3 ms·

> What every IT person needs to know about OpenBSD Unixy goodness. Secure. Consistent. Excellent documentation. Makes a great firewall, vpn, and/or router. Ma

> What every IT person needs to know about OpenBSD Unixy goodness. Secure. Consistent. Excellent documentation. Makes a great firewall, vpn, and/or router. Makes a great desktop as long as you can live within the open bsd package/port ecosystem, which includes much/most, but not all, open source / linux software [0], and choose compatible hardware, thinkpads when in doubt. A handful of years into openbsd on a couple thinkpads and a vps and I'm very happy. I'm a tech guy who prioritizes simplicity, security, and minimizing surprises. More of a minimalist than I used to be. Openbsd documentation is fantastic [1]. I've had less upgrade problems over the years than with freebsd and linux systems I've run in the past. I've got scripts that configure everything on my systems, via shell commands and /etc files. Unlike a windows pc or an android phone I very much feel like this is MY computer. Openbsd might not be for those who have to have their netflix drm or steam or adobe icloud stuff on the same pc they use as their general purpose personal computer. Depends on your priorities. [0] http://ports.su/ http://ports.su/ [1] https://www.openbsd.org/faq/index.html https://www.openbsd.org/faq/index.html

accrual 5y ago
Would you be willing to share your setup scripts or even just some hints on their structure? On a fresh install I find myself always copying a couple dot files, editing a couple /etc files, etc., knowing there must be a better way. :)
- mikem170 5y ago
  I started off with a shell script full of comments with quick step-by-step notes to myself on how I setup my laptop. Here's a sample: #!/bin/sh # TODO: install openbsd, from prepared usb or ethernet # full disk encryption, openbsd.org/faq/faq14.html#softraid # accept install defaults, including disk layout # update operating system (if needed) and firmware if [ "`syspatch -c`" ]; then syspatch; fi fw_update # update /etc/ntpd.conf, remove google entries sed -i '/google/d' /etc/ntpd.conf These scripts start as a lot of TODO entries that I'd have to manually follow when setting up a new pc. But over time I replace my TODO notes with actual shell code. Nothing wrong with having to manually do a few steps if you don't have time to automate everything. I never planned on trying to automate the bsd install to encrypted disk, for example. For quite a while mine seemed mostly manual, copy pasting shell commands for some of the steps. Now it's mostly automated, with a few manual callouts. It's easy to put the steps in order, and natural to configure the operating system before your home directory. I ended up splitting these into separate scripts, then eventually smaller component scripts in directories. So now I have a master ~/bin/setup/setup.sh script that autodetects the system (based on vps ip or laptop ethernet mac) and calls the correct componenant scripts, like pc/audio.sh, pc/pkg_add.sh, openbsd/etc_myname.sh, openbsd/etc_xenodm.sh, home/ dot_fvwmrc.sh, and so on. Each of these component shell scripts can update config files, enable daemons, copy things, etc. I made functions for some of these things. I can pass arguments to component scripts or set environment variables, for things like ip addresses and usernames. Minimally you need to be sure the automated scripts are idempotent, meaning you can run them repeatedly without harm. Things like trapping errors and testing in qmenu would be good. A lot of it is easy, copying in a file or appending to a file, running a chmod or rcctl command, etc. It's nice to have this master copy of all my config. When I want to change something I edit the appropriate setup script then re-run it to push the change.
Seirdy 5y ago
I love obsd and agree with all your points...except security. A Whonix developer and GrapheneOS contributor wrote this up better than I can: https://madaidans-insecurities.github.io/openbsd.html https://madaidans-insecurities.github.io/openbsd.html
- mikem170 5y ago
  Thanks for that link. I'll have to dig into a few of those things more, ROP is something I have not bumped into before. Comparisons to Windows/Mac/Chrome/Android security are kind of a moot point for me, given that they are tools of corporate surveillance capitalism. I wondered how linux stacked up, outside of the mentioned MAC capabilities, but the article was more focused on openbsd. How much does MAC buy if I don't notice that I've outgrown the granularity of normal file system permissions? I know that does often come up in environments with more users. Do you think openbsd has worse security than normal linux? (not selinux) My next planned security update is to attempt to separate apps that need network access from those that do not. I'm still brainstorming on how to best do this, maybe leveraging the ability of the pf firewall to allow/deny traffic by user account.
  - Seirdy 5y ago
    The author also wrote about Linux's lack of exploit mitigations and sandboxing: https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html Android's surveillance is mostly in stock android and other derivatives, but not in AOSP; AOSP has no Play services. GrapheneOS is a downstream ROM that adds further hardening and privacy enhancements. I view MAC as quite essential. On top of that, Clang on Linux supports sanitizers like CFI, safe-stack/shadow-call-stack, and a few others; check the Clang docs for more info. Linux supports dm-verity which can help ensure the integrity of the base system, and can combine with UEFI Secure Boot for getting some of the way towards a fully verified boot. I also don't know of a USBGuard- or kloak-equivalent for OpenBSD. USBGuard is essential for physical security regarding removable media, and kloak anonymizes keystroke input. There is no OpenBSD web browser that's remotely secure; they all use Linux, macOS, and Windows sandboxing/hardening measures. I never enable JS in obsd; if I absolutely must, I run the browser in a VM and disable JIT.
armitron 5y ago
It’s not at all competitive with Linux performance-wise and also lacks observability (eBPF). These are strong reasons to pass.
- mikem170 5y ago
  Openbsd is very competitive with Linux performance wise for a thinkpad user. Runs plenty fast enough on my vps, also. I haven't run any benchmarks but I've never waited on anything. I believe you that linux is faster, but it's speed that I don't need. I never heard of eBPF before. Is that like dtrace? I gather there was some working on adding that to bsd. I haven't missed not having either of those. Maybe more for lower level coding? The simplicity, consistency, and documentation are a bigger deal to me. I realize needs and preferences vary.

accrual 5y ago

Would you be willing to share your setup scripts or even just some hints on their structure? On a fresh install I find myself always copying a couple dot files, editing a couple /etc files, etc., knowing there must be a better way. :)

mikem170 5y ago
I started off with a shell script full of comments with quick step-by-step notes to myself on how I setup my laptop. Here's a sample: #!/bin/sh # TODO: install openbsd, from prepared usb or ethernet # full disk encryption, openbsd.org/faq/faq14.html#softraid # accept install defaults, including disk layout # update operating system (if needed) and firmware if [ "`syspatch -c`" ]; then syspatch; fi fw_update # update /etc/ntpd.conf, remove google entries sed -i '/google/d' /etc/ntpd.conf These scripts start as a lot of TODO entries that I'd have to manually follow when setting up a new pc. But over time I replace my TODO notes with actual shell code. Nothing wrong with having to manually do a few steps if you don't have time to automate everything. I never planned on trying to automate the bsd install to encrypted disk, for example. For quite a while mine seemed mostly manual, copy pasting shell commands for some of the steps. Now it's mostly automated, with a few manual callouts. It's easy to put the steps in order, and natural to configure the operating system before your home directory. I ended up splitting these into separate scripts, then eventually smaller component scripts in directories. So now I have a master ~/bin/setup/setup.sh script that autodetects the system (based on vps ip or laptop ethernet mac) and calls the correct componenant scripts, like pc/audio.sh, pc/pkg_add.sh, openbsd/etc_myname.sh, openbsd/etc_xenodm.sh, home/ dot_fvwmrc.sh, and so on. Each of these component shell scripts can update config files, enable daemons, copy things, etc. I made functions for some of these things. I can pass arguments to component scripts or set environment variables, for things like ip addresses and usernames. Minimally you need to be sure the automated scripts are idempotent, meaning you can run them repeatedly without harm. Things like trapping errors and testing in qmenu would be good. A lot of it is easy, copying in a file or appending to a file, running a chmod or rcctl command, etc. It's nice to have this master copy of all my config. When I want to change something I edit the appropriate setup script then re-run it to push the change.

Seirdy 5y ago

I love obsd and agree with all your points...except security. A Whonix developer and GrapheneOS contributor wrote this up better than I can: https://madaidans-insecurities.github.io/openbsd.html https://madaidans-insecurities.github.io/openbsd.html

mikem170 5y ago
Thanks for that link. I'll have to dig into a few of those things more, ROP is something I have not bumped into before. Comparisons to Windows/Mac/Chrome/Android security are kind of a moot point for me, given that they are tools of corporate surveillance capitalism. I wondered how linux stacked up, outside of the mentioned MAC capabilities, but the article was more focused on openbsd. How much does MAC buy if I don't notice that I've outgrown the granularity of normal file system permissions? I know that does often come up in environments with more users. Do you think openbsd has worse security than normal linux? (not selinux) My next planned security update is to attempt to separate apps that need network access from those that do not. I'm still brainstorming on how to best do this, maybe leveraging the ability of the pf firewall to allow/deny traffic by user account.
- Seirdy 5y ago
  The author also wrote about Linux's lack of exploit mitigations and sandboxing: https://madaidans-insecurities.github.io/linux.html https://madaidans-insecurities.github.io/linux.html Android's surveillance is mostly in stock android and other derivatives, but not in AOSP; AOSP has no Play services. GrapheneOS is a downstream ROM that adds further hardening and privacy enhancements. I view MAC as quite essential. On top of that, Clang on Linux supports sanitizers like CFI, safe-stack/shadow-call-stack, and a few others; check the Clang docs for more info. Linux supports dm-verity which can help ensure the integrity of the base system, and can combine with UEFI Secure Boot for getting some of the way towards a fully verified boot. I also don't know of a USBGuard- or kloak-equivalent for OpenBSD. USBGuard is essential for physical security regarding removable media, and kloak anonymizes keystroke input. There is no OpenBSD web browser that's remotely secure; they all use Linux, macOS, and Windows sandboxing/hardening measures. I never enable JS in obsd; if I absolutely must, I run the browser in a VM and disable JIT.

armitron 5y ago

It’s not at all competitive with Linux performance-wise and also lacks observability (eBPF). These are strong reasons to pass.

mikem170 5y ago
Openbsd is very competitive with Linux performance wise for a thinkpad user. Runs plenty fast enough on my vps, also. I haven't run any benchmarks but I've never waited on anything. I believe you that linux is faster, but it's speed that I don't need. I never heard of eBPF before. Is that like dtrace? I gather there was some working on adding that to bsd. I haven't missed not having either of those. Maybe more for lower level coding? The simplicity, consistency, and documentation are a bigger deal to me. I realize needs and preferences vary.