OpenBSD Journal

OpenBSD: Security for Financial Environments

Contributed by marco on from the don't-show-me-your-$$$ dept.

Nick Humphrey can't see why more security professionals don't use the OpenBSD operating system. He has been working in security for a decade and has implemented the free software in a range of applications, and says its security features are top class.

"I have used OpenBSD in various capacities since around 2001 and have confidence in its high quality code and security features," he says. "I've worked with a few smaller companies who had extremely small IT/security budgets, and OpenBSD provides some amazing features that can only usually be found in pricey commercial products."

To find out more, read the latest in our series of features based on recent MSc theses at Royal Holloway University of London (RHUL), where Humphrey lays out the strengths of OpenBSD.

Article here.

(Comments are closed)


Comments
  1. By m (79.114.19.145) on

    "Secondly, OpenBSD may not be the easiest free operating system to install (compared to Ubuntu Linux, for example) for newcomers to UNIX ..."

    I get the feeling that _anything_ that has no GUI is listed as not easy, complex, expert grade action. In my opinion any Linux is much more complex to install and manage. I tried a lot in the past then I came over OpenBSD and kept it for use.

    Comments
    1. By Anonymous Coward (24.37.242.64) on

      In my opinion any Linux is much more complex to install and manage. I tried a lot in the past then I came over OpenBSD and kept it for use.

      I completely agree with you and I've done the same thing!

    2. By Anonymous Coward (70.173.62.25) on

      > I get the feeling that _anything_ that has no GUI is listed as not easy, complex, expert grade action.

      I totally agree. I've played with a lot of Linux distributions and I think installing OpenBSD to be the easiest and fastest.

      Easiest: only thing I found difficult was learning the partitions. But back when I was a newbie to Unix, reading the FAQ took care of that. Partition C means whole disk, don't mess with it. A is for root, B is for swap, D - Z is for whaever you want but generally /usr, /var and /home. That's all I needed to learn.

      Fastest: Assuming you were an expert at installing all OS's and distributions, the only OS I found to be just as fast is MSDOS.

      Comments
      1. By Lennie (2001:610:612:0:217:31ff:fe75:76a5) on

        > > I get the feeling that _anything_ that has no GUI is listed as not easy, complex, expert grade action.
        >
        > I totally agree. I've played with a lot of Linux distributions and I think installing OpenBSD to be the easiest and fastest.
        >
        > Easiest: only thing I found difficult was learning the partitions. But back when I was a newbie to Unix, reading the FAQ took care of that. Partition C means whole disk, don't mess with it. A is for root, B is for swap, D - Z is for whaever you want but generally /usr, /var and /home. That's all I needed to learn.
        >
        > Fastest: Assuming you were an expert at installing all OS's and distributions, the only OS I found to be just as fast is MSDOS.
        >

        I think that's the bit people really 'complain' about. Partitions and disklabels isn't obvious to a lot of other folks.

        But I've heared on this forum, they are going to improve the installation, so maybe that last hurdle will be removed soon.

    3. By Daniel Ouellet (66.63.10.82) daniel@presscom.net on

      > I get the feeling that _anything_ that has no GUI is listed as not easy, complex, expert grade action. In my opinion any Linux is much more complex to install and manage. I tried a lot in the past then I came over OpenBSD and kept it for use.

      Not to be mean, but I get the feeling that with so many MCSE administrators becoming specialist only in GUI management where they become specialist in making choices on click thrue menu presented to them, that they forgot how computers actually works now and can't in many cases make the right choices as to what should be done if they are not presented with a choice to try, click and see what happened.

      For years, I always questions the real benefit of GUI and web interfaces and it looks like more and more that without them, many admin can't get their job done these days.

      Are they really becoming specialist in choice making, or network administrations.

      I hope not to insult anyone, but look to me that more and more admin without GUI can't get the job done and obviously can't make the right choices in many cases.

      That bare the question as to if GUI actually help admin, or hurt them more?

      Make your own judgment on it, but I am always amaze to see Windows admin starting to click at no end looking for the right choice to make when doing admin and very rarely do I see one clicking directly where he/she needs to go to get the results he/she wants out of the exercise.

      Sure makes me believe that GUI works against the decent admin and when article use GUI as a way to define if something is hard, or easy to manage, does put a lots more weight on the actual knowledge and understanding of it's author then anything else.

      Just my $0.02 worth.

      Comments
      1. By jason (jason) on http://www.dixongroup.net/

        > I hope not to insult anyone, but look to me that more and more admin without GUI can't get the job done and obviously can't make the right choices in many cases.

        From my experience, there are many admins that are competent at CLI work. But I'm also very picky about where I work and avoid "large stupid" companies (i.e. Fortune 500), particularly those that are publicly traded and hence subject to [U.S. Govt.] Federal scrutiny. Those tend to rely on Windows and COTS products where the manufacturers often spend much more on marketing than R&D.

        There will always be a glut of "administrators" who are schooled only in the vendor-supplied user interfaces. This is a natural by-product of a market where technical innovation is measured by the graphs and blinkenlights your PHB wants on his "dashboard". Fortunately, there will also be a portion of rebellious computer and programming enthusiasts holding influential positions in government, academic, and specialized markets.

      2. By Anonymous Coward (70.173.62.25) on

        > For years, I always questions the real benefit of GUI and web interfaces and it looks like more and more that without them, many admin can't get their job done these days.

        I once had a user who couldn't download a file from an ftp server. I ssh'd into my own private server which had no firewall on. From my server, I ftp'd the site using the command line and could not get in either. I called their IT admin who kept saying it wasn't on his end, it was our firewall. I found out that he was using some MS-Windows-based GUI server software. Basically he couldn't see how his server was not functioning because he was stupified by his Windows GUI software.

    4. By Paul 'WEiRD' de Weerd (weerd) weerd@weirdnet.nl on http://www.weirdnet.nl/

      > "Secondly, OpenBSD may not be the easiest free operating system to
      > install (compared to Ubuntu Linux, for example) for newcomers to UNIX
      > ..."
      >
      > I get the feeling that _anything_ that has no GUI is listed as not
      > easy, complex, expert grade action. In my opinion any Linux is much
      > more complex to install and manage. I tried a lot in the past then I
      > came over OpenBSD and kept it for use.

      Note that the article says "for newcomers to UNIX".

      When you expect a GUI and get something different, you'll have at least
      your initial surprise to overcome. If you are experienced in clicking
      your way through an OS install, typing commands on your keyboard while
      looking at 80x25 text (on your 20"+ TFT) can be daunting.

      I've done both GUI and text-based installs. Most GUI installs, to me,
      were easier to manage than most text-based installs (although those that
      gave me most pain were usually "user friendly" menu driven installers
      (FreeBSD, NetBSD)). I found that it's mostly experience with what you
      know that makes "something different" difficult.

      Not all text-based installers are as good as OpenBSDs...

      Comments
      1. By Lennie (2001:610:612:0:217:31ff:fe75:76a5) on

        > Not all text-based installers are as good as OpenBSDs...

        I think both is true, I think it's possible to create a good GUI-install and I've seen good text-installers. I can't remember any good GUI-installers though, but maybe that's just because I mostly install OS's with text-installers. :-)

    5. By Anonymous Coward (128.171.90.200) on

      Of all the operating systems I've installed OpenBSD is by far one of the easiest, I find it a lot quicker and simpler than NetBSD, FreeBSD and nearly every linux distro I can think of ( I installed Ubuntu recently, but forget if it was easy or not, needless to say as an OS it is not as nice to use as OpenBSD, unless all you want is mail and firefox. )

      I installed DragonFlyBSD recently, I have to say it probably has the edge over OpenBSD, but not by much, and again OpenBSD is a lot nicer to use.

      MacOSX has a no-brainer installer, but that goes without saying.

      I hope never to have to do another Solaris or Windows install ever, that is really painful.

      Comments
      1. By Anonymous Coward (76.250.126.209) on

        > MacOSX has a no-brainer installer, but that goes without saying.

        Not really. It asks all kinds of hard questions but makes them look pretty. I'd say from a GUI install perspective Vista wins. Yes you heard it here first.

        Then after you click for a while you only have to wait a couple more hours for a mostly non functional OS to install. Awesome.

        Comments
        1. By Anonymous Coward (128.171.90.200) on

          > > MacOSX has a no-brainer installer, but that goes without saying.
          >
          > Not really. It asks all kinds of hard questions but makes them look pretty.

          Pretty, yes, hard, ... really ?

          > I'd say from a GUI install perspective Vista wins. Yes you heard it here first.

          I am in shock

    6. By Simon Lundström (simmel) on

      > "Secondly, OpenBSD may not be the easiest free operating system to install (compared to Ubuntu Linux, for example) for newcomers to UNIX ..."
      >
      > I get the feeling that _anything_ that has no GUI is listed as not easy, complex, expert grade action. In my opinion any Linux is much more complex to install and manage. I tried a lot in the past then I came over OpenBSD and kept it for use.

      Totally agree, why I started to use OpenBSD was because my local UNIX guru said it was awesome and secure AND because I could not get X working on any of the Linux distros I tried at the time and in OpenBSD i just ran startx and it just worked(TM).

    7. By Anonymous Coward (80.37.248.67) on

      > In my opinion any Linux is much more complex to install and manage. I tried a lot in the past then I came over OpenBSD and kept it for use.
      The partitioning and slicing part is not easy at all, especially if you want OpenBSD to live peacefully with other OSes. You get welcomed by a prompt with no visual confirmation of what's going on. Oh, and when you ask for help the most important commands get scrolled away. Not everyone is installing from a 1000x1000 char terminal, you know.
      However, I agree with you that once you have OpenBSD installed, it is the easiest system to manage.

      Comments
      1. By Pierre Riteau (131.254.100.94) on

        > > In my opinion any Linux is much more complex to install and manage. I tried a lot in the past then I came over OpenBSD and kept it for use.
        > The partitioning and slicing part is not easy at all, especially if you want OpenBSD to live peacefully with other OSes. You get welcomed by a prompt with no visual confirmation of what's going on. Oh, and when you ask for help the most important commands get scrolled away. Not everyone is installing from a 1000x1000 char terminal, you know.
        > However, I agree with you that once you have OpenBSD installed, it is the easiest system to manage.

        The scrolling issue with disklabel is fixed in -current.
        And of course when you buy the CD you have all the installation process described ;)

  2. By Anonymous Coward (216.68.196.115) on

    The migration is coming. Many in business are still stuck with excel and other proprietary business software needs. Software takes a long time to write, test, and bring trust to. Financial jobs can pay very well though.
    It is interesting to look through some financial magazines, see the ads, etc.
    One is, Technical Analysis of Stocks & Commodities, neat mag, website is http://www.traders.com
    Lots of windows useage. What DID surprise me, is that there is also a lot of simple programming/scripting for data analysis/input. Some banks are using Windows again, after trying out some *BSD. Pity. I guess the good people are too hard to keep in some companys, and Windows is such common skillset. Less training of people.
    There is a term for financial hacking, where data is fudged, to see what activates, some people triggers, with the write off of, errors. Can't remember the term.
    I would expect *BSD to be much better for legal reasons of data security and data discovery. EDD is very expensive, although on a BSD system, can be trivial compared to windows.

  3. By Anonymous Coward (84.192.197.63) on

    I clearly remember the late 90's, when there was a serious effort to get OpenBSD into the world of high-finance; a lot of crypto stuff was developed, Keynote was introduced into the base install and papers were written. Sadly it never got the attention it deserved.

    OpenBSD is still the only free unix system with a real trust management system onboard (although OpenBSD's version of Keynote is getting a bit outdated).

    Someone should port NetBSD's kauth framework to OpenBSD - that would be the icing on the cake! (I know, I'm a non-contributing whiner, but hey, I can dream, no?)

  4. By Anonymous Coward (87.178.173.242) on

    The main difference between GUI and CLI based UI ist that a "graphical" (windowing) UI is like a cheat sheet all by itself.

    With a GUI you don't have to remember cryptic options, but everything is spelled out, and constrasting options are next to each other.

    The same cannot at all said about CLI programs and not even their man files, in some mans options are alphabetically listed, so you need to read (and remember) ALL in order to understand how they are interrelated.

    So a CLI generally is kind of an ergonomics desaster, unless your memory is above average.

    Comments
    1. By sthen (2a01:348:108:155:216:41ff:fe53:6a45) on

      > The main difference between GUI and CLI based UI ist that a "graphical" (windowing) UI is like a cheat sheet all by itself.
      >
      > With a GUI you don't have to remember cryptic options, but everything is spelled out, and constrasting options are next to each other.

      The main difference between GUI and a text-based configuration file is that a well-written sample configuration is like a mini-instruction manual all by itself right where you need it, with space for writing notes.

      With a text configuration file, you don't have to try and make sense of a 6-word description of a complex topic with the better explanation often only available from a link to the top of a large help page. And when you know what you're looking for but not where they decided to hide it, with a text file you can search and go straight to the right place, and find that last time you were there you left yourself some helpful notes, rather than click through 15 tabs, several of them having additional options hidden on an extra pop-up menu behind a button.

      <note to self, next time don't feed the damn trolls...>

      Comments
      1. By Anonymous Coward (87.178.172.165) on

        > <note to self, next time don't feed the damn trolls...>

        My intent was not at all to troll.
        So thanks for your thought food anyway.

        I still find I made a valid point (that's simply my experience and denying would in itself be trolling), and you too make valid points I like.

        Of course, much depends on how things are implemented.

Credits

Copyright © - Daniel Hartmeier. All rights reserved. Articles and comments are copyright their respective authors, submission implies license to publish on this web site. Contents of the archive prior to as well as images and HTML templates were copied from the fabulous original deadly.org with Jose's and Jim's kind permission. This journal runs as CGI with httpd(8) on OpenBSD, the source code is BSD licensed. undeadly \Un*dead"ly\, a. Not subject to death; immortal. [Obs.]