Annotation of www/33.html, Revision 1.54
1.54 ! bentley 1: <!doctype html>
! 2: <html lang=en id=release>
! 3: <meta charset=utf-8>
! 4:
1.36 deraadt 5: <title>OpenBSD 3.3</title>
1.1 miod 6: <meta name="description" content="OpenBSD 3.3">
1.47 tb 7: <meta name="viewport" content="width=device-width, initial-scale=1">
8: <link rel="stylesheet" type="text/css" href="openbsd.css">
1.50 tb 9: <link rel="canonical" href="https://www.openbsd.org/33.html">
1.54 ! bentley 10: <style>
! 11: #sourcecode h3 {
! 12: color: var(--red);
! 13: }
! 14:
! 15: #sourcecode p {
! 16: margin-left: 2.75em;
! 17: }
! 18:
! 19: #sourcecode blockquote {
! 20: margin-left: 4.5em;
! 21: }
! 22: </style>
1.1 miod 23:
1.54 ! bentley 24: <h2 id=OpenBSD>
1.1 miod 25: <a href="index.html">
1.54 ! bentley 26: <i>Open</i><b>BSD</b></a>
! 27: 3.3
1.47 tb 28: </h2>
1.1 miod 29:
1.54 ! bentley 30: <table>
! 31: <tr>
! 32: <td>
1.5 deraadt 33: <a href="images/Barbarian.gif">
1.54 ! bentley 34: <img width="255" height="343"
! 35: src="images/Barbarian.gif" alt="Barbarian"></a>
1.1 miod 36:
1.54 ! bentley 37: <td>
1.1 miod 38: Released May 1, 2003<br>
39: Copyright 1997-2003, Theo de Raadt.<br>
1.54 ! bentley 40: <cite class=isbn>ISBN 0-9731791-1-2</cite>
1.32 deraadt 41: <br>
1.44 deraadt 42: 3.3 Song: <a href="lyrics.html#33">"Puff the Barbarian"</a>
1.53 deraadt 43: <br>
44: <br>
1.1 miod 45: <ul>
46: <li>See the information on <a href="ftp.html">The FTP page</a> for
47: a list of mirror machines.
1.54 ! bentley 48: <li>Go to the <code class=reldir>pub/OpenBSD/3.3/</code> directory on
1.1 miod 49: one of the mirror sites.
1.31 david 50: <li>Have a look at <a href="errata33.html">The 3.3 Errata page</a> for a list
1.1 miod 51: of bugs and workarounds.
1.14 deraadt 52: <li>See a <a href="plus33.html">detailed log of changes</a> between the
1.1 miod 53: 3.2 and 3.3 releases.
54: </ul>
1.48 tb 55: <p>
1.47 tb 56: All applicable copyrights and credits are in the src.tar.gz,
57: sys.tar.gz, xenocara.tar.gz, ports.tar.gz files, or in the
58: files fetched via ports.tar.gz.
1.54 ! bentley 59: </table>
1.1 miod 60:
1.47 tb 61: <hr>
1.54 ! bentley 62:
! 63: <section id=new>
! 64: <h3>What's New</h3>
! 65:
1.1 miod 66: <p>
1.47 tb 67: This is a partial list of new features and systems included in OpenBSD 3.3.
1.18 deraadt 68: For a comprehensive list, see the <a href="plus33.html">changelog</a> leading
1.1 miod 69: to 3.3.
70: <p>
71:
72: <ul>
73: <li>Integration of the
1.30 david 74: <a href="http://www.research.ibm.com/trl/projects/security/ssp/">ProPolice</a>
1.26 deraadt 75: stack protection technology, by Hiroaki Etoh, into the system
76: compiler. This protection is enabled by default. With this change,
77: function prologues are modified to rearrange the stack: a random
78: canary is placed before the return address, and buffer variables are
79: moved closer to the canary so that regular variables are below, and
80: harder to smash. The function epilogue then checks if the canary is
81: still intact. If it is not, the process is terminated. This change
82: makes it very hard for an attacker to modify the return address used
83: when returning from a function.
1.2 deraadt 84: <p>
1.1 miod 85:
1.22 deraadt 86: <li>W^X (pronounced: "W xor X") on architectures capable of
1.10 deraadt 87: pure execute-bit support in the MMU (sparc, sparc64, alpha,
88: hppa). This is a fine-grained memory permissions layout, ensuring that
89: memory which can be written to by application programs can not be
1.22 deraadt 90: executable at the same time and vice versa. This raises the bar on
91: potential buffer overflows and other attacks: as a result, an attacker
92: is unable to write code anywhere in memory where it can be executed.
1.26 deraadt 93: (NOTE: i386 and powerpc do not support W^X in 3.3; however, 3.3-current
94: already supports it on i386, and both these processors are expected to
1.47 tb 95: support this change in 3.4).
1.1 miod 96: <p>
97:
1.2 deraadt 98: <li>Still more reduction in setuid and setgid binaries, and more chroot
1.22 deraadt 99: use throughout the system. While some programs are still setuid or
100: setgid, almost all of them grab a resource and then quickly revoke
101: privilege.
1.1 miod 102: <p>
103:
1.22 deraadt 104: <li>The X window server and xconsole now use privilege separation,
105: for better security. Also, xterm has been modified to do privilege
106: revocation. xdm runs as a special user and group, to further constrain
107: what might go wrong.
1.1 miod 108: <p>
109:
110: <li>As usual, improvements to the documentation, notably the man pages and
1.7 jsyn 111: the Web FAQ. An increasingly large part of the website is available in several
1.1 miod 112: languages.
113: <p>
114:
115: <li>More complete collection and better tested set of "ports".
116: setuid/setgid ports have been significantly reduced as well. Many of the
117: ones that remain setuid have been modified to revoke privileges as early
118: as possible.
119: <p>
120:
121: <li>Over 2000 pre-built and tested packages.
122: <p>
123:
124: <li>Significant improvements to the pthread library.
125: <p>
126:
127: <li>An incredible amount of enhancements and stability improvements to
128: our packet filter, <a
1.54 ! bentley 129: href="https://man.openbsd.org/pf.4">pf</a>,
1.8 henning 130: including:
1.1 miod 131: <ul>
1.17 deraadt 132: <li>Queue, a bandwidth management system (uses altq underneath)
1.47 tb 133: <li>Anchors, allowing subrulesets which can be loaded and modified independently
1.17 deraadt 134: <li>Tables, a very efficient way for large address lists in rules
135: <li>Address pools, redirect/NAT to multiple addresses and thus load balancing
136: <li>Configuration language has been made much more flexible
137: <li>TCP window scaling support
138: <li>Full CIDR support
139: <li>Early checksum verification return on invalid packets
140: <li>Performance boost: large rulesets load much faster now
1.54 ! bentley 141: <li><a href="https://man.openbsd.org/spamd">spamd</a>,
1.22 deraadt 142: a spam deferral daemon, which SMTP connections can be redirected to.
143: This daemon handles connections based on black lists and white lists,
144: tar-pits the connections, and ensures that the spammer knows why their
145: mail has not been accepted.
1.1 miod 146: </ul>
1.11 jason 147:
148: <p>
149:
150: <li>Much improved <a href="sparc64.html">sparc64</a> support: support for
1.13 miod 151: more models and several major bugs eradicated.
1.8 henning 152:
1.1 miod 153: <p>
154:
155: <li>The system includes the following major components from outside suppliers:
156: <ul>
157: <li>XFree86 4.2.1 (and i386 contains 3.3.X servers also, thus providing support for all chipsets)
1.4 miod 158: <li>Gcc 2.95.3 (+ patches)
159: <li>Perl 5.8.0 (+ patches)
1.3 henning 160: <li>Apache 1.3.27, mod_ssl 2.8.12, DSO support (+ patches)
1.1 miod 161: <li>OpenSSL 0.9.7beta3 (+ patches)
1.4 miod 162: <li>Groff 1.15
1.24 miod 163: <li>Sendmail 8.12.9
1.4 miod 164: <li>Bind 9.2.2 (+ patches)
1.23 margarid 165: <li>Lynx 2.8.2rel.1 with HTTPS support added (+ patches)
1.4 miod 166: <li>Sudo 1.6.7
167: <li>Ncurses 5.2
1.1 miod 168: <li>Latest KAME IPv6
1.12 hin 169: <li>KTH Kerberos 1.1.1
1.1 miod 170: <li>Heimdal 0.4e (+ patches)
171: <li>OpenSSH 3.6
172: </ul>
173: <p>
174:
175: <li>Many improvements for security and reliability (look for the red
1.18 deraadt 176: print in the <a href="plus33.html">complete changelog</a>).
1.1 miod 177: <p>
1.11 jason 178: <li> and much more.
179:
1.1 miod 180: </ul>
1.54 ! bentley 181: </section>
1.1 miod 182:
183: <hr>
1.54 ! bentley 184:
! 185: <section id=install>
! 186: <h3>How to install</h3>
! 187:
1.1 miod 188: <p>
189: Following this are the instructions which you would have on a piece of
190: paper if you had purchased a CDROM set instead of doing an alternate
191: form of install. The instructions for doing an ftp (or other style
192: of) install are very similar; the CDROM instructions are left intact
193: so that you can see how much easier it would have been if you had
194: purchased a CDROM instead.
195: <p>
196:
197: <hr>
1.15 drahn 198: Please refer to the following files on the three CDROMs or ftp mirror for
199: extensive details on how to install OpenBSD 3.3 on your machine:
1.1 miod 200: <p>
201: <ul>
202: <li> CD1:3.3/i386/INSTALL.i386
203: <p>
204: <li> CD2:3.3/macppc/INSTALL.macppc
205: <li> CD2:3.3/vax/INSTALL.vax
206: <p>
207: <li> CD3:3.3/sparc/INSTALL.sparc
208: <li> CD3:3.3/sparc64/INSTALL.sparc64
1.15 drahn 209: <p>
210: <li> FTP:.../OpenBSD/3.3/alpha/INSTALL.alpha
211: <li> FTP:.../OpenBSD/3.3/hp300/INSTALL.hp300
1.20 mickey 212: <li> FTP:.../OpenBSD/3.3/hppa/INSTALL.hppa
1.15 drahn 213: <li> FTP:.../OpenBSD/3.3/mac68k/INSTALL.mac68k
214: <li> FTP:.../OpenBSD/3.3/mvme68k/INSTALL.mvme68k
1.1 miod 215: </ul>
216: <hr>
217:
1.54 ! bentley 218: <section id=quickinstall>
! 219:
1.1 miod 220: <p>
221: Quick installer information for people familiar with OpenBSD, and the
222: use of the "disklabel -E" command. If you are at all confused when
223: installing OpenBSD, read the relevant INSTALL.* file as listed above!
1.54 ! bentley 224:
! 225: <h3>OpenBSD/i386:</h3>
! 226:
1.1 miod 227: <p>
228: Play with your BIOS options to enable booting from a CD. The OpenBSD/i386
229: release is on CD1. If your BIOS does not support booting from CD, you will need
230: to create a boot floppy to install from. To create a boot floppy write
231: <i>CD1:3.3/i386/floppy33.fs</i> to a floppy and boot via the floppy drive.
232:
233: <p>
234: Use <i>CD1:3.3/i386/floppyB33.fs</i> instead for greater scsi controller
235: support, or <i>CD1:3.3/i386/floppyC33.fs</i> for better laptop support.
236:
237: <p>
238: If you are planning on dual booting OpenBSD with another OS, you will need to read the included INSTALL.i386 document.
239:
240: <p>
241: To make a boot floppy under MS-DOS, use the "rawrite" utility located
1.54 ! bentley 242: at <i>CD:/3.3/tools/rawrite.exe</i>. To make the boot floppy under a Unix OS, use the <a href="https://man.openbsd.org/dd.1">dd(1)</a> utility. The following is an example usage of <a href="https://man.openbsd.org/dd.1">dd(1)</a>, where the device could be "floppy", "rfd0c", or "rfd0a".
1.1 miod 243:
1.54 ! bentley 244: <blockquote><pre>
1.1 miod 245: # <strong>dd if=<file> of=/dev/<device> bs=32k</strong>
1.54 ! bentley 246: </pre></blockquote>
1.1 miod 247:
248: <p>
1.49 tj 249: Make sure you use properly formatted perfect floppies with NO BAD BLOCKS or your install will most likely fail. For more information on creating a boot floppy and installing OpenBSD/i386 please refer to <a href="faq/faq4.html#MkFlop">this page</a>.
1.54 ! bentley 250:
! 251: <h3>OpenBSD/macppc:</h3>
1.1 miod 252:
253: <p>
254: Put the CD2 in your CDROM drive and poweron your machine while holding down the
255: <i>C</i> key until the display turns on and shows <i>OpenBSD/macppc boot</i>.
256:
257: <p>
258: Alternatively, at the Open Firmware prompt, enter <i>boot cd:,ofwboot
259: /3.3/macppc/bsd.rd</i>
1.54 ! bentley 260:
! 261: <h3>OpenBSD/vax:</h3>
1.1 miod 262:
263: <p>
264: Boot over the network via mopbooting as described in INSTALL.vax.
1.54 ! bentley 265:
! 266: <h3>OpenBSD/sparc:</h3>
1.1 miod 267:
268: <p>
269: The 3.3 release of OpenBSD/sparc is located on CD3. To boot off of this CD you can use one of the two commands listed below, depending on the version of your ROM.
270:
1.54 ! bentley 271: <blockquote><pre>
! 272: > <kbd>boot cdrom 3.3/sparc/bsd.rd</kbd>
1.1 miod 273: or
1.54 ! bentley 274: > <kbd>b sd(0,6,0)3.3/sparc/bsd.rd</kbd>
! 275: </pre></blockquote>
1.1 miod 276:
277: <p>
278: If your sparc does not have a CD drive, you can alternatively boot from floppy.
1.49 tj 279: To do so you need to write "CD3:3.3/sparc/floppy33.fs" to a floppy. For more information see <a href="faq/faq4.html#MkFlop">this page</a>. To boot from the floppy use one of the two commands listed below, depending on the version of your ROM.
1.1 miod 280:
1.54 ! bentley 281: <blockquote><pre>
! 282: > <kbd>boot floppy</kbd>
1.1 miod 283: or
284: > <strong>boot fd()</strong>
1.54 ! bentley 285: </pre></blockquote>
1.1 miod 286:
287: <p>
288: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.
289:
290: <p>
291: If your sparc doesn't have a floppy drive nor a CD drive, you can either
292: setup a bootable tape, or install via network, as told in the
293: INSTALL.sparc file.
1.54 ! bentley 294:
! 295: <h3>OpenBSD/sparc64:</h3>
1.1 miod 296:
297: <p>
298: Put the CD3 in your CDROM drive and type <i>boot cdrom</i>.
299:
300: <p>
301: If this doesn't work, or if you don't have a CDROM drive, you can write
302: <i>CD3:3.3/sparc64/floppy33.fs</i> to a floppy and boot it with <i>boot
303: floppy</i>.<br>
304: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.
305:
306: <p>
307: You can also write <i>CD3:3.3/sparc64/miniroot33.fs</i> to the swap partition on
308: the disk and boot with <i>boot disk:b</i>.
309:
310: <p>
311: If nothing works, you can boot over the network as described in INSTALL.sparc64
1.54 ! bentley 312:
! 313: <h3>OpenBSD/alpha:</h3>
1.1 miod 314:
315: <p>
1.54 ! bentley 316: Write <i>FTP:3.3/alpha/floppy33.fs</i> or
1.15 drahn 317: <i>FTP:3.3/alpha/floppyB33.fs</i> (depending on your machine) to a diskette and
318: enter <i>boot dva0</i>. Refer to INSTALL.alpha for more details.
319:
320: <p>
321: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.
322:
1.54 ! bentley 323: <h3>OpenBSD/hp300:</h3>
1.15 drahn 324:
325: <p>
326: Boot over the network by following the instructions in INSTALL.hp300.
327:
1.54 ! bentley 328: <h3>OpenBSD/hppa:</h3>
! 329:
1.28 miod 330: <p>
331: Boot over the network by following the instructions in INSTALL.hppa or the
332: <a href="hppa.html#netboot">hppa platform page</a>.
333:
1.54 ! bentley 334: <h3>OpenBSD/mac68k:</h3>
! 335:
1.15 drahn 336: <p>
337: Boot MacOS as normal and partition your disk with the appropriate A/UX
338: configurations. Then, extract the Macside utilities from
1.25 nick 339: <i>FTP:3.3/mac68k/utils</i> onto your hard disk. Run Mkfs to create your
1.15 drahn 340: filesystems on the A/UX partitions you just made. Then, use the
1.25 nick 341: "BSD/Mac68k Installer" to copy all the sets in <i>FTP:3.3/mac68k/</i> onto your
342: partitions. Finally, you will be ready to configure the "BSD/Mac68k
343: Booter" with the location of your kernel and boot the system.
1.15 drahn 344:
1.54 ! bentley 345: <h3>OpenBSD/mvme68k:</h3>
! 346:
1.15 drahn 347: <p>
348: You can create a bootable installation tape or boot over the network.<br>
349: The network boot requires a MVME68K BUG version that supports the <i>NIOT</i>
350: and <i>NBO</i> debugger commands. Follow the instructions in INSTALL.mvme68k
351: for more details.
1.54 ! bentley 352:
! 353: </section>
! 354:
! 355: <section id=sourcecode>
! 356: <h3>Notes about the source code:</h3>
1.15 drahn 357:
358: <p>
1.1 miod 359: src.tar.gz contains a source archive starting at /usr/src. This file
360: contains everything you need except for the kernel sources, which are
361: in a separate archive. To extract:
1.54 ! bentley 362:
! 363: <blockquote><pre>
! 364: # <kbd>mkdir -p /usr/src</kbd>
! 365: # <kbd>cd /usr/src</kbd>
! 366: # <kbd>tar xvfz /tmp/src.tar.gz</kbd>
! 367: </pre></blockquote>
! 368:
1.1 miod 369: <p>
1.29 pb 370: sys.tar.gz contains a source archive starting at /usr/src/sys.
1.1 miod 371: This file contains all the kernel sources you need to rebuild kernels.
372: To extract:
1.54 ! bentley 373:
! 374: <blockquote><pre>
! 375: # <kbd>mkdir -p /usr/src/sys</kbd>
! 376: # <kbd>cd /usr/src</kbd>
1.29 pb 377: # <strong>tar xvfz /tmp/sys.tar.gz</strong>
1.54 ! bentley 378: </pre></blockquote>
! 379:
1.1 miod 380: <p>
381: Both of these trees are a regular CVS checkout. Using these trees it
382: is possible to get a head-start on using the anoncvs servers as
1.18 deraadt 383: described <a href="anoncvs.html">here</a>.
1.1 miod 384: Using these files
385: results in a much faster initial CVS update than you could expect from
386: a fresh checkout of the full OpenBSD source tree.
1.54 ! bentley 387:
! 388: </section>
! 389: </section>
! 390:
1.1 miod 391: <hr>
1.54 ! bentley 392:
! 393: <section id=ports>
! 394: <h3>Ports Tree</h3>
1.1 miod 395: <p>
396: A ports tree archive is also provided. To extract:
397: <p>
1.54 ! bentley 398: <blockquote><pre>
! 399: # <kbd>cd /usr</kbd>
! 400: # <kbd>tar xvfz /tmp/ports.tar.gz</kbd>
! 401: # <kbd>cd ports</kbd>
! 402: </pre></blockquote>
1.1 miod 403: <p>
404: The <i>ports/</i> subdirectory is a checkout of the OpenBSD ports tree. Go
1.34 jasper 405: read the <a href="faq/faq15.html">ports</a> page
1.1 miod 406: if you know nothing about ports
407: at this point. This text is not a manual of how to use ports.
408: Rather, it is a set of notes meant to kickstart the user on the
409: OpenBSD ports system.
410: <p>
411: Certainly, the OpenBSD ports system is not complete. It is doubtful it
412: will ever be. However, it is growing very fast and getting more stable.
413: Almost all ports provided with this release should build without problems
414: on most architectures (over 2000 packages build on i386, for instance).
415: <p>
1.47 tb 416: The <i>ports/</i> directory represents a CVS (see the manpage for
1.54 ! bentley 417: <a href="https://man.openbsd.org/cvs.1">
1.47 tb 418: cvs(1)</a> if
419: you aren't familiar with CVS) checkout of our ports. As with our complete
1.1 miod 420: source tree, our ports tree is available via anoncvs. So, in
421: order to keep current with it, you must make the <i>ports/</i> tree
422: available on a read-write medium and update the tree with a command
423: like:
424: <p>
1.54 ! bentley 425: <blockquote><pre>
1.33 deraadt 426: # <strong>cd [portsdir]/; cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_3_3</strong>
1.54 ! bentley 427: </pre></blockquote>
1.1 miod 428: <p>
429: [Of course, you must replace the local directory and server name here
430: with the location of your ports collection and a nearby anoncvs
431: server.]
432: <p>
433: Note that most ports are available as packages through ftp. Updated
434: packages for the 3.3 release will be made available if problems arise.
435: <p>
436: If you're interested in seeing a port added, would like to help out, or just
437: would like to know more, the mailing list ports@openbsd.org is a good
438: place to know.
1.54 ! bentley 439: </section>
![[BACK]](/icons/back.gif){kind=icon}
Return to 33.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www