Annotation of www/33.html, Revision 1.22
1.1 miod 1: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
2: <html>
3: <head>
4: <title>OpenBSD 3.3 Release</title>
5: <link rev=made href="mailto:www@openbsd.org">
6: <meta name="resource-type" content="document">
7: <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
8: <meta name="description" content="OpenBSD 3.3">
9: <meta name="keywords" content="openbsd,main">
10: <meta name="distribution" content="global">
11: <meta name="copyright" content="This document copyright 2003 by OpenBSD.">
12: </head>
13:
14: <body bgcolor="#ffffff" text="#000000" link="#24248E">
15:
16: <a href="index.html">
17: <img alt="[OpenBSD]" height="30" width="141" hspace="24" src="images/smalltitle.gif" border="0"></a>
18: <hr>
19:
20: <p>
1.5 deraadt 21: <a href="images/Barbarian.gif">
22: <img align="left" width="255" height="343" hspace="24"
23: src="images/Barbarian.gif" alt="OpenBSD 3.3 logo"></a>
1.1 miod 24: <h2><font color="#0000e0">The OpenBSD 3.3 Release:</font></h2>
25: <p>
26:
27: Released May 1, 2003<br>
28: Copyright 1997-2003, Theo de Raadt.<br>
29: <font color="#e00000">ISBN 0-9731791-1-2</font>
30: <p>
31:
32: <a href="#new">What's New</a><br>
33: <a href="#install">How to install</a><br>
34: <a href="#ports">How to use the ports tree</a><br>
35: <a href="orders.html">Ordering a CD set</a><br>
36:
37: <p>
38: <h3><font color="#0000e0">
39: To get the files for this release:
40: <ul>
41: <li>Order a CDROM from our <a href="orders.html">ordering system</a>.
42: <li>See the information on <a href="ftp.html">The FTP page</a> for
43: a list of mirror machines.
44: <li>Go to the <font color="#e00000">pub/OpenBSD/3.3/</font> directory on
45: one of the mirror sites.
46: <li>Briefly read the rest of this document.
47: <li>Have a look at <a href="errata.html">The 3.3 Errata page</a> for a list
48: of bugs and workarounds.
1.14 deraadt 49: <li>See a <a href="plus33.html">detailed log of changes</a> between the
1.1 miod 50: 3.2 and 3.3 releases.
51: </ul>
52: </font></h3>
53: <br clear=all>
54: <br>
55: <p>
56:
57: <strong>Note:</strong> All applicable copyrights and credits can be found
58: in the applicable file sources found in the files src.tar.gz, srcsys.tar.gz,
59: XF4.tar.gz, or in the files fetched via ports.tar.gz. The distribution
60: files used to build packages from the ports.tar.gz file are not included on
61: the CDROM because of lack of space.
62: <p>
63:
64: <a name="new"></a>
65: <hr>
66: <p>
67: <h3><font color="#0000e0">What's New</font></h3>
68: <p>
69: This is a partial list of new features and systems included in OpenBSD 3.3.
1.18 deraadt 70: For a comprehensive list, see the <a href="plus33.html">changelog</a> leading
1.1 miod 71: to 3.3.
72: <p>
73:
74: <ul>
75: <li>Integration of the
76: <a href="http://www.trl.ibm.com/projects/security/ssp">ProPolice</a>
77: stack protection technology into the system compiler. This protection is
1.22 ! deraadt 78: enabled by default. With this change, function prologues are modified
! 79: to rearrange the stack: a random canary is placed before the return
! 80: address, and buffer variables are moved closer to the canary so that
! 81: regular variables are below, and harder to smash. The function
! 82: epilogue then checks if the canary is still intact. If it is not,
! 83: the process is terminated. This change makes it very hard for an
! 84: attacker to modify the return address used when returning from a
! 85: function.
1.2 deraadt 86: <p>
1.1 miod 87:
1.22 ! deraadt 88: <li>W^X (pronounced: "W xor X") on architectures capable of
1.10 deraadt 89: pure execute-bit support in the MMU (sparc, sparc64, alpha,
90: hppa). This is a fine-grained memory permissions layout, ensuring that
91: memory which can be written to by application programs can not be
1.22 ! deraadt 92: executable at the same time and vice versa. This raises the bar on
! 93: potential buffer overflows and other attacks: as a result, an attacker
! 94: is unable to write code anywhere in memory where it can be executed.
! 95: (NOTE: i386 and powerpc do not support W^X in 3.3; however, 3.4 will
! 96: make this change on those architectures as well).
1.1 miod 97: <p>
98:
1.2 deraadt 99: <li>Still more reduction in setuid and setgid binaries, and more chroot
1.22 ! deraadt 100: use throughout the system. While some programs are still setuid or
! 101: setgid, almost all of them grab a resource and then quickly revoke
! 102: privilege.
1.1 miod 103: <p>
104:
1.22 ! deraadt 105: <li>The X window server and xconsole now use privilege separation,
! 106: for better security. Also, xterm has been modified to do privilege
! 107: revocation. xdm runs as a special user and group, to further constrain
! 108: what might go wrong.
1.1 miod 109: <p>
110:
111: <li>As usual, improvements to the documentation, notably the man pages and
1.7 jsyn 112: the Web FAQ. An increasingly large part of the website is available in several
1.1 miod 113: languages.
114: <p>
115:
116: <li>More complete collection and better tested set of "ports".
117: setuid/setgid ports have been significantly reduced as well. Many of the
118: ones that remain setuid have been modified to revoke privileges as early
119: as possible.
120: <p>
121:
122: <li>Over 2000 pre-built and tested packages.
123: <p>
124:
125: <li>Significant improvements to the pthread library.
126: <p>
127:
128: <li>An incredible amount of enhancements and stability improvements to
129: our packet filter, <a
130: href="http://www.openbsd.org/cgi-bin/man.cgi?query=pf&sektion=4">pf</a>,
1.8 henning 131: including:
1.1 miod 132: <ul>
1.17 deraadt 133: <li>Queue, a bandwidth management system (uses altq underneath)
134: <li>Anchors, allowing subrulesets which can be loaded and modified independently
135: <li>Tables, a very efficient way for large address lists in rules
136: <li>Address pools, redirect/NAT to multiple addresses and thus load balancing
137: <li>Configuration language has been made much more flexible
138: <li>TCP window scaling support
139: <li>Full CIDR support
140: <li>Early checksum verification return on invalid packets
141: <li>Performance boost: large rulesets load much faster now
1.22 ! deraadt 142: <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=spamd">spamd</a>,
! 143: a spam deferral daemon, which SMTP connections can be redirected to.
! 144: This daemon handles connections based on black lists and white lists,
! 145: tar-pits the connections, and ensures that the spammer knows why their
! 146: mail has not been accepted.
1.1 miod 147: </ul>
1.11 jason 148:
149: <p>
150:
151: <li>Much improved <a href="sparc64.html">sparc64</a> support: support for
1.13 miod 152: more models and several major bugs eradicated.
1.8 henning 153:
1.1 miod 154: <p>
155:
156: <li>The system includes the following major components from outside suppliers:
157: <ul>
158: <li>XFree86 4.2.1 (and i386 contains 3.3.X servers also, thus providing support for all chipsets)
1.4 miod 159: <li>Gcc 2.95.3 (+ patches)
160: <li>Perl 5.8.0 (+ patches)
1.3 henning 161: <li>Apache 1.3.27, mod_ssl 2.8.12, DSO support (+ patches)
1.1 miod 162: <li>OpenSSL 0.9.7beta3 (+ patches)
1.4 miod 163: <li>Groff 1.15
164: <li>Sendmail 8.12.8
165: <li>Bind 9.2.2 (+ patches)
166: <li>Lynx 2.8.2rel.1 with HTTPS support added
167: <li>Sudo 1.6.7
168: <li>Ncurses 5.2
1.1 miod 169: <li>Latest KAME IPv6
1.12 hin 170: <li>KTH Kerberos 1.1.1
1.1 miod 171: <li>Heimdal 0.4e (+ patches)
172: <li>OpenSSH 3.6
173: </ul>
174: <p>
175:
176: <li>Many improvements for security and reliability (look for the red
1.18 deraadt 177: print in the <a href="plus33.html">complete changelog</a>).
1.1 miod 178: <p>
1.11 jason 179: <li> and much more.
180:
1.1 miod 181: </ul>
182:
183: <a name="install"></a>
184: <hr>
185: <p>
186: <h3><font color="#0000e0">How to install</font></h3>
187: <p>
188: Following this are the instructions which you would have on a piece of
189: paper if you had purchased a CDROM set instead of doing an alternate
190: form of install. The instructions for doing an ftp (or other style
191: of) install are very similar; the CDROM instructions are left intact
192: so that you can see how much easier it would have been if you had
193: purchased a CDROM instead.
194: <p>
195:
196: <hr>
1.15 drahn 197: Please refer to the following files on the three CDROMs or ftp mirror for
198: extensive details on how to install OpenBSD 3.3 on your machine:
1.1 miod 199: <p>
200: <ul>
201: <li> CD1:3.3/i386/INSTALL.i386
202: <p>
203: <li> CD2:3.3/macppc/INSTALL.macppc
204: <li> CD2:3.3/vax/INSTALL.vax
205: <p>
206: <li> CD3:3.3/sparc/INSTALL.sparc
207: <li> CD3:3.3/sparc64/INSTALL.sparc64
1.15 drahn 208: <p>
209: <li> FTP:.../OpenBSD/3.3/alpha/INSTALL.alpha
210: <li> FTP:.../OpenBSD/3.3/hp300/INSTALL.hp300
1.20 mickey 211: <li> FTP:.../OpenBSD/3.3/hppa/INSTALL.hppa
1.15 drahn 212: <li> FTP:.../OpenBSD/3.3/mac68k/INSTALL.mac68k
213: <li> FTP:.../OpenBSD/3.3/mvme68k/INSTALL.mvme68k
1.1 miod 214: </ul>
215: <hr>
216:
217: <p>
218: Quick installer information for people familiar with OpenBSD, and the
219: use of the "disklabel -E" command. If you are at all confused when
220: installing OpenBSD, read the relevant INSTALL.* file as listed above!
221: <p>
222:
223: <h3><font color="#e00000">OpenBSD/i386:</font></h3>
224: <ul>
225: Play with your BIOS options to enable booting from a CD. The OpenBSD/i386
226: release is on CD1. If your BIOS does not support booting from CD, you will need
227: to create a boot floppy to install from. To create a boot floppy write
228: <i>CD1:3.3/i386/floppy33.fs</i> to a floppy and boot via the floppy drive.
229:
230: <p>
231: Use <i>CD1:3.3/i386/floppyB33.fs</i> instead for greater scsi controller
232: support, or <i>CD1:3.3/i386/floppyC33.fs</i> for better laptop support.
233:
234: <p>
235: If you are planning on dual booting OpenBSD with another OS, you will need to read the included INSTALL.i386 document.
236:
237: <p>
238: To make a boot floppy under MS-DOS, use the "rawrite" utility located
239: at <i>CD:/3.3/tools/rawrite.exe</i>. To make the boot floppy under a Unix OS, use the <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=dd&sektion=1">dd(1)</a> utility. The following is an example usage of <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=dd&sektion=1">dd(1)</a>, where the device could be "floppy", "rfd0c", or "rfd0a".
240:
241: <ul><pre>
242: # <strong>dd if=<file> of=/dev/<device> bs=32k</strong>
243: </pre></ul>
244:
245: <p>
1.18 deraadt 246: Make sure you use properly formatted perfect floppies with NO BAD BLOCKS or your install will most likely fail. For more information on creating a boot floppy and installing OpenBSD/i386 please refer to <a href="faq/faq4.html#MkFlop">FAQ4.1</a>.
1.1 miod 247: </ul>
248:
249: <p>
250: <h3><font color="#e00000">OpenBSD/macppc:</font></h3>
251: <ul>
252: Put the CD2 in your CDROM drive and poweron your machine while holding down the
253: <i>C</i> key until the display turns on and shows <i>OpenBSD/macppc boot</i>.
254:
255: <p>
256: Alternatively, at the Open Firmware prompt, enter <i>boot cd:,ofwboot
257: /3.3/macppc/bsd.rd</i>
258: </ul>
259:
260: <p>
261: <h3><font color="#e00000">OpenBSD/vax:</font></h3>
262: <ul>
263: Boot over the network via mopbooting as described in INSTALL.vax.
264: </ul>
265:
266: <p>
267: <h3><font color="#e00000">OpenBSD/sparc:</font></h3>
268: <ul>
269: The 3.3 release of OpenBSD/sparc is located on CD3. To boot off of this CD you can use one of the two commands listed below, depending on the version of your ROM.
270:
271: <ul><pre>
272: > <strong>boot cdrom 3.3/sparc/bsd.rd</strong>
273: or
274: > <strong>b sd(0,6,0)3.3/sparc/bsd.rd</strong>
275: </pre></ul>
276:
277: <p>
278: If your sparc does not have a CD drive, you can alternatively boot from floppy.
1.18 deraadt 279: To do so you need to write "CD3:3.3/sparc/floppy33.fs" to a floppy. For more information see <a href="faq/faq4.html#MkFlop">FAQ4.1</a>. To boot from the floppy use one of the two commands listed below, depending on the version of your ROM.
1.1 miod 280:
281: <ul><pre>
282: > <strong>boot floppy</strong>
283: or
284: > <strong>boot fd()</strong>
285: </pre></ul>
286:
287: <p>
288: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.
289:
290: <p>
291: If your sparc doesn't have a floppy drive nor a CD drive, you can either
292: setup a bootable tape, or install via network, as told in the
293: INSTALL.sparc file.
294: </ul>
295:
296: <p>
297: <h3><font color="#e00000">OpenBSD/sparc64:</font></h3>
298: <ul>
299: Put the CD3 in your CDROM drive and type <i>boot cdrom</i>.
300:
301: <p>
302: If this doesn't work, or if you don't have a CDROM drive, you can write
303: <i>CD3:3.3/sparc64/floppy33.fs</i> to a floppy and boot it with <i>boot
304: floppy</i>.<br>
305: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.
306:
307: <p>
308: You can also write <i>CD3:3.3/sparc64/miniroot33.fs</i> to the swap partition on
309: the disk and boot with <i>boot disk:b</i>.
310:
311: <p>
312: If nothing works, you can boot over the network as described in INSTALL.sparc64
313: </ul>
314:
315: <p>
1.15 drahn 316: <h3><font color="#e00000">OpenBSD/alpha:</font></h3>
317: <ul>
318: <p>Write <i>FTP:3.3/alpha/floppy33.fs</i> or
319: <i>FTP:3.3/alpha/floppyB33.fs</i> (depending on your machine) to a diskette and
320: enter <i>boot dva0</i>. Refer to INSTALL.alpha for more details.
321:
322: <p>
323: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.
324:
325: </ul>
326:
327: <p>
328: <h3><font color="#e00000">OpenBSD/hp300:</font></h3>
329: <ul>
330: <p>
331: Boot over the network by following the instructions in INSTALL.hp300.
332: </ul>
333:
334: <p>
335: <h3><font color="#e00000">OpenBSD/mac68k:</font></h3>
336: <ul>
337: <p>
338: Boot MacOS as normal and partition your disk with the appropriate A/UX
339: configurations. Then, extract the Macside utilities from
340: CD4:3.1/mac68k/utils onto your hard disk. Run Mkfs to create your
341: filesystems on the A/UX partitions you just made. Then, use the
342: BSD/Mac68k Installer to copy all the sets in CD4:3.1/mac68k/ onto your
343: partitions. Finally, you will be ready to configure the BSD/Mac68k
344: Booter with the location of your kernel and boot the system.
345: </ul>
346:
347: <p>
348: <h3><font color="#e00000">OpenBSD/mvme68k:</font></h3>
349: <ul>
350: <p>
351: You can create a bootable installation tape or boot over the network.<br>
352: The network boot requires a MVME68K BUG version that supports the <i>NIOT</i>
353: and <i>NBO</i> debugger commands. Follow the instructions in INSTALL.mvme68k
354: for more details.
355: </ul>
356:
357: <p>
1.1 miod 358: <h3><font color="#e00000">Notes about the source code:</font></h3>
359: <ul>
360: src.tar.gz contains a source archive starting at /usr/src. This file
361: contains everything you need except for the kernel sources, which are
362: in a separate archive. To extract:
363: <p>
364: <ul><pre>
365: # <strong>mkdir -p /usr/src</strong>
366: # <strong>cd /usr/src</strong>
367: # <strong>tar xvfz /tmp/src.tar.gz</strong>
368: </pre></ul>
369: <p>
370: srcsys.tar.gz contains a source archive starting at /usr/src/sys.
371: This file contains all the kernel sources you need to rebuild kernels.
372: To extract:
373: <p>
374: <ul><pre>
375: # <strong>mkdir -p /usr/src/sys</strong>
376: # <strong>cd /usr/src</strong>
377: # <strong>tar xvfz /tmp/srcsys.tar.gz</strong>
378: </pre></ul>
379: <p>
380: Both of these trees are a regular CVS checkout. Using these trees it
381: is possible to get a head-start on using the anoncvs servers as
1.18 deraadt 382: described <a href="anoncvs.html">here</a>.
1.1 miod 383: Using these files
384: results in a much faster initial CVS update than you could expect from
385: a fresh checkout of the full OpenBSD source tree.
386: <p>
387: </ul>
388: <a name="ports"></a>
389: <hr>
390: <p>
391: <h3><font color="#0000e0">Ports Tree</font></h3>
392: <p>
393: A ports tree archive is also provided. To extract:
394: <p>
395: <ul><pre>
396: # <strong>cd /usr</strong>
397: # <strong>tar xvfz /tmp/ports.tar.gz</strong>
398: # <strong>cd ports</strong>
399: </pre></ul>
400: <p>
401: The <i>ports/</i> subdirectory is a checkout of the OpenBSD ports tree. Go
1.18 deraadt 402: read the <a href="ports.html">ports</a> page
1.1 miod 403: if you know nothing about ports
404: at this point. This text is not a manual of how to use ports.
405: Rather, it is a set of notes meant to kickstart the user on the
406: OpenBSD ports system.
407: <p>
408: Certainly, the OpenBSD ports system is not complete. It is doubtful it
409: will ever be. However, it is growing very fast and getting more stable.
410: Almost all ports provided with this release should build without problems
411: on most architectures (over 2000 packages build on i386, for instance).
412: <p>
413: The <i>ports/</i> directory represents a CVS (see the manpage for
414: <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=cvs&apropos=0&sektion=1&manpath=OpenBSD+Current&arch=i386&format=html">
415: cvs(1)</a> if
416: you aren't familiar with CVS) checkout of our ports. As with our complete
417: source tree, our ports tree is available via anoncvs. So, in
418: order to keep current with it, you must make the <i>ports/</i> tree
419: available on a read-write medium and update the tree with a command
420: like:
421: <p>
422: <ul><pre>
1.15 drahn 423: # <strong>cd [portsdir]/; cvs -d anoncvsserver.openbsd.org:/cvs update -Pd -rOPENBSD_3_3</strong>
1.1 miod 424: </pre></ul>
425: <p>
426: [Of course, you must replace the local directory and server name here
427: with the location of your ports collection and a nearby anoncvs
428: server.]
429: <p>
430: Note that most ports are available as packages through ftp. Updated
431: packages for the 3.3 release will be made available if problems arise.
432: <p>
433: If you're interested in seeing a port added, would like to help out, or just
434: would like to know more, the mailing list ports@openbsd.org is a good
435: place to know.
436: <p>
437:
438: <hr>
439: <a href="index.html"><img height="24" width="24" src="back.gif" border="0"
440: alt="OpenBSD"></a>
441: <a href="mailto:www@openbsd.org">www@openbsd.org</a>
442: <br><small>
1.22 ! deraadt 443: $OpenBSD: 33.html,v 1.21 2003/03/27 23:29:02 henning Exp $
1.1 miod 444: </small>
445:
446: </body>
447: </html>
![[BACK]](/icons/back.gif){kind=icon}
Return to 33.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www