Security: OpenBSD vs. FreeBSD

http://networkfilter.blogspot.com/2014/12/security-openbsd-vs-freebsd.html

by atmosx • 12 years ago

155 54 12 years ago

networkfilter.blogspot.com

tribaal• 12 years ago

Interesting read! Thanks.

dale-cooper• 12 years ago

It would be interesting to see how it compares to linux with grsecurity

haneefmubarak• 12 years ago

I didn't go and research grsecurity, but I did do some overall research to see how Linux compares:

https://news.ycombinator.com/item?id=8898152

miduil• 12 years ago

Previous discussion on another blogposting of the same author: https://news.ycombinator.com/item?id=8871705 Though, OpenBSD rarely supports hardware, since this isn't their goal.

cLeEOGPw2• 12 years ago

Well, since it should mostly be used as a firewall, having a little restriction of which hardware you can use isn't a big deal.

dbolgheroni3• 12 years ago

since it should mostly be used as a firewall

This is a misconception.

smhenderson4• 12 years ago

I had three different Lenovo laptops that I used to experiment with the various BSDs. One fairly old (2009) and the other two were between 6 - 10 months old. On all three of them OpenBSD detected my hardware (wireless, sound, lan, etc) better than Net or Free did.

Anecdotal I know and I don't have specific model information in front of me at the moment but, at least in my case, I found OpenBSD to be the best choice for these laptops simply because when I finished installing, everything Just Worked.

Oh, and they sleep properly too...

gvozd2• 12 years ago

Another anecdote: I had the same experience with my new Gigabyte laptop. OpenBSD 5.6 supported the hardware better than FreeBSD or Linux (Qubes-OS, which is based on Fedora). I ended up running OpenBSD on my laptop and FreeBSD on my servers: one leased physical box with lots of jails, and one hosted VM for redundancy.

I'd like to run OpenBSD on my servers, but acquiring the dozen or so machines I need for service separation is just not cost effective or resource efficient.

dbolgheroni3• 12 years ago

"rarely"? I use OpenBSD for a long time, mostly on laptops, and rarely found hardware which isn't supported.

Of course that there are some wi-fi devices that require blobs, and I'm glad OpenBSD do not support these. However, I learned that no support at all is better than half support of some crap drivers.

armones• 12 years ago

What about NetBSD? Is it not relevant anymore anywhere?

justincormack4• 12 years ago

It is closer to FreeBSD for many things, closer to OpenBSD for others. I get the impression that the author does not use it which is why it is not there.

tw04• 12 years ago

It's used by plenty of embedded vendors. It just isn't generally deployed as a general purpose OS or server by most people. Not really the goal of the project either - their goal is generally "run on any piece of hardware ever created".

justincormack4• 12 years ago

It makes a perfectly decent server OS and people do use it as exactly that. The portability goal is more about writing reasonable portable code, not running on everything, indeed it runs on fewer devices than Linux, but it is easy to port if you wish to.

justincormack4• 12 years ago

"arc4random implementations in FreeBSD and NetBSD aren't quite state of the art anymore" NetBSD's has been updated, now uses chacha20 and fixes the other issues (duplicated random number state on fork for example).

dbolgheroni3• 12 years ago

OpenBSD uses ChaCha20 since 5.5, as can be seen in the man page:

http://www.openbsd.org/cgi-bin/man.cgi?query=arc4random&apro...

feld6• 12 years ago

Xin Li is working on the arc4random changes for FreeBSD

https://github.com/delphij/freebsd/compare/master...featuref...

riffraff2• 12 years ago

I think the point of MAC was understated: the important idea (AFAIU) is that in traditional unix root is god, while with MAC the intent would be to make the whole "got r00t" pointless because root is just another user with some specific capabilities (e.g. create users, but not access the database).

Like, AWS' IAM for the single server.

I recall some ten years ago DAC vs MAC was a frequently debated topic, nowadays seems nobody talks about it, not sure if because trustedbsd/selinux/apparmor didn't deliver on the promises or anything else.

emidln• 12 years ago

sebsd and selinux were and continue to be difficult to write policies for. I'm not even aware of anyone other than Fedora/RedHat and then specific appliances that even ship policies. If I understand correctly, even RedHat only ships targeted policies (not a comprehensive system policy) that usually need tweaked by the end admin for the situation at hand (which seems to lead to people just turning off selinux in Fedora/Centos/RHEL).

erglkjahlkh• 12 years ago

Shipping a targeted policy is simply a matter of practicality. Linux has actual 3rd party applications, and forcing all the vendors to either ship with policies or let the applications fail to run correctly would be a kiss of death to the MAC system. That was actually tried in the early days of SELinux, and it did not go well.

In fact that is why you even nowadays see "SELinux must be disabled" in application manuals. The early SELinux iterations really broke all the applications, and many people never took a second look at the technology. 9/10 of the application vendors that recommend disabling SELinux really don't do anything that would hit a targeted policy - the SELinux is already practically disabled for them. They just destroy the protection for the other software in the system...

Most common tweaking tasks can be found from booleans, and extra tweaks are easy to accomplish the help of audit2allow. However it baffles me to notice that audit2allow is not part of the default installations. It is a life saver that makes finding out why SELinux doesn't allow something really fast and easy.

agumonkey• 12 years ago

Interesting, root is not a superset, just a seed (NPI) for other user/permissions to exist, right ?

riffraff2• 12 years ago

that is my understanding, yes (though I have no idea what "NPI" means, sorry).

feld6• 12 years ago

I wish someone from the FreeBSD project with authority and expertise would speak out instead of being silent when these discussions come up; a clearly communicated security roadmap would be nice. I suspect there's no desire to start internet flamewars or heated discussions about FreeBSD's security situation as they're weary of the discussions.

OpenBSD pioneers a lot of security research and best practices but I think many people get misled by all the hand waving and subsequently have more faith in certain features and less knowledge. I'm a victim myself.

As an example, I recently brought up W^X and wanted to know what the status / stance was and was met with a healthy dose of skepticism. As I was told, "W^X is very useful for debugging but not for security as the kernel has a read-write 1:1 map of all physical memory... you can still write to memory that will later be executed, you just have to use a different address" (not a direct quote) This was completely new information to me that nobody seems to talk about.

Likewise when I asked about securelevel=1 -- I was met with "securelevel is more likely to be removed entirely than enabled by default ... not convincing because there's no coherent model ... easy to work around as an attacker unless the system is very, very carefully configured, which means it's locked down beyond usability for most configurations ... though it's useful for jails since you can still do maintenance from the jailhost"

tl;dr I think the FreeBSD devs who can call the shots are more interested in ASLR and pushing Capsicum hard.

ghswa• 12 years ago

Are you referring to discussions on their mailing lists? If so, could you link to them?

feld6• 12 years ago

No, it was in an IRC chat

mlarkin2• 12 years ago

Whoever told you about that direct map "issue" didn't do their homework, and is talking out of their ass.

http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/arch/amd64/...

feld6• 12 years ago

Thanks for the link, I'll share it.

edit: would this prevent you from being able to support 1GB pages?

nailer• 12 years ago

Do OpenBSD use CVS?

brynet• 12 years ago

I wouldn't be so quick to declare the work done in OpenBSD as hand-waiving, especially when the FreeBSD developers you've been talking to are just as uninformed as you are now.

Feel free to point them at the link mlarkin himself has posted here.

feld6• 12 years ago

gladly will. learning is an important process. :-)

MrBuddyCasino• 12 years ago

Ha, interesting. I wonder what the rate of cross-pollination is - the BSDs should, due to their license, easily be able to use code from the other BSD variants, right? So how come that FreeBSDs pf is kinda outdated, and OpenBSD hasn't adopted Jails, too? Is it due to different philosophies, NIH syndrome or simply not enough manpower?

justincormack4• 12 years ago

Some code you can just drop in, other code needs more extensive changes because the internals are different. It would be interesting to map the cross pollination, there is a lot.

I believe jails is a philosophical issue, it is very hard to show that it actually provides isolation.

tedunangst• 12 years ago

I believe jails is a philosophical issue, it is very hard to show that it actually provides isolation.

Indeed. In theory, the kernel runs at a security/isolation level above root, but in practice root can often subvert it.

That said, OpenBSD also offers rdomains, which aren't quite jails but provide a somewhat similar degree of network separation.

elektronjunge• 12 years ago

The article is actually incorrect about PF. FreeBSD forked OpenBSD's 4.5 version but has provided its own set of enhancements including SMP it has fallen behind in other respects. PF in OpenBSD has had some large architectural changes that break SMP and the biggest change (new syntax) wasn't deemed worthwhile to port back to the SMP version. The blog links to an email chain about it https://lists.freebsd.org/pipermail/freebsd-pf/2014-July/007...

protomyth4• 12 years ago

I'm actually a little worried about cross-pollination after I listened to BSD Now episode 52[1]. The interview with Shawn Webb scarred me quite a bit with the answer to the question at 24:08 in the video[2]. The not knowing the OpenBSD model and the whole taint code comment is not an acceptable answer when looking at another BSD licensed project. It is also a really poor idea.

1) http://www.bsdnow.tv/episodes/2014_08_27-reverse_takeover

2) This is the one time I really, really wish there was an interviewer not from the FreeBSD / PC-BSD project. I really wanted a follow-up question to this one.

allanjude• 12 years ago

You can always email the guest. We include the guest's contact details in every episode's show notes.

arca_vorago• 12 years ago

Being a pretty security conscious fellow, I would just like to say that we need more in depth and up to date comparisons like this. I would like it if more distros were added in though.

For example, while DragonFly BSD does not tout security as a strong point yet, I have been keeping an eye on them and am very impressed with some of the things they are doing and how they go about it. (http://www.dragonflybsd.org/docs/newhandbook/Security/)

I also have gotten tired of pam/selinux on linux, but have been running Alpine linux with grsec and am impressed at the default install level of security, and would like to possible see alpine put up against openbsd.

Minix 3 is too immature at the moment but I think pretty soon they are going to be at the level where they need to start thinking about security as well.

Zikes• 12 years ago

I'm a web developer primarily, and I'm accustomed to Linux servers with the likes of CentOS and Ubuntu. I've been seeing a lot of talk lately about how secure *BSD is compared to Linux, and now Digital Ocean supports it. Is it something I should start looking into? What's the learning curve like for someone with moderate Linux experience? Where would I start?

darkarmani• 12 years ago

If you are primarily a web developer who knows nothing about BSD, I don't think you want to choose BSD for security reasons. The underlying OS might be more hardened, but if you don't know the system and applications as well as you know in linux, it's more likely you'll have a configuration error that opens a gaping security hole.

ketralnis2• 12 years ago

For instance, the default mail system in FreeBSD is still sendmail (https://www.freebsd.org/doc/handbook/sendmail.html). It's pretty easy to accidentally configure it as an open relay, even if you mostly know what you're doing. Until 10, BIND was the default DNS server (https://www.freebsd.org/doc/handbook/network-dns.html), which has the same kinds of configuration problems.

ris• 12 years ago

"Is it something I should start looking into?"

No. Don't bother. The only BSD that has a security edge over linux is OpenBSD and you're probably not happy to lose the performance (and often hardware support) it would entail. It's also lacking a lot of the platform management linux systems have (package management stone ages - you won't have fun upgrading it).

It's great for critical systems, though. It's just the majority of the time I'm not willing to give up the niceties I would have to.

Security: OpenBSD vs. FreeBSD

Related Stories