9 ms·

Good question: Is OpenBSD more secure than a mainstream Linux distribution, notably Debian, in their default configurations? The code is less, but there are fe

by aborsy 4y ago

Good question: Is OpenBSD more secure than a mainstream Linux distribution, notably Debian, in their default configurations? The code is less, but there are fewer developers too. For example, basic support for disk encryption (an important security feature) has been added to the installer in 2023 in OpenBSD. Perhaps people familiar with the software development process in both could chime in.

CuteDinosaur 4y ago
No, basically. You can't really compare.
anthk 4y ago
You could do it by hand with bioctl since forever. You had to spawn a shell with ! from the installer, run the bioctl commands to assign a new device to get encrypted and then on installing you would select that new device instead of your raw disk.
nixcraft 4y ago
Yes and No. Both modern Linux and OpenBSD have their pros and cons. For example, security works better in the onion layers, which can increase complexity. With Linux, you get a modern stack such as Linux containers or ZFS if you want those excellent filesystem features. Are you using containers for development and deploying apps? Using Linux would simplify the process (of course, you can set Linux VM under OpenBSD and run Docker). On the other hand, OpenBSD is a compact OS. Less code == fewer bugs (at least in theory). Some of their code, such as OpenSSH, is wildly used by Linux, Windows, and major IT vendors in their devices. OpenBSD devs do write reliable code. In short, use whatever gets your work done quickly, which also keeps you or your devs/users happy. That is all matter. Apart from that, it would be best if you took all other precautions to secure your OS, such as regularly applying patches, and firewalls, installing adblocker, not downloading unwanted stuff and clicking on the links, regardless of whether it is Win11, macOS, Debian/Ubuntu Linux, or OpenBSD.
- LanternLight83 4y ago
  > With Linux, you get a modern stack such as Linux containers or ZFS if you want those excellent filesystem features. While might be more pre-oackaged containers available for linux, our OCI stack has nothing on BSD's Jails. ZFS was ported to linux from Solaris, and still runs better on the BSD's (at least in regards to license controversies, if not feature support or performance, which have mostly converged in OpenZFS). The linux-native option would be BTRFS (love them both :p).
  - gnubison 4y ago
    OpenBSD does not support jails or ZFS. Those are FreeBSD features (although perhaps NetBSD supports some of them too?). I really like OpenBSD but I think it’s counterproductive to lump them together: they are very different.
disvor 4y ago
Linux has a richer set of security features available than OpenBSD, in some areas. One is the mandatory access control of SELinux, used extensively in Android (probably the most widely-used Linux distribution of them all). This has no OpenBSD equivalent, as far as I know. Another is that the Linux kernel has some compiled-in exploit mitigations enabled that OpenBSD doesn't, such as automatic bounds checks on fixed-size array access (based on UBSan).
- dbolgheroni 4y ago
  That's not true. There is pledge(2) and unveil(2) (just to start) and the whole point of them is to _make it usable_. Some Linux distros have a basic config for SELinux, but if you need to change it for anything, it's so difficult that most people just end up disabling it, thus making it less secure than a default OpenBSD install. Besides this, it changes the perspective of who is the best person to configure the secure features. OpenBSD makes this a decision for the developer of the application, who should know better about it than a random sysadmin who most probably won't even open the source code to know better (this is the approach SELinux takes). https://man.openbsd.org/pledge https://man.openbsd.org/pledge https://man.openbsd.org/unveil https://man.openbsd.org/unveil
  - PrimeMcFly 4y ago
    pledge and unveil are not even close to being full alternatives to something like SELinux.
    - nix23 4y ago
      You are not wrong but also not right, it's something different. For example FreeBSD has a MAC framework (a massive one btw) and also the "SELinux/SEBSD" framework on top of it (FLASK/TE), but you don't need to use it (not on Linux nor on FBSD). OpenBSD has no MAC implementation, and with that no framework (SE*) on top of it, but has different/other way's to secure a system. And TBH i have seen just 3 Customers until now who really develop highly secure/complicated policies (Two use MLS and one uses Brewer-Nash) I think MAC should be used much more, but it's time intensive and hard to do it right, also to keep the policies clean and understandable need's LOTS of documentation and dedication. https://www.diva-portal.org/smash/get/diva2:5365/FULLTEXT01.pdf https://www.diva-portal.org/smash/get/diva2:5365/FULLTEXT01.... (2006) https://hardenedbsd.org/content/easy-feature-comparison https://hardenedbsd.org/content/easy-feature-comparison
Zurrrrr 4y ago
OpenBSD's default configuration has basically nothing running. Once you actually set it up for a use case, it isn't much better (you'll likely be running software you would on Linux that wasn't audited) and might even be worse given it lacks a lot of security features Linux has (meaning you have less control over how to lock down things in the case of a hack).
- anthk 4y ago
  False. OpenBSD's daemons are patched, sandboxed and reviewed and lots of software it's compiled with secure CFLAGS and LDFLAGS among some tweaks for browsers with pledge and unveil.
  - Zurrrrr 4y ago
    It's not false. No significant services are running by default, and for it to do anything useful you have to install and/or enable whatever services you want. Semantics doesn't change that.
    - anthk 4y ago
      Who cares, your point it's still wrong as you don't understand how much OpenBSD diverges from Linux and even FreeBSD and NetBSD on security and correctness.
      - Zurrrrr 4y ago
        No, I understand absolutely. I've been playing with OpenBSD for over 20 years. My point is that OpenBSD wants to focus on trying to remove bugs as much as possible, and securing the system in case a bug is exploited is very much a secondary objective. Pledge and unveil are nice, but insufficient compared to what SELinux can do, or similar systems. That's simply objectively true, regardless of if your bias towards OpenBSD will let you admit it or not. So no, my point isn't wrong, you're just possibly out of your depth in this convo. OpenBSD provides NOTHING to protect against an attacker who gets remote root, it just really really really hopes they won't.
the_qbit 4y ago
Since no one has specifically mentioned it yet.. OpenBSD has had the ability to do FDE from installer since FDE was added to OpenBSD (sometime prior to 2007).. This change makes it more convenient.
- 2b3a51 4y ago
  Yes, you are correct in the sense that you need to create a partition within which you build an encrypted 'device' before running the installer script. And then at the appropriate point in the installer dialogue you need to select the encrypted device as the target to install to. It is I agree only a few extra commands, but obviously one of the OpenBSD team thought it worth while to automate those few steps for 'common' cases. https://www.openbsd.org/faq/faq14.html#softraidFDE https://www.openbsd.org/faq/faq14.html#softraidFDE Above is the section of the FAQ about full disk encryption for OpenBSD 7.2 which is the most recent release. PS: I agree fully with a parent comment that the OpenBSD installer is superb. It is like working your way through a checklist. Nice and straight forward once you have read the FAQ first.

by aborsy 4y ago

CuteDinosaur 4y ago

No, basically. You can't really compare.

anthk 4y ago

You could do it by hand with bioctl since forever. You had to spawn a shell with ! from the installer, run the bioctl commands to assign a new device to get encrypted and then on installing you would select that new device instead of your raw disk.

nixcraft 4y ago

Yes and No. Both modern Linux and OpenBSD have their pros and cons. For example, security works better in the onion layers, which can increase complexity. With Linux, you get a modern stack such as Linux containers or ZFS if you want those excellent filesystem features. Are you using containers for development and deploying apps? Using Linux would simplify the process (of course, you can set Linux VM under OpenBSD and run Docker). On the other hand, OpenBSD is a compact OS. Less code == fewer bugs (at least in theory). Some of their code, such as OpenSSH, is wildly used by Linux, Windows, and major IT vendors in their devices. OpenBSD devs do write reliable code. In short, use whatever gets your work done quickly, which also keeps you or your devs/users happy. That is all matter. Apart from that, it would be best if you took all other precautions to secure your OS, such as regularly applying patches, and firewalls, installing adblocker, not downloading unwanted stuff and clicking on the links, regardless of whether it is Win11, macOS, Debian/Ubuntu Linux, or OpenBSD.

LanternLight83 4y ago
> With Linux, you get a modern stack such as Linux containers or ZFS if you want those excellent filesystem features. While might be more pre-oackaged containers available for linux, our OCI stack has nothing on BSD's Jails. ZFS was ported to linux from Solaris, and still runs better on the BSD's (at least in regards to license controversies, if not feature support or performance, which have mostly converged in OpenZFS). The linux-native option would be BTRFS (love them both :p).
- gnubison 4y ago
  OpenBSD does not support jails or ZFS. Those are FreeBSD features (although perhaps NetBSD supports some of them too?). I really like OpenBSD but I think it’s counterproductive to lump them together: they are very different.

disvor 4y ago

Linux has a richer set of security features available than OpenBSD, in some areas. One is the mandatory access control of SELinux, used extensively in Android (probably the most widely-used Linux distribution of them all). This has no OpenBSD equivalent, as far as I know. Another is that the Linux kernel has some compiled-in exploit mitigations enabled that OpenBSD doesn't, such as automatic bounds checks on fixed-size array access (based on UBSan).

dbolgheroni 4y ago
That's not true. There is pledge(2) and unveil(2) (just to start) and the whole point of them is to _make it usable_. Some Linux distros have a basic config for SELinux, but if you need to change it for anything, it's so difficult that most people just end up disabling it, thus making it less secure than a default OpenBSD install. Besides this, it changes the perspective of who is the best person to configure the secure features. OpenBSD makes this a decision for the developer of the application, who should know better about it than a random sysadmin who most probably won't even open the source code to know better (this is the approach SELinux takes). https://man.openbsd.org/pledge https://man.openbsd.org/pledge https://man.openbsd.org/unveil https://man.openbsd.org/unveil
- PrimeMcFly 4y ago
  pledge and unveil are not even close to being full alternatives to something like SELinux.
  - nix23 4y ago
    You are not wrong but also not right, it's something different. For example FreeBSD has a MAC framework (a massive one btw) and also the "SELinux/SEBSD" framework on top of it (FLASK/TE), but you don't need to use it (not on Linux nor on FBSD). OpenBSD has no MAC implementation, and with that no framework (SE*) on top of it, but has different/other way's to secure a system. And TBH i have seen just 3 Customers until now who really develop highly secure/complicated policies (Two use MLS and one uses Brewer-Nash) I think MAC should be used much more, but it's time intensive and hard to do it right, also to keep the policies clean and understandable need's LOTS of documentation and dedication. https://www.diva-portal.org/smash/get/diva2:5365/FULLTEXT01.pdf https://www.diva-portal.org/smash/get/diva2:5365/FULLTEXT01.... (2006) https://hardenedbsd.org/content/easy-feature-comparison https://hardenedbsd.org/content/easy-feature-comparison

Zurrrrr 4y ago

OpenBSD's default configuration has basically nothing running. Once you actually set it up for a use case, it isn't much better (you'll likely be running software you would on Linux that wasn't audited) and might even be worse given it lacks a lot of security features Linux has (meaning you have less control over how to lock down things in the case of a hack).

anthk 4y ago
False. OpenBSD's daemons are patched, sandboxed and reviewed and lots of software it's compiled with secure CFLAGS and LDFLAGS among some tweaks for browsers with pledge and unveil.
- Zurrrrr 4y ago
  It's not false. No significant services are running by default, and for it to do anything useful you have to install and/or enable whatever services you want. Semantics doesn't change that.
  - anthk 4y ago
    Who cares, your point it's still wrong as you don't understand how much OpenBSD diverges from Linux and even FreeBSD and NetBSD on security and correctness.
    - Zurrrrr 4y ago
      No, I understand absolutely. I've been playing with OpenBSD for over 20 years. My point is that OpenBSD wants to focus on trying to remove bugs as much as possible, and securing the system in case a bug is exploited is very much a secondary objective. Pledge and unveil are nice, but insufficient compared to what SELinux can do, or similar systems. That's simply objectively true, regardless of if your bias towards OpenBSD will let you admit it or not. So no, my point isn't wrong, you're just possibly out of your depth in this convo. OpenBSD provides NOTHING to protect against an attacker who gets remote root, it just really really really hopes they won't.

the_qbit 4y ago

Since no one has specifically mentioned it yet.. OpenBSD has had the ability to do FDE from installer since FDE was added to OpenBSD (sometime prior to 2007).. This change makes it more convenient.

2b3a51 4y ago
Yes, you are correct in the sense that you need to create a partition within which you build an encrypted 'device' before running the installer script. And then at the appropriate point in the installer dialogue you need to select the encrypted device as the target to install to. It is I agree only a few extra commands, but obviously one of the OpenBSD team thought it worth while to automate those few steps for 'common' cases. https://www.openbsd.org/faq/faq14.html#softraidFDE https://www.openbsd.org/faq/faq14.html#softraidFDE Above is the section of the FAQ about full disk encryption for OpenBSD 7.2 which is the most recent release. PS: I agree fully with a parent comment that the OpenBSD installer is superb. It is like working your way through a checklist. Nice and straight forward once you have read the FAQ first.