keeping OBSD up to date and secure throughout time

Previous thread: Support for HDMI and Disk On Memory? by Girish Venkatachalam on Wednesday, October 31, 2007 - 8:24 pm. (4 messages)

Next thread: OpenBSD 4.2 release November 1, 2007 by Theo de Raadt on Wednesday, October 31, 2007 - 11:41 pm. (8 messages)
To: <misc@...>
Date: Wednesday, October 31, 2007 - 10:28 pm

hail all,

I use FreeBSD for a long time and now I'm changing my routers slowly
to OpenBSD. I have one router running 4.2-current (or anything like
this, uname shows 4.2 but motd shows 4.2-current. I confess this still
confuses me) and I'm studying it to be confident enough to make it the
one.

but my main question is, how to make obsd allways up to date, keeping
it bug free. mas from time to time there is security bugs found and so
on.

for what I saw in obsd web
site(http://www.openbsd.org/faq/faq5.html#Flavors), when 4.1 is
released 3.9 is not suported aymore.

my question is, how to keep up to date if putting a cdrom and boot for
upgrade for me is too much of a problem for me ? and also, just as an
example (I'm really not trying to make flame wars or such things, I
just want to know how to make things in obsd) in Freebsd i can compile
and make almost everything yep online and running. just reboot and if
everything is fine, the downtime is just of the reboot itself.

as a pf fan, and as i prefer to use pf in obsd itself, is there a way
to do things this way in obsd ?

thanks,

matheus

--
We will call you cygnus,
The God of balance you shall be

To: <misc@...>
Date: Wednesday, October 31, 2007 - 11:17 pm

Simple way: upgrade every six months, and follow the -stable branch.

Complex way: Follow -current, upgrade your machines almost constantly.

If you have anything approaching "production", run -stable. Downgrading
is difficult, and sooner or later you'll hit something that makes your
life difficult, like changing a major feature (ipf -> pf) or upgrading

You can do an "unpack the install files over the running OS" upgrade,
that's detailed in the upgrade guide in the FAQ. Better yet, you can
put two machines together with CARP and not have any downtime at all.

To: Steve Shockley <steve.shockley@...>
Cc: <misc@...>
Date: Thursday, November 1, 2007 - 5:24 pm

[Empty message]
To: <misc@...>
Date: Thursday, November 1, 2007 - 10:46 pm

Backporting port updates from -current to -stable is usually trivial.
Of course, the real solution would be to find a maintainer...

To: <misc@...>
Date: Saturday, November 3, 2007 - 4:50 am

this made me curious.

I did:

bash-3.2# cat cvs.sh
export CVSROOT=anoncvs@anoncvs1.usa.openbsd.org:/cvs

# src
cd /usr/src
cvs -d$CVSROOT checkout -rOPENBSD_4_2 -P src

and compiled all. then I have.

bash-3.2# dmesg | head
OpenBSD 4.2-current (xxx) #5: Fri Nov 2 22:39:58 BRT 2007
root@xxx.xxx:/usr/src/sys/arch/i386/compile/xxx
cpu0: Intel Pentium II ("GenuineIntel" 686-class, 512KB L2 cache) 300 MHz
cpu0: FPU,V86,DE,PSE,TSC,MSR,PAE,MCE,CX8,SEP,MTRR,PGE,MCA,CMOV,MMX
real mem = 268005376 (255MB)
avail mem = 251445248 (239MB)
mainbus0 at root
bios0 at mainbus0: AT/286+ BIOS, date 09/16/97, BIOS32 rev. 0 @ 0xfd7b1
apm0 at bios0: Power Management spec V1.2
apm0: AC on, battery charge unknown

so, I know change in releases is not supported. But shouldnt berak ?

I thought I was about to have -stable ...

what am I doing bizzare ?

thanks again,

matheus

--
We will call you cygnus,
The God of balance you shall be

To: <misc@...>
Date: Thursday, November 1, 2007 - 6:14 pm

No idea. It used to be, and it will still receive normal (non-ports)
updates.

Just how unsupported -stable is is not entirely clear, to me at least.

Joachim

--
TFMotD: OpenBSD::PkgCfl (3p) - pkg_create(1) @conflict handling

To: Steve Shockley <steve.shockley@...>
Cc: <misc@...>
Date: Thursday, November 1, 2007 - 2:46 pm

hmm, thats what I'll do then. but, there is no way to make my

by what I saw, the way Nick said is what I'll do :)

just want to be 4.2 release again ! :)

(if I cant, I'll install a 4.1 and then do the moves to be 4.2 and
begin the training :) )

thanks all,

matheus

--
We will call you cygnus,
The God of balance you shall be

To: <misc@...>
Date: Thursday, November 1, 2007 - 4:28 pm

Hi!

I guess the official way is to backup your own data (including your own
/etc and so on [e.g. /var/named, /var/www, etc.]), and reinstall from

Kind regards,

Hannah.

To: misc <misc@...>
Date: Wednesday, October 31, 2007 - 11:05 pm

For updates to the latest patched -stable, just follow FAQ5's
instructions. Same thing...compile, reboot, done.

For upGRADING between versions, follow the upgrade guide.
http://www.openbsd.org/faq/upgrade42.html
Upgrading to a new version by source is NOT supported, and often is
not possible for sane definitions of "possible". Don't waste your
time trying.

The first time you do it, allow an hour from start to finish.
Second time, a LOT less. With a moderately fast machine, you can
probably do it in about ten minutes, with only two reboots of complete
down-time.

Since you are running -current, you will have to stay with -current,
at least until 4.3.
Just untar a snapshot, look at
http://www.openbsd.org/faq/current.html
make any adjustments needed, then reboot. Look, no compiling! :)
(a little secret: Assuming no show-stoppers in current.html, I tend to
upgrade all my machines' /etc files at every release, then just untar
file sets to snapshots in between releases. Granted, a very large
reason why I do this is to give me lots of machines to test the
upgradeXX.html process, but it often works fine between releases to
just ignore the /etc file changes. This was not a recommendation, just
a "what I do that is wrong, but I get away with it" :)

Nick.

To: Nenhum_de_Nos <matheusber@...>
Cc: <misc@...>
Date: Wednesday, October 31, 2007 - 10:53 pm

Perhaps you should check this out:

http://www.openbsd101.com/

Most of my experience has been with GNU/Linux distros and their binary
package update schemes, so I found this site to be very helpful to me.

-davidc

--
gpg-key: http://www.zettazebra.com/files/key.gpg

[demime 1.01d removed an attachment of type application/pgp-signature which had a name of signature.asc]

To: <misc@...>
Date: Thursday, November 1, 2007 - 2:26 pm

Hi,

I use binpatch for OpenBSD
http://openbsdbinpatch.sourceforge.net/#download.
With the little program I compile the patches only once and then deploy
they to all my machines.

Best Regards

Patrick

had a name of signature.asc]

[demime 1.01d removed an attachment of type application/x-pkcs7-signature which had a name of smime.p7s]

Previous thread: Support for HDMI and Disk On Memory? by Girish Venkatachalam on Wednesday, October 31, 2007 - 8:24 pm. (4 messages)

Next thread: OpenBSD 4.2 release November 1, 2007 by Theo de Raadt on Wednesday, October 31, 2007 - 11:41 pm. (8 messages)