www/55.html - diff

<li>Support for CoreChip RD9700 USB Ethernet devices has been added to the <a href="https://man.openbsd.org/?query=udav&sektion=4">udav(4)</a> driver.

<li>Support for CoreChip RD9700 USB Ethernet devices has been added to the <a href="https://man.openbsd.org/udav.4">udav(4)</a> driver.

<li>Further reliability improvements regarding suspend/resume and hibernation.

<li>Enabled IPv6 transmit TCP/UDP checksum offload in

<a href="https://man.openbsd.org/?query=jme&sektion=4">jme(4)</a>.

<a href="https://man.openbsd.org/jme.4">jme(4)</a>.

</ul>

<p>

<li>Generic network stack improvements:

<ul>

<li>Added <a href="https://man.openbsd.org/?query=vxlan&sektion=4">vxlan(4)</a>,

<li>Added <a href="https://man.openbsd.org/vxlan.4">vxlan(4)</a>,

a virtual extensible local area network tunnel interface.

<li><a href="https://man.openbsd.org/?query=pflow&sektion=4">pflow(4)</a>

<li><a href="https://man.openbsd.org/pflow.4">pflow(4)</a>

now sends 64 bit time values for pflowproto 10. The changed templates /

flows for pflowproto 10 are now parsable by existing receivers.

<li>Continued improvement of the checksum offload framework to streamline

Line 221

Line 233

<li>Routing daemons and other userland network improvements:

<ul>

<li>The popa3d POP3 server has been removed.

<li>Added <a href="https://man.openbsd.org/?query=ntpctl&sektion=8">ntpctl(8)</a>,

<li>Added <a href="https://man.openbsd.org/ntpctl.8">ntpctl(8)</a>,

a program to control the Network Time Protocol daemon.

<li><a href="https://man.openbsd.org/?query=slowcgi&sektion=8">slowcgi(8)</a>

<li><a href="https://man.openbsd.org/slowcgi.8">slowcgi(8)</a>

now works with a high number of concurrent connections.

<li>The inetd-based identd has been replaced by a new libevent-based

<a href="https://man.openbsd.org/?query=identd&sektion=8">identd(8)</a>.

<a href="https://man.openbsd.org/identd.8">identd(8)</a>.

<li><a href="https://man.openbsd.org/?query=tcpdump&sektion=8">tcpdump(8)</a>

<li><a href="https://man.openbsd.org/tcpdump.8">tcpdump(8)</a>

can now detect bad ICMP and ICMPv6 checksums when used with the -v flag.

<li>Added rdomain support to IPv6 configuration tools

<a href="https://man.openbsd.org/?query=ndp&sektion=8">ndp(8)</a>,

<a href="https://man.openbsd.org/ndp.8">ndp(8)</a>,

<a href="https://man.openbsd.org/?query=rtsold&sektion=8">rtsold(8)</a>,

<a href="https://man.openbsd.org/rtsold.8">rtsold(8)</a>,

<a href="https://man.openbsd.org/?query=ping6&sektion=8">ping6(8)</a>, and

<a href="https://man.openbsd.org/ping6.8">ping6(8)</a>, and

<a href="https://man.openbsd.org/?query=traceroute6&sektion=8">traceroute6(8)</a>.

<a href="https://man.openbsd.org/traceroute6.8">traceroute6(8)</a>.

<li>Added SNMPv2 client support to

<a href="https://man.openbsd.org/?query=snmpctl&sektion=8">snmpctl(8)</a>

<a href="https://man.openbsd.org/snmpctl.8">snmpctl(8)</a>

("get", "walk", and "bulkwalk").

<li><a href="https://man.openbsd.org/?query=relayd&sektion=8">relayd(8)</a>

<li><a href="https://man.openbsd.org/relayd.8">relayd(8)</a>

now supports TLS Perfect Forward Secrecy (PFS) with ECDHE (Elliptic curve Diffie-Hellman) that is enabled by default.

</ul>

<p>

<li><a href="https://man.openbsd.org/?query=pf&sektion=4">pf(4)</a> improvements:

<li><a href="https://man.openbsd.org/pf.4">pf(4)</a> improvements:

<ul>

<li>New queueing system with new syntax.

<li>The "received-on" parameter can now be used with the "any" keyword to

match any existing interface except loopback ones.

<li>The block policy in the default <a href="https://man.openbsd.org/?query=pf.conf&sektion=5">pf.conf(5)</a> is now "block return".

<li>The block policy in the default <a href="https://man.openbsd.org/pf.conf.5">pf.conf(5)</a> is now "block return".

</ul>

<p>

<li><a href="https://man.openbsd.org/?query=dhcpd&sektion=8">dhcpd(8)</a> and <a href="https://man.openbsd.org/?query=dhclient&sektion=8">dhclient(8)</a> improvements:

<li><a href="https://man.openbsd.org/dhcpd.8">dhcpd(8)</a> and <a href="https://man.openbsd.org/dhclient.8">dhclient(8)</a> improvements:

<ul>

<li>No longer create a route to the bound address via 127.0.0.1.

<li>The options 'dhcp-lease-time', 'dhcp-rebinding-time', and 'dhcp-renewal-time' can now be configured in <a href="https://man.openbsd.org/?query=dhclient.conf&sektion=5">dhclient.conf(5)</a>.

<li>The options 'dhcp-lease-time', 'dhcp-rebinding-time', and 'dhcp-renewal-time' can now be configured in <a href="https://man.openbsd.org/dhclient.conf.5">dhclient.conf(5)</a>.

<li>'next-server' (a.k.a. siaddr) info now saved in lease files.

<li>Fall back to broadcasting when unicast renewal fails, as specified in

RFC 2131 and friends.

Line 265

Line 277

<li>Fix 'effective' lease created by '-L' to have correct address, 'next_server', 'timestamp', and 'resolv_conf' fields.

<li>Fix handling of non-printable characters in lease file strings.

<li>Fix many edge cases in config file and lease parsing and ensure that error messages refer to the correct position in erroneous line.

<li><a href="https://man.openbsd.org/?query=dhclient.conf&sektion=5">dhclient.conf(5)</a> can now override anything in an offer or saved lease when creating the effective lease. In particular, 'fixed-address', 'next-server', 'filename' and 'server-name'.

<li><a href="https://man.openbsd.org/dhclient.conf.5">dhclient.conf(5)</a> can now override anything in an offer or saved lease when creating the effective lease. In particular, 'fixed-address', 'next-server', 'filename' and 'server-name'.

<li>Fix parsing of <a href="https://man.openbsd.org/?query=dhclient.conf&sektion=5">dhclient.conf(5)</a> statements 'fixed-address' and

<li>Fix parsing of <a href="https://man.openbsd.org/dhclient.conf.5">dhclient.conf(5)</a> statements 'fixed-address' and

'next-server'.

<li>Log failures to fchmod() or fchown() files being written.

<li>Create lease files with permissions 0640.

<li>Fix possible failure to write <a href="https://man.openbsd.org/?query=resolv.conf&sektion=5">resolv.conf(5)</a> when -L is used.

<li>Fix possible failure to write <a href="https://man.openbsd.org/resolv.conf.5">resolv.conf(5)</a> when -L is used.

<li>'send dhcp-client-identifier "";' in <a href="https://man.openbsd.org/?query=dhclient.conf&sektion=5">dhclient.conf(5)</a> will result in no 'dhcp-client-identifier' (option 61) being sent.

<li>'send dhcp-client-identifier "";' in <a href="https://man.openbsd.org/dhclient.conf.5">dhclient.conf(5)</a> will result in no 'dhcp-client-identifier' (option 61) being sent.

</ul>

<p>

<li><a href="https://man.openbsd.org/?query=iked&sektion=8">iked(8)</a> improvements:

<li><a href="https://man.openbsd.org/iked.8">iked(8)</a> improvements:

<ul>

<li>Support for OCSP ("Online Certificate Status Protocol"); enable with "set ocsp <em>URL</em>".

<li>Support for RSA public key authentication as an alternative to X.509 certificates or pre-shared keys.

<li>Support for DPD ("Dead Peer Detection") similar to the implementation in

<a href="https://man.openbsd.org/?query=isakmpd&sektion=8">isakmpd(8)</a>.

<a href="https://man.openbsd.org/isakmpd.8">isakmpd(8)</a>.

<li>Support for dynamic IP address assignment from a pool in configuration mode; enabled with "config address <em>net/pool-prefix</em>".

<li>Initial support for IPComp.

<li>Various improvements and a thorough audit of the network input path.

Line 300

Line 312

<li>other processes now have an API to return more precise codes ...

<li>... which will be improved further with each version.

</ul>

<li>Improved <a href="https://man.openbsd.org/?query=smtpctl&sektion=8">smtpctl(8)</a>:

<li>Improved <a href="https://man.openbsd.org/smtpctl.8">smtpctl(8)</a>:

<ul>

<li>sendmail mode now supports DSN parameters

<li>Can now pause/resume a source address -> destination domain route.

Line 352

Line 364

</ul>

<li>Documentation:

<ul>

<li><a href="https://man.openbsd.org/?query=table&sektion=5">table(5)</a> describes format for static, file and db backends.

<li><a href="https://man.openbsd.org/table.5">table(5)</a> describes format for static, file and db backends.

<li>sendmail(8) describes our "sendmail" interface.

</ul>

<li>Reduced memory usage in both general and stressed cases.

<li>OpenSMTPD now automagically upgrades queue if the format changes!

<li>Support Qmail-like "sticky home".

<li>Support for authenticating users from a credentials table.

<li>Introduce <a href="https://man.openbsd.org/?query=passwd&sektion=5">passwd(5)</a> table backend for user and credentials lookup.

<li>Introduce <a href="https://man.openbsd.org/passwd.5">passwd(5)</a> table backend for user and credentials lookup.

<li>Expansion variables in ~/.forward now support modifiers.

<li>Much more efficient scheduler!

<li>Many documentation fixes and improvements.

Line 370

Line 382

<li>Security improvements:

<ul>

<li>Position-independent executables (PIE) are now used by default on i386.

<li>The <a href="https://man.openbsd.org/?query=arc4random&sektion=3">arc4random(3)</a>

<li>The <a href="https://man.openbsd.org/arc4random.3">arc4random(3)</a>

functions now use the ChaCha20 cipher.

<li>The kernel random number system is initially seeded by the bootloader,

providing better random very early.

<li>Kernel stack protector is also seeded via the same mechanism, providing

protection earlier.

<li>-Wbounded is now enabled in GCC by default.

<li>Added <a href="https://man.openbsd.org/?query=explicit_bzero&sektion=3">explicit_bzero(3)</a>.

<li>Added <a href="https://man.openbsd.org/explicit_bzero.3">explicit_bzero(3)</a>.

</ul>

<p>

Line 389

Line 401

<li>Threading improvements:

<ul>

<li>Interprocess semaphores via <a href="https://man.openbsd.org/?query=sem_open&sektion=3">sem_open(3)</a>.

<li>Interprocess semaphores via <a href="https://man.openbsd.org/sem_open.3">sem_open(3)</a>.

<li>Running threaded processes under a debugger no longer causes panics.

<li>SIGPROF and SIGVTALRM are now reliably delivered to the thread that was running when they were triggered.

<li>Thread stacks now have a random bias.

<li><a href="https://man.openbsd.org/?query=fork&sektion=2">fork(2)</a> no longer changes the pthread_t of the forking thread in the child.

<li><a href="https://man.openbsd.org/fork.2">fork(2)</a> no longer changes the pthread_t of the forking thread in the child.

<li>Signaling races eliminated from <a href="https://man.openbsd.org/?query=pthread_kill&sektion=3">pthread_kill(3)</a> and <a href="https://man.openbsd.org/?query=pthread_cancel&sektion=3">pthread_cancel(3)</a>.

<li>Signaling races eliminated from <a href="https://man.openbsd.org/pthread_kill.3">pthread_kill(3)</a> and <a href="https://man.openbsd.org/pthread_cancel.3">pthread_cancel(3)</a>.

</ul>

<p>

<li>Assorted improvements:

<ul>

<li>New in-memory file system, <a href="https://man.openbsd.org/?query=mount_tmpfs&sektion=8">tmpfs</a>.

<li>New in-memory file system, <a href="https://man.openbsd.org/mount_tmpfs.8">tmpfs</a>.

<li>Many <a href="https://man.openbsd.org/?query=fuse&sektion=4">fuse(4)</a> improvements and stability fixes.

<li>Many <a href="https://man.openbsd.org/fuse.4">fuse(4)</a> improvements and stability fixes.

<li>Added POSIX-required <a href="https://man.openbsd.org/?query=nl&sektion=1">nl(1)</a> utility.

<li>Added POSIX-required <a href="https://man.openbsd.org/nl.1">nl(1)</a> utility.

<li>OpenBSD/vax has switched to GCC 3.

<li>Replaced <a href="https://man.openbsd.org/?query=getdirentries&sektion=2&manpath=OpenBSD+5.4">getdirentries(2)</a> with <a href="https://man.openbsd.org/?query=getdents&sektion=2">getdents(2)</a>, vastly improving the performance and memory usage of <a href="https://man.openbsd.org/?query=telldir&sektion=3">telldir(3)</a>.

<li>Replaced <a href="https://man.openbsd.org/OpenBSD+5.4/getdirentries.2">getdirentries(2)</a> with <a href="https://man.openbsd.org/getdents.2">getdents(2)</a>, vastly improving the performance and memory usage of <a href="https://man.openbsd.org/telldir.3">telldir(3)</a>.

<li>amd64 and i386 now use the MWAIT instruction for their idle loop where available to reduce latency.

<li>Added support for CLOCK_UPTIME.

<li>Added <a href="https://man.openbsd.org/?query=tcgetsid&sektion=3">tcgetsid(3)</a>.

<li>Added <a href="https://man.openbsd.org/tcgetsid.3">tcgetsid(3)</a>.

<li>clock_t is now a 64 bit type, so it no longer wraps around in only 248 days.

<li>ino_t is now a 64 bit type, mostly to support large NFS filesystems.

<li>Corrected handling of UTIME_OMIT.

<li><a href="https://man.openbsd.org/?query=pax&sektion=1">pax(1)</a> now sets the mode and timestamps correctly on symlinks, and makes hardlinks to symlinks when requested.

<li><a href="https://man.openbsd.org/pax.1">pax(1)</a> now sets the mode and timestamps correctly on symlinks, and makes hardlinks to symlinks when requested.

<li>Corrected handling of shared library destructors when libc is statically linked.

<li>Corrected various disk drivers to handle non-512-byte sectors and disk sizes greater than 32-bits.

<li>Corrected <a href="https://man.openbsd.org/?query=growfs&sektion=8">growfs(8)</a> to handle non-512-byte sectors and disk sizes greater than 32-bits.

<li>Corrected <a href="https://man.openbsd.org/growfs.8">growfs(8)</a> to handle non-512-byte sectors and disk sizes greater than 32-bits.

<li>All CIRCLEQ uses replaced with TAILQ.

<li>Preserve and honour changes to the OpenBSD bounds in a disklabel.

<li><a href="https://man.openbsd.org/?query=fdisk&sektion=8">fdisk(8)</a> now always writes a good signature when the MBR is written to disk.

<li><a href="https://man.openbsd.org/fdisk.8">fdisk(8)</a> now always writes a good signature when the MBR is written to disk.

<li><a href="https://man.openbsd.org/?query=disklabel&sektion=8">disklabel(8)</a> now writes the disklabel to the correct location on non-512-byte sector devices.

<li><a href="https://man.openbsd.org/disklabel.8">disklabel(8)</a> now writes the disklabel to the correct location on non-512-byte sector devices.

<li>Fix <a href="https://man.openbsd.org/?query=athn&sektion=4">athn(4)</a> tick calculations to eliminate excessive timeouts.

<li>Fix <a href="https://man.openbsd.org/athn.4">athn(4)</a> tick calculations to eliminate excessive timeouts.

<li>Allow <a href="https://man.openbsd.org/?query=disklabel&sektion=8">disklabel(8)</a> to set any partition, including 'C', to type UNUSED.

<li>Allow <a href="https://man.openbsd.org/disklabel.8">disklabel(8)</a> to set any partition, including 'C', to type UNUSED.

<li>New <a href="https://man.openbsd.org/?query=sha512&sektion=1">sha512(1)</a> tool to calculate and verify the SHA-512 checksums of files.

<li>New <a href="https://man.openbsd.org/sha512.1">sha512(1)</a> tool to calculate and verify the SHA-512 checksums of files.

<li><a href="https://man.openbsd.org/?query=sha256&sektion=1">sha256(1)</a> and related tools

<li><a href="https://man.openbsd.org/sha256.1">sha256(1)</a> and related tools

(<a href="https://man.openbsd.org/?query=cksum&sektion=1">cksum(1)</a>,

(<a href="https://man.openbsd.org/cksum.1">cksum(1)</a>,

<a href="https://man.openbsd.org/?query=md5&sektion=1">md5(1)</a>,

<a href="https://man.openbsd.org/md5.1">md5(1)</a>,

<a href="https://man.openbsd.org/?query=sha1&sektion=1">sha1(1)</a>, and

<a href="https://man.openbsd.org/sha1.1">sha1(1)</a>, and

<a href="https://man.openbsd.org/?query=sha512&sektion=1">sha512(1)</a>)

<a href="https://man.openbsd.org/sha512.1">sha512(1)</a>)

now support a new -h flag to place the checksum into a specified hash file instead of stdout.

<li><a href="https://man.openbsd.org/?query=sha256&sektion=1">sha256(1)</a> and related tools now support a new -C flag that allows the verification of selected files in a checklist.

<li><a href="https://man.openbsd.org/sha256.1">sha256(1)</a> and related tools now support a new -C flag that allows the verification of selected files in a checklist.

<li><a href="https://man.openbsd.org/?query=sha256&sektion=1">sha256(1)</a> and related tools will now print MISSING if they encounter non-existent files in a checklist.

<li><a href="https://man.openbsd.org/sha256.1">sha256(1)</a> and related tools will now print MISSING if they encounter non-existent files in a checklist.

<li>i386 and amd64 platforms can now boot from keydisk-based <a href="https://man.openbsd.org/?query=softraid&sektion=4">softraid(4)</a> crypto volumes.

<li>i386 and amd64 platforms can now boot from keydisk-based <a href="https://man.openbsd.org/softraid.4">softraid(4)</a> crypto volumes.

<li>Allow <a href="https://man.openbsd.org/?query=softraid&sektion=4">softraid(4)</a> to work with partitions larger than 2TB.

<li>Allow <a href="https://man.openbsd.org/softraid.4">softraid(4)</a> to work with partitions larger than 2TB.

<li>Removed experimental RAID 4 support from <a href="https://man.openbsd.org/?query=softraid&sektion=4">softraid(4)</a>.

<li>Removed experimental RAID 4 support from <a href="https://man.openbsd.org/softraid.4">softraid(4)</a>.

<li>Added experimental support for rebuilding RAID 5 <a href="https://man.openbsd.org/?query=softraid&sektion=4">softraid(4)</a> volumes. Lots of testing is still required and there is missing functionality, such as the ability to resume a partially completed rebuild. <a href="https://man.openbsd.org/?query=bioctl&sektion=8">bioctl(8)</a> refuses to create RAID 5 volumes unless recompiled with -DRAID5.

<li>Added experimental support for rebuilding RAID 5 <a href="https://man.openbsd.org/softraid.4">softraid(4)</a> volumes. Lots of testing is still required and there is missing functionality, such as the ability to resume a partially completed rebuild. <a href="https://man.openbsd.org/bioctl.8">bioctl(8)</a> refuses to create RAID 5 volumes unless recompiled with -DRAID5.

<li>The uhts(4) driver has been merged into

<a href="https://man.openbsd.org/?query=ums&sektion=4">ums(4)</a>.

<a href="https://man.openbsd.org/ums.4">ums(4)</a>.

<li>Many new checks were added to portcheck(1)  utility; now it catches almost every popular mistake that observed in ports in last years.

</ul>

<p>

Line 444

Line 456

<ul>

<li>Security:

<ul>

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

when using environment passing with a

<a href="https://man.openbsd.org/?query=sshd_config&sektion=5">sshd_config(5)</a>

<a href="https://man.openbsd.org/sshd_config.5">sshd_config(5)</a>

<tt>AcceptEnv</tt> pattern with a wildcard. OpenSSH prior to 6.6 could

<code>AcceptEnv</code> pattern with a wildcard. OpenSSH prior to 6.6 could

be tricked into accepting any enviornment variable that contains the

characters before the wildcard character.

</ul>

<li>New/changed features:

<ul>

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,

<a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

Add support for key exchange using <i>elliptic-curve Diffie Hellman</i>

in Daniel Bernstein's <i>Curve25519</i>. This key exchange method is

the default when both the client and server support it.

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,

<a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

Add support for <i>ED25519</i> as a public key type. ED25519 is

a elliptic curve signature scheme that offers better security than

<i>ECDSA</i> and <i>DSA</i> and good performance. It may be used for

Line 467

Line 479

<li>Add a new private key format that uses a <i>bcrypt KDF</i> to better

protect keys at rest. This format is used unconditionally for

ED25519 keys, but may be requested when generating or saving

existing keys of other types via the <tt>-o</tt>

existing keys of other types via the <code>-o</code>

<a href="https://man.openbsd.org/?query=ssh-keygen&sektion=1">ssh-keygen(1)</a>

<a href="https://man.openbsd.org/ssh-keygen.1">ssh-keygen(1)</a>

option. We intend to make the new format the default in the near

future. Details of the new format are in the <tt>PROTOCOL.key</tt>

future. Details of the new format are in the <code>PROTOCOL.key</code>

file.

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,

<a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

Add a new transport cipher "chacha20-poly1305@openssh.com" that

combines Daniel Bernstein's <i>ChaCha20</i> stream cipher and

<i>Poly1305 MAC</i> to build an authenticated encryption mode. Details

are in the <tt>PROTOCOL.chacha20poly1305</tt> file.

are in the <code>PROTOCOL.chacha20poly1305</code> file.

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,

<a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

Refuse <i>RSA</i> keys from old proprietary clients and servers that

use the obsolete <i>RSA+MD5</i> signature scheme. It will still be

possible to connect with these clients/servers but <b>only DSA keys

will be accepted, and OpenSSH will refuse connection entirely in a

future release</b>.

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,

<a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

Refuse old proprietary clients and servers that use a weaker key

exchange hash calculation.

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:

Increase the size of the <i>Diffie-Hellman groups</i> requested for

each symmetric key size. New values from <i>NIST Special Publication

800-57</i> with the upper limit specified by <i>RFC 4419</i>.

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,

<a href="https://man.openbsd.org/?query=ssh-agent&sektion=1">ssh-agent(1)</a>:

<a href="https://man.openbsd.org/ssh-agent.1">ssh-agent(1)</a>:

Support <i>PKCS#11</i> tokens that only provide <i>X.509</i> certs

instead of raw public keys. (requested as bz#1908)

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:

Add a

<a href="https://man.openbsd.org/?query=ssh_config&sektion=5">ssh_config(5)</a>

<a href="https://man.openbsd.org/ssh_config.5">ssh_config(5)</a>

<tt>Match</tt> keyword that allows conditional configuration to be

<code>Match</code> keyword that allows conditional configuration to be

applied by matching on <i>hostname</i>, <i>user</i> and <i>result of

arbitrary commands</i>.

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:

Add support for <i>client-side hostname canonicalisation</i> using a

set of <i>DNS suffixes</i> and rules in

<a href="https://man.openbsd.org/?query=ssh_config&sektion=5">ssh_config(5)</a>.

<a href="https://man.openbsd.org/ssh_config.5">ssh_config(5)</a>.

This allows unqualified names to be canonicalised to fully-qualified

domain names to eliminate ambiguity when looking up keys in

<tt>known_hosts</tt> or checking host certificate names.

<code>known_hosts</code> or checking host certificate names.

<li><a href="https://man.openbsd.org/?query=sftp-server&sektion=8">sftp-server(8)</a>:

<li><a href="https://man.openbsd.org/sftp-server.8">sftp-server(8)</a>:

Add the ability to whitelist and/or blacklist sftp protocol requests by

name.

<li><a href="https://man.openbsd.org/?query=sftp-server&sektion=8">sftp-server(8)</a>:

<li><a href="https://man.openbsd.org/sftp-server.8">sftp-server(8)</a>:

Add a sftp "fsync@openssh.com" to support calling

<a href="https://man.openbsd.org/?query=fsync&sektion=2">fsync(2)</a>

<a href="https://man.openbsd.org/fsync.2">fsync(2)</a>

on an open file handle.

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

Add a

<a href="https://man.openbsd.org/?query=ssh_config&sektion=5">ssh_config(5)</a>

<a href="https://man.openbsd.org/ssh_config.5">ssh_config(5)</a>

<tt>PermitTTY</tt> to disallow <i>TTY</i> allocation, mirroring the

<code>PermitTTY</code> to disallow <i>TTY</i> allocation, mirroring the

longstanding <tt>no-pty</tt> <tt>authorized_keys</tt> option.

longstanding <code>no-pty</code> <code>authorized_keys</code> option.

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:

Add a

<a href="https://man.openbsd.org/?query=ssh_config&sektion=5">ssh_config(5)</a>

<a href="https://man.openbsd.org/ssh_config.5">ssh_config(5)</a>

<tt>ProxyUseFDPass</tt> option that supports the use of

<code>ProxyUseFDPass</code> option that supports the use of

<tt>ProxyCommands</tt> that establish a connection and then pass a

<code>ProxyCommands</code> that establish a connection and then pass a

connected file descriptor back to

<a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>.

<a href="https://man.openbsd.org/ssh.1">ssh(1)</a>.

This allows the <tt>ProxyCommand</tt> to exit rather than staying

This allows the <code>ProxyCommand</code> to exit rather than staying

around to transfer data.

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,

<a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

this release removes the <i>J-PAKE</i> authentication code. This code

was experimental, never enabled and had been unmaintained for some

time.

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:

when processing <tt>Match</tt> blocks, skip '<tt>exec</tt>' clauses

when processing <code>Match</code> blocks, skip '<code>exec</code>' clauses

other clauses predicates failed to match.

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:

if hostname canonicalisation is enabled and results in the destination

hostname being changed, then re-parse

<a href="https://man.openbsd.org/?query=ssh_config&sektion=5">ssh_config(5)</a>

<a href="https://man.openbsd.org/ssh_config.5">ssh_config(5)</a>

files using the new destination hostname. This gives '<tt>Host</tt>'

files using the new destination hostname. This gives '<code>Host</code>'

and '<tt>Match</tt>' directives that use the expanded hostname a chance

and '<code>Match</code>' directives that use the expanded hostname a chance

to be applied.

</ul>

<li>The following significant bugs have been fixed in this release:

<ul>

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,

<a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

Fix potential stack exhaustion caused by nested certificates.

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:

make <tt>BindAddress</tt> work with <tt>UsePrivilegedPort</tt>.

make <code>BindAddress</code> work with <code>UsePrivilegedPort</code>.

(bz#1211)

<li><a href="https://man.openbsd.org/?query=sftp&sektion=1">sftp(1)</a>:

<li><a href="https://man.openbsd.org/sftp.1">sftp(1)</a>:

fix the progress meter for resumed transfer. (bz#2137)

<li><a href="https://man.openbsd.org/?query=ssh-add&sektion=1">ssh-add(1)</a>:

<li><a href="https://man.openbsd.org/ssh-add.1">ssh-add(1)</a>:

do not request smartcard PIN when removing keys from

<a href="https://man.openbsd.org/?query=ssh-agent&sektion=1">ssh-agent(1)</a>.

<a href="https://man.openbsd.org/ssh-agent.1">ssh-agent(1)</a>.

(bz#2187)

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

fix re-exec fallback when original

binary cannot be executed. (bz#2139)

<li><a href="https://man.openbsd.org/?query=ssh-keygen&sektion=1">ssh-keygen(1)</a>:

<li><a href="https://man.openbsd.org/ssh-keygen.1">ssh-keygen(1)</a>:

Make relative-specified certificate expiry times relative to current

time and not the validity start time.

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

fix <tt>AuthorizedKeysCommand</tt> inside a <tt>Match</tt> block.

fix <code>AuthorizedKeysCommand</code> inside a <code>Match</code> block.

(bz#2161)

<li><a href="https://man.openbsd.org/?query=sftp&sektion=1">sftp(1)</a>:

<li><a href="https://man.openbsd.org/sftp.1">sftp(1)</a>:

symlinking a file would incorrectly canonicalise the target path.

(bz#2129)

<li><a href="https://man.openbsd.org/?query=ssh-agent&sektion=1">ssh-agent(1)</a>:

<li><a href="https://man.openbsd.org/ssh-agent.1">ssh-agent(1)</a>:

fix a use-after-free in the PKCS#11 agent helper executable.

(bz#2175)

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

Improve logging of sessions to include the <i>user name</i>, <i>remote

host</i> and <i>port</i>, the <i>session type</i> (shell, command,

etc.) and <i>allocated TTY</i> (if any).

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

tell the client (via a debug message) when their preferred listen

address has been overridden by the server's <tt>GatewayPorts</tt>

address has been overridden by the server's <code>GatewayPorts</code>

setting. (bz#1297)

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

include report port in bad protocol banner message. (bz#2162)

<li><a href="https://man.openbsd.org/?query=sftp&sektion=1">sftp(1)</a>:

<li><a href="https://man.openbsd.org/sftp.1">sftp(1)</a>:

fix memory leak in error path in <i>do_readdir()</i>. (bz#2163)

<li><a href="https://man.openbsd.org/?query=sftp&sektion=1">sftp(1)</a>:

<li><a href="https://man.openbsd.org/sftp.1">sftp(1)</a>:

don't leak file descriptor on error. (bz#2171)

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

include the <i>local address</i> and <i>port</i> in

"<tt>Connection from ...</tt>" message.

"<code>Connection from ...</code>" message.

(only shown at <i>loglevel>=verbose</i>)

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:

avoid spurious "<tt>getsockname failed: Bad file descriptor</tt>" in

avoid spurious "<code>getsockname failed: Bad file descriptor</code>" in

<tt>ssh -W</tt>. (bz#2200, debian#738692)

<code>ssh -W</code>. (bz#2200, debian#738692)

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

allow the

<a href="https://man.openbsd.org/?query=shutdown&sektion=2">shutdown(2)</a>

<a href="https://man.openbsd.org/shutdown.2">shutdown(2)</a>

syscall in seccomp-bpf and systrace sandbox modes, as it is reachable

if the connection is terminated during the pre-auth phase.

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,

<a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

fix unsigned overflow that in <i>SSH protocol 1 bignum parsing</i>.

Minimum key length checks render this bug unexploitable to compromise

SSH 1 sessions.

<li><a href="https://man.openbsd.org/?query=sshd_config&sektion=5">sshd_config(5)</a>

<li><a href="https://man.openbsd.org/sshd_config.5">sshd_config(5)</a>

clarify behaviour of a keyword that appears in multiple matching

<tt>Match</tt> blocks. (bz#2184)

<code>Match</code> blocks. (bz#2184)

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:

avoid unnecessary hostname lookups when canonicalisation is disabled.

(bz#2205)

<li><a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<li><a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

avoid sandbox violation crashes in GSSAPI code by caching the supported

list of GSSAPI mechanism OIDs before entering the sandbox. (bz#2107)

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:

fix possible crashes in SOCKS4 parsing caused by assumption that the

SOCKS username is nul-terminated.

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:

fix regression for <tt>UsePrivilegedPort=yes</tt> when

fix regression for <code>UsePrivilegedPort=yes</code> when

<tt>BindAddress</tt> is not specified.

<code>BindAddress</code> is not specified.

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>,

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>,

<a href="https://man.openbsd.org/?query=sshd&sektion=8">sshd(8)</a>:

<a href="https://man.openbsd.org/sshd.8">sshd(8)</a>:

fix memory leak in ECDSA signature verification.

<li><a href="https://man.openbsd.org/?query=ssh&sektion=1">ssh(1)</a>:

<li><a href="https://man.openbsd.org/ssh.1">ssh(1)</a>:

fix matching of '<tt>Host</tt>' directives in

fix matching of '<code>Host</code>' directives in

<a href="https://man.openbsd.org/?query=ssh_config&sektion=5">ssh_config(5)</a>

<a href="https://man.openbsd.org/ssh_config.5">ssh_config(5)</a>

files to be case-insensitive again. (regression in 6.5)

</ul>

Line 638

Line 650

<ul>

<li>Over 8,700 ports.

<li>Major overhaul of the package tools, resulting in much better memory usage.

<li><a href="https://man.openbsd.org/?query=pkg_add&sektion=1">pkg_add(1)</a> now only trusts signed packages by default.

<li><a href="https://man.openbsd.org/pkg_add.1">pkg_add(1)</a> now only trusts signed packages by default.

<li>The build process now allows some limited capability for building

conflicting packages, yielding KDE 4 packages as a result, along

with KDE 3 ones.

</ul>

<p>

<li>Many pre-built packages for each architecture:

<tr>

<ul>

<li>i386: 8468

<li>sparc64: 7969

<li>alpha: 6199

<li>m68k: 3270

</ul></td><td valign=top width="25%"><ul>

<li>sh: 345

<li>amd64: 8534

<li>powerpc: 8057

<li>m88k: 1258

</ul></td><td valign=top width="25%"><ul>

<li>sparc: 4681

<li>arm: 6181

<li>hppa: 6549

</ul></td><td valign=top width="25%"><ul>

<li>vax: 1007

<li>mips64: 4726

<li>mips64el: 6730

</ul></td></tr></table>

</ul>

<p>

<li>Some highlights:

Line 715

Line 721

<li>Less 444 (+ patches)

<li>Awk Aug 10, 2011 version

</ul>

</section>

<hr>

<h3>How to install</h3>

<p>

<h3><font color="#0000e0">How to install</font></h3>

<p>

Following this are the instructions which you would have on a piece of

paper if you had purchased a CDROM set instead of doing an alternate

form of install. The instructions for doing an FTP (or other style

Line 792

Line 799

</ul>

<hr>

<p>

Quick installer information for people familiar with OpenBSD, and the

use of the "disklabel -E" command. If you are at all confused when

installing OpenBSD, read the relevant INSTALL.* file as listed above!

<p>

<h3><font color="#e00000">OpenBSD/i386:</font></h3>

<h3>OpenBSD/i386:</h3>

<ul>

<p>

Play with your BIOS options to enable booting from a CD. The OpenBSD/i386

release is on CD1. If your BIOS does not support booting from CD, you will need

to create a boot floppy to install from. To create a boot floppy write

Line 826

Line 835

To make a boot floppy under MS-DOS, use the "rawrite" utility located

at <i>CD1:5.5/tools/rawrite.exe</i>. To make the boot floppy under a Unix OS,

use the

utility. The following is an example usage of

<a href="https://man.openbsd.org/?query=dd&sektion=1">dd(1)</a>,

<a href="https://man.openbsd.org/dd.1">dd(1)</a>,

where the device could be "floppy", "rfd0c", or

"rfd0a".

# <strong>dd if=<file> of=/dev/<device> bs=32k</strong>

</pre></ul>

</pre></blockquote>

<p>

Make sure you use properly formatted perfect floppies with NO BAD BLOCKS or

your install will most likely fail. For more information on creating a boot

floppy and installing OpenBSD/i386 please refer to

<a href="faq/faq4.html#MkFlop">this page</a>.

</ul>

<h3>OpenBSD/amd64:</h3>

<p>

<h3><font color="#e00000">OpenBSD/amd64:</font></h3>

<ul>

The 5.5 release of OpenBSD/amd64 is located on CD2.

Boot from the CD to begin the install - you may need to adjust

your BIOS options first.

Line 865

Line 873

<p>

If you are planning to dual boot OpenBSD with another OS, you will need to

read INSTALL.amd64.

</ul>

<h3>OpenBSD/macppc:</h3>

<p>

<h3><font color="#e00000">OpenBSD/macppc:</font></h3>

<ul>

Burn the image from the FTP site to a CDROM, and power on your machine

while holding down the <i>C</i> key until the display turns on and

shows <i>OpenBSD/macppc boot</i>.

Line 877

Line 884

<p>

Alternatively, at the Open Firmware prompt, enter <i>boot cd:,ofwboot

/5.5/macppc/bsd.rd</i>

</ul>

<h3>OpenBSD/sparc64:</h3>

<p>

<h3><font color="#e00000">OpenBSD/sparc64:</font></h3>

<ul>

Put CD3 in your CDROM drive and type <i>boot cdrom</i>.

<p>

Line 900

Line 906

<p>

If nothing works, you can boot over the network as described in INSTALL.sparc64.

</ul>

<h3>OpenBSD/alpha:</h3>

<p>

<h3><font color="#e00000">OpenBSD/alpha:</font></h3>

Write <i>FTP:5.5/alpha/floppy55.fs</i> or

<ul>

<p>Write <i>FTP:5.5/alpha/floppy55.fs</i> or

<i>FTP:5.5/alpha/floppyB55.fs</i> (depending on your machine) to a diskette and

enter <i>boot dva0</i>. Refer to INSTALL.alpha for more details.

Line 913

Line 918

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install

will most likely fail.

</ul>

<h3>OpenBSD/armish:</h3>

<p>

<h3><font color="#e00000">OpenBSD/armish:</font></h3>

<ul>

<p>

After connecting a serial port, Thecus can boot directly from the network

either tftp or http. Configure the network using fconfig, reset,

then load bsd.rd, see INSTALL.armish for specific details.

Line 926

Line 928

and copy 'boot' and bsd.rd into the first partition on wd0 (hda1)

then load and run bsd.rd, preserving the wd0i (hda1) ext2fs partition.

More details are available in INSTALL.armish.

</ul>

<h3>OpenBSD/hp300:</h3>

<p>

<h3><font color="#e00000">OpenBSD/hp300:</font></h3>

<ul>

<p>

Boot over the network by following the instructions in INSTALL.hp300.

</ul>

<h3>OpenBSD/hppa:</h3>

<p>

<h3><font color="#e00000">OpenBSD/hppa:</font></h3>

<ul>

<p>

Boot over the network by following the instructions in INSTALL.hppa or the

<a href="hppa.html#install">hppa platform page</a>.

</ul>

<h3>OpenBSD/landisk:</h3>

<p>

<h3><font color="#e00000">OpenBSD/landisk:</font></h3>

<ul>

<p>

Write <i>miniroot55.fs</i> to the start of the CF

or disk, and boot normally.

</ul>

<h3>OpenBSD/loongson:</h3>

<p>

<h3><font color="#e00000">OpenBSD/loongson:</font></h3>

<ul>

<p>

Write <i>miniroot55.fs</i> to a USB stick and boot bsd.rd from it

or boot bsd.rd via tftp.

Refer to the instructions in INSTALL.loongson for more details.

</ul>

<p>

<h3>OpenBSD/luna88k:</h3>

<p>

<h3><font color="#e00000">OpenBSD/luna88k:</font></h3>

Copy 'boot' and 'bsd.rd' to a Mach or UniOS partition, and boot the bootloader

<ul>

<p>

Copy `boot' and `bsd.rd' to a Mach or UniOS partition, and boot the bootloader

from the PROM, and the bsd.rd from the bootloader.

Refer to the instructions in INSTALL.luna88k for more details.

</ul>

<h3>OpenBSD/mvme68k:</h3>

<p>

<h3><font color="#e00000">OpenBSD/mvme68k:</font></h3>

<ul>

<p>

You can create a bootable installation tape or boot over the network.<br>

The network boot requires a MVME68K BUG version that supports the <i>NIOT</i>

and <i>NBO</i> debugger commands. Follow the instructions in INSTALL.mvme68k

for more details.

</ul>

<h3>OpenBSD/mvme88k:</h3>

<p>

<h3><font color="#e00000">OpenBSD/mvme88k:</font></h3>

<ul>

<p>

You can create a bootable installation tape or boot over the network.<br>

The network boot requires a MVME88K BUG version that supports the <i>NIOT</i>

and <i>NBO</i> debugger commands. Follow the instructions in INSTALL.mvme88k

for more details.

</ul>

<h3>OpenBSD/octeon:</h3>

<p>

<h3><font color="#e00000">OpenBSD/octeon:</font></h3>

<ul>

<p>

After connecting a serial port, boot bsd.rd over the network via DHCP/tftp.

Refer to the instructions in INSTALL.octeon for more details.

</ul>

<h3>OpenBSD/sgi:</h3>

<p>

<h3><font color="#e00000">OpenBSD/sgi:</font></h3>

<ul>

<p>

To install, burn cd55.iso on a CD-R, put it in the CD drive of your

machine and select <i>Install System Software</i> from the System Maintenance

menu. Indigo/Indy/Indigo2 (R4000) systems will not boot automatically from

Line 1012

Line 995

If your machine doesn't have a CD drive, you can setup a DHCP/tftp network

server, and boot using "bootp()/bsd.rd.IP##" using the kernel matching your

system type. Refer to the instructions in INSTALL.sgi for more details.

</ul>

<h3>OpenBSD/socppc:</h3>

<p>

<h3><font color="#e00000">OpenBSD/socppc:</font></h3>

<ul>

<p>

After connecting a serial port, boot over the network via DHCP/tftp.

Refer to the instructions in INSTALL.socppc for more details.

</ul>

<h3>OpenBSD/sparc:</h3>

<p>

<h3><font color="#e00000">OpenBSD/sparc:</font></h3>

<ul>

Boot from one of the provided install ISO images, using one of the two

commands listed below, depending on the version of your ROM.

ok <strong>boot cdrom 5.5/sparc/bsd.rd</strong>

ok <kbd>boot cdrom 5.5/sparc/bsd.rd</kbd>

> <strong>b sd(0,6,0)5.5/sparc/bsd.rd</strong>

> <kbd>b sd(0,6,0)5.5/sparc/bsd.rd</kbd>

</pre></ul>

</pre></blockquote>

<p>

If your SPARC system does not have a CD drive, you can alternatively boot from floppy.

Line 1041

Line 1021

To boot from the floppy use one of the two commands listed below,

depending on the version of your ROM.

ok <strong>boot floppy</strong>

ok <kbd>boot floppy</kbd>

> <strong>b fd()</strong>

> <kbd>b fd()</kbd>

</pre></ul>

</pre></blockquote>

<p>

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install

Line 1055

Line 1035

If your SPARC system doesn't have a floppy drive nor a CD drive, you can either

setup a bootable tape, or install via network, as told in the

INSTALL.sparc file.

</ul>

<h3>OpenBSD/vax:</h3>

<p>

<h3><font color="#e00000">OpenBSD/vax:</font></h3>

<ul>

Boot over the network via mopbooting as described in INSTALL.vax.

</ul>

<h3>OpenBSD/zaurus:</h3>

<p>

<h3><font color="#e00000">OpenBSD/zaurus:</font></h3>

<ul>

<p>

Using the Linux built-in graphical ipkg installer, install the

openbsd55_arm.ipk package. Reboot, then run it. Read INSTALL.zaurus

for a few important details.

</ul>

</section>

<h3>Notes about the source code:</h3>

<p>

<h3><font color="#e00000">Notes about the source code:</font></h3>

<ul>

src.tar.gz contains a source archive starting at /usr/src. This file

contains everything you need except for the kernel sources, which are

in a separate archive. To extract:

# <kbd>mkdir -p /usr/src</kbd>

# <kbd>cd /usr/src</kbd>

# <kbd>tar xvfz /tmp/src.tar.gz</kbd>

</pre></blockquote>

<p>

# <strong>mkdir -p /usr/src</strong>

# <strong>cd /usr/src</strong>

# <strong>tar xvfz /tmp/src.tar.gz</strong>

</pre></ul>

<p>

sys.tar.gz contains a source archive starting at /usr/src/sys.

This file contains all the kernel sources you need to rebuild kernels.

To extract:

<p>

# <strong>mkdir -p /usr/src/sys</strong>

# <kbd>mkdir -p /usr/src/sys</kbd>

# <strong>cd /usr/src</strong>

# <kbd>cd /usr/src</kbd>

# <strong>tar xvfz /tmp/sys.tar.gz</strong>

</pre></ul>

</pre></blockquote>

<p>

Both of these trees are a regular CVS checkout. Using these trees it

is possible to get a head-start on using the anoncvs servers as

Line 1101

Line 1082

Using these files

results in a much faster initial CVS update than you could expect from

a fresh checkout of the full OpenBSD source tree.

<p>

</ul>

</section>

<hr>

<h3>How to upgrade</h3>

<p>

<h3><font color="#0000e0">How to upgrade</font></h3>

<p>

If you already have an OpenBSD 5.4 system, and do not want to reinstall,

upgrade instructions and advice can be found in the

<a href="faq/upgrade55.html">Upgrade Guide</a>.

</section>

<hr>

<h3>Ports Tree</h3>

<p>

<h3><font color="#0000e0">Ports Tree</font></h3>

<p>

A ports tree archive is also provided. To extract:

<p>

# <strong>cd /usr</strong>

# <kbd>cd /usr</kbd>

# <strong>tar xvfz /tmp/ports.tar.gz</strong>

# <kbd>tar xvfz /tmp/ports.tar.gz</kbd>

</pre></ul>

</pre></blockquote>

<p>

The <i>ports/</i> subdirectory is a checkout of the OpenBSD ports tree. Go

read the <a href="faq/ports/index.html">ports</a> page

Line 1133

Line 1116

OpenBSD ports system.

<p>

The <i>ports/</i> directory represents a CVS (see the manpage for

cvs(1)</a> if

you aren't familiar with CVS) checkout of our ports. As with our complete

source tree, our ports tree is available via

Line 1142

Line 1125

available on a read-write medium and update the tree with a command

like:

<p>

# <strong>cd /usr/ports</strong>

# <strong>cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_5_5</strong>

</pre></ul>

</pre></blockquote>

<p>

[Of course, you must replace the server name here with a nearby anoncvs

server.]

Line 1156

Line 1139

If you're interested in seeing a port added, would like to help out, or just

would like to know more, the mailing list

<a href="mail.html">ports@openbsd.org</a> is a good place to know.

<p>

</section>

</body>

</html>