Misplaced Pages

Latest revision as of 15:26, 20 November 2024

OpenBSD

Free, Functional, and Secure
OpenBSD 7.0 default desktop with various utilities: top, xterm, xcalc, and glxgears
Developer	Theo de Raadt et al.
Written in	C, assembly, Perl, Unix shell
OS family	Unix-like (BSD)
Working state	Current
Source model	Free software
Initial release	July 1996; 28 years ago (1996-07)
Latest release	7.6 (8 October 2024; 2 months ago (2024-10-08)) [±]
Repository	cvsweb.openbsd.org/cgi-bin/cvsweb/
Package manager	OpenBSD package tools
Platforms	Alpha, x86-64, ARMv7, ARMv8 (64-bit), PA-RISC, IA-32, LANDISK, Loongson, Omron LUNA-88K, MIPS64, macppc, PowerPC, 64-bit RISC-V, SPARC64
Kernel type	Monolithic
Userland	BSD
Default user interface	Modified pdksh, X11 (FVWM)
License	BSD, ISC, other permissive licenses
Official website	www.openbsd.org

OpenBSD is a security-focused, free software, Unix-like operating system based on the Berkeley Software Distribution (BSD). Theo de Raadt created OpenBSD in 1995 by forking NetBSD 1.0. The OpenBSD project emphasizes portability, standardization, correctness, proactive security, and integrated cryptography.

The OpenBSD project maintains portable versions of many subsystems as packages for other operating systems. Because of the project's preferred BSD license, which allows binary redistributions without the source code, many components are reused in proprietary and corporate-sponsored software projects. The firewall code in Apple's macOS is based on OpenBSD's PF firewall code, Android's Bionic C standard library is based on OpenBSD code, LLVM uses OpenBSD's regular expression library, and Windows 10 uses OpenSSH (OpenBSD Secure Shell) with LibreSSL.

The word "open" in the name OpenBSD refers to the availability of the operating system source code on the Internet, although the word "open" in the name OpenSSH means "OpenBSD". It also refers to the wide range of hardware platforms the system supports. OpenBSD supports a variety of system architectures including x86-64, IA-32, ARM, PowerPC, and 64-bit RISC-V.

History

In December 1994, Theo de Raadt, a founding member of the NetBSD project, was asked to resign from the NetBSD core team over disagreements and conflicts with the other members of the NetBSD team. In October 1995, De Raadt founded OpenBSD, a new project forked from NetBSD 1.0. The initial release, OpenBSD 1.2, was made in July 1996, followed by OpenBSD 2.0 in October of the same year. Since then, the project has issued a release every six months, each of which is supported for one year.

On 25 July 2007, OpenBSD developer Bob Beck announced the formation of the OpenBSD Foundation, a Canadian non-profit organization formed to "act as a single point of contact for persons and organizations requiring a legal entity to deal with when they wish to support OpenBSD."

In 2024, it announced that the project has modified all files since the original import.

Usage statistics

It is hard to determine how widely OpenBSD is used, because the developers do not publish or collect usage statistics.

In September 2005, the BSD Certification Group surveyed 4330 individual BSD users, showing that 32.8% used OpenBSD, behind FreeBSD with 77%, ahead of NetBSD with 16.3% and DragonFly BSD with 2.6%. However, the authors of this survey clarified that it is neither "exhaustive" nor "completely accurate", since the survey was spread mainly through mailing lists, forums and word of mouth. This combined with other factors, like the lack of a control group, a pre-screening process or significant outreach outside of the BSD community, makes the survey unreliable for judging BSD usage globally.

Uses

Network appliances

OpenBSD features a robust TCP/IP networking stack, and can be used as a router or wireless access point. OpenBSD's security enhancements, built-in cryptography, and packet filter make it suitable for security purposes such as firewalls, intrusion-detection systems, and VPN gateways.

Several proprietary systems are based on OpenBSD, including devices from Armorlogic (Profense web application firewall), Calyptix Security, GeNUA, RTMX, and .vantronix.

Other operating systems

Some versions of Microsoft's Services for UNIX, an extension to the Windows operating system to provide Unix-like functionality, use much of the OpenBSD code base that is included in the Interix interoperability suite, developed by Softway Systems Inc., which Microsoft acquired in 1999. Core Force, a security product for Windows, is based on OpenBSD's pf firewall. The pf firewall is also found in other operating systems: including FreeBSD, and macOS.

Personal computers

OpenBSD ships with Xenocara, an implementation of the X Window System, and is suitable as a desktop operating system for personal computers, including laptops. As of September 2018, OpenBSD includes approximately 8000 packages in its software repository, including desktop environments such as Lumina, GNOME, KDE Plasma, and Xfce, and web browsers such as Firefox and Chromium. The project also includes three window managers in the main distribution: cwm, FVWM (part of the default configuration for Xenocara), and twm.

Servers

OpenBSD features a full server suite and can be configured as a mail server, web server, FTP server, DNS server, router, firewall, NFS file server, or any combination of these. Since version 6.8, OpenBSD has also shipped with native in-kernel WireGuard support.

Security

Shortly after OpenBSD was created, De Raadt was contacted by a local security software company named Secure Networks (later acquired by McAfee). The company was developing a network security auditing tool called Ballista, which was intended to find and exploit software security flaws. This coincided with De Raadt's interest in security, so the two cooperated leading up to the release of OpenBSD 2.3. This collaboration helped to define security as the focus of the OpenBSD project.

OpenBSD includes numerous features designed to improve security, such as:

• Secure alternatives to POSIX functions in the C standard library, such as strlcat for strcat and strlcpy for strcpy
• Toolchain alterations, including a static bounds checker
• Memory protection techniques to guard against invalid accesses, such as ProPolice and the W^X page protection feature
• Strong cryptography and randomization
• System call and filesystem access restrictions to limit process capabilities

To reduce the risk of a vulnerability or misconfiguration allowing privilege escalation, many programs have been written or adapted to make use of privilege separation, privilege revocation and chrooting. Privilege separation is a technique, pioneered on OpenBSD and inspired by the principle of least privilege, where a program is split into two or more parts, one of which performs privileged operations and the other—almost always the bulk of the code—runs without privilege. Privilege revocation is similar and involves a program performing any necessary operations with the privileges it starts with then dropping them. Chrooting involves restricting an application to one section of the file system, prohibiting it from accessing areas that contain private or system files. Developers have applied these enhancements to OpenBSD versions of many common applications, such as tcpdump, file, tmux, smtpd, and syslogd.

OpenBSD developers were instrumental in the creation and development of OpenSSH (aka OpenBSD Secure Shell), which is developed in the OpenBSD CVS repositories. OpenBSD Secure Shell is based on the original SSH. It first appeared in OpenBSD 2.6 and is now by far the most popular SSH client and server, available on many operating systems.

The project has a policy of continually auditing source code for problems, work that developer Marc Espie has described as "never finished ... more a question of process than of a specific bug being hunted." He went on to list several typical steps once a bug is found, including examining the entire source tree for the same and similar issues, "try to find out whether the documentation ought to be amended", and investigating whether "it's possible to augment the compiler to warn against this specific problem."

Security record

The OpenBSD website features a prominent reference to the system's security record. Until June 2002, it read:

Five years without a remote hole in the default install!

In June 2002, Mark Dowd of Internet Security Systems disclosed a bug in the OpenSSH code implementing challenge–response authentication. This vulnerability in the OpenBSD default installation allowed an attacker remote access to the root account, which was extremely serious not only to OpenBSD, but also to the large number of other operating systems that were using OpenSSH by that time. This problem necessitated the adjustment of the slogan on the OpenBSD website to:

One remote hole in the default install, in nearly 6 years!

The quote remained unchanged as time passed, until on 13 March 2007, when Alfredo Ortega of Core Security Technologies disclosed a network-related remote vulnerability. The quote was subsequently changed to:

Only two remote holes in the default install, in a heck of a long time!

This statement has been criticized because the default install contains few running services, and many use cases require additional services. Also, because the ports tree contains unaudited third-party software, it is easy for users to compromise security by installing or improperly configuring packages. However, the project maintains that the slogan is intended to refer to a default install and that it is correct by that measure.

One of the fundamental ideas behind OpenBSD is a drive for systems to be simple, clean, and secure by default. The default install is quite minimal, which the project states is to ensure novice users "do not need to become security experts overnight", which fits with open-source and code auditing practices considered important elements of a security system. Additional services are to be enabled manually to make users think of the security implications first.

Alleged backdoor

On 11 December 2010, Gregory Perry, a former technical consultant for the Federal Bureau of Investigation (FBI), emailed De Raadt alleging that the FBI had paid some OpenBSD ex-developers 10 years prior to insert backdoors into the OpenBSD Cryptographic Framework. De Raadt made the email public on 14 December by forwarding it to the openbsd-tech mailing list and suggested an audit of the IPsec codebase. De Raadt's response was skeptical of the report and he invited all developers to independently review the relevant code. In the weeks that followed, bugs were fixed but no evidence of backdoors was found. De Raadt stated "I believe that NetSec was probably contracted to write backdoors as alleged. If those were written, I don't believe they made it into our tree. They might have been deployed as their own product."

Criticisms

In December 2017, Ilja van Sprundel, director at IOActive, gave a talk at the CCC as well as DEF CON, entitled "Are all BSDs created equally? — A survey of BSD kernel vulnerabilities", in which he stated that although OpenBSD was the clear winner of the BSDs in terms of security, "Bugs are still easy to find in those kernels, even in OpenBSD".

Two years later, in 2019, a talk named "A systematic evaluation of OpenBSD's mitigations" was given at the CCC, arguing that while OpenBSD has some effective mitigations, a significant part of them are "useless at best and based on pure luck and superstition", arguing for a more rational approach when it comes to designing them.

Subprojects

Many open source projects started as components of OpenBSD, including:

• bioctl, a generic RAID management interface similar to ifconfig
• CARP, a free alternative to Cisco's patented HSRP/VRRP redundancy protocols
• cwm, a stacking window manager
• doas, a safer replacement for sudo
• OpenBSD httpd, an implementation of httpd
• hw.sensors, a sensors framework used by over 100 drivers
• LibreSSL, an implementation of the SSL and TLS protocols, forked from OpenSSL 1.0.1g
• OpenBGPD, an implementation of BGP-4
• OpenIKED, an implementation of IKEv2
• OpenNTPD, a simpler alternative to ntp.org's NTP daemon
• OpenOSPFD, an implementation of OSPF
• OpenSMTPD, an SMTP daemon with IPv4/IPv6, PAM, Maildir, and virtual domains support
• OpenSSH, an implementation of SSH
• PF, an IPv4/IPv6 stateful firewall with NAT, PAT, QoS and traffic normalization support
• pfsync, a firewall state synchronization protocol for PF with high availability support using CARP
• sndio, a compact audio and MIDI framework
• spamd, a spam filter with greylisting support designed to inter-operate with PF
• Xenocara, a customized X.Org build infrastructure

Some subsystems have been integrated into other BSD operating systems, and many are available as packages for use in other Unix-like systems.

Linux administrator Carlos Fenollosa commented on moving from Linux to OpenBSD that the system is faithful to the Unix philosophy of small, simple tools that work together well: "Some base components are not as feature-rich, on purpose. Since 99% of the servers don't need the flexibility of Apache, OpenBSD's httpd will work fine, be more secure, and probably faster". He characterized the developer community's attitude to components as: "When the community decides that some module sucks, they develop a new one from scratch. OpenBSD has its own NTPd, SMTPd and, more recently, HTTPd. They work great". As a result, OpenBSD is relatively prolific in creating components that become widely reused by other systems.

OpenBSD runs nearly all of its standard daemons within chroot and privsep security structures by default, as part of hardening the base system.

The Calgary Internet Exchange was formed in 2012, in part to serve the needs of the OpenBSD project.

In 2017, Isotop, a French project aiming to adapt OpenBSD to desktops and laptops, using xfce then dwm, started to be developed.

Third-party components

OpenBSD includes a number of third-party components, many with OpenBSD-specific patches, such as X.Org, Clang (the default compiler on several architectures), GCC, Perl, NSD, Unbound, ncurses, GNU binutils, GDB, and AWK.

Development

Development is continuous, and team management is open and tiered. Anyone with appropriate skills may contribute, with commit rights being awarded on merit and De Raadt acting as coordinator. Two official releases are made per year, with the version number incremented by 0.1, and these are each supported for twelve months (two release cycles). Snapshot releases are also available at frequent intervals.

Maintenance patches for supported releases may be applied using syspatch, manually or by updating the system against the patch branch of the CVS source repository for that release. Alternatively, a system administrator may opt to upgrade to the next snapshot release using sysupgrade, or by using the -current branch of the CVS repository, in order to gain pre-release access to recently added features. The sysupgrade tool can also upgrade to the latest stable release version.

The generic OpenBSD kernel provided by default is strongly recommended for end users, in contrast to operating systems that recommend user kernel customization.

Packages outside the base system are maintained by CVS through a ports tree and are the responsibility of the individual maintainers, known as porters. As well as keeping the current branch up to date, porters are expected to apply appropriate bug-fixes and maintenance fixes to branches of their package for OpenBSD's supported releases. Ports are generally not subject to the same continuous auditing as the base system due to lack of manpower.

Binary packages are built centrally from the ports tree for each architecture. This process is applied for the current version, for each supported release, and for each snapshot. Administrators are recommended to use the package mechanism rather than build the package from the ports tree, unless they need to perform their own source changes.

OpenBSD's developers regularly meet at special events called hackathons, where they "sit down and code", emphasizing productivity.

Most new releases include a song.

Open source and open documentation

OpenBSD is known for its high-quality documentation.

When OpenBSD was created, De Raadt decided that the source code should be available for anyone to read. At the time, a small team of developers generally had access to a project's source code. Chuck Cranor and De Raadt concluded this practice was "counter to the open source philosophy" and inconvenient to potential contributors. Together, Cranor and De Raadt set up the first public, anonymous revision control system server. De Raadt's decision allowed users to "take a more active role", and established the project's commitment to open access. OpenBSD is notable for its continued use of CVS (more precisely an unreleased, OpenBSD-managed fork named OpenCVS), when most other projects that used it have migrated to other systems.

OpenBSD does not include closed source binary drivers in the source tree, nor does it include code requiring the signing of non-disclosure agreements. According to the GNU Project, OpenBSD includes small "blobs" of proprietary object code as device firmware.

Since OpenBSD is based in Canada, no United States export restrictions on cryptography apply, allowing the distribution to make full use of modern algorithms for encryption. For example, the swap space is divided into small sections and each section is encrypted with its own key, ensuring that sensitive data does not leak into an insecure part of the system.

OpenBSD randomizes various behaviors of applications, making them less predictable and thus more difficult to attack. For example, PIDs are created and associated randomly to processes; the bind system call uses random port numbers; files are created with random inode numbers; and IP datagrams have random identifiers. This approach also helps expose bugs in the kernel and in user space programs.

The OpenBSD policy on openness extends to hardware documentation: in the slides for a December 2006 presentation, De Raadt explained that without it "developers often make mistakes writing drivers", and pointed out that "the rush is harder to achieve, and some developers just give up." He went on to say that vendor-supplied binary drivers are unacceptable for inclusion in OpenBSD, that they have "no trust of vendor binaries running in our kernel" and that there is "no way to fix ... when they break."

Licensing

OpenBSD maintains a strict license policy, preferring the ISC license and other variants of the BSD license. The project attempts to "maintain the spirit of the original Berkeley Unix copyrights," which permitted a "relatively un-encumbered Unix source distribution." The widely used Apache License and GNU General Public License are considered overly restrictive.

In June 2001, triggered by concerns over Darren Reed's modification of IPFilter's license wording, a systematic license audit of the OpenBSD ports and source trees was undertaken. Code in more than a hundred files throughout the system was found to be unlicensed, ambiguously licensed or in use against the terms of the license. To ensure that all licenses were properly adhered to, an attempt was made to contact all the relevant copyright holders: some pieces of code were removed, many were replaced, and others, such as the multicast routing tools mrinfo and map-mbone, were relicensed so that OpenBSD could continue to use them. Also removed during this audit was all software produced by Daniel J. Bernstein. At the time, Bernstein requested that all modified versions of his code be approved by him prior to redistribution, a requirement to which OpenBSD developers were unwilling to devote time or effort.

Because of licensing concerns, the OpenBSD team has reimplemented software from scratch or adopted suitable existing software. For example, OpenBSD developers created the PF packet filter after unacceptable restrictions were imposed on IPFilter. PF first appeared in OpenBSD 3.0 and is now available in many other operating systems. OpenBSD developers have also replaced GPL-licensed tools (such as CVS and pkg-config) with permissively licensed equivalents.

Funding

Although the operating system and its portable components are used in commercial products, De Raadt says that little of the funding for the project comes from the industry: "traditionally all our funding has come from user donations and users buying our CDs (our other products don't really make us much money). Obviously, that has not been a lot of money."

For a two-year period in the early 2000s, the project received funding from DARPA, which "paid the salaries of 5 people to work completely full-time, bought about $30k in hardware, and paid for 3 hackathons", from the POSSE project.

In 2006, the OpenBSD project experienced financial difficulties. The Mozilla Foundation and GoDaddy are among the organizations that helped OpenBSD to survive. However, De Raadt expressed concern about the asymmetry of funding: "I think that contributions should have come first from the vendors, secondly from the corporate users, and thirdly from individual users. But the response has been almost entirely the opposite, with almost a 15-to-1 dollar ratio in favor of the little people. Thanks a lot, little people!"

On 14 January 2014, Bob Beck issued a request for funding to cover electrical costs. If sustainable funding was not found, Beck suggested the OpenBSD project would shut down. The project soon received a US$20,000 donation from Mircea Popescu, the Romanian creator of the MPEx bitcoin stock exchange, paid in bitcoins. The project raised US$150,000 in response to the appeal, enabling it to pay its bills and securing its short-term future.

OpenBSD Foundation

The OpenBSD Foundation is a Canadian federal non-profit organization founded by the OpenBSD project as a "single point of contact for persons and organizations requiring a legal entity to deal with when they wish to support OpenBSD." It was announced to the public by OpenBSD developer Bob Beck on 25 July 2007. It also serves as a legal safeguard over other projects which are affiliated with OpenBSD, including OpenSSH, OpenBGPD, OpenNTPD, OpenCVS, OpenSMTPD and LibreSSL.

Since 2014, several large contributions to the OpenBSD Foundation have come from corporations such as Microsoft, Facebook, and Google as well as the Core Infrastructure Initiative.

In 2015, Microsoft became the foundation's first gold level contributor donating between $25,000-50,000 to support development of OpenSSH, which had been integrated into PowerShell in July, and later into Windows Server in 2018. Other contributors include Google, Facebook and DuckDuckGo.

During the 2016 and 2017 fundraising campaigns, Smartisan, a Chinese company, was the leading financial contributor to the OpenBSD Foundation.

Distribution

OpenBSD is freely available in various ways: the source can be retrieved by anonymous CVS, and binary releases and development snapshots can be downloaded by FTP, HTTP, and rsync. Prepackaged CD-ROM sets through version 6.0 can be ordered online for a small fee, complete with an assortment of stickers and a copy of the release's theme song. These, with their artwork and other bonuses, have been one of the project's few sources of income, funding hardware, Internet service, and other expenses. Beginning with version 6.1, CD-ROM sets are no longer released.

OpenBSD provides a package management system for easy installation and management of programs which are not part of the base operating system. Packages are binary files which are extracted, managed and removed using the package tools. On OpenBSD, the source of packages is the ports system, a collection of Makefiles and other infrastructure required to create packages. In OpenBSD, the ports and base operating system are developed and released together for each version: this means that the ports or packages released with, for example, 4.6 are not suitable for use with 4.5 and vice versa.

Songs and artwork

Initially, OpenBSD used a haloed version of the BSD daemon mascot drawn by Erick Green, who was asked by De Raadt to create the logo for the 2.3 and 2.4 versions of OpenBSD. Green planned to create a full daemon, including head and body, but only the head was completed in time for OpenBSD 2.3. The body as well as pitchfork and tail was completed for OpenBSD 2.4.

Subsequent releases used variations such as a police daemon by Ty Semaka, but eventually settled on a pufferfish named Puffy. Since then, Puffy has appeared on OpenBSD promotional material and featured in release songs and artwork.

The promotional material of early OpenBSD releases did not have a cohesive theme or design, but later the CD-ROMs, release songs, posters and tee-shirts for each release have been produced with a single style and theme, sometimes contributed to by Ty Semaka of the Plaid Tongued Devils. These have become a part of OpenBSD advocacy, with each release expounding a moral or political point important to the project, often through parody.

Themes have included Puff the Barbarian in OpenBSD 3.3, which included an 80s rock song and parody of Conan the Barbarian alluding to open documentation, The Wizard of OS in OpenBSD 3.7, related to the project's work on wireless drivers, and Hackers of the Lost RAID, a parody of Indiana Jones referencing the new RAID tools in OpenBSD 3.8.

Releases

The following table summarizes the version history of the OpenBSD operating system.

See also

• Comparison of BSD operating systems
• Comparison of open-source operating systems
• KAME project, responsible for OpenBSD's IPv6 support
• Lumina (desktop environment)
• OpenBSD Journal
• OpenBSD security features
• Security-focused operating system
• Unix security

Notes

1. ^ Multiple selections were permitted as users may use multiple BSD variants side by side.
2. Later renamed to Cybercop Scanner after SNI was purchased by Network Associates.
3. As of OpenBSD 6.3, either Clang 5.0.1, GCC 4.2.1 or GCC 3.3.6 is shipped, depending on the platform.
4. Compare release history of NetBSD, which OpenBSD branched from
5. ^ OpenBSD is released roughly every 6 months targeting May and November and only the latest two releases receive security and reliability fixes for the base system.

References

1. "Package Management". OpenBSD Frequently Asked Questions. Retrieved 1 June 2016.
2. "Platforms". OpenBSD. Retrieved 3 September 2016.
3. ^ "Copyright Policy". OpenBSD. Retrieved 13 December 2011.
4. ^ de Raadt, Theo (29 March 2009). "Archive of the mail conversation leading to Theo de Raadt's departure". Retrieved 15 January 2010.
5. OpenBSD Project (19 May 2020). "OpenBSD". OpenBSD.org. Retrieved 12 October 2020.
6. "Murus App, Apple PF for macOS from OpenBSD".
7. "Android's C Library Has 173 Files of Unchanged OpenBSD Code". Retrieved 8 October 2018.
8. "LLVM Release License". Retrieved 8 October 2018.
9. "OpenSSH for Windows". Retrieved 8 October 2018.
10. Grimes, Roger A. (29 December 2006). "New year's resolution No. 1: Get OpenBSD". InfoWorld.
11. Glass, Adam (23 December 1994). "Theo De Raadt". netbsd-users (Mailing list).
12. De Raadt, Theo (18 October 1996). "The OpenBSD 2.0 release". openbsd-announce (Mailing list).
13. "Announcing – The OpenBSD Foundation". OpenBSD Journal. 26 July 2007.
14. "'CVS: cvs.openbsd.org: src' - MARC". marc.info. Retrieved 1 November 2024.
15. ^ BSD Usage Survey (PDF) (Report). The BSD Certification Group. 31 October 2005. p. 9. Retrieved 16 September 2012.
16. "OpenBSD PF - Building a Router". Retrieved 8 August 2019.
17. "Building an OpenBSD wireless access point". Retrieved 8 August 2019.
18. ^ McIntire, Tim (8 August 2006). "Take a closer look at OpenBSD". Developerworks. IBM. Retrieved 13 December 2011.
19. "AccessEnforcer Model AE800". Calyptix Security. Archived from the original on 2 December 2020. Retrieved 28 May 2016.
20. "High Resistance Firewall genugate". GeNUA. Archived from the original on 19 September 2020. Retrieved 29 May 2016.
21. "RTMX O/S IEEE Real Time POSIX Operating Systems". RTMX. Retrieved 13 December 2011. RTMX O/S is a product extension to OpenBSD Unix-like operating system with emphasis on embedded, dedicated applications.
22. ".vantronix secure system". Compumatica secure networks. Archived from the original on 1 January 2012. Retrieved 13 December 2011. The Next Generation Firewall is not a standalone device, it is a Router for operation in security critical environments with high requirements for availability, comprehensive support as well as reliable and trusted systems powered by OpenBSD.
23. Dohnert, Roberto J. (21 January 2004), "Review of Windows Services for UNIX 3.5", OSNews, David Adams, archived from the original on 11 February 2008
24. Reiter, Brian (26 January 2010). "WONTFIX: select(2) in SUA 5.2 ignores timeout". brianreiter.org.
25. "Microsoft Acquires Softway Systems To Strengthen Future Customer Interoperability Solutions", Microsoft News Center, Microsoft, 17 September 1999
26. "Milltech Consulting Inc". 2019. Archived from the original on 18 September 2020. Retrieved 23 June 2020.
27. "Core Force", Core Labs, archived from the original on 28 November 2011, retrieved 13 December 2011, CORE FORCE provides inbound and outbound stateful packet filtering for TCP/IP protocols using a Windows port of OpenBSD's PF firewall, granular file system and registry access control and programs' integrity validation.
28. "Chapter 31. Firewalls". The FreeBSD Project. Retrieved 3 December 2021.
29. "pf.c". opensource.apple.com. Retrieved 3 December 2021.
30. ^ "About Xenocara". Xenocara. Retrieved 13 December 2011.
31. Tzanidakis, Manolis (21 April 2006). "Using OpenBSD on the desktop". Linux.com. Archived from the original on 5 May 2012. Retrieved 9 March 2012.
32. ^ Lucas, Michael W. (April 2013). Absolute OpenBSD: Unix for the Practical Paranoid (2nd ed.). San Francisco, California: No Starch Press. ISBN 978-1-59327-476-4.
33. "OpenPorts.se Statistics". OpenPorts.se. Archived from the original on 28 September 2020. Retrieved 8 February 2018.
34. ^ "OpenBSD 6.0". OpenBSD. Retrieved 1 November 2016.
35. "The X Windows System". OpenBSD Frequently Asked Questions. Retrieved 22 May 2016. OpenBSD ships with the cwm(1), fvwm(1) and twm(1) window managers,
36. "OpenBSD 6.8". www.openbsd.org. Retrieved 3 December 2021.
37. "WireGuard imported into OpenBSD". undeadly.org. Retrieved 3 December 2021.
38. Varghese, Sam (8 October 2004). "Staying on the cutting edge". The Age. Retrieved 13 December 2011.
39. Laird, Cameron; Staplin, George Peter (17 July 2003). "The Essence of OpenBSD". ONLamp. Archived from the original on 22 October 2017. Retrieved 13 December 2011.
40. De Raadt, Theo (19 December 2005). "2.3 release announcement". openbsd-misc (Mailing list). Without support at the right time, this release probably would not have happened.
41. Wayner, Peter (13 July 2000). "18.3 Flames, Fights, and the Birth of OpenBSD". Free For All: How Linux and the Free Software Movement Undercut the High Tech Titans (1st ed.). HarperBusiness. ISBN 978-0-06-662050-3. Archived from the original on 22 January 2012. Retrieved 13 December 2011.
42. Miller, Todd C.; De Raadt, Theo (6 June 1999). strlcpy and strlcat - Consistent, Safe, String Copy and Concatenation. USENIX Annual Technical Conference. Monterey, California. Retrieved 13 December 2011.
43. ^ "gcc-local – local modifications to gcc". OpenBSD manual pages. Retrieved 1 November 2016.
44. De Raadt, Theo; Hallqvist, Niklas; Grabowski, Artur; Keromytis, Angelos D.; Provos, Niels (6 June 1999). Cryptography in OpenBSD: An Overview. USENIX Annual Technical Conference. Monterey, California. Retrieved 27 May 2016.
45. "Pledge() - A New Mitigation Mechanism". Retrieved 8 October 2018.
46. Provos, Niels (9 August 2003). "Privilege Separated OpenSSH". Archived from the original on 2 January 2012. Retrieved 13 December 2011.
47. "Innovations". OpenBSD. Retrieved 18 May 2016. Privilege separation: The concept is now used in many OpenBSD programs, for example etc.
48. "Project History and Credits". OpenSSH. Retrieved 13 December 2011.
49. "SSH usage profiling". OpenSSH. Retrieved 13 December 2011.
50. Biancuzzi, Federico (18 March 2004). "An Interview with OpenBSD's Marc Espie". ONLamp. Archived from the original on 4 May 2018. Retrieved 13 December 2011.
51. "OpenSSH Remote Challenge Vulnerability". Internet Security Systems. 26 June 2002. Archived from the original on 8 September 2012. Retrieved 17 December 2005.
52. "A partial list of affected operating systems". Archived from the original on 6 January 2012.
53. "OpenBSD's IPv6 mbufs remote kernel buffer overflow". Core Security Technologies. 13 March 2007.
54. Brindle, Joshua (30 March 2008), "Secure doesn't mean anything", Security Blog, retrieved 13 December 2011
55. "Security". OpenBSD. Retrieved 13 December 2011. Secure by Default.
56. Wheeler, David A. (3 March 2003). "2.4. Is Open Source Good for Security?". Secure Programming for Linux and Unix HOWTO. Retrieved 13 December 2011.
57. De Raadt, Theo (14 December 2010). "Allegations regarding OpenBSD IPSEC". openbsd-tech (Mailing list). Retrieved 28 May 2016.
58. Holwerda, Thom (14 December 2010). "FBI Added Secret Backdoors to OpenBSD IPSEC". OSNews. Retrieved 13 December 2011.
59. Ryan, Paul (23 December 2010). "OpenBSD code audit uncovers bugs, but no evidence of backdoor". Ars Technica. Retrieved 9 January 2011.
60. Schwartz, Mathew J. (22 December 2010). "OpenBSD Founder Believes FBI Built IPsec Backdoor". InformationWeek: DARKreading. Archived from the original on 11 July 2017.
61. Van Sprundel, Ilja (December 2017). "Are all BSDs created equally? — A survey of BSD kernel vulnerabilities".
62. Van Sprundel, Ilja (July 2017). "Are all BSDs created equally? — A survey of BSD kernel vulnerabilities" (PDF).
63. "Lecture: A systematic evaluation of OpenBSD's mitigations". December 2019.
64. "Is OpenBSD secure?". 29 December 2019.
65. "src/usr.sbin/httpd/". OpenBSD CVSWeb.
66. "web/obhttpd: OpenBSD http server". Freshports.
67. "LibreSSL". Retrieved 8 August 2019.
68. ^ "OpenBGPD". Retrieved 8 August 2019.
69. "OpenIKED". Archived from the original on 14 May 2017. Retrieved 8 August 2019.
70. "OpenNTPD". Retrieved 8 August 2019.
71. "OpenSMTPD". Retrieved 8 August 2019.
72. "OpenSSH". Retrieved 8 August 2019.
73. "Contents of /stable/10/crypto/openssh/README". svnweb.freebsd.org. Retrieved 19 May 2016. This is the port of OpenBSD's excellent OpenSSH to Linux and other Unices.
74. "src/crypto/external/bsd/openssh/dist/README – view – 1.4". NetBSD CVS Repositories. Retrieved 19 May 2016.
75. "dragonfly.git/blob – crypto/openssh/README". gitweb.dragonflybsd.org. Retrieved 19 May 2016. This is the port of OpenBSD's excellent OpenSSH to Linux and other Unices.
76. "Arch Linux – openssh 7.2p2-1 (x86_64)". Arch Linux. Retrieved 17 May 2016.
77. "openssh". OpenSUSE. Retrieved 17 May 2016.
78. "Debian – Details of package openssh-client in jessie". Debian. Retrieved 17 May 2016.
79. ^ "OpenBSD from a veteran Linux user perspective".
80. De Raadt, Theo (18 June 2013). "An Internet Exchange for Calgary" (PDF). Archived from the original (PDF) on 5 October 2013. Retrieved 9 October 2018.
81. "3hg | isotop - index". www.3hg.fr. Retrieved 6 May 2022.
82. pavroo (17 May 2021). "Isotop". ArchiveOS. Retrieved 6 May 2022.
83. ^ "clang-local – OpenBSD-specific behavior of LLVM/clang". OpenBSD manual pages. Retrieved 2 February 2018.
84. ^ Andrews, Jeremy (2 May 2006). "Interview: Theo de Raadt". KernelTrap. Archived from the original on 24 April 2013.
85. "OpenBSD's flavors". OpenBSD Frequently Asked Questions. Retrieved 22 May 2016.
86. "Applying patches in OpenBSD". OpenBSD Frequently Asked Questions. Retrieved 15 May 2016.
87. "Migrating to OpenBSD". OpenBSD Frequently Asked Questions. Retrieved 4 January 2017.
88. "Hackathons". OpenBSD. Retrieved 18 May 2016.
89. "Interview: Theo de Raadt of OpenBSD". NewsForge. 28 March 2006. Retrieved 31 March 2016.
90. ^ "Release Songs". OpenBSD. Retrieved 22 May 2016.
91. Chisnall, David (20 January 2006). "BSD: The Other Free UNIX Family". InformIT. Archived from the original on 4 April 2014.
92. Smith, Jesse (18 November 2013). "OpenBSD 5.4: Puffy on the Desktop". Archived from the original on 29 April 2014.
93. ^ Cranor, Chuck D.; De Raadt, Theo (6 June 1999). Opening the Source Repository with Anonymous CVS. USENIX Annual Technical Conference. Monterey, California. Retrieved 13 December 2011.
94. Cranor, Chuck D. "Chuck Cranor's Home Page". Retrieved 13 December 2011. I also hosted and helped create the first Anonymous CVS server on the Internet (the original anoncvs.openbsd.org
95. Fresh, Andrew. "Why OpenBSD Developers Use CVS". Retrieved 30 August 2021.
96. "Project Goals". OpenBSD. Retrieved 18 May 2016. Integrate good code from any source with acceptable licenses. , NDAs are never acceptable.
97. "Explaining Why We Don't Endorse Other Systems". 10 December 2023. Archived from the original on 23 November 2023. Retrieved 10 December 2023.
98. De Raadt, Theo; Hallqvist, Niklas; Grabowski, Artur; Keromytis, Angelos D.; Provos, Niels (6 June 1999). "Randomness Used Inside the Kernel". Cryptography in OpenBSD: An Overview. USENIX Annual Technical Conference. Monterey, California. Retrieved 1 February 2014.
99. ^ De Raadt, Theo (5 December 2006). "Presentation at OpenCON". OpenBSD. Retrieved 13 December 2011.
100. Matzan, Jem (15 June 2005). "BSD cognoscenti on Linux". NewsForge. Linux.com. Retrieved 28 May 2016.
101. Gasperson, Tina (6 June 2001). "OpenBSD and ipfilter still fighting over license disagreement". Linux.com. Archived from the original on 26 June 2008.
102. "src/usr.sbin/mrinfo/mrinfo.c – view – 1.7". cvsweb.openbsd.org. 31 July 2001. Retrieved 24 May 2016. New license from Xerox! This code is now FREE! Took a while and a lot of mails, but it is worth it.
103. "src/usr.sbin/map-mbone/mapper.c – view – 1.5". cvsweb.openbsd.org. 31 July 2001. Retrieved 24 May 2016. New license from Xerox! This code is now FREE! Took a while and a lot of mails, but it is worth it.
104. De Raadt, Theo (24 August 2001). "Re: Why were all DJB's ports removed? No more qmail?". openbsd-misc (Mailing list). Archived from the original on 19 April 2016.
105. Bernstein, Daniel J. (27 August 2001). "Re: Why were all DJB's ports removed? No more qmail?". openbsd-misc (Mailing list). Archived from the original on 4 February 2012.
106. Espie, Marc (28 August 2001). "Re: Why were all DJB's ports removed? No more qmail?". openbsd-misc (Mailing list). Archived from the original on 19 April 2016.
107. Hartmeier, Daniel (10 June 2002). Design and Performance of the OpenBSD Stateful Packet Filter (pf). USENIX Annual Technical Conference. Monterey, California. Retrieved 13 December 2011.
108. The OpenBSD PF Packet Filter Book: PF for NetBSD, FreeBSD, DragonFly and OpenBSD. Reed Media Services. 2006. ISBN 0-9790342-0-5. Retrieved 19 May 2016.
109. "New BSD licensed CVS replacement for OpenBSD". 6 December 2004. Retrieved 9 October 2018.
110. "pkg-config(1)". Retrieved 9 October 2018.
111. "OpenBSD Project in Financial Danger". Slashdot. 21 March 2006. Retrieved 12 December 2014.
112. "Mozilla Foundation Donates $10K to OpenSSH". Slashdot. 4 April 2006. Retrieved 12 December 2014.
113. "GoDaddy.com Donates $10K to Open Source Development Project". The Hosting News. 19 April 2006. Archived from the original on 11 November 2006.
114. Beck, Bob (14 January 2014). "Request for Funding our Electricity". openbsd-misc (Mailing list). Retrieved 17 May 2016.
115. ^ Bright, Peter (20 January 2014). "OpenBSD rescued from unpowered oblivion by $20K bitcoin donation". Ars Technica. Retrieved 20 January 2014.
116. "The OpenBSD Foundation 2014 Fundraising Campaign". OpenBSD Foundation. Retrieved 24 May 2014.
117. "Announcing - The OpenBSD Foundation". OpenBSD Journal. 26 July 2007. Retrieved 8 May 2014.
118. Brodkin, Jon (22 April 2014). "OpenSSL code beyond repair, claims creator of "LibreSSL" fork". Ars Technica. Retrieved 18 August 2021.
119. McAllister, Neil (8 July 2015). "Microsoft rains cash on OpenBSD Foundation, becomes top 2015 donor". The Register. Retrieved 27 May 2016.
120. "Contributors". OpenBSD Foundation. Retrieved 27 May 2016.
121. Vaughan-Nichols, Steven J. "Microsoft becomes OpenBSD's first gold contributor". ZDNet. Retrieved 18 August 2021.
122. Mackie, Kurt; 12 November 2018. "Microsoft Now Supports OpenSSH in Windows Server 2019 -- Redmondmag.com". Redmondmag. Retrieved 18 August 2021.{{cite web}}: CS1 maint: numeric names: authors list (link)
123. "Donate to the OpenBSD Foundation". www.openbsdfoundation.org. Retrieved 18 August 2021.
124. "OpenBSD Donors".
125. "Smartisan Makes Another Iridium Donation to the OpenBSD Foundation". OpenBSD Journal.
126. "Anonymous CVS". OpenBSD. Retrieved 13 December 2011.
127. "Mirrors". OpenBSD. Retrieved 22 May 2016.
128. "Orders". OpenBSD. Archived from the original on 19 December 2011. Retrieved 20 May 2016.
129. ^ "Packages and Ports". OpenBSD Frequently Asked Questions. Retrieved 22 May 2016.
130. "OpenBSD". mckusick.com. Retrieved 12 December 2014.
131. De Raadt, Theo (19 May 1999). "OpenBSD 2.5 Release Announcement". openbsd-announce (Mailing list). Archived from the original on 2 February 2014. OpenBSD 2.5 introduces the new Cop daemon image done by cartoonist Ty Semeka.
132. "OpenBSD 2.7". OpenBSD. Retrieved 22 May 2016.
133. Matzan, Jem (1 December 2006). "OpenBSD 4.0 review". Software in Review. Archived from the original on 11 January 2012. Retrieved 13 December 2011. Each OpenBSD release has a graphical theme and a song that goes with it. The theme reflects a major concern that the OpenBSD programmers are addressing or bringing to light.
134. "Undeadly". Retrieved 9 October 2018.
135. "Changes". Archived from the original on 18 October 1997.
136. "OpenBSD 2.0". Retrieved 9 October 2018.
137. "Release Notes". Retrieved 9 October 2018.
138. "Release Notes". Retrieved 9 October 2018.
139. "Release Notes". Retrieved 9 October 2018.
140. "Release Notes". Retrieved 9 October 2018.
141. "Release Notes". Retrieved 9 October 2018.
142. "Release Notes". Retrieved 9 October 2018.
143. "Release Notes". Retrieved 9 October 2018.
144. "OpenBSD 2.8 Changelog". Retrieved 10 August 2021.
145. "Release Notes". Retrieved 9 October 2018.
146. "Release Notes". Retrieved 9 October 2018.
147. "Release Notes". Retrieved 9 October 2018.
148. "Errata". Retrieved 9 October 2018.
149. "Release Notes". Retrieved 9 October 2018.
150. "Release Notes". Retrieved 9 October 2018.
151. "Release Notes". Retrieved 9 October 2018.
152. "p0f". Retrieved 9 October 2018.
153. ^ "OpenBSD Innovations". The OpenBSD project. Retrieved 12 September 2016.
154. ^ Constantine A. Murenin; Raouf Boutaba (17 March 2009). "6. Evolution of the framework". OpenBSD Hardware Sensors Framework (PDF). AsiaBSDCon 2009 Proceedings, 12–15 March 2009. Tokyo University of Science, Tokyo, Japan (published 14 March 2009). Archived (PDF) from the original on 20 June 2010. Retrieved 4 March 2019. Alt URL
155. "Release Notes". Retrieved 9 October 2018.
156. Federico Biancuzzi (15 April 2004). "OpenBSD PF Developer Interview". ONLamp. O'Reilly Media. Archived from the original on 8 May 2004. Retrieved 20 March 2019.
157. Federico Biancuzzi (6 May 2004). "OpenBSD PF Developer Interview, Part 2". ONLamp. O'Reilly Media. Archived from the original on 19 June 2004. Retrieved 20 March 2019.
158. "bc(1)". Retrieved 9 October 2018.
159. "dc(1)". Retrieved 9 October 2018.
160. "nm(1)". Retrieved 9 October 2018.
161. "size(1)". Retrieved 9 October 2018.
162. "Release Notes". Retrieved 9 October 2018.
163. "Release Notes". Retrieved 9 October 2018.
164. ^ Federico Biancuzzi (28 October 2004). "OpenBSD 3.6 Live". ONLamp. O'Reilly Media. Archived from the original on 29 October 2004. Retrieved 20 March 2019.
165. "Release Notes". Retrieved 9 October 2018.
166. Federico Biancuzzi (19 May 2005). "OpenBSD 3.7: The Wizard of OS". ONLamp. O'Reilly Media. Archived from the original on 21 May 2005. Retrieved 20 March 2019.
167. "Release Notes". Retrieved 9 October 2018.
168. de Raadt, Theo. "CVS: cvs.openbsd.org: src". OpenBSD-CVS mailing list. Removed files: libexec/telnetd
169. Federico Biancuzzi (20 October 2005). "OpenBSD 3.8: Hackers of the Lost RAID". ONLamp. O'Reilly Media. Archived from the original on 27 December 2005. Retrieved 20 March 2019.
170. "Release Notes". Retrieved 9 October 2018.
171. ^ Federico Biancuzzi (27 April 2006). "OpenBSD 3.9: Blob-Busters Interviewed". ONLamp. O'Reilly Media. Archived from the original on 12 May 2006. Retrieved 19 March 2019.
172. "Release Notes". Retrieved 9 October 2018.
173. Federico Biancuzzi (26 October 2006). "OpenBSD 4.0: Pufferix's Adventures". ONLamp. O'Reilly Media. Archived from the original on 10 March 2007. Retrieved 19 March 2019.
174. "Errata". Retrieved 9 October 2018.
175. "Release Notes". Retrieved 9 October 2018.
176. Federico Biancuzzi (3 May 2007). "OpenBSD 4.1: Puffy Strikes Again". ONLamp. O'Reilly Media. Archived from the original on 18 May 2008. Retrieved 19 March 2019.
177. Constantine A. Murenin (30 December 2006). Marco Peereboom (ed.). "New two-level sensor API". OpenBSD Journal. Retrieved 4 March 2019.
178. Constantine A. Murenin (17 April 2007). "4.3. What we have proposed and implemented". Generalised Interfacing with Microprocessor System Hardware Monitors. Proceedings of 2007 IEEE International Conference on Networking, Sensing and Control, 15–17 April 2007. London, United Kingdom: IEEE. pp. 901–906. doi:10.1109/ICNSC.2007.372901. ISBN 978-1-4244-1076-7. IEEE ICNSC 2007, pp. 901–906.
179. "Release Notes". Retrieved 9 October 2018.
180. Federico Biancuzzi (1 November 2007). "Puffy's Marathon: What's New in OpenBSD 4.2". ONLamp. O'Reilly Media. Archived from the original on 13 October 2011. Retrieved 3 March 2019.
     • "Puffy's Marathon: What's New in OpenBSD 4.2 - ONLamp.com". OpenBSD Journal.
181. "Release Notes". Retrieved 9 October 2018.
182. Federico Biancuzzi (29 April 2008). "Puffy and the Cryptonauts: What's New in OpenBSD 4.3". ONLamp. O'Reilly Media. Archived from the original on 6 May 2008. Retrieved 20 March 2019.
183. "Release Notes". Retrieved 9 October 2018.
184. Kurt Miller (2008). "OpenBSD's Position Independent Executable (PIE) Implementation". Archived from the original on 12 June 2011. Retrieved 22 July 2011.
185. ^ Federico Biancuzzi (3 November 2008). "Source Wars - Return of the Puffy: What's New in OpenBSD 4.4". O'Reilly Media. Archived from the original on 24 May 2012. Retrieved 3 March 2019.
186. "Release Notes". Retrieved 9 October 2018.
187. Federico Biancuzzi (15 June 2009). "PuffyTron recommends OpenBSD 4.5". O'Reilly Media. Archived from the original on 19 June 2009. Retrieved 19 March 2019.
188. ^ Constantine A. Murenin (21 May 2010). "6.2. Evolution of drivers; Chart VII. Number of drivers using the sensors framework from OpenBSD 3.4 to 4.6.". OpenBSD Hardware Sensors — Environmental Monitoring and Fan Control (MMath thesis). University of Waterloo: UWSpace. hdl:10012/5234. Document ID: ab71498b6b1a60ff817b29d56997a418.
189. "Release Notes". Retrieved 9 October 2018.
190. "Release Notes". Retrieved 9 October 2018.
191. "Release Notes". Retrieved 9 October 2018.
192. "MARC". Retrieved 9 October 2018.
193. "Release Notes". Retrieved 9 October 2018.
194. "Release Notes". Retrieved 9 October 2018.
195. "Release Notes". Retrieved 9 October 2018.
196. "Release Notes". Retrieved 9 October 2018.
197. "Release Notes". Retrieved 9 October 2018.
198. "Release Notes". Retrieved 9 October 2018.
199. "Release Notes". Retrieved 9 October 2018.
200. "Release Notes". Retrieved 9 October 2018.
201. "Release Notes". Retrieved 9 October 2018.
202. "Release Notes". Retrieved 9 October 2018.
203. "MARC". Retrieved 9 October 2018.
204. "Release Notes". Retrieved 9 October 2018.
205. OpenBSD 6.0. ISBN 978-0-9881561-8-0. Retrieved 24 July 2016. {{cite book}}: |website= ignored (help)
206. "OpenBSD vax". OpenBSD. Retrieved 2 September 2016.
207. "OpenBSD sparc". OpenBSD. Retrieved 2 September 2016.
208. "OpenBSD 6.1". OpenBSD. Retrieved 11 April 2017.
209. "OpenBSD 6.2". OpenBSD.
210. "unveil(2)". OpenBSD. Retrieved 19 October 2018.
211. "OpenBSD 6.6". OpenBSD. Retrieved 17 January 2020.
212. "OpenBSD 6.7". OpenBSD. Retrieved 21 May 2020.
213. "OpenBSD 6.8". OpenBSD. Retrieved 18 October 2020.
214. "OpenBSD FAQ". OpenBSD. Retrieved 5 May 2021.
215. "OpenBSD 6.9". OpenBSD. Retrieved 2 May 2021.
216. ^ "OpenBSD 7.0". OpenBSD. Retrieved 15 October 2021.
217. "OpenBSD 7.1". OpenBSD. Retrieved 21 April 2022.
218. "OpenBSD loongson". Archived from the original on 22 August 2022.
219. "OpenBSD 7.2". OpenBSD. Retrieved 20 October 2022.
220. "OpenBSD 7.3". OpenBSD. Retrieved 10 April 2023.
221. "OpenBSD 7.4". OpenBSD. Retrieved 16 October 2023.
222. "OpenBSD 7.5". OpenBSD. Retrieved 9 April 2024.
223. "OpenBSD 7.6". OpenBSD. Retrieved 8 October 2024.

External links

• Official website
• GitHub mirror
• OpenBSD manual pages
• OpenBSD ports & packages (latest)
• OpenBSD source code search

• OpenBSD
• Cryptographic software
• Free software programmed in C
• Lightweight Unix-like systems
• OpenBSD software using the ISC license
• PowerPC operating systems
• Software forks
• Software using the BSD license
• 1996 software
• ARM operating systems
• IA-32 operating systems
• X86-64 operating systems
• Non-profit organizations based in Alberta
• Free software project foundations
• Monolithic kernels