16 ms·
Initial support for guided disk encryption in OpenBSD installer
- hosteur 4y agoGood news. But why so late to support this? Debian had this for decades.
- TacoSteemers 4y agoMaybe it is coming now instead of earlier not because of a clear choice, but because to get features in to the project people need to spend their own free time on creating them. Thank you Klemens Nanni and others for taking the time.
- anthk 4y agoNo, you could do it by hand. Even with commands, bioctl was far easier than the luks+lvm voodoo.
- tux2bsd 4y ago[dead]
- moviuro 4y agoIt's only now added as an interactive step in the install script. It has ~always been possible to create a crypto device with the install medium by dropping to a shell: https://www.openbsd.org/faq/faq14.html#softraidFDE https://www.openbsd.org/faq/faq14.html#softraidFDE
- quesera 4y agoSometimes adding a user interface to a straightforward operation is complicated, expensive, time-consuming, and/or low-priority for the intended audience. OpenBSD users know how to partition and encrypt their disks. World domination was never on BSD's todo list! Don't get me wrong -- the Linux way is also perfectly valid, and obviously more popular. But it's not the only way.
- sarnowski 4y agoI think/assume OpenBSD is mainly used as a server OS. Yes, passionate people use it as a desktop but those mostly read the FAQ anyway. Currently and as far as I know, bioctl does only support user typed in passwords or key disks. You certainly want also encrypted disks on your server but requiring user typed in password is oftentimes a no-go (think of various firewall appliances doing a reboot and not having remote hands). A compensation can be the key disk but I don’t know how widely that is used. Hardware bound encryption like with a TPM is not supported. Also Linux is still exploring here as far as I can tell (no installer offers that). In sum: I think disk encryption in the current form is not a tradeoff many installations will take.
- e12e 4y ago> Hardware bound encryption like with a TPM is not supported. Also Linux is still exploring here as far as I can tell (no installer offers that). True, OTOH AFAIK you can add tpm unlock to a typical luks setup after installation, see my other comments: https://news.ycombinator.com/item?id=35067375 https://news.ycombinator.com/item?id=35067375 (ed: fixed)
- prmoustache 4y agoWrong link I believe. Also if secure-boot/tpm is not desired or not available systemd can now start openssh very early to allow user to type passphrase and for non systemd system one can use tinyssh-initramfs or dropbear-initramfs depending on keys requirements. Last option is dedicated kvm (which also work for openbsd).
- e12e 4y ago> Wrong link I believe. Yes, it was. Fixed, thank you.
- prmoustache 4y agoarchlinux only added an installer very recently. Besides, setting encryption manually and then installing openbsd with its very fast installer has always been faster than using the interactive debian installer so in the grand scheme of things it wasn't that big of a deal.
- znpy 4y agoWelcome to ~2015 i guess?
- anthk 4y agoNo. OpenBSD had it as an optional method in the FAQ and man pages. The encryption guide was already there, but not shown in the installer. You had to run three or four short commands by spawning a shell with '!' from the installer, exit that shell and that's it. Now try doing the same by hand under Linux. With an encrypted boot.
- thinking001001 4y agoIt is true, encrypted /boot on Linux (i.e. where the Linux kernel lives) is time-consuming and error-prone to setup, even if you have been using Linux for years. GRUB only understands LUKS version 1, and is poorly optimised, meaning LUKS' default "2 seconds of password hashing" during install/setup from a running Linux OS takes significantly (!) longer when booting via GRUB. It is the age-old cathedral/bazaar issue.
- aspyct 4y agoThis is one of the things the OpenBSD folks gave me a _hard_ time about when I was trying out their system. Yes, I said theirs, because since then I want nothing to do with that. "Unix grey beards are forged in suffering". Yeah, well, suffer if you'd like, but I have better things to do with my time.
- kunley 4y agoSome projects are just about belonging to some arcane group, not about creating something much useful... though of course the said group would disagree.
- YPPH 4y agoThe OpenBSD folks have a mentality of secure by default. Doing the best to encourage disk encryption upon install promotes that ideal.
- aspyct 4y agoYes, my point exactly. Disk encryption wasn't even part of the default install flow before. You had to go out of your way to find documentation, understand how to run it, find some more documentation, get "RTFM" replies on their IRC channel. Doesn't seem very secure by default to me.
- 4y ago
- tux2bsd 4y ago[dead]
- gautamcgoel 4y agoI tried installing OpenBSD a few times and could never get past partitioning and encrypting my disk. Yes, I could probably have gotten it to work if I was willing to fiddle with it/read some blog posts. But I'd rather just run Linux :)
- anthk 4y agoHeh, compared to Linux encrypting a disk was dumb easy. Once you set the bioctl devices, you usually chose sd1 or sd2 depending on the layout and literally apply the same instructions af it was sd0. Done. With Linux, crypsetup and lvm I wanted to kill myself.
- e12e 4y ago> With Linux, crypsetup and lvm I wanted to kill myself. With what, Linux from scratch or something? Eg: Debian has had "encrypt disk" in the installer for a long time. Granted, if you want a super custom setup - it's trickier - but then it kind of is inherently more complex.
- anthk 4y agoSlackware, Arch, and most non-Debian and Fedora based distros. And, even on Debian/Fedora derivs, on troubleshooting, encrypting HD drives under GNU/Linux has always been hell.
- 2b3a51 4y agoSlackware is pretty manual I admit. The installer does not actually provide an automatic partitioning scheme at all, you boot from the installation media, set the keyboard, and drop into a root shell and run fdisk/cfdisk on the fixed disk you want to install to and set up your partitions as you want. That is for any installation, unencrypted or encrypted. http://slackware.uk/slackware/slackware64-15.0/README_CRYPT.TXT http://slackware.uk/slackware/slackware64-15.0/README_CRYPT.... Using an lvm set up is about half way through the document above. These docs come on the installation media. Same kind of idea as with OpenBSD - partition hard drive so small partition just to boot off then the rest of the disk to house encrypted lvms with swap, home, root whatever. Then run the 'setup' program as usual to actually install to your lvms. Other distributions (e.g. RHEL/Debian based) make it a push button exercise.
- pcdoodle 4y agoholy cow, I've never used BSD but HN is one cranky bunch!
- dang 4y agoYou're right that this thread broke out into hellflames. We've banned the worst offenders and scolded some of the others. I don't think it's representative of HN, though. My take is that it was the old-school pull-no-punches style of some systems-oriented communities showing up on HN without adjusting for the cultural context shift. I could be wrong about that though.
- pcdoodle 4y agoI hope that we don't start demoting visibility to the point that it's nowhere to be found somewhere in the first 10 pages after hitting the front page even if it's bad. It don't feel it represents our users from the fringe. If you're going to demote, don't take it off the main page index for casual browsers. Sometimes the fringe is very correct.
- dang 4y agoHN's practices around this have been well-established for many years. Flamewars tend to get demoted off the front page (mostly by software) while sensational or repetitive stories tend to get demoted by moderators. The current thread spent 9 hours on the front page, which is a lot. It did set off the flamewar detector but it looks like we switched that off. Other than that, moderators didn't touch it.
- sadfdsgf 4y agoRemember that OpenBSD is mainly a research OS, and a great on in my opinion.
- bartekrutkowski 4y agoThat is simply not true, OpenBSD is not mainly a research OS, it is widely used (for a non-linux OS) in networking appliances, to begin with.
- nesarkvechnep 4y agoIt’s not mainly a research OS.
- anthk 4y agoI woudn't call OpenSSH, LibreSSL and PF 'research tools'.
- phneutral26 4y agoYes! This is awesome! OpenBSD's Installer was already superb, much better than those calamares installers on your typical manjaro or whatever distro. It was plain easy. Many friends of me didn't switch to openBSD because they didnt fully understand the partitioning system but wanted their disk encrypted (like any sane person should do). I hope this will convince some of them.
- charcircuit 4y agoWhy does this default to no encryption? Systems should be secure by default.
- prmoustache 4y agoWild guess: It was commited only 1 day ago, this is considered initial support and need to be tested, previous openbsd users are used to drop to a shell and set it manually and thus might have already encrypted the disk when they reach that step.
- jonathanstrange 4y agoEncryption doesn't necessarily make a system more secure. For many normal desktop users data integrity is more important than full-disk encryption. Data integrity and encryption are principally opposed to each other and create a trade-off. Encryption adds many additional points of failure and makes data recovery hard, sometimes even impossible. I would recommend full-disk encryption for most laptop users who carry their laptop with them, though.
- daneel_w 4y agoBesides the obvious reason of it being a brand new feature of the installer, one reason may be the "hassle" that full-disk encryption comes with. FDE isn't just "home directory encryption", which unlocks automatically when you log in. It requires manual password entry (or key-disk provisioning) in order to init and load the kernel at all.
- disvor 4y agoIs there any support in OpenBSD, or indeed any Unix-based desktop/server operating system, for storing key material in a TPM? Windows has this, and it permits booting without a passphrase being entered, but the disk will still be encrypted at rest.
- capitol_ 4y agoI have never understood what threat scenario this is meant to protect against. That a thief opens your laptop and steal the harddrive instead of the complete machine? Or is this just a solution that is meant to check a checkbox to make an auditor happy?
- disvor 4y agoIt protects against data being directly copied off the disk, or modified, by anyone who may have physical access to the machine, but who lacks credentials to log in.
- capitol_ 4y agoWouldn't that require that the complete boot chain is totally locked down and cryptographically secure? If you can insert a usb-plug and boot from that you could unlock the disk with the help of the tpm, or interrupt grub and set init=/bin/bash. Or since the scenario is that the attacker have physical access, maybe desolder the tpm chip and move it to another computer where they have control over how the machine boots. I guess modern gaming consoles are locked down in such a way so that this makes sense, but I have never seen a general purpose computer secured like this. Thanks for explaining, I guess the above was mostly my stream of consciousness ranting.
- azalemeth 4y ago> If you can insert a usb-plug and boot from that you could unlock the disk with the help of the tpm, or interrupt grub and set init=/bin/bash. You can't easily do that as the platform control headers will be different to those set by Windows. You can't brute-force it as they have a realtime clock and lock after about 32 attempts, granting one more attempt for each ten minutes. Getting the bit-locker key from a discrete TPM v1.2 or v2.0 requires being a bus pirate [1]. Getting it from a "soft" TPM inside a CPU is likely much, much harder. [1] https://pulsesecurity.co.nz/articles/TPM-sniffing https://pulsesecurity.co.nz/articles/TPM-sniffing
- aborsy 4y agoGood question: Is OpenBSD more secure than a mainstream Linux distribution, notably Debian, in their default configurations? The code is less, but there are fewer developers too. For example, basic support for disk encryption (an important security feature) has been added to the installer in 2023 in OpenBSD. Perhaps people familiar with the software development process in both could chime in.
- CuteDinosaur 4y agoNo, basically. You can't really compare.
- anthk 4y agoYou could do it by hand with bioctl since forever. You had to spawn a shell with ! from the installer, run the bioctl commands to assign a new device to get encrypted and then on installing you would select that new device instead of your raw disk.
- nixcraft 4y agoYes and No. Both modern Linux and OpenBSD have their pros and cons. For example, security works better in the onion layers, which can increase complexity. With Linux, you get a modern stack such as Linux containers or ZFS if you want those excellent filesystem features. Are you using containers for development and deploying apps? Using Linux would simplify the process (of course, you can set Linux VM under OpenBSD and run Docker). On the other hand, OpenBSD is a compact OS. Less code == fewer bugs (at least in theory). Some of their code, such as OpenSSH, is wildly used by Linux, Windows, and major IT vendors in their devices. OpenBSD devs do write reliable code. In short, use whatever gets your work done quickly, which also keeps you or your devs/users happy. That is all matter. Apart from that, it would be best if you took all other precautions to secure your OS, such as regularly applying patches, and firewalls, installing adblocker, not downloading unwanted stuff and clicking on the links, regardless of whether it is Win11, macOS, Debian/Ubuntu Linux, or OpenBSD.
- LanternLight83 4y ago> With Linux, you get a modern stack such as Linux containers or ZFS if you want those excellent filesystem features. While might be more pre-oackaged containers available for linux, our OCI stack has nothing on BSD's Jails. ZFS was ported to linux from Solaris, and still runs better on the BSD's (at least in regards to license controversies, if not feature support or performance, which have mostly converged in OpenZFS). The linux-native option would be BTRFS (love them both :p).
- thinking001001 4y agoBravo, it is much more likely to be reliable if everyone is going down the same kind of path to set it up