10 ms·

An Introduction to OpenBSD [video]

201 points by asicsp 6y ago

brobdingnagians 6y ago
I've grown to love OpenBSD recently (and BSDs in general). I started life using Windows all the time, switched to Linux when I went to university, had a fling with Macs for a few years, then almost exclusive with Linux again for years. In the last several years I discovered the BSDSs, and OpenBSD is now my daily driver. It is so beautifully simple. Configuring a secure server is easy. The config files are consistent. It just works. I highly recommend installing and playing around with it. Like Lisp, even if you don't go permanent with it, the encounter will change how you think and what you expect in terms of elegance from every other system you use.
- 120photo 6y ago
  FreeBSD was the system where I really really learned to use UNIX like systems. I had a home server and followed book "How to Build a Server with FreeBSD 7" and that was a helpful guide. Michael Lucas' "Absolute FreeBSD" and his other BSD books are amazing resources. The FreeBSD documentation is also so well written there is little room for 3rd party books. The main reason I don't use BSD (well other than mac OS and iOS which you can argue are a fork of BSD) and go with Linux is because of work and if I do use Linux on a personal station there is just so much more software and more support. I would recommend any Linux user to go give the BSDs a try and see what a well thought out OS looks like.
  - mikece 6y ago
    "I would recommend any Linux user to go give the BSDs a try and see what a well thought out OS looks like." While I can see where both kernel and userland being built by a single team can have advantages, why is it necessarily the Linux approach to bolting the userland items as needed necessarily a bad thing? If a fictitious userland app such as `hnget` doesn't have good documentation is that a weakness of the linux distro or the makers of `hnget`? Sure, having one team brings the opportunity to leverage peer pressure to improve documentation or even to impose a "system level of docs quality".... but is it really so bad in Linux-land?
    - brobdingnagians 6y ago
      One example I like is the FreeBSD security page. It gives a nice overview of different things to think about and configure in relation to security. It brings a lot of information about separate systems into one conceptual place, which helps know if you are missing something obvious.
    - massysett 6y ago
      As a user the end result is the same: my system has this thing ‘hnget’ that I need to use, yet it’s not documented. I don’t care whose fault it is. Linux land can certainly be bad in the sense that many distributors don’t document the system. They just bolt stuff together, sometimes with multiple layers of bolting (Distro X is based on Ubuntu that’s based on Debian, so which method am I “supposed to” use? If I use this new shiny package manager front end, will that interfere with the old command-line tool that works on Debian?) For this reason I shy away from derivative distributions. But even then, the Linux user land and kernel are not models of superior documentation.
    - linguae 6y ago
      I've been using FreeBSD for servers and as an occasional daily driver for the past 16 years. Linux is a great operating system that I use for my work and also in situations where I have Linux hardware support but not for FreeBSD (I prefer Linux for laptops over FreeBSD). It's not a bad thing that Linux's core utilities are not developed alongside the kernel; in fact, part of what makes the GNU toolkit so flexible is the fact that it runs on a variety of Unix-like operating systems instead of just Linux, a great thing for BSD users as well as users of lesser-used Unix-like operating systems like Minix, Solaris, and GNU Hurd. But with that being said, what I love about FreeBSD is that the core utilities are very well documented. I believe the quality of FreeBSD's documentation is an artifact of the BSDs long-standing culture of providing high-quality documentation; some of the man pages have origins in AT&T Unix and the days of BSD up to 4.4BSD, but it's been updated over all these years to reflect changes. The AT&T Unix versions and the Berkeley-developed BSDs always had wonderful documentation, much of it written by Unix legends like Ken Thompson, Dennis Ritchie, Bill Joy, Marshall Kirk McKusick, and others. Even the post-Berkeley documentation still captures this spirit. Plus, I happen to prefer man pages to the info pages that GNU utilities tend to prefer since I can never remember the keys used for navigating the hyperlinks found in info pages. I also like how FreeBSD ships with some traditional supplementary Unix documents, which have helpful tutorials for classic Unix tools. The FreeBSD handbook is very well written, and it can be easily downloaded. For people who sometimes need to do kernel hacking, there's Marshall Kirk McKusick et al.'s wonderfully written "The Design and Implementation of the FreeBSD Operating System, Second Edition," which I have a copy of. I find the source code of FreeBSD easier to read than the source code of Linux. FreeBSD reminds me a lot of PostgreSQL, another high-quality open source project with excellent documentation that happens to also derive from UC Berkeley.
- valarauko 6y ago
  I've been on linux for many years, and have been growing curious about BSDs, but confused over the various BSDs variants. I'm still unclear of how exactly BSDs are superior to linux. Could you shine a light on the different BSDS, and perhaps a recommendation?
  - owenmarshall 6y ago
    The biggest thing you'll find over Linux (IMO) is the advantage of having one team build things. Linux the OS is actually the Linux kernel + userspace software, and those pieces are built independently. With the BSDs, the team is building the userspace and kernel together. You end up with a small, well-designed system that fits together nicely. As an example, OpenBSD gives you a HTTP server, load balancer, and firewall right out of the box – and they all make use of pledge(2) and privsep and other security designs in a very consistent manner. And the documentation for the whole system is top-notch: you can read their manpages and not have to resort to Googling things. I'd recommend you spin up OpenBSD on a VPC (try Vultr or DigitalOcean) and kick it around.
    - sn 6y ago
      One thing we couldn't figure out from the documentation is encrypted root with serial console: https://prgmr.com/blog/openbsd/2020/05/08/openbsd-encrypted-root.html https://prgmr.com/blog/openbsd/2020/05/08/openbsd-encrypted-... I have gotten it on someone's TODO list to upstream that work though it hasn't happened yet.
    - danieldk 6y ago
      Linux the OS is actually the Linux kernel + userspace software, and those pieces are built independently. With the BSDs, the team is building the userspace and kernel together. You end up with a small, well-designed system that fits together nicely. That's a blessing and a curse. While the BSD approach leads to more consistency, the Linux approach allows the ecosystem to move faster. In BSD projects, progress is often hampered, because proposals to drastically change subsystems is met with inertia, and then nothing happens. In Linux the inertia is there, but nobody stops people from implementing an alternative implementation, because the pieces are relatively decoupled, and then convince distributions to adopt the replacement. This is why Linux ecosystem went from System V init -> Upstart -> systemd. Similarly, X11 -> Mir/Wayland -> Wayland (although Wayland could be adopted as a default on BSDs as well). Or chroot -> LXC -> Docker (or more generally cgroups + user namespaces). Although controversial (every change leads to some controversy), technically systemd and Wayland are substantial improvements to their predecessors. Of course, the downside is that the integration is left to the distributors and the documentation may be inconsistent or uneven. --- Another thing to take into accounts when looking at BSDs is that the BSDs have far fewer contributors than the Linux ecosystem. So, you might find that it lacks basic things such as 802.11ac support (though there has recently been movement in FreeBSD again) or support for the newest GPUs.
- victorgama 6y ago
  Out of curiosity: what do you work with? Asking since I’d like to move to OpenBSD as well, but several tools are not available. For instance, the company I work for relies heavily on Docker. :(
  - brobdingnagians 6y ago
    Yeah, that has been an issue at times. My team uses Docker, luckily it is only a few applications and it was easy to set them up to just be run directly. For heavy Docker usage though, that could be a deal breaker. I also had to custom compile the pty4j and purejavacomm libraries to get the jetbrains IDEs to work to my satisfaction.
  - phone8675309 6y ago
    Not OP, but daily OpenBSD user. My desktop machine runs OpenBSD (after getting off of OS X) but I have a few headless Linux machines for things that only run on it.
- deleted 6y ago
  [deleted]
gbrown_ 6y ago
OpenBSD does not do KASLR as far as I'm aware.
- nargek 6y ago
  OpenBSD does have Kernel Address Randomized Link (KARL) since 6.2 [1]. [1]https://www.openbsd.org/62.html https://www.openbsd.org/62.html
  - gbrown_ 6y ago
    Yes which the linked piece covers but it also says OpenBSD does both KASLR and KARL.
    - nargek 6y ago
      Sorry, i bookmarked the link for later. I think you are right then.
    - brynet 6y ago
      Yes the author is incorrect in their slides, OpenBSD has userland ASLR, it uses both PIE by default and also created static-PIE, which are self-relocating executables. There's also been a considerable effort to convert OpenBSD's already privsep daemons to the fork+exec model, most having been completed, expanding upon initial work done on sshd over 16 years ago.
rawoke083600 6y ago
OpenBSD is brilliant and I'm sure it runs on a multitude of network hardware, that you don't even know you encounter on a daily basis ! Given that this is HN, many of the readers might already know the "story" and I'm sure it has be told many many times... but I will tell it anyway since it's so funny (to me at least). Also we probably should not admire or approve of this sorta behaviour. Right so disclaimer out of the way, the story goes that: Someone once incurred Theo de Raadt(Main guy at OpenBSD) ire by asking the wrong question at the wrong time, and Theo de Raadt hacked his router and remotely remapped his keyboard. Now that is funny - Wrong but funny:)
- djxfade 6y ago
  That sounds a bit too good to be true. You got any tangible source for this?
  - rawoke083600 6y ago
    I read it on mailing list yearrss ago, and repeated on my blogs and sites over the years, I'm obvious not helping if it is just an urban-myth, hence the "story-air-quotes". I still get a kick out of just the idea though :) If one googles "theo de raadt and keyboard remap" there a numerous reports - but I agree it's not credible enough. Lol if one google "LochNess Monster" you also get lots of hits and sites reporting it to be so. Just a "maybe-urban-myth" to lighten the Monday-Bluezz :) [0] https://www.trollaxor.com/2010/06/why-i-left-openbsd.html https://www.trollaxor.com/2010/06/why-i-left-openbsd.html
    - juped 6y ago
      "trollaxor" is a joke site (with various takes on the "theo bad man" schtick posted therein)
- RedShift1 6y ago
  This just sounds like a Chuck Norris quote. Except Chuck Norris doesn't need to hack routers to remap keyboards, keyboards remap themselves when they see Chuck Norris.
traceroute66 6y ago
OpenBSD is great. Except for Theo. If you question Theo on anything, even something reasonable, you will incur his wrath, and that of his henchmen (the clique of project devs that surround him). Case in point is the whole "Funding our Electricity" thing: (a) Theo insists on keeping their test lab in his own house (b) Theo insists on supporting obscure archaic architectures (c) Theo claims on list to have incurred 20,000 dollars of electricity that year (d) Theo refuses to answer reasonable questions, such as cost breakdown, why the equipment can't be moved elsewhere, why the insistent on obscure architectures. Or when he does answer its essentially "my way or the highway". OpenBSD is great, no doubt about that. But the whole Theo & friends clique needs to change.
- tharne 6y ago
  I don't think you can easily separate a great project like OpenBSD from the culture that produced it. OpenBSD is what it is precisely because Theo and co. are ruthlessly uncompromising with their vision and their principles, and don't suffer fools. That may for some unpleasant email exchanges and hurt feelings, but OpenBSD is a great and unique OS and has been around for decades.
  - mumblemumble 6y ago
    Perhaps. But it's also difficult to separate one's donations from a desire that those funds are going places where they will be handled appropriately.
    - brynet 6y ago
      The OpenBSD Foundation tells you how your funds are going to be used, if you instead choose to donate to the project, then you're donating to Theo and it is entirely his discretion how he chooses to spend it on the project. Donations with strings attached are not donations. https://www.openbsdfoundation.org/activities.html https://www.openbsdfoundation.org/activities.html vs. https://www.openbsd.org/donations.html https://www.openbsd.org/donations.html
- ainar-g 6y ago
lsofzz 6y ago
OpenBSD is also a great choice for a firewall too https://www.openbsd.org/faq/pf/ https://www.openbsd.org/faq/pf/
- brobdingnagians 6y ago
  Highly recommend "The Book of PF" for anyone looking into OpenBSD as a firewall. Lots of nice information in one place and helps showcase how fantastic pf is.
protomyth 6y ago
I use it for our network services except for file storage or required OS of a software vendor[1]. It is supper easy to setup and now the upgrade story is much easier, it really is a minimum maintenance OS. Regenerating the system and putting back the files needed to run is very straightforward. 1) I once thought enterprise software was the worst imaginable, but nothing compares to government required software that only runs on Windows 2003.
jayp1418 6y ago
I think presentation got one thing wrong. npf (NetBSD's pf) is not coded on based on OpenBSD's pf.
- rjsw 6y ago
  NetBSD used to contain an old copy of pf as well as ipf and npf.

201 points by asicsp 6y ago

I've grown to love OpenBSD recently (and BSDs in general). I started life using Windows all the time, switched to Linux when I went to university, had a fling with Macs for a few years, then almost exclusive with Linux again for years. In the last several years I discovered the BSDSs, and OpenBSD is now my daily driver. It is so beautifully simple. Configuring a secure server is easy. The config files are consistent. It just works. I highly recommend installing and playing around with it. Like Lisp, even if you don't go permanent with it, the encounter will change how you think and what you expect in terms of elegance from every other system you use.

120photo 6y ago
FreeBSD was the system where I really really learned to use UNIX like systems. I had a home server and followed book "How to Build a Server with FreeBSD 7" and that was a helpful guide. Michael Lucas' "Absolute FreeBSD" and his other BSD books are amazing resources. The FreeBSD documentation is also so well written there is little room for 3rd party books. The main reason I don't use BSD (well other than mac OS and iOS which you can argue are a fork of BSD) and go with Linux is because of work and if I do use Linux on a personal station there is just so much more software and more support. I would recommend any Linux user to go give the BSDs a try and see what a well thought out OS looks like.
- mikece 6y ago
  "I would recommend any Linux user to go give the BSDs a try and see what a well thought out OS looks like." While I can see where both kernel and userland being built by a single team can have advantages, why is it necessarily the Linux approach to bolting the userland items as needed necessarily a bad thing? If a fictitious userland app such as `hnget` doesn't have good documentation is that a weakness of the linux distro or the makers of `hnget`? Sure, having one team brings the opportunity to leverage peer pressure to improve documentation or even to impose a "system level of docs quality".... but is it really so bad in Linux-land?
  - brobdingnagians 6y ago
    One example I like is the FreeBSD security page. It gives a nice overview of different things to think about and configure in relation to security. It brings a lot of information about separate systems into one conceptual place, which helps know if you are missing something obvious.
  - massysett 6y ago
    As a user the end result is the same: my system has this thing ‘hnget’ that I need to use, yet it’s not documented. I don’t care whose fault it is. Linux land can certainly be bad in the sense that many distributors don’t document the system. They just bolt stuff together, sometimes with multiple layers of bolting (Distro X is based on Ubuntu that’s based on Debian, so which method am I “supposed to” use? If I use this new shiny package manager front end, will that interfere with the old command-line tool that works on Debian?) For this reason I shy away from derivative distributions. But even then, the Linux user land and kernel are not models of superior documentation.
  - linguae 6y ago
    I've been using FreeBSD for servers and as an occasional daily driver for the past 16 years. Linux is a great operating system that I use for my work and also in situations where I have Linux hardware support but not for FreeBSD (I prefer Linux for laptops over FreeBSD). It's not a bad thing that Linux's core utilities are not developed alongside the kernel; in fact, part of what makes the GNU toolkit so flexible is the fact that it runs on a variety of Unix-like operating systems instead of just Linux, a great thing for BSD users as well as users of lesser-used Unix-like operating systems like Minix, Solaris, and GNU Hurd. But with that being said, what I love about FreeBSD is that the core utilities are very well documented. I believe the quality of FreeBSD's documentation is an artifact of the BSDs long-standing culture of providing high-quality documentation; some of the man pages have origins in AT&T Unix and the days of BSD up to 4.4BSD, but it's been updated over all these years to reflect changes. The AT&T Unix versions and the Berkeley-developed BSDs always had wonderful documentation, much of it written by Unix legends like Ken Thompson, Dennis Ritchie, Bill Joy, Marshall Kirk McKusick, and others. Even the post-Berkeley documentation still captures this spirit. Plus, I happen to prefer man pages to the info pages that GNU utilities tend to prefer since I can never remember the keys used for navigating the hyperlinks found in info pages. I also like how FreeBSD ships with some traditional supplementary Unix documents, which have helpful tutorials for classic Unix tools. The FreeBSD handbook is very well written, and it can be easily downloaded. For people who sometimes need to do kernel hacking, there's Marshall Kirk McKusick et al.'s wonderfully written "The Design and Implementation of the FreeBSD Operating System, Second Edition," which I have a copy of. I find the source code of FreeBSD easier to read than the source code of Linux. FreeBSD reminds me a lot of PostgreSQL, another high-quality open source project with excellent documentation that happens to also derive from UC Berkeley.
valarauko 6y ago
I've been on linux for many years, and have been growing curious about BSDs, but confused over the various BSDs variants. I'm still unclear of how exactly BSDs are superior to linux. Could you shine a light on the different BSDS, and perhaps a recommendation?
- owenmarshall 6y ago
  The biggest thing you'll find over Linux (IMO) is the advantage of having one team build things. Linux the OS is actually the Linux kernel + userspace software, and those pieces are built independently. With the BSDs, the team is building the userspace and kernel together. You end up with a small, well-designed system that fits together nicely. As an example, OpenBSD gives you a HTTP server, load balancer, and firewall right out of the box – and they all make use of pledge(2) and privsep and other security designs in a very consistent manner. And the documentation for the whole system is top-notch: you can read their manpages and not have to resort to Googling things. I'd recommend you spin up OpenBSD on a VPC (try Vultr or DigitalOcean) and kick it around.
  - sn 6y ago
    One thing we couldn't figure out from the documentation is encrypted root with serial console: https://prgmr.com/blog/openbsd/2020/05/08/openbsd-encrypted-root.html https://prgmr.com/blog/openbsd/2020/05/08/openbsd-encrypted-... I have gotten it on someone's TODO list to upstream that work though it hasn't happened yet.
  - danieldk 6y ago
    Linux the OS is actually the Linux kernel + userspace software, and those pieces are built independently. With the BSDs, the team is building the userspace and kernel together. You end up with a small, well-designed system that fits together nicely. That's a blessing and a curse. While the BSD approach leads to more consistency, the Linux approach allows the ecosystem to move faster. In BSD projects, progress is often hampered, because proposals to drastically change subsystems is met with inertia, and then nothing happens. In Linux the inertia is there, but nobody stops people from implementing an alternative implementation, because the pieces are relatively decoupled, and then convince distributions to adopt the replacement. This is why Linux ecosystem went from System V init -> Upstart -> systemd. Similarly, X11 -> Mir/Wayland -> Wayland (although Wayland could be adopted as a default on BSDs as well). Or chroot -> LXC -> Docker (or more generally cgroups + user namespaces). Although controversial (every change leads to some controversy), technically systemd and Wayland are substantial improvements to their predecessors. Of course, the downside is that the integration is left to the distributors and the documentation may be inconsistent or uneven. --- Another thing to take into accounts when looking at BSDs is that the BSDs have far fewer contributors than the Linux ecosystem. So, you might find that it lacks basic things such as 802.11ac support (though there has recently been movement in FreeBSD again) or support for the newest GPUs.
victorgama 6y ago
Out of curiosity: what do you work with? Asking since I’d like to move to OpenBSD as well, but several tools are not available. For instance, the company I work for relies heavily on Docker. :(
- brobdingnagians 6y ago
  Yeah, that has been an issue at times. My team uses Docker, luckily it is only a few applications and it was easy to set them up to just be run directly. For heavy Docker usage though, that could be a deal breaker. I also had to custom compile the pty4j and purejavacomm libraries to get the jetbrains IDEs to work to my satisfaction.
- phone8675309 6y ago
  Not OP, but daily OpenBSD user. My desktop machine runs OpenBSD (after getting off of OS X) but I have a few headless Linux machines for things that only run on it.
deleted 6y ago
[deleted]

gbrown_ 6y ago

OpenBSD does not do KASLR as far as I'm aware.

nargek 6y ago
OpenBSD does have Kernel Address Randomized Link (KARL) since 6.2 [1]. [1]https://www.openbsd.org/62.html https://www.openbsd.org/62.html
- gbrown_ 6y ago
  Yes which the linked piece covers but it also says OpenBSD does both KASLR and KARL.
  - nargek 6y ago
    Sorry, i bookmarked the link for later. I think you are right then.
  - brynet 6y ago
    Yes the author is incorrect in their slides, OpenBSD has userland ASLR, it uses both PIE by default and also created static-PIE, which are self-relocating executables. There's also been a considerable effort to convert OpenBSD's already privsep daemons to the fork+exec model, most having been completed, expanding upon initial work done on sshd over 16 years ago.

rawoke083600 6y ago

OpenBSD is brilliant and I'm sure it runs on a multitude of network hardware, that you don't even know you encounter on a daily basis ! Given that this is HN, many of the readers might already know the "story" and I'm sure it has be told many many times... but I will tell it anyway since it's so funny (to me at least). Also we probably should not admire or approve of this sorta behaviour. Right so disclaimer out of the way, the story goes that: Someone once incurred Theo de Raadt(Main guy at OpenBSD) ire by asking the wrong question at the wrong time, and Theo de Raadt hacked his router and remotely remapped his keyboard. Now that is funny - Wrong but funny:)

djxfade 6y ago
That sounds a bit too good to be true. You got any tangible source for this?
- rawoke083600 6y ago
  I read it on mailing list yearrss ago, and repeated on my blogs and sites over the years, I'm obvious not helping if it is just an urban-myth, hence the "story-air-quotes". I still get a kick out of just the idea though :) If one googles "theo de raadt and keyboard remap" there a numerous reports - but I agree it's not credible enough. Lol if one google "LochNess Monster" you also get lots of hits and sites reporting it to be so. Just a "maybe-urban-myth" to lighten the Monday-Bluezz :) [0] https://www.trollaxor.com/2010/06/why-i-left-openbsd.html https://www.trollaxor.com/2010/06/why-i-left-openbsd.html
  - juped 6y ago
    "trollaxor" is a joke site (with various takes on the "theo bad man" schtick posted therein)
RedShift1 6y ago
This just sounds like a Chuck Norris quote. Except Chuck Norris doesn't need to hack routers to remap keyboards, keyboards remap themselves when they see Chuck Norris.

traceroute66 6y ago

OpenBSD is great. Except for Theo. If you question Theo on anything, even something reasonable, you will incur his wrath, and that of his henchmen (the clique of project devs that surround him). Case in point is the whole "Funding our Electricity" thing: (a) Theo insists on keeping their test lab in his own house (b) Theo insists on supporting obscure archaic architectures (c) Theo claims on list to have incurred 20,000 dollars of electricity that year (d) Theo refuses to answer reasonable questions, such as cost breakdown, why the equipment can't be moved elsewhere, why the insistent on obscure architectures. Or when he does answer its essentially "my way or the highway". OpenBSD is great, no doubt about that. But the whole Theo & friends clique needs to change.

tharne 6y ago
I don't think you can easily separate a great project like OpenBSD from the culture that produced it. OpenBSD is what it is precisely because Theo and co. are ruthlessly uncompromising with their vision and their principles, and don't suffer fools. That may for some unpleasant email exchanges and hurt feelings, but OpenBSD is a great and unique OS and has been around for decades.
- mumblemumble 6y ago
  Perhaps. But it's also difficult to separate one's donations from a desire that those funds are going places where they will be handled appropriately.
  - brynet 6y ago
    The OpenBSD Foundation tells you how your funds are going to be used, if you instead choose to donate to the project, then you're donating to Theo and it is entirely his discretion how he chooses to spend it on the project. Donations with strings attached are not donations. https://www.openbsdfoundation.org/activities.html https://www.openbsdfoundation.org/activities.html vs. https://www.openbsd.org/donations.html https://www.openbsd.org/donations.html
ainar-g 6y ago

lsofzz 6y ago

OpenBSD is also a great choice for a firewall too https://www.openbsd.org/faq/pf/ https://www.openbsd.org/faq/pf/

brobdingnagians 6y ago
Highly recommend "The Book of PF" for anyone looking into OpenBSD as a firewall. Lots of nice information in one place and helps showcase how fantastic pf is.

protomyth 6y ago

I use it for our network services except for file storage or required OS of a software vendor[1]. It is supper easy to setup and now the upgrade story is much easier, it really is a minimum maintenance OS. Regenerating the system and putting back the files needed to run is very straightforward. 1) I once thought enterprise software was the worst imaginable, but nothing compares to government required software that only runs on Windows 2003.

jayp1418 6y ago

I think presentation got one thing wrong. npf (NetBSD's pf) is not coded on based on OpenBSD's pf.

rjsw 6y ago
NetBSD used to contain an old copy of pf as well as ipf and npf.