Annotation of www/33.html, Revision 1.45
1.27 david 1: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
1.1 miod 2: <html>
3: <head>
1.36 deraadt 4: <title>OpenBSD 3.3</title>
1.1 miod 5: <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
6: <meta name="description" content="OpenBSD 3.3">
7: <meta name="copyright" content="This document copyright 2003 by OpenBSD.">
1.42 sthen 8: <link rel="canonical" href="http://www.openbsd.org/33.html">
1.1 miod 9: </head>
10:
11: <body bgcolor="#ffffff" text="#000000" link="#24248E">
12:
13: <a href="index.html">
14: <img alt="[OpenBSD]" height="30" width="141" hspace="24" src="images/smalltitle.gif" border="0"></a>
1.38 deraadt 15: <p>
1.1 miod 16:
1.5 deraadt 17: <a href="images/Barbarian.gif">
18: <img align="left" width="255" height="343" hspace="24"
19: src="images/Barbarian.gif" alt="OpenBSD 3.3 logo"></a>
1.36 deraadt 20: <h2><font color="#0000e0">OpenBSD 3.3</font></h2>
1.1 miod 21: <p>
22:
23: Released May 1, 2003<br>
24: Copyright 1997-2003, Theo de Raadt.<br>
25: <font color="#e00000">ISBN 0-9731791-1-2</font>
1.32 deraadt 26: <br>
1.44 deraadt 27: 3.3 Song: <a href="lyrics.html#33">"Puff the Barbarian"</a>
1.1 miod 28: <p>
29: <ul>
1.41 deraadt 30: <li>Order a CDROM from our <a href="https://openbsdstore.com">ordering system</a>.
1.1 miod 31: <li>See the information on <a href="ftp.html">The FTP page</a> for
32: a list of mirror machines.
33: <li>Go to the <font color="#e00000">pub/OpenBSD/3.3/</font> directory on
34: one of the mirror sites.
1.31 david 35: <li>Have a look at <a href="errata33.html">The 3.3 Errata page</a> for a list
1.1 miod 36: of bugs and workarounds.
1.14 deraadt 37: <li>See a <a href="plus33.html">detailed log of changes</a> between the
1.1 miod 38: 3.2 and 3.3 releases.
39: </ul>
40: <br clear=all>
1.37 deraadt 41: <p>
1.36 deraadt 42: All applicable copyrights and credits can be found in the applicable
43: file sources found in the files src.tar.gz, sys.tar.gz,
1.40 jsg 44: XF4.tar.gz, or in the files fetched via ports.tar.gz. The
1.36 deraadt 45: distribution files used to build packages from the ports.tar.gz file
46: are not included on the CDROM because of lack of space.
1.1 miod 47: <p>
48:
49: <a name="new"></a>
50: <hr>
51: <p>
52: <h3><font color="#0000e0">What's New</font></h3>
53: <p>
54: This is a partial list of new features and systems included in OpenBSD 3.3.
1.18 deraadt 55: For a comprehensive list, see the <a href="plus33.html">changelog</a> leading
1.1 miod 56: to 3.3.
57: <p>
58:
59: <ul>
60: <li>Integration of the
1.30 david 61: <a href="http://www.research.ibm.com/trl/projects/security/ssp/">ProPolice</a>
1.26 deraadt 62: stack protection technology, by Hiroaki Etoh, into the system
63: compiler. This protection is enabled by default. With this change,
64: function prologues are modified to rearrange the stack: a random
65: canary is placed before the return address, and buffer variables are
66: moved closer to the canary so that regular variables are below, and
67: harder to smash. The function epilogue then checks if the canary is
68: still intact. If it is not, the process is terminated. This change
69: makes it very hard for an attacker to modify the return address used
70: when returning from a function.
1.2 deraadt 71: <p>
1.1 miod 72:
1.22 deraadt 73: <li>W^X (pronounced: "W xor X") on architectures capable of
1.10 deraadt 74: pure execute-bit support in the MMU (sparc, sparc64, alpha,
75: hppa). This is a fine-grained memory permissions layout, ensuring that
76: memory which can be written to by application programs can not be
1.22 deraadt 77: executable at the same time and vice versa. This raises the bar on
78: potential buffer overflows and other attacks: as a result, an attacker
79: is unable to write code anywhere in memory where it can be executed.
1.26 deraadt 80: (NOTE: i386 and powerpc do not support W^X in 3.3; however, 3.3-current
81: already supports it on i386, and both these processors are expected to
82: support this change in 3.4).
1.1 miod 83: <p>
84:
1.2 deraadt 85: <li>Still more reduction in setuid and setgid binaries, and more chroot
1.22 deraadt 86: use throughout the system. While some programs are still setuid or
87: setgid, almost all of them grab a resource and then quickly revoke
88: privilege.
1.1 miod 89: <p>
90:
1.22 deraadt 91: <li>The X window server and xconsole now use privilege separation,
92: for better security. Also, xterm has been modified to do privilege
93: revocation. xdm runs as a special user and group, to further constrain
94: what might go wrong.
1.1 miod 95: <p>
96:
97: <li>As usual, improvements to the documentation, notably the man pages and
1.7 jsyn 98: the Web FAQ. An increasingly large part of the website is available in several
1.1 miod 99: languages.
100: <p>
101:
102: <li>More complete collection and better tested set of "ports".
103: setuid/setgid ports have been significantly reduced as well. Many of the
104: ones that remain setuid have been modified to revoke privileges as early
105: as possible.
106: <p>
107:
108: <li>Over 2000 pre-built and tested packages.
109: <p>
110:
111: <li>Significant improvements to the pthread library.
112: <p>
113:
114: <li>An incredible amount of enhancements and stability improvements to
115: our packet filter, <a
1.45 ! beck 116: href="http://man.openbsd.org?query=pf&sektion=4">pf</a>,
1.8 henning 117: including:
1.1 miod 118: <ul>
1.17 deraadt 119: <li>Queue, a bandwidth management system (uses altq underneath)
120: <li>Anchors, allowing subrulesets which can be loaded and modified independently
121: <li>Tables, a very efficient way for large address lists in rules
122: <li>Address pools, redirect/NAT to multiple addresses and thus load balancing
123: <li>Configuration language has been made much more flexible
124: <li>TCP window scaling support
125: <li>Full CIDR support
126: <li>Early checksum verification return on invalid packets
127: <li>Performance boost: large rulesets load much faster now
1.45 ! beck 128: <li><a href="http://man.openbsd.org?query=spamd">spamd</a>,
1.22 deraadt 129: a spam deferral daemon, which SMTP connections can be redirected to.
130: This daemon handles connections based on black lists and white lists,
131: tar-pits the connections, and ensures that the spammer knows why their
132: mail has not been accepted.
1.1 miod 133: </ul>
1.11 jason 134:
135: <p>
136:
137: <li>Much improved <a href="sparc64.html">sparc64</a> support: support for
1.13 miod 138: more models and several major bugs eradicated.
1.8 henning 139:
1.1 miod 140: <p>
141:
142: <li>The system includes the following major components from outside suppliers:
143: <ul>
144: <li>XFree86 4.2.1 (and i386 contains 3.3.X servers also, thus providing support for all chipsets)
1.4 miod 145: <li>Gcc 2.95.3 (+ patches)
146: <li>Perl 5.8.0 (+ patches)
1.3 henning 147: <li>Apache 1.3.27, mod_ssl 2.8.12, DSO support (+ patches)
1.1 miod 148: <li>OpenSSL 0.9.7beta3 (+ patches)
1.4 miod 149: <li>Groff 1.15
1.24 miod 150: <li>Sendmail 8.12.9
1.4 miod 151: <li>Bind 9.2.2 (+ patches)
1.23 margarid 152: <li>Lynx 2.8.2rel.1 with HTTPS support added (+ patches)
1.4 miod 153: <li>Sudo 1.6.7
154: <li>Ncurses 5.2
1.1 miod 155: <li>Latest KAME IPv6
1.12 hin 156: <li>KTH Kerberos 1.1.1
1.1 miod 157: <li>Heimdal 0.4e (+ patches)
158: <li>OpenSSH 3.6
159: </ul>
160: <p>
161:
162: <li>Many improvements for security and reliability (look for the red
1.18 deraadt 163: print in the <a href="plus33.html">complete changelog</a>).
1.1 miod 164: <p>
1.11 jason 165: <li> and much more.
166:
1.1 miod 167: </ul>
168:
169: <a name="install"></a>
170: <hr>
171: <p>
172: <h3><font color="#0000e0">How to install</font></h3>
173: <p>
174: Following this are the instructions which you would have on a piece of
175: paper if you had purchased a CDROM set instead of doing an alternate
176: form of install. The instructions for doing an ftp (or other style
177: of) install are very similar; the CDROM instructions are left intact
178: so that you can see how much easier it would have been if you had
179: purchased a CDROM instead.
180: <p>
181:
182: <hr>
1.15 drahn 183: Please refer to the following files on the three CDROMs or ftp mirror for
184: extensive details on how to install OpenBSD 3.3 on your machine:
1.1 miod 185: <p>
186: <ul>
187: <li> CD1:3.3/i386/INSTALL.i386
188: <p>
189: <li> CD2:3.3/macppc/INSTALL.macppc
190: <li> CD2:3.3/vax/INSTALL.vax
191: <p>
192: <li> CD3:3.3/sparc/INSTALL.sparc
193: <li> CD3:3.3/sparc64/INSTALL.sparc64
1.15 drahn 194: <p>
195: <li> FTP:.../OpenBSD/3.3/alpha/INSTALL.alpha
196: <li> FTP:.../OpenBSD/3.3/hp300/INSTALL.hp300
1.20 mickey 197: <li> FTP:.../OpenBSD/3.3/hppa/INSTALL.hppa
1.15 drahn 198: <li> FTP:.../OpenBSD/3.3/mac68k/INSTALL.mac68k
199: <li> FTP:.../OpenBSD/3.3/mvme68k/INSTALL.mvme68k
1.1 miod 200: </ul>
201: <hr>
202:
203: <p>
204: Quick installer information for people familiar with OpenBSD, and the
205: use of the "disklabel -E" command. If you are at all confused when
206: installing OpenBSD, read the relevant INSTALL.* file as listed above!
207: <p>
208:
209: <h3><font color="#e00000">OpenBSD/i386:</font></h3>
210: <ul>
211: Play with your BIOS options to enable booting from a CD. The OpenBSD/i386
212: release is on CD1. If your BIOS does not support booting from CD, you will need
213: to create a boot floppy to install from. To create a boot floppy write
214: <i>CD1:3.3/i386/floppy33.fs</i> to a floppy and boot via the floppy drive.
215:
216: <p>
217: Use <i>CD1:3.3/i386/floppyB33.fs</i> instead for greater scsi controller
218: support, or <i>CD1:3.3/i386/floppyC33.fs</i> for better laptop support.
219:
220: <p>
221: If you are planning on dual booting OpenBSD with another OS, you will need to read the included INSTALL.i386 document.
222:
223: <p>
224: To make a boot floppy under MS-DOS, use the "rawrite" utility located
1.45 ! beck 225: at <i>CD:/3.3/tools/rawrite.exe</i>. To make the boot floppy under a Unix OS, use the <a href="http://man.openbsd.org?query=dd&sektion=1">dd(1)</a> utility. The following is an example usage of <a href="http://man.openbsd.org?query=dd&sektion=1">dd(1)</a>, where the device could be "floppy", "rfd0c", or "rfd0a".
1.1 miod 226:
227: <ul><pre>
228: # <strong>dd if=<file> of=/dev/<device> bs=32k</strong>
229: </pre></ul>
230:
231: <p>
1.18 deraadt 232: Make sure you use properly formatted perfect floppies with NO BAD BLOCKS or your install will most likely fail. For more information on creating a boot floppy and installing OpenBSD/i386 please refer to <a href="faq/faq4.html#MkFlop">FAQ4.1</a>.
1.1 miod 233: </ul>
234:
235: <p>
236: <h3><font color="#e00000">OpenBSD/macppc:</font></h3>
237: <ul>
238: Put the CD2 in your CDROM drive and poweron your machine while holding down the
239: <i>C</i> key until the display turns on and shows <i>OpenBSD/macppc boot</i>.
240:
241: <p>
242: Alternatively, at the Open Firmware prompt, enter <i>boot cd:,ofwboot
243: /3.3/macppc/bsd.rd</i>
244: </ul>
245:
246: <p>
247: <h3><font color="#e00000">OpenBSD/vax:</font></h3>
248: <ul>
249: Boot over the network via mopbooting as described in INSTALL.vax.
250: </ul>
251:
252: <p>
253: <h3><font color="#e00000">OpenBSD/sparc:</font></h3>
254: <ul>
255: The 3.3 release of OpenBSD/sparc is located on CD3. To boot off of this CD you can use one of the two commands listed below, depending on the version of your ROM.
256:
257: <ul><pre>
258: > <strong>boot cdrom 3.3/sparc/bsd.rd</strong>
259: or
260: > <strong>b sd(0,6,0)3.3/sparc/bsd.rd</strong>
261: </pre></ul>
262:
263: <p>
264: If your sparc does not have a CD drive, you can alternatively boot from floppy.
1.18 deraadt 265: To do so you need to write "CD3:3.3/sparc/floppy33.fs" to a floppy. For more information see <a href="faq/faq4.html#MkFlop">FAQ4.1</a>. To boot from the floppy use one of the two commands listed below, depending on the version of your ROM.
1.1 miod 266:
267: <ul><pre>
268: > <strong>boot floppy</strong>
269: or
270: > <strong>boot fd()</strong>
271: </pre></ul>
272:
273: <p>
274: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.
275:
276: <p>
277: If your sparc doesn't have a floppy drive nor a CD drive, you can either
278: setup a bootable tape, or install via network, as told in the
279: INSTALL.sparc file.
280: </ul>
281:
282: <p>
283: <h3><font color="#e00000">OpenBSD/sparc64:</font></h3>
284: <ul>
285: Put the CD3 in your CDROM drive and type <i>boot cdrom</i>.
286:
287: <p>
288: If this doesn't work, or if you don't have a CDROM drive, you can write
289: <i>CD3:3.3/sparc64/floppy33.fs</i> to a floppy and boot it with <i>boot
290: floppy</i>.<br>
291: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.
292:
293: <p>
294: You can also write <i>CD3:3.3/sparc64/miniroot33.fs</i> to the swap partition on
295: the disk and boot with <i>boot disk:b</i>.
296:
297: <p>
298: If nothing works, you can boot over the network as described in INSTALL.sparc64
299: </ul>
300:
301: <p>
1.15 drahn 302: <h3><font color="#e00000">OpenBSD/alpha:</font></h3>
303: <ul>
304: <p>Write <i>FTP:3.3/alpha/floppy33.fs</i> or
305: <i>FTP:3.3/alpha/floppyB33.fs</i> (depending on your machine) to a diskette and
306: enter <i>boot dva0</i>. Refer to INSTALL.alpha for more details.
307:
308: <p>
309: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.
310:
311: </ul>
312:
313: <p>
314: <h3><font color="#e00000">OpenBSD/hp300:</font></h3>
315: <ul>
316: <p>
317: Boot over the network by following the instructions in INSTALL.hp300.
318: </ul>
319:
320: <p>
1.28 miod 321: <h3><font color="#e00000">OpenBSD/hppa:</font></h3>
322: <ul>
323: <p>
324: Boot over the network by following the instructions in INSTALL.hppa or the
325: <a href="hppa.html#netboot">hppa platform page</a>.
326: </ul>
327:
328: <p>
1.15 drahn 329: <h3><font color="#e00000">OpenBSD/mac68k:</font></h3>
330: <ul>
331: <p>
332: Boot MacOS as normal and partition your disk with the appropriate A/UX
333: configurations. Then, extract the Macside utilities from
1.25 nick 334: <i>FTP:3.3/mac68k/utils</i> onto your hard disk. Run Mkfs to create your
1.15 drahn 335: filesystems on the A/UX partitions you just made. Then, use the
1.25 nick 336: "BSD/Mac68k Installer" to copy all the sets in <i>FTP:3.3/mac68k/</i> onto your
337: partitions. Finally, you will be ready to configure the "BSD/Mac68k
338: Booter" with the location of your kernel and boot the system.
1.15 drahn 339: </ul>
340:
341: <p>
342: <h3><font color="#e00000">OpenBSD/mvme68k:</font></h3>
343: <ul>
344: <p>
345: You can create a bootable installation tape or boot over the network.<br>
346: The network boot requires a MVME68K BUG version that supports the <i>NIOT</i>
347: and <i>NBO</i> debugger commands. Follow the instructions in INSTALL.mvme68k
348: for more details.
349: </ul>
350:
351: <p>
1.1 miod 352: <h3><font color="#e00000">Notes about the source code:</font></h3>
353: <ul>
354: src.tar.gz contains a source archive starting at /usr/src. This file
355: contains everything you need except for the kernel sources, which are
356: in a separate archive. To extract:
357: <p>
358: <ul><pre>
359: # <strong>mkdir -p /usr/src</strong>
360: # <strong>cd /usr/src</strong>
361: # <strong>tar xvfz /tmp/src.tar.gz</strong>
362: </pre></ul>
363: <p>
1.29 pb 364: sys.tar.gz contains a source archive starting at /usr/src/sys.
1.1 miod 365: This file contains all the kernel sources you need to rebuild kernels.
366: To extract:
367: <p>
368: <ul><pre>
369: # <strong>mkdir -p /usr/src/sys</strong>
370: # <strong>cd /usr/src</strong>
1.29 pb 371: # <strong>tar xvfz /tmp/sys.tar.gz</strong>
1.1 miod 372: </pre></ul>
373: <p>
374: Both of these trees are a regular CVS checkout. Using these trees it
375: is possible to get a head-start on using the anoncvs servers as
1.18 deraadt 376: described <a href="anoncvs.html">here</a>.
1.1 miod 377: Using these files
378: results in a much faster initial CVS update than you could expect from
379: a fresh checkout of the full OpenBSD source tree.
380: <p>
381: </ul>
382: <a name="ports"></a>
383: <hr>
384: <p>
385: <h3><font color="#0000e0">Ports Tree</font></h3>
386: <p>
387: A ports tree archive is also provided. To extract:
388: <p>
389: <ul><pre>
390: # <strong>cd /usr</strong>
391: # <strong>tar xvfz /tmp/ports.tar.gz</strong>
392: # <strong>cd ports</strong>
393: </pre></ul>
394: <p>
395: The <i>ports/</i> subdirectory is a checkout of the OpenBSD ports tree. Go
1.34 jasper 396: read the <a href="faq/faq15.html">ports</a> page
1.1 miod 397: if you know nothing about ports
398: at this point. This text is not a manual of how to use ports.
399: Rather, it is a set of notes meant to kickstart the user on the
400: OpenBSD ports system.
401: <p>
402: Certainly, the OpenBSD ports system is not complete. It is doubtful it
403: will ever be. However, it is growing very fast and getting more stable.
404: Almost all ports provided with this release should build without problems
405: on most architectures (over 2000 packages build on i386, for instance).
406: <p>
407: The <i>ports/</i> directory represents a CVS (see the manpage for
1.45 ! beck 408: <a href="http://man.openbsd.org?query=cvs&apropos=0&sektion=1&manpath=OpenBSD+Current&arch=i386&format=html">
1.1 miod 409: cvs(1)</a> if
410: you aren't familiar with CVS) checkout of our ports. As with our complete
411: source tree, our ports tree is available via anoncvs. So, in
412: order to keep current with it, you must make the <i>ports/</i> tree
413: available on a read-write medium and update the tree with a command
414: like:
415: <p>
416: <ul><pre>
1.33 deraadt 417: # <strong>cd [portsdir]/; cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_3_3</strong>
1.1 miod 418: </pre></ul>
419: <p>
420: [Of course, you must replace the local directory and server name here
421: with the location of your ports collection and a nearby anoncvs
422: server.]
423: <p>
424: Note that most ports are available as packages through ftp. Updated
425: packages for the 3.3 release will be made available if problems arise.
426: <p>
427: If you're interested in seeing a port added, would like to help out, or just
428: would like to know more, the mailing list ports@openbsd.org is a good
429: place to know.
430: <p>
431:
432: </body>
433: </html>
![[BACK]](/icons/back.gif){kind=icon}
Return to 33.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www