Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
Upgrades BSD

OpenBSD 4.6 Released 178

Posted by kdawson from the onward-and-upward dept.
pgilman writes "The release of OpenBSD 4.6 was announced today. Highlights of the new release include a new privilege-separated smtpd; numerous improvements to packet filtering, software RAID, routing daemons, and the TCP stack; a new installer; and lots more. Grab a CD set or download from a mirror, and please support the project (which also brings you OpenSSH and lots of other great free software) if you can."
This discussion has been archived. No new comments can be posted.

OpenBSD 4.6 Released More

OpenBSD 4.6 Released

Comments Filter:

  • October 18th is also its birthday (Score:5, Informative)

    by wb8wsf ( 106309 ) <steve@wb8wsf.org> on Sunday October 18, 2009 @07:38PM (#29788387)

    OpenBSD is 14 as of today.

    Today would be a great day for even a little gift. ;-)

  • Thanks Theo and everyone else. (Score:2)

    by Anonymous Coward

    I just want to give a huge Thanks to Theo and the rest of the OpenBSD developers. They're doing a fantastic job. I'll order my CD soon.

    • Just wondering, but are you unable to simply download the sources/ISO files? Unless you collect the CDs or something, it seems strange in this day and age. That said, I will be donating to the project today. :-)
    • Wouldn't it be better to download iso and the donate those $'s for CD to OpenBSD project?

  • Doing what others only dream... a scheduled release, early!

  • They have lots of mirrors and they likely work well, but with a torrent I could help pass it around.
    What is with projects not offering the option?

  • Come on! FreeBSD has been releasing via bittorrent for a while now [freebsd.org]. Get with it OpenBSD!

    • Re: (Score:3, Insightful)

      by Jared555 ( 874152 )

      Most distros have at least one or two really good mirrors nearby. Maybe when they don't offer a 4GB file (their install.iso file is 200MB) they don't see the need.

      • Even a 200MB iso would benefit from bittorrent.

        • Re: (Score:2, Informative)

          by dayid ( 802168 )
          Except if you're following installation directions (and for some reason not using bsd.rd, etc, to install), you would be downloading the 6MB cd64.iso, not the 200MB install46.iso. http://www.openbsd.org/faq/faq3.html#ISO [openbsd.org]

          • Funny that just says that the iso files available are not official. I do not see where it says that the 6MB network installer is more official than the 200 MB installer with all of the file sets on it.

            • Re: (Score:2, Informative)

              by dayid ( 802168 )
              For those that need a bootable CD for their system, bootdisk ISO images (named cd46.iso) are available for a number of platforms [...]. ...

            • Funny that just says that the iso files available are not official. I do not see where it says that the 6MB network installer is more official than the 200 MB installer with all of the file sets on it.

              I am guessing that statement is just outdated since at one point in time some or all of the .iso files they release now were not available in the past and other people made and distributed unofficial ones.

      • Re: (Score:3, Insightful)

        by blhack ( 921171 )

        Maybe when they don't offer a 4GB file (their install.iso file is 200MB) they don't see the need.

        Every openbsd installer I have ever downloaded has been 10MB...

        • install.iso is 200MB, the iso that has just the installer on it without packages is around 10MB.

    • Re: (Score:1)

      by dayid ( 802168 )
      The x86 install disk is less than 6MB. Maybe when they have 4GB DVD iso's available like FreeBSD they'll feel the pain and go torrents?

    • NetBSD has torrents as well. About as year ago I wanted an AMD64 iso to I got the torrent but it turned into a straight download so I may as well not have bothered. I wonder if the actual demand for openbsd is enough to justify the effort.

    • http://openbsd.somedomain.net/index.php?version=latest+release [somedomain.net]

      List of all their torrents, by architecture and type. Search for the text "install" to find the binary install images (rather than source code or package bundles).

  • Where's the song [openbsd.org]? There was supposed to be an earth-shattering song!

    • Re:Where's the song? (Score:4, Informative)

      by dayid ( 802168 ) <slashdot@dayid.org> on Sunday October 18, 2009 @08:34PM (#29788707) Homepage
      Right here: http://openbsd.org/lyrics.html#46 [openbsd.org]

    • Re: (Score:1)

      by pddo ( 969282 )
      That is some of the funniest/wierdest music I've ever heard.

    • Re: (Score:1, Insightful)

      by Anonymous Coward

      I swear the release songs are what excites me the most about each OpenBSD release song. :-)

      I also find myself agreeing with most of them too. This last one is particularly poignant. I feel the same way a lot of the time, that the technology is trying to be too controlling, that there is too much (technological) power in the hands of the big monopolies, that our choices are dwindling and we must defend them.

      Don't ask me to rationally defend all these positions. I just don't like one-button iPods, locked

  • Anyone know of the preformace? Been using mdadm for a while and been liking it.

    • Re: (Score:3, Informative)

      by Galactic Dominator ( 944134 )

      Now if mdadm only had the ease use gmirror/geom does in freebsd, then it might be more widely adopted.

      mdadm is a perfectly functional package, but it's setup is quite awkward. gmirror however is a breeze to setup, and it's performance kicks the crap out of most hardware controllers I've tried(admittedly few). I imagine OpenBSD implementation is also a good performer as software raid. This states a 30% speedup for certain cases. http://www.openbsd.org/plus.html [openbsd.org]

  • OpenBSD security is in large part overstated, and at worst, a myth.

    Let us look at 3 main points, of which the last is the most important.

    1. Secure by default. Yes, having services turned off by default is a good move. It also actually has nothing to do with the security of what you actually have running.

    2. Auditing. Only the base system is audited. The ports are often quite far behind. Most attacks are not against "the base system".

    3. Lastly...OpenBSD, by design, is not a secure system. A secure system is m

    • Re:OpenBSD - not that secure... (Score:4, Informative)

      by Spit ( 23158 ) on Monday October 19, 2009 @02:10AM (#29790971)

      OpenBSD's focus is preventing the exploits in the first place with many overflow vulnerabities in third-party software being non-exploitable on OpenBSD. After running it for 10 years, I trust OpenBSD's record. It has some of the best in the business probing it, and with the most serious flaw in years being a subtle IP6 attack, I think that trust is well founded. If you were to prove otherwise, I'm sure you would instantly be a big name in security.

      Although sound design, role security is added complexity which increases scope for vulnerabilities. From coding errors to implementation errors, complexity breeds insecurity. They also create a false sense of security: having implemented RBAC on Solaris I was initially impressed until I realized one could bypass it with suid bombs.

      OpenBSD's simple design and sound default permissions mean that even with a local account, it is very difficult to gain root access. The base system is comprehensive so usually there's little reason to go to ports to implement OpenBSD in its perimiter focused role.

      You would do well to back up your claim that OpenBSD is snake-oil.

      • Indeed. For example, I believe OpenBSD was the first production (non-research) OS to implement Address Space Layout Randomization [wikipedia.org]. This is the kind of forward-thinking and comprehensive defense-in-depth approach that OpenBSD takes; even if an application vulnerability is found, it's hard to make an exploit that will *do* anything.

      • Re: (Score:2, Interesting)

        by metrix007 ( 200091 )

        My point was that OpenBSD is not a 'secure system', despite being quality code.

        It provides no ways to limit or control the system, or to limit access if an attack does occur.

        It is good practice to assume that an attack may occur, and be prepared for it.

        I never said OpenBSD was snake oil, simply that it is not the secure system people seem to think it is.

        And, no, you can't bypass RBAC with SUID bombs if it is set up correctly.

        • Re: (Score:2)

          by Spit ( 23158 )

          You can bypass RBAC on Solaris. Covert root to a role as per doco, then as a user not associated with root role run sudo. Assuming the user has root role in sudo, that user becomes root.

      • "Only two remote holes in the default install, in a heck of a long time!" just isn't the impressive statement it used to be.. When was the last Windows/Linux remote hole in a default install. Last I can remember was blaster, and you can bet Windows will have a hell of a lot more people looking for holes in it than OpenBSD.

        Things like NX which OpenBSD rushed to emulate in software are now implemented in hardware on every modern computer. It's not the late 90s/early 2000 when robust security was a real sell
    • SELinux has nothing on GRSecurity. http://www.grsecurity.net/ [grsecurity.net]

    • Re: (Score:3, Informative)

      by atarashi ( 303878 )

      Well, I beg to differ (what else ;-)

      OpenBSD does help you, when something goes wrong:
      like for example with immuteable files, or append only files, so no one can delete your logfiles! At least you have the chance to look at what the "bad guys" did. Indeed a very fine feature for a logserver, isn't it?
      Or OpenBSD secure modes?
      Plus, you can put your WEB-Server in a jail, so *IF* someone breaks into your WEB-Server, well, the whole system is still NOT compromised.
      Jails work very well! Maybe even better the the c

  • The web server can finally serve large files (Score:3, Interesting)

    by Mr.Ned ( 79679 ) on Sunday October 18, 2009 @11:49PM (#29790137)

    When I looked at the release notes sent out by email, I saw this under "New functionality":

    "httpd(8) can now serve files larger than 2GB in size."

    I'm very surprised by this.

    • "Two Gigabytes ought to be enough for anybody!"

      Seriously, this just reflects the conservativeness of OpenBSD, just like DOS back in the day. They move slowly, if at all. Users are expected to be grateful for improvements made years ago in other OSes.

    • Re: (Score:2)

      by vlm ( 69642 )

      When I looked at the release notes sent out by email, I saw this under "New functionality":
      "httpd(8) can now serve files larger than 2GB in size."
      I'm very surprised by this.

      apache has been able to do that since 2.2. Of course, a web page larger than 2 gigs is a bug not a feature...

      http://httpd.apache.org/docs/2.2/new_features_2_2.html [apache.org]

      Large File Support
      httpd is now built with support for files larger than 2GB on modern 32-bit Unix systems. Support for handling >2GB request bodies has also been added.

      • apache has been able to do that since 2.2. Of course, a web page larger than 2 gigs is a bug not a feature...

        You *are* aware that HTTP is used to transfer more than just HTML, right?

        • apache has been able to do that since 2.2. Of course, a web page larger than 2 gigs is a bug not a feature...

          You *are* aware that HTTP is used to transfer more than just HTML, right?

          Like he said, it's a bug not a feature. Torrent and FTP are much more efficient, especially when handling interrupted transfers. HTTP doesn't. Unreliable networks can make a net-based installation process drag on and on or even freeze.

          • Torrent and FTP are much more efficient, especially when handling interrupted transfers.

            Bullshit. Bittorrent isn't appropriate for all applications, and for large transfers, HTTP and FTP are basically a wash as far as efficiency goes, while HTTP handles resumes just fine (the browser needs only to send along a start offset in the request header). Meanwhile, unlike HTTP, FTP doesn't play well with firewalls or caches.

          • Re: (Score:2)

            by Ant P. ( 974313 )

            HTTP has handled partial transfers since version 1.1. ... does OpenBSD not support HTTP 1.1 yet either?

          • Torrent and FTP are much more efficient
            FTP wastes server resources and complicates interactions with firewalling and NAT by using seperate control and data connections. FTP and HTTP both have resume functionality nowadays.

            Torrent is designed for peer to peer distribution, of peices this can save the server a lot of bandwith but also adds a lot of checking overhead and is somewhat controversial.

            Unreliable networks can make a net-based installation process drag on and on or even freeze.
            That is more likely a c

    • I know, isn't it great? :-) They're still working on the 8.3 filename limitation, but let no-one say UFS is standing still!

  • Looks like a typical OpenBSD release (Score:4, Interesting)

    by fadir ( 522518 ) on Monday October 19, 2009 @01:18AM (#29790717)

    Rock solid, thought through and very conservative.

    They have their niche and do their best to serve it as good as they can. I'm very glad that this project exists even though I don't use OpenBSD but various of its offsprings (OpenSSH/SSL, etc.) only.
    Theo is a very controversial person but at least he keeps the project on focus and going. Congratulations for that and best of luck for the future.
    I don't see myself using OpenBSD anytime soon but I know a few people that do and they are happy with it. So keep going, the community needs you!

  • FreeBSD is already at 7.2! No way they can catch up now, unless they pull a Windows.

  • Apparently, softraid is also included in the GENERIC kernel. This means that, unlike with the old RAIDframe, you don't have to compile your own kernel before you can use it.

  • > please support the project (which also brings you OpenSSH Is it possible to support OpenSSH without the money being wasted on OpenBSD?

  • I want to build an AP with openbsd (Score:3, Interesting)

    by drinkypoo ( 153816 ) <drink@hyperlogos.org> on Monday October 19, 2009 @09:06AM (#29793561) Homepage Journal

    Can someone recommend a good platform on which to run OpenBSD which will consume the lowest possible power and let me run a Wireless-G and a Wireless-N NIC in master mode at the same time? I also need 100baseT[x]. Ideally it would run from fairly broad DC power (8-18VDC). I want to spend minimal money :) So far in the running are PC Engines, Mikrotik, and Soekris, in my current order of preference from most to least. I'm willing to have my mind changed, though. SD, USB, or CF storage, I don't care.

    • Re: (Score:2)

      by Hatta ( 162192 ) *

      You can run OpenBSD on a PC Engine [wikipedia.org]? Awesome!

    • Oh boy you're in for a fun time..

      • I guessed as much, which is why I asked. It's pretty easy to do with Linux if you buy the right hardware, and if I don't get any good replies I will try one or two other places and then just do it with Linux, for which I don't require any hand-holding because several companies are intelligent enough to sell me what I want.

  • When I last tried to use OpenBSD, package management was a big barrier to entry. In those days, I yearned for apt-get like ease to set updates and even distribution upgrades automatically. I noticed that OpenBSD added pkg_add several years ago, but I haven't really tried it in the enterprise. How is the package management system today? How easy is it to do hands-off administration of tens if not hundreds of these servers?

Slashdot Top Deals

"I'm a mean green mother from outer space" -- Audrey II, The Little Shop of Horrors

Close