OpenBSD

OpenBSD Security Views

OpenBSD believes in strong security. Our aspiration is to be NUMBER ONE in the industry for security. Our open software development model permits us to take a more uncompromising view towards increased security than Sun, SGI, IBM, HP, or other vendors are able to. We can make changes the vendors would not make. Also, since OpenBSD is exported with cryptography software, we are able to take cryptographic approaches towards fixing security problems.

Like most readers of the BUGTRAQ mailing list, we believe in full disclosure of security problems. We believe that security information moves very fast in crackers circles. Our experience shows that coding and release of proper security fixes typically requires about an hour of work resulting in very fast fix turnaround. Thus we think that full disclosure helps the people who really care about security.

Our security auditing team typically has between six and twelve members, and most of us continually search for and fix new security holes. We have been auditing since the summer of 1997. The process we followed to increase security was simply a comprehensive file-by-file analysis of every critical software component. Flaws were found in just about every area of the system. Entire new classes of security problems were found while we were doing the audit, and in many cases source code which had been audited earlier had to be re-audited with these new flaws in mind.

Another facet of our security auditing process is it's proactiveness. In almost all cases we have found that the determination of exploitability is not an issue. During our auditing process we find many bugs, and endeavor to simply fix them even though exploitability is not proven. We have fixed many simple and obvious careless programming errors in code and then only months later discovered that the problems were in fact exploitable. This proactive auditing process has really paid off. Statements like ``This problem was fixed in OpenBSD about 6 months ago'' have become commonplace in security forums like BUGTRAQ.

The auditing process is not over yet, and as you can see we continue to find and fix new security flaws.

OpenBSD 2.1 Security Advisories

These are the OpenBSD 2.1 advisories. All these problems are solved in OpenBSD 2.2. Some of these problems still exist in other operating systems.

OpenBSD 2.2 Security Advisories

These are the OpenBSD 2.2 advisories. All these problems are solved in OpenBSD current. Some of these problems still exist in other operating systems.

Other Resources

Other security advisories that have (in the past) affected OpenBSD can be found at the Secure Networks archive.

If you find a new security problem, you can mail it to deraadt@openbsd.org.
If you wish to PGP encode it (but please only do so if privacy is very urgent, since it is inconvenient) use this pgp key.