OpenBSD 5.4

15 min read Original article ↗
Puffia Released Nov 1, 2013
Copyright 1997-2013, Theo de Raadt.
ISBN 978-0-9881561-2-8
5.4 Song: "Our favorite hacks"

All applicable copyrights and credits are in the src.tar.gz, sys.tar.gz, xenocara.tar.gz, ports.tar.gz files, or in the files fetched via ports.tar.gz.

What's New

This is a partial list of new features and systems included in OpenBSD 5.4. For a comprehensive list, see the changelog leading to 5.4.

  • New/extended platforms:
    • OpenBSD/octeon
      New platform for systems based on the Cavium Octeon MIPS-compatible processors. Supported machines include:
      • Portwell CAM-0100
      • Ubiquiti Networks EdgeRouter LITE (no local storage)
    • OpenBSD/beagle
      New platform for OMAP3/4 and AM335x systems using an ARM Cortex-A8 or Cortex-A9 CPU. Supported boards include:
      • BeagleBoard C4 / xM
      • BeagleBone and BeagleBone Black
      • PandaBoard and PandaBoard ES
  • Improved hardware support, including:
    • inteldrm(4) has been overhauled, including:
      • Now mostly in sync with Linux 3.8.13.
      • Support for Kernel Mode Setting (KMS) including support for additional output types such as DisplayPort.
      • Sandy Bridge and newer parts which previously had only ShadowFB acceleration now have full hardware acceleration including use of the 3D rings.
      • wsdisplay(4) now attaches to inteldrm(4) and providers a framebuffer console.
    • vgafb(4/macppc) now supports multiple virtual consoles.
    • Support for Elantech touchpads version 4 (clickpad) added to pms(4).
    • Fixed st(4) EOM handling, enabling much better Bacula support.
    • Support for vdsk(4) disks larger than 2TB.
  • Generic network stack improvements:
    • Reworked checksum handling for network protocols.
    • divert(4) now recalculates the IP and protocol checksums of reinjected packets.
    • No longer attempt to delete the undeletable RNF_ROOT route.
  • Routing daemons and other userland network improvements:
    • Support SSL inspection in relayd(8).
    • Added slowcgi(8), a libevent-based FastCGI implementation.
    • Enabled ECDHE support in httpd(8).
    • Do not start inetd(8) by default any more.
    • Many ldpd(8) improvements, including a speed-up of the session establishment process, support for adjacencies and targeted hellos, support for multiple addresses per interface, and more.
  • dhcpd(8) improvements:
    • Improved compliance with RFC 2131 strictures on client-identifiers.
    • Fixed synchronization of leases.
    • Replaced manual date parsing and printing with strftime and strptime.
    • Explicitly label dates in leases files as being UTC dates.
  • dhclient(8) improvements:
    • Delete routes added by defunct dhclient processes.
    • Improved handling of client-identifier option.
    • Increased ip_ttl on packets to 128, allowing more distant servers to provide leases.
    • Replaced manual date parsing and printing with strftime and strptime.
    • Explicitly label dates in leases files as being UTC dates.
    • Improved interactions between dhclient processes to make the most recent dhclient started the most likely to persist.
    • Support for static routes and classless static routes options.
    • Fixed log messages to print correct addresses.
    • Reduced log verbosity by emitting debug messages only when debugging.
    • Eliminated unnecessary address and route churn during lease renewal by not binding leases identical to the current one.
  • OpenSMTPD 5.3.3:
    • New features:
      • Add support for LMTP local deliveries
      • Add SECURE and AUTH transmission types
      • Add support for transparent queue compression
      • helo names can now be looked up in a db(3) table
      • New "error:" alias kind allows aliasing a user-part to an error
      • Traces can be (de)activated at runtime
    • Improvements:
      • More robust queue can cope with runtime errors
      • Improved routing strategies
      • Assorted minor bug fixes and cleanups
  • Performance improvements:
    • Don't require the kernel lock when processing audio interrupts.
    • Improved kernel bcopy/memmove/memcpy implementations and made more careful choices between them.
    • Implemented symbol caching and RELCOUNT/RELACOUNT optimizations in ld.so(1).
  • Threading improvements:
    • Closed various race conditions between exit/fork/execve/__tfork/__threxit/ptrace in both the kernel and libpthread.
  • Assorted improvements:
  • OpenSSH 6.3:
    • New features:
      • sshd(8): add ssh-agent(1) support to sshd(8); allows encrypted hostkeys, or hostkeys on smartcards.
      • ssh(1) and sshd(8): allow optional time-based rekeying via a second argument to the existing RekeyLimit option. RekeyLimit is now supported in sshd_config(5) as well as on the client.
      • sshd(8): standardise logging of information during user authentication.
      • ssh(1): add the ability to query supported ciphers, MAC algorithms, key types and key exchange methods.
      • ssh(1): support ProxyCommand=- to allow support cases where stdin and stdout already point to the proxy.
      • ssh(1): allow IdentityFile=none.
      • ssh(1) and sshd(8): add -E option to ssh(1) and sshd(8) to append debugging logs to a specified file instead of stderr or syslog.
      • sftp(1): add support for resuming partial downloads using the reget command and on the sftp(1) commandline or on the get commandline using the -a (append) option.
      • ssh(1): add an IgnoreUnknown configuration option to selectively suppress errors arising from unknown configuration directives.
      • sshd(8): add support for submethods to be appended to required authentication methods listed via AuthenticationMethods.
    • The following significant bugs have been fixed in this release:
      • sshd(8): fix refusal to accept certificate if a key of a different type to the CA key appeared in authorized_keys before the CA key.
      • ssh(1), ssh-agent(1) and sshd(8): Use a monotonic time source for timers so that things like keepalives and rekeying will work properly over clock steps.
      • sftp(1): update progressmeter when data is acknowledged, not when it's sent. (bz#2108)
      • ssh(1) and ssh-keygen(1): improve error messages when the current user does not exist in /etc/passwd. (bz#2125)
      • ssh(1): reset the order in which public keys are tried after partial authentication success.
      • ssh-agent(1): clean up socket files after SIGINT when in debug mode. (bz#2120)
      • ssh(1) and others: avoid confusing error messages in the case of broken system resolver configurations. (bz#2122)
      • ssh(1): set TCP nodelay for connections started with -N. (bz#2124)
      • ssh(1): correct manual for permission requirements on ~/.ssh/config. (bz#2078)
      • ssh(1): fix ControlPersist timeout not triggering in cases where TCP connections have hung. (bz#1917)
      • ssh(1): properly detach a ControlPersist master from its controlling terminal.
      • sftp(1): avoid crashes in libedit when it has been compiled with multi-byte character support. (bz#1990)
      • sshd(8): when running sshd -D, close stderr unless we have explicitly requested logging to stderr. (bz#1976)
      • ssh(1): fix incomplete bzero. (bz#2100)
      • sshd(8): log and error and exit if ChrootDirectory is specified and running without root privileges.
      • Many improvements to the regression test suite. In particular log files are now saved from ssh(1) and sshd(8) after failures.
      • Fix a number of memory leaks. (bz#1967, bz#2096 and others)
      • sshd(8): fix public key authentication when a :style is appended to the requested username.
      • ssh(1): do not fatally exit when attempting to cleanup multiplexing-created channels that are incompletely opened. (bz#2079)
  • Over 7,800 ports, major stability improvements in the package build process
    • The parallel ports builder is better at catching up errors on older slower platforms, thus allowing release engineers to better concentrate on real errors.
  • Many pre-built packages for each architecture:
    • i386: 7976
    • sparc64: 6959
    • alpha: 6062
    • m68k: 3862
    • sh: 989
    • amd64: 7941
    • powerpc: 7483
    • m88k: 3951
    • sparc: 4823
    • arm: 5582
    • hppa: 6607
    • vax: 2226
    • mips64: 6739
    • mips64el: 6306
  • Some highlights:
    • GNOME 3.8.3
    • KDE 3.5.10
    • Xfce 4.10
    • MySQL 5.1.70
    • PostgreSQL 9.2.4
    • Postfix 2.10.1
    • OpenLDAP 2.3.43 and 2.4.35
    • Mozilla Firefox 3.6.28 and 22.0
    • Mozilla Thunderbird 17.0.7
    • GHC 7.6.3
    • LibreOffice 4.0.4.2
    • Emacs 21.4 and 24.3
    • Vim 7.3.850
    • PHP 5.2.17 and 5.3.27
    • Python 2.7.5 and 3.3.2
    • Ruby 1.8.7.374, 1.9.3.448 and 2.0.0.247
    • Tcl/Tk 8.4.20, 8.5.14 and 8.6.0
    • JDK 1.6.0.32 and 1.7.0.21
    • Mono 2.10.9
    • Chromium 28.0.1500.45
    • Groff 1.22.2
    • Go 1.1.1
    • GCC 4.6.4 and 4.8.1
    • LLVM/Clang 3.3
    • Node.js 0.10.12
  • As usual, steady improvements in manual pages and other documentation.
  • The system includes the following major components from outside suppliers:
    • Xenocara (based on X.Org 7.7 with xserver 1.14.1 + patches, freetype 2.4.12, fontconfig 2.10.91, Mesa 7.11.2, xterm 293, xkeyboard-config 2.7 and more)
    • Gcc 4.2.1 (+patches), 3.3.6 (+ patches) and 2.95.3 (+ patches)
    • Perl 5.16.3 (+ patches)
    • Our improved and secured version of Apache 1.3, with SSL/TLS and DSO support
    • Nginx 1.4.1 (+ patches)
    • OpenSSL 1.0.1c (+ patches)
    • SQLite 3.7.17 (+ patches)
    • Sendmail 8.14.7, with libmilter
    • Bind 9.4.2-P2 (+ patches)
    • NSD 3.2.15
    • Lynx 2.8.7rel.2 with HTTPS and IPv6 support (+ patches)
    • Sudo 1.7.2p8
    • Ncurses 5.7
    • Heimdal 1.5.2 (+ patches)
    • Binutils 2.15 (+ patches)
    • Gdb 6.3 (+ patches)
    • Less 444 (+ patches)
    • Awk Aug 10, 2011 version

How to install

Following this are the instructions which you would have on a piece of paper if you had purchased a CDROM set instead of doing an alternate form of install. The instructions for doing an FTP (or other style of) install are very similar; the CDROM instructions are left intact so that you can see how much easier it would have been if you had purchased a CDROM instead.

Please refer to the following files on the three CDROMs or FTP mirror for extensive details on how to install OpenBSD 5.4 on your machine:

Quick installer information for people familiar with OpenBSD, and the use of the "disklabel -E" command. If you are at all confused when installing OpenBSD, read the relevant INSTALL.* file as listed above!

OpenBSD/i386:

Play with your BIOS options to enable booting from a CD. The OpenBSD/i386 release is on CD1. If your BIOS does not support booting from CD, you will need to create a boot floppy to install from. To create a boot floppy write CD1:5.4/i386/floppy54.fs to a floppy and boot via the floppy drive.

Use CD1:5.4/i386/floppyB54.fs instead for greater SCSI controller support, or CD1:5.4/i386/floppyC54.fs for better laptop support.

If you can't boot from a CD or a floppy disk, you can install across the network using PXE as described in the included INSTALL.i386 document.

If you are planning on dual booting OpenBSD with another OS, you will need to read INSTALL.i386.

To make a boot floppy under MS-DOS, use the "rawrite" utility located at CD1:5.4/tools/rawrite.exe. To make the boot floppy under a Unix OS, use the dd(1) utility. The following is an example usage of dd(1), where the device could be "floppy", "rfd0c", or "rfd0a". 

# dd if=<file> of=/dev/<device> bs=32k

Make sure you use properly formatted perfect floppies with NO BAD BLOCKS or your install will most likely fail. For more information on creating a boot floppy and installing OpenBSD/i386 please refer to this page.

OpenBSD/amd64:

The 5.4 release of OpenBSD/amd64 is located on CD2. Boot from the CD to begin the install - you may need to adjust your BIOS options first. If you can't boot from the CD, you can create a boot floppy to install from. To do this, write CD2:5.4/amd64/floppy54.fs to a floppy, then boot from the floppy drive.

If you can't boot from a CD or a floppy disk, you can install across the network using PXE as described in the included INSTALL.amd64 document.

If you are planning to dual boot OpenBSD with another OS, you will need to read INSTALL.amd64.

OpenBSD/macppc:

Burn the image from the FTP site to a CDROM, and power on your machine while holding down the C key until the display turns on and shows OpenBSD/macppc boot.

Alternatively, at the Open Firmware prompt, enter boot cd:,ofwboot /5.4/macppc/bsd.rd

OpenBSD/sparc64:

Put CD3 in your CDROM drive and type boot cdrom.

If this doesn't work, or if you don't have a CDROM drive, you can write CD3:5.4/sparc64/floppy54.fs or CD3:5.4/sparc64/floppyB54.fs (depending on your machine) to a floppy and boot it with boot floppy. Refer to INSTALL.sparc64 for details.

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.

You can also write CD3:5.4/sparc64/miniroot54.fs to the swap partition on the disk and boot with boot disk:b.

If nothing works, you can boot over the network as described in INSTALL.sparc64.

OpenBSD/alpha:

Write 5.4/alpha/floppy54.fs or 5.4/alpha/floppyB54.fs (depending on your machine) to a diskette and enter boot dva0. Refer to INSTALL.alpha for more details.

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.

OpenBSD/armish:

After connecting a serial port, Thecus can boot directly from the network either tftp or http. Configure the network using fconfig, reset, then load bsd.rd, see INSTALL.armish for specific details. IOData HDL-G can only boot from an EXT-2 partition. Boot into linux and copy 'boot' and bsd.rd into the first partition on wd0 (hda1) then load and run bsd.rd, preserving the wd0i (hda1) ext2fs partition. More details are available in INSTALL.armish.

OpenBSD/hp300:

Boot over the network by following the instructions in INSTALL.hp300.

OpenBSD/hppa:

Boot over the network by following the instructions in INSTALL.hppa or the hppa platform page.

OpenBSD/landisk:

Write miniroot54.fs to the start of the CF or disk, and boot normally.

OpenBSD/loongson:

Write miniroot54.fs to a USB stick and boot bsd.rd from it or boot bsd.rd via tftp. Refer to the instructions in INSTALL.loongson for more details.

OpenBSD/luna88k:

Copy bsd.rd to a Mach or UniOS partition, and boot it from the PROM. Alternatively, you can create a bootable tape and boot from it. Refer to the instructions in INSTALL.luna88k for more details.

OpenBSD/mvme68k:

You can create a bootable installation tape or boot over the network.
The network boot requires a MVME68K BUG version that supports the NIOT and NBO debugger commands. Follow the instructions in INSTALL.mvme68k for more details.

OpenBSD/mvme88k:

You can create a bootable installation tape or boot over the network.
The network boot requires a MVME88K BUG version that supports the NIOT and NBO debugger commands. Follow the instructions in INSTALL.mvme88k for more details.

OpenBSD/octeon:

After connecting a serial port, boot bsd.rd over the network via DHCP/tftp. Refer to the instructions in INSTALL.octeon for more details.

OpenBSD/sgi:

To install on an O2, burn cd54.iso on a CD-R, put it in the CD drive of your machine and select Install System Software from the System Maintenance menu.

On other systems, or if your machine doesn't have a CD drive, you can setup a DHCP/tftp network server, and boot using "bootp()/bsd.rd.IP##" using the kernel matching your system type. Refer to the instructions in INSTALL.sgi for more details.

OpenBSD/socppc:

After connecting a serial port, boot over the network via DHCP/tftp. Refer to the instructions in INSTALL.socppc for more details.

OpenBSD/sparc:

Boot from one of the provided install ISO images, using one of the two commands listed below, depending on the version of your ROM. 

ok boot cdrom 5.4/sparc/bsd.rd
or
> b sd(0,6,0)5.4/sparc/bsd.rd

If your SPARC system does not have a CD drive, you can alternatively boot from floppy. To do so you need to write floppy54.fs to a floppy. For more information see this page. To boot from the floppy use one of the two commands listed below, depending on the version of your ROM. 

ok boot floppy
or
> b fd()

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.

If your SPARC system doesn't have a floppy drive nor a CD drive, you can either setup a bootable tape, or install via network, as told in the INSTALL.sparc file.

OpenBSD/vax:

Boot over the network via mopbooting as described in INSTALL.vax.

OpenBSD/zaurus:

Using the Linux built-in graphical ipkg installer, install the openbsd54_arm.ipk package. Reboot, then run it. Read INSTALL.zaurus for a few important details.

Notes about the source code

src.tar.gz contains a source archive starting at /usr/src. This file contains everything you need except for the kernel sources, which are in a separate archive. To extract: 

# mkdir -p /usr/src
# cd /usr/src
# tar xvfz /tmp/src.tar.gz

sys.tar.gz contains a source archive starting at /usr/src/sys. This file contains all the kernel sources you need to rebuild kernels. To extract: 

# mkdir -p /usr/src/sys
# cd /usr/src
# tar xvfz /tmp/sys.tar.gz

Both of these trees are a regular CVS checkout. Using these trees it is possible to get a head-start on using the anoncvs servers as described here. Using these files results in a much faster initial CVS update than you could expect from a fresh checkout of the full OpenBSD source tree.

How to upgrade

If you already have an OpenBSD 5.3 system, and do not want to reinstall, upgrade instructions and advice can be found in the Upgrade Guide.

Ports Tree

A ports tree archive is also provided. To extract: 

# cd /usr
# tar xvfz /tmp/ports.tar.gz

The ports/ subdirectory is a checkout of the OpenBSD ports tree. Go read the ports page if you know nothing about ports at this point. This text is not a manual of how to use ports. Rather, it is a set of notes meant to kickstart the user on the OpenBSD ports system.

The ports/ directory represents a CVS (see the manpage for cvs(1) if you aren't familiar with CVS) checkout of our ports. As with our complete source tree, our ports tree is available via AnonCVS. So, in order to keep current with it, you must make the ports/ tree available on a read-write medium and update the tree with a command like: 

# cd /usr/ports
# cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_5_4

[Of course, you must replace the server name here with a nearby anoncvs server.]

Note that most ports are available as packages on our mirrors. Updated packages for the 5.4 release will be made available if problems arise.

If you're interested in seeing a port added, would like to help out, or just would like to know more, the mailing list ports@openbsd.org is a good place to know.