OpenBSD

**OpenBSD** is a free operatin system, that pits its emphasis on securitie. The source code is open. It's nae muckle different fae UNIX o the BSD varietie (Berkeley Software Distribution). It wis Theo de Raadt that stairtit OpenBSD in 1995, wi a forkin o the code fae NetBSD. De Raadt's threap is that OpenBSD is an operatin system meant for research an for giein computers better securitie.

The OpenBSD project keeps, an uphauds, portable versions o a wheen o its ain subsystems as packages that ither operatin systems can tak an uise. Wi the emphasis it pits on haein guid-quality code, a lot o OpenBSD's components is uised ower agane in ither saftware projects. Android uises a lot fae OpenBSD's staundart C library. LLVM uises OpenBSD's regular expression library, an Windows 10 uises OpenSSH (kent forby as OpenBSD Secure Shell) wi LibreSSL.

The wird "open" in the name OpenBSD means that its source code can be gotten fae the Internet, tho the wird "open" in the name OpenSSH means "OpenBSD". Forby, "open" means that OpenBSD can rin on a heest o different types o computer.

## History

In December 1994, Theo de Raadt wis gart resign fae the NetBSD core team. His access tae the program code wis taen awa fae him. Ither team members claimed it was aw aboot fowk on the mailin lists fawin oot wi ane anither.

In October 1995, De Raadt foondit OpenBSD, a new project fork't fae NetBSD 1.0. The first release, OpenBSD 1.2, wis in July 1996, follaed by OpenBSD 2.0 in the October o thon same year. Sinsyne, the project his pitten oot a release ilka six months. Thay support ilkane o thaim for ae year.

On 25 July 2007, OpenBSD developer Bob Beck annunce't the foondin o the OpenBSD Foundation in Canada. This wis a nae-profits organisation wi the ettle o bein "a single pynt o contact for fowk an organisations, needin a legal entitie that thay cud deal wi whan thay wir wantin tae support OpenBSD".

It's haurd tae ken jist hou widely OpenBSD gets uised, seein as the developers disna gaither or publish statistics aboot this. In September 2005, the BSD Certification Group surveyed BSD uisers. Thay fand that 33% o thaim uised OpenBSD, ahint FreeBSD wi its 77% an aheid o NetBSD wi jist 16%.

## Uisses

### Netwark appliances
Ae thing that OpenBSD staunds oot for is its strang, sturdy netwarkin stack. It can be uised as a router or a wireless access pynt. OpenBSD's better securitie, its ain inbiggit cryptographie, an its packet filter maks it a guid chyce for firewaws, intrusion detection, VPN gateweys, an ither purposes whaur securitie is important.

A wheen o proprietarie systems is biggit on OpenBSD, amang thaim anes fae Armorlogic (Profense web application firewaw), Calyptix Security, GeNUA and .vantronix.

### Foreign operatin systems
A curn versions o Microsoft's Services for UNIX, a biggin oot o the Windows operatin system tae gie functionalitie sib tae UNIX, uises a lot o OpenBSD code that comes wi the Interix interoperability suite develop't by Softway Systems Inc, that Microsoft bocht in 1999. Core Force, a securitie product for Windows, is foondit on OpenBSD's firewaw.

### Personal computers
OpenBSD comes ready wi Xenocara, a implementation o the X Window System. It can be uised as a desktap operatin system for personal computers, laptaps an aw. As o September 2018, OpenBSD hauds aboot 8000 packages in its saftware repositorie, amang thaim environments the like o GNOME, Plasma 4, an Xfce, an wab browsers the likes o Firefox and Chromium.

### Servers
OpenBSD his a full server suite. It can be setten up tae be a mail server, wab server, FTP server, DNS server, router, firewa, NFS file server, or onie o thae things thegither.

## Securitie
Nae lang efter the wark stairtit on OpenBSD, De Raadt heard fae a local security saftware company named Secure Networks (ane that McAfee bocht later). Thay wir wirkin on a netwark security audit tool cried Ballista, that its aim wis tae find, an tak a len o, flaws in saftware security. This fittit weel wi De Raadt's interest in securitie, sae the twa o thaim wirkit thegither, leadin tae the launch o OpenBSD 2.3. This jynt wark helpit tae bring securitie tae the fore as the focus o the OpenBSD project.

OpenBSD his a wheen o features that thair aim is better security, the likes o:

* Secure functions insteid o POSIX functions in the C standart librarie, the likes o `strlcat` for `strcat`, an `strlcpy` for `strcpy`
* Cheenges tae Toolchain, amang thaim a static boonds checker
* Weys o memory protection, tae gaird against forbidden access, the likes o ProPolice an W^X page protection
* Strang cryptographie an randomisation
* Liemits on system caws an on uise o the file system, tae liemit whit a process can dui wi thaim

Tae lower the risk o a waikness, or wrang settin up, or allouin a process tae hae privilege it shudna hae, a lot o programs his been written or cheenged tae mak uise o privilege separation, privilege revocation an chrooting. Privilege separation is a wey o wirkin, first tried on OpenBSD and inspire't by the principle o "lowest  privilege", whaur a program is splitten intae twa or mair pairts: ane o thaim dis the privileged operations an the ither ane, awmaist aye the feck o the code, rins wi nae privilege. Privilege revocation is gey near the same, an gars a program dui ony operations it needs til wi the privileges it stairts wi, an syne draps thaim. Chrooting means haudin an application tae ae pairt o the file system, baurin it fae areas that micht haud private or system files. Developers sinsyne his applied thon principles tae OpenBSD maks o a wheen common applications, the likes o tcpdump, file, tmux, smtpd, and syslogd.

OpenBSD developers played a big pairt in the makkin o OpenSSH (kent forby as OpenBSD Secure Shell). It code is haudit in the same CVS repositories as OpenBSD. OpenBSD Secure Shell is foondit on the auld, first SSH. It first appeared in OpenBSD 2.6, an nou it's by far the widest uised SSH client an server, available on a heest o operatin systems.

The project his a policy o aye auditin source code for problems. This is wark that developer Marc Espie his said "is nivver finish't ... mair a maiter o a process nor o a kent bug bein huntit." He cairied on tae gie a list o a curn typical steps thay tak ance a bug is fund, amang thaim leukin throu the hail code tree for problems that is the same or gey near the same, "tryin tae wirk oot if the documents is needin cheenged", an leukin intae whether "it's possible tae mak the compiler warn aboot this partiecular problem."

### Security record
The OpenBSD wabsite maks a claim aboot the system's security record, a claim that staunds oot richt awa. Until June 2002, it read:

In June 2002, Mark Dowd fae Internet Security Systems telt awbodie aboot a bug in the OpenSSH code, the pairt giein challenge-response authentication. This waikness in OpenBSD's defaut installation alloued a attacker tae get intae the ruit accoont remote-like, an this wis gey serious no jist tae OpenBSD, bit forby tae the wheen o ither operatin systems that wis uisin OpenSSH by then. Oot o this, the slogan on the OpenBSD wabsite hid tae be cheenged til:

The claim bade the wey it wis ower time, until 13th Mairch, 2007, whan Alfredo Ortega fae Core Security Technologies telt awbodie aboot a remote vulnerability tied tae netwarkin. Efter this ane the quote wis cheenged til:

This statement his been doun-cried, seein as the defaut installation disna hae monie rinnin services, an a lot o uise cases needs ither services an aw. As weel, seein as the ports tree hauds third-pairtie saftware that hisna been auditit, it is easie for uisers tae waiken securitie if thay instaw packages wrang or set thaim up wrang. For aw that, the project threaps that the slogan is meant tae be aboot a defaut installation, an that it is richt by that meisure.

Ane o the basic ideas ahint OpenBSD is a drive for systems tae be simple, clean, an secure fae the beginnin. Thare's nae muckle tae the defaut installation, that the project says is tae mak shuir new uisers "disna need tae become securitie experts owernicht". This fits wi open-source an code audits bein thocht on as important elements o a securitie system.

### Alleged back door
On 11 December 2010, Gregory Perry, that hid aerlier been a technical consultant for the Federal Bureau o Investigation (FBI), emailed De Raadt wi a claim that the FBI hid pey'd some OpenBSD ex-developers 10 year afore tae pit "backdoors" intae the OpenBSD Cryptographic Framewark. De Raadt made the email public on 14 December by sendin it on tae the openbsd-tech mailin list an askit for a audit o the IPsec codebase. De Raadt's answer wis that he hid his douts aboot the report, an he invitit aw the developers tae review the code independent-like. In the weeks that follaed, bugs wis fix't but naebodie fund onie evidence o backdoors. De Raadt threap't "A div believe that NetSec wis likelie contractit tae write backdoors lik it's been alleged. If thay wir written, A dinna believe thay wun the lenth o oor tree. Thay micht hae been deployed as thair ain product."

### Criticisms
In December 2017, Ilja van Sprundel, director at IOActive, gied a speik at the CCC as weel as DEF CON, wi the title "Is aw BSDs creatit equal-like?" A survey o BSD kernel waiknesses" whaur he said that, awtho OpenBSD wis the clear winner o the BSDs as meisured by hou secure thay ar, "Bugs is aye easie tae find in thae kernels, even in OpenBSD".

Twa year efter, in 2019, a speik wi the name "A systematic evaluation of OpenBSD's mitigations" wis gien at the CCC. It airgued that, while OpenBSD dis hae some wirthwhile mitigations, a guid monie o thaim is "uiseless at best, an foondit on pure luck an superstition", airguin for a mair rational approach in thair design.

## Haurdware compatibiliie
The different computers an ither devices ye can uise OpenBSD on is gien in a list in the OpenBSD Supported Platforms Notes. Ither arrangements micht wirk an aw, bit they jist hinna been testit or pitten doun in the documents. Thare's a 3rd-pairtie repository o (roch) lists o computers an ither devices, pitten thegither automatic-like.

In 2020, a new project wis stairtit tae gaither information, automatic-like, aboot aw the testit haurdware arrangements.

## Subprojects
Monie open source projects stairtit as components o OpenBSD. Amang thaim wir:

* bioctl, a generic RAID management interface nae muckle different fae ifconfig
* CARP, a free (for naething) alternative tae Cisco's patentit HSRP/VRRP redundancie protocols
* cwm, a stackin windae manager
* OpenBSD httpd, a implementation o httpd
* hw.sensors, a sensors framewark uised by ower 100 drivers
* LibreSSL, a implementation o the SSL an TLS protocols, forkit fae OpenSSL 1.0.1g

Some subsystems his been brocht inby as pairt o ither BSD operatin systems, an a lot  o thaim can be gotten as packages tae be uised in ither Unix-like systems.

Linux administrator Carlos Fenollosa said, whan he gaed ower fae Linux tae OpenBSD, that the system is leal tae Unix's philosophie o haein sma an simple tools that wirks thegither weel. "Some base components disna hae the same number o features, deliberate-like. Seein as 99% o the servers disna need tae be swack lik Apache, OpenBSD's httpd wull wirk fine, be mair secure, an likelie faster". He described the developer community's attitude tae components this wey: "whan the community decides that some module is nae uise for oniething, they jist develop a new ane fae the beginnin. OpenBSD his its ain NTPd, SMTPd and, mair latelie, HTTPd. They wirk jist rare". The ootcome is that, time an time agane, OpenBSD creates components an syne a wheen o thaim is uised agane in ither systems.

OpenBSD rins gey near aw o its staundart daemons inside chroot and privsep securitie structures by defaut, as pairt o haurdenin the base system.

The Calgary Internet Exchange wis foondit in 2012, in pairt sae's tae serve the needs o the OpenBSD project.

## Third-pairtie components
Inside OpenBSD thare's a wheen o third-pairtie components, a lot o thaim wi patches meant jist for OpenBSD, the likes o X.Org, Clang (the defaut compiler on a wheen o architectures), GCC,Perl, NSD, Unbound, ncurses, GNU binutils, GDB, an AWK.

## Development

Development gangs on aw the time, an team management is open an organised intae tiers. Oniebodie wi the richt skills can jyne in, wi the richt tae commit wark gien on merit an wi De Raadt actin as the heid-ane. Twa official releases is made ilka year, wi the version number raised by 0.1, and ilkane is supportit for twal months (twa release cycles). Snapshot releases is pitten oot an aw, aften.

Upkeep patches for supportit releases can be pitten on manual-like or by bringin a system up-tae-date against the patch braunch o the CVS repository for that release. On the ither haund, a system administrator can decide tae upgrade fae a snapshot release an syne update the system regular-like fae the current branch o the CVS repository, sae's tae gain access tae new features afore thay'r released.

The generic OpenBSD kernel providit by defaut is recommendit as the best ane for end uisers, nae like operatin systems that recommends uisers dui the kernel customisation thaimsels.

Packages ootside the base system is maintained by CVS throu a ports tree, an thay'r the responsibilitie o the individual maintainers, cried "porters". As weel as keepin the current braunch up tae date, porters is leukit-tae tae pit in the richt bug-fixes an upkeep fixes tae braunches o thair package for OpenBSD's supportit releases. On the hail, ports is no gien the same on-gaun auditin as the base system, for want o manpouer.

Binary packages is biggit central-like fae the ports tree for ilka architecture. This process is duin for the current version, for ilka supportit release, and for ilka snapshot. Administrators is recommendit tae uise the package mechanism insteid o biggin the package fae the ports tree, unless they need tae make thair ain cheenges tae the source code.

OpenBSD's developers meets regular-like at special events cried hackathons, whaur they "sit doun an code", wi the ettle o daein a lot o wark.
In maist new releases, there's a sang.

## Open source an open documentation
OpenBSD is kent for its guid quality o documentation. It's seen as the best amang aw the BSD operating systems, tho aw o thaim pits a lot o effort intae correct documentation.

Whan OpenBSD wis first stairtit, De Raadt wantit the source code tae be open tae oniebodie tae read. At thon time, it wis uisual that a sma team o developers hid access tae a project's source code. Chuck Cranor an De Raadt thocht this practice "didna fit wi the open source philosophie" an wis jist gettin in the road o potential contributors. Thegither, Cranor and De Raadt set up the first public, nameless CVS server. De Raadt's decision alloued uisers tae "tak a mair steerin role", and set doun the project's commitment tae haein open access.

OpenBSD disna haud closed-source binary drivers in the source tree, an thay dinna haud code that needs a non-disclosure agreement tae be signed aither.

Seein as OpenBSD his its hame in Canada, US American export restrictions on cryptography disna haud. This allous the distribution tae mak full uise o modren algorithms for encryption. For example, the swap space is pairtit intae sma sections an ilka section is encryptit wi its ain key, makkin shuir that sensitive data disna leak ower intae a insecure pairt o the system.

OpenBSD randomises the different things that applications dis, makkin it haurder tae foretell whit thay'r gaun tae dae, and that wey thay'r faur haurder tae attack. For example, PIDs is creatit an associate tae processes random-like; the `bind` system caw uises random port numbers; files is creatit wi random inode numbers; and IP datagrams his random identifiers.

The OpenBSD policie on openness gaes as faur as haurdware documentation: in the slides for a presentation in December 2006, De Raadt explain't that wi-oot it "developers aften gangs agley writin drivers", an pyntit oot that "the [michtie, A gart it wirk] rush is haurder tae bring aboot, an some developers jist gies up." He gaed on tae say that binary drivers fae the vendor is nae acceptable as pairt o OpenBSD, that thay hiv "nae trust o vendors' binaries rinning in oor kernel" an that thare is "nae wey tae fix [thaim] ... whan thay brak."

## Licensin
OpenBSD's licence policie is a strict ane, wi a better likin for the ISC license an ither variants o the BSD licence. The project tries tae haud tae the spirit o the auld Berkeley Unix copierichts," that alloued a "Unix source distribution wi-oot muckle hindrance." The widelie uised Apache License an the GNU General Public License is seen as ower strict.

In June 2001, stemmin fae worries aboot Darren Reed's cheenges tae IPFilter's licence wirdin, a systematic license audit o the OpenBSD ports an the source trees wis haudit. Code in mair nor a hunder files throu the hail system wis fund tae be: nae licensed ava; nae licensed clear-like; or in uise against the terms o thair license. Tae mak shuir that aw the licences wis abidden by, thay tried tae mak contact wi aw thaim that hid relevant copyrichts: some pieces o code wis taen oot, an a wheen o thaim wis replace't awthegither. Ither anes, the like o the multicast routin tools `mrinfo` and `map-mbone`, wis licensed ower agane sae's that OpenBSD cud cairy on uisin thaim. Forby, aw saftware that wis the wark o Daniel J. Bernstein wis taen oot. At thon time, Bernstein wis wantin aw cheenges tae his code tae hae his approval afore thay wir sent oot, an OpenBSD developers wis sweirt tae pit time an darg intae daein this.

Oot o worries aboot licensin, the OpenBSD team his written saftware ower agane fae the beginnin, or brocht in suitable saftware that hid been written awreadie. For example, OpenBSD developers creatit the PF packet filter efter they cudna accept restrictions that hid been pitten on IPFilter. PF wis first pairt o OpenBSD 3.0, an it's pairt o a lot o ither operatin systems nou. OpenBSD developers his written thair ain tools, wi the licence open tae oniebodie, tae tak the place o general licensed tools the like o CVS, diff, grep and pkg-config.

## Fundin
OpenBSD an its portable components is uised in ither products, tho De Raadt says that nae muckle o the siller fae sellin thae products wins the lenth o OpenBSD. "Mainlie wir siller haes been gotten fae uisers' donations an fae uisers buyin wir CDs. It's easie tae see that wunna be muckle."

For a peiriod o twa year in the aerlie 2000s, the project wis gettin siller frae DARPA, an that "pey'd the salaries o 5 fowk tae wirk ful-time, bocht aboot thertie thoosand dollars in haurdware, and pey'd for 3 hackathons", fae the POSSE project.

In 2006, the OpenBSD project suffer't fae a want o siller. The Mozilla Foundation an GoDaddy is twa o the organisations that helpit OpenBSD tae haud gaun. For aw that, De Raadt wis fash't that this wis aw ae-sidit: "A think donations an peyments shoud hae come first fae the saftware sellers, an syne saicont fae the corporate uisers, an third fae uisers by thaimsels. Reallie, it's been awmaist the ither wey roon awthegither, wi a ratio o awmaist 15 dollars tae ane comin fae the wee fowk. Thank ye muckle, wee fowk!"

On 14 January 2014, Bob Beck askit for siller tae pey electritie bills. Gin thay cudna find fundin for the lang term, Beck thocht the OpenBSD project wad hae tae close doun. The project suin got a donation o twintie thoosand US dollars fae Mircea Popescu, him that wis the Romanian creator o the MPEx bitcoin stock exchange. The donation wis pey'd in bitcoins. The project brocht in US$150,000 fae the appeal, sae's it cud pey its bills an mak siccar its short-term future. Fae 2014 on, a curn big contributions tae the OpenBSD Foundation his come fae corporations, the likes o Microsoft, Facebook an Google as weel as the Core Infrastructure Initiative.

Durin the 2016 and 2017 fundraisin campaigns, it wis Smartisan, a Chinese firm, that gied the maist siller tae the project.

## Distribution
Oniebodie can get haud o OpenBSD, an in a wheen o weys: the source can be taen anonymous-like fae CVS, an binary releases an development snapshots can be dounloadit by FTP, HTTP, and rsync. CD-ROM sets, up tae version 6.0, can be order't online for a smaw fee, thegither wi a curn stickers an a copie o the release's theme sang. Thir things, wi thair airtwark an ither bonuses, his been ane o the project's (no monie) sources o siller. It peys for haurdware, Internet service, an ither costs. Stairtin fae version 6.1, CD-ROM sets is no gien oot onie mair.

OpenBSD comes wi its ain package management system sae's that programs that is no pairt o its base operatin system can be instawed an managed easie-like.  Packages is binarie files that is extractit, managed an taen oot wi the package tools. On OpenBSD, the source o packages is the ports system, a gaitherin thegither o Makefiles an ither infrastructure needit tae create packages. In OpenBSD, the ports an base operatin system is developed an released thegither for ilka version. This means that the ports or packages released wi, for example, 4.6 is no suitable for uisin wi 4.5, an the same the ither wey roond.

### Sangs and airtwark

Tae stairt wi, OpenBSD uised a version (wi a halo) o the BSD daemon mascot drawn by Erick Green, him that wis askit by De Raadt tae draw the logo for the 2.3 and 2.4 versions o OpenBSD. Green planned tae draw a full daemon, heid an body an aw, bit jist the heid wis ready in time for OpenBSD 2.3. The body wi the graip an tail wis ready for OpenBSD 2.4.
The follaein releases uised ither things, the likes o a police daemon fae Ty Semaka. In the hinner end, thay settle't on a pufferfish cried Puffy. Fae then on, Puffy his been on OpenBSD promotional material an feature't in release sangs an airtwark.

The promotional material o aerlie OpenBSD releases didna hae jist ae theme or design rinnin throu it, bit later the CD-ROMs, release sangs, posters an tee-shirts for ilka release his been produce't wi jist ae style and theme, whilies wi inpit fae Ty Semaka fae the Plaid Tongued Devils. Thir things his come tae be pairt o OpenBSD's advocacie, wi ilka release pittin ower a moral or political pynt important tae the project, aften by wey o a parodie.

Thare's been themes the likes o *Puffy the Barbarian* in OpenBSD 3.3. Pairt o it wis an 80s rock sang an parodie o Conan the Barbarian hintin at open documentation, *The Wizard of OS* in OpenBSD 3.7, tied tae the project's wark on wireless drivers, an *Hackers of the Lost RAID*, a parodie o Indiana Jones hintin at the new RAID tools in OpenBSD 3.8.

## Beuks

Thare's been a wheen o beuks aboot OpenBSD that wis published, includin:

* *[http://www.devguide.net/index.php?q=node/19 The OpenBSD Command-Line Companion, 1st ed.] * by Jacek Artymiak. ISBN 83-916651-8-6.
* *[http://www.devguide.net/books/openbsdfw-02-ed/ Building Firewalls with OpenBSD and PF: Second Edition] * by Jacek Artymiak. ISBN 83-916651-1-9.
* *[http://www.oreilly.com/catalog/mfreeopenbsd/ Mastering FreeBSD and OpenBSD Security]* by Yanek Korff, Paco Hope and Bruce Potter. ISBN 0-596-00626-8.
* *Absolute OpenBSD, Unix for the Practical Paranoid* by Michael W. Lucas. ISBN 1-886411-99-9.
* *[http://www.aw-bc.com/catalog/academic/product/0,1144,0321193660,00.html Secure Architectures with OpenBSD]* by Brandon Palmer and Jose Nazario. ISBN 0-321-19366-0.
* *[http://www.reedmedia.net/books/pf-book/ The OpenBSD PF Packet Filter Book: PF for NetBSD, FreeBSD, DragonFly and OpenBSD]* published by Reed Media Services. ISBN 0-9790342-0-5.
* *[http://www.wiley.com/legacy/compbooks/catalog/35366-3.htm Building Linux and OpenBSD Firewalls]* by Wes Sonnenreich and Tom Yates. ISBN 0-471-35366-3.

## Notes

## References

## External links

* OpenBSD's homepage
* OpenSSH's homepage
* OpenNTPD's homepage
* OpenBGPD's homepage
* OpenCVS's homepage
* OpenBSD journal
* Unofficial OpenBSD ports tracker 
* Short manual page URLs
* OpenBSD ports and packages search
* Super User's BSD Cross Reference (OpenGrok), OpenBSD — source code search