TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

OpenBSD Jumpstart: Learn to Tame OpenBSD Quickly

131 点作者 fcambus超过 9 年前

9 条评论

jlgaddis超过 9 年前
I played with OpenBSD many, many years ago (when I had much more free time) but then didn&#x27;t touch it for years.<p>After hearing about JETPLOW [0], I decided to replace the Cisco ASA that I had been using for my (fiber) Internet connection at home with an open-source router&#x2F;firewall.<p>I had a RouterMaxx 1106 [1] (PDF) laying around so I decided to put OpenBSD on it and use that. In short order, I built an OpenBSD virtual machine, used flashrd [2] to build an OpenBSD image I could put on a CompactFlash card, and had it up and running.<p><i>It just works.</i><p>About two years later, it&#x27;s still humming along nicely. The only downtime that I&#x27;ve had is when I upgraded to a new OpenBSD version. I could&#x27;ve minimized somewhat but I use a new CF card every time.<p>Nowadays, I&#x27;ve also got a dedicated laptop running OpenBSD that I use solely for &quot;security critical&quot; stuff for $work. A separate machine stands in between the Internet and our MX hosts and runs OpenBSD&#x27;s spamd [3] to help keep spam out of our users&#x27; mailboxes (N.B.: the number of messages hitting out Barracuda dropped by ~70%, with <i>zero</i> complaints received from any of our users).<p>In addition, we&#x27;re just beginning a project to basically rebuild our entire server infrastructure and we&#x27;ll be using OpenBSD for certain functions: remote access (OpenVPN), SSH jump hosts, possibly authoritative DNS, etc.<p>I&#x27;m a firm believer in using &quot;the best tool for the job&quot;. Most of our servers will be running FreeBSD, but OpenBSD definitely has its place in our environment.<p>[0]: <a href="https:&#x2F;&#x2F;nsa.gov1.info&#x2F;dni&#x2F;nsa-ant-catalog&#x2F;firewalls&#x2F;" rel="nofollow">https:&#x2F;&#x2F;nsa.gov1.info&#x2F;dni&#x2F;nsa-ant-catalog&#x2F;firewalls&#x2F;</a><p>[1]: <a href="http:&#x2F;&#x2F;www.balticnetworks.com&#x2F;docs&#x2F;routermaxx%206%20port.pdf" rel="nofollow">http:&#x2F;&#x2F;www.balticnetworks.com&#x2F;docs&#x2F;routermaxx%206%20port.pdf</a><p>[2]: <a href="http:&#x2F;&#x2F;www.nmedia.net&#x2F;flashrd&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.nmedia.net&#x2F;flashrd&#x2F;</a><p>[3]: <a href="http:&#x2F;&#x2F;www.openbsd.org&#x2F;spamd&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.openbsd.org&#x2F;spamd&#x2F;</a>
nalck超过 9 年前
This is quite the handy resource! Great idea and well done. OpenBSD is really quite friendly, just need to be comfortable with reading man pages and Unix basics.<p>A tip for first-timers: perform the installation with an Ethernet internet connection. On my laptop, wireless firmware was installed and configured automagically on first boot. After that it&#x27;s all gravy.
评论 #10796517 未加载
评论 #10795480 未加载
评论 #10795505 未加载
SwellJoe超过 9 年前
I&#x27;ve never seriously used any BSD, but I do have to admit I like that things don&#x27;t change for the sake of change, as seems to happen on Linux every couple of years. With OpenBSD, docs from 10 years ago are generally workable, because nothing on the user side has changed. That&#x27;s got some definite benefits. I&#x27;ve been using Linux as my primary OS for 20 years, as of this year (which is, coincidentally about as long as OpenBSD has been around), and I don&#x27;t feel significantly more &quot;on top of&quot; the OS than I did 10 or even 15 years ago. On many fronts, I&#x27;m further behind, because I have so much less free time, and there&#x27;s so much more to a Linux system. And, <i>so much</i> has changed.<p>That said, there&#x27;s a bunch of trade-offs. Virtualization on OpenBSD is, as far as I can tell, effectively a non-starter for any major project (i.e. those with many VMs, a virtual network, virtual disks, etc.). Containers seem to not exist, at all, though I found some historic mentions of jail-based options.<p>It <i>seems</i> like a perfect candidate for a VM or container guest OS, due to security focus, small size, simple deployment, etc. But, you then have to have two sets of skills: Managing your guest operating system, and managing your host operating system. Since Linux is the strongest container or VM hosting OS on the server (this was once debatable when Solaris Zones was new and Linux was still somewhat immature on the container front, but I don&#x27;t think anyone would make the case that Linux isn&#x27;t the obvious choice for hosting VMs or containers in most deployments today), and Linux is pretty far away from OpenBSD, you&#x27;ve got two pretty widely divergent skill sets needed.<p>Nonetheless, every time I read about OpenBSD, I feel a strong urge to give it a try. It seems extremely elegant in the way old UNIX systems were elegant. It appeals to me on a lot of fronts. Also, the code and documentation are extremely readable, in ways I&#x27;ve rarely seen elsewhere (FreeBSD also meets this description, but it&#x27;s so much bigger it can still be daunting).<p>I wonder if anyone is working on a Zones port to any BSD? OpenBSD with a convincing container or virtualization story would be a tipping point for me, in terms of being willing to put in the effort to learn it and use it.
评论 #10796584 未加载
评论 #10795795 未加载
评论 #10795792 未加载
评论 #10795833 未加载
评论 #10796549 未加载
mozumder超过 9 年前
How does networking speed compare to FreeBSD and Linux?<p>If I were to make an REST API server, that serves 10,000 requests per second per core, which OS should I use?
评论 #10796972 未加载
评论 #10797297 未加载
评论 #10796289 未加载
评论 #10796425 未加载
blue1超过 9 年前
I&#x27;ve been using OpenBSD on my firewall for ages, but the fact that patches are only distributed in source form is a giant giant hassle. I understand the reasons for that but it&#x27;s a level of inconvenience that I find unbearable today. On Debian it&#x27;s just &quot;apt-get upgrade&quot;. On OpenBSD it&#x27;s so more difficult that I usually end just not patching it at all.
评论 #10797468 未加载
评论 #10797629 未加载
ksec超过 9 年前
There are different FreeBSD flavours such as PC-BSD which solely focus on PC Desktop usage.<p>I wonder why there are any similar initiative for OpenBSD? I am sure OpenBSD is great fit for Server and Internet based Appliance where security is a prime concern, and doesn&#x27;t require PC desktop support.
unixhero超过 9 年前
This is great.
wila超过 9 年前
Very nice, here&#x27;s the plain text version instead of slide format.<p>Learn to tame OpenBSD quickly.<p>December 24, 2015<p>History<p>Forked from NetBSD. Theo De Raadt is the founder and leader of the OpenBSD project. The first OpenBSD release (1.1&#x2F;CVS) appear on October 18, 1995.<p>Why use OpenBSD ?<p><pre><code> UNIX-like Get the last version of OpenSSH, OpenSMTPD, OpenNTPD, OpenBGPD, OpenOSPFD, LibreSSL Get the last PF (Packet Filter) features Security focused Operating System Thorough documentation Cryptography </code></pre> Forked from NetBSD. Theo De Raadt is the founder and leader of the OpenBSD project. The first OpenBSD release (1.1&#x2F;CVS) appear on October 18, 1995.<p>OpenBSD Version numbers<p><pre><code> Six month release cycle New release is incremented by 0.1 </code></pre> OpenBSD&#x27;s Flavors<p><pre><code> -release: The version of OpenBSD shipped every six months -current: Development just after the release -stable: Release, plus patches (support ~ 1 year) </code></pre> Installation<p>Really simple, ready in 5 minutes (KISS).<p>Get more information: <a href="http:&#x2F;&#x2F;www.openbsd.org&#x2F;faq&#x2F;faq4.html" rel="nofollow">http:&#x2F;&#x2F;www.openbsd.org&#x2F;faq&#x2F;faq4.html</a><p>Networking (Files)<p><pre><code> File Contain &#x2F;etc&#x2F;myname Default hostname. &#x2F;etc&#x2F;hostname.if Configuration for each network interface, for example: &#x2F;etc&#x2F;hostname.bge0 &#x2F;etc&#x2F;mygate Default gateway. &#x2F;etc&#x2F;resolv.conf Resolver (DNS). &#x2F;etc&#x2F;hosts Known hosts on the network. </code></pre> Networking<p><pre><code> # See available network cards: &#x2F;sbin&#x2F;ifconfig # Restart networking service: &#x2F;bin&#x2F;sh &#x2F;etc&#x2F;netstart # Set DHCP for &#x27;re0&#x27; interface, on the fly: &#x2F;sbin&#x2F;dhclient re0 </code></pre> Networking (Routing)<p><pre><code> # Show the routing table (ipv4): &#x2F;usr&#x2F;bin&#x2F;netstat -rnf inet # Show the routing table (ipv6): &#x2F;usr&#x2F;bin&#x2F;netstat -rnf inet6 # Delete all gateway entries from the routing table: &#x2F;sbin&#x2F;route -n flush </code></pre> Networking (set at startup)<p>Example 1: configure static IP address for re0.<p><pre><code> ## file: &#x2F;etc&#x2F;hostname.re0 inet 192.168.0.58 255.255.255.0 # For more information, read the manual: hostname.if(5) </code></pre> Don&#x27;t forget to run &#x27;sh &#x2F;etc&#x2F;netstart re0&#x27; to apply changes to running system.<p>Example 2: configure DHCP for bge0.<p><pre><code> ## file: &#x2F;etc&#x2F;hostname.bge0 dhcp # For more information, read the manual: hostname.if(5) </code></pre> Don&#x27;t forget to run &#x27;sh &#x2F;etc&#x2F;netstart bge0&#x27; to apply changes to running system.<p>Example 3: configure wireless.<p><pre><code> ## file: &#x2F;etc&#x2F;hostname.iwn0 nwid ACCESS_POINT_NAME wpakey THE_SECRET_KEY dhcp # For more information, read the manual: hostname.if(5) </code></pre> Don&#x27;t forget to run &#x27;sh &#x2F;etc&#x2F;netstart iwn0&#x27; to apply changes to running system.<p>PF (Packet Filter)<p><pre><code> Ruleset: &#x2F;etc&#x2F;pf.conf </code></pre> Useful commands.<p><pre><code> # Disable PF &#x2F;sbin&#x2F;pfctl -d # Enable PF and load the rules &#x2F;sbin&#x2F;pfctl -ef &#x2F;etc&#x2F;pf.conf # Just load the rules (apply changes) &#x2F;sbin&#x2F;pfctl -f &#x2F;etc&#x2F;pf.conf # View the loaded rules &#x2F;sbin&#x2F;pfctl -s rules </code></pre> For more information, read the manual: pfctl(8)<p>Pf ruleset sample<p><pre><code> ## file: &#x2F;etc&#x2F;pf.conf # Protect a laptop (allow only ping&#x2F;ssh from anywhere) set skip on lo set fingerprints &quot;&#x2F;dev&#x2F;null&quot; block log all pass in on egress inet proto icmp all icmp-type echoreq pass in on egress inet proto tcp from any to any port ssh pass out # For more information, read the manual: pf.conf(5) </code></pre> Debug PF with tcpdump(8)<p><pre><code> &#x2F;usr&#x2F;sbin&#x2F;tcpdump -nettti pflog0 </code></pre> Manage users<p>Manually<p><pre><code> &#x2F;usr&#x2F;sbin&#x2F;user [add|del|info|mod] user_name </code></pre> The interactive way<p><pre><code> # Add users &#x2F;usr&#x2F;sbin&#x2F;adduser # Remove users &#x2F;usr&#x2F;sbin&#x2F;rmuser </code></pre> For more information, read the manual: adduser(8)<p>Manage Groups<p><pre><code> File: &#x2F;etc&#x2F;group &#x2F;usr&#x2F;sbin&#x2F;group [add|del|info|mod] group_name </code></pre> Members in &#x27;wheel&#x27; group can use su(1) to become &#x27;root&#x27;.<p>For more information, read the manual: group(8,5)<p>sudo replaced with doas(1)<p><pre><code> ## file: &#x2F;etc&#x2F;doas.conf # Permit the user &#x27;Marc&#x27; to reboot the box permit nopass marc as root cmd reboot </code></pre> Marc can now reboot the box:<p><pre><code> $ doas reboot </code></pre> For more information, read the manual: doas.conf(5)<p>Install Packages<p><pre><code> export PKG_PATH=http:&#x2F;&#x2F;ftp.openbsd.org&#x2F;pub&#x2F;OpenBSD&#x2F;5.8&#x2F;packages&#x2F;amd64&#x2F; # OR use &#x27;installpath&#x27; variable in &#x2F;etc&#x2F;pkg.conf: installpath=http:&#x2F;&#x2F;ftp2.fr.openbsd.org&#x2F;pub&#x2F;OpenBSD&#x2F;%c&#x2F;packages&#x2F;%a&#x2F; # Add sudo package &#x2F;usr&#x2F;sbin&#x2F;pkg_add sudo </code></pre> Some packages provide configuration and other information in a file located in &#x27;&#x2F;usr&#x2F;local&#x2F;share&#x2F;doc&#x2F;pkg-readmes&#x27;.<p>For more information, read the manual: pkg.conf(5)<p>Packages<p><pre><code> # List packages installed &#x2F;usr&#x2F;sbin&#x2F;pkg_info # View install-message for a specific package &#x2F;usr&#x2F;sbin&#x2F;pkg_info -M package_name # Remove a Package &#x2F;usr&#x2F;sbin&#x2F;pkg_delete package_name # Delete unused dependencies &#x2F;usr&#x2F;sbin&#x2F;pkg_delete -a </code></pre> For more information, read the manual: packages(7)<p>Install non-free firmware packages<p><pre><code> &#x2F;usr&#x2F;sbin&#x2F;fw_update </code></pre> Firmware is downloaded from release-specific directories at: <a href="http:&#x2F;&#x2F;firmware.openbsd.org&#x2F;firmware&#x2F;" rel="nofollow">http:&#x2F;&#x2F;firmware.openbsd.org&#x2F;firmware&#x2F;</a><p>Manage daemons, services<p><pre><code> File: &#x2F;etc&#x2F;rc.conf.local &#x2F;usr&#x2F;sbin&#x2F;rcctl [enable|disable|start|stop|reload|restart] daemon_name # Examples &#x2F;usr&#x2F;sbin&#x2F;rcctl enable ipsec &#x2F;usr&#x2F;sbin&#x2F;rcctl enable isakmpd &#x2F;usr&#x2F;sbin&#x2F;rcctl set isakmpd flags -K &#x2F;usr&#x2F;sbin&#x2F;rcctl start isakmpd </code></pre> For more information, read the manual: rcctl(8)<p>Run a script at startup<p><pre><code> File: &#x2F;etc&#x2F;rc.local </code></pre> For more information, read the manual: rc.local(8)<p>Update OpenBSD<p>Any security or reliability fixes can be found at: <a href="http:&#x2F;&#x2F;www.openbsd.org&#x2F;errata.html" rel="nofollow">http:&#x2F;&#x2F;www.openbsd.org&#x2F;errata.html</a><p>You can also use the openup tool from M:tier<p>Upgrade OpenBSD<p>To upgrade 5.6 to 5.8, you need to follow instructions:<p><a href="http:&#x2F;&#x2F;www.openbsd.org&#x2F;faq&#x2F;upgrade57.html" rel="nofollow">http:&#x2F;&#x2F;www.openbsd.org&#x2F;faq&#x2F;upgrade57.html</a> &amp; <a href="http:&#x2F;&#x2F;www.openbsd.org&#x2F;faq&#x2F;upgrade58.html" rel="nofollow">http:&#x2F;&#x2F;www.openbsd.org&#x2F;faq&#x2F;upgrade58.html</a><p>OpenBSD Filesystem<p><pre><code> The most important: &#x2F; Root directory. &#x2F;home User home directories. &#x2F;root Default home directory for the superuser. &#x2F;mnt A temporary mount point. &#x2F;etc System configuration files and scripts. &#x2F;etc&#x2F;examples Example configuration files for base system daemons. &#x2F;etc&#x2F;skel (dot) files for new accounts. &#x2F;etc&#x2F;signify Key files used for signify(1). &#x2F;tmp Cleaned after a reboot. &#x2F;var&#x2F;tmp Symbolic link to the system &#x2F;tmp. &#x2F;var&#x2F;log Log files. &#x2F;var&#x2F;run pid, socket files, utmp, dmesg.boot &#x2F;var&#x2F;db Database files. &#x2F;var&#x2F;www Configuration files for httpd(8). &#x2F;usr&#x2F;local Used for third packages installed. &#x2F;usr&#x2F;src BSD and&#x2F;or local source files. </code></pre> For more information, read the manual: hier(7)<p>OpenBSD Kernels<p><pre><code> &#x2F;bsd Pure kernel executable (the operating system loaded into memory at boot-time). &#x2F;bsd.mp Pure kernel executable for multiprocessor machines. &#x2F;bsd.rd Installation kernel. The built-in RAM disk contains utilities which can be run without an external file system, so this kernel is useful for limited system maintenance too. </code></pre> Tune the system<p><pre><code> sysctl(8) get or set kernel state config(8) modify a kernel </code></pre> Need more help ?<p><pre><code> FAQ: http:&#x2F;&#x2F;www.openbsd.org&#x2F;faq&#x2F; Manual page: afterboot(8) Mailing list: misc@ </code></pre> Presentations &amp; Papers<p><pre><code> http:&#x2F;&#x2F;www.openbsd.org&#x2F;papers&#x2F; </code></pre> Supporting OpenBSD<p><pre><code> Donations [1] OpenBSD Foundation [2] OpenBSD Store [3] </code></pre> Thank you. Feedback: contact@<p>[1] <a href="http:&#x2F;&#x2F;www.openbsd.org&#x2F;donations.html" rel="nofollow">http:&#x2F;&#x2F;www.openbsd.org&#x2F;donations.html</a><p>[2] <a href="http:&#x2F;&#x2F;www.openbsdfoundation.org&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.openbsdfoundation.org&#x2F;</a><p>[3] <a href="http:&#x2F;&#x2F;www.openbsdstore.com&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.openbsdstore.com&#x2F;</a>
digitalzombie超过 9 年前
Slide 3:<p>&gt; Get the last PF (Packet Filter) features<p>last -&gt; latest
评论 #10799935 未加载