“Free, Functional & Secure”
base data
developers: The OpenBSD project under Theo de Raadt
version: 3.9 (1. May 2006)
Family tree: \ Unix
\ 386BSD and.4.4BSD-Lite
\ NetBSD
\ OpenBSD
architectures: More than 16
license: BSD license
Other: Price: free of charge
language: English

OpenBSD is 4,4 BSD - based Unix - a similar operating system, which is freely available under the BSD license. It became 1994 by Theo de Raadt von NetBSD, the first BSD - sourceopen were based (Open SOURCE) abgespalten operating system . OpenBSD is admits for persisting of its developers on source openness, free documentation, compromiseless position in relation to software - licenses, focus on computer security and correctness of source code. With the Logo, and/or. Maskottchen of the project actsit itself around Puffy, a ball fish.

OpenBSD contains a multiplicity of safety functions, which are only optionally missing in other operating systems or. Traditionally by the developers a regular Auditing, an investigation of source code on program errors is accomplished.The project holds strict guidelines concerning software licenses upright and prefers the sourceopen BSD license, as well as their variants. This led in the past to comprehensive license examinations, as well as the replacement or distance of source code, which under less acceptable licensesstands.

In agreement with other BSD are based operating systems both the OpenBSD Kernel and the user land programs becomes, how Unix Shell and, jointly in a source code Repository develops common tools. Software of third parties is available or can also as finished packageAssistance of the package management system from the source code to be provided.

Up-to-date OpenBSD for 16 different computer architectures is available, these contains among other things DEK alpha, Intel i386, AMD AMD64, Motorola 68000, Apple PowerPC, Sun SPARC (32/64 bit), VAX and Sharp Zaurus.

Table of contents

historyand spreading

in December 1994 was asked Theo de Raadt, one the joint founder NetBSDs, experienced developer and member of the core team, to give its position up. Its entrance to the source code Repository became simultaneous closed. The reason is not exactly well-known, however there are statements,it conditions in connection with personal conflicts on the NetBSD mailing list.[1] Theo de Raadt was criticized to show occasionally an aggressive kind: In the book Free For universe maintains Peter Wayner that de Raadt before the splitting offfrom NetBSD „had begun to annoy some people automatically “;[2] Interviewers admit to preserve „doubts [over it] „;[3] and Linus Torvalds described it as „with difficulty”.[4] He was regarded of some NetBSD mailing list participants quite as „a terrorist”, why his of many yearsBarrier was also only waived few months ago (conditions:2005). Others however feel its directness than recreating and hardly someone deny that he is a talented programmer and expert for computer security.

In October 1995 de Raadt OpenBSD based, asnew project fragmentation of NetBSD 1.0. The first publication, OpenBSD 1,2, was published in July 1996, followed of OpenBSD 2,0 in the October of the same yearly.[5] Since that time OpenBSD follows the time schedule every six months a new version to give change, this becomes thereafterone year long maintained and supports. The last version, OpenBSD 3,9, became at the 1. May 2006 given change.[6]

It is difficult to determine the spreading of OpenBSD accurately: The OpenBSD project collects and publishes no Nutzungstatistiken, and there are only fewother sources of information. The becoming BSD certify project accomplished a use inquiry, these resulted in that 32.8% of the asked BSD users (asked 1420 of 4330) use OpenBSD, [7] thereby OpenBSD platzierte itself as the second of the four large BSD distributions, behind FreeBSD with 77,0% andbefore NetBSD with 16,3%. The web page Distrowatch [8], admits in the Linux - municipality and often as reference point for popularity used, publishes side access numbers for different Linux distributions and other operating systems. OpenBSD is on that 39. Place with an average ratioof 116 hits per day (conditions: 22. January 2006). FreeBSD is on that 11. Place with 459 hits per day and a multiplicity of Linux distributions are between the two. From these statistics it can be derived that OpenBSD, alsoa third of the users of FreeBSD, a considerable operational readiness level in the BSD world and it enjoys in the more extensive open SOURCE - and free software - municipality likewise to the knowledge is taken.

free software and free documentation

as OpenBSD inLife was called, decided Theo de Raadt to make the source text for everyone readable at each time therefore it put by Chuck Cranor, [9] a public anonymous CVS - to version administrative servers on. This was first of its kind in thatWorld of the software development: at that time it was usual that only a small team of developers had access to the CVS management system. This procedure did not have some lack, particularly external participations had a possibility to find out, what had been already settled and steeredfrom the resulting ignorance Patches . This entailed much unnecessarily duplicated work. The decision for disclosure led to the name OpenBSD and marked at the beginning of persisting, on the part of the project on free and publicly accessible source texts as well as documentation.

In March 2005 an informative example of the attitude of the OpenBSD project showed up concerning open documentation. At this time Theo de Raadt would send a E-Mail [10] to openbsd misc - the mailing list, in this communicated it that Adaptec aftermore than four months further no documentation for its AAC RAID - CONTROLLER had released. However to improve these necessarily around the OpenBSD device driver. De Raadt under similar conditions had before already requested the OpenBSD municipality, itself by clear representingto bring in their point of view opposite Adaptec. Shortly thereafter Scott Long [11], former Adaptec employees, FreeBSD Mitentwickler and programmer of the AAC RAID support published, a comment [12] on OSNews. In this it does not throw Theo de Raadt forwards, concerning the problems with Adaptec a contact alsoit to have taken up. By the comment the discussion continued at freebsd questions - the mailing list. De Raadt [13], answered there that it before from Scott Long neither an offer of help received, nor it Adaptec informed, at whomit to turn should. The debate became still more verbissener by different points of view of the two sides concerning Binary - drivers and agreements over Nichtoffenlegung (NDA): Theo de Raadt and the OpenBSD project are strongly averse from both. They do not permit merging Binary driversinto the OpenBSD source code and reject it to sign NDAs. The guidelines of the FreeBSD project are however less strictly held and a large part of the FreeBSD Adaptec RAID Verwaltungswerkzeuge of Scott Long only than Binary drivers available or under a NDA had been programmed. Becauseno documentation up to the period for publication by OpenBSD 3,7 was approved, the support for Adaptec AAC RAID CONTROLLERs from the OpenBSD Standardkernel was removed.


OpenBSD 3,7 with and the window manager JWM

a goal of OpenBSD is it,„the spirit of the original Berkeley Unix - copyright to keep upright”, this permitted one „relatively unimpaired distribution of the Unix source code. ” [14] from this reason the Internet of system becomes Consortium (ISC) for new source code - license prefers, which represents a simplified version of the BSD licensewhich removed after that Bernese convention unnecessary formulations. The WITH - or BSD license is likewise accepted. The GNU general publicly License is regarded in the comparison as too restrictive:[15] Source code under these and other unwanted licenses does not becomeIntegration into the basic system certified. Additionally existing source code under these licenses is replaced or if possible again licensed. In some cases this is however not possible, an example is GCC. For this there is no suitable replacement: it would beto time-consuming and unpractically to sketch a new compiler. Nevertheless OpenBSD made already important progress regarding licenses. Particularly worth mentioning the development of OpenSSH is based, on the original SSH. It appeared for the first time inOpenBSD 2,6 and is today the most popular SSH implementation. It is a firm or optional component of many operating systems. The become development of the PF necessary by license restrictions on IPFilter is just as worth mentioning - Firewall. This appeared for the first time inOpenBSD 3,0 and is today likewise available for DragonFly BSD , NetBSD and FreeBSD. Recently OpenBSD replaced under the GPL standing university X-commands diff , grep , gzip , UC, DC, Nm and size by BSD licensed versions.The OpenBSD project stands the moreover one also behind the development of OpenNTPD and open CVS, likewise BSD licensed versions of existing software.

In June 2001 doubts over Darren Reeds changes at the IPFilter license solved a systematic examination of all licenses in the OpenBSD source code and Haven system out. Source code in more than 100 files scattered in the system was hurting found than not licensed, ambiguous or guidelines. In order to guarantee the adherence to all licenses, was tried, to take up contact to all copyright owners. As result some parts were removed, manyreplaced and others again licensed, in order to permit the further use in OpenBSD. To the newly licensed programs the multicast - Routing -, licensed of Xerox for research purposes, programs originally exclusively belonged mrinfo and to map MBONE.[16]

To mark is also thoseDistance of all software of Daniel J. Amber from the OpenBSD Portssystem. At present the distance required amber that all modified versions of its software before the publication of it must be abgesegnet, a demand for those the OpenBSD project neither time nor effortto dedicate wanted.[17] The distance led to a controversy with amber, this regarded it as inappropriate and answered that the Netscape - Webbrowser is by far less free. He accused the OpenBSD project as well as Theo de Raadt for this reasonthe Heuchelei.[18] The OpenBSD project represented the position the fact that Netscape although sourceopen, did not demand license conditions which can be kept more simply;[19] they stated opposite amber that after control of derivatives to a large quantity of additional work will lead the demands. Therefore is thoseDistance the most appropriate way to follow its requirements. Up-to-date, i.e. also after the publication of OpenBSD 3,8, Daniel J. remain. Amber banishes programs further from the haven system.


further information to this topic: OpenBSD security characteristics

short time afterthe OpenBSD project was born, became Theo de Raadt of the local software safety company Secure network, Inc. (SNI) contacts.[20] [21] this worked on Ballista, one „tool for safety audits of networks”. It - after SNI von Network Associates had been bought up- in „Cybercop scanner” renamed. It was sketched to use any safety holes in software. This agreed close with Theo de Raadts own interest in security. Therefore both decided to cooperate. This relationship was very useful, because ithelped to specify the emphasis for the OpenBSD project and contributed to the publication of OpenBSD 2,3 [22]. Although others selected the way of the slightest resistance in many points, OpenBSD often went another way and gave themselves large trouble to do,which was correctly, appropriate or safe, even at expense of comfort, speed or functionality. When program errors in OpenBSD became usable to find more difficult and, the safety company felt it too with difficulty, and/or. not cost-efficiency to worry about such insignificant problems.After many years of co-operation the two sides decided that its goals were reached and their ways separated.

By June 2002 the OpenBSD web page the Slogan zierte:

„No safety gap in the standard installation since nearly 6, open to attack over the netYears. ”

In June 2002 Internet Security of system discovered an error with the Challenge response Authentifizierung in the OpenSSH source code.[23] This was first and to today only safety gap in the OpenBSD Standardinstallation, which it permits a distant aggressor, itself entrance to the root -To provide user account. The safety gap was very serious, partial due to the large spreading of OpenSSH. The error concerned also a considerable quantity other operating systems.[24] It forced for the change of the Slogans:

„Only a safety gap in more, open to attack over the netas 8 years. ”

This statement was criticized already often, because in the OpenBSD Standardinstallation only little service and contained versions of OpenBSD software are activated, for which later removes safety gaps open to attack was found; however the OpenBSD project persists in the fact that itself the Sloganto the standard installation to refer is and the data are therefore correct. One of the fundamental concepts of OpenBSD is striving for a simple, clean and safe according to standard system. „According to standard” designates thereby the pre-setting of the product directly with the installation; soquite more safety gaps to be registered had, if with OpenBSD of more services had been started. The concept to offer only according to standard few services inserts itself well into common procedures of computer security. Further the project is open SOURCE and uses methods howSource code Auditing, both things, by which it is said that they are important for the security of a system.[25]

OpenBSD 3.8-current with safe times locomotive - implementation when starting

OpenBSD contains a multiplicity of special on improvement of the security of cut functions: Changeat the compiler and the programming interfaces like the functions strlcpy and strlcat; A static software test for the examination of the buffers; Protection from bad accesses by storage protection - techniques, like pro policy, StackGhost and W^X (abbreviation for Writeable xor eXecutable); Since OpenBSD 3.8Improvements on the times locomotive - implementation; Kryptografi and randomized functions, among other things in the network minutes pile; Integration of the Blowfish - block cipher for safe password coding. All of this was done, in order to reduce the risks of a safety gap or a false configuration, which to a privilege escalationto lead could. Some programs were again written or adapted, in order to use privilege separation, privilege reduction or Chroots. Privilege separation is a procedure, with which a program is divided into several parts. One of these parts implements functions, which high privileges need, howeverthe largest part of the program with low privileges can usually run. By OpenBSD the way was prepared for this technology and it is inspired of the principle of the smallest right. Privilege reduction is similar, a program leads first all functions, whichhigh privileges presuppose, out and deliver afterwards its privileges. Chroots limit a program to a small part of the file system and prevent so the access to system files.

The project follows the guideline a continual source code audit after safety gaps to hold.The developer Mark of Espie described the work as „ending, it is never more a question of the progress than the search for specific errors. ” [26] it continues enumerating some typical steps one follows to which, as soon as an error was found. Oneis to scan the complete source code Repository for this and similar errors. „Attempts to find out whether the documentation be extended it should” and to employ, whether „it is possible to extend the compiler thereby he warns investigations in the future of this special problem.” BesideDragonFly BSD has OpenBSD the only open SOURCE operating system with the guideline to replace classical K&R - C-source code by equivalent modern ANSI - to C-code. This causes no functional changes, but increases the legibility and provides for a higher consistency. There is a standard style for source code,the Kernel normally form (KNF), these indicates the appearance of source code, in order to make it simply understandable and maintainable. The KNF must be applied to all source code, which is considered for the admission in the basic system. Code already existing becomesmomentarily renews around the style requirements to fulfill.


due to the safety improvements, Kryptografie and the integrated PF-Firewall is suitable OpenBSD for the use in the safety industry, particularly for Firewalls, intrusion Detection of systems and VPN - gateways.It will have to be likewise frequent for Web - and other servers assigned, there these resistantly against Cracker - and DOS - attacks. Due to the inclusion of spamd in the basic system OpenBSD is used occasionally also as Spam filter.

It gives up someOpenBSD based prop. guessing acres of systems. Some of it are: Profense of Armorlogic ApS, IP360-Sicherheitslückenverwaltung of nCircle, syswall of Syscall network Solutions AG, GeNUGate and GeNUBox of Genova ltd. and RTMX O/S of RTMX Inc. From these both RTMX and Genova hasa contribution to OpenBSD performed. RTMX contributed Patches, in order the fulfilment of the POSIX - specification further to develop. Genova financed the development of SMP for the i386-Architektur. A set of open SOURCE operating systems likewise here Anonym.OS descend and from OpenBSD, worth mentioning are MirOSBSD as well as those systems today any longer not existing ekkoBSD, MicroBSD and Gentoo/OpenBSD. In addition source code from many systemnear OpenBSD Tools was used in new versions by of Microsoft services for UNIX (SFU ). SFU is an extension to Microsoft Windows,the some Unix similar functions makes available and on 4.4BSD-Lite was originally based. There were also projects, which used OpenBSD as part image or for Embedded of system, for example OpenSoekris and flashdist. In co-operation with Tools as nsh makes this, Embedded systems possible similarlyof Cisco the manufactured.

OpenBSD integrates the X Window system. After the changes of license at XFree86 a current version is used by X.Org. An old XFree86-3.3-Version is likewise for the useon very old diagram maps available. With the X-system it is possible to use OpenBSD as home computers or workstation and for use of a Desktop Environments to make window manager or both. Thus it is possible, the X-Desktop in an abundance from manifestations touse. By the OpenBSD package management system can be selected from a multiplicity of the most popular programs for the Desktop. Here is among other things the Desktopumgebungen of GNOMES, KDE and Xfce; the Webbrowser Mozilla Firefox and Opera as well as many Multimedia - programs.There are also compatibility layers, which permit it, only binary available programs, which for other operating systems were compiled, to use. Among other things there are these layers for Linux, FreeBSD, Solaris and HP-UX. There itself hardware manufacturers such as ATI and nVidia do not refuse giving change open SOURCE drivers or documentation for the 3D-Fähigkeiten of its diagram maps offers to OpenBSD any support for 3D-beschleunigte diagrams.

The operability and performance of OpenBSD are occasionally criticized. Investigations on performance and scaling often show that OpenBSD behind other operating systems, are here the investigations are most well-known past by Felix von Leitner.[27] OpenBSD developer and - users answered with the opinion, performance should be considered, however was security of regarding reliability and correctness as more important.[28] OpenBSD is a comparatively small project, particularlyin the comparison with FreeBSD and Linux, therefore developer time for safety improvements often as more worthwhile seen as for performance optimizations. Critics of the user friendliness often reproach the absence of graphic configuration programs, the plain standard installation, [29] as well as „the spartanische” and „intimidating” installation.[30] This criticism with a similar rejection as the criticism at performance one meets: the preference/advantage of simplicity, reliability and security. A critic admitted: „a ultra safe operating system to use can be a piece of work. ” [31]

salesand marketing

OpenBSD is freely available on different ways: the source code can be referred over anonymous CVS or CVSup, binary final and development versions can over ftp and HTTP be downloaded. Manufacture CD sets, together with a selection of stickers and thatTitle song of the respective version, on-line can be ordered against a small fee. The CD sets with the pertinent illustrations and other Merchandise are one of the few sources of income for the project. From the incomes hardware, range and other acquisitions are financed. Overfor the purchase of the official CDs to encourage, OpenBSD gives only a small ISO image to downloads freely, instead of the complete CDs.

Together with some other operating systems OpenBSD uses the haven system in connection with its own package management system, this permits a simple installationand administration of programs not contained in the basic system. Originally being based on the FreeBSD Portssystem, the systems are in the meantime clearly different. The system went down between version 3.6 and 3.8 large changes those still persists. A part of these was the exchange thatTools for package administration - these are the final user programs around packages to manipulate - by more powerful versions. They were completely again written by Mark Espie in Perl. Contrary to FreeBSD the OpenBSD Portssystem is only the source for providing the final product,that is called meant the packages. With installing haven is provided first a package and installed this afterwards by the Paketverwaltungstools. Packages are provided in great quantities of the OpenBSD team for each version and made available to to download. OpenBSD is under the BSDs alsoin the regard singularly that haven and basic system for each version are developed together and given change. Hence follows that haven and packages, which are published with a version, for example 3,7, it are used not with another version, for example 3,6,can. This guideline contributes a large part to the stability of the development process, but at the same time it can also mean that haven often commodity of the last OpenBSD version up to the appearance of the next version stays behind the newest program version of the author.

The OpenBSD Maskottchen named Puffy, the ball fish

approximate at present from OpenBSD 2,7 was replaced the original Maskottchen, a BSD Daemon with Dreizack and Strahlenkranz, by Puffy, a ball fish. Puffy selected due to the ball fish algorithm (Blowfish) in OpenSSH and strongly defensive imagethe ball fish, whose pricks protect it against enemies. Puffy enjoyed of fast high popularity, mainly because of the responding image and its clear distinction by the BSD Daemon, that from FreeBSD is likewise used and the Daemonenherde used by NetBSD. Puffy appeared tofirst time in OpenBSD 2,6 and was it shown since his feature in a multiplicity of shapes to T-Shirts and Postern. Some of it were, often following well-known persons:Puffiana Jones, famous Hackologe and adventurer on the search afterthe lost RAID;Puffathy, a small girl from Alberta those with Taiwan to co-operate must save around the situation; Sir Puffy OF Ramsay, freedom fighter, that together with the small Bob from Beckly of the realms steals and underthe arms distributes;Puffy daddy, more famous RWSby and political Idol.

After some versions OpenBSD became notorious for its in-usual songs and its interesting, often funny, illustrations. The advertising material of the early OpenBSD versions did not have connected topic or Design, but sinceOpenBSD 3,0 are produced the CDs, poster and T-Shirts for each version with a uniform topic and style. Some was contributed every now and then by Ty Semaka the volumes Plaid Tonqued Devils. First it was meant only as insignificant humor, as itselfthe concept however developed further, became it a part of the OpenBSD Evangelismus. Each version publicises a moral or a political point of view with meaning for the project, often in form of a Parodie. A cutout of the previous topics: in OpenBSD 3,8 the hackersthe lost RAID, a Parodie on Indiana Jones with reference to the new RAID Tools; in OpenBSD 3,7 the Zauberer of OS on Pink Floyd, a Parodie of the Zauberer of Oz, purchase the work on that was based Wireless LAN - Support; in OpenBSD 3,3 Puff the barbarian, a Parodie on Conan the barbarian as well as a skirt song from - the 80's with the reference to open documentation.

Additionally to the Slogans on T-Shirts and Postern OpenBSD bringsoccasionally also further out: over the years some key words like „transport from Skriptkiddies to /dev/null since 1995”, „functional, surely and freely, select three of it”, „security according to standard” and still some further Slogans, only on T-Shirts printed for developers on meetingsto find, for example „security with world class, many cheaper than a Cruise missile are”, or an annoyed old Tintenfisches „the muzzle and heels hold!” to the best one gives.


some the books concerning OpenBSD:

further information

work on []

Appendix and indication of source

  1. Glass, Adam. Report at netbsd users: Theo De Raadt (sic), 23. December 1994.
  2. Wayner, Peter. Free For universe: How Linux and the Free software Movement Undercut the High Tech of titanium, 16,3 Flames, Fights, and theBirth OF OpenBSD, 2000
  3. NewsForge. Theo de Raadt gives it all ton of OpenBSD, 30. January 2001.
  4. Forbes. Is Linux For Losers? 16. June 2005.
  5. de Raadt, Theo. E-Mail to openbsd announce: The OpenBSD the 2,0 releases,18. October 18 1996.
  6. de Raadt, Theo. E-Mail on openbsd misc: the 3,8 releases, November 1 2005. 9. December 2005.
  7. BSD Certification site: here; Pdf with results of the use inquiry: here.
  8. Distrowatch web page: here.
  9. web pageof Chuck Cranor here.
  10. de Raadt, Theo. Mail ton openbsd misc: Adaptec AAC raid support, 18. March 2005.
  11. web page of Scott Long here.
  12. Long, Scott. Post office at OSNews: From A BSD and molder Adaptec person…, 19. March 2005.
  13. de Raadt, Theo. Mail ton freebsd questions: aac support, 19. March 2005.
  14. de Raadt, Theo. Mail ton freebsd questions: aac support, 19. March 2005.
  15. Copyright guidelines.
  16. NewsForge. BSD cognoscenti onLinux, 15. June 2005.
  17. hard Meier, Daniel. Design and performance OF the OpenBSD Stateful pack filters (pf).
  18. NewsForge. OpenBSD and fighting more over license disagreement more ipfilter quietly, 6. June 2001.
  19. one pages: mrinfo and map MBONE.
  20. de Raadt, Theo. Mail ton openbsd misc: RH: Why were all DJB's of haven removed? NO more qmail?, 24. August 2001.
  21. amber, DJ. Mail ton openbsd misc: RH: Why were all DJB's of haven removed? NO more qmail?, 27. August2001.
  22. Espie, Mark. Mail ton openbsd misc: RH: Why were all DJB's of haven removed? NO more qmail?, 28. August 2001.
  23. The Age. Staying on the cutting edge, 8. Oktobor 2004.
  24. Interview with OpenBSD developers: TheEssence OF OpenBSD, 17. July 2003.
  25. Theo de Raadt to SNI: “Without their support in due time this version would not exist probably.” from the 2.3 releases announcement.
  26. Internet Security of system. OpenSSH remote Challenge Vulnerability, 26.June 2002.
  27. A partial cunning OF affected operating of system is here.
  28. Wheeler, David A. Secure Programming for Linux and Unix HOWTO, 2.4. Is open SOURCE Good for Security?, 3. March 2003.
  29. Provos, Niels. Privilege SeparatedOpenSSH.
  30. O'Reilly network. At interview with OpenBSD's Mark of Espie, 18. March 2004.
  31. OpenSoekris, flashdist and nsh.
  32. the test results and result are: here.
  33. Holland, nod. E-Mail too openbsd misc: RH: OpenBSD Benchmarked… results:poor!, 19. Oktobor 2003.
  34. NewsForge. Trying out the new OpenBSD 3,8, 2. November 2005.
  35. NewsForge. Review: OpenBSD 3,5, 22. July 2004.
  36. Distrowatch. OpenBSD - For Your Eyes Only, 2004.

Web on the left of

Commons: OpenBSD - pictures, videos and/or audio files

  > German to English > (Machine translated into English)