4 ms·

I use OpenBSD because it's a very pragmatic choice for servers. Nearly everything is "off" by default and I can add only the specific things I need, reducing th

I use OpenBSD because it's a very pragmatic choice for servers. Nearly everything is "off" by default and I can add only the specific things I need, reducing the attack surface. Pledge/unveil makes sandboxing my applications very simple. The pf firewall is much easier to use with confidence than iptables. The manpages are great and the system is small relative to most Linux distros, so you can understand how everything works and fits together -- great for infra. It's well-designed and consistent throughout because the kernel, OS, and all core tools are designed by the same people. As of yet, no conntrack-style edge cases requiring days digging through kernel code. :) This of course involves many trade-offs (losing access to common "modern" tech like containers, slower performance) but for my company the trade-offs were justified.

clipradiowallet 5y ago
> The pf firewall is much easier to use with confidence than iptables Tell me more! I cut my teeth on ipchains/iptables back in the early 90's, and feel very familiar with it. That said, I know that doesn't mean it's the best/easiest at all. I've tried to grok Pf once or twice, but never ended up getting very far. I wanted to ask you if you began with Pf, or if you came from something else? More or less, I'm trying to figure out if Pf was difficult for me just because it wasn't my first.
- cpach 5y ago
  FWIW: No Starch Press has a book about PF. I haven’t read it myself, but it might be worth having a look at. https://mwl.io/archives/2232 https://mwl.io/archives/2232
- hellcow 5y ago
  I came from iptables and still have the misfortune of needing to use that in my job. :) My favorite feature of pf is the configuration file, which is a human-readable/writable file which sets the state in a consistent way, rather than iptable's preferred mechanism of using a bunch of CLI commands executed in just the right sequence. I want a guaranteed consistent state when I'm configuring firewalls across a fleet, and pf.conf makes that not only easy to achieve, but the default behavior. Just modify the conf file, copy that to all the boxes, reload pf, and your firewalls are all updated and guaranteed to be in the same state, regardless of whatever state they were in before. You can read the pf.conf file from top to bottom to figure out what's going to happen to any packet. All the rules are included right there. I would just read the man page for pf.conf which gives helpful examples (https://man.openbsd.org/pf.conf.5#EXAMPLES https://man.openbsd.org/pf.conf.5#EXAMPLES) as well as this resource: https://www.openbsd.org/faq/pf/config.html https://www.openbsd.org/faq/pf/config.html.
mrtweetyhack 5y ago
That's one of the things I HATE about Debian. Install a package and it defaults to on at start up.

clipradiowallet 5y ago

> The pf firewall is much easier to use with confidence than iptables Tell me more! I cut my teeth on ipchains/iptables back in the early 90's, and feel very familiar with it. That said, I know that doesn't mean it's the best/easiest at all. I've tried to grok Pf once or twice, but never ended up getting very far. I wanted to ask you if you began with Pf, or if you came from something else? More or less, I'm trying to figure out if Pf was difficult for me just because it wasn't my first.

cpach 5y ago
FWIW: No Starch Press has a book about PF. I haven’t read it myself, but it might be worth having a look at. https://mwl.io/archives/2232 https://mwl.io/archives/2232
hellcow 5y ago
I came from iptables and still have the misfortune of needing to use that in my job. :) My favorite feature of pf is the configuration file, which is a human-readable/writable file which sets the state in a consistent way, rather than iptable's preferred mechanism of using a bunch of CLI commands executed in just the right sequence. I want a guaranteed consistent state when I'm configuring firewalls across a fleet, and pf.conf makes that not only easy to achieve, but the default behavior. Just modify the conf file, copy that to all the boxes, reload pf, and your firewalls are all updated and guaranteed to be in the same state, regardless of whatever state they were in before. You can read the pf.conf file from top to bottom to figure out what's going to happen to any packet. All the rules are included right there. I would just read the man page for pf.conf which gives helpful examples (https://man.openbsd.org/pf.conf.5#EXAMPLES https://man.openbsd.org/pf.conf.5#EXAMPLES) as well as this resource: https://www.openbsd.org/faq/pf/config.html https://www.openbsd.org/faq/pf/config.html.

mrtweetyhack 5y ago

That's one of the things I HATE about Debian. Install a package and it defaults to on at start up.