11 ms·

OpenBSD 6.1 released

223 points by gbrown_ 10y ago

l2dy 10y ago
New syspatch(8) utility for security and reliability binary updates to the base system.
- parfe 10y ago
  http://man.openbsd.org/syspatch.8 http://man.openbsd.org/syspatch.8 Thanks for highlighting this. For me, OpenBSD releases needed so few fixes that keeping the system up to date wrapped around, and become more of a hassle to deal with! I'd get an email and have to manually rebuild something. Watching yet another flood of compiler output started feeling like a huge waste of time, despite only happening once every month or two. For personal use, on debian I set a cron job and forget it. This utility hits the sweet spot to get me running OpenBSD again.
  - adamrt 10y ago
    You may already be familiar with but just in case: https://wiki.debian.org/UnattendedUpgrades https://wiki.debian.org/UnattendedUpgrades You can specify the types of updates to auto install (ie I use security updates only automatically).
    - currysausage 10y ago
      I keep running into a weird issue where my Debian servers won't shut down ("A start job is running for Unattended Upgrades") when I enable unattended upgrades as described at [1]. It is especially weird since my Debian systems are otherwise pretty bare-bones, yet the issue occurs on several of them. The solutions listed on Stack Exchange [2] seem rather hacky. [1] https://wiki.debian.org/UnattendedUpgrades#automatic_call_via_.2Fetc.2Fapt.2Fapt.conf.d.2F20auto-upgrades https://wiki.debian.org/UnattendedUpgrades#automatic_call_vi... [2] http://unix.stackexchange.com/questions/293804/debian-a-start-job-is-running-for-unattended-upgrades http://unix.stackexchange.com/questions/293804/debian-a-star...
      - voltagex_ 10y ago
        That's particularly nasty (and an aspect of systemd that I really don't like). I'm not sure this has been reported before / correctly: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=837155 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=837155 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=719597 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=719597 Maybe give the maintainers a prod with a link to that thread?
- yellowapple 10y ago
  This alone is huge. It addresses a huge pain point (probably the biggest one) in managing security updates between releases.
crasm 10y ago
Hey, vmm supports linux guests now.
- dromenkoning 10y ago
  Before you start wiping your other hypervisors, please note that it does not seem to be mature yet * https://marc.info/?l=openbsd-tech&m=149048271705188&w=2 https://marc.info/?l=openbsd-tech&m=149048271705188&w=2)
i336_ 10y ago
A (highly subjective) selection of things that seemed interesting, sorted from most to least noteworthy in my opinion -- - A lot of code has been removed or simplified to make the transition to multi-processor easier. - printf(3) family of formatting functions now report to syslog when the %s format is used with a NULL pointer. - When sending TCP streams they are locally stored in large mbuf clusters to improve memory management. The maximum TCP send and receive buffer size has been increased from 256KB to 2MB. Note that this results in a different pf(4) OS fingerprint for OpenBSD. - ssh(1): Add a proxy multiplexing mode to ssh(1) inspired by the version in PuTTY by Simon Tatham. This allows a multiplexing client to communicate with the master process using a subset of the SSH packet and channels protocol over a Unix-domain socket, with the main process acting as a proxy that translates channel IDs, etc. This allows multiplexing mode to run on systems that lack file-descriptor passing used by current multiplexing code) and potentially, in conjunction with Unix-domain socket forwarding, with the client and multiplexing master process on different machines. Multiplexing proxy mode may be invoked using "ssh -O proxy ..." - OpenSSH 7.4: Server support for the SSH v.1 protocol has been removed. {NB, note the "server" bit - "client" is not mentioned} - Support for Linux guest VMs. - The performance and concurrency of the malloc(3) family in multi-threaded processes has been improved. - read(2) on directories now fails instead of returning 0. - Support for permitting non-root users to mount(8) filesystems has been removed. - Install sets are now fetched over an HTTPS connection by default when using a mirror that supports it. - For incoming TLS connections syslogd(8) can validate client certificates with a given CA file. - nc(1) now also supports OCSP stapling server side, and will show the stapling information client side. - When log files are rotated, newsyslog(8) writes the creation time in UTC ISO format into the first line. -- - sshd(8): Remove the UseLogin configuration directive and support for having /bin/login manage login sessions. - sshd(8): Add a sshd_config DisableForwarding option that disables X11, agent, TCP, tunnel and Unix domain socket forwarding, as well as anything else we might implement in the future. Like the 'restrict' authorized_keys flag, this is intended to be a simple and future-proof way of restricting an account. - sshd(8), ssh(1): Support the "curve25519-sha256" key exchange method. This is identical to the currently-supported method named "curve25519-sha256@libssh.org". - Deprecate the sshd_config UsePrivilegeSeparation option, thereby making privilege separation mandatory. Privilege separation has been on by default for almost 15 years and sandboxing has been on by default for almost the last five. - SHA512_256 family of functions added to libc. - LibreSSL 2.5.3: Massive update and normalization of manpages, conversion to mandoc format. Many pages were rewritten for clarity and accuracy. Portable doc links are up-to-date with a new conversion tool. -- - Use a hardware register for the thread pointer on arm for improved performance in multi-threaded processes. - New vmm(4)/ vmd(8): Support was partially integrated in 6.0, but disabled. - vmm(4) no longer requires VMX unrestricted guest capability (Nehalem and later CPUs are sufficient). - Support VMs with > 2GB RAM. - vmd(8) uses pledge(2) and the fork+exec model. -- - All shared libraries, all dynamic and static-PIE executables, and ld.so(1) itself use the RELRO ("read-only after relocation") design such that more of the initial data is protected as read-only. - The privileged parent process of syslogd(8) calls exec(2) to reshuffle its random memory layout. - New function recallocarray(3) to reduce the risk of incorrect clearing of memory before and after reallocarray(3). - arm added to the list of archs where the setjmp(3) family of functions apply XOR cookies to stack and return-address values in the jmpbuf. - bioctl(8) now uses bcrypt PBKDF to derive keys for crypto volumes. - Partial UTF-8 line editing support for ksh(1) Vi input mode. - UTF-8 support in column(1). -- Edit: Reordered things a little and grouped things together for legibility
ramshorns 10y ago
It's the first release without an official CD set [1], and OpenBSD was probably one of the last operating systems to provide official installation discs. I wonder if they'll start recommending third-party sellers of installation CDs and DVDs like Debian does [2]. [1] https://www.openbsd.org/orders.html https://www.openbsd.org/orders.html [2] https://www.debian.org/CD/vendors/ https://www.debian.org/CD/vendors/
- justin66 10y ago
  They're down to earth enough that they'll probably recommend people learn how to use a CD burner.
  - protomyth 10y ago
    or learn to create your own bootable USB flash drive https://www.openbsd.org/faq/faq4.html#MkInsMedia https://www.openbsd.org/faq/faq4.html#MkInsMedia
- jasonkostempski 10y ago
  Weren't these mostly just a nice way to contribute to the project and get something tangible in return, or did they not sell the disks at a profit?
  - qeternity 10y ago
    A three pack of 5.9 disks are being sold for $60...so yeah, I'd say so.
  - JoachimSchipper 10y ago
    The disks were apparently stopped because they no longer provided a relevant amount of profit-per-work - making CD's requires a lot of coordination work, and worldwide shipping isn't trivial.
  - nopcode 10y ago
    The image on the CDs was actually different from the .iso's online: It contained the OpenBSD's public singing key.
sspiff 10y ago
> The following platforms were retired: armish, sparc, zaurus. Goodnight, sweet prince. The Sharp Zaurus was where I first ran OpenBSD.
- i336_ 10y ago
  Waaait what?? SPARC is one of the few unencumbered platforms without security bits (Intel ME or AMD PSP) and GPL cores: https://news.ycombinator.com/item?id=11423350 https://news.ycombinator.com/item?id=11423350
  - protomyth 10y ago
    sparc64 is still supported. sparc is the 32-bit port. https://www.openbsd.org/sparc.html https://www.openbsd.org/sparc.html - Discontinued https://www.openbsd.org/sparc64.html https://www.openbsd.org/sparc64.html - Supported
    - i336_ 10y ago
      Oh. Whoops. Thanks heaps.
zdw 10y ago
My personal favorite from the LibreSSL section: Massive update and normalization of manpages, conversion to mandoc format. Many pages were rewritten for clarity and accuracy. Most of OpenSSL's documentation desperately needed attention and was full of extremely minor errors that rendered some parts unintelligible - for example, this confusing single character one that was already fixed in LibreSSL : https://github.com/openssl/openssl/commit/a41815f05e71009d2a5148bd30b70f47186ed66b https://github.com/openssl/openssl/commit/a41815f05e71009d2a...
smhenderson 10y ago
Nice to see the Hyper-V support in there!
hackermailman 10y ago
Go also now supports pledge https://go.googlesource.com/sys/+/8fd966b47dbdd4faa03de0d06e3d733baeb9a1a9%5E!/ https://go.googlesource.com/sys/+/8fd966b47dbdd4faa03de0d06e...
- equalunique 10y ago
  That's good news
protomyth 10y ago
Support for X550 family of 10 Gigabit Ethernet based devices has been added to the ix(4) driver. This is a big help because now I can put in production the SuperMicro E200-8D I bought to replace our older gateway.
- justinclift 10y ago
  Cool, hadn't seen those before. They look super nifty. :)
jordigh 10y ago
Aw, no release song yet: https://www.openbsd.org/lyrics.html#61 https://www.openbsd.org/lyrics.html#61 That's usually my favourite part about new OpenBSD releases. :-)
- protomyth 10y ago
  The page updated with "will be released around April 25"
Something1234 10y ago
Do any VPS providers offer an OpenBSD image?
- vasachi 10y ago
  Vultr does. Last time I looked, 6.0.
  - radimm 10y ago
    or bring your own ISO
- mytec 10y ago
  RootBSD does well. The latest version of OpenBSD is usually available within a week or less. https://www.rootbsd.net/ https://www.rootbsd.net/
- eatonphil 10y ago
  I host a few images for Linode -- including OpenBSD -- and a deploy script [1]. But my OpenBSD is 6.0, not 6.1. [1] https://github.com/eatonphil/linode_deploy_experimental https://github.com/eatonphil/linode_deploy_experimental
- frenkel 10y ago
  Tilaa provides images. We run some ~40 servers with OpenBSD there.
- JoachimSchipper 10y ago
  In addition to what has been said, any provider that provides a (RAM-based) rescue system will likely allow you to install OpenBSD by running the OpenBSD installer in qemu, with the 'real' disks mounted as the VM's disks. This is not a supported or convenient way to do your first OpenBSD install. Having a serial console is not necessary, but recommended (in particular, don't forget to configure <real-hw-interface>0, not the em0 that qemu is likely to offer you.) That said, I've done this before on some Hetzner serverauction (bare-metal) box, and the procedure worked fine (as one would expect.) (Of course, you can run into hardware that OpenBSD doesn't support. Consult the man pages to find what is supported, or just try - server hardware is pretty likely to be supported.)
mrweasel 10y ago
Sadly I don't often get to play with OpenBSD, but every time I do I'm impressed by how coherent an operation system it is. You really get the feeling that the developers care about delivering a system with a unified expression, where everything is meant to be used together. It's not just kernel bundled with a bunch of tools/programs which sort of seem to work together, but not in the same manor. Even FreeBSD have sometimes left me with the impression that the developers don't care about style and just import tools or subsystems at leave it at that, rather than making it feel like it belongs.
- floatboth 10y ago
  Heh, as a FreeBSD user primarily, OpenBSD sometimes feels kinda empty to me. No ZFS, no DTrace, no jails, no mandatory access control, no CloudABI, no Linux compat layer…
  - peatmoss 10y ago
    I agree with both of these sentiments. I think that's because OpenBSD prefers to move more slowly until they can be sure a thing is absolutely right. Innovation in OpenBSD tends to be unsexy and carefully considered. FreeBSD pushes the envelope in a lot of areas to deliver features, with more inherent risk. Both are valid, and result in very different operating systems. These days most of my work can be fit into the OpenBSD envelope, which makes me feel especially good.
  - milcron 10y ago
    OpenBSD does seem empty by comparison, but it's on purpose. ZFS is large and complicated. http://www.tedunangst.com/flak/post/ZFS-on-OpenBSD http://www.tedunangst.com/flak/post/ZFS-on-OpenBSD DTrace would be nice to have, but I believe there are CDDL license concerns. Jails are a way of isolating services so that they cannot do (much) damage to the system in the event they are compromised. The closest alternative in OpenBSD is probably pledge(2), which allows a program to voluntarily renounce the ability to invoke a set of syscalls. There is also chroot if all you need is filesystem virtualization. MAC can be complicated to implement. This comment explained things very well: https://news.ycombinator.com/item?id=8893749 https://news.ycombinator.com/item?id=8893749 > OpenBSD doesn't support a MAC framework because they believe the best approach to security is correctness, rather than trying to achieve security by adding features which results in more complexity, making it more difficult to ensure correctness. A common mistake people make is thinking that OpenBSD's primary goal is security; their primary goal is correctness. This just happens to result in better security more often than not. Linux compat is a similar story. OpenBSD dropped it in the 6.0 release due to complexity and security concerns. I don't know a whole lot about CloudABI.
elchief 10y ago
SNI for httpd! Yay And Postgres 9.6 in packages. Today is a good day
deleted 10y ago
[deleted]
throwawayish 10y ago
Is there a router/firewall distro or administration tool for OpenBSD that's recommendable (e.g. like pfsense without all the enterprisey bloat, or like securityrouter without the licensing stuff)?
- notaplumber 10y ago
  Not a distro, but if you're intimidated by the prospect of editing configuration files using vi(1), you might like Chris Cappuccio's nsh project. http://www.nmedia.net/nsh/ http://www.nmedia.net/nsh/
- Gracana 10y ago
  TrueOS is making rapid improvements to their sysadm tool (client/server system for managing TrueOS machines), iirc (from a recent BSD Now episode) there's work going into improving the firewall management interface. This isn't really a recommendation to switch to TrueOS, but it is a recommendation to keep an eye on their progress. [edit] D'oh, for some reason I read "like pfsense" but missed "for openbsd."
- geggam 10y ago
  vi / emacs ?
- protomyth 10y ago
  What problem are you trying to solve. I use it for a firewall and really only have a couple of files I back up or change.
  - throwawayish 10y ago
    I have a Linux-based router/firewall, but it's all configuration files and stuff. Something with fancy graphs and statistics would be nice :)
    - protomyth 10y ago
      like pfstat http://www.benzedrine.ch/pfstat.html http://www.benzedrine.ch/pfstat.html or something different?
whitepoplar 10y ago
Maybe this isn't the best place to ask this, but how does OpenBSD handle "real world" security these days? Last time I checked, OpenBSD was heavily audited, with emphasis on shipping a secure base system. The problem, to me, is that every running system in the world has many packages installed to make it useful as an e.g. server. What use is a secure base system if installable packages aren't audited to the same degree? Debian handles this by putting all packages (apart from universe) under the maintenance of the Debian Security Team. I would love to use OpenBSD, but want to make sure that the extra effort isn't spent with no real security advantage.
- antod 10y ago
  Universe is an Ubuntu thing. Debian doesn't have that distinction. On Ubuntu, universe is basically packages straight from Debian not directly supported by Ubuntu.
  - whitepoplar 10y ago
    Gotcha. My bad. Too much time spent with Ubuntu lately!
- darkengine 10y ago
  Most (all?) ports than run servers get an unprivileged user all to their own (_dovecot, _nginx, etc). Many (including desktop packages like Chromium) also have pledge() support patched in.
- elchief 10y ago
  There is a lot of functionality in Base that some aren't aware of: ldapd, httpd, IPSec + iked (VPN), pf (firewall, NAT), dhcpd, ntpd, smtpd, snmpd, radiusd, relayd (load balancer), tftpd, sshd, nfs, nsd and unbound (DNS) So, you could run an HTTPS site, with a Perl fastCGI site, sending emails, all out of Base Plus you get privsep'd X (xenocara)
  - smhenderson 10y ago
    Yes, built in pf, dns and dhcp alone make for a nice little home router that I trust more than an off the shelf model. Pretty easy to set up too, config files in OpenBSD are generally straightforward and easy to get right the first time. I definitely found nsd easier to setup than bind.
JdeBP 10y ago
And NetBSD 7.1 came out a few weeks ago, too: https://news.ycombinator.com/item?id=14072284 https://news.ycombinator.com/item?id=14072284

223 points by gbrown_ 10y ago

l2dy 10y ago

New syspatch(8) utility for security and reliability binary updates to the base system.

parfe 10y ago
http://man.openbsd.org/syspatch.8 http://man.openbsd.org/syspatch.8 Thanks for highlighting this. For me, OpenBSD releases needed so few fixes that keeping the system up to date wrapped around, and become more of a hassle to deal with! I'd get an email and have to manually rebuild something. Watching yet another flood of compiler output started feeling like a huge waste of time, despite only happening once every month or two. For personal use, on debian I set a cron job and forget it. This utility hits the sweet spot to get me running OpenBSD again.
- adamrt 10y ago
  You may already be familiar with but just in case: https://wiki.debian.org/UnattendedUpgrades https://wiki.debian.org/UnattendedUpgrades You can specify the types of updates to auto install (ie I use security updates only automatically).
  - currysausage 10y ago
    I keep running into a weird issue where my Debian servers won't shut down ("A start job is running for Unattended Upgrades") when I enable unattended upgrades as described at [1]. It is especially weird since my Debian systems are otherwise pretty bare-bones, yet the issue occurs on several of them. The solutions listed on Stack Exchange [2] seem rather hacky. [1] https://wiki.debian.org/UnattendedUpgrades#automatic_call_via_.2Fetc.2Fapt.2Fapt.conf.d.2F20auto-upgrades https://wiki.debian.org/UnattendedUpgrades#automatic_call_vi... [2] http://unix.stackexchange.com/questions/293804/debian-a-start-job-is-running-for-unattended-upgrades http://unix.stackexchange.com/questions/293804/debian-a-star...
    - voltagex_ 10y ago
      That's particularly nasty (and an aspect of systemd that I really don't like). I'm not sure this has been reported before / correctly: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=837155 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=837155 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=719597 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=719597 Maybe give the maintainers a prod with a link to that thread?
yellowapple 10y ago
This alone is huge. It addresses a huge pain point (probably the biggest one) in managing security updates between releases.

crasm 10y ago

Hey, vmm supports linux guests now.

dromenkoning 10y ago
Before you start wiping your other hypervisors, please note that it does not seem to be mature yet * https://marc.info/?l=openbsd-tech&m=149048271705188&w=2 https://marc.info/?l=openbsd-tech&m=149048271705188&w=2)

i336_ 10y ago

A (highly subjective) selection of things that seemed interesting, sorted from most to least noteworthy in my opinion -- - A lot of code has been removed or simplified to make the transition to multi-processor easier. - printf(3) family of formatting functions now report to syslog when the %s format is used with a NULL pointer. - When sending TCP streams they are locally stored in large mbuf clusters to improve memory management. The maximum TCP send and receive buffer size has been increased from 256KB to 2MB. Note that this results in a different pf(4) OS fingerprint for OpenBSD. - ssh(1): Add a proxy multiplexing mode to ssh(1) inspired by the version in PuTTY by Simon Tatham. This allows a multiplexing client to communicate with the master process using a subset of the SSH packet and channels protocol over a Unix-domain socket, with the main process acting as a proxy that translates channel IDs, etc. This allows multiplexing mode to run on systems that lack file-descriptor passing used by current multiplexing code) and potentially, in conjunction with Unix-domain socket forwarding, with the client and multiplexing master process on different machines. Multiplexing proxy mode may be invoked using "ssh -O proxy ..." - OpenSSH 7.4: Server support for the SSH v.1 protocol has been removed. {NB, note the "server" bit - "client" is not mentioned} - Support for Linux guest VMs. - The performance and concurrency of the malloc(3) family in multi-threaded processes has been improved. - read(2) on directories now fails instead of returning 0. - Support for permitting non-root users to mount(8) filesystems has been removed. - Install sets are now fetched over an HTTPS connection by default when using a mirror that supports it. - For incoming TLS connections syslogd(8) can validate client certificates with a given CA file. - nc(1) now also supports OCSP stapling server side, and will show the stapling information client side. - When log files are rotated, newsyslog(8) writes the creation time in UTC ISO format into the first line. -- - sshd(8): Remove the UseLogin configuration directive and support for having /bin/login manage login sessions. - sshd(8): Add a sshd_config DisableForwarding option that disables X11, agent, TCP, tunnel and Unix domain socket forwarding, as well as anything else we might implement in the future. Like the 'restrict' authorized_keys flag, this is intended to be a simple and future-proof way of restricting an account. - sshd(8), ssh(1): Support the "curve25519-sha256" key exchange method. This is identical to the currently-supported method named "curve25519-sha256@libssh.org". - Deprecate the sshd_config UsePrivilegeSeparation option, thereby making privilege separation mandatory. Privilege separation has been on by default for almost 15 years and sandboxing has been on by default for almost the last five. - SHA512_256 family of functions added to libc. - LibreSSL 2.5.3: Massive update and normalization of manpages, conversion to mandoc format. Many pages were rewritten for clarity and accuracy. Portable doc links are up-to-date with a new conversion tool. -- - Use a hardware register for the thread pointer on arm for improved performance in multi-threaded processes. - New vmm(4)/ vmd(8): Support was partially integrated in 6.0, but disabled. - vmm(4) no longer requires VMX unrestricted guest capability (Nehalem and later CPUs are sufficient). - Support VMs with > 2GB RAM. - vmd(8) uses pledge(2) and the fork+exec model. -- - All shared libraries, all dynamic and static-PIE executables, and ld.so(1) itself use the RELRO ("read-only after relocation") design such that more of the initial data is protected as read-only. - The privileged parent process of syslogd(8) calls exec(2) to reshuffle its random memory layout. - New function recallocarray(3) to reduce the risk of incorrect clearing of memory before and after reallocarray(3). - arm added to the list of archs where the setjmp(3) family of functions apply XOR cookies to stack and return-address values in the jmpbuf. - bioctl(8) now uses bcrypt PBKDF to derive keys for crypto volumes. - Partial UTF-8 line editing support for ksh(1) Vi input mode. - UTF-8 support in column(1). -- Edit: Reordered things a little and grouped things together for legibility

ramshorns 10y ago

It's the first release without an official CD set [1], and OpenBSD was probably one of the last operating systems to provide official installation discs. I wonder if they'll start recommending third-party sellers of installation CDs and DVDs like Debian does [2]. [1] https://www.openbsd.org/orders.html https://www.openbsd.org/orders.html [2] https://www.debian.org/CD/vendors/ https://www.debian.org/CD/vendors/

justin66 10y ago
They're down to earth enough that they'll probably recommend people learn how to use a CD burner.
- protomyth 10y ago
  or learn to create your own bootable USB flash drive https://www.openbsd.org/faq/faq4.html#MkInsMedia https://www.openbsd.org/faq/faq4.html#MkInsMedia
jasonkostempski 10y ago
Weren't these mostly just a nice way to contribute to the project and get something tangible in return, or did they not sell the disks at a profit?
- qeternity 10y ago
  A three pack of 5.9 disks are being sold for $60...so yeah, I'd say so.
- JoachimSchipper 10y ago
  The disks were apparently stopped because they no longer provided a relevant amount of profit-per-work - making CD's requires a lot of coordination work, and worldwide shipping isn't trivial.
- nopcode 10y ago
  The image on the CDs was actually different from the .iso's online: It contained the OpenBSD's public singing key.

sspiff 10y ago

> The following platforms were retired: armish, sparc, zaurus. Goodnight, sweet prince. The Sharp Zaurus was where I first ran OpenBSD.

i336_ 10y ago
Waaait what?? SPARC is one of the few unencumbered platforms without security bits (Intel ME or AMD PSP) and GPL cores: https://news.ycombinator.com/item?id=11423350 https://news.ycombinator.com/item?id=11423350
- protomyth 10y ago
  sparc64 is still supported. sparc is the 32-bit port. https://www.openbsd.org/sparc.html https://www.openbsd.org/sparc.html - Discontinued https://www.openbsd.org/sparc64.html https://www.openbsd.org/sparc64.html - Supported
  - i336_ 10y ago
    Oh. Whoops. Thanks heaps.

zdw 10y ago

My personal favorite from the LibreSSL section: Massive update and normalization of manpages, conversion to mandoc format. Many pages were rewritten for clarity and accuracy. Most of OpenSSL's documentation desperately needed attention and was full of extremely minor errors that rendered some parts unintelligible - for example, this confusing single character one that was already fixed in LibreSSL : https://github.com/openssl/openssl/commit/a41815f05e71009d2a5148bd30b70f47186ed66b https://github.com/openssl/openssl/commit/a41815f05e71009d2a...

smhenderson 10y ago

Nice to see the Hyper-V support in there!

hackermailman 10y ago

Go also now supports pledge https://go.googlesource.com/sys/+/8fd966b47dbdd4faa03de0d06e3d733baeb9a1a9%5E!/ https://go.googlesource.com/sys/+/8fd966b47dbdd4faa03de0d06e...

equalunique 10y ago
That's good news

protomyth 10y ago

Support for X550 family of 10 Gigabit Ethernet based devices has been added to the ix(4) driver. This is a big help because now I can put in production the SuperMicro E200-8D I bought to replace our older gateway.

justinclift 10y ago
Cool, hadn't seen those before. They look super nifty. :)

jordigh 10y ago

Aw, no release song yet: https://www.openbsd.org/lyrics.html#61 https://www.openbsd.org/lyrics.html#61 That's usually my favourite part about new OpenBSD releases. :-)

protomyth 10y ago
The page updated with "will be released around April 25"

Something1234 10y ago

Do any VPS providers offer an OpenBSD image?

vasachi 10y ago
Vultr does. Last time I looked, 6.0.
- radimm 10y ago
  or bring your own ISO
mytec 10y ago
RootBSD does well. The latest version of OpenBSD is usually available within a week or less. https://www.rootbsd.net/ https://www.rootbsd.net/
eatonphil 10y ago
I host a few images for Linode -- including OpenBSD -- and a deploy script [1]. But my OpenBSD is 6.0, not 6.1. [1] https://github.com/eatonphil/linode_deploy_experimental https://github.com/eatonphil/linode_deploy_experimental
frenkel 10y ago
Tilaa provides images. We run some ~40 servers with OpenBSD there.
JoachimSchipper 10y ago
In addition to what has been said, any provider that provides a (RAM-based) rescue system will likely allow you to install OpenBSD by running the OpenBSD installer in qemu, with the 'real' disks mounted as the VM's disks. This is not a supported or convenient way to do your first OpenBSD install. Having a serial console is not necessary, but recommended (in particular, don't forget to configure <real-hw-interface>0, not the em0 that qemu is likely to offer you.) That said, I've done this before on some Hetzner serverauction (bare-metal) box, and the procedure worked fine (as one would expect.) (Of course, you can run into hardware that OpenBSD doesn't support. Consult the man pages to find what is supported, or just try - server hardware is pretty likely to be supported.)

mrweasel 10y ago

Sadly I don't often get to play with OpenBSD, but every time I do I'm impressed by how coherent an operation system it is. You really get the feeling that the developers care about delivering a system with a unified expression, where everything is meant to be used together. It's not just kernel bundled with a bunch of tools/programs which sort of seem to work together, but not in the same manor. Even FreeBSD have sometimes left me with the impression that the developers don't care about style and just import tools or subsystems at leave it at that, rather than making it feel like it belongs.

floatboth 10y ago
Heh, as a FreeBSD user primarily, OpenBSD sometimes feels kinda empty to me. No ZFS, no DTrace, no jails, no mandatory access control, no CloudABI, no Linux compat layer…
- peatmoss 10y ago
  I agree with both of these sentiments. I think that's because OpenBSD prefers to move more slowly until they can be sure a thing is absolutely right. Innovation in OpenBSD tends to be unsexy and carefully considered. FreeBSD pushes the envelope in a lot of areas to deliver features, with more inherent risk. Both are valid, and result in very different operating systems. These days most of my work can be fit into the OpenBSD envelope, which makes me feel especially good.
- milcron 10y ago
  OpenBSD does seem empty by comparison, but it's on purpose. ZFS is large and complicated. http://www.tedunangst.com/flak/post/ZFS-on-OpenBSD http://www.tedunangst.com/flak/post/ZFS-on-OpenBSD DTrace would be nice to have, but I believe there are CDDL license concerns. Jails are a way of isolating services so that they cannot do (much) damage to the system in the event they are compromised. The closest alternative in OpenBSD is probably pledge(2), which allows a program to voluntarily renounce the ability to invoke a set of syscalls. There is also chroot if all you need is filesystem virtualization. MAC can be complicated to implement. This comment explained things very well: https://news.ycombinator.com/item?id=8893749 https://news.ycombinator.com/item?id=8893749 > OpenBSD doesn't support a MAC framework because they believe the best approach to security is correctness, rather than trying to achieve security by adding features which results in more complexity, making it more difficult to ensure correctness. A common mistake people make is thinking that OpenBSD's primary goal is security; their primary goal is correctness. This just happens to result in better security more often than not. Linux compat is a similar story. OpenBSD dropped it in the 6.0 release due to complexity and security concerns. I don't know a whole lot about CloudABI.

elchief 10y ago

SNI for httpd! Yay And Postgres 9.6 in packages. Today is a good day

deleted 10y ago

[deleted]

throwawayish 10y ago

Is there a router/firewall distro or administration tool for OpenBSD that's recommendable (e.g. like pfsense without all the enterprisey bloat, or like securityrouter without the licensing stuff)?

notaplumber 10y ago
Not a distro, but if you're intimidated by the prospect of editing configuration files using vi(1), you might like Chris Cappuccio's nsh project. http://www.nmedia.net/nsh/ http://www.nmedia.net/nsh/
Gracana 10y ago
TrueOS is making rapid improvements to their sysadm tool (client/server system for managing TrueOS machines), iirc (from a recent BSD Now episode) there's work going into improving the firewall management interface. This isn't really a recommendation to switch to TrueOS, but it is a recommendation to keep an eye on their progress. [edit] D'oh, for some reason I read "like pfsense" but missed "for openbsd."
geggam 10y ago
vi / emacs ?
protomyth 10y ago
What problem are you trying to solve. I use it for a firewall and really only have a couple of files I back up or change.
- throwawayish 10y ago
  I have a Linux-based router/firewall, but it's all configuration files and stuff. Something with fancy graphs and statistics would be nice :)
  - protomyth 10y ago
    like pfstat http://www.benzedrine.ch/pfstat.html http://www.benzedrine.ch/pfstat.html or something different?

whitepoplar 10y ago

Maybe this isn't the best place to ask this, but how does OpenBSD handle "real world" security these days? Last time I checked, OpenBSD was heavily audited, with emphasis on shipping a secure base system. The problem, to me, is that every running system in the world has many packages installed to make it useful as an e.g. server. What use is a secure base system if installable packages aren't audited to the same degree? Debian handles this by putting all packages (apart from universe) under the maintenance of the Debian Security Team. I would love to use OpenBSD, but want to make sure that the extra effort isn't spent with no real security advantage.

antod 10y ago
Universe is an Ubuntu thing. Debian doesn't have that distinction. On Ubuntu, universe is basically packages straight from Debian not directly supported by Ubuntu.
- whitepoplar 10y ago
  Gotcha. My bad. Too much time spent with Ubuntu lately!
darkengine 10y ago
Most (all?) ports than run servers get an unprivileged user all to their own (_dovecot, _nginx, etc). Many (including desktop packages like Chromium) also have pledge() support patched in.
elchief 10y ago
There is a lot of functionality in Base that some aren't aware of: ldapd, httpd, IPSec + iked (VPN), pf (firewall, NAT), dhcpd, ntpd, smtpd, snmpd, radiusd, relayd (load balancer), tftpd, sshd, nfs, nsd and unbound (DNS) So, you could run an HTTPS site, with a Perl fastCGI site, sending emails, all out of Base Plus you get privsep'd X (xenocara)
- smhenderson 10y ago
  Yes, built in pf, dns and dhcp alone make for a nice little home router that I trust more than an off the shelf model. Pretty easy to set up too, config files in OpenBSD are generally straightforward and easy to get right the first time. I definitely found nsd easier to setup than bind.

JdeBP 10y ago

And NetBSD 7.1 came out a few weeks ago, too: https://news.ycombinator.com/item?id=14072284 https://news.ycombinator.com/item?id=14072284