Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [openbsd]

OpenBSD is a Unix computer operating system descended from Berkeley Software Distribution (BSD) which emphasizes portability, standardization, correctness, proactive security and integrated cryptography.

2
votes
1answer
332 views

Is there something similar to Firejail for OpenBSD?

On Linux, Firejail (https://firejail.wordpress.com/) offers an easy way to sandbox web browsers and other programs. Is there an easy way to sandbox a web browser on OpenBSD ? (reserve question: is ...
6
votes
2answers
2k views

Is installing an old version of OpenBSD on an internet-facing server a security risk?

I have one specific package (moodle) which is not available on newer versions of the aforementioned OS. The last version of moodle was available on OpenBSD 5.3, which is more than 4 years old. ...
6
votes
1answer
875 views

OpenBSD is implementing KARL. How does this improve security?

According to this article, OpenBSD is implementing a feature that will create a unique kernel every time a user reboots or upgrades his computer. It is called KARL, "Kernel Address Randomized Link". ...
4
votes
3answers
274 views

How should I respond to an unrecognized client in my DHCP logs?

I've found a strange hostname in my dhcpd.leases file and I'm wondering what steps I should take in response. I have a simple home network: my modem is plugged into a router running OpenBSD 6.0, and ...
3
votes
2answers
344 views

Is OpenBSD's low number of exploits really that relevant?

The number of OpenBSD's known vulnerabilities is tiny, but so it's the number of users. How significant is this scarceness of exploits found?
1
vote
2answers
110 views

How does separating concerns into separate processes (without enforcement) help security?

In this talk on privilege separation, Theo de Raadt explains that OpenBSD's ntpd has a master process which calls settimeofday(), a DNS process responsible for querying DNS servers, and an NTP ...
1
vote
1answer
574 views

Why does paxtest show OpenBSD as vulnerable?

install60.iso Executable anonymous mapping (mprotect) : Vulnerable Executable bss (mprotect) : Vulnerable Executable data (mprotect) : Vulnerable Executable heap (mprotect) : Vulnerable Executable ...
1
vote
2answers
144 views

cc-memtest for testing memory security for OpenBSD

http://blog.acumensecurity.net/revisiting-wx-with-openbsd-6-0/ http://blog.acumensecurity.net/fpt_wx_ext-1-a-rundown/ Has anybody got the cc-memtest binary or source code or cc-memtest? A program ...
5
votes
2answers
363 views

Is there any safe OpenBSD desktop screenlocker?

Linux screen lockers don't seem so very secure, at least not in the past [1, 2, 3]. But is there any very secure OpenBSD screen locker? (Or perhaps OpenBSD uses the same desktop related source code ...
1
vote
1answer
2k views

Is BSD more secure than GNU/Linux? [closed]

BSD controls the OS while Linux is just a kernel. BSD is less popular than Linux, but which one is better in terms of security?
2
votes
2answers
117 views

Does OpenBSD's security protect against identical vulns in other OSs?

I have been reading about OpenBSD and its more secure design. I was wondering therefore about the difference this makes to applications which can run on any number of OS. Lets take the example of a ...
1
vote
3answers
112 views

Verifying consistency of OpenBSD LiveCD [closed]

OpenBSD offers a live cd that can be downloaded at http://livecd-openbsd.sourceforge.net/ However, there is no md5sum, no sha256, no checksum of any kind on this page. How can we test this version ...
8
votes
1answer
2k views

Is receiving IPv4 connections on AF_INET6 sockets insecure?

The FreeBSD man page for inet6 has the following: By default, FreeBSD does not route IPv4 traffic to AF_INET6 sockets. The default behavior intentionally violates RFC2553 for security reasons. ...
1
vote
1answer
1k views

How to detect/mitigate UDP port scan using OpenBSD and pf

One of our OpenBSD firewalls experienced a flood of UDP traffic from a compromised host within our internal network. The traffic was exchanged between the compromised internal host and a single ...
2
votes
3answers
1k views

How to detect suspicious activity on a web and mailserver?

There is a OpenBSD (64bit; 5.5) server having nginx (HTTP/HTTPS) and SMTP (OpenSMTP). Question: What are the best practices to detect suspicious activity? Are there any scripts that shows ...
2
votes
2answers
354 views

What's there to harden for a home Unix-box behind Comcast cable modem?

I'm learning that much of the security advice I come across under the "hardening" heading simply does not apply to a single-user home desktop box sitting in a private wireless IPv4 LAN behind a ...
14
votes
2answers
2k views

Do any OpenBSD protections mitigate the damage from Heartbleed?

OpenBSD provides a list of substantial protections against exploits inherent to the OS. Most of these features are not found in other operating systems, or at least are not turned on by default. The ...
3
votes
0answers
195 views

BSD encryption advantages [closed]

If someone who knows about the BSD project has a moment to answer this, I'm wondering a few things about the encryption used. It's more than what I'm finding in the docs and on Wiki/Google (even the ...
2
votes
2answers
2k views

For a simple purpose, a simple httpd server is more secure?

Using OpenBSD for example, we have a task to serve static html files, no php/cgi/etc. Q: What would be more secure? Using a default apache/nginx -OR- using (KISS principle) a chrooted www server ...
6
votes
4answers
1k views

In this case, does Virtualization gives more security?

A: running an OpenBSD machine with a httpd and a smtp server? vs. B: running an OpenBSD machine as virtualization host with QEMU having two guest OpenBSD system: one for smtp and one for httpd. Q: ...
5
votes
1answer
157 views

OpenBSD, fbtab and X Window [closed]

The afterboot(8) man page of OpenBSD advises "You might wish to tighten up security more by editing /etc/fbtab as when installing X. " I would like to know what entries in /etc/fbtab would make sense ...
0
votes
2answers
898 views

Why is systrace insecure?

Why is the: http://www.openbsd.org/cgi-bin/man.cgi?query=systrace&sektion=4 Systrace marked as insecure? Can someone explain the "why"?
3
votes
4answers
616 views

Learn about network and security for securing a server

I'm setting up an OpenBSD server that I want to connect to the Internet (it's going to be used to host a site - so, with Apache, SQLite and the like). I want it to be as secure as possible. Social ...
2
votes
3answers
2k views

Is running an OpenBSD in QEMU on an OpenBSD machine safe?

Is running an OpenBSD** using QEMU on an OpenBSD safer then running just natively an OpenBSD? ** = only used for apache + scp + ssh I'm thinking about running the OS/webserver in QEMU because then I ...
12
votes
3answers
15k views

How to best set up public WiFi without giving access to the rest of my network?

For reference, this is just for my home network. Anyway, I have quite a few of my neighbors ask me to share my internet with them. I'd really like to eliminate this "here's the password" portion ...
5
votes
3answers
1k views

Increase security without using “dynamic” kernel modules?

I recently read that NOT using loadable kernel modules could increase security. In my interpretation this consist about recomplying the kernel with only built-in kernel modules. (how to disable ...
12
votes
9answers
3k views

Where to download OpenBSD release ISO's over HTTPS?

OpenBSD claims to be highly secure. So why doesn't it allow downloading the release iso's over HTTPS? Or I'm missing something? Can someone please explain this to me?
3
votes
2answers
394 views

OBSD X11 as non-root?

If running X11 as root is not a very good idea, then can anyone mention a method/solution, how to still use a GUI, and not having X11 as root?
5
votes
1answer
599 views

OpenBSD-based LiveCD/LiveDVD - is it secure? is it offical?

Does the OpenBSD LiveCD/LiveDVD get deeply audited like the original OpenBSD? Is it an official "port"? Experiences with it?
4
votes
2answers
1k views

OpenBSD 32 or 64bit installer?

is the 64 bit or the 32 bit installer better? (not counting that if i have x>4 GByte RAM) - so i mean like is there any ASLR in OpenBSD? https://secure.wikimedia.org/wikipedia/en/wiki/...
13
votes
4answers
9k views

OpenBSD vs. NetBSD security

If I search for the two words: OpenBSD and NetBSD on http://www.exploit-db.com/ then I get 17 hits regarding security bugs on OpenBSD, and 8 hits regarding security bugs on NetBSD. So what are the ...
15
votes
5answers
779 views

What is the potential impact of the alleged OpenBSD IPSEC attack?

Recently there is a bit of concern over encryption back doors in IPsec and while the status of this has not been confirmed, I don't know what impact something like this might have. For instance, does ...