4 ms·

I've never heard of HardenedBSD before. I thought OpenBSD was generally considered the best choice for serious security, but I'd be interesting in reading up mo

I've never heard of HardenedBSD before. I thought OpenBSD was generally considered the best choice for serious security, but I'd be interesting in reading up more on how they compare. As someone that's not an expert on the subject, it would help to get some extra info that explains why certain features are useful for improving security. It's not clear that all these features impact real-world security, but maybe I'm just inexperienced and naive. For example, OpenBSD has "Most of base sandboxed", which seems like a huge deal to me. Knowing how many security issues we've seen in the last 10 to 20 years relating to each feature would help in understanding their impact a lot more. Some immediate questions that popped up from clicking through their pages: Who uses this OS? There's a few company links, but I had a hard time figuring out what some of them even do. Maybe this is a really dumb question, but why FreeBSD over OpenBSD? Finally, are changes being upstreamed? Can we expect these improvements to eventually make it into FreeBSD?

petee 8y ago
Not only sandboxed, but many are pledge(2)'d now also. One downside with OpenBSD is the result of lacking resources - they only support the latest 2 releases (one every 6mo) with only the most critical patches being back ported. I don't believe syspatch(8) changes this, although its certainly easier to apply kernel patches now (please correct me if I'm mistaken) Same with packages - unless you use mTier to get binary updates, security fixes and updates for packages need to be compiled yourself. Not the worst, but depends how much free time you have to keep on it. FreeBSD has a larger ecosystem, and seems to be more performance oriented
- black_knight 8y ago
  On the other hand, upgrading OpenBSD to a new version is just about as easy as updating the packages on any other OS. If not easier! Also, yes, syspatch makes the paching between releases a five seconds task.
  - 4ad 8y ago
    Unfortunately, OpenBSD normally requires booting into a special kernel for upgrading unless you do this: https://www.openbsd.org/faq/upgrade63.html#NoInstKern https://www.openbsd.org/faq/upgrade63.html#NoInstKern. This really makes it hard to use on AWS.
    - asveikau 8y ago
      I agree it is tedious, however, I have found it is pretty simple to put those instructions in a shell script and use it across multiple machines.
      - 4ad 8y ago
        My problem is not that it is tedious, but that it is not a recommended configuration. Stuff might break, it's much less tested, etc.
- krylon 8y ago
  > Not only sandboxed, but many are pledge(2)'d now also. And here I was thinking that pledge(2) was the sandbox. Did I miss something?
  - petee 8y ago
    In a way, just not in the traditional filesystem sense; e.g., jail, chroot. Pledge allows a program to 'promise' which calls it is expected to make. For example, a program promising only to use 'stdio', will SIGABORT if you try to open a socket, fork, exec, or anything not part of the stdio group (as defined by pledge) https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2
floatboth 8y ago
> why FreeBSD over OpenBSD? Because people need things other than security to actually do useful things with computers :) - more ports - more features (ZFS, DTrace, Jails, RCTL/RACCT, netgraph, Capsicum, CloudABI, Linuxulator) - more drivers (lots of >=10GbE NICs, AMD GPUs, evdev for input devices) - more SMP scalability (even NUMA work is ongoing on FreeBSD, while OpenBSD still has lots of things under giant lock AFAIK)

petee 8y ago

Not only sandboxed, but many are pledge(2)'d now also. One downside with OpenBSD is the result of lacking resources - they only support the latest 2 releases (one every 6mo) with only the most critical patches being back ported. I don't believe syspatch(8) changes this, although its certainly easier to apply kernel patches now (please correct me if I'm mistaken) Same with packages - unless you use mTier to get binary updates, security fixes and updates for packages need to be compiled yourself. Not the worst, but depends how much free time you have to keep on it. FreeBSD has a larger ecosystem, and seems to be more performance oriented

black_knight 8y ago
On the other hand, upgrading OpenBSD to a new version is just about as easy as updating the packages on any other OS. If not easier! Also, yes, syspatch makes the paching between releases a five seconds task.
- 4ad 8y ago
  Unfortunately, OpenBSD normally requires booting into a special kernel for upgrading unless you do this: https://www.openbsd.org/faq/upgrade63.html#NoInstKern https://www.openbsd.org/faq/upgrade63.html#NoInstKern. This really makes it hard to use on AWS.
  - asveikau 8y ago
    I agree it is tedious, however, I have found it is pretty simple to put those instructions in a shell script and use it across multiple machines.
    - 4ad 8y ago
      My problem is not that it is tedious, but that it is not a recommended configuration. Stuff might break, it's much less tested, etc.
krylon 8y ago
> Not only sandboxed, but many are pledge(2)'d now also. And here I was thinking that pledge(2) was the sandbox. Did I miss something?
- petee 8y ago
  In a way, just not in the traditional filesystem sense; e.g., jail, chroot. Pledge allows a program to 'promise' which calls it is expected to make. For example, a program promising only to use 'stdio', will SIGABORT if you try to open a socket, fork, exec, or anything not part of the stdio group (as defined by pledge) https://man.openbsd.org/pledge.2 https://man.openbsd.org/pledge.2

floatboth 8y ago

> why FreeBSD over OpenBSD? Because people need things other than security to actually do useful things with computers :) - more ports - more features (ZFS, DTrace, Jails, RCTL/RACCT, netgraph, Capsicum, CloudABI, Linuxulator) - more drivers (lots of >=10GbE NICs, AMD GPUs, evdev for input devices) - more SMP scalability (even NUMA work is ongoing on FreeBSD, while OpenBSD still has lots of things under giant lock AFAIK)