7 ms·

OpenBSD Jumpstart: Learn to Tame OpenBSD Quickly

131 points by fcambus 11y ago

nalck 11y ago
This is quite the handy resource! Great idea and well done. OpenBSD is really quite friendly, just need to be comfortable with reading man pages and Unix basics. A tip for first-timers: perform the installation with an Ethernet internet connection. On my laptop, wireless firmware was installed and configured automagically on first boot. After that it's all gravy.
- dijit 11y ago
  I agree. It certainly feels more friendly than I was expecting. And the fact that they patched in modern features to old utilities (wpa in ifconfig instead of wpa_supplicant) makes things super clean and easy to understand. FreeBSD is less easy to use, and Linux, by comparison is a mess. That said. Finding pre-built binary packages can be hit or miss. And ports requires X11 to be installed. But when all is said and done. It's the community that's most important. And OpenBSD has one of the kindest and active IRC channels on freenode. Far from the "in your face"/elitist reputation others have stated before.
  - justinsaccount 11y ago
    > And the fact that they patched in modern features to old utilities (wpa in ifconfig instead of wpa_supplicant) makes things super clean and easy to understand Sure.. though from what I can see, openbsd didn't support wpa enterprise until 2013, and at that point it was supported using wpa_supplicant. http://www.undeadly.org/cgi?action=article&sid=20130128142215 http://www.undeadly.org/cgi?action=article&sid=2013012814221...
- snksnk 11y ago
  Agreed, OpenBSD is rock solid; it just works, with well thought out defaults and excellent drivers for devices that are supported. I only wish they would port hammer faster..
  - na85 11y ago
    If only the performance was adequate. It was so laggy and power-hungry on my i7 thinkpad that I was forced to go back to Linux.
    - morganvachon 11y ago
      That's the only thing stopping me from running OpenBSD 24/7/365 on my workstation. It's getting marginally better with each release, but even on a system that screams under any other OS, OpenBSD just lags and lags, even with tweaks. I've found a great use case for it though; older, slower hardware (think P4 and older) actually benefits from running OpenBSD versus most modern Linux distros. For example, I have an ancient PIII laptop that refuses to run anything other than OpenBSD, Slackware, and Haiku OS. Out of those, OpenBSD is the fastest and least buggy. Granted, it's just a toy/hobby device, but I found it intriguing nonetheless.
      - geggam 11y ago
        using minecraft as an example... http://www.laptopmag.com/reviews/laptops/fujitsu-lifebook-s751 http://www.laptopmag.com/reviews/laptops/fujitsu-lifebook-s7... The above ~5yr old laptop will give 60fps running minecraft with no hiccups / glitches. Installed an SSD and frankly its a perfect workstation for anything I would use and I see no lag.
      - zmyrgel 11y ago
        Could you be more specific on what problems you have? Usually OpenBSD has been running quite smoothly. Only issues I've experienced have been on video use. Like I haven't been able to get smooth playback of HD material. And firefox seems to be bit choppy but that is probably my "gazillion tabs" I keep open.
        na85 11y ago
        Multiple-second system freezes when opening programs or changing workspaces, etc. It's just laggy and runs hotter than Linux. I get a solid hour and a half more battery life on Linux too.
- jlgaddis 11y ago
  > A tip for first-timers: perform the installation with an Ethernet internet connection. Yes, it's much easier that way. Then, once the firmware for your wireless card is installed, configure your wired and wireless interfaces as a failover trunk (if you switch back and forth between them very often). This way, your IP address doesn't change when you {dis}connect your Ethernet cable. Obviously, everyone has different needs but this works out great for me (I plug in when at my desk and use wireless the rest of the time).
  - zmyrgel 11y ago
    Only use failover trunk if your wireless network and wired connections share same subnet. Otherwise it work that well. Like once you connect the ethernet cable you lose network connectivity as trunk won't renew your address. Seems the currently recommended method is to just run dhclient on both wireless and wired interfaces and let the routing table to decide which to use.
    - jlgaddis 11y ago
      I haven't encountered that issue as I only use that laptop at home (same subnet) but that's a very good point, thanks.
SwellJoe 11y ago
I've never seriously used any BSD, but I do have to admit I like that things don't change for the sake of change, as seems to happen on Linux every couple of years. With OpenBSD, docs from 10 years ago are generally workable, because nothing on the user side has changed. That's got some definite benefits. I've been using Linux as my primary OS for 20 years, as of this year (which is, coincidentally about as long as OpenBSD has been around), and I don't feel significantly more "on top of" the OS than I did 10 or even 15 years ago. On many fronts, I'm further behind, because I have so much less free time, and there's so much more to a Linux system. And, so much has changed. That said, there's a bunch of trade-offs. Virtualization on OpenBSD is, as far as I can tell, effectively a non-starter for any major project (i.e. those with many VMs, a virtual network, virtual disks, etc.). Containers seem to not exist, at all, though I found some historic mentions of jail-based options. It seems like a perfect candidate for a VM or container guest OS, due to security focus, small size, simple deployment, etc. But, you then have to have two sets of skills: Managing your guest operating system, and managing your host operating system. Since Linux is the strongest container or VM hosting OS on the server (this was once debatable when Solaris Zones was new and Linux was still somewhat immature on the container front, but I don't think anyone would make the case that Linux isn't the obvious choice for hosting VMs or containers in most deployments today), and Linux is pretty far away from OpenBSD, you've got two pretty widely divergent skill sets needed. Nonetheless, every time I read about OpenBSD, I feel a strong urge to give it a try. It seems extremely elegant in the way old UNIX systems were elegant. It appeals to me on a lot of fronts. Also, the code and documentation are extremely readable, in ways I've rarely seen elsewhere (FreeBSD also meets this description, but it's so much bigger it can still be daunting). I wonder if anyone is working on a Zones port to any BSD? OpenBSD with a convincing container or virtualization story would be a tipping point for me, in terms of being willing to put in the effort to learn it and use it.
- empthought 11y ago
  As far as I know, zones are essentially a port of FreeBSD jails in the first place.
  - SwellJoe 11y ago
mozumder 11y ago
How does networking speed compare to FreeBSD and Linux? If I were to make an REST API server, that serves 10,000 requests per second per core, which OS should I use?
- ratboy666 11y ago
  mozumder -- um... what? But, here is an answer - 10,000 requests per second is 100 microseconds per request. At 100Mbps network speed, this gives (roughly) 10 characters per microsecond or a budget of 1,000 characters combined per request. We will take 100 characters for the request, and 900 characters for the reply. Of course, you could go with 1Gps network service, and multiply this by 10. But, you will need at least 20kpps "per core". However, you also have to contend with disk i/o and/or the database layer. Which OS? I think you are probably a long way from being able to answer that question. Note that OpenBSD will not be as "multicore performant" but that may not matter in your application.
  - mozumder 11y ago
    100mbps is really slow for a server. The colocation providers I'm looking at are offering 10G network connections for around $500/month. The server I'm using has Intel SSDs, capable of 400,000 read IOPS per drive. Redis caching can be used to reduce database accesses as well.
    - jlgaddis 11y ago
      10 GbE? FreeBSD.
- jpfr 11y ago
  At that rate, you are limited by context changes from userland to the OS. So you must use an event driven approach like nginx or node.js. In contrast to the Apache way of opening a thread per connection. Also, make use of netmap: http://info.iet.unipi.it/~luigi/netmap/ http://info.iet.unipi.it/~luigi/netmap/ That is available for FreeBSD and Linux. 10k messages per sec is doable. But probably not off the shelf.
- 11y ago
jlgaddis 11y ago
I played with OpenBSD many, many years ago (when I had much more free time) but then didn't touch it for years. After hearing about JETPLOW [0], I decided to replace the Cisco ASA that I had been using for my (fiber) Internet connection at home with an open-source router/firewall. I had a RouterMaxx 1106 [1] (PDF) laying around so I decided to put OpenBSD on it and use that. In short order, I built an OpenBSD virtual machine, used flashrd [2] to build an OpenBSD image I could put on a CompactFlash card, and had it up and running. It just works. About two years later, it's still humming along nicely. The only downtime that I've had is when I upgraded to a new OpenBSD version. I could've minimized somewhat but I use a new CF card every time. Nowadays, I've also got a dedicated laptop running OpenBSD that I use solely for "security critical" stuff for $work. A separate machine stands in between the Internet and our MX hosts and runs OpenBSD's spamd [3] to help keep spam out of our users' mailboxes (N.B.: the number of messages hitting out Barracuda dropped by ~70%, with zero complaints received from any of our users). In addition, we're just beginning a project to basically rebuild our entire server infrastructure and we'll be using OpenBSD for certain functions: remote access (OpenVPN), SSH jump hosts, possibly authoritative DNS, etc. I'm a firm believer in using "the best tool for the job". Most of our servers will be running FreeBSD, but OpenBSD definitely has its place in our environment. [0]: https://nsa.gov1.info/dni/nsa-ant-catalog/firewalls/ https://nsa.gov1.info/dni/nsa-ant-catalog/firewalls/ [1]: http://www.balticnetworks.com/docs/routermaxx%206%20port.pdf http://www.balticnetworks.com/docs/routermaxx%206%20port.pdf [2]: http://www.nmedia.net/flashrd/ http://www.nmedia.net/flashrd/ [3]: http://www.openbsd.org/spamd/ http://www.openbsd.org/spamd/
digitalzombie 11y ago
Slide 3: > Get the last PF (Packet Filter) features last -> latest
- jlgaddis 11y ago
  > Feedback: contact@ Posting about typo's and such here in the comments helps no one.
  - digitalzombie 11y ago
    I just wanted to point out a typo, is there some rule against that? lol, I was considering not posting comments on HN anymore. This is just cake. I don't even know why I try, bye HN thanks for all the fishes.
    - jlgaddis 11y ago
      Comments here, generally, should contribute to or advance the discussion. I'm having trouble seeing how pointing out a typo to other HN readers -- who can't fix it -- benefits any of us. If you felt inclined to point it out to someone, you should have pointed it to the author (who conveniently provided a way to contact him). If we always pointed out every typo or grammatical error in every submission (as users on some other discussion sites tend to do), this comments section would be full of them and the quality of the site would quickly diminish.
blue1 11y ago
I've been using OpenBSD on my firewall for ages, but the fact that patches are only distributed in source form is a giant giant hassle. I understand the reasons for that but it's a level of inconvenience that I find unbearable today. On Debian it's just "apt-get upgrade". On OpenBSD it's so more difficult that I usually end just not patching it at all.
- davidgerard 11y ago
  I must admit that apt was what converted me from FreeBSD to Ubuntu and convinced me to put up with the Linux kernel. It is so clearly The Right Thing.
  - jlgaddis 11y ago
    I don't know how long ago you switched from FreeBSD but are you aware of FreeBSD's (relatively) new `pkg` tool and binary package repositories?
- Gracana 11y ago
  m:tier provides binary packages for -stable, if you want to run an OpenBSD box with less hassle: https://www.mtier.org/solutions/apps/ https://www.mtier.org/solutions/apps/ They also make binpatch-ng which helps you create binary patches which you can then distribute around to your machines.
  - zmyrgel 11y ago
    To add to Gracana's comment. M:Tier provides openup tool which will update your base system and packages to match -stable. That way you don't have to patch and compile your kernel yourself. For trustworthiness of M:Tier, several project developers are employed by M:Tier.
wila 11y ago
Very nice, here's the plain text version instead of slide format. Learn to tame OpenBSD quickly. December 24, 2015 History Forked from NetBSD. Theo De Raadt is the founder and leader of the OpenBSD project. The first OpenBSD release (1.1/CVS) appear on October 18, 1995. Why use OpenBSD ? UNIX-like Get the last version of OpenSSH, OpenSMTPD, OpenNTPD, OpenBGPD, OpenOSPFD, LibreSSL Get the last PF (Packet Filter) features Security focused Operating System Thorough documentation Cryptography Forked from NetBSD. Theo De Raadt is the founder and leader of the OpenBSD project. The first OpenBSD release (1.1/CVS) appear on October 18, 1995. OpenBSD Version numbers Six month release cycle New release is incremented by 0.1 OpenBSD's Flavors -release: The version of OpenBSD shipped every six months -current: Development just after the release -stable: Release, plus patches (support ~ 1 year) Installation Really simple, ready in 5 minutes (KISS). Get more information: http://www.openbsd.org/faq/faq4.html http://www.openbsd.org/faq/faq4.html Networking (Files) File Contain /etc/myname Default hostname. /etc/hostname.if Configuration for each network interface, for example: /etc/hostname.bge0 /etc/mygate Default gateway. /etc/resolv.conf Resolver (DNS). /etc/hosts Known hosts on the network. Networking # See available network cards: /sbin/ifconfig # Restart networking service: /bin/sh /etc/netstart # Set DHCP for 're0' interface, on the fly: /sbin/dhclient re0 Networking (Routing) # Show the routing table (ipv4): /usr/bin/netstat -rnf inet # Show the routing table (ipv6): /usr/bin/netstat -rnf inet6 # Delete all gateway entries from the routing table: /sbin/route -n flush Networking (set at startup) Example 1: configure static IP address for re0. ## file: /etc/hostname.re0 inet 192.168.0.58 255.255.255.0 # For more information, read the manual: hostname.if(5) Don't forget to run 'sh /etc/netstart re0' to apply changes to running system. Example 2: configure DHCP for bge0. ## file: /etc/hostname.bge0 dhcp # For more information, read the manual: hostname.if(5) Don't forget to run 'sh /etc/netstart bge0' to apply changes to running system. Example 3: configure wireless. ## file: /etc/hostname.iwn0 nwid ACCESS_POINT_NAME wpakey THE_SECRET_KEY dhcp # For more information, read the manual: hostname.if(5) Don't forget to run 'sh /etc/netstart iwn0' to apply changes to running system. PF (Packet Filter) Ruleset: /etc/pf.conf Useful commands. # Disable PF /sbin/pfctl -d # Enable PF and load the rules /sbin/pfctl -ef /etc/pf.conf # Just load the rules (apply changes) /sbin/pfctl -f /etc/pf.conf # View the loaded rules /sbin/pfctl -s rules For more information, read the manual: pfctl(8) Pf ruleset sample ## file: /etc/pf.conf # Protect a laptop (allow only ping/ssh from anywhere) set skip on lo set fingerprints "/dev/null" block log all pass in on egress inet proto icmp all icmp-type echoreq pass in on egress inet proto tcp from any to any port ssh pass out # For more information, read the manual: pf.conf(5) Debug PF with tcpdump(8) /usr/sbin/tcpdump -nettti pflog0 Manage users Manually /usr/sbin/user [add|del|info|mod] user_name The interactive way # Add users /usr/sbin/adduser # Remove users /usr/sbin/rmuser For more information, read the manual: adduser(8) Manage Groups File: /etc/group /usr/sbin/group [add|del|info|mod] group_name Members in 'wheel' group can use su(1) to become 'root'. For more information, read the manual: group(8,5) sudo replaced with doas(1) ## file: /etc/doas.conf # Permit the user 'Marc' to reboot the box permit nopass marc as root cmd reboot Marc can now reboot the box: $ doas reboot For more information, read the manual: doas.conf(5) Install Packages export PKG_PATH=http://ftp.openbsd.org/pub/OpenBSD/5.8/packages/amd64/ # OR use 'installpath' variable in /etc/pkg.conf: installpath=http://ftp2.fr.openbsd.org/pub/OpenBSD/%c/packages/%a/ # Add sudo package /usr/sbin/pkg_add sudo Some packages provide configuration and other information in a file located in '/usr/local/share/doc/pkg-readmes'. For more information, read the manual: pkg.conf(5) Packages # List packages installed /usr/sbin/pkg_info # View install-message for a specific package /usr/sbin/pkg_info -M package_name # Remove a Package /usr/sbin/pkg_delete package_name # Delete unused dependencies /usr/sbin/pkg_delete -a For more information, read the manual: packages(7) Install non-free firmware packages /usr/sbin/fw_update Firmware is downloaded from release-specific directories at: http://firmware.openbsd.org/firmware/ http://firmware.openbsd.org/firmware/ Manage daemons, services File: /etc/rc.conf.local /usr/sbin/rcctl [enable|disable|start|stop|reload|restart] daemon_name # Examples /usr/sbin/rcctl enable ipsec /usr/sbin/rcctl enable isakmpd /usr/sbin/rcctl set isakmpd flags -K /usr/sbin/rcctl start isakmpd For more information, read the manual: rcctl(8) Run a script at startup File: /etc/rc.local For more information, read the manual: rc.local(8) Update OpenBSD Any security or reliability fixes can be found at: http://www.openbsd.org/errata.html http://www.openbsd.org/errata.html You can also use the openup tool from M:tier Upgrade OpenBSD To upgrade 5.6 to 5.8, you need to follow instructions: http://www.openbsd.org/faq/upgrade57.html http://www.openbsd.org/faq/upgrade57.html & http://www.openbsd.org/faq/upgrade58.html http://www.openbsd.org/faq/upgrade58.html OpenBSD Filesystem The most important: / Root directory. /home User home directories. /root Default home directory for the superuser. /mnt A temporary mount point. /etc System configuration files and scripts. /etc/examples Example configuration files for base system daemons. /etc/skel (dot) files for new accounts. /etc/signify Key files used for signify(1). /tmp Cleaned after a reboot. /var/tmp Symbolic link to the system /tmp. /var/log Log files. /var/run pid, socket files, utmp, dmesg.boot /var/db Database files. /var/www Configuration files for httpd(8). /usr/local Used for third packages installed. /usr/src BSD and/or local source files. For more information, read the manual: hier(7) OpenBSD Kernels /bsd Pure kernel executable (the operating system loaded into memory at boot-time). /bsd.mp Pure kernel executable for multiprocessor machines. /bsd.rd Installation kernel. The built-in RAM disk contains utilities which can be run without an external file system, so this kernel is useful for limited system maintenance too. Tune the system sysctl(8) get or set kernel state config(8) modify a kernel Need more help ? FAQ: http://www.openbsd.org/faq/ Manual page: afterboot(8) Mailing list: misc@ Presentations & Papers http://www.openbsd.org/papers/ Supporting OpenBSD Donations [1] OpenBSD Foundation [2] OpenBSD Store [3] Thank you. Feedback: contact@ [1] http://www.openbsd.org/donations.html http://www.openbsd.org/donations.html [2] http://www.openbsdfoundation.org/ http://www.openbsdfoundation.org/ [3] http://www.openbsdstore.com/ http://www.openbsdstore.com/
unixhero 11y ago
This is great.
ksec 11y ago
There are different FreeBSD flavours such as PC-BSD which solely focus on PC Desktop usage. I wonder why there are any similar initiative for OpenBSD? I am sure OpenBSD is great fit for Server and Internet based Appliance where security is a prime concern, and doesn't require PC desktop support.

131 points by fcambus 11y ago

nalck 11y ago

This is quite the handy resource! Great idea and well done. OpenBSD is really quite friendly, just need to be comfortable with reading man pages and Unix basics. A tip for first-timers: perform the installation with an Ethernet internet connection. On my laptop, wireless firmware was installed and configured automagically on first boot. After that it's all gravy.

dijit 11y ago
I agree. It certainly feels more friendly than I was expecting. And the fact that they patched in modern features to old utilities (wpa in ifconfig instead of wpa_supplicant) makes things super clean and easy to understand. FreeBSD is less easy to use, and Linux, by comparison is a mess. That said. Finding pre-built binary packages can be hit or miss. And ports requires X11 to be installed. But when all is said and done. It's the community that's most important. And OpenBSD has one of the kindest and active IRC channels on freenode. Far from the "in your face"/elitist reputation others have stated before.
- justinsaccount 11y ago
  > And the fact that they patched in modern features to old utilities (wpa in ifconfig instead of wpa_supplicant) makes things super clean and easy to understand Sure.. though from what I can see, openbsd didn't support wpa enterprise until 2013, and at that point it was supported using wpa_supplicant. http://www.undeadly.org/cgi?action=article&sid=20130128142215 http://www.undeadly.org/cgi?action=article&sid=2013012814221...
snksnk 11y ago
Agreed, OpenBSD is rock solid; it just works, with well thought out defaults and excellent drivers for devices that are supported. I only wish they would port hammer faster..
- na85 11y ago
  If only the performance was adequate. It was so laggy and power-hungry on my i7 thinkpad that I was forced to go back to Linux.
  - morganvachon 11y ago
    That's the only thing stopping me from running OpenBSD 24/7/365 on my workstation. It's getting marginally better with each release, but even on a system that screams under any other OS, OpenBSD just lags and lags, even with tweaks. I've found a great use case for it though; older, slower hardware (think P4 and older) actually benefits from running OpenBSD versus most modern Linux distros. For example, I have an ancient PIII laptop that refuses to run anything other than OpenBSD, Slackware, and Haiku OS. Out of those, OpenBSD is the fastest and least buggy. Granted, it's just a toy/hobby device, but I found it intriguing nonetheless.
    - geggam 11y ago
      using minecraft as an example... http://www.laptopmag.com/reviews/laptops/fujitsu-lifebook-s751 http://www.laptopmag.com/reviews/laptops/fujitsu-lifebook-s7... The above ~5yr old laptop will give 60fps running minecraft with no hiccups / glitches. Installed an SSD and frankly its a perfect workstation for anything I would use and I see no lag.
    - zmyrgel 11y ago
      Could you be more specific on what problems you have? Usually OpenBSD has been running quite smoothly. Only issues I've experienced have been on video use. Like I haven't been able to get smooth playback of HD material. And firefox seems to be bit choppy but that is probably my "gazillion tabs" I keep open.
      - na85 11y ago
        Multiple-second system freezes when opening programs or changing workspaces, etc. It's just laggy and runs hotter than Linux. I get a solid hour and a half more battery life on Linux too.
jlgaddis 11y ago
> A tip for first-timers: perform the installation with an Ethernet internet connection. Yes, it's much easier that way. Then, once the firmware for your wireless card is installed, configure your wired and wireless interfaces as a failover trunk (if you switch back and forth between them very often). This way, your IP address doesn't change when you {dis}connect your Ethernet cable. Obviously, everyone has different needs but this works out great for me (I plug in when at my desk and use wireless the rest of the time).
- zmyrgel 11y ago
  Only use failover trunk if your wireless network and wired connections share same subnet. Otherwise it work that well. Like once you connect the ethernet cable you lose network connectivity as trunk won't renew your address. Seems the currently recommended method is to just run dhclient on both wireless and wired interfaces and let the routing table to decide which to use.
  - jlgaddis 11y ago
    I haven't encountered that issue as I only use that laptop at home (same subnet) but that's a very good point, thanks.

SwellJoe 11y ago

I've never seriously used any BSD, but I do have to admit I like that things don't change for the sake of change, as seems to happen on Linux every couple of years. With OpenBSD, docs from 10 years ago are generally workable, because nothing on the user side has changed. That's got some definite benefits. I've been using Linux as my primary OS for 20 years, as of this year (which is, coincidentally about as long as OpenBSD has been around), and I don't feel significantly more "on top of" the OS than I did 10 or even 15 years ago. On many fronts, I'm further behind, because I have so much less free time, and there's so much more to a Linux system. And, so much has changed. That said, there's a bunch of trade-offs. Virtualization on OpenBSD is, as far as I can tell, effectively a non-starter for any major project (i.e. those with many VMs, a virtual network, virtual disks, etc.). Containers seem to not exist, at all, though I found some historic mentions of jail-based options. It seems like a perfect candidate for a VM or container guest OS, due to security focus, small size, simple deployment, etc. But, you then have to have two sets of skills: Managing your guest operating system, and managing your host operating system. Since Linux is the strongest container or VM hosting OS on the server (this was once debatable when Solaris Zones was new and Linux was still somewhat immature on the container front, but I don't think anyone would make the case that Linux isn't the obvious choice for hosting VMs or containers in most deployments today), and Linux is pretty far away from OpenBSD, you've got two pretty widely divergent skill sets needed. Nonetheless, every time I read about OpenBSD, I feel a strong urge to give it a try. It seems extremely elegant in the way old UNIX systems were elegant. It appeals to me on a lot of fronts. Also, the code and documentation are extremely readable, in ways I've rarely seen elsewhere (FreeBSD also meets this description, but it's so much bigger it can still be daunting). I wonder if anyone is working on a Zones port to any BSD? OpenBSD with a convincing container or virtualization story would be a tipping point for me, in terms of being willing to put in the effort to learn it and use it.

empthought 11y ago
As far as I know, zones are essentially a port of FreeBSD jails in the first place.
- SwellJoe 11y ago

mozumder 11y ago

How does networking speed compare to FreeBSD and Linux? If I were to make an REST API server, that serves 10,000 requests per second per core, which OS should I use?

ratboy666 11y ago
mozumder -- um... what? But, here is an answer - 10,000 requests per second is 100 microseconds per request. At 100Mbps network speed, this gives (roughly) 10 characters per microsecond or a budget of 1,000 characters combined per request. We will take 100 characters for the request, and 900 characters for the reply. Of course, you could go with 1Gps network service, and multiply this by 10. But, you will need at least 20kpps "per core". However, you also have to contend with disk i/o and/or the database layer. Which OS? I think you are probably a long way from being able to answer that question. Note that OpenBSD will not be as "multicore performant" but that may not matter in your application.
- mozumder 11y ago
  100mbps is really slow for a server. The colocation providers I'm looking at are offering 10G network connections for around $500/month. The server I'm using has Intel SSDs, capable of 400,000 read IOPS per drive. Redis caching can be used to reduce database accesses as well.
  - jlgaddis 11y ago
    10 GbE? FreeBSD.
jpfr 11y ago
At that rate, you are limited by context changes from userland to the OS. So you must use an event driven approach like nginx or node.js. In contrast to the Apache way of opening a thread per connection. Also, make use of netmap: http://info.iet.unipi.it/~luigi/netmap/ http://info.iet.unipi.it/~luigi/netmap/ That is available for FreeBSD and Linux. 10k messages per sec is doable. But probably not off the shelf.
11y ago

jlgaddis 11y ago

I played with OpenBSD many, many years ago (when I had much more free time) but then didn't touch it for years. After hearing about JETPLOW [0], I decided to replace the Cisco ASA that I had been using for my (fiber) Internet connection at home with an open-source router/firewall. I had a RouterMaxx 1106 [1] (PDF) laying around so I decided to put OpenBSD on it and use that. In short order, I built an OpenBSD virtual machine, used flashrd [2] to build an OpenBSD image I could put on a CompactFlash card, and had it up and running. It just works. About two years later, it's still humming along nicely. The only downtime that I've had is when I upgraded to a new OpenBSD version. I could've minimized somewhat but I use a new CF card every time. Nowadays, I've also got a dedicated laptop running OpenBSD that I use solely for "security critical" stuff for $work. A separate machine stands in between the Internet and our MX hosts and runs OpenBSD's spamd [3] to help keep spam out of our users' mailboxes (N.B.: the number of messages hitting out Barracuda dropped by ~70%, with zero complaints received from any of our users). In addition, we're just beginning a project to basically rebuild our entire server infrastructure and we'll be using OpenBSD for certain functions: remote access (OpenVPN), SSH jump hosts, possibly authoritative DNS, etc. I'm a firm believer in using "the best tool for the job". Most of our servers will be running FreeBSD, but OpenBSD definitely has its place in our environment. [0]: https://nsa.gov1.info/dni/nsa-ant-catalog/firewalls/ https://nsa.gov1.info/dni/nsa-ant-catalog/firewalls/ [1]: http://www.balticnetworks.com/docs/routermaxx%206%20port.pdf http://www.balticnetworks.com/docs/routermaxx%206%20port.pdf [2]: http://www.nmedia.net/flashrd/ http://www.nmedia.net/flashrd/ [3]: http://www.openbsd.org/spamd/ http://www.openbsd.org/spamd/

digitalzombie 11y ago

Slide 3: > Get the last PF (Packet Filter) features last -> latest

jlgaddis 11y ago
> Feedback: contact@ Posting about typo's and such here in the comments helps no one.
- digitalzombie 11y ago
  I just wanted to point out a typo, is there some rule against that? lol, I was considering not posting comments on HN anymore. This is just cake. I don't even know why I try, bye HN thanks for all the fishes.
  - jlgaddis 11y ago
    Comments here, generally, should contribute to or advance the discussion. I'm having trouble seeing how pointing out a typo to other HN readers -- who can't fix it -- benefits any of us. If you felt inclined to point it out to someone, you should have pointed it to the author (who conveniently provided a way to contact him). If we always pointed out every typo or grammatical error in every submission (as users on some other discussion sites tend to do), this comments section would be full of them and the quality of the site would quickly diminish.

blue1 11y ago

I've been using OpenBSD on my firewall for ages, but the fact that patches are only distributed in source form is a giant giant hassle. I understand the reasons for that but it's a level of inconvenience that I find unbearable today. On Debian it's just "apt-get upgrade". On OpenBSD it's so more difficult that I usually end just not patching it at all.

davidgerard 11y ago
I must admit that apt was what converted me from FreeBSD to Ubuntu and convinced me to put up with the Linux kernel. It is so clearly The Right Thing.
- jlgaddis 11y ago
  I don't know how long ago you switched from FreeBSD but are you aware of FreeBSD's (relatively) new `pkg` tool and binary package repositories?
Gracana 11y ago
m:tier provides binary packages for -stable, if you want to run an OpenBSD box with less hassle: https://www.mtier.org/solutions/apps/ https://www.mtier.org/solutions/apps/ They also make binpatch-ng which helps you create binary patches which you can then distribute around to your machines.
- zmyrgel 11y ago
  To add to Gracana's comment. M:Tier provides openup tool which will update your base system and packages to match -stable. That way you don't have to patch and compile your kernel yourself. For trustworthiness of M:Tier, several project developers are employed by M:Tier.

wila 11y ago

Very nice, here's the plain text version instead of slide format. Learn to tame OpenBSD quickly. December 24, 2015 History Forked from NetBSD. Theo De Raadt is the founder and leader of the OpenBSD project. The first OpenBSD release (1.1/CVS) appear on October 18, 1995. Why use OpenBSD ? UNIX-like Get the last version of OpenSSH, OpenSMTPD, OpenNTPD, OpenBGPD, OpenOSPFD, LibreSSL Get the last PF (Packet Filter) features Security focused Operating System Thorough documentation Cryptography Forked from NetBSD. Theo De Raadt is the founder and leader of the OpenBSD project. The first OpenBSD release (1.1/CVS) appear on October 18, 1995. OpenBSD Version numbers Six month release cycle New release is incremented by 0.1 OpenBSD's Flavors -release: The version of OpenBSD shipped every six months -current: Development just after the release -stable: Release, plus patches (support ~ 1 year) Installation Really simple, ready in 5 minutes (KISS). Get more information: http://www.openbsd.org/faq/faq4.html http://www.openbsd.org/faq/faq4.html Networking (Files) File Contain /etc/myname Default hostname. /etc/hostname.if Configuration for each network interface, for example: /etc/hostname.bge0 /etc/mygate Default gateway. /etc/resolv.conf Resolver (DNS). /etc/hosts Known hosts on the network. Networking # See available network cards: /sbin/ifconfig # Restart networking service: /bin/sh /etc/netstart # Set DHCP for 're0' interface, on the fly: /sbin/dhclient re0 Networking (Routing) # Show the routing table (ipv4): /usr/bin/netstat -rnf inet # Show the routing table (ipv6): /usr/bin/netstat -rnf inet6 # Delete all gateway entries from the routing table: /sbin/route -n flush Networking (set at startup) Example 1: configure static IP address for re0. ## file: /etc/hostname.re0 inet 192.168.0.58 255.255.255.0 # For more information, read the manual: hostname.if(5) Don't forget to run 'sh /etc/netstart re0' to apply changes to running system. Example 2: configure DHCP for bge0. ## file: /etc/hostname.bge0 dhcp # For more information, read the manual: hostname.if(5) Don't forget to run 'sh /etc/netstart bge0' to apply changes to running system. Example 3: configure wireless. ## file: /etc/hostname.iwn0 nwid ACCESS_POINT_NAME wpakey THE_SECRET_KEY dhcp # For more information, read the manual: hostname.if(5) Don't forget to run 'sh /etc/netstart iwn0' to apply changes to running system. PF (Packet Filter) Ruleset: /etc/pf.conf Useful commands. # Disable PF /sbin/pfctl -d # Enable PF and load the rules /sbin/pfctl -ef /etc/pf.conf # Just load the rules (apply changes) /sbin/pfctl -f /etc/pf.conf # View the loaded rules /sbin/pfctl -s rules For more information, read the manual: pfctl(8) Pf ruleset sample ## file: /etc/pf.conf # Protect a laptop (allow only ping/ssh from anywhere) set skip on lo set fingerprints "/dev/null" block log all pass in on egress inet proto icmp all icmp-type echoreq pass in on egress inet proto tcp from any to any port ssh pass out # For more information, read the manual: pf.conf(5) Debug PF with tcpdump(8) /usr/sbin/tcpdump -nettti pflog0 Manage users Manually /usr/sbin/user [add|del|info|mod] user_name The interactive way # Add users /usr/sbin/adduser # Remove users /usr/sbin/rmuser For more information, read the manual: adduser(8) Manage Groups File: /etc/group /usr/sbin/group [add|del|info|mod] group_name Members in 'wheel' group can use su(1) to become 'root'. For more information, read the manual: group(8,5) sudo replaced with doas(1) ## file: /etc/doas.conf # Permit the user 'Marc' to reboot the box permit nopass marc as root cmd reboot Marc can now reboot the box: $ doas reboot For more information, read the manual: doas.conf(5) Install Packages export PKG_PATH=http://ftp.openbsd.org/pub/OpenBSD/5.8/packages/amd64/ # OR use 'installpath' variable in /etc/pkg.conf: installpath=http://ftp2.fr.openbsd.org/pub/OpenBSD/%c/packages/%a/ # Add sudo package /usr/sbin/pkg_add sudo Some packages provide configuration and other information in a file located in '/usr/local/share/doc/pkg-readmes'. For more information, read the manual: pkg.conf(5) Packages # List packages installed /usr/sbin/pkg_info # View install-message for a specific package /usr/sbin/pkg_info -M package_name # Remove a Package /usr/sbin/pkg_delete package_name # Delete unused dependencies /usr/sbin/pkg_delete -a For more information, read the manual: packages(7) Install non-free firmware packages /usr/sbin/fw_update Firmware is downloaded from release-specific directories at: http://firmware.openbsd.org/firmware/ http://firmware.openbsd.org/firmware/ Manage daemons, services File: /etc/rc.conf.local /usr/sbin/rcctl [enable|disable|start|stop|reload|restart] daemon_name # Examples /usr/sbin/rcctl enable ipsec /usr/sbin/rcctl enable isakmpd /usr/sbin/rcctl set isakmpd flags -K /usr/sbin/rcctl start isakmpd For more information, read the manual: rcctl(8) Run a script at startup File: /etc/rc.local For more information, read the manual: rc.local(8) Update OpenBSD Any security or reliability fixes can be found at: http://www.openbsd.org/errata.html http://www.openbsd.org/errata.html You can also use the openup tool from M:tier Upgrade OpenBSD To upgrade 5.6 to 5.8, you need to follow instructions: http://www.openbsd.org/faq/upgrade57.html http://www.openbsd.org/faq/upgrade57.html & http://www.openbsd.org/faq/upgrade58.html http://www.openbsd.org/faq/upgrade58.html OpenBSD Filesystem The most important: / Root directory. /home User home directories. /root Default home directory for the superuser. /mnt A temporary mount point. /etc System configuration files and scripts. /etc/examples Example configuration files for base system daemons. /etc/skel (dot) files for new accounts. /etc/signify Key files used for signify(1). /tmp Cleaned after a reboot. /var/tmp Symbolic link to the system /tmp. /var/log Log files. /var/run pid, socket files, utmp, dmesg.boot /var/db Database files. /var/www Configuration files for httpd(8). /usr/local Used for third packages installed. /usr/src BSD and/or local source files. For more information, read the manual: hier(7) OpenBSD Kernels /bsd Pure kernel executable (the operating system loaded into memory at boot-time). /bsd.mp Pure kernel executable for multiprocessor machines. /bsd.rd Installation kernel. The built-in RAM disk contains utilities which can be run without an external file system, so this kernel is useful for limited system maintenance too. Tune the system sysctl(8) get or set kernel state config(8) modify a kernel Need more help ? FAQ: http://www.openbsd.org/faq/ Manual page: afterboot(8) Mailing list: misc@ Presentations & Papers http://www.openbsd.org/papers/ Supporting OpenBSD Donations [1] OpenBSD Foundation [2] OpenBSD Store [3] Thank you. Feedback: contact@ [1] http://www.openbsd.org/donations.html http://www.openbsd.org/donations.html [2] http://www.openbsdfoundation.org/ http://www.openbsdfoundation.org/ [3] http://www.openbsdstore.com/ http://www.openbsdstore.com/

unixhero 11y ago

This is great.

ksec 11y ago

There are different FreeBSD flavours such as PC-BSD which solely focus on PC Desktop usage. I wonder why there are any similar initiative for OpenBSD? I am sure OpenBSD is great fit for Server and Internet based Appliance where security is a prime concern, and doesn't require PC desktop support.