Annotation of www/33.html, Revision 1.37
1.27 david 1: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
1.1 miod 2: <html>
3: <head>
1.36 deraadt 4: <title>OpenBSD 3.3</title>
1.1 miod 5: <meta name="resource-type" content="document">
6: <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
7: <meta name="description" content="OpenBSD 3.3">
8: <meta name="keywords" content="openbsd,main">
9: <meta name="distribution" content="global">
10: <meta name="copyright" content="This document copyright 2003 by OpenBSD.">
11: </head>
12:
13: <body bgcolor="#ffffff" text="#000000" link="#24248E">
14:
15: <a href="index.html">
16: <img alt="[OpenBSD]" height="30" width="141" hspace="24" src="images/smalltitle.gif" border="0"></a>
17: <hr>
18:
19: <p>
1.5 deraadt 20: <a href="images/Barbarian.gif">
21: <img align="left" width="255" height="343" hspace="24"
22: src="images/Barbarian.gif" alt="OpenBSD 3.3 logo"></a>
1.36 deraadt 23: <h2><font color="#0000e0">OpenBSD 3.3</font></h2>
1.1 miod 24: <p>
25:
26: Released May 1, 2003<br>
27: Copyright 1997-2003, Theo de Raadt.<br>
28: <font color="#e00000">ISBN 0-9731791-1-2</font>
1.32 deraadt 29: <br>
30: <a href="lyrics.html#33">3.3 Song: "Puff the Barbarian"</a>
1.1 miod 31: <p>
32: <ul>
33: <li>Order a CDROM from our <a href="orders.html">ordering system</a>.
34: <li>See the information on <a href="ftp.html">The FTP page</a> for
35: a list of mirror machines.
36: <li>Go to the <font color="#e00000">pub/OpenBSD/3.3/</font> directory on
37: one of the mirror sites.
38: <li>Briefly read the rest of this document.
1.31 david 39: <li>Have a look at <a href="errata33.html">The 3.3 Errata page</a> for a list
1.1 miod 40: of bugs and workarounds.
1.14 deraadt 41: <li>See a <a href="plus33.html">detailed log of changes</a> between the
1.1 miod 42: 3.2 and 3.3 releases.
43: </ul>
44: <br clear=all>
1.37 ! deraadt 45: <p>
1.36 deraadt 46: All applicable copyrights and credits can be found in the applicable
47: file sources found in the files src.tar.gz, sys.tar.gz,
48: xenocara.tar.gz, or in the files fetched via ports.tar.gz. The
49: distribution files used to build packages from the ports.tar.gz file
50: are not included on the CDROM because of lack of space.
1.1 miod 51: <p>
52:
53: <a name="new"></a>
54: <hr>
55: <p>
56: <h3><font color="#0000e0">What's New</font></h3>
57: <p>
58: This is a partial list of new features and systems included in OpenBSD 3.3.
1.18 deraadt 59: For a comprehensive list, see the <a href="plus33.html">changelog</a> leading
1.1 miod 60: to 3.3.
61: <p>
62:
63: <ul>
64: <li>Integration of the
1.30 david 65: <a href="http://www.research.ibm.com/trl/projects/security/ssp/">ProPolice</a>
1.26 deraadt 66: stack protection technology, by Hiroaki Etoh, into the system
67: compiler. This protection is enabled by default. With this change,
68: function prologues are modified to rearrange the stack: a random
69: canary is placed before the return address, and buffer variables are
70: moved closer to the canary so that regular variables are below, and
71: harder to smash. The function epilogue then checks if the canary is
72: still intact. If it is not, the process is terminated. This change
73: makes it very hard for an attacker to modify the return address used
74: when returning from a function.
1.2 deraadt 75: <p>
1.1 miod 76:
1.22 deraadt 77: <li>W^X (pronounced: "W xor X") on architectures capable of
1.10 deraadt 78: pure execute-bit support in the MMU (sparc, sparc64, alpha,
79: hppa). This is a fine-grained memory permissions layout, ensuring that
80: memory which can be written to by application programs can not be
1.22 deraadt 81: executable at the same time and vice versa. This raises the bar on
82: potential buffer overflows and other attacks: as a result, an attacker
83: is unable to write code anywhere in memory where it can be executed.
1.26 deraadt 84: (NOTE: i386 and powerpc do not support W^X in 3.3; however, 3.3-current
85: already supports it on i386, and both these processors are expected to
86: support this change in 3.4).
1.1 miod 87: <p>
88:
1.2 deraadt 89: <li>Still more reduction in setuid and setgid binaries, and more chroot
1.22 deraadt 90: use throughout the system. While some programs are still setuid or
91: setgid, almost all of them grab a resource and then quickly revoke
92: privilege.
1.1 miod 93: <p>
94:
1.22 deraadt 95: <li>The X window server and xconsole now use privilege separation,
96: for better security. Also, xterm has been modified to do privilege
97: revocation. xdm runs as a special user and group, to further constrain
98: what might go wrong.
1.1 miod 99: <p>
100:
101: <li>As usual, improvements to the documentation, notably the man pages and
1.7 jsyn 102: the Web FAQ. An increasingly large part of the website is available in several
1.1 miod 103: languages.
104: <p>
105:
106: <li>More complete collection and better tested set of "ports".
107: setuid/setgid ports have been significantly reduced as well. Many of the
108: ones that remain setuid have been modified to revoke privileges as early
109: as possible.
110: <p>
111:
112: <li>Over 2000 pre-built and tested packages.
113: <p>
114:
115: <li>Significant improvements to the pthread library.
116: <p>
117:
118: <li>An incredible amount of enhancements and stability improvements to
119: our packet filter, <a
120: href="http://www.openbsd.org/cgi-bin/man.cgi?query=pf&sektion=4">pf</a>,
1.8 henning 121: including:
1.1 miod 122: <ul>
1.17 deraadt 123: <li>Queue, a bandwidth management system (uses altq underneath)
124: <li>Anchors, allowing subrulesets which can be loaded and modified independently
125: <li>Tables, a very efficient way for large address lists in rules
126: <li>Address pools, redirect/NAT to multiple addresses and thus load balancing
127: <li>Configuration language has been made much more flexible
128: <li>TCP window scaling support
129: <li>Full CIDR support
130: <li>Early checksum verification return on invalid packets
131: <li>Performance boost: large rulesets load much faster now
1.22 deraadt 132: <li><a href="http://www.openbsd.org/cgi-bin/man.cgi?query=spamd">spamd</a>,
133: a spam deferral daemon, which SMTP connections can be redirected to.
134: This daemon handles connections based on black lists and white lists,
135: tar-pits the connections, and ensures that the spammer knows why their
136: mail has not been accepted.
1.1 miod 137: </ul>
1.11 jason 138:
139: <p>
140:
141: <li>Much improved <a href="sparc64.html">sparc64</a> support: support for
1.13 miod 142: more models and several major bugs eradicated.
1.8 henning 143:
1.1 miod 144: <p>
145:
146: <li>The system includes the following major components from outside suppliers:
147: <ul>
148: <li>XFree86 4.2.1 (and i386 contains 3.3.X servers also, thus providing support for all chipsets)
1.4 miod 149: <li>Gcc 2.95.3 (+ patches)
150: <li>Perl 5.8.0 (+ patches)
1.3 henning 151: <li>Apache 1.3.27, mod_ssl 2.8.12, DSO support (+ patches)
1.1 miod 152: <li>OpenSSL 0.9.7beta3 (+ patches)
1.4 miod 153: <li>Groff 1.15
1.24 miod 154: <li>Sendmail 8.12.9
1.4 miod 155: <li>Bind 9.2.2 (+ patches)
1.23 margarid 156: <li>Lynx 2.8.2rel.1 with HTTPS support added (+ patches)
1.4 miod 157: <li>Sudo 1.6.7
158: <li>Ncurses 5.2
1.1 miod 159: <li>Latest KAME IPv6
1.12 hin 160: <li>KTH Kerberos 1.1.1
1.1 miod 161: <li>Heimdal 0.4e (+ patches)
162: <li>OpenSSH 3.6
163: </ul>
164: <p>
165:
166: <li>Many improvements for security and reliability (look for the red
1.18 deraadt 167: print in the <a href="plus33.html">complete changelog</a>).
1.1 miod 168: <p>
1.11 jason 169: <li> and much more.
170:
1.1 miod 171: </ul>
172:
173: <a name="install"></a>
174: <hr>
175: <p>
176: <h3><font color="#0000e0">How to install</font></h3>
177: <p>
178: Following this are the instructions which you would have on a piece of
179: paper if you had purchased a CDROM set instead of doing an alternate
180: form of install. The instructions for doing an ftp (or other style
181: of) install are very similar; the CDROM instructions are left intact
182: so that you can see how much easier it would have been if you had
183: purchased a CDROM instead.
184: <p>
185:
186: <hr>
1.15 drahn 187: Please refer to the following files on the three CDROMs or ftp mirror for
188: extensive details on how to install OpenBSD 3.3 on your machine:
1.1 miod 189: <p>
190: <ul>
191: <li> CD1:3.3/i386/INSTALL.i386
192: <p>
193: <li> CD2:3.3/macppc/INSTALL.macppc
194: <li> CD2:3.3/vax/INSTALL.vax
195: <p>
196: <li> CD3:3.3/sparc/INSTALL.sparc
197: <li> CD3:3.3/sparc64/INSTALL.sparc64
1.15 drahn 198: <p>
199: <li> FTP:.../OpenBSD/3.3/alpha/INSTALL.alpha
200: <li> FTP:.../OpenBSD/3.3/hp300/INSTALL.hp300
1.20 mickey 201: <li> FTP:.../OpenBSD/3.3/hppa/INSTALL.hppa
1.15 drahn 202: <li> FTP:.../OpenBSD/3.3/mac68k/INSTALL.mac68k
203: <li> FTP:.../OpenBSD/3.3/mvme68k/INSTALL.mvme68k
1.1 miod 204: </ul>
205: <hr>
206:
207: <p>
208: Quick installer information for people familiar with OpenBSD, and the
209: use of the "disklabel -E" command. If you are at all confused when
210: installing OpenBSD, read the relevant INSTALL.* file as listed above!
211: <p>
212:
213: <h3><font color="#e00000">OpenBSD/i386:</font></h3>
214: <ul>
215: Play with your BIOS options to enable booting from a CD. The OpenBSD/i386
216: release is on CD1. If your BIOS does not support booting from CD, you will need
217: to create a boot floppy to install from. To create a boot floppy write
218: <i>CD1:3.3/i386/floppy33.fs</i> to a floppy and boot via the floppy drive.
219:
220: <p>
221: Use <i>CD1:3.3/i386/floppyB33.fs</i> instead for greater scsi controller
222: support, or <i>CD1:3.3/i386/floppyC33.fs</i> for better laptop support.
223:
224: <p>
225: If you are planning on dual booting OpenBSD with another OS, you will need to read the included INSTALL.i386 document.
226:
227: <p>
228: To make a boot floppy under MS-DOS, use the "rawrite" utility located
229: at <i>CD:/3.3/tools/rawrite.exe</i>. To make the boot floppy under a Unix OS, use the <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=dd&sektion=1">dd(1)</a> utility. The following is an example usage of <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=dd&sektion=1">dd(1)</a>, where the device could be "floppy", "rfd0c", or "rfd0a".
230:
231: <ul><pre>
232: # <strong>dd if=<file> of=/dev/<device> bs=32k</strong>
233: </pre></ul>
234:
235: <p>
1.18 deraadt 236: Make sure you use properly formatted perfect floppies with NO BAD BLOCKS or your install will most likely fail. For more information on creating a boot floppy and installing OpenBSD/i386 please refer to <a href="faq/faq4.html#MkFlop">FAQ4.1</a>.
1.1 miod 237: </ul>
238:
239: <p>
240: <h3><font color="#e00000">OpenBSD/macppc:</font></h3>
241: <ul>
242: Put the CD2 in your CDROM drive and poweron your machine while holding down the
243: <i>C</i> key until the display turns on and shows <i>OpenBSD/macppc boot</i>.
244:
245: <p>
246: Alternatively, at the Open Firmware prompt, enter <i>boot cd:,ofwboot
247: /3.3/macppc/bsd.rd</i>
248: </ul>
249:
250: <p>
251: <h3><font color="#e00000">OpenBSD/vax:</font></h3>
252: <ul>
253: Boot over the network via mopbooting as described in INSTALL.vax.
254: </ul>
255:
256: <p>
257: <h3><font color="#e00000">OpenBSD/sparc:</font></h3>
258: <ul>
259: The 3.3 release of OpenBSD/sparc is located on CD3. To boot off of this CD you can use one of the two commands listed below, depending on the version of your ROM.
260:
261: <ul><pre>
262: > <strong>boot cdrom 3.3/sparc/bsd.rd</strong>
263: or
264: > <strong>b sd(0,6,0)3.3/sparc/bsd.rd</strong>
265: </pre></ul>
266:
267: <p>
268: If your sparc does not have a CD drive, you can alternatively boot from floppy.
1.18 deraadt 269: To do so you need to write "CD3:3.3/sparc/floppy33.fs" to a floppy. For more information see <a href="faq/faq4.html#MkFlop">FAQ4.1</a>. To boot from the floppy use one of the two commands listed below, depending on the version of your ROM.
1.1 miod 270:
271: <ul><pre>
272: > <strong>boot floppy</strong>
273: or
274: > <strong>boot fd()</strong>
275: </pre></ul>
276:
277: <p>
278: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.
279:
280: <p>
281: If your sparc doesn't have a floppy drive nor a CD drive, you can either
282: setup a bootable tape, or install via network, as told in the
283: INSTALL.sparc file.
284: </ul>
285:
286: <p>
287: <h3><font color="#e00000">OpenBSD/sparc64:</font></h3>
288: <ul>
289: Put the CD3 in your CDROM drive and type <i>boot cdrom</i>.
290:
291: <p>
292: If this doesn't work, or if you don't have a CDROM drive, you can write
293: <i>CD3:3.3/sparc64/floppy33.fs</i> to a floppy and boot it with <i>boot
294: floppy</i>.<br>
295: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.
296:
297: <p>
298: You can also write <i>CD3:3.3/sparc64/miniroot33.fs</i> to the swap partition on
299: the disk and boot with <i>boot disk:b</i>.
300:
301: <p>
302: If nothing works, you can boot over the network as described in INSTALL.sparc64
303: </ul>
304:
305: <p>
1.15 drahn 306: <h3><font color="#e00000">OpenBSD/alpha:</font></h3>
307: <ul>
308: <p>Write <i>FTP:3.3/alpha/floppy33.fs</i> or
309: <i>FTP:3.3/alpha/floppyB33.fs</i> (depending on your machine) to a diskette and
310: enter <i>boot dva0</i>. Refer to INSTALL.alpha for more details.
311:
312: <p>
313: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.
314:
315: </ul>
316:
317: <p>
318: <h3><font color="#e00000">OpenBSD/hp300:</font></h3>
319: <ul>
320: <p>
321: Boot over the network by following the instructions in INSTALL.hp300.
322: </ul>
323:
324: <p>
1.28 miod 325: <h3><font color="#e00000">OpenBSD/hppa:</font></h3>
326: <ul>
327: <p>
328: Boot over the network by following the instructions in INSTALL.hppa or the
329: <a href="hppa.html#netboot">hppa platform page</a>.
330: </ul>
331:
332: <p>
1.15 drahn 333: <h3><font color="#e00000">OpenBSD/mac68k:</font></h3>
334: <ul>
335: <p>
336: Boot MacOS as normal and partition your disk with the appropriate A/UX
337: configurations. Then, extract the Macside utilities from
1.25 nick 338: <i>FTP:3.3/mac68k/utils</i> onto your hard disk. Run Mkfs to create your
1.15 drahn 339: filesystems on the A/UX partitions you just made. Then, use the
1.25 nick 340: "BSD/Mac68k Installer" to copy all the sets in <i>FTP:3.3/mac68k/</i> onto your
341: partitions. Finally, you will be ready to configure the "BSD/Mac68k
342: Booter" with the location of your kernel and boot the system.
1.15 drahn 343: </ul>
344:
345: <p>
346: <h3><font color="#e00000">OpenBSD/mvme68k:</font></h3>
347: <ul>
348: <p>
349: You can create a bootable installation tape or boot over the network.<br>
350: The network boot requires a MVME68K BUG version that supports the <i>NIOT</i>
351: and <i>NBO</i> debugger commands. Follow the instructions in INSTALL.mvme68k
352: for more details.
353: </ul>
354:
355: <p>
1.1 miod 356: <h3><font color="#e00000">Notes about the source code:</font></h3>
357: <ul>
358: src.tar.gz contains a source archive starting at /usr/src. This file
359: contains everything you need except for the kernel sources, which are
360: in a separate archive. To extract:
361: <p>
362: <ul><pre>
363: # <strong>mkdir -p /usr/src</strong>
364: # <strong>cd /usr/src</strong>
365: # <strong>tar xvfz /tmp/src.tar.gz</strong>
366: </pre></ul>
367: <p>
1.29 pb 368: sys.tar.gz contains a source archive starting at /usr/src/sys.
1.1 miod 369: This file contains all the kernel sources you need to rebuild kernels.
370: To extract:
371: <p>
372: <ul><pre>
373: # <strong>mkdir -p /usr/src/sys</strong>
374: # <strong>cd /usr/src</strong>
1.29 pb 375: # <strong>tar xvfz /tmp/sys.tar.gz</strong>
1.1 miod 376: </pre></ul>
377: <p>
378: Both of these trees are a regular CVS checkout. Using these trees it
379: is possible to get a head-start on using the anoncvs servers as
1.18 deraadt 380: described <a href="anoncvs.html">here</a>.
1.1 miod 381: Using these files
382: results in a much faster initial CVS update than you could expect from
383: a fresh checkout of the full OpenBSD source tree.
384: <p>
385: </ul>
386: <a name="ports"></a>
387: <hr>
388: <p>
389: <h3><font color="#0000e0">Ports Tree</font></h3>
390: <p>
391: A ports tree archive is also provided. To extract:
392: <p>
393: <ul><pre>
394: # <strong>cd /usr</strong>
395: # <strong>tar xvfz /tmp/ports.tar.gz</strong>
396: # <strong>cd ports</strong>
397: </pre></ul>
398: <p>
399: The <i>ports/</i> subdirectory is a checkout of the OpenBSD ports tree. Go
1.34 jasper 400: read the <a href="faq/faq15.html">ports</a> page
1.1 miod 401: if you know nothing about ports
402: at this point. This text is not a manual of how to use ports.
403: Rather, it is a set of notes meant to kickstart the user on the
404: OpenBSD ports system.
405: <p>
406: Certainly, the OpenBSD ports system is not complete. It is doubtful it
407: will ever be. However, it is growing very fast and getting more stable.
408: Almost all ports provided with this release should build without problems
409: on most architectures (over 2000 packages build on i386, for instance).
410: <p>
411: The <i>ports/</i> directory represents a CVS (see the manpage for
412: <a href="http://www.openbsd.org/cgi-bin/man.cgi?query=cvs&apropos=0&sektion=1&manpath=OpenBSD+Current&arch=i386&format=html">
413: cvs(1)</a> if
414: you aren't familiar with CVS) checkout of our ports. As with our complete
415: source tree, our ports tree is available via anoncvs. So, in
416: order to keep current with it, you must make the <i>ports/</i> tree
417: available on a read-write medium and update the tree with a command
418: like:
419: <p>
420: <ul><pre>
1.33 deraadt 421: # <strong>cd [portsdir]/; cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_3_3</strong>
1.1 miod 422: </pre></ul>
423: <p>
424: [Of course, you must replace the local directory and server name here
425: with the location of your ports collection and a nearby anoncvs
426: server.]
427: <p>
428: Note that most ports are available as packages through ftp. Updated
429: packages for the 3.3 release will be made available if problems arise.
430: <p>
431: If you're interested in seeing a port added, would like to help out, or just
432: would like to know more, the mailing list ports@openbsd.org is a good
433: place to know.
434: <p>
435:
436: </body>
437: </html>