OpenBSD Journal

OpenBSD 3.6 torrents and bittorrent security?

Contributed by grey on from the sharing the bandwidth dept.

Thanks to andrew fresh for writing in with the following offer:

I have made some OpenBSD 3.6 torrents available for the source and i386 architecture.

They are available at http://www.rraz.net/OpenBSD/

The actual links to the torrents are:
http://www.rraz.net/OpenBSD/OpenBSD_3_6.torrent
and
http://www.rraz.net/OpenBSD/OpenBSD_3_6_i386.torrent

It should go without saying that these are unofficial, just like the torrent that dhartmei announced in Friday's release announcement thread. Still, bittorrent is a useful means to distribute load, and I did hear some demand for an amd64 torrent recently (although I've yet to see one). For those who use these, keep in mind that the tracker won't be as long lived as this article.

Meanwhile, on a related note Anthony asked:

I have security concerns about bittorrent. I often run the client for days or weeks at a time, sometimes several instances at once. In that situation the client is exposed to all the same threats that a server is, so I'd like to take whatever precautions I reasonably can. Since the client runs as the user by default, it would be pretty bad if an exploit were discovered.

I run the bt client on my OpenBSD firewall because it's the only computer I have that I don't turn off. For security reasons (it also makes configuring PF easier), I created a user torrent and I run the client as this user, inside its home directory. I'm not really sure what else I can do short of setting up a jail with all the libraries Python needs.

Does anyone have any suggestions?

(Comments are closed)

Comments

  1. By Ray (24.90.93.11) ray@cyth.net on

    Systrace it:

    $ cat .systrace/usr_local_bin_btdownloadcurses_py
Policy: /usr/local/bin/btdownloadcurses.py, Emulation: native
        native-__sysctl: permit
        native-accept: permit
        native-bind: sockaddr eq "inet-[0.0.0.0]:0" then permit
        native-bind: sockaddr eq "inet-[0.0.0.0]:6881" then permit
        native-bind: sockaddr eq "inet-[0.0.0.0]:6882" then permit
        native-break: permit
        native-chdir: filename eq "/usr/local/bin" then permit
        native-clock_gettime: permit
        native-close: permit
        native-connect: sockaddr match "inet-*" then permit
        native-exit: permit
        native-fchdir: permit
        native-fcntl: permit
        native-fsread: filename inpath "$HOME" then permit
        native-fsread: filename eq "$HOME/.terminfo.db" then permit
        native-fsread: filename eq "$HOME/.terminfo" then permit
        native-fsread: filename match "$HOME/downloads" then permit
        native-fsread: filename eq "/etc/malloc.conf" then permit
        native-fsread: filename eq "/etc/resolv.conf" then permit
        native-fsread: filename eq "/tmp" then permit
        native-fsread: filename match "/usr/lib/lib*" then permit
        native-fsread: filename match "/usr/local/bin" then permit
        native-fsread: filename inpath "/usr/local/lib" then permit
        native-fsread: filename match "/usr/local/lib/python2.3" then permit
        native-fsread: filename eq "/usr/local/lib/python23.zip" then permit
        native-fsread: filename eq "/usr/local/lib/site-python" then permit
        native-fsread: filename eq "/usr/share/misc/terminfo.db" then permit
        native-fsread: filename eq "/usr/share/nls/C/libc.cat" then permit
        native-fsread: filename match "/usr/share/zoneinfo" then permit
        native-fsread: filename eq "/var/run/ld.so.hints" then permit
        native-fsread: filename sub "" then deny[enoent]
        native-fstat: permit
        native-fstatfs: permit
        native-fswrite: filename match "$HOME/downloads" then permit
        native-getdirentries: permit
        native-getpeername: permit
        native-getpid: permit
        native-getrlimit: permit
        native-getsockopt: permit
        native-gettimeofday: permit
        native-ioctl: permit
        native-issetugid: permit
        native-listen: permit
        native-lseek: permit
        native-madvise: permit
        native-mmap: permit
        native-mprotect: permit
        native-mquery: permit
        native-munmap: permit
        native-pipe: permit
        native-poll: permit
        native-pread: permit
        native-read: permit
        native-recvfrom: permit
        native-sendto: permit
        native-setitimer: permit
        native-setsockopt: permit
        native-sigaction: permit
        native-sigprocmask: permit
        native-sigreturn: permit
        native-socket: sockdom eq "AF_INET" and socktype eq "SOCK_DGRAM" then permit
        native-socket: sockdom eq "AF_INET" and socktype eq "SOCK_STREAM" then permit
        native-socket: sockdom eq "AF_INET6" and socktype eq "SOCK_STREAM" then permit
        native-write: permit

    Comments

    1. By Ray (199.67.138.76) ray@cyth.net on

      The line that read (rĕd):

              native-fsread: filename sub "" then deny[enoent]

      should read (rēd): 

              native-fsread: filename sub "<non-existent filename>" then deny[enoent]

  2. By James Carter (66.218.244.40) on http://www.phatxlr8r.com

    I am certain your efforts are appreciated. If only we could get a couple of the FTP mirrors to switch to bittorrent as seeders. The bandwidth difference really is there as long as enough seeders are using the same tracker.

    I started with Slackware....

    Now it appears Debian is also making a major push toward bittorrent!

    I think OpenBSD would benefit from the added exposure.

    Comments

    1. By vxla (67.175.80.217) on

      I manage a mirror and would seed it if you let me know how to do so. I dont have much time to look around at this point, however. But if you let me know, I'll do it.

      epancer{at}sg[dot]depaul{dot}edu

Latest Articles

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]