Hacker News Reader

Hacker News

Comment by nailer | Hacker News Reader

Full thread

nailer

Anyone on HN deploying on OpenBSD? Any thoughts?

View on HN

I've got a home router running on OpenBSD, for a mix of practical and educational purposes.

I've found pf to be particularly nice - it's much easier to work with than iptables for me.

Like all the BSDs, it has man pages for everything, which is an extremely nice aspect.

The main thing that I don't like about OpenBSD is the increased update hassle as compared to, for example, Debian.

I'd probably use OpenBSD everywhere if there was some reasonable equivalent of what you'd do on Debian with "aptitude update && aptitude upgrade".

The OpenBSD packaging system's update infrastructure has really improved within the last year. It might be worth another look. I do porting, and very frequently update to a recent snapshot, then update all ports. I haven't had problems with it for a while.

And yeah, best router/firewall OS ever.

How do you find running snapshots? I always figured just from the name you could expect them to have problems.

The snapshot computer is my main desktop (amd64), and in general, I haven't had problems. (On second thought, updating "very frequently" is probably an exaggeration - more like monthly/biweekly.) One time I noticed that my CD burner had stopped working, but I hadn't used it for several months before that anyway, and it went away on a subsequent update. Other than that, no problems.

I was an OpenBSD fanboi for a while. It was not a terrible desktop OS, but Linux is just so much easier to deal with. apt-get blows ports (and pkg-add, hahaha) out of the water.

I also used it for my mail/web server, and it didn't seem to be the path of least resistance. With Debian, I spent about 10 minutes configuring Apache + fastcgi and exim + spamassassin + clamav. With OpenBSD, I spent days setting it up (I felt like the first person in the world to ever deploy a FastCGI app on OpenBSD), but the result was much more secure. Each web app ran as its own user in a chroot with no view of the shared filesystem beyond /tmp, and the webserver ran as its own user, also in a chroot. Very secure, but still felt flaky to me. My mailserver never worked right. (The "world's most secure operating system" uses sendmail!?)

pf is just wonderful compared to iptables, though, so I would definitely use OpenBSD for anything routing-related. (But Linux has better hardware support, so I am stuck with that for now. Need to get a Soekris router!)

>(The "world's most secure operating system" uses sendmail!?)

Their FAQ addresses this and says that the Sendmail upstream has been a bit more receptive to security issues than Postfix or others. In addition, they claim that Postfix hasn't been the cleanest in recent years.

They also have smtpd now. (http://www.openbsd.org/cgi-bin/man.cgi?query=smtpd)

Have been using it on firewalls for about 10 years. Wouldn't use anything else in that space, between the security, reliability, and usability of PF.

A couple of the current firewalls are on Soekris hardware, cheap little boxes that only draw a couple watts -- more at http://slagwerks.com/blog/?s=soekris

Speaking of hardware, I'm using it on an alix 2d3 (http://www.pcengines.ch/alix.htm) with openbsd. I was impressed because it's more powerful but much cheaper than a soekris.

I'm using an alix 2d3 as well, very impressed with it so far.

interesting! Hadn't heard of them before, will check one out sometime.

I've used it for a number of different purposes. I prefer it over everything else for firewalls and servers of almost any kind.

I use on my router for WAN load balancing (2 outgoing links) because it is so much easier with pf than with iptables.

http://news.ycombinator.com/item?id=1364132

all of my public services (web/email/dns/database hosting, my SaSS - http://corduroysite.com/) are hosted on openbsd servers, as well as my office firewall and workstations running openbsd. i'm also an openbsd developer (jcs@)

It's an excellent OS for (most C) development: it has fantastic documentation and is very good at crashing buggy programs (even better with some malloc options set). It also actually installs headers, unlike many Linux distributions.

(It's also an excellent firewall, server, desktop, ...)

[EDIT: ... for most stuff at least. Ubuntu is shinier, and Linux/Solaris/FreeBSD is better for multithreaded number crunching.]

I use OpenBSD for Email, Music Daemon, FTP server, VPN, irc and of course as a firewall.

The best thing about it other than its vaunted security is the absolutely fantastic documentation and predictability. Once you get something, anything working its quite easy to get other pieces to work as well. They all follow the same pattern.

Reply on news.ycombinator.com