4 ms·

Maybe this isn't the best place to ask this, but how does OpenBSD handle "real world" security these days? Last time I checked, OpenBSD was heavily audited, wit

Maybe this isn't the best place to ask this, but how does OpenBSD handle "real world" security these days? Last time I checked, OpenBSD was heavily audited, with emphasis on shipping a secure base system. The problem, to me, is that every running system in the world has many packages installed to make it useful as an e.g. server. What use is a secure base system if installable packages aren't audited to the same degree? Debian handles this by putting all packages (apart from universe) under the maintenance of the Debian Security Team. I would love to use OpenBSD, but want to make sure that the extra effort isn't spent with no real security advantage.

antod 10y ago
Universe is an Ubuntu thing. Debian doesn't have that distinction. On Ubuntu, universe is basically packages straight from Debian not directly supported by Ubuntu.
- whitepoplar 10y ago
  Gotcha. My bad. Too much time spent with Ubuntu lately!
darkengine 10y ago
Most (all?) ports than run servers get an unprivileged user all to their own (_dovecot, _nginx, etc). Many (including desktop packages like Chromium) also have pledge() support patched in.
elchief 10y ago
There is a lot of functionality in Base that some aren't aware of: ldapd, httpd, IPSec + iked (VPN), pf (firewall, NAT), dhcpd, ntpd, smtpd, snmpd, radiusd, relayd (load balancer), tftpd, sshd, nfs, nsd and unbound (DNS) So, you could run an HTTPS site, with a Perl fastCGI site, sending emails, all out of Base Plus you get privsep'd X (xenocara)
- smhenderson 10y ago
  Yes, built in pf, dns and dhcp alone make for a nice little home router that I trust more than an off the shelf model. Pretty easy to set up too, config files in OpenBSD are generally straightforward and easy to get right the first time. I definitely found nsd easier to setup than bind.
- peatmoss 10y ago
  Xenocara may not satisfy performance characteristics the way something like Wayland is. However, Xenocara is pretty awesome in (I believe) being the only X11 server to address the somewhat ugly security model of stuff running as root.
  - krakensden 10y ago
    I think most of the popular Linux distributions have been shipping rootless x11 for a few years now, too. Kernel Mode Setting was the big watershed feature.
    - peatmoss 10y ago
      Interesting, I hadn't known that. Canonical's site indicates that there's some nuance there depending on the video card model though: https://wiki.ubuntu.com/X/Rootless https://wiki.ubuntu.com/X/Rootless Also interesting is that support for rootless (at least in Arch) depends on, or perhaps was facilitated by systemd: https://wiki.archlinux.org/index.php/Xorg#Rootless_Xorg_.28v1.16.29 https://wiki.archlinux.org/index.php/Xorg#Rootless_Xorg_.28v... I don't pay as close attention to Linux developments as I should these days!
  - elchief 10y ago
    OpenBSD and performance are acquaintances, but not really close friends :)
- deleted 10y ago
  [deleted]
microcolonel 10y ago
In addition to the other things people have mentioned, it also now has vmm/vmd. Also, much of the ported software has patches to make better use of OpenBSD mitigations, some make use of pledge(2).

antod 10y ago

Universe is an Ubuntu thing. Debian doesn't have that distinction. On Ubuntu, universe is basically packages straight from Debian not directly supported by Ubuntu.

whitepoplar 10y ago
Gotcha. My bad. Too much time spent with Ubuntu lately!

darkengine 10y ago

Most (all?) ports than run servers get an unprivileged user all to their own (_dovecot, _nginx, etc). Many (including desktop packages like Chromium) also have pledge() support patched in.

elchief 10y ago

There is a lot of functionality in Base that some aren't aware of: ldapd, httpd, IPSec + iked (VPN), pf (firewall, NAT), dhcpd, ntpd, smtpd, snmpd, radiusd, relayd (load balancer), tftpd, sshd, nfs, nsd and unbound (DNS) So, you could run an HTTPS site, with a Perl fastCGI site, sending emails, all out of Base Plus you get privsep'd X (xenocara)

smhenderson 10y ago
Yes, built in pf, dns and dhcp alone make for a nice little home router that I trust more than an off the shelf model. Pretty easy to set up too, config files in OpenBSD are generally straightforward and easy to get right the first time. I definitely found nsd easier to setup than bind.
peatmoss 10y ago
Xenocara may not satisfy performance characteristics the way something like Wayland is. However, Xenocara is pretty awesome in (I believe) being the only X11 server to address the somewhat ugly security model of stuff running as root.
- krakensden 10y ago
  I think most of the popular Linux distributions have been shipping rootless x11 for a few years now, too. Kernel Mode Setting was the big watershed feature.
  - peatmoss 10y ago
    Interesting, I hadn't known that. Canonical's site indicates that there's some nuance there depending on the video card model though: https://wiki.ubuntu.com/X/Rootless https://wiki.ubuntu.com/X/Rootless Also interesting is that support for rootless (at least in Arch) depends on, or perhaps was facilitated by systemd: https://wiki.archlinux.org/index.php/Xorg#Rootless_Xorg_.28v1.16.29 https://wiki.archlinux.org/index.php/Xorg#Rootless_Xorg_.28v... I don't pay as close attention to Linux developments as I should these days!
- elchief 10y ago
  OpenBSD and performance are acquaintances, but not really close friends :)
deleted 10y ago
[deleted]

microcolonel 10y ago

In addition to the other things people have mentioned, it also now has vmm/vmd. Also, much of the ported software has patches to make better use of OpenBSD mitigations, some make use of pledge(2).