14 ms·

Semi-related: is anyone here using OpenBSD in their daily DevOps setup? If so, why did you choose it (say, over Linux or FreeBSD)?

by sauere 12y ago

alrs 12y ago
I don't think you're using the term "devops" very well. http://en.wikipedia.org/wiki/DevOps http://en.wikipedia.org/wiki/DevOps Are you asking if OpenBSD is part of people's workflow, or if it is part of their permanent infrastructure?
eksith 12y ago
OpenBSD is what I use to host a bunch of private sites for myself and a few people I know. This is only due to some custom configurations and applications that my shared webhost didn't provide and for things I can't be bothered with, like my own domain which is static html. I put them on the shared host. I wish it was for a lofty goal like security and "code correctness" etc... but the honest answer is that it's extremely simple (once you get used to it) and I tend to be extremely lazy at times. Configuration is very straightforward for a lot of things and there have been very few surprises along the way. Actually no surprises that I can recall in most of what I do since 5.0. I wouldn't recommend it as a desktop system although plenty of people (including my boss) use it as such. There is some fiddling required for this that I'd rather not do, but for very simple, stable and surprise-free servers, it works very well for me. I also wouldn't recommend it for first-time admins either, although their man pages are some of the most thorough and helpful I've ever read.
- cgag 12y ago
  I installed freebsd on an old laptop (thinkpad t60) because I want to use something simple, very well documented, and with an emphasis on good code. I know OpenBSD takes this further, but I know FreeBSD has more packages/ports available, and I'm interested in playing with ZFS and jails.
  - aortega 12y ago
    The problem with FreeBSD is that it has almost no security features turned on by default. It's more unsafe than windows and much worst than Linux.
    - vezzy-fnord 12y ago
      FreeBSD is the only mainstream operating system that I know of which has absolutely no ASLR by default to this day. Thankfully, it looks like they're finally gonna get there soon: http://www.bsdcan.org/2014/schedule/events/452.en.html http://www.bsdcan.org/2014/schedule/events/452.en.html
    - stock_toaster 12y ago
      > The problem with FreeBSD is that it has almost no > security features turned on by default. What security features would you like to see turned on by default?
      - aortega 12y ago
        All of these https://wiki.ubuntu.com/Security/Features https://wiki.ubuntu.com/Security/Features
      - tedunangst 12y ago
        Stack protector for one. Though they finally did that. http://marc.info/?l=freebsd-stable&m=141495893928493&w=2 http://marc.info/?l=freebsd-stable&m=141495893928493&w=2
        stock_toaster 12y ago
        Yeah. Just saw that recently too. Good news! ASLR is apparently around the corner+ as well. Didn't OpenBSD get ASLR in 2008 or something like that? It only took 6 years for FreeBSD to get it.... >_< +for some definition of corner.
        12y ago
- brynet 12y ago
  I use OpenBSD on my laptops and desktop. The KMS drm drivers have been improved for 5.6. So you have 2D/3D acceleration, and unlike with FreeBSD, Xorg just works without configuration out of the box. For a more "desktop" experience, OpenBSD 5.6 also has working GNOME 3.12.2. One thing that tends to trip up desktop users is the default ulimits, BSD has login classes which may need to be tuned in login.conf(5). This is especially true if you plan on using modern web browsers which are resource hogs.
  - eksith 12y ago
    It seems I have to revaluate my stance on this. I admit, it's been a while since I ran OpenBSD as a full desktop. I've been happy with Crunchbang Linux so far as a simpler system, but maybe it's time I tried it again.
- stevekemp 12y ago
  I have to say I recently made a similar choice; I chose FreeBSD because I could easily download an ISO for it though. The documentation is exceptionally good, and the simplicity for configuration is a nice bonus.
  - anotherfact 12y ago
    OpenBSD has had downloadable ISO for a long time. It is easily reachable from ftp or http. FreeBSD's site requires for and takes more clicks to get to.
    - stevekemp 12y ago
      After reading this post I went looking, looking over the FTP site I did find an ISO. Thanks. My memory was always that ISOs were hard to find, and when I didn't see a big flashing link I guess I tuned out. I'll revisit OpenBSD in the future, for the moment I'm enjoying FreeBSD though.
- clarry 12y ago
  > I wouldn't recommend it as a desktop system although plenty of people (including my boss) use it as such. There is some fiddling required for this I've been running OpenBSD on a laptop (which works as my desktop) for years now, and I can say there's been very little fiddling. In fact it's proved to be the best out-of-the-box experience I've had with any OS (including Windows XP and a whole bunch of Linux distros). > I also wouldn't recommend it for first-time admins either I have to admit I wasn't administrating things for the first time when I did it on OpenBSD.. but OpenBSD was so simple and straightforward that I eventually lost the will to fiddle with other systems. They really have gone out of the way to make sure the system is Dead Simple to configure (the best configuration is no need for any configuration at all!), and when you really need to change something, the documentation is unparalleled. Of course, different people have different needs so what works for me might not work for everyone. I know that what seems to work for most people doesn't really work for me...
  - Touche 12y ago
    > I've been running OpenBSD on a laptop (which works as my desktop) for years now, and I can say there's been very little fiddling. In fact it's proved to be the best out-of-the-box experience I've had with any OS (including Windows XP and a whole bunch of Linux distros). I think with any BSD, trying to run it on modern hardware will be a frustrating experience as it lags behind Linux in hardware support (which itself lags behind Windows/OSX). Of course, BSDs are more coherent OSes and if it were not for hardware support I would use it exclusively.
superflit 12y ago
I use. And mostly I use for consumer internal applications. Why: 1. After install sometimes I do not have access or prompt access to the machine; 2. It is safe and the need for updates are minimal. It works..
smutticus 12y ago
I hack on my OSS project on OpenBSD exclusively. I'm a stickler for good documentation, and the BSDs IMO are far better than Linux. I use OpenBSD because 3-4 years ago I discovered a bug in the FreeBSD kernel that meant my OSS project wouldn't work. When generating lots of IGMPv2 packets on FreeBSD I could consistently cause the kernel to panic. I wrote a bug report, but I'm not a kernel hacker so I just switched to OpenBSD. Manpages in Linux are atrocious, and each distro has their own way of doing things that only half works. I don't like GNU info, and Googling for docs is unacceptable. I often work in places with no Internet and I need the doc with me.
- busterarm 12y ago
  I guess I'm biased as an Arch user but I've found their documentation to be leagues ahead of everything else I've used. That said, it doesn't solve the offline access issue you raised and the BSDs are firmly in second place. That said, I've been starting to care quite a lot more about security and code correctness in light of recent events and have been waiting for today to install OpenBSD on my machine.
  - eeZi 12y ago
    > That said, it doesn't solve the offline access issue you raised https://www.archlinux.org/packages/community/any/arch-wiki-docs/ https://www.archlinux.org/packages/community/any/arch-wiki-d...
    - rakoo 12y ago
      Also of interest: http://kmkeen.com/arch-wiki-lite/ http://kmkeen.com/arch-wiki-lite/
  - deleted 12y ago
    [deleted]
  - cgag 12y ago
    You'd put the bsd handbooks in second place after the Arch wiki? The FreeBSD handbook seems a lot more impressive and coherent to me, so does the OpenBSD documentation.
INTPenis 12y ago
No not at work. At home I use it on my two routers, one alix and one apu board. I ran into a huge backset with openbsd at work 3 years ago when I wanted to run two redundant load balancers with carp in vSphere. Turns out I had to enable promiscuous mode on an entire port group to make it happen. These days we use virtual switches so maybe it's easier now but in those days we did not want to do it because it would mean enabling promiscuous mode on an esx host adapter, affecting everyone on that host.
- feld 12y ago
  This is not OpenBSD's fault. It's VMWare's limitation in their vSwitch that by default disables broadcast traffic. XenServer has it worse -- no option to turn it on at all.
fidotron 12y ago
Further related, does anyone know of a rented server company that offers OpenBSD? Ideally a sort of Linode for OpenBSD, although I understand with the virtualization fun that's mildly unlikely to be a 1:1 equivalence. I can't be the only person that wants to deploy Linux based services piped through pf on OpenBSD and doesn't want to get into colocation.
- m0nastic 12y ago
  RootBSD (https://www.rootbsd.net/services/virtual-servers-vps/ https://www.rootbsd.net/services/virtual-servers-vps/) has OpenBSD VPS's (I'm guessing it'll be a little bit before they have 5.6 available).
  - ams6110 12y ago
    You can install it yourself actually, even if they don't offer it right away.
- jlgaddis 12y ago
  I've been a happy customer of ARP Networks [0] for about five years now (running Linux, FreeBSD, and OpenBSD hosts). I've pretty much moved everything off to my own servers (since I work for an ISP and can put whatever I want in our datacenters) but I do still have one VPS hosting a few websites. Native IPv6 is enabled on every host which, as a network engineer, is a huge plus for me. Physical location is at One Wilshire in Los Angeles and ARP has great connectivity and lots of peering. It's a small operation which, depending on your point of view, can be either a good thing or a bad thing. There is no "instant provisioning" (or wasn't, the last time I ordered a new host) so it may take a day or so for your host to be available for your use. On the other hand, you can often catch the owner in #arpnetworks on freenode and chat directly with him (or get quick answers to (general) questions from other happy customers). He's also on HN occasionally, if memory serves. [0]: https://arpnetworks.com/ https://arpnetworks.com/
- slasaus 12y ago
  TransIP in the Netherlands offers OpenBSD VPSs https://www.transip.eu/vps/operating-systems/ https://www.transip.eu/vps/operating-systems/
Mordak 12y ago
Yes. I've commented on this sort of thing before, but my preference for OpenBSD over other things really boils down to the Just Works factor, and the simplicity and transparency of the system. I usually find that getting things going on OpenBSD is straightforward and well documented, which saves me time and aggravation. The offline factor is handy for my work, and OpenBSD really shines here. I think the more interesting question is why OpenBSD over Linux (which distro?) or FreeBSD. For me, this comes down to preference for simplicity, an absence of weird abstractions over top of simple things like networking, and confidence in the quality of the base system. I like FreeBSD and happily use it in several instances (freebsd-update is pretty great for online updating), but have had very mixed results with Linux systems (mostly debian and ubuntu). Sometimes things work, and sometimes I waste hours trolling through internet forums trying to figure out how to make it do what I want. Really though, if you want to know what the difference is, you should just try it. Pull down the ISO, fire up a VM, do the install, and then try to get some work done. Take the time to read the man pages for afterboot, pkg_add and rc.conf.local, and you'll be on your way. The worst that could happen is you don't like it..
- atmosx 12y ago
  Hm, my only problem with my FreeBSD VPS is that ruby is terribly slow... I think it's the VM that slows down the ruby interpreter. Other than that, as you said BSD is way easier to maintain and configure because of it's clarity and documentation compared to Linux. On the other hand you can find documentation for Fedora and Ubuntu server in terms of blog-posts for just about everything.
- ezequiel-garzon 12y ago
  Thanks for such a thorough comment. What web browser do you use? Does it involve building from source? Ports? Thanks and cheers!
  - Mordak 12y ago
    Most of my work is server side (vim!), but on a client I just install firefox-esr with pkg_add. If there's a security update that I think I need, I'll 'make package' on the -stable branch in ports, and install that package wherever I need it. The -current branch keeps up to date with firefox pretty well if you want all the new features, but -current tends to move faster than I'm willing to keep up with.
JoachimSchipper 12y ago
Not really DevOps, but it's my main ("desktop") OS. I know it well, it's pretty damn secure, and it's an excellent development environment - good docs and lots of features that crash bad software.

Semi-related: is anyone here using OpenBSD in their daily DevOps setup? If so, why did you choose it (say, over Linux or FreeBSD)?

by sauere 12y ago

Semi-related: is anyone here using OpenBSD in their daily DevOps setup? If so, why did you choose it (say, over Linux or FreeBSD)?

alrs 12y ago

I don't think you're using the term "devops" very well. http://en.wikipedia.org/wiki/DevOps http://en.wikipedia.org/wiki/DevOps Are you asking if OpenBSD is part of people's workflow, or if it is part of their permanent infrastructure?

eksith 12y ago

OpenBSD is what I use to host a bunch of private sites for myself and a few people I know. This is only due to some custom configurations and applications that my shared webhost didn't provide and for things I can't be bothered with, like my own domain which is static html. I put them on the shared host. I wish it was for a lofty goal like security and "code correctness" etc... but the honest answer is that it's extremely simple (once you get used to it) and I tend to be extremely lazy at times. Configuration is very straightforward for a lot of things and there have been very few surprises along the way. Actually no surprises that I can recall in most of what I do since 5.0. I wouldn't recommend it as a desktop system although plenty of people (including my boss) use it as such. There is some fiddling required for this that I'd rather not do, but for very simple, stable and surprise-free servers, it works very well for me. I also wouldn't recommend it for first-time admins either, although their man pages are some of the most thorough and helpful I've ever read.

cgag 12y ago
I installed freebsd on an old laptop (thinkpad t60) because I want to use something simple, very well documented, and with an emphasis on good code. I know OpenBSD takes this further, but I know FreeBSD has more packages/ports available, and I'm interested in playing with ZFS and jails.
- aortega 12y ago
  The problem with FreeBSD is that it has almost no security features turned on by default. It's more unsafe than windows and much worst than Linux.
  - vezzy-fnord 12y ago
    FreeBSD is the only mainstream operating system that I know of which has absolutely no ASLR by default to this day. Thankfully, it looks like they're finally gonna get there soon: http://www.bsdcan.org/2014/schedule/events/452.en.html http://www.bsdcan.org/2014/schedule/events/452.en.html
  - stock_toaster 12y ago
    > The problem with FreeBSD is that it has almost no > security features turned on by default. What security features would you like to see turned on by default?
    - aortega 12y ago
      All of these https://wiki.ubuntu.com/Security/Features https://wiki.ubuntu.com/Security/Features
    - tedunangst 12y ago
      Stack protector for one. Though they finally did that. http://marc.info/?l=freebsd-stable&m=141495893928493&w=2 http://marc.info/?l=freebsd-stable&m=141495893928493&w=2
      - stock_toaster 12y ago
        Yeah. Just saw that recently too. Good news! ASLR is apparently around the corner+ as well. Didn't OpenBSD get ASLR in 2008 or something like that? It only took 6 years for FreeBSD to get it.... >_< +for some definition of corner.
        12y ago
brynet 12y ago
I use OpenBSD on my laptops and desktop. The KMS drm drivers have been improved for 5.6. So you have 2D/3D acceleration, and unlike with FreeBSD, Xorg just works without configuration out of the box. For a more "desktop" experience, OpenBSD 5.6 also has working GNOME 3.12.2. One thing that tends to trip up desktop users is the default ulimits, BSD has login classes which may need to be tuned in login.conf(5). This is especially true if you plan on using modern web browsers which are resource hogs.
- eksith 12y ago
  It seems I have to revaluate my stance on this. I admit, it's been a while since I ran OpenBSD as a full desktop. I've been happy with Crunchbang Linux so far as a simpler system, but maybe it's time I tried it again.
stevekemp 12y ago
I have to say I recently made a similar choice; I chose FreeBSD because I could easily download an ISO for it though. The documentation is exceptionally good, and the simplicity for configuration is a nice bonus.
- anotherfact 12y ago
  OpenBSD has had downloadable ISO for a long time. It is easily reachable from ftp or http. FreeBSD's site requires for and takes more clicks to get to.
  - stevekemp 12y ago
    After reading this post I went looking, looking over the FTP site I did find an ISO. Thanks. My memory was always that ISOs were hard to find, and when I didn't see a big flashing link I guess I tuned out. I'll revisit OpenBSD in the future, for the moment I'm enjoying FreeBSD though.
clarry 12y ago
> I wouldn't recommend it as a desktop system although plenty of people (including my boss) use it as such. There is some fiddling required for this I've been running OpenBSD on a laptop (which works as my desktop) for years now, and I can say there's been very little fiddling. In fact it's proved to be the best out-of-the-box experience I've had with any OS (including Windows XP and a whole bunch of Linux distros). > I also wouldn't recommend it for first-time admins either I have to admit I wasn't administrating things for the first time when I did it on OpenBSD.. but OpenBSD was so simple and straightforward that I eventually lost the will to fiddle with other systems. They really have gone out of the way to make sure the system is Dead Simple to configure (the best configuration is no need for any configuration at all!), and when you really need to change something, the documentation is unparalleled. Of course, different people have different needs so what works for me might not work for everyone. I know that what seems to work for most people doesn't really work for me...
- Touche 12y ago
  > I've been running OpenBSD on a laptop (which works as my desktop) for years now, and I can say there's been very little fiddling. In fact it's proved to be the best out-of-the-box experience I've had with any OS (including Windows XP and a whole bunch of Linux distros). I think with any BSD, trying to run it on modern hardware will be a frustrating experience as it lags behind Linux in hardware support (which itself lags behind Windows/OSX). Of course, BSDs are more coherent OSes and if it were not for hardware support I would use it exclusively.

superflit 12y ago

I use. And mostly I use for consumer internal applications. Why: 1. After install sometimes I do not have access or prompt access to the machine; 2. It is safe and the need for updates are minimal. It works..

smutticus 12y ago

I hack on my OSS project on OpenBSD exclusively. I'm a stickler for good documentation, and the BSDs IMO are far better than Linux. I use OpenBSD because 3-4 years ago I discovered a bug in the FreeBSD kernel that meant my OSS project wouldn't work. When generating lots of IGMPv2 packets on FreeBSD I could consistently cause the kernel to panic. I wrote a bug report, but I'm not a kernel hacker so I just switched to OpenBSD. Manpages in Linux are atrocious, and each distro has their own way of doing things that only half works. I don't like GNU info, and Googling for docs is unacceptable. I often work in places with no Internet and I need the doc with me.

busterarm 12y ago
I guess I'm biased as an Arch user but I've found their documentation to be leagues ahead of everything else I've used. That said, it doesn't solve the offline access issue you raised and the BSDs are firmly in second place. That said, I've been starting to care quite a lot more about security and code correctness in light of recent events and have been waiting for today to install OpenBSD on my machine.
- eeZi 12y ago
  > That said, it doesn't solve the offline access issue you raised https://www.archlinux.org/packages/community/any/arch-wiki-docs/ https://www.archlinux.org/packages/community/any/arch-wiki-d...
  - rakoo 12y ago
    Also of interest: http://kmkeen.com/arch-wiki-lite/ http://kmkeen.com/arch-wiki-lite/
- deleted 12y ago
  [deleted]
- cgag 12y ago
  You'd put the bsd handbooks in second place after the Arch wiki? The FreeBSD handbook seems a lot more impressive and coherent to me, so does the OpenBSD documentation.

INTPenis 12y ago

No not at work. At home I use it on my two routers, one alix and one apu board. I ran into a huge backset with openbsd at work 3 years ago when I wanted to run two redundant load balancers with carp in vSphere. Turns out I had to enable promiscuous mode on an entire port group to make it happen. These days we use virtual switches so maybe it's easier now but in those days we did not want to do it because it would mean enabling promiscuous mode on an esx host adapter, affecting everyone on that host.

feld 12y ago
This is not OpenBSD's fault. It's VMWare's limitation in their vSwitch that by default disables broadcast traffic. XenServer has it worse -- no option to turn it on at all.

fidotron 12y ago

Further related, does anyone know of a rented server company that offers OpenBSD? Ideally a sort of Linode for OpenBSD, although I understand with the virtualization fun that's mildly unlikely to be a 1:1 equivalence. I can't be the only person that wants to deploy Linux based services piped through pf on OpenBSD and doesn't want to get into colocation.

m0nastic 12y ago
RootBSD (https://www.rootbsd.net/services/virtual-servers-vps/ https://www.rootbsd.net/services/virtual-servers-vps/) has OpenBSD VPS's (I'm guessing it'll be a little bit before they have 5.6 available).
- ams6110 12y ago
  You can install it yourself actually, even if they don't offer it right away.
jlgaddis 12y ago
I've been a happy customer of ARP Networks [0] for about five years now (running Linux, FreeBSD, and OpenBSD hosts). I've pretty much moved everything off to my own servers (since I work for an ISP and can put whatever I want in our datacenters) but I do still have one VPS hosting a few websites. Native IPv6 is enabled on every host which, as a network engineer, is a huge plus for me. Physical location is at One Wilshire in Los Angeles and ARP has great connectivity and lots of peering. It's a small operation which, depending on your point of view, can be either a good thing or a bad thing. There is no "instant provisioning" (or wasn't, the last time I ordered a new host) so it may take a day or so for your host to be available for your use. On the other hand, you can often catch the owner in #arpnetworks on freenode and chat directly with him (or get quick answers to (general) questions from other happy customers). He's also on HN occasionally, if memory serves. [0]: https://arpnetworks.com/ https://arpnetworks.com/
slasaus 12y ago
TransIP in the Netherlands offers OpenBSD VPSs https://www.transip.eu/vps/operating-systems/ https://www.transip.eu/vps/operating-systems/

Mordak 12y ago

Yes. I've commented on this sort of thing before, but my preference for OpenBSD over other things really boils down to the Just Works factor, and the simplicity and transparency of the system. I usually find that getting things going on OpenBSD is straightforward and well documented, which saves me time and aggravation. The offline factor is handy for my work, and OpenBSD really shines here. I think the more interesting question is why OpenBSD over Linux (which distro?) or FreeBSD. For me, this comes down to preference for simplicity, an absence of weird abstractions over top of simple things like networking, and confidence in the quality of the base system. I like FreeBSD and happily use it in several instances (freebsd-update is pretty great for online updating), but have had very mixed results with Linux systems (mostly debian and ubuntu). Sometimes things work, and sometimes I waste hours trolling through internet forums trying to figure out how to make it do what I want. Really though, if you want to know what the difference is, you should just try it. Pull down the ISO, fire up a VM, do the install, and then try to get some work done. Take the time to read the man pages for afterboot, pkg_add and rc.conf.local, and you'll be on your way. The worst that could happen is you don't like it..

atmosx 12y ago
Hm, my only problem with my FreeBSD VPS is that ruby is terribly slow... I think it's the VM that slows down the ruby interpreter. Other than that, as you said BSD is way easier to maintain and configure because of it's clarity and documentation compared to Linux. On the other hand you can find documentation for Fedora and Ubuntu server in terms of blog-posts for just about everything.
ezequiel-garzon 12y ago
Thanks for such a thorough comment. What web browser do you use? Does it involve building from source? Ports? Thanks and cheers!
- Mordak 12y ago
  Most of my work is server side (vim!), but on a client I just install firefox-esr with pkg_add. If there's a security update that I think I need, I'll 'make package' on the -stable branch in ports, and install that package wherever I need it. The -current branch keeps up to date with firefox pretty well if you want all the new features, but -current tends to move faster than I'm willing to keep up with.

JoachimSchipper 12y ago

Not really DevOps, but it's my main ("desktop") OS. I know it well, it's pretty damn secure, and it's an excellent development environment - good docs and lots of features that crash bad software.