get with it BSD!
Now if mdadm only had the ease use gmirror/geom does in freebsd, then it might be more widely adopted.
mdadm is a perfectly functional package, but it's setup is quite awkward. gmirror however is a breeze to setup, and it's performance kicks the crap out of most hardware controllers I've tried(admittedly few). I imagine OpenBSD implementation is also a good performer as software raid. This states a 30% speedup for certain cases. http://www.openbsd.org/plus.html [openbsd.org]
Rock solid, thought through and very conservative.
They have their niche and do their best to serve it as good as they can. I'm very glad that this project exists even though I don't use OpenBSD but various of its offsprings (OpenSSH/SSL, etc.) only. Theo is a very controversial person but at least he keeps the project on focus and going. Congratulations for that and best of luck for the future. I don't see myself using OpenBSD anytime soon but I know a few people that do and they are happy with it. So keep going, the community needs you!
Apparently, softraid is also included in the GENERIC kernel. This means that, unlike with the old RAIDframe, you don't have to compile your own kernel before you can use it.
Can someone recommend a good platform on which to run OpenBSD which will consume the lowest possible power and let me run a Wireless-G and a Wireless-N NIC in master mode at the same time? I also need 100baseT[x]. Ideally it would run from fairly broad DC power (8-18VDC). I want to spend minimal money:) So far in the running are PC Engines, Mikrotik, and Soekris, in my current order of preference from most to least. I'm willing to have my mind changed, though. SD, USB, or CF storage, I don't care.
OpenBSD is, if nothing else, a very conservative OS. It's not particularly surprising that they don't adopt the new shiny if their current system is working just fine.
They didn't have a full install iso until somewhat recently, as they felt that it would hurt their CD sales. I suppose they will do a bit torrent sometime, but probably not for a release or two.
OpenBSD's FAQ explains their choices regarding ISO
images [openbsd.org].
I like to install OpenBSD from a floppy
image [arcticnetwork.ca] - only 1.44 MB! I then choose an FTP
mirror [openbsd.org] and install whatever parts I want on the fly.
You can install it from your running Linux or something to a free partition if you don't want to burn a CD. It is a good finger exercise to do without a CD.
So put the floppy image on a USB stick (instead of a floppy disk) and boot from that. Sheesh, do we have to hold your hand, or do you need us to type the commands for you, or what?
Most distros have at least one or two really good mirrors nearby. Maybe when they don't offer a 4GB file (their install.iso file is 200MB) they don't see the need.
Except if you're following installation directions (and for some reason not using bsd.rd, etc, to install), you would be downloading the 6MB cd64.iso, not the 200MB install46.iso. http://www.openbsd.org/faq/faq3.html#ISO [openbsd.org]
Funny that just says that the iso files available are not official. I do not see where it says that the 6MB network installer is more official than the 200 MB installer with all of the file sets on it.
I am guessing that statement is just outdated since at one point in time some or all of the.iso files they release now were not available in the past and other people made and distributed unofficial ones.
NetBSD has torrents as well. About as year ago I wanted an AMD64 iso to I got the torrent but it turned into a straight download so I may as well not have bothered. I wonder if the actual demand for openbsd is enough to justify the effort.
List of all their torrents, by architecture and type. Search for the text "install" to find the binary install images (rather than source code or package bundles).
The 200MB iso is meant primarily for installing on networkless or low speed connections so the packages are already available. A comparison would be a linux network install cd/floppy vs the live cd/cd with packages on it.
ah, that's super easy, have you ever even tried to read the docs? If 10.0.0.1 is a gateway that people are nat'd behind, something like
block in from 10.0.0.1 to 192.168.0.0/24
in pf.conf, done. pfctl -n -f/etc/pf.conf to check that the grammar is correct, and pfctl -F rules -f/etc/pf.conf to reload the rules. If you mean you need to set up the openbsd box to *do* nating it's still pretty simple. All it takes is a quick look at the PF documentation.
CARP and pfsync can provide a virtual IP address managed by a cluster to act as a frontend to N web servers, but AFAIK (and no I haven't RTFA) they don't have anything else to help like a clustered filesystem, a web server that clusters so sessions can fail over within the cluster or anything fancy like that.
I use it for my father's site-to-site VPN and the ease of configuration of OpenBSD's ipsec.conf makes it wonderful. It is highly reliable and, in the two years I have had it implemented it went down due to the failure of the onboard NIC in a Dell Server. I simply threw in a spare INTEL PRO/100 (em) and it was back up within 5 minutes.
The story points to plus46.html which isn't useful for a general distribution announcement like this. Here's a much better choice (which includes a link to the plus46.html page):
for the record, i submitted it with different links. plus46.html was originally linked from the text "and lots more." they "improved" the links in the story before they published it.
Depending on what language/program/whatever you're using, it'll either round towards -inf (as apparently they've patched this one to do), or towards 0. The mathematical definition of the term "floor" is -inf, so I guess this change makes it "more correct." But God help you if you have a program that relied on the previous behavior.
But God help you if you have a program that relied on the previous behavior.
Well, IIUC, that would just entail converting all floors on negative numbers to ceils: double floorToZero (double n) {
return (n < 0) ? ceil(n) : floor(n); }
OpenBSD's focus is preventing the exploits in the first place with many overflow vulnerabities in third-party software being non-exploitable on OpenBSD. After running it for 10 years, I trust OpenBSD's record. It has some of the best in the business probing it, and with the most serious flaw in years being a subtle IP6 attack, I think that trust is well founded. If you were to prove otherwise, I'm sure you would instantly be a big name in security.
Although sound design, role security is added complexity which increases scope for vulnerabilities. From coding errors to implementation errors, complexity breeds insecurity. They also create a false sense of security: having implemented RBAC on Solaris I was initially impressed until I realized one could bypass it with suid bombs.
OpenBSD's simple design and sound default permissions mean that even with a local account, it is very difficult to gain root access. The base system is comprehensive so usually there's little reason to go to ports to implement OpenBSD in its perimiter focused role.
You would do well to back up your claim that OpenBSD is snake-oil.
OpenBSD does help you, when something goes wrong: like for example with immuteable files, or append only files, so no one can delete your logfiles! At least you have the chance to look at what the "bad guys" did. Indeed a very fine feature for a logserver, isn't it? Or OpenBSD secure modes? Plus, you can put your WEB-Server in a jail, so *IF* someone breaks into your WEB-Server, well, the whole system is still NOT compromised. Jails work very well! Maybe even better the the c
October 18th is also its birthday (Score:5, Informative)
OpenBSD is 14 as of today.
Today would be a great day for even a little gift. ;-)
Re: (Score:2, Insightful)
Does BSD support "Q" yet? Linux stole the "P" code ages ago and implemented "Q" but released it under a restrictive license that prevents the original authors from using the new features. Come on, get with it BSD!
Re: (Score:3, Informative)
Thanks Theo and everyone else. (Score:2)
I just want to give a huge Thanks to Theo and the rest of the OpenBSD developers. They're doing a fantastic job. I'll order my CD soon.
Now There's Some Software Engineering! (Score:2, Interesting)
Doing what others only dream... a scheduled release, early!
Where's the song? (Score:2)
Re:Where's the song? (Score:4, Informative)
Parent
Software RAID? (Score:2)
Re: (Score:3, Informative)
Now if mdadm only had the ease use gmirror/geom does in freebsd, then it might be more widely adopted.
mdadm is a perfectly functional package, but it's setup is quite awkward. gmirror however is a breeze to setup, and it's performance kicks the crap out of most hardware controllers I've tried(admittedly few). I imagine OpenBSD implementation is also a good performer as software raid. This states a 30% speedup for certain cases. http://www.openbsd.org/plus.html [openbsd.org]
The web server can finally serve large files (Score:3, Interesting)
When I looked at the release notes sent out by email, I saw this under "New functionality":
"httpd(8) can now serve files larger than 2GB in size."
I'm very surprised by this.
Looks like a typical OpenBSD release (Score:4, Interesting)
Rock solid, thought through and very conservative.
They have their niche and do their best to serve it as good as they can. I'm very glad that this project exists even though I don't use OpenBSD but various of its offsprings (OpenSSH/SSL, etc.) only.
Theo is a very controversial person but at least he keeps the project on focus and going. Congratulations for that and best of luck for the future.
I don't see myself using OpenBSD anytime soon but I know a few people that do and they are happy with it. So keep going, the community needs you!
They're behind - way behind . . . (Score:2)
softraid (Score:2)
Apparently, softraid is also included in the GENERIC kernel. This means that, unlike with the old RAIDframe, you don't have to compile your own kernel before you can use it.
I want to build an AP with openbsd (Score:3, Interesting)
Can someone recommend a good platform on which to run OpenBSD which will consume the lowest possible power and let me run a Wireless-G and a Wireless-N NIC in master mode at the same time? I also need 100baseT[x]. Ideally it would run from fairly broad DC power (8-18VDC). I want to spend minimal money :) So far in the running are PC Engines, Mikrotik, and Soekris, in my current order of preference from most to least. I'm willing to have my mind changed, though. SD, USB, or CF storage, I don't care.
Re:Soft RAID? (Score:5, Informative)
Parent
Re: (Score:2)
Aye, just notice the use of semicolons and commas in the sentence :-)
Becomes:
Numerous improvements to: (packet filtering, software RAID, routing daemons, and the TCP stack);
(but yes I did read it for a moment as saying that one of the new things was a TCP stack!)
Re: (Score:2)
Re: (Score:2, Insightful)
Re: (Score:2)
Their main CD is not very large at all. If I remember correctly most of the files are downloaded during the installation.
Re: (Score:2)
Was looking at the wrong file, guess it is 200MB but they probably have their reasons for not offering a torrent by default
Re: (Score:2)
ISO Policy Explained (Score:4, Insightful)
OpenBSD's FAQ explains their choices regarding ISO images [openbsd.org].
I like to install OpenBSD from a floppy image [arcticnetwork.ca] - only 1.44 MB! I then choose an FTP mirror [openbsd.org] and install whatever parts I want on the fly.
Parent
Re: (Score:2)
You can install it from your running Linux or something to a free partition if you don't want to burn a CD.
It is a good finger exercise to do without a CD.
Re: (Score:2, Informative)
In summary, buy the cds they come with cool stickers and they're only $50.
I got my cds in the mail on friday.
Already have the OpenBSD 4.6 stickers on my lappy :D
cyphercell
ps - it really is a drop in the bucket compared to my other work expenses this year.
Re: (Score:3, Informative)
So put the floppy image on a USB stick (instead of a floppy disk) and boot from that. Sheesh, do we have to hold your hand, or do you need us to type the commands for you, or what?
Re: (Score:2)
From the top story at Distrowatch.com, the link to the OpenBSD torrent site is http://openbsd.somedomain.net/index.php?version=latest+release [somedomain.net]
The ones you're mostly likely interested in:
http://openbsd.somedomain.net/torrents/OpenBSD_4_6_i386_install46_iso-2009-10-18-1238.torrent [somedomain.net] (i386)
http://openbsd.somedomain.net/torrents/OpenBSD_4_5_amd64_install45_iso-2009-04-30-2207.torrent [somedomain.net] (x86_64)
http://openbsd.somedomain.net/torrents/OpenBSD_4_5_macppc_install45_iso-2009-05-01-1435.torrent [somedomain.net] (PPC)
Re: (Score:3, Insightful)
Most distros have at least one or two really good mirrors nearby. Maybe when they don't offer a 4GB file (their install.iso file is 200MB) they don't see the need.
Re: (Score:2)
Even a 200MB iso would benefit from bittorrent.
Re: (Score:2, Informative)
Re: (Score:2, Informative)
Re: (Score:2)
Funny that just says that the iso files available are not official. I do not see where it says that the 6MB network installer is more official than the 200 MB installer with all of the file sets on it.
I am guessing that statement is just outdated since at one point in time some or all of the .iso files they release now were not available in the past and other people made and distributed unofficial ones.
Re: (Score:3, Insightful)
Maybe when they don't offer a 4GB file (their install.iso file is 200MB) they don't see the need.
Every openbsd installer I have ever downloaded has been 10MB...
Re: (Score:2)
install.iso is 200MB, the iso that has just the installer on it without packages is around 10MB.
Re: (Score:2)
NetBSD has torrents as well. About as year ago I wanted an AMD64 iso to I got the torrent but it turned into a straight download so I may as well not have bothered. I wonder if the actual demand for openbsd is enough to justify the effort.
Re: (Score:2)
http://openbsd.somedomain.net/index.php?version=latest+release [somedomain.net]
List of all their torrents, by architecture and type. Search for the text "install" to find the binary install images (rather than source code or package bundles).
Re: (Score:2)
Re: (Score:2)
The 200MB iso is meant primarily for installing on networkless or low speed connections so the packages are already available. A comparison would be a linux network install cd/floppy vs the live cd/cd with packages on it.
Re: (Score:3, Informative)
Re:openbsd kernel (Score:4, Funny)
*BSDs (all of them) still lack HA and failover clustering software.
Ironic in a story about an OS release that features improved HA networking.
Parent
Re: (Score:3, Informative)
Re: (Score:2)
CARP and pfsync can provide a virtual IP address managed by a cluster to act as a frontend to N web servers, but AFAIK (and no I haven't RTFA) they don't have anything else to help like a clustered filesystem, a web server that clusters so sessions can fail over within the cluster or anything fancy like that.
Re: (Score:2)
Do you have any clue who is responsible for developing Common Address Redundancy Protocol?
You have other options too,
http://www.freebsd.org/cgi/cvsweb.cgi/ports/sysutils/heartbeat/ [freebsd.org]
or for a DRBD eqiv, try ggated + gmirror
http://serverbbs.ccw.com.cn/thread-14564-1-1.html [ccw.com.cn]
Re: (Score:3, Informative)
http://www.freebsd.org/doc/en_US.ISO8859-1/books/handbook/nutshell.html#INTRODUCTION-NUTSHELL-USERS [freebsd.org]
Many, many not listed, one example is php.net.
Re: (Score:3, Interesting)
Re: (Score:3, Interesting)
The story points to plus46.html which isn't useful for a general distribution announcement like this. Here's a much better choice (which includes a link to the plus46.html page):
http://www.openbsd.org/46.html [openbsd.org]
or
http://www.sigmasoft.com/~openbsd/archives/html/openbsd-announce/2009-10/msg00001.html [sigmasoft.com]
for the record, i submitted it with different links. plus46.html was originally linked from the text "and lots more." they "improved" the links in the story before they published it.
Re: (Score:2)
"floor" is one of those functions... ugh.
Depending on what language/program/whatever you're using, it'll either round towards -inf (as apparently they've patched this one to do), or towards 0. The mathematical definition of the term "floor" is -inf, so I guess this change makes it "more correct." But God help you if you have a program that relied on the previous behavior.
Re: (Score:2, Informative)
Well, IIUC, that would just entail converting all floors on negative numbers to ceils:
double floorToZero (double n)
{
return (n < 0) ? ceil(n) : floor(n);
}
Re:OpenBSD - not that secure... (Score:4, Informative)
OpenBSD's focus is preventing the exploits in the first place with many overflow vulnerabities in third-party software being non-exploitable on OpenBSD. After running it for 10 years, I trust OpenBSD's record. It has some of the best in the business probing it, and with the most serious flaw in years being a subtle IP6 attack, I think that trust is well founded. If you were to prove otherwise, I'm sure you would instantly be a big name in security.
Although sound design, role security is added complexity which increases scope for vulnerabilities. From coding errors to implementation errors, complexity breeds insecurity. They also create a false sense of security: having implemented RBAC on Solaris I was initially impressed until I realized one could bypass it with suid bombs.
OpenBSD's simple design and sound default permissions mean that even with a local account, it is very difficult to gain root access. The base system is comprehensive so usually there's little reason to go to ports to implement OpenBSD in its perimiter focused role.
You would do well to back up your claim that OpenBSD is snake-oil.
Parent
Re: (Score:3, Informative)
Well, I beg to differ (what else ;-)
OpenBSD does help you, when something goes wrong:
like for example with immuteable files, or append only files, so no one can delete your logfiles! At least you have the chance to look at what the "bad guys" did. Indeed a very fine feature for a logserver, isn't it?
Or OpenBSD secure modes?
Plus, you can put your WEB-Server in a jail, so *IF* someone breaks into your WEB-Server, well, the whole system is still NOT compromised.
Jails work very well! Maybe even better the the c
Re: (Score:3, Interesting)
A far more secure kernel. User-land wise, there is a lot of manual configuration to get things right which Ubuntu just does out of the box.
OpenBSD is certainly faster on a single core system on a dual core system the difference is not as apparent unless run