OpenBSD Inquiry reddit / BSD ---------------------------------------------------------------------- StupidFuck6969 · 2019-02-11 00:40 is OpenBSD really that secure when taking into account it's apparent faults? There are numerous criticisms I've found online regarding OpenBSD, and the main thing is this: OpenBSD lacks TrustedBSD MAC (Mandatory Access Control), as well as jails and ACL's. OpenBSD's chroot mechanism for isolating services is more secure than on at least most other \*nix, but it's still not as secure as a FreeBSD jail. The main argument against OpenBSD is that it provides very limited access controls. So is all of this true? Would FreeBSD with some possible additional configuration be a better choice in light of these critiques? ---------------------------------------------------------------------- IAmThe11 · 2019-02-11 00:59 Jails are not necessarily a security mechanism but more like virtualization. OpenBSD's filesystem does not need ACLs because it uses FFS. What you read is just FUD. ---------------------------------------------------------------------- LocalRefuse · 2019-02-11 08:14 Yes, OpenBSD is better security-wise than FreeBSD. FreeBSD is currently lagging behind in implementing certain kinds of security mitigation. OpenBSD is also more ready to delete bad code even if it loses some functionality. There are also other BSDs besides those two. The security mitigations I am mentioning are the kinds that benefit you even if you don't take action to use them. If you are not using jails they do not give you any security benefits. ---------------------------------------------------------------------- DamienCouderc · 2019-02-11 11:33 Just take a look in events & papers : [https://www.openbsd.org/events. html](https://www.openbsd.org/events.html) For example a limited list of papers : * Bob Beck, Unveil in OpenBSD ([slides](https://www.openbsd.org/papers/eurobsdcon2018-unveil/)) * Todd Mortimer, Removing ROP Gadgets from OpenBSD ([slides](https://www.openbsd.org/papers/eurobsdcon2018-rop.pdf), [video](https://youtu.be/ZvSSHtRv5Mg?t=28)) * Bob Beck, Adventures in OpenBSD pledge - SIGABRT is your friend. ([ slides](https://www.openbsd.org/papers/BeckPledgeUnveilBSDCan2018.pdf) , [video](https://www.youtube.com/watch?v=bXO6nelFt-E)) * Theo de Raadt, Speculation about Intel Speculation ([slides](https://www.openbsd.org/papers/speculation2018.pdf)) * Theo de Raadt gave a presentation [Thwarting (ROP) Return Oriented Programming (ROP) Attacks](https://www.openbsd.org/papers/rop.pdf) * Theo de Raadt, [Mitigations and other real Security Features](https://www.openbsd.org/papers/bsdtw.pdf) * Giovanni Bechis gave a talk about pledge(2) ([slides](https://www.snb.it/downloads/seccomp-pledge-oss2017.pdf)) * Theo de Raadt, [Pledge and Privsep](https://www.openbsd.org/papers/eurobsdcon2017-pledge.pdf) ([video](https://www.youtube.com/watch?v=fYgG0ds2_UQ)) * Mike Larkin presented [Kernel W\^X Improvements In OpenBSD](https://www.openbsd.org/papers/hackfest2015-w-xor-x.pdf). A [video](https://www.youtube.com/watch?v=A7vtAAeW6zo) is available * Theo de Raadt presented an updated talk about [arc4random](https:// www.openbsd.org/papers/hackfest2014-arc4random/index.html) * Philip Guenther: ["Secure lazy binding"](https://www.openbsd.org/pa pers/eurobsdcon2014_securelazy/slide001.html) * Theo de Raadt gave a talk on ["Security Mitigation Techniques: An update after 10 years"](https://www.openbsd.org/papers/ru13-deraadt) * Matthieu Herrb, [ Security measures in OpenBSD](http://homepages.laas.fr/matthieu/talks/openbsd-h2k9.pdf) * Peter Valchev gave a talk titled [ Using OpenBSD Security Features to Find Software Bugs](https://www.openbsd.org/papers/rp2007-slides.pdf) * Damien Miller presented a paper [Security measures in OpenSSH](https://www.openbsd.org/papers/openssh-measures- asiabsdcon2007.pdf). Presentation [slides](https://www.openbsd.org/papers/openssh-measures- asiabsdcon2007-slides.pdf) are also available. * Theo presented his ["Exploit Mitigation Techniques"](https://www.openbsd.org/papers/ven05-deraadt) talk Compare this to others OS security features and ask yourself who have the important ones (like, for example, are ACL really useful for my use case ?). ---------------------------------------------------------------------- DamienCouderc · 2019-02-11 11:35 PS : I don't understand why the post is downvoted, the question is legitimate even if the OP didn't do his homework. ---------------------------------------------------------------------- b6s6d6 · 2019-02-11 14:31 If you want FreeBSD but more secure, then try HardenedBSD [https://hardenedbsd.org/content/easy-feature- comparison](https://hardenedbsd.org/content/easy-feature-comparison) ---------------------------------------------------------------------- daemonpenguin · 2019-02-11 16:10 OpenBSD and FreeBSD have different approaches to security. As the OP pointed out, FreeBSD focuses on isolating processes. MAC, ACL, and Jails are all isolation techniques. This makes the base OS more complex (and prone to bugs) in exchange for locking down third-party programs which may cause problems or get exploited. OpenBSD focuses on having a minimal attack surface and security through correctness. OpenBSD offers fewer isolation techniques in exchange for keeping the base OS clean and secure. OpenBSD expects programs to voluntarily isolate themselves using unveil and pledge, etc. FreeBSD is better in instances where you are going to be running third-party software that is likely to be exploited eventually. OpenBSD is better for when all the software you need is in the base OS and you expect it to not get exploited at all, but it falls apart a bit if you start adding unaudited third-party code to the system. It's not a case of one being better, the two systems have different focuses and use cases. ---------------------------------------------------------------------- StupidFuck6969 · 2019-02-11 23:26 Thanks. How would you address these: [https://aboutthebsds.wordpress.com/2013/01/25/20/](https://aboutthebs ds.wordpress.com/2013/01/25/20/) [https://allthatiswrong.wordpress.com/2010/01/20/the-insecurity-of- openbsd/](https://allthatiswrong.wordpress.com/2010/01/20/the- insecurity-of-openbsd/) [https://i.warosu.org/data/g/img/0697/62/1549924433253.png](https://i. warosu.org/data/g/img/0697/62/1549924433253.png) ---------------------------------------------------------------------- Puddle_of_Snark · 2019-02-11 23:41 > OpenBSD's filesystem does not need ACLs because it uses FFS In no world does this wording make sense. OpenBSD simply doesn't support ACLs. ​ ---------------------------------------------------------------------- yourhelpfulfriend · 2019-02-12 07:58 You can safely ignore the "about the bsds" website. The guy was a well-known troll. Just look at the blog post you linked. He claims that 60% of third party software distributed by OpenBSD is malware. In what world is that believable? I remember one time when he said that the largest part of the OpenBSD Foundation (or was it FreeBSD Foundation?) budget was spent on alcohol for developers. As for the image you linked, what is the point? Yes, OpenBSD has fewer software packaged than, say, Debian. And yes, the developers can't audit the third party software the same way they audit the base system. But that's true of \_every\_ Linux distro as well. I've had packages on Debian flat out fail to run, so I know the packagers weren't coming close to examining every single line of code. And how many of the Debian developers actually audit the bloated Linux kernel or GNU userland? When you get to the smaller distros, I really doubt that \_anyone\_ has audited \_anything\_. The middle link is at least intelligent, but as has been mentioned, OpenBSD favors simple, sane defaults, over complex features that are difficult to use correctly. Take your choice. ---------------------------------------------------------------------- [deleted] · 2019-02-17 08:45 Facts. When I was new to OpenBSD, the first website I went at to read about the platform said that Theo was in love triangle with the lead dev at FreeBSD and the lead dev at NetBSD. The NetBSD guy got jealous and kicked him out of project, so he then forked it. The internet is full of trolling nonsense.