Annotation of www/33.html, Revision 1.52
1.27 david 1: <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
1.1 miod 2: <html>
3: <head>
1.36 deraadt 4: <title>OpenBSD 3.3</title>
1.1 miod 5: <meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
6: <meta name="description" content="OpenBSD 3.3">
7: <meta name="copyright" content="This document copyright 2003 by OpenBSD.">
1.47 tb 8: <meta name="viewport" content="width=device-width, initial-scale=1">
9: <link rel="stylesheet" type="text/css" href="openbsd.css">
1.50 tb 10: <link rel="canonical" href="https://www.openbsd.org/33.html">
1.1 miod 11: </head>
12:
13: <body bgcolor="#ffffff" text="#000000" link="#24248E">
14:
1.47 tb 15: <h2>
1.1 miod 16: <a href="index.html">
1.47 tb 17: <font color="#0000ff"><i>Open</i></font><font color="#000084">BSD</font></a>
18: <font color="#e00000">3.3</font>
19: </h2>
1.1 miod 20:
1.5 deraadt 21: <a href="images/Barbarian.gif">
22: <img align="left" width="255" height="343" hspace="24"
23: src="images/Barbarian.gif" alt="OpenBSD 3.3 logo"></a>
1.1 miod 24: <p>
25:
26: Released May 1, 2003<br>
27: Copyright 1997-2003, Theo de Raadt.<br>
28: <font color="#e00000">ISBN 0-9731791-1-2</font>
1.32 deraadt 29: <br>
1.44 deraadt 30: 3.3 Song: <a href="lyrics.html#33">"Puff the Barbarian"</a>
1.1 miod 31: <p>
32: <ul>
1.52 ! tj 33: <!--
1.41 deraadt 34: <li>Order a CDROM from our <a href="https://openbsdstore.com">ordering system</a>.
1.52 ! tj 35: -->
1.1 miod 36: <li>See the information on <a href="ftp.html">The FTP page</a> for
37: a list of mirror machines.
38: <li>Go to the <font color="#e00000">pub/OpenBSD/3.3/</font> directory on
39: one of the mirror sites.
1.31 david 40: <li>Have a look at <a href="errata33.html">The 3.3 Errata page</a> for a list
1.1 miod 41: of bugs and workarounds.
1.14 deraadt 42: <li>See a <a href="plus33.html">detailed log of changes</a> between the
1.1 miod 43: 3.2 and 3.3 releases.
44: </ul>
1.48 tb 45: <p>
1.47 tb 46: All applicable copyrights and credits are in the src.tar.gz,
47: sys.tar.gz, xenocara.tar.gz, ports.tar.gz files, or in the
48: files fetched via ports.tar.gz.
49: <br clear="all">
1.1 miod 50:
1.47 tb 51: <hr>
1.1 miod 52: <a name="new"></a>
53: <p>
54: <h3><font color="#0000e0">What's New</font></h3>
55: <p>
1.47 tb 56: This is a partial list of new features and systems included in OpenBSD 3.3.
1.18 deraadt 57: For a comprehensive list, see the <a href="plus33.html">changelog</a> leading
1.1 miod 58: to 3.3.
59: <p>
60:
61: <ul>
62: <li>Integration of the
1.30 david 63: <a href="http://www.research.ibm.com/trl/projects/security/ssp/">ProPolice</a>
1.26 deraadt 64: stack protection technology, by Hiroaki Etoh, into the system
65: compiler. This protection is enabled by default. With this change,
66: function prologues are modified to rearrange the stack: a random
67: canary is placed before the return address, and buffer variables are
68: moved closer to the canary so that regular variables are below, and
69: harder to smash. The function epilogue then checks if the canary is
70: still intact. If it is not, the process is terminated. This change
71: makes it very hard for an attacker to modify the return address used
72: when returning from a function.
1.2 deraadt 73: <p>
1.1 miod 74:
1.22 deraadt 75: <li>W^X (pronounced: "W xor X") on architectures capable of
1.10 deraadt 76: pure execute-bit support in the MMU (sparc, sparc64, alpha,
77: hppa). This is a fine-grained memory permissions layout, ensuring that
78: memory which can be written to by application programs can not be
1.22 deraadt 79: executable at the same time and vice versa. This raises the bar on
80: potential buffer overflows and other attacks: as a result, an attacker
81: is unable to write code anywhere in memory where it can be executed.
1.26 deraadt 82: (NOTE: i386 and powerpc do not support W^X in 3.3; however, 3.3-current
83: already supports it on i386, and both these processors are expected to
1.47 tb 84: support this change in 3.4).
1.1 miod 85: <p>
86:
1.2 deraadt 87: <li>Still more reduction in setuid and setgid binaries, and more chroot
1.22 deraadt 88: use throughout the system. While some programs are still setuid or
89: setgid, almost all of them grab a resource and then quickly revoke
90: privilege.
1.1 miod 91: <p>
92:
1.22 deraadt 93: <li>The X window server and xconsole now use privilege separation,
94: for better security. Also, xterm has been modified to do privilege
95: revocation. xdm runs as a special user and group, to further constrain
96: what might go wrong.
1.1 miod 97: <p>
98:
99: <li>As usual, improvements to the documentation, notably the man pages and
1.7 jsyn 100: the Web FAQ. An increasingly large part of the website is available in several
1.1 miod 101: languages.
102: <p>
103:
104: <li>More complete collection and better tested set of "ports".
105: setuid/setgid ports have been significantly reduced as well. Many of the
106: ones that remain setuid have been modified to revoke privileges as early
107: as possible.
108: <p>
109:
110: <li>Over 2000 pre-built and tested packages.
111: <p>
112:
113: <li>Significant improvements to the pthread library.
114: <p>
115:
116: <li>An incredible amount of enhancements and stability improvements to
117: our packet filter, <a
1.51 tb 118: href="https://man.openbsd.org/?query=pf&sektion=4">pf</a>,
1.8 henning 119: including:
1.1 miod 120: <ul>
1.17 deraadt 121: <li>Queue, a bandwidth management system (uses altq underneath)
1.47 tb 122: <li>Anchors, allowing subrulesets which can be loaded and modified independently
1.17 deraadt 123: <li>Tables, a very efficient way for large address lists in rules
124: <li>Address pools, redirect/NAT to multiple addresses and thus load balancing
125: <li>Configuration language has been made much more flexible
126: <li>TCP window scaling support
127: <li>Full CIDR support
128: <li>Early checksum verification return on invalid packets
129: <li>Performance boost: large rulesets load much faster now
1.51 tb 130: <li><a href="https://man.openbsd.org/?query=spamd">spamd</a>,
1.22 deraadt 131: a spam deferral daemon, which SMTP connections can be redirected to.
132: This daemon handles connections based on black lists and white lists,
133: tar-pits the connections, and ensures that the spammer knows why their
134: mail has not been accepted.
1.1 miod 135: </ul>
1.11 jason 136:
137: <p>
138:
139: <li>Much improved <a href="sparc64.html">sparc64</a> support: support for
1.13 miod 140: more models and several major bugs eradicated.
1.8 henning 141:
1.1 miod 142: <p>
143:
144: <li>The system includes the following major components from outside suppliers:
145: <ul>
146: <li>XFree86 4.2.1 (and i386 contains 3.3.X servers also, thus providing support for all chipsets)
1.4 miod 147: <li>Gcc 2.95.3 (+ patches)
148: <li>Perl 5.8.0 (+ patches)
1.3 henning 149: <li>Apache 1.3.27, mod_ssl 2.8.12, DSO support (+ patches)
1.1 miod 150: <li>OpenSSL 0.9.7beta3 (+ patches)
1.4 miod 151: <li>Groff 1.15
1.24 miod 152: <li>Sendmail 8.12.9
1.4 miod 153: <li>Bind 9.2.2 (+ patches)
1.23 margarid 154: <li>Lynx 2.8.2rel.1 with HTTPS support added (+ patches)
1.4 miod 155: <li>Sudo 1.6.7
156: <li>Ncurses 5.2
1.1 miod 157: <li>Latest KAME IPv6
1.12 hin 158: <li>KTH Kerberos 1.1.1
1.1 miod 159: <li>Heimdal 0.4e (+ patches)
160: <li>OpenSSH 3.6
161: </ul>
162: <p>
163:
164: <li>Many improvements for security and reliability (look for the red
1.18 deraadt 165: print in the <a href="plus33.html">complete changelog</a>).
1.1 miod 166: <p>
1.11 jason 167: <li> and much more.
168:
1.1 miod 169: </ul>
170:
171: <a name="install"></a>
172: <hr>
173: <p>
174: <h3><font color="#0000e0">How to install</font></h3>
175: <p>
176: Following this are the instructions which you would have on a piece of
177: paper if you had purchased a CDROM set instead of doing an alternate
178: form of install. The instructions for doing an ftp (or other style
179: of) install are very similar; the CDROM instructions are left intact
180: so that you can see how much easier it would have been if you had
181: purchased a CDROM instead.
182: <p>
183:
184: <hr>
1.15 drahn 185: Please refer to the following files on the three CDROMs or ftp mirror for
186: extensive details on how to install OpenBSD 3.3 on your machine:
1.1 miod 187: <p>
188: <ul>
189: <li> CD1:3.3/i386/INSTALL.i386
190: <p>
191: <li> CD2:3.3/macppc/INSTALL.macppc
192: <li> CD2:3.3/vax/INSTALL.vax
193: <p>
194: <li> CD3:3.3/sparc/INSTALL.sparc
195: <li> CD3:3.3/sparc64/INSTALL.sparc64
1.15 drahn 196: <p>
197: <li> FTP:.../OpenBSD/3.3/alpha/INSTALL.alpha
198: <li> FTP:.../OpenBSD/3.3/hp300/INSTALL.hp300
1.20 mickey 199: <li> FTP:.../OpenBSD/3.3/hppa/INSTALL.hppa
1.15 drahn 200: <li> FTP:.../OpenBSD/3.3/mac68k/INSTALL.mac68k
201: <li> FTP:.../OpenBSD/3.3/mvme68k/INSTALL.mvme68k
1.1 miod 202: </ul>
203: <hr>
204:
205: <p>
206: Quick installer information for people familiar with OpenBSD, and the
207: use of the "disklabel -E" command. If you are at all confused when
208: installing OpenBSD, read the relevant INSTALL.* file as listed above!
209: <p>
210:
211: <h3><font color="#e00000">OpenBSD/i386:</font></h3>
212: <ul>
213: Play with your BIOS options to enable booting from a CD. The OpenBSD/i386
214: release is on CD1. If your BIOS does not support booting from CD, you will need
215: to create a boot floppy to install from. To create a boot floppy write
216: <i>CD1:3.3/i386/floppy33.fs</i> to a floppy and boot via the floppy drive.
217:
218: <p>
219: Use <i>CD1:3.3/i386/floppyB33.fs</i> instead for greater scsi controller
220: support, or <i>CD1:3.3/i386/floppyC33.fs</i> for better laptop support.
221:
222: <p>
223: If you are planning on dual booting OpenBSD with another OS, you will need to read the included INSTALL.i386 document.
224:
225: <p>
226: To make a boot floppy under MS-DOS, use the "rawrite" utility located
1.51 tb 227: at <i>CD:/3.3/tools/rawrite.exe</i>. To make the boot floppy under a Unix OS, use the <a href="https://man.openbsd.org/?query=dd&sektion=1">dd(1)</a> utility. The following is an example usage of <a href="https://man.openbsd.org/?query=dd&sektion=1">dd(1)</a>, where the device could be "floppy", "rfd0c", or "rfd0a".
1.1 miod 228:
229: <ul><pre>
230: # <strong>dd if=<file> of=/dev/<device> bs=32k</strong>
231: </pre></ul>
232:
233: <p>
1.49 tj 234: Make sure you use properly formatted perfect floppies with NO BAD BLOCKS or your install will most likely fail. For more information on creating a boot floppy and installing OpenBSD/i386 please refer to <a href="faq/faq4.html#MkFlop">this page</a>.
1.1 miod 235: </ul>
236:
237: <p>
238: <h3><font color="#e00000">OpenBSD/macppc:</font></h3>
239: <ul>
240: Put the CD2 in your CDROM drive and poweron your machine while holding down the
241: <i>C</i> key until the display turns on and shows <i>OpenBSD/macppc boot</i>.
242:
243: <p>
244: Alternatively, at the Open Firmware prompt, enter <i>boot cd:,ofwboot
245: /3.3/macppc/bsd.rd</i>
246: </ul>
247:
248: <p>
249: <h3><font color="#e00000">OpenBSD/vax:</font></h3>
250: <ul>
251: Boot over the network via mopbooting as described in INSTALL.vax.
252: </ul>
253:
254: <p>
255: <h3><font color="#e00000">OpenBSD/sparc:</font></h3>
256: <ul>
257: The 3.3 release of OpenBSD/sparc is located on CD3. To boot off of this CD you can use one of the two commands listed below, depending on the version of your ROM.
258:
259: <ul><pre>
260: > <strong>boot cdrom 3.3/sparc/bsd.rd</strong>
261: or
262: > <strong>b sd(0,6,0)3.3/sparc/bsd.rd</strong>
263: </pre></ul>
264:
265: <p>
266: If your sparc does not have a CD drive, you can alternatively boot from floppy.
1.49 tj 267: To do so you need to write "CD3:3.3/sparc/floppy33.fs" to a floppy. For more information see <a href="faq/faq4.html#MkFlop">this page</a>. To boot from the floppy use one of the two commands listed below, depending on the version of your ROM.
1.1 miod 268:
269: <ul><pre>
270: > <strong>boot floppy</strong>
271: or
272: > <strong>boot fd()</strong>
273: </pre></ul>
274:
275: <p>
276: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.
277:
278: <p>
279: If your sparc doesn't have a floppy drive nor a CD drive, you can either
280: setup a bootable tape, or install via network, as told in the
281: INSTALL.sparc file.
282: </ul>
283:
284: <p>
285: <h3><font color="#e00000">OpenBSD/sparc64:</font></h3>
286: <ul>
287: Put the CD3 in your CDROM drive and type <i>boot cdrom</i>.
288:
289: <p>
290: If this doesn't work, or if you don't have a CDROM drive, you can write
291: <i>CD3:3.3/sparc64/floppy33.fs</i> to a floppy and boot it with <i>boot
292: floppy</i>.<br>
293: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.
294:
295: <p>
296: You can also write <i>CD3:3.3/sparc64/miniroot33.fs</i> to the swap partition on
297: the disk and boot with <i>boot disk:b</i>.
298:
299: <p>
300: If nothing works, you can boot over the network as described in INSTALL.sparc64
301: </ul>
302:
303: <p>
1.15 drahn 304: <h3><font color="#e00000">OpenBSD/alpha:</font></h3>
305: <ul>
306: <p>Write <i>FTP:3.3/alpha/floppy33.fs</i> or
307: <i>FTP:3.3/alpha/floppyB33.fs</i> (depending on your machine) to a diskette and
308: enter <i>boot dva0</i>. Refer to INSTALL.alpha for more details.
309:
310: <p>
311: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.
312:
313: </ul>
314:
315: <p>
316: <h3><font color="#e00000">OpenBSD/hp300:</font></h3>
317: <ul>
318: <p>
319: Boot over the network by following the instructions in INSTALL.hp300.
320: </ul>
321:
322: <p>
1.28 miod 323: <h3><font color="#e00000">OpenBSD/hppa:</font></h3>
324: <ul>
325: <p>
326: Boot over the network by following the instructions in INSTALL.hppa or the
327: <a href="hppa.html#netboot">hppa platform page</a>.
328: </ul>
329:
330: <p>
1.15 drahn 331: <h3><font color="#e00000">OpenBSD/mac68k:</font></h3>
332: <ul>
333: <p>
334: Boot MacOS as normal and partition your disk with the appropriate A/UX
335: configurations. Then, extract the Macside utilities from
1.25 nick 336: <i>FTP:3.3/mac68k/utils</i> onto your hard disk. Run Mkfs to create your
1.15 drahn 337: filesystems on the A/UX partitions you just made. Then, use the
1.25 nick 338: "BSD/Mac68k Installer" to copy all the sets in <i>FTP:3.3/mac68k/</i> onto your
339: partitions. Finally, you will be ready to configure the "BSD/Mac68k
340: Booter" with the location of your kernel and boot the system.
1.15 drahn 341: </ul>
342:
343: <p>
344: <h3><font color="#e00000">OpenBSD/mvme68k:</font></h3>
345: <ul>
346: <p>
347: You can create a bootable installation tape or boot over the network.<br>
348: The network boot requires a MVME68K BUG version that supports the <i>NIOT</i>
349: and <i>NBO</i> debugger commands. Follow the instructions in INSTALL.mvme68k
350: for more details.
351: </ul>
352:
353: <p>
1.1 miod 354: <h3><font color="#e00000">Notes about the source code:</font></h3>
355: <ul>
356: src.tar.gz contains a source archive starting at /usr/src. This file
357: contains everything you need except for the kernel sources, which are
358: in a separate archive. To extract:
359: <p>
360: <ul><pre>
361: # <strong>mkdir -p /usr/src</strong>
362: # <strong>cd /usr/src</strong>
363: # <strong>tar xvfz /tmp/src.tar.gz</strong>
364: </pre></ul>
365: <p>
1.29 pb 366: sys.tar.gz contains a source archive starting at /usr/src/sys.
1.1 miod 367: This file contains all the kernel sources you need to rebuild kernels.
368: To extract:
369: <p>
370: <ul><pre>
371: # <strong>mkdir -p /usr/src/sys</strong>
372: # <strong>cd /usr/src</strong>
1.29 pb 373: # <strong>tar xvfz /tmp/sys.tar.gz</strong>
1.1 miod 374: </pre></ul>
375: <p>
376: Both of these trees are a regular CVS checkout. Using these trees it
377: is possible to get a head-start on using the anoncvs servers as
1.18 deraadt 378: described <a href="anoncvs.html">here</a>.
1.1 miod 379: Using these files
380: results in a much faster initial CVS update than you could expect from
381: a fresh checkout of the full OpenBSD source tree.
382: <p>
383: </ul>
384: <a name="ports"></a>
385: <hr>
386: <p>
387: <h3><font color="#0000e0">Ports Tree</font></h3>
388: <p>
389: A ports tree archive is also provided. To extract:
390: <p>
391: <ul><pre>
392: # <strong>cd /usr</strong>
393: # <strong>tar xvfz /tmp/ports.tar.gz</strong>
394: # <strong>cd ports</strong>
395: </pre></ul>
396: <p>
397: The <i>ports/</i> subdirectory is a checkout of the OpenBSD ports tree. Go
1.34 jasper 398: read the <a href="faq/faq15.html">ports</a> page
1.1 miod 399: if you know nothing about ports
400: at this point. This text is not a manual of how to use ports.
401: Rather, it is a set of notes meant to kickstart the user on the
402: OpenBSD ports system.
403: <p>
404: Certainly, the OpenBSD ports system is not complete. It is doubtful it
405: will ever be. However, it is growing very fast and getting more stable.
406: Almost all ports provided with this release should build without problems
407: on most architectures (over 2000 packages build on i386, for instance).
408: <p>
1.47 tb 409: The <i>ports/</i> directory represents a CVS (see the manpage for
1.51 tb 410: <a href="https://man.openbsd.org/?query=cvs&apropos=0&sektion=1&manpath=OpenBSD+Current&arch=i386&format=html">
1.47 tb 411: cvs(1)</a> if
412: you aren't familiar with CVS) checkout of our ports. As with our complete
1.1 miod 413: source tree, our ports tree is available via anoncvs. So, in
414: order to keep current with it, you must make the <i>ports/</i> tree
415: available on a read-write medium and update the tree with a command
416: like:
417: <p>
418: <ul><pre>
1.33 deraadt 419: # <strong>cd [portsdir]/; cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_3_3</strong>
1.1 miod 420: </pre></ul>
421: <p>
422: [Of course, you must replace the local directory and server name here
423: with the location of your ports collection and a nearby anoncvs
424: server.]
425: <p>
426: Note that most ports are available as packages through ftp. Updated
427: packages for the 3.3 release will be made available if problems arise.
428: <p>
429: If you're interested in seeing a port added, would like to help out, or just
430: would like to know more, the mailing list ports@openbsd.org is a good
431: place to know.
432: <p>
433:
434: </body>
435: </html>
![[BACK]](/icons/back.gif){kind=icon}
Return to 33.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www