Annotation of www/33.html, Revision 1.58
1.54 bentley 1: <!doctype html>
2: <html lang=en id=release>
3: <meta charset=utf-8>
4:
1.36 deraadt 5: <title>OpenBSD 3.3</title>
1.1 miod 6: <meta name="description" content="OpenBSD 3.3">
1.47 tb 7: <meta name="viewport" content="width=device-width, initial-scale=1">
8: <link rel="stylesheet" type="text/css" href="openbsd.css">
1.50 tb 9: <link rel="canonical" href="https://www.openbsd.org/33.html">
1.1 miod 10:
1.54 bentley 11: <h2 id=OpenBSD>
1.1 miod 12: <a href="index.html">
1.54 bentley 13: <i>Open</i><b>BSD</b></a>
14: 3.3
1.47 tb 15: </h2>
1.1 miod 16:
1.54 bentley 17: <table>
18: <tr>
19: <td>
1.5 deraadt 20: <a href="images/Barbarian.gif">
1.55 deraadt 21: <img width="255" height="343"
1.54 bentley 22: src="images/Barbarian.gif" alt="Barbarian"></a>
1.1 miod 23:
1.54 bentley 24: <td>
1.1 miod 25: Released May 1, 2003<br>
26: Copyright 1997-2003, Theo de Raadt.<br>
1.54 bentley 27: <cite class=isbn>ISBN 0-9731791-1-2</cite>
1.32 deraadt 28: <br>
1.44 deraadt 29: 3.3 Song: <a href="lyrics.html#33">"Puff the Barbarian"</a>
1.53 deraadt 30: <br>
31: <br>
1.1 miod 32: <ul>
33: <li>See the information on <a href="ftp.html">The FTP page</a> for
34: a list of mirror machines.
1.54 bentley 35: <li>Go to the <code class=reldir>pub/OpenBSD/3.3/</code> directory on
1.1 miod 36: one of the mirror sites.
1.31 david 37: <li>Have a look at <a href="errata33.html">The 3.3 Errata page</a> for a list
1.1 miod 38: of bugs and workarounds.
1.14 deraadt 39: <li>See a <a href="plus33.html">detailed log of changes</a> between the
1.1 miod 40: 3.2 and 3.3 releases.
41: </ul>
1.48 tb 42: <p>
1.47 tb 43: All applicable copyrights and credits are in the src.tar.gz,
44: sys.tar.gz, xenocara.tar.gz, ports.tar.gz files, or in the
1.58 ! deraadt 45: files fetched via <code>ports.tar.gz</code>.
1.54 bentley 46: </table>
1.1 miod 47:
1.47 tb 48: <hr>
1.54 bentley 49:
50: <section id=new>
51: <h3>What's New</h3>
1.1 miod 52: <p>
1.47 tb 53: This is a partial list of new features and systems included in OpenBSD 3.3.
1.18 deraadt 54: For a comprehensive list, see the <a href="plus33.html">changelog</a> leading
1.1 miod 55: to 3.3.
56: <p>
57:
58: <ul>
59: <li>Integration of the
1.30 david 60: <a href="http://www.research.ibm.com/trl/projects/security/ssp/">ProPolice</a>
1.26 deraadt 61: stack protection technology, by Hiroaki Etoh, into the system
62: compiler. This protection is enabled by default. With this change,
63: function prologues are modified to rearrange the stack: a random
64: canary is placed before the return address, and buffer variables are
65: moved closer to the canary so that regular variables are below, and
66: harder to smash. The function epilogue then checks if the canary is
67: still intact. If it is not, the process is terminated. This change
68: makes it very hard for an attacker to modify the return address used
69: when returning from a function.
1.2 deraadt 70: <p>
1.1 miod 71:
1.22 deraadt 72: <li>W^X (pronounced: "W xor X") on architectures capable of
1.10 deraadt 73: pure execute-bit support in the MMU (sparc, sparc64, alpha,
74: hppa). This is a fine-grained memory permissions layout, ensuring that
75: memory which can be written to by application programs can not be
1.22 deraadt 76: executable at the same time and vice versa. This raises the bar on
77: potential buffer overflows and other attacks: as a result, an attacker
78: is unable to write code anywhere in memory where it can be executed.
1.26 deraadt 79: (NOTE: i386 and powerpc do not support W^X in 3.3; however, 3.3-current
80: already supports it on i386, and both these processors are expected to
1.47 tb 81: support this change in 3.4).
1.1 miod 82: <p>
83:
1.2 deraadt 84: <li>Still more reduction in setuid and setgid binaries, and more chroot
1.22 deraadt 85: use throughout the system. While some programs are still setuid or
86: setgid, almost all of them grab a resource and then quickly revoke
87: privilege.
1.1 miod 88: <p>
89:
1.22 deraadt 90: <li>The X window server and xconsole now use privilege separation,
91: for better security. Also, xterm has been modified to do privilege
92: revocation. xdm runs as a special user and group, to further constrain
93: what might go wrong.
1.1 miod 94: <p>
95:
96: <li>As usual, improvements to the documentation, notably the man pages and
1.7 jsyn 97: the Web FAQ. An increasingly large part of the website is available in several
1.1 miod 98: languages.
99: <p>
100:
101: <li>More complete collection and better tested set of "ports".
102: setuid/setgid ports have been significantly reduced as well. Many of the
103: ones that remain setuid have been modified to revoke privileges as early
104: as possible.
105: <p>
106:
107: <li>Over 2000 pre-built and tested packages.
108: <p>
109:
110: <li>Significant improvements to the pthread library.
111: <p>
112:
113: <li>An incredible amount of enhancements and stability improvements to
114: our packet filter, <a
1.54 bentley 115: href="https://man.openbsd.org/pf.4">pf</a>,
1.8 henning 116: including:
1.1 miod 117: <ul>
1.17 deraadt 118: <li>Queue, a bandwidth management system (uses altq underneath)
1.47 tb 119: <li>Anchors, allowing subrulesets which can be loaded and modified independently
1.17 deraadt 120: <li>Tables, a very efficient way for large address lists in rules
121: <li>Address pools, redirect/NAT to multiple addresses and thus load balancing
122: <li>Configuration language has been made much more flexible
123: <li>TCP window scaling support
124: <li>Full CIDR support
125: <li>Early checksum verification return on invalid packets
126: <li>Performance boost: large rulesets load much faster now
1.54 bentley 127: <li><a href="https://man.openbsd.org/spamd">spamd</a>,
1.22 deraadt 128: a spam deferral daemon, which SMTP connections can be redirected to.
129: This daemon handles connections based on black lists and white lists,
130: tar-pits the connections, and ensures that the spammer knows why their
131: mail has not been accepted.
1.1 miod 132: </ul>
1.11 jason 133:
134: <p>
135:
136: <li>Much improved <a href="sparc64.html">sparc64</a> support: support for
1.13 miod 137: more models and several major bugs eradicated.
1.8 henning 138:
1.1 miod 139: <p>
140:
141: <li>The system includes the following major components from outside suppliers:
142: <ul>
143: <li>XFree86 4.2.1 (and i386 contains 3.3.X servers also, thus providing support for all chipsets)
1.4 miod 144: <li>Gcc 2.95.3 (+ patches)
145: <li>Perl 5.8.0 (+ patches)
1.3 henning 146: <li>Apache 1.3.27, mod_ssl 2.8.12, DSO support (+ patches)
1.1 miod 147: <li>OpenSSL 0.9.7beta3 (+ patches)
1.4 miod 148: <li>Groff 1.15
1.24 miod 149: <li>Sendmail 8.12.9
1.4 miod 150: <li>Bind 9.2.2 (+ patches)
1.23 margarid 151: <li>Lynx 2.8.2rel.1 with HTTPS support added (+ patches)
1.4 miod 152: <li>Sudo 1.6.7
153: <li>Ncurses 5.2
1.1 miod 154: <li>Latest KAME IPv6
1.12 hin 155: <li>KTH Kerberos 1.1.1
1.1 miod 156: <li>Heimdal 0.4e (+ patches)
157: <li>OpenSSH 3.6
158: </ul>
159: <p>
160:
161: <li>Many improvements for security and reliability (look for the red
1.18 deraadt 162: print in the <a href="plus33.html">complete changelog</a>).
1.1 miod 163: <p>
1.11 jason 164: <li> and much more.
165:
1.1 miod 166: </ul>
1.54 bentley 167: </section>
1.1 miod 168:
169: <hr>
1.54 bentley 170:
171: <section id=install>
172: <h3>How to install</h3>
173:
1.1 miod 174: <p>
175: Following this are the instructions which you would have on a piece of
176: paper if you had purchased a CDROM set instead of doing an alternate
177: form of install. The instructions for doing an ftp (or other style
178: of) install are very similar; the CDROM instructions are left intact
179: so that you can see how much easier it would have been if you had
180: purchased a CDROM instead.
181: <p>
182:
183: <hr>
1.15 drahn 184: Please refer to the following files on the three CDROMs or ftp mirror for
185: extensive details on how to install OpenBSD 3.3 on your machine:
1.1 miod 186: <p>
187: <ul>
1.56 deraadt 188: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/3.3/i386/INSTALL.i386">
189: .../OpenBSD/3.3/i386/INSTALL.i386 (on CD1)</a>
1.15 drahn 190: <p>
1.56 deraadt 191: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/3.3/macppc/INSTALL.macppc">
192: .../OpenBSD/3.3/macppc/INSTALL.macppc (on CD2)</a>
193: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/3.3/vax/INSTALL.vax">
194: .../OpenBSD/3.3/vax/INSTALL.vax (on CD2)</a>
195: <p>
196: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/3.3/sparc/INSTALL.sparc">
197: .../OpenBSD/3.3/sparc/INSTALL.sparc (on CD3)</a>
198: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/3.3/sparc64/INSTALL.sparc64">
199: .../OpenBSD/3.3/sparc64/INSTALL.sparc64 (on CD3)</a>
200: <p>
201: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/3.3/alpha/INSTALL.alpha">
202: .../OpenBSD/3.3/alpha/INSTALL.alpha</a>
203: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/3.3/hp300/INSTALL.hp300">
204: .../OpenBSD/3.3/hp300/INSTALL.hp300</a>
205: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/3.3/hppa/INSTALL.hppa">
206: .../OpenBSD/3.3/hppa/INSTALL.hppa</a>
207: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/3.3/mac68k/INSTALL.mac68k">
208: .../OpenBSD/3.3/mac68k/INSTALL.mac68k</a>
209: <li><a href="https://ftp.openbsd.org/pub/OpenBSD/3.3/mvme68k/INSTALL.mvme68k">
210: .../OpenBSD/3.3/mvme68k/INSTALL.mvme68k</a>
1.1 miod 211: </ul>
1.56 deraadt 212: </section>
213:
1.1 miod 214: <hr>
215:
1.54 bentley 216: <section id=quickinstall>
217:
1.1 miod 218: <p>
219: Quick installer information for people familiar with OpenBSD, and the
220: use of the "disklabel -E" command. If you are at all confused when
221: installing OpenBSD, read the relevant INSTALL.* file as listed above!
1.54 bentley 222:
223: <h3>OpenBSD/i386:</h3>
224:
1.1 miod 225: <p>
226: Play with your BIOS options to enable booting from a CD. The OpenBSD/i386
227: release is on CD1. If your BIOS does not support booting from CD, you will need
228: to create a boot floppy to install from. To create a boot floppy write
229: <i>CD1:3.3/i386/floppy33.fs</i> to a floppy and boot via the floppy drive.
230:
231: <p>
232: Use <i>CD1:3.3/i386/floppyB33.fs</i> instead for greater scsi controller
233: support, or <i>CD1:3.3/i386/floppyC33.fs</i> for better laptop support.
234:
235: <p>
236: If you are planning on dual booting OpenBSD with another OS, you will need to read the included INSTALL.i386 document.
237:
238: <p>
239: To make a boot floppy under MS-DOS, use the "rawrite" utility located
1.54 bentley 240: at <i>CD:/3.3/tools/rawrite.exe</i>. To make the boot floppy under a Unix OS, use the <a href="https://man.openbsd.org/dd.1">dd(1)</a> utility. The following is an example usage of <a href="https://man.openbsd.org/dd.1">dd(1)</a>, where the device could be "floppy", "rfd0c", or "rfd0a".
1.1 miod 241:
1.54 bentley 242: <blockquote><pre>
1.56 deraadt 243: # <kbd>dd if=<file> of=/dev/<device> bs=32k</kbd>
1.54 bentley 244: </pre></blockquote>
1.1 miod 245:
246: <p>
1.49 tj 247: Make sure you use properly formatted perfect floppies with NO BAD BLOCKS or your install will most likely fail. For more information on creating a boot floppy and installing OpenBSD/i386 please refer to <a href="faq/faq4.html#MkFlop">this page</a>.
1.54 bentley 248:
249: <h3>OpenBSD/macppc:</h3>
1.1 miod 250:
251: <p>
252: Put the CD2 in your CDROM drive and poweron your machine while holding down the
253: <i>C</i> key until the display turns on and shows <i>OpenBSD/macppc boot</i>.
254:
255: <p>
256: Alternatively, at the Open Firmware prompt, enter <i>boot cd:,ofwboot
257: /3.3/macppc/bsd.rd</i>
1.54 bentley 258:
259: <h3>OpenBSD/vax:</h3>
1.1 miod 260:
261: <p>
262: Boot over the network via mopbooting as described in INSTALL.vax.
1.54 bentley 263:
264: <h3>OpenBSD/sparc:</h3>
1.1 miod 265:
266: <p>
267: The 3.3 release of OpenBSD/sparc is located on CD3. To boot off of this CD you can use one of the two commands listed below, depending on the version of your ROM.
268:
1.54 bentley 269: <blockquote><pre>
270: > <kbd>boot cdrom 3.3/sparc/bsd.rd</kbd>
1.1 miod 271: or
1.54 bentley 272: > <kbd>b sd(0,6,0)3.3/sparc/bsd.rd</kbd>
273: </pre></blockquote>
1.1 miod 274:
275: <p>
276: If your sparc does not have a CD drive, you can alternatively boot from floppy.
1.49 tj 277: To do so you need to write "CD3:3.3/sparc/floppy33.fs" to a floppy. For more information see <a href="faq/faq4.html#MkFlop">this page</a>. To boot from the floppy use one of the two commands listed below, depending on the version of your ROM.
1.1 miod 278:
1.54 bentley 279: <blockquote><pre>
280: > <kbd>boot floppy</kbd>
1.1 miod 281: or
1.56 deraadt 282: > <kbd>boot fd()</kbd>
1.54 bentley 283: </pre></blockquote>
1.1 miod 284:
285: <p>
286: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.
287:
288: <p>
289: If your sparc doesn't have a floppy drive nor a CD drive, you can either
290: setup a bootable tape, or install via network, as told in the
291: INSTALL.sparc file.
1.54 bentley 292:
293: <h3>OpenBSD/sparc64:</h3>
1.1 miod 294:
295: <p>
296: Put the CD3 in your CDROM drive and type <i>boot cdrom</i>.
297:
298: <p>
299: If this doesn't work, or if you don't have a CDROM drive, you can write
300: <i>CD3:3.3/sparc64/floppy33.fs</i> to a floppy and boot it with <i>boot
301: floppy</i>.<br>
302: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.
303:
304: <p>
305: You can also write <i>CD3:3.3/sparc64/miniroot33.fs</i> to the swap partition on
306: the disk and boot with <i>boot disk:b</i>.
307:
308: <p>
309: If nothing works, you can boot over the network as described in INSTALL.sparc64
1.54 bentley 310:
311: <h3>OpenBSD/alpha:</h3>
1.1 miod 312:
313: <p>
1.56 deraadt 314: Write <i>3.3/alpha/floppy33.fs</i> or
315: <i>3.3/alpha/floppyB33.fs</i> (depending on your machine) to a diskette and
1.15 drahn 316: enter <i>boot dva0</i>. Refer to INSTALL.alpha for more details.
317:
318: <p>
319: Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.
320:
1.54 bentley 321: <h3>OpenBSD/hp300:</h3>
1.15 drahn 322:
323: <p>
324: Boot over the network by following the instructions in INSTALL.hp300.
325:
1.54 bentley 326: <h3>OpenBSD/hppa:</h3>
327:
1.28 miod 328: <p>
329: Boot over the network by following the instructions in INSTALL.hppa or the
330: <a href="hppa.html#netboot">hppa platform page</a>.
331:
1.54 bentley 332: <h3>OpenBSD/mac68k:</h3>
333:
1.15 drahn 334: <p>
335: Boot MacOS as normal and partition your disk with the appropriate A/UX
336: configurations. Then, extract the Macside utilities from
1.56 deraadt 337: <i>3.3/mac68k/utils</i> onto your hard disk. Run Mkfs to create your
1.15 drahn 338: filesystems on the A/UX partitions you just made. Then, use the
1.56 deraadt 339: "BSD/Mac68k Installer" to copy all the sets in <i>3.3/mac68k/</i> onto your
1.25 nick 340: partitions. Finally, you will be ready to configure the "BSD/Mac68k
341: Booter" with the location of your kernel and boot the system.
1.15 drahn 342:
1.54 bentley 343: <h3>OpenBSD/mvme68k:</h3>
344:
1.15 drahn 345: <p>
346: You can create a bootable installation tape or boot over the network.<br>
347: The network boot requires a MVME68K BUG version that supports the <i>NIOT</i>
348: and <i>NBO</i> debugger commands. Follow the instructions in INSTALL.mvme68k
349: for more details.
1.56 deraadt 350: </section>
1.54 bentley 351:
1.56 deraadt 352: <hr>
1.54 bentley 353:
354: <section id=sourcecode>
1.56 deraadt 355: <h3>Notes about the source code</h3>
1.15 drahn 356: <p>
1.58 ! deraadt 357: <code>src.tar.gz</code> contains a source archive starting at <code>/usr/src</code>.
! 358: This file contains everything you need except for the kernel sources, which are
1.1 miod 359: in a separate archive. To extract:
1.54 bentley 360:
361: <blockquote><pre>
362: # <kbd>mkdir -p /usr/src</kbd>
363: # <kbd>cd /usr/src</kbd>
364: # <kbd>tar xvfz /tmp/src.tar.gz</kbd>
365: </pre></blockquote>
366:
1.1 miod 367: <p>
1.58 ! deraadt 368: <code>sys.tar.gz</code> contains a source archive starting at <code>/usr/src/sys</code>.
1.1 miod 369: This file contains all the kernel sources you need to rebuild kernels.
370: To extract:
1.54 bentley 371:
372: <blockquote><pre>
373: # <kbd>mkdir -p /usr/src/sys</kbd>
374: # <kbd>cd /usr/src</kbd>
1.56 deraadt 375: # <kbd>tar xvfz /tmp/sys.tar.gz</kbd>
1.54 bentley 376: </pre></blockquote>
377:
1.1 miod 378: <p>
379: Both of these trees are a regular CVS checkout. Using these trees it
380: is possible to get a head-start on using the anoncvs servers as
1.18 deraadt 381: described <a href="anoncvs.html">here</a>.
1.1 miod 382: Using these files
383: results in a much faster initial CVS update than you could expect from
384: a fresh checkout of the full OpenBSD source tree.
1.54 bentley 385: </section>
386:
1.1 miod 387: <hr>
1.54 bentley 388:
389: <section id=ports>
390: <h3>Ports Tree</h3>
1.1 miod 391: <p>
392: A ports tree archive is also provided. To extract:
1.54 bentley 393: <blockquote><pre>
394: # <kbd>cd /usr</kbd>
395: # <kbd>tar xvfz /tmp/ports.tar.gz</kbd>
396: # <kbd>cd ports</kbd>
397: </pre></blockquote>
1.1 miod 398: <p>
399: The <i>ports/</i> subdirectory is a checkout of the OpenBSD ports tree. Go
1.34 jasper 400: read the <a href="faq/faq15.html">ports</a> page
1.1 miod 401: if you know nothing about ports
402: at this point. This text is not a manual of how to use ports.
403: Rather, it is a set of notes meant to kickstart the user on the
404: OpenBSD ports system.
405: <p>
406: Certainly, the OpenBSD ports system is not complete. It is doubtful it
407: will ever be. However, it is growing very fast and getting more stable.
408: Almost all ports provided with this release should build without problems
409: on most architectures (over 2000 packages build on i386, for instance).
410: <p>
1.47 tb 411: The <i>ports/</i> directory represents a CVS (see the manpage for
1.57 bentley 412: <a href="https://man.openbsd.org/cvs.1">cvs(1)</a> if
1.47 tb 413: you aren't familiar with CVS) checkout of our ports. As with our complete
1.1 miod 414: source tree, our ports tree is available via anoncvs. So, in
415: order to keep current with it, you must make the <i>ports/</i> tree
416: available on a read-write medium and update the tree with a command
417: like:
1.54 bentley 418: <blockquote><pre>
1.56 deraadt 419: # <kbd>cd [portsdir]/; cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_3_3</kbd>
1.54 bentley 420: </pre></blockquote>
1.1 miod 421: <p>
422: [Of course, you must replace the local directory and server name here
423: with the location of your ports collection and a nearby anoncvs
424: server.]
425: <p>
1.56 deraadt 426: Note that most ports are available as packages on our mirrors. Updated
1.1 miod 427: packages for the 3.3 release will be made available if problems arise.
428: <p>
429: If you're interested in seeing a port added, would like to help out, or just
1.56 deraadt 430: would like to know more, the mailing list
431: <a href="mail.html">ports@openbsd.org</a> is a good place to know.
1.54 bentley 432: </section>
![[BACK]](/icons/back.gif){kind=icon}
Return to 33.html CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / www