9 ms·

OpenBSD 5.6

200 points by fcambus 12y ago

farawayea 12y ago
Is installing openbsd securely possible using hash checks and signing?
- Spidler 12y ago
  Yes, they have tools for that these days.
- brynet 12y ago
  OpenBSD 5.5 and 5.6 include signify(1) for both signing and verifying signed files. http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/signify.1?query=signify&sec=1 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/...
  - farawayea 12y ago
    What is the secure install process? Are there signatures for packages and for the iso file? The system wants to be secure, but it's not teaching me how to install it securely. Buying the CDs is risky. How can I know they're not backdoored?
    - tedunangst 12y ago
      Read the install docs and search for "sign". http://ftp.openbsd.org/pub/OpenBSD/5.6/amd64/INSTALL.amd64 http://ftp.openbsd.org/pub/OpenBSD/5.6/amd64/INSTALL.amd64
      - cesarb 12y ago
        Forgive me if I'm missing something, but I don't see how to "bootstrap" the trust from an existing, non-OpenBSD system. For instance, for Fedora, the download page I use (https://fedoraproject.org/pt_BR/get-fedora https://fedoraproject.org/pt_BR/get-fedora) has a link on the sidebar to https://fedoraproject.org/pt_BR/verify https://fedoraproject.org/pt_BR/verify, which has a link to https://fedoraproject.org/pt_BR/keys https://fedoraproject.org/pt_BR/keys, which has the full fingerprint for the GPG keys. That page is authenticated via TLS. So, for me the trust chain for the Fedora installation DVD is: - The trust chain root is my current browser (a recent enough version of Firefox); - The browser trusts the CAs in its certificate store (the built-in CA certificates from Mozilla, plus the ICP-Brasil CA certificates); - One of these CAs verifies the certificates for the fedoraproject.org pages; - From these pages, I download a set of public GPG keys, and if I want I can verify their fingerprints; - The torrent for the installation DVD has the DVD image and a checksum file. I use GnuPG to verify the signature on the checksum file, and check the page to confirm that it was signed with the correct key; - Finally, I verify the SHA256 of the DVD image and confirm that it matches the value found in the checksum file. I don't know how I would do it for OpenBSD. The www.openbsd.org page doesn't seem to be available over TLS, so I can't use the CAs trusted by my browser to bootstrap the trust chain. If I had OpenBSD 5.5 installed, I could use it as the root of the trust chain (as explained at the link you posted), but unfortunately I don't have it installed anywhere, so that trust path doesn't work for me. If I had an OpenBSD 5.6 ISO in hand right now, what could I do to authenticate it? (Assume I have a recent Linux or BSD system to start with.)
        cowabunga 12y ago
        The official way of doing this is to buy the CD set in which the code and keys are sent via different channels. You buy the CD set and it is mailed to you. You then verify that against the key on the web site. If the verification fails, either the CD set or the key is compromised. I really wouldn't trust a CA or shared PKI to do this to be honest as that means you have to trust three or more parties rather than just two.
        farawayea 12y ago
        This mailing of cds seems silly. An attacker could compromise the cds to be different and serve you another signature on the site. This is easy for me to do. It must be the same for others.
        tedunangst 12y ago
        It's easy for you to intercept somebody's mail and internet connection? Who do you work for?
        farawayea 12y ago
        Networks are easy to attack if you have control over the ISP. Mail can be easily replaced by one single person monitoring someone's mail. A company where employees get their mail at work and only access the net from work could do both easily. I don't have resources for something like this, but doing this isn't as difficult as it might seem. A big enough adversary with enough resources could compromise everything used in security sensitive environments. I wanted to know if anything changed in how OpenBSD can be installed securely. It is easier to obtain other operating systems securely. They are less secure, but the authenticity of the iso files can be verified via signatures. This uncertainty has stopped me from using OpenBSD in the past. I have the same questions now. This is a question about obtaining an iso file to install OpenBSD knowing it's what the developers sent out, just like checking a sha256 signature for other operating systems when downloading. It's not a question about using it in a government agency. Thanks for the replies. You probably have more useful things to do than discuss this.
lmedinas 12y ago
And brings LibreSSL: - This release forks OpenSSL into LibreSSL, a version of the TLS/crypto stack with goals of modernizing the codebase, improving security, and applying best practice development processes.
- w8rbt 12y ago
  Modernizing the codebase? I think 'simplifying' is the right word. If OpenBSD is anything it is simple and easy to understand, but it is not modern. That's why it is secure.
  - tedunangst 12y ago
    Well, modernizing as in using modern functions like 'memmove', even though they may not exist on SunOS 4.1.
  - imanaccount247 12y ago
    Modern doesn't have to be a code word for deliberately convoluted. Things can be both modern and simple.
eksith 12y ago
It seems this is the last version to have Nginx in the base install. 5.7 Will only ship their in-house httpd(8) as the default web server, although Nginx will still be available in ports. Reyk explained the reasoning : http://undeadly.org/cgi?action=article&sid=20140827065755&pid=24 http://undeadly.org/cgi?action=article&sid=20140827065755&pi... And the httpd(8) manual shows there are some similarities in the configuration to Nginx. http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/httpd.8 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/... It seems to be a much more simplified and streamlined setup.
- feld 12y ago
  Reyk also said that people could write papers on Nginx's http implementation because it's crazy how well optimized it is. There's a BSDNow.tv interview he brings this up and talks more about the change away from Nginx.
- gioele 12y ago
  > [nginx] uses custom memory allocators (for performance reasons) and it is wrapping or replacing standard C library functions all over the place. This could eliminate some of our built-in security mechanisms. Isn't this what made most of OpenSSL bugs possible and made them go unnoticed for a long time?
  - haberman 12y ago
    And yet techniques like custom memory allocators can have compelling performance benefits. To me the right tradeoff is: if you want to do fancy allocation, at least make the allocator injectable so that people can use standard malloc (or even a specialized security-hardened malloc) if they prefer. Robust low-level libraries like Lua, zlib, etc. usually take this approach: you can pass a pointer to a custom "malloc" function. Unfortunately this isn't always possible: LuaJIT doesn't support the "custom allocator" part of the Lua API for a couple of reasons: http://www.freelists.org/post/luajit/Why-does-LuaJIT-have-its-own-allocator http://www.freelists.org/post/luajit/Why-does-LuaJIT-have-it... https://gist.github.com/nddrylliog/8722197 https://gist.github.com/nddrylliog/8722197
sauere 12y ago
Semi-related: is anyone here using OpenBSD in their daily DevOps setup? If so, why did you choose it (say, over Linux or FreeBSD)?
- alrs 12y ago
  I don't think you're using the term "devops" very well. http://en.wikipedia.org/wiki/DevOps http://en.wikipedia.org/wiki/DevOps Are you asking if OpenBSD is part of people's workflow, or if it is part of their permanent infrastructure?
- eksith 12y ago
  OpenBSD is what I use to host a bunch of private sites for myself and a few people I know. This is only due to some custom configurations and applications that my shared webhost didn't provide and for things I can't be bothered with, like my own domain which is static html. I put them on the shared host. I wish it was for a lofty goal like security and "code correctness" etc... but the honest answer is that it's extremely simple (once you get used to it) and I tend to be extremely lazy at times. Configuration is very straightforward for a lot of things and there have been very few surprises along the way. Actually no surprises that I can recall in most of what I do since 5.0. I wouldn't recommend it as a desktop system although plenty of people (including my boss) use it as such. There is some fiddling required for this that I'd rather not do, but for very simple, stable and surprise-free servers, it works very well for me. I also wouldn't recommend it for first-time admins either, although their man pages are some of the most thorough and helpful I've ever read.
  - cgag 12y ago
    I installed freebsd on an old laptop (thinkpad t60) because I want to use something simple, very well documented, and with an emphasis on good code. I know OpenBSD takes this further, but I know FreeBSD has more packages/ports available, and I'm interested in playing with ZFS and jails.
    - aortega 12y ago
      The problem with FreeBSD is that it has almost no security features turned on by default. It's more unsafe than windows and much worst than Linux.
brynet 12y ago
OpenBSD 5.6 isn't quite released yet, it's still not on the master site. The announcement will undoubtedly be going out soon though, and it's on a few mirrors if you wish to jump the gun.
- edwintorok 12y ago
  And the (unofficial) -stable binpatches[1] fixing the errata[2] are out too! [1] https://stable.mtier.org/ https://stable.mtier.org/ [2] http://www.openbsd.org/errata56.html http://www.openbsd.org/errata56.html [3] https://twitter.com/mtierltd/status/528560775204712448 https://twitter.com/mtierltd/status/528560775204712448
- brynet 12y ago
  ..and now here it is released! 5.6 is official. http://marc.info/?l=openbsd-announce&m=141486254309079&w=2 http://marc.info/?l=openbsd-announce&m=141486254309079&w=2
- mrweasel 12y ago
  It's out now.
brynet 12y ago
You can order the 5.6 CD set from the new OpenBSD Store, there's also older sets and other swag. https://www.openbsdstore.com/cgi-bin/live/ecommerce.pl?site=shop_openbsdeurope_dollar&state=department https://www.openbsdstore.com/cgi-bin/live/ecommerce.pl?site=... I want a Wireframe Puffy Coffee Mug.
brynet 12y ago
Related to OpenBSD, and BSD in general. Peter N. M. Hansteen is auctioning off the first signed copy The Book of PF, 3rd edition. He will be supporting the OpenBSD Foundation by donating the amount raised. http://bsdly.blogspot.ca/2014/10/the-book-of-pf-3rd-edition-is-here.html http://bsdly.blogspot.ca/2014/10/the-book-of-pf-3rd-edition-...
e12e 12y ago
Hm, ripping kerberos from libssl I can understand -- but from base? Does that mean that openssh certificate is what people are using for federated authentication? While kerberos is complex and complected -- are there any solutions that are better, if you require administrating a non-trivial number of users, along with a good way to immediatly revoke access as users leave the organization?
- Mordak 12y ago
  It was just moved from base to ports, so you can still get it from ports/security/heimdal if you want it.
  - e12e 12y ago
    Sure. But authentication and authorization of users isn't like showing a static (or dynamic) web page (ie: simpler httpd vs more full-featured nginx). I'd say moving it out of base is a pretty strong signal to OpenBSD users. (Now, granted, kerberos have and have had perhaps more than its share of issues ... so the signal could just be: you probably shouldn't have been depending on this to be secure enough to grant access to the server in the first place). I'm more curious if this means OpenBSD (base) doesn't have any form of secure(ish) federated auth(z) story (other than ssh certs) any more.
    - mrweasel 12y ago
      You could use LDAP, that's in base. There's even an small OpenBSD LDAP daemon actively maintained by the OpenBSD proejct.
      - erglkjahlkh 12y ago
        That is not Single-Sign-On, if you have to sign on several times. LDAP is NOT a replacement for Kerberos. OAuth and alike might be, but when you work with internal users Kerberos is much much better. Also for web services because GSSAPI/spnego stuff just works. By removing kerberos from base setup openBSD people have once more moved towards irrelevance outside their own closet setups. Kerberos is the only really working method you can use in corporate setups for large amounts of users and achieving SSO. When it's not in base setup, it's just easier to install any decent Linux distro, and skip openBSD. That as market placement decision was yet another major blunder from openBSD folks, and still they wonder why their donations have dried up the last a few years...

OpenBSD 5.6

200 points by fcambus 12y ago

farawayea 12y ago

Is installing openbsd securely possible using hash checks and signing?

Spidler 12y ago
Yes, they have tools for that these days.
brynet 12y ago
OpenBSD 5.5 and 5.6 include signify(1) for both signing and verifying signed files. http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/signify.1?query=signify&sec=1 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man1/...
- farawayea 12y ago
  What is the secure install process? Are there signatures for packages and for the iso file? The system wants to be secure, but it's not teaching me how to install it securely. Buying the CDs is risky. How can I know they're not backdoored?
  - tedunangst 12y ago
    Read the install docs and search for "sign". http://ftp.openbsd.org/pub/OpenBSD/5.6/amd64/INSTALL.amd64 http://ftp.openbsd.org/pub/OpenBSD/5.6/amd64/INSTALL.amd64
    - cesarb 12y ago
      Forgive me if I'm missing something, but I don't see how to "bootstrap" the trust from an existing, non-OpenBSD system. For instance, for Fedora, the download page I use (https://fedoraproject.org/pt_BR/get-fedora https://fedoraproject.org/pt_BR/get-fedora) has a link on the sidebar to https://fedoraproject.org/pt_BR/verify https://fedoraproject.org/pt_BR/verify, which has a link to https://fedoraproject.org/pt_BR/keys https://fedoraproject.org/pt_BR/keys, which has the full fingerprint for the GPG keys. That page is authenticated via TLS. So, for me the trust chain for the Fedora installation DVD is: - The trust chain root is my current browser (a recent enough version of Firefox); - The browser trusts the CAs in its certificate store (the built-in CA certificates from Mozilla, plus the ICP-Brasil CA certificates); - One of these CAs verifies the certificates for the fedoraproject.org pages; - From these pages, I download a set of public GPG keys, and if I want I can verify their fingerprints; - The torrent for the installation DVD has the DVD image and a checksum file. I use GnuPG to verify the signature on the checksum file, and check the page to confirm that it was signed with the correct key; - Finally, I verify the SHA256 of the DVD image and confirm that it matches the value found in the checksum file. I don't know how I would do it for OpenBSD. The www.openbsd.org page doesn't seem to be available over TLS, so I can't use the CAs trusted by my browser to bootstrap the trust chain. If I had OpenBSD 5.5 installed, I could use it as the root of the trust chain (as explained at the link you posted), but unfortunately I don't have it installed anywhere, so that trust path doesn't work for me. If I had an OpenBSD 5.6 ISO in hand right now, what could I do to authenticate it? (Assume I have a recent Linux or BSD system to start with.)
      - cowabunga 12y ago
        The official way of doing this is to buy the CD set in which the code and keys are sent via different channels. You buy the CD set and it is mailed to you. You then verify that against the key on the web site. If the verification fails, either the CD set or the key is compromised. I really wouldn't trust a CA or shared PKI to do this to be honest as that means you have to trust three or more parties rather than just two.
        farawayea 12y ago
        This mailing of cds seems silly. An attacker could compromise the cds to be different and serve you another signature on the site. This is easy for me to do. It must be the same for others.
        tedunangst 12y ago
        It's easy for you to intercept somebody's mail and internet connection? Who do you work for?
        farawayea 12y ago
        Networks are easy to attack if you have control over the ISP. Mail can be easily replaced by one single person monitoring someone's mail. A company where employees get their mail at work and only access the net from work could do both easily. I don't have resources for something like this, but doing this isn't as difficult as it might seem. A big enough adversary with enough resources could compromise everything used in security sensitive environments. I wanted to know if anything changed in how OpenBSD can be installed securely. It is easier to obtain other operating systems securely. They are less secure, but the authenticity of the iso files can be verified via signatures. This uncertainty has stopped me from using OpenBSD in the past. I have the same questions now. This is a question about obtaining an iso file to install OpenBSD knowing it's what the developers sent out, just like checking a sha256 signature for other operating systems when downloading. It's not a question about using it in a government agency. Thanks for the replies. You probably have more useful things to do than discuss this.

lmedinas 12y ago

And brings LibreSSL: - This release forks OpenSSL into LibreSSL, a version of the TLS/crypto stack with goals of modernizing the codebase, improving security, and applying best practice development processes.

w8rbt 12y ago
Modernizing the codebase? I think 'simplifying' is the right word. If OpenBSD is anything it is simple and easy to understand, but it is not modern. That's why it is secure.
- tedunangst 12y ago
  Well, modernizing as in using modern functions like 'memmove', even though they may not exist on SunOS 4.1.
- imanaccount247 12y ago
  Modern doesn't have to be a code word for deliberately convoluted. Things can be both modern and simple.

eksith 12y ago

It seems this is the last version to have Nginx in the base install. 5.7 Will only ship their in-house httpd(8) as the default web server, although Nginx will still be available in ports. Reyk explained the reasoning : http://undeadly.org/cgi?action=article&sid=20140827065755&pid=24 http://undeadly.org/cgi?action=article&sid=20140827065755&pi... And the httpd(8) manual shows there are some similarities in the configuration to Nginx. http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/httpd.8 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/... It seems to be a much more simplified and streamlined setup.

feld 12y ago
Reyk also said that people could write papers on Nginx's http implementation because it's crazy how well optimized it is. There's a BSDNow.tv interview he brings this up and talks more about the change away from Nginx.
gioele 12y ago
> [nginx] uses custom memory allocators (for performance reasons) and it is wrapping or replacing standard C library functions all over the place. This could eliminate some of our built-in security mechanisms. Isn't this what made most of OpenSSL bugs possible and made them go unnoticed for a long time?
- haberman 12y ago
  And yet techniques like custom memory allocators can have compelling performance benefits. To me the right tradeoff is: if you want to do fancy allocation, at least make the allocator injectable so that people can use standard malloc (or even a specialized security-hardened malloc) if they prefer. Robust low-level libraries like Lua, zlib, etc. usually take this approach: you can pass a pointer to a custom "malloc" function. Unfortunately this isn't always possible: LuaJIT doesn't support the "custom allocator" part of the Lua API for a couple of reasons: http://www.freelists.org/post/luajit/Why-does-LuaJIT-have-its-own-allocator http://www.freelists.org/post/luajit/Why-does-LuaJIT-have-it... https://gist.github.com/nddrylliog/8722197 https://gist.github.com/nddrylliog/8722197

sauere 12y ago

Semi-related: is anyone here using OpenBSD in their daily DevOps setup? If so, why did you choose it (say, over Linux or FreeBSD)?

alrs 12y ago
I don't think you're using the term "devops" very well. http://en.wikipedia.org/wiki/DevOps http://en.wikipedia.org/wiki/DevOps Are you asking if OpenBSD is part of people's workflow, or if it is part of their permanent infrastructure?
eksith 12y ago
OpenBSD is what I use to host a bunch of private sites for myself and a few people I know. This is only due to some custom configurations and applications that my shared webhost didn't provide and for things I can't be bothered with, like my own domain which is static html. I put them on the shared host. I wish it was for a lofty goal like security and "code correctness" etc... but the honest answer is that it's extremely simple (once you get used to it) and I tend to be extremely lazy at times. Configuration is very straightforward for a lot of things and there have been very few surprises along the way. Actually no surprises that I can recall in most of what I do since 5.0. I wouldn't recommend it as a desktop system although plenty of people (including my boss) use it as such. There is some fiddling required for this that I'd rather not do, but for very simple, stable and surprise-free servers, it works very well for me. I also wouldn't recommend it for first-time admins either, although their man pages are some of the most thorough and helpful I've ever read.
- cgag 12y ago
  I installed freebsd on an old laptop (thinkpad t60) because I want to use something simple, very well documented, and with an emphasis on good code. I know OpenBSD takes this further, but I know FreeBSD has more packages/ports available, and I'm interested in playing with ZFS and jails.
  - aortega 12y ago
    The problem with FreeBSD is that it has almost no security features turned on by default. It's more unsafe than windows and much worst than Linux.

brynet 12y ago

OpenBSD 5.6 isn't quite released yet, it's still not on the master site. The announcement will undoubtedly be going out soon though, and it's on a few mirrors if you wish to jump the gun.

edwintorok 12y ago
And the (unofficial) -stable binpatches[1] fixing the errata[2] are out too! [1] https://stable.mtier.org/ https://stable.mtier.org/ [2] http://www.openbsd.org/errata56.html http://www.openbsd.org/errata56.html [3] https://twitter.com/mtierltd/status/528560775204712448 https://twitter.com/mtierltd/status/528560775204712448
brynet 12y ago
..and now here it is released! 5.6 is official. http://marc.info/?l=openbsd-announce&m=141486254309079&w=2 http://marc.info/?l=openbsd-announce&m=141486254309079&w=2
mrweasel 12y ago
It's out now.

brynet 12y ago

You can order the 5.6 CD set from the new OpenBSD Store, there's also older sets and other swag. https://www.openbsdstore.com/cgi-bin/live/ecommerce.pl?site=shop_openbsdeurope_dollar&state=department https://www.openbsdstore.com/cgi-bin/live/ecommerce.pl?site=... I want a Wireframe Puffy Coffee Mug.

brynet 12y ago

Related to OpenBSD, and BSD in general. Peter N. M. Hansteen is auctioning off the first signed copy The Book of PF, 3rd edition. He will be supporting the OpenBSD Foundation by donating the amount raised. http://bsdly.blogspot.ca/2014/10/the-book-of-pf-3rd-edition-is-here.html http://bsdly.blogspot.ca/2014/10/the-book-of-pf-3rd-edition-...

e12e 12y ago

Hm, ripping kerberos from libssl I can understand -- but from base? Does that mean that openssh certificate is what people are using for federated authentication? While kerberos is complex and complected -- are there any solutions that are better, if you require administrating a non-trivial number of users, along with a good way to immediatly revoke access as users leave the organization?

Mordak 12y ago
It was just moved from base to ports, so you can still get it from ports/security/heimdal if you want it.
- e12e 12y ago
  Sure. But authentication and authorization of users isn't like showing a static (or dynamic) web page (ie: simpler httpd vs more full-featured nginx). I'd say moving it out of base is a pretty strong signal to OpenBSD users. (Now, granted, kerberos have and have had perhaps more than its share of issues ... so the signal could just be: you probably shouldn't have been depending on this to be secure enough to grant access to the server in the first place). I'm more curious if this means OpenBSD (base) doesn't have any form of secure(ish) federated auth(z) story (other than ssh certs) any more.
  - mrweasel 12y ago
    You could use LDAP, that's in base. There's even an small OpenBSD LDAP daemon actively maintained by the OpenBSD proejct.
    - erglkjahlkh 12y ago
      That is not Single-Sign-On, if you have to sign on several times. LDAP is NOT a replacement for Kerberos. OAuth and alike might be, but when you work with internal users Kerberos is much much better. Also for web services because GSSAPI/spnego stuff just works. By removing kerberos from base setup openBSD people have once more moved towards irrelevance outside their own closet setups. Kerberos is the only really working method you can use in corporate setups for large amounts of users and achieving SSO. When it's not in base setup, it's just easier to install any decent Linux distro, and skip openBSD. That as market placement decision was yet another major blunder from openBSD folks, and still they wonder why their donations have dried up the last a few years...