APLawrence.com -  Resources for Unix and Linux Systems, Bloggers and the self-employed

OpenBSD Security Techniques


Some material is very old and may be incorrect today

© September 2004 Drag Sidious
Referencing: /

http://cvs.openbsd.org/papers/auug04/index.html

Interesting set of slides showing what lengths OpenBSD does on top of their code auditing efforts they put into securing their operating system.

Very impressive and looks like it would make over flow buffers exploits a thing of the past, and badly written programs get exposed quickly as part of the process.

Stuff like this is why OpenBSD has the best security record of any OS available to the average person. They are a bit behind in terms of new software and hardware support, and SMP support is near non-existent. But if you need a secure machine it's hard to go wrong with OpenBSD.


If you found something useful today, please consider a small donation.



Got something to add? Send me email.





(OLDER)    <- More Stuff -> (NEWER)    (NEWEST)   

Printer Friendly Version

->
-> Open BSD auditing


Inexpensive and informative Apple related e-books:

iOS 10: A Take Control Crash Course

El Capitan: A Take Control Crash Course

Take Control of the Mac Command Line with Terminal, Second Edition

Take Control of Pages

Take Control of IOS 11





More Articles by © Drag Sidious




---September 2, 2004

I have never understood why W^X hasn't been just automatic practice. There are very few programs that ever need to write into executable space, and as they say, they can be handled as a special case.

I like the stack gap idea - not foolproof, but it could thwart an attack or two and it is obviously trivial to implement.

OSes should just automatically do both of these - if you had W^X the stack gap shouldn't be necessary, but it's like blocking a service at the firewall AND at the server - never hurts to cover the same ground twice just in case.


--TonyLawrence



---September 3, 2004

Personally my favorite is the propolice stack smashing protection patches for GCC. You simply recompile programs using the patched GCC compiler, and with no internal code change, you have a extra layer of protection against buffer overflow attacks. And if a program does end crashing because of it, 9 times out of 10 that program's memory management/whatever was flawed. Helps to chase down bugs.

--Drag

---September 3, 2004





Printer Friendly Version

Have you tried Searching this site?

This is a Unix/Linux resource website. It contains technical articles about Unix, Linux and general computing related subjects, opinion, news, help files, how-to's, tutorials and more.

Contact us


Printer Friendly Version





I love deadlines. I love the whooshing noise they make as they go by. (Douglas Adams)




Linux posts

Troubleshooting posts


This post tagged:

Blog

Drag

Kernel

Linux

Misc.

Programming

Security

Unix



Unix/Linux Consultants

Skills Tests

Unix/Linux Book Reviews

My Unix/Linux Troubleshooting Book

This site runs on Linode