Nabble - openbsd user - announce

4.6-stable ports

2009-10-21T20:05:37Z

We are happy to announce that 4.6-stable ports will soon be receiving
security updates and fixes.

Please note that this also marks the end of updates to 4.5-stable
ports, as we are supporting the presently-available release only.

OpenBSD 4.6 release, Oct 18

2009-10-18T08:38:41Z

Many people have received their 4.6 CDs in the mail by now, and we
really don't want them to be without the full package repository.

------------------------------------------------------------------------
- OpenBSD 4.6 RELEASED -------------------------------------------------

Oct 18, 2009.

We are pleased to announce the official release of OpenBSD 4.6.
This is our 26th release on CD-ROM (and 27th via FTP). We remain
proud of OpenBSD's record of more than ten years with only two remote
holes in the default install.

As in our previous releases, 4.6 provides significant improvements,
including new features, in nearly all areas of the system:

- New/extended platforms:
o mvme88k
o MVME141 and MVME165 boards are now supported.
o sgi
o SGI Octane, SGI Origin 200 and SGI Fuel systems are now supported.
o Several bugs in interrupt handling have been fixed, resulting
in significantly improved system response.
o sparc
o The bootblock load address has been moved so that larger kernels
can be loaded.
o sparc64
o Acceleration support has been added for many of the PCI frame buffer
drivers, such as the Sun PGX, PGX64 and XVR-100, and Tech Source
Raptor GFX graphics cards.

- Improved hardware support, including:
o Several new/improved drivers for sensors, including:
o The ips(4) driver now has sensor support, complementing the bio support.
o The acpithinkpad(4) driver now has temperature and fan sensor support.
o New endrun(4) driver for the EndRun Technologies timedelta sensor.
o The fins(4) driver now has support for F71806, F71862 and F71882 ICs.
o The acpitz(4) driver now shows correct decimals for temperature.
o Added radeonfb(4) to sparc64, an accelerated framebuffer for
Sun XVR-100 boards.
o Added support for RTL8103E and RTL8168DP devices in the re(4) driver.
o Added support for BCM5709/BCM5716 devices in the bnx(4) driver.
o Added support for ICH10 variants of em(4).
o Added support for VIA VX855 chipset in the viapm(4) and pciide(4) drivers.
o Added support for Intel SCH IDE to pciide(4).
o Added support for the Broadcom HT-1100 chipset in the piixpm(4) driver.
o Added support for 82574L based devices in the em(4) driver.
o Added support for VIA CX800 south bridge to the viapm(4) driver.
o A number of network drivers including bge(4), bnx(4), hme(4), iwn(4),
ix(4), msk(4), sis(4), sk(4), vr(4) and wpi(4) now make use of the
MCLGETI(9) allocator in order to reduce memory usage and increase
performance when under load or attack.
o Added support in em(4) for the newer 82575 chips.
o zyd(4) now supports devices with Airoha AL2230S radios.
o zyd(4) now works on big-endian machines
o urtw(4) now supports RTL8187B based devices.
o New otus(4) driver for Atheros AR9001U USB 802.11a/b/g/Draft-N
wireless devices.
o New berkwdt(4) driver for Berkshire Products PCI watchdog timers.
o New udl(4) driver for USB video devices.
o Support for a variety of newer models in bge(4).
o Initial version of vsw(4), a driver for the virtual network switch
found on sun4v sparc64 systems.
o Implemented machfb(4), an accelerated driver for the sparc64 PGX/PGX64
framebuffers.
o New vcc(4) and vcctty(4) drivers for the "Virtual Console Concentrator"
found on the control domain of sun4v systems.
o Implemented 64-bit FIFO modes for ciss(4) devices.
o Enabled hardware VLAN tagging and stripping on ix(4).
o Added basic support for Envy24HT chips to the envy(4) driver.
o Many improvements and updates to the isp(4) driver.
o Added support for 88E8057-based Yukon 2 Ultra 2-devices in msk(4).
o The ips(4) driver now works reliably.
o Added raptor(4), an accelerated framebuffer driver for the Tech Source
Raptor GFX cards on the sparc64 platform.
o Enabled schsio(4) on i386 and amd64 and added watchdog timer support.
o New acpivideo(4) driver for ACPI display switching and brightness control.
o Added support for the IBM ServeRAID-8k in the aac(4) driver.
o Added support for the BCM5825 and 5860/61/62 Broadcom CryptoNetX
IPSec/SSL Security processor in the ubsec(4) driver.
o Added support for AES-CBC with BCM5823-based ubsec(4) devices.
o Firmware for bnx(4) has been updated.
o Added support to fxp(4) for the 82552 MAC found on some ICH7 chipsets.
o Added support to umsm(4) for Truinstall enabled modems like the
Sierra 881U.
o Added support to pciide(4) for ICH10 SATA devices not operating in
AHCI mode.
o dc(4) now reads the MAC address from the eeprom rather than CIS.
o em(4) now correctly handles MAC addresses for dual-port 8257[56] cards.
o IPv6 receive TCP/UDP checksum offloading has been enabled for jme(4).
o IPv6 receive TCP/UDP checksum offloading has been enabled in bge(4) for
the 5755 and later chips.
o iwi(4) now associates with APs that refuse non-short slot-time capable
STAs.
o IP, TCP and UDP checksum offloading has been enabled in vr(4) for
VT6105M-based devices.
o VGA BIOS repost support has been added for amd64 and i386 platforms.

- New tools:
o Added smtpd(8), a new privilege-separated SMTP daemon.
o Imported the tmux(1) terminal multiplexer, replacing window(1).

- New functionality:
o httpd(8) can now serve files larger than 2GB in size.
o Mice with many buttons are now supported by wsmoused(8).
o New "nfsserver" and "nfsclient" views have been added to systat(1).
o Automatic partition allocation has been added to disklabel(8), with a
variety of smart heuristics.
o An undo command has been added to disklabel(8), which reverts the
label back to its previous state.
o When running in auto-mode, sysmerge(8) will now install binary files
from X sets automatically.
o sysmerge(8) now creates a report summary file in the work directory.
o httpd(8) now drops privileges to www/www rather than nobody/nogroup
if the User/Group entries are not present within the configuration file.
o ELF based platforms now generate ELF core dumps and gdb(1) is now able
to read ELF core dumps.
o Additional diff options have been added to opencvs(1).
o When sendbug(1) is run as root, the pcidump(8) and acpidump(8) output
is included.
o Support for audible ping(8) and ping6(8) has been added.
o ftpd(8) now logs both the remote IP and remote hostname when receiving
a new connection.
o relayd(8) now allows both UDP and TCP redirections.
o SSL sessions are now maintained by relayd(8) for each checked host,
resulting in subsequent checks being lighter and faster on the server.
o Added support to relayd(8) for client-side TCP connections from relays.
o Added support to relayd(8) for specifying a CA file to verify SSL server
certificates when connecting as a client from relays.

- pf(4) improvements:
o Enabled pf(4) by default in the rc.conf(8).
o Removed pf(4) scrub rules, and only do one kind of packet reassembly.
Rulesets with scrub rules need to be modified because of this.
o Regular rules can now have per-rule scrub options.
o Added new "match" keyword which only applies rule options but does
not change the current pass/block state.
o Make all pf(4) operations transactional to improve atomicity of reloads.
o Stricter pf(4) checking for ICMP and ICMPv6 packets.
o Various improvements to pfsync(4) to lower sync traffic bandwidth and
optionally allow active-active firewall setups.
o Fix pf(4) scrub max-mss for IPv6 traffic.

- softraid(4) improvements:
o Rebuild support has been added and RAID 1 volumes can now be rebuilt.
o Boot time assembly has been significantly improved, with volume and
chunk ordering now being respected. Duplicated chunks and version
mismatches are also handled gracefully.
o Volumes with missing members are now brought online.

- OpenBGPD, OpenOSPFD and other routing daemon improvements:
o In bgpd(8), rework most of the RDE to allow multiple RIBs.
It is possible to filter per-RIB and attach neighbors to a specific RIB.
o Added an option to bgpd(8) to change the "connect-retry" timer.
o Allow bgpd.conf(5) and bgpctl(8) to contain 32-bit ASN numbers written in
ASPLAIN format.
o Fix bgpd(8) to correctly encode MP unreachable NLRI so IPv6 prefixes get
removed correctly.
o Changed the behaviour of "redistribute default" for ospfd(8) and ripd(8).
A default route has to be present in the FIB to be correctly advertised.
o Make ospfd(8) and ripd(8) track reject and blackhole routes and allow
them to be redistributed even if pointing to 127.0.0.1.
o Allow an alternate control socket to be specified for ospfd(8).
o ospfd(8) can now be bound to an alternate routing domain.
o Fix ospfd(8) route metric for "redistribute default".
o Initial version of ldpctl(8) and ldpd(8), a label distribution protocol
daemon for mpls.
o Make dvmrpd(8) RDE aware of multicast group members per interface.
o Added support for pruning in dvmrpd(8).

- Generic Network-Stack improvements:
o Support for virtual routing and firewalling with the addition of routing
domains.
o Added support for ifconfig(8) to bind an interface to a routing domain.
o Added support to ping(8), traceroute(8), arp(8), nc(1) and telnet(1) to
specify which routing domain to use.
o Allow ifconfig(8) to turn off IPv6 completely for an interface and
make rtsold(8) turn on inet6 on the interface.
o Routes track the interface link state.
o route(8) flush accepts "-iface" or "-priority" to only flush routes
matching these conditions.
o Multiple dhclients can now coexist without causing mayhem.
o Make wireless interfaces have an interface priority of 4 by default.
Makes them less preferred then wired interfaces.
o Do not accept IPv4 ICMP redirects by default.
o Added the MAC address to the log entries in dhclient(8).
o Make systat(1) show interface description names in the interface view,
and add new NFS server and client views.
o Make tun(4) emulate link state depending on the open and close of the
device fd.
o Use pf state-table information to speed up decision on whether a packet
is to be delivered locally or forwarded.
o More routing socket checks added to make userland applications more
resilient to kernel changes.

- Install/Upgrade process changes:
o The installer has almost been rewritten, primarily with a focus on
simplifying the installation process.
o Automatic disk layout can now be used during installation, allowing for
simple single-disk installs.
o VLAN support is now available in some installation media.
o A standard user account can now be created during the install process.

- OpenSSH 5.3:
o Do not limit home directory paths to 256 characters.
o Several minor documentation and correctness fixes.

- Over 5,800 ports, minor robustness improvements in package tools.
o Many pre-built packages for each architecture:
i386: 5606 sparc64: 5413 alpha: 5346 sh: 1261
amd64: 5544 powerpc: 5427 sparc: 3711 mips64: 3443
arm: 5291 hppa: 4790 vax: 1785

- As usual, steady improvements in manual pages and other documentation.

- The system includes the following major components from outside
suppliers:
o Xenocara (based on X.Org 7.4 + patches, freetype 2.3.9,
fontconfig 2.6.0, Mesa 7.4.2, xterm 243 and more)
o Gcc 2.95.3 (+ patches) and 3.3.5 (+ patches)
o Perl 5.10.0 (+ patches)
o Our improved and secured version of Apache 1.3, with SSL/TLS
and DSO support
o OpenSSL 0.9.8k (+ patches)
o Groff 1.15
o Sendmail 8.14.3, with libmilter
o Bind 9.4.2-P2 (+ patches)
o Lynx 2.8.6rel.5 with HTTPS and IPv6 support (+ patches)
o Sudo 1.7.2
o Ncurses 5.2
o Latest KAME IPv6
o Heimdal 0.7.2 (+ patches)
o Arla 0.35.7
o Binutils 2.15 (+ patches)
o Gdb 6.3 (+ patches)

If you'd like to see a list of what has changed between OpenBSD 4.5
and 4.6, look at

http://www.OpenBSD.org/plus46.html

Even though the list is a summary of the most important changes
made to OpenBSD, it still is a very very long list.

------------------------------------------------------------------------
- SECURITY AND ERRATA --------------------------------------------------

we provide patches for known security threats and other important
issues discovered after each CD release. As usual, between the
creation of the OpenBSD 4.6 FTP/CD-ROM binaries and the actual 4.6
release date, our team found and fixed some new reliability problems
(note: most are minor and in subsystems that are not enabled by
default). Our continued research into security means we will find
new security problems -- and we always provide patches as soon as
possible. Therefore, we advise regular visits to

http://www.OpenBSD.org/security.html
and
http://www.OpenBSD.org/errata.html

Security patch announcements are sent to the security-announce@...
mailing list. For information on OpenBSD mailing lists, please see:

http://www.OpenBSD.org/mail.html

------------------------------------------------------------------------
- CD-ROM SALES ---------------------------------------------------------

OpenBSD 4.6 is also available on CD-ROM. The 3-CD set costs $50 CDN and
is available via mail order and from a number of contacts around the
world. The set includes a colourful booklet which carefully explains the
installation of OpenBSD. A new set of cute little stickers is also
included (sorry, but our FTP mirror sites do not support STP, the Sticker
Transfer Protocol). As an added bonus, the second CD contains an audio
track, a song entitled "Planet of the Users". MP3 and OGG versions of
the audio track can be found on the first CD.

Lyrics (and an explanation) for the songs may be found at:

http://www.OpenBSD.org/lyrics.html#46

Profits from CD sales are the primary income source for the OpenBSD
project -- in essence selling these CD-ROM units ensures that OpenBSD
will continue to make another release six months from now.

The OpenBSD 4.6 CD-ROMs are bootable on the following four platforms:

o i386
o amd64
o macppc
o sparc64

(Other platforms must boot from floppy, network, or other method).

For more information on ordering CD-ROMs, see:

http://www.OpenBSD.org/orders.html

The above web page lists a number of places where OpenBSD CD-ROMs
can be purchased from. For our default mail order, go directly to:

https://https.OpenBSD.org/cgi-bin/order

All of our developers strongly urge you to buy a CD-ROM and support
our future efforts. Additionally, donations to the project are
highly appreciated, as described in more detail at:

http://www.OpenBSD.org/goals.html#funding

------------------------------------------------------------------------
- OPENBSD FOUNDATION ---------------------------------------------------

For those unable to make their contributions as straightforward gifts,
the OpenBSD Foundation (http://www.openbsdfoundation.org) is a Canadian
not-for-profit corporation that can accept larger contributions and
issue receipts. In some situations, their receipt may qualify as a
business expense writeoff, so this is certainly a consideration for
some organizations or businesses. There may also be exposure benefits
since the Foundation may be interested in participating in press releases.
In turn, the Foundation then uses these contributions to assist OpenBSD's
infrastructure needs. Contact the foundation directors at
directors@... for more information.

------------------------------------------------------------------------
- T-SHIRT SALES --------------------------------------------------------

The OpenBSD distribution companies also sell tshirts and polo shirts.
And our users like them too. We have a variety of shirts available,
with the new and old designs, from our web ordering system at, as
described above.

The OpenBSD 4.6 t-shirts are available now. We also sell our older
shirts, as well as a selection of OpenSSH t-shirts.

------------------------------------------------------------------------
- FTP INSTALLS ---------------------------------------------------------

If you choose not to buy an OpenBSD CD-ROM, OpenBSD can be easily
installed via FTP. Typically you need a single small piece of boot
media (e.g., a boot floppy) and then the rest of the files can be
installed from a number of locations, including directly off the
Internet. Follow this simple set of instructions to ensure that
you find all of the documentation you will need while performing
an install via FTP. With the CD-ROMs, the necessary documentation
is easier to find.

1) Read either of the following two files for a list of ftp
mirrors which provide OpenBSD, then choose one near you:

http://www.OpenBSD.org/ftp.html
ftp://ftp.OpenBSD.org/pub/OpenBSD/4.6/ftplist

As of Oct 1, 2009, the following ftp mirror sites have the 4.6 release:

ftp://ftp.stacken.kth.se/pub/OpenBSD/4.6/ Sweden
ftp://ftp2.usa.openbsd.org/pub/OpenBSD/4.6/ NYC, USA
ftp://ftp3.usa.openbsd.org/pub/OpenBSD/4.6/ CO, USA
ftp://ftp5.usa.openbsd.org/pub/OpenBSD/4.6/ CA, USA
ftp://rt.fm/pub/OpenBSD/4.6/ IL, USA

The release is also available at the master site:

ftp://ftp.openbsd.org/pub/OpenBSD/4.6/ Alberta, Canada

However it is strongly suggested you use a mirror.

Other mirror sites may take a day or two to update.

2) Connect to that ftp mirror site and go into the directory
pub/OpenBSD/4.6/ which contains these files and directories.
This is a list of what you will see:

ANNOUNCEMENT armish/ mvme68k/ sparc64/
Changelogs/ ftplist mvme88k/ src.tar.gz
HARDWARE hp300/ packages/ sys.tar.gz
PACKAGES hppa/ ports.tar.gz tools/
PORTS i386/ root.mail vax/
README landisk/ sgi/ xenocara.tar.gz
alpha/ mac68k/ socppc/ zaurus/
amd64/ macppc/ sparc/

It is quite likely that you will want at LEAST the following
files which apply to all the architectures OpenBSD supports.

README - generic README
HARDWARE - list of hardware we support
PORTS - description of our "ports" tree
PACKAGES - description of pre-compiled packages
root.mail - a copy of root's mail at initial login.
(This is really worthwhile reading).

3) Read the README file. It is short, and a quick read will make
sure you understand what else you need to fetch.

4) Next, go into the directory that applies to your architecture,
for example, i386. This is a list of what you will see:

INSTALL.i386 cd46.iso floppyB46.fs pxeboot*
INSTALL.linux cdboot* floppyC46.fs xbase46.tgz
MD5 cdbr* game46.tgz xetc46.tgz
base46.tgz cdemu46.iso index.txt xfont46.tgz
bsd* comp46.tgz install46.iso xserv46.tgz
bsd.mp* etc46.tgz man46.tgz xshare46.tgz
bsd.rd* floppy46.fs misc46.tgz

If you are new to OpenBSD, fetch _at least_ the file INSTALL.i386
and the appropriate floppy*.fs or install46.iso files. Consult the
INSTALL.i386 file if you don't know which of the floppy images
you need (or simply fetch all of them).

If you use the install46.iso file (roughly 200MB in size), then you
do not need the various *.tgz files since they are contained on that
one-step ISO-format install CD.

5) If you are an expert, follow the instructions in the file called
README; otherwise, use the more complete instructions in the
file called INSTALL.i386. INSTALL.i386 may tell you that you
need to fetch other files.

6) Just in case, take a peek at:

http://www.OpenBSD.org/errata.html

This is the page where we talk about the mistakes we made while
creating the 4.6 release, or the significant bugs we fixed
post-release which we think our users should have fixes for.
Patches and workarounds are clearly described there.

Note: If you end up needing to write a raw floppy using Windows,
you can use "fdimage.exe" located in the pub/OpenBSD/4.6/tools
directory to do so.

------------------------------------------------------------------------
- X.ORG FOR MOST ARCHITECTURES -----------------------------------------

X.Org has been integrated more closely into the system. This release
contains X.Org 7.4. Most of our architectures ship with X.Org, including
amd64, sparc, sparc64 and macppc. During installation, you can install
X.Org quite easily. Be sure to try out xdm(1) and see how we have
customized it for OpenBSD.

------------------------------------------------------------------------
- PORTS TREE -----------------------------------------------------------

The OpenBSD ports tree contains automated instructions for building
third party software. The software has been verified to build and
run on the various OpenBSD architectures. The 4.6 ports collection,
including many of the distribution files, is included on the 3-CD
set. Please see the PORTS file for more information.

Note: some of the most popular ports, e.g., the Apache web server
and several X applications, come standard with OpenBSD. Also, many
popular ports have been pre-compiled for those who do not desire
to build their own binaries (see BINARY PACKAGES, below).

------------------------------------------------------------------------
- BINARY PACKAGES WE PROVIDE -------------------------------------------

A large number of binary packages are provided. Please see the PACKAGES
file (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.6/PACKAGES) for more details.

------------------------------------------------------------------------
- SYSTEM SOURCE CODE ---------------------------------------------------

The CD-ROMs contain source code for all the subsystems explained
above, and the README (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.6/README)
file explains how to deal with these source files. For those who
are doing an FTP install, the source code for all four subsystems
can be found in the pub/OpenBSD/4.6/ directory:

xenocara.tar.gz ports.tar.gz src.tar.gz sys.tar.gz

------------------------------------------------------------------------
- THANKS ---------------------------------------------------------------

OpenBSD 4.6 includes artwork and CD artistic layout by Ty Semaka,
who also arranged an audio track on the OpenBSD 4.6 CD set. Ports
tree and package building by Jasper Lievisse Adriaanse, Michael Erdely,
Simon Bertrang, Stuart Henderson, Antoine Jacoutot, Robert Nagy,
Nikolay Sturm, and Christian Weisgerber. System builds by Theo de Raadt,
Mark Kettenis, and Miod Vallat. X11 builds by Todd Fries and Miod Vallat.
ISO-9660 filesystem layout by Theo de Raadt.

We would like to thank all of the people who sent in bug reports, bug
fixes, donation cheques, and hardware that we use. We would also like
to thank those who pre-ordered the 4.6 CD-ROM or bought our previous
CD-ROMs. Those who did not support us financially have still helped
us with our goal of improving the quality of the software.

Our developers are:

Alexander Bluhm, Alexander Hall, Alexander von Gernler,
Alexander Yurchenko, Alexandre Ratchov, Alexey Vatchenko,
Anders Magnusson, Andreas Gunnarsson, Anil Madhavapeddy,
Antoine Jacoutot, Ariane van der Steldt, Artur Grabowski,
Austin Hook, Benoit Lecocq, Bernd Ahlers, Bob Beck, Bret Lambert,
Can Erkin Acar, Chad Loder, Charles Longeau, Chris Cappuccio,
Chris Kuethe, Christian Weisgerber, Claudio Jeker,
Constantine A. Murenin, Dale Rahn, Damien Bergamini, Damien Miller,
Darren Tucker, David Gwynne, David Hill, David Krause, Eric Faurot,
Esben Norby, Federico G. Schwindt, Felix Kronlage, Gilles Chehade,
Giovanni Bechis, Gordon Willem Klok, Hans-Joerg Hoexer,
Henning Brauer, Ian Darwin, Igor Sobrado, Ingo Schwarze,
Jacek Masiulaniec, Jacob Meuser, Jakob Schlyter, Janne Johansson,
Jared Yanovich, Jason Dixon, Jason George, Jason McIntyre,
Jason Meltzer, Jasper Lievisse Adriaanse, Jim Razmus II, Joel Sing,
Joerg Goltermann, Johan Mson Lindman, Jolan Luff, Jonathan Gray,
Jordan Hargrave, Joris Vink, joshua stein, Kenneth R Westerback,
Kevin Lo, Kevin Steves, Kjell Wooding, Kurt Miller, Landry Breuil,
Laurent Fanis, Marc Espie, Marco Peereboom, Marco Pfatschbacher,
Marco S Hyman, Marcus Glocker, Mark Kettenis, Mark Uemura,
Markus Friedl, Martin Reindl, Martynas Venckus,
Mathieu Sauve-Frankel, Mats O Jansson, Matthias Kilian,
Matthieu Herrb, Michael Erdely, Michael Knudsen, Michele Marchetto,
Mike Larkin, Miod Vallat, Moritz Grimm, Moritz Jodeit,
Nicholas Marriott, Nick Holland, Nikolay Sturm, Okan Demirmen,
Oleg Safiullin, Otto Moerbeek, Owain Ainsworth, Paul de Weerd,
Paul Irofti, Peter Hessler, Peter Stromberg, Peter Valchev,
Philip Guenther, Pierre-Emmanuel Andre, Pierre-Yves Ritschard,
Rainer Giedat, Ray Lai, Reyk Floeter, Robert Nagy, Rui Reis,
Ryan Thomas McBride, Simon Bertrang, Stefan Kempf, Steven Mestdagh,
Stuart Henderson, Ted Unangst, Theo de Raadt, Thordur I. Bjornsson,
Tobias Stoeckmann, Tobias Weingartner, Todd C. Miller, Todd Fries,
Will Maier, William Yodlowsky, Xavier Santolaria, Yojiro Uo

Announce: OpenSSH 5.3 released

2009-10-01T06:46:18Z

OpenSSH 5.3 has just been released. It will be available from the
mirrors listed at http://www.openssh.com/ shortly.

OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0
implementation and includes sftp client and server support.

This release marks the 10th anniversary of the OpenSSH project.
We would like to thank the OpenSSH community for their support,
especially those who will continue to contribute code or patches,
report bugs, test snapshots or donate to the project during the
next 10 years. More information on donations may be found at:
http://www.openssh.com/donations.html

This is a bugfix release, no new features have been added.

Changes since OpenSSH 5.2
=========================

General Bugfixes:

* Do not limit home directory paths to 256 characters. bz#1615

* Several minor documentation and correctness fixes.

Portable OpenSSH Bugfixes:

* This release removes for support for very old versions of Cygwin and
for Windows 95/98/ME

* Move the deletion of PAM credentials on logout to after the session
close. bz#1534

* Make PrintLastLog work on AIX. bz#1595

* Avoid compile errors on FreeBSD from conflicts in glob.h. bz#1634

* Delay dropping of root privileges on AIX so chroot and pam_open_session
work correctly. bz#1249 and bz#1567

* Increase client IO buffer on Cygwin to 64K, realising a significant
performance improvement.

* Roll back bz#1241 (better handling for expired passwords on Tru64).
The change broke password logins on some configurations.

* Accept ENOSYS as a fallback error when attempting atomic
rename(). bz#1535

* Fix passing of variables to recursive make(1) invocations on Solaris.
bz#1505

* Skip the tcgetattr call on the pty master on Solaris, since it never
succeeds and can hang if large amounts of data is sent to the slave
(eg a copy-paste). bz#1528

* Fix detection of krb5-config. bz#1639

* Fix test for server-assigned remote forwarding port for non-root users.
bz#1578

* Fix detection of libresolv on OSX 10.6.

Checksums:
==========

- SHA1 (openssh-5.3.tar.gz) = f1b9a280565e916c1f84fd4d944313ec926242a2
- SHA1 (openssh-5.3p1.tar.gz) = d411fde2584ef6022187f565360b2c63a05602b5

Reporting Bugs:
===============

- Please read http://www.openssh.com/report.html
Security bugs should be reported directly to openssh@...

OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and
Ben Lindstrom.

Reclaim Bank Charges: Contact us!

2009-09-20T14:24:19Z

If you have trouble seeing the images below, click here

	Have you been mis-sold a payment protection policy on a loan? Have you been subject to unfair credit card charges? Yes? then we have some good news!

For year’s the banks have a got away with your money - now it’s time you to get it back!

Join the thousands of people who have already claimed back their money.

With our NO WIN, NO FEE service you can be sure that making a claim is quick and easy and with absolutely no upfront costs. As long as you have taken your loan out in the last 6 years we can make a claim for you. Apply online now by clicking here or on one of the buttons below.


	MIS-SOLD A PAYMENT PROTECTION POLICY... Our Quick Apply service should take less a minute to complete and we will send you a Claim Pack in the post. Once you have returned the Claim Pack you can sit back knowing our expert team is on your side and will be working to get you the best possible compensation.		VICTIM OF UNFAIR CREDIT CARD CHARGES... You could be owed £1000’s on compensation. Don’t delay any further - click above and start your claim today!

OpenBSD 4.5 released, May 1, 2009

2009-04-30T10:07:41Z

------------------------------------------------------------------------
- OpenBSD 4.5 RELEASED -------------------------------------------------

May 1, 2009.

We are pleased to announce the official release of OpenBSD 4.5.
This is our 25th release on CD-ROM (and 26th via FTP). We remain
proud of OpenBSD's record of more than ten years with only two remote
holes in the default install.

As in our previous releases, 4.5 provides significant improvements,
including new features, in nearly all areas of the system:

- New/extended platforms:
o Initial ports to the xscale based gumstix platform and the ARM
based OpenMoko
o OpenBSD/sparc64
o New vdsk(4) and vnet(4) drivers provide support for virtual
I/O between logical domains on Sun's CoolThreads servers,
including UltraSPARC T2+ machines.
o Workstations and laptops with UltraSPARC IIe CPUs can now scale
down the CPU frequency to save power.

- Improved hardware support, including:
o Several new/improved drivers for sensors, including:
o The cac(4) driver now has bio and sensor support.
o The mpi(4) driver now has bio and sensor support.
o New gpiodcf(4) driver for DCF77/HBG timedelta sensors
through GPIO pins.
o New schsio(4) driver for SMSC SCH311x LPC Super I/O devices.
o The it(4) driver now supports IT8720F chips.
o The it(4) driver now supports FAN4 and FAN5 sensors for
IT8716F/IT8718F/IT8720F/IT8726F chips.
o The owtemp(4) driver now supports Maxim/Dallas DS18B20 and
DS1822 temperature sensors.
o The km(4) driver now supports AMD Family 11h
processors (Turion X2 Ultra et al).
o The lm(4) driver now supports W83627DHG attachment on the ICC bus.
o The lmenv(4) driver now has better support for the fan sensors
on lm81, adm9240 and ds1780 chips.
o The sdtemp(4) driver now supports ST STTS424 chips.
o The em(4) driver now supports ICH9 IGP M and IGP M AMT chips.
o The sdmmc(4) driver now supports SDHC cards.
o The msk(4) driver now supports Yukon-2 FE+ (88E8040, 88E8042) based
devices.
o The iwn(4) driver now supports Intel WiFi Link 5100/5300 devices.
o The wpi(4) and iwn(4) drivers now support hardware CCMP cryptography.
o The ath(4) driver now has WPA-PSK support.
o age(4), a driver for Attansic L1 gigabit Ethernet devices was added.
o ale(4), a driver for Atheros AR81xx (aka Attansic L1E) Ethernet
devices was added.
o mos(4), a driver for Moschip MCS7730/7830 10/100 USB Ethernet
devices was added.
o jme(4), a driver for JMicron JMC250/JMC260 10/100 and Gigabit
Ethernet devices was added.
o run(4), a driver for Ralink USB IEEE 802.11a/b/g/Draft-N devices
was added.
o auacer(4), a driver for Acer Labs M5455 audio devices was added.
o ifb(4), a driver for Sun Expert3D, Expert3D-Lite, XVR-500, XVR-600
and XVR-1200 framebuffers (accelerated).
o wildcatfb(4), an X driver for Sun Expert3D, Expert3D-Lite, XVR-500,
XVR-600 and XVR-1200 framebuffers (unaccelerated).
o sunffb(4), an accelerated X driver for Sun Creator, Creator 3D and
Elite 3D framebuffers.
o vdsk(4), a driver for virtual disks of sun4v logical domains.
o vnet(4), a driver for virtual network adapters of sun4v logical domains.
o vrng(4), a driver for the random number generator on Sun
UltraSPARC T2/T2+ CPUs.
o The vcons(4) driver is now interrupt driven.
o ips(4), a driver for IBM SATA/SCSI ServeRAID controllers was added.
o udfu(4), a driver for device firmware upgrade (DFU) was added.
o Many improvements were made to the acpi(4) subsystem.
o The umsm(4) driver supports several new EVDO/UMTS devices.
o The mfi(4) driver now supports the next generation of
MegaRAID SAS controllers.
o New vsbic(4) driver for the MVME327A SCSI and floppy controller
on mvme88k machines.
o The re(4) driver, now supports 8168D/8111D-based devices.
o The ehci(4) driver now supports isochronous transfers.
o S/PDIF output support has been added to the ac97(4), auich(4),
auvia(4) and azalia(4) drivers.
o azalia(4) mixer has been clarified and simplified, support for 20-bit
and 24-bit encodings has been added.
o The gbe(4) frame buffer driver now supports acceleration.

- New tools:
o ypldap(8), an YP server using LDAP as a backend.
o xcompmgr(1) was added to xenocara.

- New functionality:
o The libc resolver(3) may now be forced to perform lookups by TCP
only using a new resolv.conf(5) option. The nameserver declaration
in resolv.conf(5) has also been extended to allow specification
of non-default nameserver ports.
o apropos(1) has two new options (-S and -s) to allow searching by
machine architecture and manual section.
o aucat(1) now has audio server capability. Audio devices can be
shared between multiple applications. Applications can run natively
on fixed sample rate devices or on devices with unusual encodings.
Multi-channel audio devices can be split into smaller independent
subdevices.
o aucat(1) now has a deviceless mode, in which it can be used as a
general purpose audio file format conversion utility (to mix,
demultiplex, resample or reencode files).
o ifconfig(8) can now list channels supported by an IEEE 802.11 device.
o New views were added to systat(8): malloc, bucket and pool. Improvements
were made to existing views.
o vnconfig(8) can now create devices with arbitrary geometry with the
new -t option.
o FFS filesystems are now supported on most devices, e.g. CD's, that have
sector sizes other than 512 bytes.
o Disklabels are now correctly placed and found on most devices,
e.g. CD's, that have sector sizes other than 512 bytes.

- Assorted improvements and code cleanup:
o malloc(3) has gained new attack mitigation measures; critical
bookkeeping structures are protected at runtime using mprotect(2)
and allocated at random addresses where possible.
o A new version of the gdtoa code has been integrated, bringing
better C99 support to printf(3) and friends.
o Vastly improved C99 support in libm, including complex math support.

- Install/Upgrade process changes:
o crunchgen(1) and crunchide(1) have been merged into crunchgen(8),
which is now built and installed by default.
o mksuncd(1) now lives in base and is installed by default.
o CD-ROM installs are now supported on SGI.
o Accept initial root passwords containing backslash characters.
o Install now allows multiple interfaces to be configured with dhcp(8).
o Upgrades now use the minimal protocols(5) and services(5) files
provided on the install media.
o The install media no longer contain a disktab(5) file.
o Serial console speed is correctly determined on macppc.

- OpenSSH 5.2:
o New features:
o Added an option to ssh(1) to force logging to syslog rather
than stderr.
o The sshd_config(5) ForceCommand directive now accepts commandline
arguments for the internal-sftp server.
o The ssh(1) ~C escape commandline now support runtime creation of
dynamic port forwards.
o Support the SOCKS4A protocol in ssh(1) dynamic forwards.
o Support remote port forwarding with a listen port of '0'.
o sshd(8) now supports setting PermitEmptyPasswords and
AllowAgentForwarding in Match blocks.
o The following significant bugs have been fixed in this release:
o Repair a ssh(1) crash introduced in openssh-5.1 when the
client is sent a zero-length banner.
o The eow@... and no-more-sessions@... protocol
extensions are now only sent to peers that identify
themselves as OpenSSH.
o Avoid printing "Non-public channel" warnings in sshd(8), since ssh(1)
has sent incorrect channel numbers since ~2004; make ssh(1) send the
correct channel number for SSH2_MSG_CHANNEL_SUCCESS and
SSH2_MSG_CHANNEL_FAILURE.
o Avoid double-free in ssh(1) ~C escape -L handler.
o Correct fail-on-error behaviour in sftp(1) batchmode for remote
stat operations.
o Avoid hang in ssh(1) when attempting to connect to a server that
has MaxSessions set to zero.

- Over 5,500 ports, minor robustness improvements in package tools.
o Many pre-built packages for each architecture:
i386: 5379 sparc64: 5174 alpha: 5132 sh: 1543
amd64: 5312 powerpc: 5162 sparc: 2651 mips64: 3278
arm: 4120 hppa: 4689 vax: 1718
o Highlights include:
o Gnome 2.24.3.
o GNUstep 1.18.0.
o KDE 3.5.10.
o Mozilla Firefox 3.0.6.
o Mozilla Thunderbird 2.0.0.19.
o MySQL 5.0.77.
o OpenOffice.org 2.4.2 and 3.0.1.
o PostgreSQL 8.3.6.
o Xfce 4.4.3.
o OpenArena 0.8.1 (only for amd64, i386 and macppc)

- As usual, steady improvements in manual pages and other documentation.

- The system includes the following major components from outside
suppliers:
o Xenocara (based on X.Org 7.4 + patches, freetype 2.3.7,
fontconfig 2.4.2, Mesa 7.2, xterm 239 and more)
o Gcc 2.95.3 (+ patches) and 3.3.5 (+ patches)
o Perl 5.10.0 (+ patches)
o Our improved and secured version of Apache 1.3, with SSL/TLS
and DSO support
o OpenSSL 0.9.8j (+ patches)
o Groff 1.15
o Sendmail 8.14.3, with libmilter
o Bind 9.4.2-P2 (+ patches)
o Lynx 2.8.5rel.4 with HTTPS and IPv6 support (+ patches)
o Sudo 1.7
o Ncurses 5.2
o Latest KAME IPv6
o Heimdal 0.7.2 (+ patches)
o Arla 0.35.7
o Binutils 2.15 (+ patches)
o Gdb 6.3 (+ patches)

If you'd like to see a list of what has changed between OpenBSD 4.4
and 4.5, look at

http://www.OpenBSD.org/plus45.html

Even though the list is a summary of the most important changes
made to OpenBSD, it still is a very very long list.

------------------------------------------------------------------------
- SECURITY AND ERRATA --------------------------------------------------

We provide patches for known security threats and other important
issues discovered after each CD release. As usual, between the
creation of the OpenBSD 4.5 FTP/CD-ROM binaries and the actual 4.5
release date, our team found and fixed some new reliability problems
(note: most are minor and in subsystems that are not enabled by
default). Our continued research into security means we will find
new security problems -- and we always provide patches as soon as
possible. Therefore, we advise regular visits to

http://www.OpenBSD.org/security.html
and
http://www.OpenBSD.org/errata.html

Security patch announcements are sent to the security-announce@...
mailing list. For information on OpenBSD mailing lists, please see:

http://www.OpenBSD.org/mail.html

------------------------------------------------------------------------
- CD-ROM SALES ---------------------------------------------------------

OpenBSD 4.5 is also available on CD-ROM. The 3-CD set costs $50 CDN and
is available via mail order and from a number of contacts around the
world. The set includes a colourful booklet which carefully explains the
installation of OpenBSD. A new set of cute little stickers is also
included (sorry, but our FTP mirror sites do not support STP, the Sticker
Transfer Protocol). As an added bonus, the second CD contains an audio
track, a song entitled "Games". MP3 and OGG versions of the audio track
can be found on the first CD.

Lyrics (and an explanation) for the songs may be found at:

http://www.OpenBSD.org/lyrics.html#45

Profits from CD sales are the primary income source for the OpenBSD
project -- in essence selling these CD-ROM units ensures that OpenBSD
will continue to make another release six months from now.

The OpenBSD 4.5 CD-ROMs are bootable on the following four platforms:

o i386
o amd64
o macppc
o sparc64

(Other platforms must boot from floppy, network, or other method).

For more information on ordering CD-ROMs, see:

http://www.OpenBSD.org/orders.html

The above web page lists a number of places where OpenBSD CD-ROMs
can be purchased from. For our default mail order, go directly to:

https://https.OpenBSD.org/cgi-bin/order

All of our developers strongly urge you to buy a CD-ROM and support
our future efforts. Additionally, donations to the project are
highly appreciated, as described in more detail at:

http://www.OpenBSD.org/goals.html#funding

------------------------------------------------------------------------
- OPENBSD FOUNDATION ---------------------------------------------------

For those unable to make their contributions as straightforward gifts,
the OpenBSD Foundation (http://www.openbsdfoundation.org) is a Canadian
not-for-profit corporation that can accept larger contributions and
issue receipts. In some situations, their receipt may qualify as a
business expense writeoff, so this is certainly a consideration for
some organizations or businesses. There may also be exposure benefits
since the Foundation may be interested in participating in press releases.
In turn, the Foundation then uses these contributions to assist OpenBSD's
infrastructure needs. Contact the foundation directors at
directors@... for more information.

------------------------------------------------------------------------
- T-SHIRT SALES --------------------------------------------------------

The OpenBSD distribution companies also sell tshirts and polo shirts.
And our users like them too. We have a variety of shirts available,
with the new and old designs, from our web ordering system at, as
described above.

The OpenBSD 4.5 t-shirts are available now. We also sell our older
shirts, as well as a selection of OpenSSH t-shirts.

------------------------------------------------------------------------
- FTP INSTALLS ---------------------------------------------------------

If you choose not to buy an OpenBSD CD-ROM, OpenBSD can be easily
installed via FTP. Typically you need a single small piece of boot
media (e.g., a boot floppy) and then the rest of the files can be
installed from a number of locations, including directly off the
Internet. Follow this simple set of instructions to ensure that
you find all of the documentation you will need while performing
an install via FTP. With the CD-ROMs, the necessary documentation
is easier to find.

1) Read either of the following two files for a list of ftp
mirrors which provide OpenBSD, then choose one near you:

http://www.OpenBSD.org/ftp.html
ftp://ftp.OpenBSD.org/pub/OpenBSD/4.5/ftplist

As of May 1, 2009, the following ftp mirror sites have the 4.5 release:

ftp://ftp.stacken.kth.se/pub/OpenBSD/4.5/ Sweden
ftp://ftp2.usa.openbsd.org/pub/OpenBSD/4.5/ NYC, USA
ftp://ftp3.usa.openbsd.org/pub/OpenBSD/4.5/ CO, USA
ftp://ftp5.usa.openbsd.org/pub/OpenBSD/4.5/ CA, USA
ftp://rt.fm/pub/OpenBSD/4.5/ IL, USA

The release is also available at the master site:

ftp://ftp.openbsd.org/pub/OpenBSD/4.5/ Alberta, Canada

However it is strongly suggested you use a mirror.

Other mirror sites may take a day or two to update.

2) Connect to that ftp mirror site and go into the directory
pub/OpenBSD/4.5/ which contains these files and directories.
This is a list of what you will see:

ANNOUNCEMENT amd64/ macppc/ sys.tar.gz
Changelogs/ armish/ mvme68k/ tools/
HARDWARE ftplist packages/ vax/
PACKAGES hp300/ ports.tar.gz xenocara.tar.gz
PORTS hppa/ root.mail zaurus/
README i386/ sparc/
SIZES landisk/ sparc64/
alpha/ mac68k/ src.tar.gz

It is quite likely that you will want at LEAST the following
files which apply to all the architectures OpenBSD supports.

README - generic README
HARDWARE - list of hardware we support
PORTS - description of our "ports" tree
PACKAGES - description of pre-compiled packages
root.mail - a copy of root's mail at initial login.
(This is really worthwhile reading).

3) Read the README file. It is short, and a quick read will make
sure you understand what else you need to fetch.

4) Next, go into the directory that applies to your architecture,
for example, i386. This is a list of what you will see:

INSTALL.i386 cd45.iso floppyB45.fs pxeboot*
INSTALL.linux cdboot* floppyC45.fs xbase45.tgz
MD5 cdbr* game45.tgz xetc45.tgz
base45.tgz cdemu45.iso index.txt xfont45.tgz
bsd* comp45.tgz install45.iso xserv45.tgz
bsd.mp* etc45.tgz man45.tgz xshare45.tgz
bsd.rd* floppy45.fs misc45.tgz

If you are new to OpenBSD, fetch _at least_ the file INSTALL.i386
and the appropriate floppy*.fs or install45.iso files. Consult the
INSTALL.i386 file if you don't know which of the floppy images
you need (or simply fetch all of them).

If you use the install45.iso file (roughly 200MB in size), then you
do not need the various *.tgz files since they are contained on that
one-step ISO-format install CD.

5) If you are an expert, follow the instructions in the file called
README; otherwise, use the more complete instructions in the
file called INSTALL.i386. INSTALL.i386 may tell you that you
need to fetch other files.

6) Just in case, take a peek at:

http://www.OpenBSD.org/errata.html

This is the page where we talk about the mistakes we made while
creating the 4.5 release, or the significant bugs we fixed
post-release which we think our users should have fixes for.
Patches and workarounds are clearly described there.

Note: If you end up needing to write a raw floppy using Windows,
you can use "fdimage.exe" located in the pub/OpenBSD/4.5/tools
directory to do so.

------------------------------------------------------------------------
- X.ORG FOR MOST ARCHITECTURES -----------------------------------------

X.Org has been integrated more closely into the system. This release
contains X.Org 7.4. Most of our architectures ship with X.Org, including
amd64, sparc, sparc64 and macppc. During installation, you can install
X.Org quite easily. Be sure to try out xdm(1) and see how we have
customized it for OpenBSD.

------------------------------------------------------------------------
- PORTS TREE -----------------------------------------------------------

The OpenBSD ports tree contains automated instructions for building
third party software. The software has been verified to build and
run on the various OpenBSD architectures. The 4.5 ports collection,
including many of the distribution files, is included on the 3-CD
set. Please see the PORTS file for more information.

Note: some of the most popular ports, e.g., the Apache web server
and several X applications, come standard with OpenBSD. Also, many
popular ports have been pre-compiled for those who do not desire
to build their own binaries (see BINARY PACKAGES, below).

------------------------------------------------------------------------
- BINARY PACKAGES WE PROVIDE -------------------------------------------

A large number of binary packages are provided. Please see the PACKAGES
file (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.5/PACKAGES) for more details.

------------------------------------------------------------------------
- SYSTEM SOURCE CODE ---------------------------------------------------

The CD-ROMs contain source code for all the subsystems explained
above, and the README (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.5/README)
file explains how to deal with these source files. For those who
are doing an FTP install, the source code for all four subsystems
can be found in the pub/OpenBSD/4.5/ directory:

xenocara.tar.gz ports.tar.gz src.tar.gz sys.tar.gz

------------------------------------------------------------------------
- THANKS ---------------------------------------------------------------

OpenBSD 4.5 includes artwork and CD artistic layout by Ty Semaka,
who also arranged an audio track on the OpenBSD 4.5 CD set. Ports
tree and package building by Jasper Lievisse Adriaanse, Michael Erdely,
Simon Bertrang, Stuart Henderson, Antoine Jacoutot, Robert Nagy,
Nikolay Sturm, and Christian Weisgerber. System builds by Theo de Raadt,
Mark Kettenis, and Miod Vallat. X11 builds by Todd Fries and Miod Vallat.
ISO-9660 filesystem layout by Theo de Raadt.

We would like to thank all of the people who sent in bug reports, bug
fixes, donation cheques, and hardware that we use. We would also like
to thank those who pre-ordered the 4.5 CD-ROM or bought our previous
CD-ROMs. Those who did not support us financially have still helped
us with our goal of improving the quality of the software.

Our developers are:

Alexander Bluhm, Alexander Schrijver, Alexander Yurchenko,
Alexander von Gernler, Alexandre Ratchov, Alexey Vatchenko,
Anders Magnusson, Andreas Gunnarsson, Anil Madhavapeddy,
Antoine Jacoutot, Ariane van der Steldt, Artur Grabowski,
Austin Hook, Bernd Ahlers, Bob Beck, Bret Lambert, Can Erkin Acar,
Chad Loder, Charles Longeau, Chris Kuethe, Christian Weisgerber,
Claudio Jeker, Constantine A. Murenin, Dale Rahn, Damien Bergamini,
Damien Miller, Darren Tucker, David Gwynne, David Hill,
David Krause, Eric Faurot, Esben Norby, Federico G. Schwindt,
Felix Kronlage, Gilles Chehade, Giovanni Bechis, Gordon Willem Klok,
Hans-Joerg Hoexer, Henning Brauer, Ian Darwin, Igor Sobrado,
Jacek Masiulaniec, Jacob Meuser, Jakob Schlyter, Janne Johansson,
Jared Yanovich, Jason Dixon, Jason George, Jason McIntyre,
Jasper Lievisse Adriaanse, Joel Sing, Joerg Goltermann, Jolan Luff,
Jonathan Gray, Jordan Hargrave, Joris Vink, Joshua Stein,
Kenneth R Westerback, Kevin Lo, Kevin Steves, Kjell Wooding,
Kurt Miller, Landry Breuil, Laurent Fanis, Marc Balmer, Marc Espie,
Marco Peereboom, Marco Pfatschbacher, Marco S Hyman, Marcus Glocker,
Mark Kettenis, Mark Uemura, Markus Friedl, Martin Reindl,
Martynas Venckus, Mathieu Sauve-Frankel, Mats O Jansson,
Matthias Kilian, Matthieu Herrb, Michael Erdely, Michael Knudsen,
Michele Marchetto, Mike Belopuhov, Mike Larkin, Miod Vallat,
Moritz Jodeit, Nick Holland, Nikolay Sturm, Okan Demirmen,
Oleg Safiullin, Otto Moerbeek, Owain Ainsworth, Paul Irofti,
Paul de Weerd, Pedro Martelletto, Peter Hessler, Peter Stromberg,
Peter Valchev, Philip Guenther, Pierre-Emmanuel Andre,
Pierre-Yves Ritschard, Rainer Giedat, Ray Lai, Reyk Floeter,
Robert Nagy, Rui Reis, Ryan Thomas McBride, Simon Bertrang,
Stefan Kempf, Stefan Sperling, Steven Mestdagh, Stuart Henderson,
Ted Unangst, Theo de Raadt, Thordur I. Bjornsson, Tobias Stoeckmann,
Tobias Weingartner, Todd C. Miller, Todd Fries, Will Maier,
Xavier Santolaria, Yojiro Uo

Announce: OpenSSH 5.2 released

2009-02-22T18:23:34Z

OpenSSH 5.2 has just been released. It will be available from the
mirrors listed at http://www.openssh.com/ shortly.

OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0
implementation and includes sftp client and server support.

We have also recently completed another Internet SSH usage scan, the
results of which may be found at http://www.openssh.com/usage.html

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots or donated to the
project. More information on donations may be found at:
http://www.openssh.com/donations.html

The focus of this release has been on bugfixes as the previous
openssh-5.1 release introduced many new features and made some
invasive changes.

Changes since OpenSSH 5.1
=========================

Security:

* This release changes the default cipher order to prefer the AES CTR
modes and the revised "arcfour256" mode to CBC mode ciphers that are
susceptible to CPNI-957037 "Plaintext Recovery Attack Against SSH".

* This release also adds countermeasures to mitigate CPNI-957037-style
attacks against the SSH protocol's use of CBC-mode ciphers. Upon
detection of an invalid packet length or Message Authentication
Code, ssh/sshd will continue reading up to the maximum supported
packet length rather than immediately terminating the connection.
This eliminates most of the known differences in behaviour that
leaked information about the plaintext of injected data which formed
the basis of this attack. We believe that these attacks are rendered
infeasible by these changes.

New features:

* Added a -y option to ssh(1) to force logging to syslog rather than
stderr, which is useful when running daemonised (ssh -f)

* The sshd_config(5) ForceCommand directive now accepts commandline
arguments for the internal-sftp server.

* The ssh(1) ~C escape commandline now support runtime creation of
dynamic (-D) port forwards.

* Support the SOCKS4A protocol in ssh(1) dynamic (-D) forwards.
(bz#1482)

* Support remote port forwarding with a listen port of '0'. This
informs the server that it should dynamically allocate a listen
port and report it back to the client. (bz#1003)

* sshd(8) now supports setting PermitEmptyPasswords and
AllowAgentForwarding in Match blocks

Bug and documentation fixes

* Repair a ssh(1) crash introduced in openssh-5.1 when the client is
sent a zero-length banner (bz#1496)

* Due to interoperability problems with certain
broken SSH implementations, the eow@... and
no-more-sessions@... protocol extensions are now only sent
to peers that identify themselves as OpenSSH.

* Make ssh(1) send the correct channel number for
SSH2_MSG_CHANNEL_SUCCESS and SSH2_MSG_CHANNEL_FAILURE messages to
avoid triggering 'Non-public channel' error messages on sshd(8) in
openssh-5.1.

* Avoid printing 'Non-public channel' warnings in sshd(8), since the
ssh(1) has sent incorrect channel numbers since ~2004 (this reverts
a behaviour introduced in openssh-5.1).

* Avoid double-free in ssh(1) ~C escape -L handler (bz#1539)

* Correct fail-on-error behaviour in sftp(1) batchmode for remote
stat operations. (bz#1541)

* Disable nonfunctional ssh(1) ~C escape handler in multiplex slave
connections. (bz#1543)

* Avoid hang in ssh(1) when attempting to connect to a server that
has MaxSessions=0 set.

* Multiple fixes to sshd(8) configuration test (-T) mode

* Several core and portable OpenSSH bugs fixed: 1380, 1412, 1418,
1419, 1421, 1490, 1491, 1492, 1514, 1515, 1518, 1520, 1538, 1540

* Many manual page improvements.

Checksums:
==========

- SHA1 (openssh-5.2.tar.gz) = 260074ed466e95f054ac05a4406f613d08575217
- SHA1 (openssh-5.2p1.tar.gz) = 8273a0237db98179fbdc412207ff8eb14ff3d6de

Reporting Bugs:
===============

- Please read http://www.openssh.com/report.html
Security bugs should be reported directly to openssh@...

OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and
Ben Lindstrom.

Revised: OpenSSH security advisory: cbc.adv

2008-11-23T13:58:55Z

Hi,

There was an error in the original advisory. The estimate of 32768
attempts to carry out a successful attack is incorrect. The correct
estimate is 11356 attempts. A revised version is now available at:
http://www.openssh.com/txt/cbc.adv

The advisory and its recommendations are otherwise unchanged.

-d

OpenSSH security advisory: cbc.adv

2008-11-21T02:19:03Z

OpenSSH Security Advisory: cbc.adv

Regarding the "Plaintext Recovery Attack Against SSH" reported as
CPNI-957037[1]:

The OpenSSH team has been made aware of an attack against the SSH
protocol version 2 by researchers at the University of London.
Unfortunately, due to the report lacking any detailed technical
description of the attack and CPNI's unwillingness to share necessary
information, we are unable to properly assess its impact.

Based on the description contained in the CPNI report and a slightly
more detailed description forwarded by CERT this issue appears to be
substantially similar to a known weakness in the SSH binary packet
protocol first described in 2002 by Bellare, Kohno and Namprempre[2].
The new component seems to be an attack that can recover 14 bits of
plaintext with a success probability of 2^-14, though we suspect this
underestimates the work required by a practical attack.

For most SSH usage scenarios, this attack has a very low likelihood of
being carried out successfully - each attempt has a low probability
of success and each failure will cause connection termination with a
fatal error. It is therefore very unlikely for an interactive session
to be usefully attacked using this protocol weakness: an attacker would
expect around 32768 connection-killing attempts before they are likely
to succeed. This level of disruption would certainly be noticed and it
is highly unlikely that any user would retry the connection enough times
for the attack to succeed.

The usage pattern where the attack is most likely to succeed is where an
automated connection is configured to retry indefinitely in the event of
errors. In this case, it might be possible to recover as much as 14 bits
of plaintext per hour (assuming a very fast 10 connections per second).
Implementing a limit on the number of connection retries (e.g. 256) is
sufficient to render the attack infeasible for this case.

AES CTR mode and arcfour ciphers are not vulnerable to this attack at
all. These may be preferentially selected by placing the following
directive in sshd_config and ssh_config:

Ciphers aes128-ctr,aes256-ctr,arcfour256,arcfour,aes128-cbc,aes256-cbc

A future version of OpenSSH may make CTR mode ciphers the default and/or
implement other countermeasures, but at present we do not feel that this
issue is serious enough to make an emergency release.

-d

[1] http://www.cpni.gov.uk/Docs/Vulnerability_Advisory_SSH.txt
[2] http://www.cs.washington.edu/homes/yoshi/papers/TISSEC04/

DCBSDCon 2009 Call for Papers

2008-10-31T22:43:54Z

The DCBSDCon conference has opened up a Call for Papers for the 2009
event. Speakers are welcome to submit any topic of interest, although
security themes are preferred. This conference leads up to the very
popular ShmooCon hacker convention in Washington, D.C. where OpenBSD
developers and users are always in attendance.

Main Website: http://www.dcbsdcon.org/
Call For Papers: http://www.dcbsdcon.org/cfp.html

P.S. ShmooCon registration opens Saturday, November 1 at 12pm EDT. If
you're planning to attend both events, make sure you register for their
event. Previous attendees know how hard it can be to get tickets.

ShmooCon: http://www.shmoocon.org/registration.html

Hope to see you there!

--
Jason Dixon
DixonGroup Consulting
http://www.dixongroup.net/

OpenBSD 4.4 released, Nov 1. Enjoy!

2008-10-31T09:34:14Z

------------------------------------------------------------------------
- OpenBSD 4.4 RELEASED -------------------------------------------------

Nov 1, 2008.

We are pleased to announce the official release of OpenBSD 4.4.
This is our 24th release on CD-ROM (and 25th via FTP). We remain
proud of OpenBSD's record of more than ten years with only two remote
holes in the default install.

As in our previous releases, 4.4 provides significant improvements,
including new features, in nearly all areas of the system:

- New/extended platforms:
o OpenBSD/sparc64.
Fujitsu's SPARC64-V, SPARC64-VI and SPARC64-VII processors are supported
now, which means that many of the PRIMEPOWER machines and the SPARC
Enterprise M4000/M5000/M8000/M9000 work now.
Sun's UltraSPARC VI processors are supported now. Many of Sun's
mid-range and high-end servers with these processors or UltraSPARC III
and UltraSPARC III+ processors work now.
Sun's UltraSPARC T1 and UltraSPARC T2 processors are supported now,
which means the sun4v architecture is now supported and machines like
the SPARC Enterprise T1000 and SPARC Enterprise T5220 work now.
o OpenBSD/socppc.
For machines based on the Freescale MPC8349E
System-on-Chip (SoC) platform that use Das U-Boot as a boot loader.
o OpenBSD/landisk: added shared libraries support.

- Improved hardware support, including:
o Several new/improved drivers for sensors: fins(4), andl(4), it(4),
kate(4), sdtemp(4), lmtemp(4), adt(4), km(4).
o Support for Intel G33 and G35 chipsets in agp(4).
o New lii(4) driver for Attansic L2 10/100 Ethernet devices.
o Preliminary support for UVC USB webcams: uvideo(4) and video(4).
o WPA/WPA2-PSK support for several models of wireless cards.
o Openchrome(4) and geode(4) video card drivers for X.Org.
o New vmt(4) driver, implements VMware Tools.
o New auglx(4) driver for AMD Geode LX CS5536 integrated AC'97 audio.
o New ix(4) driver for Intel 82598 PCI Express 10Gb Ethernet.
o New acpithinkpad(4) driver provides additional ACPI support for
IBM/Lenovo ThinkPad laptops.
o New acpiasus(4) driver provides additional ACPI support for ASUS
laptops including the EeePC.
o New gecko(4) driver supporting the GeckoBOA BC GSC+ port found on
some hppa systems.
o New tsec(4) driver supporting the Freescale Triple Speed Ethernet
Controller..
o The re(4) driver now supports RTL8102E and RTL8168 devices.
o The cas(4) driver now supports National Semiconductor Saturn devices.
o The pccom(4) driver has been removed; all platforms use com(4) now.
o cardbus(4) and pcmcia(4) now work on most sparc64 machines.
o The udcf(4) driver now supports mouseCLOCK USB II devices.
o The msk(4) driver now supports 88E8040T devices.
o The ath(4) now now supports many more Atheros wireless devices.
o The ciss(4) driver now supports HP Smart Array P212, P410, P411, P411i
and P812 devices.
o The uftdi(4) driver now supports ELV Elektronik and FTDI 2232L devices.
o The umsm(4) driver now supports Option GlobeTrotter 3G+, Huawei E220
and more HSDPA MSM devices.
o The ubsa(4) driver now supports ZTE CMDMA MSM devices.
o The axe(4) driver now supports Apple USB A1277 devices.
o The puc(4) driver now supports more Netmos devices.
o The mgx(4) driver now supports 2D acceleration on selected boards.
o The isp(4) driver firmware for some controllers has been updated.
o The isp(4) driver no longer hangs during probe on some machines.
o The bge(4) driver has better support for BCM5704 chipsets in fiber
mode which helps with some blade servers.
o The bge(4) driver has better support for the BCM5906 chipset on
some systems.
o The bge(4) driver has much better support for PCI Express chipsets
resulting in much faster transmit performance.
o The bge(4) driver has support for the BCM5714/5715/5780 chipsets
using fiber interfaces.
o The bnx(4) driver has support for the BCM5706/5708 chipsets using
fiber interfaces.
o The ral(4) driver now supports Ralink Technology RT2700 devices.
o Serial ports other than com0 can now be used for console on amd64.
o The serial console on i386 and amd64 has improved compatibility
with server management cards.

- New tools:
o rpc.statd(8), the host status monitoring daemon for use with the NFS
file locking daemon.
o Initial import of ypldap(8), a drop-in replacement for ypserv
to glue in an LDAP directory for get{pw,gr}ent family of functions.
o Deprecated slattach(8) and nmeaattach(8) in favor of ldattach(8).
o Import of tcpbench(1), a small TCP benchmarking tool.

- New functionality:
o aucat(1) is now able to play and record audio in fullduplex, it
can mix unlimited number of streams, handles up to 16 channels, can
resample streams on the fly, supports various 24-bit and 32-bit
encodings and does format conversions on the fly.
o httpd(8) now supports IPv6.
o dhcpd(8) now supports basic synchronization of the /etc/dhcpd.leases
file to allow for running multiple instances for redundancy.
o rpc.lockd(8) now supports NLMv4 and does actually do locking.
o ftp(1) now supports recursive mget transfers.
o ftp(1) now uses keep alive packets by default.
o Make ftp(1) accept empty passwords in URLs.
o locate(1) now supports -b flag to perform search only on the last
component of the path.
o Allow cdio(1) in TAO mode to set the write speed.
o cdio(1) no longer blanks media twice.
o Add ability in cdio(1) to determine media capabilities and make it figure
out if media supports TAO or blanking.
o Initial version of softraid(4) crypto support.
o dhcpd(8) now groks options tftp-config-file and auto-proxy-script in
dhcpd.conf.
o dhclient(8) option handling much more resistant to abuse.
o dhclient(8) now aware of interface link state and reacts to changes.
o DIOCRLDINFO, DIOCGPDINFO, and DIOCGPART support added to block devices
previously lacking it.
o disklabel(8) no longer supports the '-r' option, and obtains all disklabel
information via ioctl's.
o disklabel(8) no longer suggests offsets and sizes that would result in
partitions starting or ending outside the OpenBSD section of the disk.
o disklabel(8) now correctly reads back the 'vendor' field from text
disklabels.
o disklabel(8) editor mode '?' and 'p' commands are more compact and the 'l'
command has been added to produce previous verbose output.
o I/O's outside the bounds of the RAW_PART are now prevented, allowing
proper detection of invalid I/O's.
o USB floppies now have a valid cylinder count calculated, rather than 0.
o newfs(8) can now create filesystems on devices with sector sizes other
than 512, although such filesystems cannot yet be read.
o scsi(4) probing displays less useless verbiage and fewer spurious error
messages.
o st(4) devices can now be detached.
o ATAPI devices are now identified as such, rather than as SCSIn devices.
o SATA tape drives now work.
o scsi(4) probing now displays the ID of the initiator on the bus.
o scsi(4) debug capabilities improved to show commands and input or output
data as appropriate.
o scsi(4) probing makes better use of the TEST UNIT READY command to clear
errors and allow successfull attachments.
o scsi(4) probing can now find more fibre channel attached devices.
o Several mbuf pool cache corruption issues were fixed
o identd(8) now supports IPv6 in standalone mode.
o cal(1) now shows week numbers too.
o In pf(4), implement a sloppy tcpstate tracker which does not look at
sequence numbers at all.
o pf(4) rule accounting now has a counter to record how many states in
total have been created by a rule.
o The kill states feature in pfctl(8) now supports two additional match
targets: Kill by rule label or state ID.
o Make relayd(8) use sloppy pf(4) state keeping for routed sessions (Direct
Server Return).
o Added support in relayd(8) for transparent L7 forwarding in relays.
o Added support for dynamic IPv6-to-IPv4 or IPv4-to-IPv6 TCP relays
in relayd(8).
o Improved the DNS mode and use OpenBSD's Id shuffle code from named(8)
in relayd(8).
o Extend awk(1) with bitwise operations.
o Updated the display code for systat(1) which adds views for pf(4) states,
rules and queues.
o Imported initial support for IEEE 802.3ad/LACP in trunk(4).

- Assorted improvements and code cleanup:
o A greatly changed buffer cache subsystem which maps cache pages only
when in use, resulting in improved filesystem performance, and
allowing for the effective use of a much larger buffer cache
o A greatly improved implementation of malloc(3), the general purpose
memory allocator, which catches more mistakes, reduces address space
fragmentation, and is faster.
o The statfs(2) system call has been enhanced to support large filesystems.
o The strtof(3) function has been added to libc.
o A lot of work has been done on libm to add several functions towards more
C99 compliance.
o Lots of features have been implemented in OpenCVS, which can now be used
to do some real work.
o New APIs for arc4random, one to fill a buffer with random numbers
and the other to return a uniformly distributed random number
without bias.

- Install/Upgrade process changes:
o A new tool sysmerge(1), derived from the old mergemaster port, makes
it easier to merge configuration files changes during an upgrade.
o Fully support OpenBSD inside extended partitions on i386 and amd64.
o During installation 'dhcp' is now the initial default answer during
network configuration.
o Fetching sets via FTP more reliable due to automatic use of keep alive.
o Fetching sets via NFS no longer hangs retrying a non-functional mount.
o Installation ensures hostname.* files are installed with mode 600.
o Serial console configuration now automatically detects speed.
o Serial console support extended to all architectures.
o Partition size display no longer limited to 32 bit sizes.
o Partition sizes now scaled and formatted to use human readable units.
o NTPD configuration questions improved.
o Sparc miniroot root disk detection fixed.
o Invocations of disklabel(8) by the scripts are now less verbose.

- OpenSSH 5.1:
o New experimental fingerprint ASCII art visualisation system for easier
verification of remote keys.
o Added chroot(2) support for sshd(8).
o Added an extended test mode (-T) to sshd(8).
o Make ssh(1) support negation of groups in a "Match group" block.
o Increased the ephemeral key size in protocol1 from 768 to 1024 bits.
o Better tests of primes in /etc/moduli
o Refuse to read .shosts or authorized_keys files that are not regular
files.
o Enable ~ escapes for multiplex slave sessions.
o Support CIDR address matching in Match blocks and authorized_keys
from="..." stanzas.
o Make port forwarding code try additional addresses when connecting to
a destination whose DNS name resolves to more than one address.
o Make the maximum number of ssh(1) sessions run-time controllable via
MaxSessions in sshd_config(5).
o ssh-scan(1) now defaults to RSA protocol 2 keys, instead of RSA1.
o Added an extension to sftp protocol to implement statvfs(2)-like operations
and add a df command to sftp(1).
o Disable execution of /.ssh/rc for sessions where a command has been
forced by the sshd_config ForceCommand directive.
o And several bug fixes and performance enhancements.

- Over 4,500 ports, minor robustness improvements in package tools.
o Many pre-built packages for each architecture:
i386: 5033 sparc64: 4862 alpha: 4852 sh: 1285
amd64: 4940 powerpc: 4466 sparc: 3381 mips64: 3099
arm: 4018 hppa: 1595 vax: 1954
o Highlights include:
o mozilla-firefox 3
o drupal 5
o Gnome 2.20.3.
o GNUstep 1.14.2.
o Inkscape 0.46.
o JDK 1.7.0.b24.
o KDE 3.5.8.
o Mozilla Firefox 2.0.0.16 and 3.0.1.
o Mozilla Thunderbird 2.0.0.16.
o MySQL 5.0.51a
o OpenMotif 2.3.0.
o OpenOffice.org 2.4.1.
o PostgreSQL 8.3.3.
o Xfce 4.4.2.

- As usual, steady improvements in manual pages and other documentation.

- The system includes the following major components from outside
suppliers:
o Xenocara (based on X.Org 7.3 + patches, freetype 2.3.5,
fontconfig 2.4.2, expat 2.0.1, Mesa 7.0.3, xterm 234 and more)
o Gcc 2.95.3 (+ patches) and 3.3.5 (+ patches)
o Perl 5.8.8 (+ patches)
o Our improved and secured version of Apache 1.3, with SSL/TLS and DSO
support
o OpenSSL 0.9.7j (+ patches)
o Groff 1.15
o Sendmail 8.14.3, with libmilter
o Bind 9.4.2-P2 (+ patches)
o Lynx 2.8.5rel.4 with HTTPS and IPv6 support (+ patches)
o Sudo 1.6.9p17
o Ncurses 5.2
o Latest KAME IPv6
o Heimdal 0.7.2 (+ patches)
o Arla 0.35.7
o Binutils 2.15 (+ patches)
o Gdb 6.3 (+ patches)

If you'd like to see a list of what has changed between OpenBSD 4.3
and 4.4, look at

http://www.OpenBSD.org/plus44.html

Even though the list is a summary of the most important changes
made to OpenBSD, it still is a very very long list.

------------------------------------------------------------------------
- SECURITY AND ERRATA --------------------------------------------------

We provide patches for known security threats and other important
issues discovered after each CD release. As usual, between the
creation of the OpenBSD 4.4 FTP/CD-ROM binaries and the actual 4.4
release date, our team found and fixed some new reliability problems
(note: most are minor and in subsystems that are not enabled by
default). Our continued research into security means we will find
new security problems -- and we always provide patches as soon as
possible. Therefore, we advise regular visits to

http://www.OpenBSD.org/security.html
and
http://www.OpenBSD.org/errata.html

Security patch announcements are sent to the security-announce@...
mailing list. For information on OpenBSD mailing lists, please see:

http://www.OpenBSD.org/mail.html

------------------------------------------------------------------------
- CD-ROM SALES ---------------------------------------------------------

OpenBSD 4.4 is also available on CD-ROM. The 3-CD set costs $50 CDN
(EUR 50 including VAT) and is available via mail order and from a number
of contacts around the world. The set includes a colourful booklet
which carefully explains the installation of OpenBSD. A new set
of cute little stickers is also included (sorry, but our FTP mirror
sites do not support STP, the Sticker Transfer Protocol). As an
added bonus, the second CD contains an audio track, a song entitled
"Trial of the BSD Knights". MP3 and OGG versions of the audio track can
be found on the first CD.

Lyrics (and an explanation) for the songs may be found at:

http://www.OpenBSD.org/lyrics.html#44

Profits from CD sales are the primary income source for the OpenBSD
project -- in essence selling these CD-ROM units ensures that OpenBSD
will continue to make another release six months from now.

The OpenBSD 4.4 CD-ROMs are bootable on the following four platforms:

o i386
o amd64
o macppc
o sparc64

(Other platforms must boot from floppy, network, or other method).

For more information on ordering CD-ROMs, see:

http://www.OpenBSD.org/orders.html

The above web page lists a number of places where OpenBSD CD-ROMs
can be purchased from. For our default mail order, go directly to:

https://https.OpenBSD.org/cgi-bin/order

or, for European orders:

https://https.OpenBSD.org/cgi-bin/order.eu

All of our developers strongly urge you to buy a CD-ROM and support
our future efforts. Additionally, donations to the project are
highly appreciated, as described in more detail at:

http://www.OpenBSD.org/goals.html#funding

------------------------------------------------------------------------
- OPENBSD FOUNDATION ---------------------------------------------------

For those unable to make their contributions as straightforward gifts,
the OpenBSD Foundation (http://www.openbsdfoundation.org) is a Canadian
not-for-profit corporation that can accept larger contributions and
issue receipts. In some situations, their receipt may qualify as a
business expense writeoff, so this is certainly a consideration for
some organizations or businesses. There may also be exposure benefits
since the Foundation may be interested in participating in press releases.
In turn, the Foundation then uses these contributions to assist OpenBSD's
infrastructure needs. Contact the foundation directors at
directors@... for more information.

------------------------------------------------------------------------
- T-SHIRT SALES --------------------------------------------------------

The OpenBSD distribution companies also sell tshirts and polo shirts.
And our users like them too. We have a variety of shirts available,
with the new and old designs, from our web ordering system at:

https://https.OpenBSD.org/cgi-bin/order

and for Europe:

https://https.OpenBSD.org/cgi-bin/order.eu

The OpenBSD 4.4 t-shirts are available now. We also sell our older
shirts, as well as a selection of OpenSSH t-shirts.

------------------------------------------------------------------------
- FTP INSTALLS ---------------------------------------------------------

If you choose not to buy an OpenBSD CD-ROM, OpenBSD can be easily
installed via FTP. Typically you need a single small piece of boot
media (e.g., a boot floppy) and then the rest of the files can be
installed from a number of locations, including directly off the
Internet. Follow this simple set of instructions to ensure that
you find all of the documentation you will need while performing
an install via FTP. With the CD-ROMs, the necessary documentation
is easier to find.

1) Read either of the following two files for a list of ftp
mirrors which provide OpenBSD, then choose one near you:

http://www.OpenBSD.org/ftp.html
ftp://ftp.OpenBSD.org/pub/OpenBSD/4.4/ftplist

As of November 1, 2008, the following ftp mirror sites have the 4.4 release:

ftp://ftp.kd85.com/pub/OpenBSD/4.4/ Austria
ftp://ftp.stacken.kth.se/pub/OpenBSD/4.4/ Sweden
ftp://ftp2.usa.openbsd.org/pub/OpenBSD/4.4/ NYC, USA
ftp://ftp3.usa.openbsd.org/pub/OpenBSD/4.4/ CO, USA
ftp://ftp5.usa.openbsd.org/pub/OpenBSD/4.4/ CA, USA
ftp://rt.fm/pub/OpenBSD/4.4/ IL, USA

The release is also available at the master site:

ftp://ftp.openbsd.org/pub/OpenBSD/4.4/ Alberta, Canada

However it is strongly suggested you use a mirror.

Other mirror sites may take a day or two to update.

2) Connect to that ftp mirror site and go into the directory
pub/OpenBSD/4.4/ which contains these files and directories.
This is a list of what you will see:

ANNOUNCEMENT amd64/ macppc/ sys.tar.gz
Changelogs/ armish/ mvme68k/ tools/
HARDWARE ftplist packages/ vax/
PACKAGES hp300/ ports.tar.gz xenocara.tar.gz
PORTS hppa/ root.mail zaurus/
README i386/ sparc/
SIZES landisk/ sparc64/
alpha/ mac68k/ src.tar.gz

It is quite likely that you will want at LEAST the following
files which apply to all the architectures OpenBSD supports.

README - generic README
HARDWARE - list of hardware we support
PORTS - description of our "ports" tree
PACKAGES - description of pre-compiled packages
root.mail - a copy of root's mail at initial login.
(This is really worthwhile reading).

3) Read the README file. It is short, and a quick read will make
sure you understand what else you need to fetch.

4) Next, go into the directory that applies to your architecture,
for example, i386. This is a list of what you will see:

INSTALL.i386 cd44.iso floppyB44.fs pxeboot*
INSTALL.linux cdboot* floppyC44.fs xbase44.tgz
MD5 cdbr* game44.tgz xetc44.tgz
base44.tgz cdemu44.iso index.txt xfont44.tgz
bsd* comp44.tgz install44.iso xserv44.tgz
bsd.mp* etc44.tgz man44.tgz xshare44.tgz
bsd.rd* floppy44.fs misc44.tgz

If you are new to OpenBSD, fetch _at least_ the file INSTALL.i386
and the appropriate floppy*.fs or install44.iso files. Consult the
INSTALL.i386 file if you don't know which of the floppy images
you need (or simply fetch all of them).

If you use the install44.iso file (roughly 200MB in size), then you
do not need the various *.tgz files since they are contained on that
one-step ISO-format install CD.

5) If you are an expert, follow the instructions in the file called
README; otherwise, use the more complete instructions in the
file called INSTALL.i386. INSTALL.i386 may tell you that you
need to fetch other files.

6) Just in case, take a peek at:

http://www.OpenBSD.org/errata.html

This is the page where we talk about the mistakes we made while
creating the 4.4 release, or the significant bugs we fixed
post-release which we think our users should have fixes for.
Patches and workarounds are clearly described there.

Note: If you end up needing to write a raw floppy using Windows,
you can use "fdimage.exe" located in the pub/OpenBSD/4.4/tools
directory to do so.

------------------------------------------------------------------------
- X.ORG FOR MOST ARCHITECTURES -----------------------------------------

X.Org has been integrated more closely into the system. This release
contains X.Org 7.3.0. Most of our architectures ship with X.Org, including
amd64, sparc, sparc64 and macppc. During installation, you can install
X.Org quite easily. Be sure to try out xdm(1) and see how we have
customized it for OpenBSD.

------------------------------------------------------------------------
- PORTS TREE -----------------------------------------------------------

The OpenBSD ports tree contains automated instructions for building
third party software. The software has been verified to build and
run on the various OpenBSD architectures. The 4.4 ports collection,
including many of the distribution files, is included on the 3-CD
set. Please see the PORTS file for more information.

Note: some of the most popular ports, e.g., the Apache web server
and several X applications, come standard with OpenBSD. Also, many
popular ports have been pre-compiled for those who do not desire
to build their own binaries (see BINARY PACKAGES, below).

------------------------------------------------------------------------
- BINARY PACKAGES WE PROVIDE -------------------------------------------

A large number of binary packages are provided. Please see the PACKAGES
file (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.4/PACKAGES) for more details.

------------------------------------------------------------------------
- SYSTEM SOURCE CODE ---------------------------------------------------

The CD-ROMs contain source code for all the subsystems explained
above, and the README (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.4/README)
file explains how to deal with these source files. For those who
are doing an FTP install, the source code for all four subsystems
can be found in the pub/OpenBSD/4.4/ directory:

xenocara.tar.gz ports.tar.gz src.tar.gz sys.tar.gz

------------------------------------------------------------------------
- THANKS ---------------------------------------------------------------

OpenBSD 4.4 includes artwork and CD artistic layout by Ty Semaka,
who also arranged an audio track on the OpenBSD 4.4 CD set. Ports
tree and package building by Antoine Jacoutot, Nikolay Sturm,
Robert Nagy and Christian Weisgerber. System builds by Theo de Raadt,
and Miod Vallat. X11 builds by Todd Fries. ISO-9660 filesystem
layout by Theo de Raadt.

We would like to thank all of the people who sent in bug reports, bug
fixes, donation cheques, and hardware that we use. We would also like
to thank those who pre-ordered the 4.4 CD-ROM or bought our previous
CD-ROMs. Those who did not support us financially have still helped
us with our goal of improving the quality of the software.

Our developers are:

Alexander Bluhm, Alexander Schrijver, Alexander von Gernler,
Alexandre Anriot, Alexandre Ratchov, Alexey Vatchenko,
Anders Magnusson, Andreas Gunnarsson, Antoine Jacoutot,
Artur Grabowski, Austin Hook, Bernd Ahlers, Bob Beck, Brad Smith,
Bret Lambert, Can Erkin Acar, Chad Loder, Charles Longeau,
Chris Kuethe, Christian Weisgerber, Claudio Jeker,
Constantine A. Murenin, Dale Rahn, Damien Bergamini, Damien Miller,
Daniel Hartmeier, Darren Tucker, David Gwynne, David Hill,
David Krause, Deanna Phillips, Eric Faurot, Esben Norby,
Federico G. Schwindt, Felix Kronlage, Gilles Chehade,
Gordon Willem Klok, Hans-Joerg Hoexer, Henning Brauer,
Henric Jungheim, Hugh Graham, Ian Darwin, Igor Sobrado,
Jacob Meuser, Jakob Schlyter, Janne Johansson, Jared Yanovich,
Jason Dixon, Jason George, Jason McIntyre,
Jasper Lievisse Adriaanse, Joel Knight, Joel Sing,
Johan Mson Lindman, Jolan Luff, Jonathan Gray, Jordan Hargrave,
Joris Vink, Kenneth R Westerback, Kevin Lo, Kevin Steves,
Kjell Wooding, Kurt Miller, Landry Breuil, Laurent Fanis,
Marc Balmer, Marc Espie, Marco Peereboom, Marco Pfatschbacher,
Marco S Hyman, Marcus Glocker, Mark Kettenis, Mark Uemura,
Markus Friedl, Martin Reindl, Martynas Venckus,
Mathieu Sauve-Frankel, Mats O Jansson, Matthias Kilian,
Matthieu Herrb, Michael Erdely, Michael Knudsen, Mike Belopuhov,
Miod Vallat, Moritz Grimm, Moritz Jodeit, Nick Holland,
Nikolay Sturm, Okan Demirmen, Oleg Safiullin, Otto Moerbeek,
Owain Ainsworth, Pedro Martelletto, Peter Hessler, Peter Stromberg,
Peter Valchev, Philip Guenther, Pierre-Yves Ritschard,
Rainer Giedat, Ray Lai, Reyk Floeter, Robert Nagy, Rui Reis,
Ryan Thomas McBride, Saad Kadhi, Simon Bertrang, Stefan Kempf,
Steven Mestdagh, Stuart Henderson, Ted Unangst, Theo de Raadt,
Thordur I. Bjornsson, Tobias Stoeckmann, Tobias Weingartner,
Todd C. Miller, Todd Fries, Tomoyuki Sakurai, Uwe Stuehler,
Will Maier, Xavier Santolaria, Yojiro Uo, joshua stein

Announce: OpenSSH 5.1 released

2008-07-21T17:11:49Z

OpenSSH 5.1 has just been released. It will be available from the
mirrors listed at http://www.openssh.com/ shortly.

OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0
implementation and includes sftp client and server support.

We have also recently completed another Internet SSH usage scan, the
results of which may be found at http://www.openssh.com/usage.html

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots or donated to the
project. More information on donations may be found at:
http://www.openssh.com/donations.html

Changes since OpenSSH 5.0
=========================

Security:

* sshd(8): Avoid X11 man-in-the-middle attack on HP/UX (and possibly
other platforms) when X11UseLocalhost=no

When attempting to bind(2) to a port that has previously been bound
with SO_REUSEADDR set, most operating systems check that either the
effective user-id matches the previous bind (common on BSD-derived
systems) or that the bind addresses do not overlap (Linux and
Solaris).

Some operating systems, such as HP/UX, do not perform these checks
and are vulnerable to an X11 man-in-the-middle attack when the
sshd_config(5) option X11UseLocalhost has been set to "no" - an
attacker may establish a more-specific bind, which will be used in
preference to sshd's wildcard listener.

Modern BSD operating systems, Linux, OS X and Solaris implement the
above checks and are not vulnerable to this attack, nor are systems
where the X11UseLocalhost has been left at the default value of
"yes".

Portable OpenSSH 5.1 avoids this problem for all operating systems
by not setting SO_REUSEADDR when X11UseLocalhost is set to no.

This vulnerability was reported by sway2004009 AT hotmail.com.

New features:

* Introduce experimental SSH Fingerprint ASCII Visualisation to ssh(1)
and ssh-keygen(1). Visual fingerprinnt display is controlled by a new
ssh_config(5) option "VisualHostKey". The intent is to render
SSH host keys in a visual form that is amenable to easy recall and
rejection of changed host keys. This technique inspired by the
graphical hash visualisation schemes known as "random art[*]", and
by Dan Kaminsky's musings at 23C3 in Berlin.

Fingerprint visualisation in is currently disabled by default, as the
algorithm used to generate the random art is still subject to change.

[*] "Hash Visualization: a New Technique to improve Real-World
Security", Perrig A. and Song D., 1999, International Workshop on
Cryptographic Techniques and E-Commerce (CrypTEC '99)
http://sparrow.ece.cmu.edu/~adrian/projects/validation/validation.pdf

* sshd_config(5) now supports CIDR address/masklen matching in "Match
address" blocks, with a fallback to classic wildcard matching. For
example:
Match address 192.0.2.0/24,3ffe:ffff::/32,!10.*
PasswordAuthentication yes

* sshd(8) now supports CIDR matching in ~/.ssh/authorized_keys
from="..." restrictions, also with a fallback to classic wildcard
matching.

* Added an extended test mode (-T) to sshd(8) to request that it write
its effective configuration to stdout and exit. Extended test mode
also supports the specification of connection parameters (username,
source address and hostname) to test the application of
sshd_config(5) Match rules.

* ssh(1) now prints the number of bytes transferred and the overall
connection throughput for SSH protocol 2 sessions when in verbose
mode (previously these statistics were displayed for protocol 1
connections only).

* sftp-server(8) now supports extension methods statvfs@... and
fstatvfs@... that implement statvfs(2)-like operations.
(bz#1399)

* sftp(1) now has a "df" command to the sftp client that uses the
statvfs@... to produce a df(1)-like display of filesystem
space and inode utilisation (requires statvfs@... support on
the server)

* Added a MaxSessions option to sshd_config(5) to allow control of the
number of multiplexed sessions supported over a single TCP connection.
This allows increasing the number of allowed sessions above the
previous default of 10, disabling connection multiplexing
(MaxSessions=1) or disallowing login/shell/subsystem sessions
entirely (MaxSessions=0).

* Added a no-more-sessions@... global request extension that is
sent from ssh(1) to sshd(8) when the client knows that it will never
request another session (i.e. when session multiplexing is disabled).
This allows a server to disallow further session requests and
terminate the session in cases where the client has been hijacked.

* ssh-keygen(1) now supports the use of the -l option in combination
with -F to search for a host in ~/.ssh/known_hosts and display its
fingerprint.

* ssh-keyscan(1) now defaults to "rsa" (protocol 2) keys, instead of
"rsa1".

* Added an AllowAgentForwarding option to sshd_config(8) to control
whether authentication agent forwarding is permitted. Note that this
is a loose control, as a client may install their own unofficial
forwarder.

* ssh(1) and sshd(8): avoid unnecessary malloc/copy/free when receiving
network data, resulting in a ~10% speedup

* ssh(1) and sshd(8) will now try additional addresses when connecting
to a port forward destination whose DNS name resolves to more than
one address. The previous behaviour was to try the only first address
and give up if that failed. (bz#383)

* ssh(1) and sshd(8) now support signalling that channels are
half-closed for writing, through a channel protocol extension
notification "eow@...". This allows propagation of closed
file descriptors, so that commands such as:
"ssh -2 localhost od /bin/ls | true"
do not send unnecessary data over the wire. (bz#85)

* sshd(8): increased the default size of ssh protocol 1 ephemeral keys
from 768 to 1024 bits.

* When ssh(1) has been requested to fork after authentication
("ssh -f") with ExitOnForwardFailure enabled, delay the fork until
after replies for any -R forwards have been seen. Allows for robust
detection of -R forward failure when using -f. (bz#92)

* "Match group" blocks in sshd_config(5) now support negation of
groups. E.g. "Match group staff,!guests" (bz#1315)

* sftp(1) and sftp-server(8) now allow chmod-like operations to set
set[ug]id/sticky bits. (bz#1310)

* The MaxAuthTries option is now permitted in sshd_config(5) match
blocks.

* Multiplexed ssh(1) sessions now support a subset of the ~ escapes
that are available to a primary connection. (bz#1331)

* ssh(1) connection multiplexing will now fall back to creating a new
connection in most error cases. (bz#1439 bz#1329)

* Added some basic interoperability tests against Twisted Conch.

* Documented OpenSSH's extensions to and deviations from the published
SSH protocols (the PROTOCOL file in the distribution)

* Documented OpenSSH's ssh-agent protocol (PROTOCOL.agent).

Bug and documentation fixes

* Make ssh(1) deal more gracefully with channel requests that fail.
Previously it would optimistically assume that requests would always
succeed, which could cause hangs if they did not (e.g. when the
server runs out of file descriptors). (bz#1384)

* ssh(1) now reports multiplexing errors via the multiplex slave's
stderr where possible (subject to LogLevel in the mux master).

* ssh(1) and sshd(8) now send terminate protocol banners with CR+LF for
protocol 2 to comply with RFC 4253. Previously they were terminated
with CR alone. Protocol 1 banners remain CR terminated. (bz#1443)

* Merged duplicate authentication file checks in sshd(8) and refuse to
read authorised_keys and .shosts from non-regular files. (bz#1438)

* Ensure that sshd(8)'s umask disallows at least group and world write,
even if a more permissive one has been inherited. (bz#1433)

* Suppress the warning message from sshd(8) when changing to a
non-existent user home directory after chrooting. (bz#1461)

* Mention that scp(1) follows symlinks when performing recursive
copies. (bz#1466)

* Prevent sshd(8) from erroneously applying public key restrictions
leaned from ~/.ssh/authorized_keys to other authentication methods
when public key authentication subsequently fails. (bz#1472)

* Fix protocol keepalive timeouts - in some cases, keepalive packets
were being sent, but the connection was not being closed when the
limit for missing replies was exceeded. (bz#1465)

* Fix ssh(1) sending invalid TTY modes when a TTY was forced (ssh -tt)
but stdin was not a TTY. (bz#1199)

* ssh(1) will now exit with a non-zero exit status if
ExitOnForwardFailure was set and forwardings were disabled due to a
failed host key check.

* Fix MaxAuthTries tests to disallow a free authentication try to
clients that skipped the protocol 2 "none" authentication method.
(part of bz#1432)

* Make keepalive timeouts apply while synchronously waiting
for a packet, particularly during key renegotiation. (bz#1363)

* sshd(8) has been audited to eliminate fd leaks and calls to fatal()
in conditions of file descriptor exhaustion.

Portable OpenSSH-specific bugfixes

* Avoid a sshd(8) hang-on-exit on Solaris caused by depending on the
success of isatty() on a PTY master (undefined behaviour). Probably
affected other platforms too. (bz#1463)

* Fixed test for locked accounts on HP/UX with shadowed
passwords disabled. (bz#1083)

* Disable poll() fallback in atomiciov for Tru64. readv
doesn't seem to be a comparable object there, which lead to
compilation errors. (bz#1386)

* Fall back to racy rename if link returns EXDEV. (bz#1447)

* Explicitly handle EWOULDBLOCK wherever we handle EAGAIN, on
some platforms (HP nonstop) it is a distinct errno. (bz#1467)

* Avoid NULL dereferences in ancient sigaction replacement
code. (bz#1240)

* Avoid linking against libgssapi, which despite its name
doesn't seem to implement all of GSSAPI. (bz#1276)

* Use explicit noreturn attribute instead of __dead, fixing
compilation problems on Interix. (bz#1112)

* Added support password expiry on Tru64 SIA systems. (bz#1241)

* Fixed an UMAC alignment problem that manifested on Itanium
platforms. (bz#1462)

* The sftp-server(8) manual now describes the requirements for
transfer logging in chroot environments. (bz#1488)

* Strip trailing dot from hostnames when the sshd_config(5)
HostbasedUsesNameFromPacketOnly option is set. (bz#1200)

Checksums:
==========

- SHA1 (openssh-5.1.tar.gz) = 1e5b43844ed015e4fbbbe25cfad6f5377c60e759
- SHA1 (openssh-5.1p1.tar.gz) = 877ea5b283060fe0160e376ea645e8e168047ff5

Reporting Bugs:
===============

- Please read http://www.openssh.com/report.html
Security bugs should be reported directly to openssh@...

OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and
Ben Lindstrom.

The OpenBSD Foundation Announces Support for C2K8

2008-05-29T19:39:04Z

FOR IMMEDIATE RELEASE

From: The OpenBSD Foundation
Contact: directors@...
Date: May 28, 2008

THE OPENBSD FOUNDATION ANNOUNCES SUPPORT FOR C2K8 CONFERENCE

The OpenBSD Foundation is pleased to announce that it has completed
arrangements with the University of Alberta in Edmonton to host the
2008 Annual OpenBSD Developer's Conference (C2K8 Hackathon)
from June 7 to June 15, 2008.

The facility support from the University of Alberta Computer Science
Department will provide C2K8 the best facilities yet for the annual
OpenBSD Developer Conference. C2K8 will be the 10th annual event of
its kind. Previous hackathons have produced tools such as the PF
firewall, OpenBGP, relayd and spamd, as well as innumerable
critical improvements to OpenBSD, OpenSSH, and related projects.

This year, the OpenBSD Foundation will disburse approximately
$15,000
to support C2K8, enabling more than 50 OpenBSD developers from
around
the world to attend this important event. The Foundation thanks
all who have generously donated the resources to make C2K8
possible.

The OpenBSD Foundation relies on donations of money and equipment
from
corporations and individuals to make events like this one possible.
If
you or your organization are interested in making a contribution,
please contact us at: directors@....

-30-

Thu gui tu The Transport Journal Online

2008-05-21T01:51:52Z

Gui quy ban doc!

The Transport Journal Online la kenh thong tin chuyen nganh Giao thong van tai Viet Nam. The Transport Journal Online gioi thieu toan canh ve cac linh vuc Giao thong van tai: hang hai, hang khong, duong sat, duong bo, duong thuy, dong tau, du an & quan ly du an va dang kiem... cua Nganh Giao thong van tai Viet Nam va quoc te.

The Transport Journal Online lien tuc cap nhat nhung tin tuc va hoat dong tren cac linh vuc Giao thong van tai - Dong thoi cung cap cho cac doanh nghiep nhung dich vu: quang ba thuong hieu, giao dich truc tuyen, nghien cuu thi truong...

Ban co the truy cap tai dia chi http://www.transportjournal.com.vn

Muon xem day du thong tin ban can dang ky de nhan duoc Ten truy cap va Mat khau. Dang ky tai day

Ban bien tap

THE TRANSPORT JOURNAL ONLINE

Tel         : +84. 8. 8239645
Fax        : +84. 8. 6126265
E-mail    : info@...
Website : http://www.transportjournal.com.vn

OpenBSD 4.3 released May 1, 2008

2008-04-30T15:00:55Z

------------------------------------------------------------------------
- OpenBSD 4.3 RELEASED -------------------------------------------------

May 1, 2008.

We are pleased to announce the official release of OpenBSD 4.3.
This is our 23nd release on CD-ROM (and 24rd via FTP). We remain
proud of OpenBSD's record of more than ten years with only two remote
holes in the default install.

As in our previous releases, 4.3 provides significant improvements,
including new features, in nearly all areas of the system:

- New/extended platforms:
o OpenBSD/sparc64.
SMP support. This should work on all supported systems, with
the exception of the Sun Enterprise 10000.
o OpenBSD/hppa.
K-class servers like the K200 and K410 are supported now.
o OpenBSD/mvme88k
SMP support on MVME188 and MVME188A systems.
88110 processor, and thus MVME197LE/SP/DP boards, are supported now.
o OpenBSD/sgi.
Contains many new drivers, however the kernel requires an important
errata fix.

- Improved hardware support, including:
o The bge(4) driver now supports BCM5906/BCM5906M 10/100 and BCM5755
10/100/Gigabit Ethernet devices.
o The cas(4) driver now supports Cassini+ 10/100/Gigabit Ethernet devices.
o The em(4) driver now supports ICH9 10/100 and 10/100/Gigabit Ethernet
devices.
o The gem(4) driver now supports the onboard 1000base-SX interface on
the Sun Fire V880 server.
o The ixgb(4) driver now supports the Sun 10Gb PCI-X Ethernet devices.
o The msk(4) driver now supports Yukon FE+ 10/100 and Yukon Supreme
10/100/Gigabit Ethernet devices.
o The nfe(4) driver now supports MCP73, MCP77 and MCP79 10/100/Gigabit
Ethernet devices.
o The ral(4) driver now supports RT2800 based wireless network devices.
o The cmpci(4) driver now supports CMI8768 based audio adapters.
o The it(4) driver now supports ITE IT8705F/8712F/8716F/8718F/8726F and
SiS SiS950 ICs. Watchdog timer functionality added.
o The mfi(4) driver now supports Dell CERC6/PERC6 and LSI SAS1078 RAID
controllers.
o The viapm(4) driver now supports the VIA VT8237S south bridges SMBus
controller.
o Support for hotplugging ExpressCard devices has been added.
o New amdpcib(4) driver for the AMD-8111 series LPC bridge and
timecounter on amd64.
o New pctr(4) driver for the CPU performance counters on amd64.
o New bwi(4) driver for the Broadcom AirForce IEEE 802.11b/g wireless
network device.
o New envy(4) driver for the VIA Envy24 audio device.
o New et(4) driver for the Agere/LSI ET1310 10/100/Gigabit Ethernet
device.
o New etphy(4) driver for the Agere/LSI ET1011 TruePHY Gigabit
Ethernet PHY.
o New amdpcib(4) driver for the AMD-8111 series LPC bridge and
timecounter on i386.
o New glxpcib(4) driver for the AMD CS5536 PCI-ISA bridge with timecounter,
watchdog timer, and GPIO on i386.
o New iwn(4) driver for the Intel Wireless WiFi Link 4965AGN IEEE
802.11a/b/g/Draft-N wireless network device.
o New msts(4) line discipline to interface Meinberg Standard Time String
devices and to provide a timedelta sensor.
o New gbe(4) driver for the SGI Graphics Back End (GBE) Frame Buffer on sgi.
o New mkbc(4) driver for the Moosehead PS/2 Controller on sgi.
o New power(4) driver for the power button on sgi.
o New ecadc(4) driver for the Environmental Monitoring Subsystem
temperature sensor on sparc64.
o New tda(4) driver for the fan controller on the Sun Blade 1000/2000,
making these machines much less noisy.
o New spdmem(4) driver retrieves information about memory modules.
o New thmc(4) driver for the TI THMC50, Analog ADM1022/1028
temperature sensor.
o New uchcom(4) driver for the WinChipHead CH341/340 based USB serial
adapter.
o New umbg(4) driver for the Meinberg Funkuhren USB5131 radio clock to
provide a timedelta sensor.
o New upgt(4) driver for the Conexant/Intersil PrismGT SoftMAC USB IEEE
802.11b/g wireless network device.
o New wbng(4) driver for the Winbond W83793G temperature, voltage, and
fan sensor.
o New wbsio(4) driver for the Winbond LPC Super I/O ICs.
o New adl(4) driver for the Andigilog aSC7621 temperature, voltage, and
fan sensor.
o The siop(4) driver now supports the (non-PCI) NCR 53c720/770 in
big-endian mode.
o New lmn(4) driver for the National Semiconductor LM93 sensor.

- New tools:
o snmpd(8), implementing the Simple Network Management Protocol.
o The snmpctl(8) program controls the SNMP daemon.
o The pcidump(8) utility displays the device address, vendor, and
product name of PCI devices.
o ldattach(8) is used to attach a line discipline to a serial line to
allow for in-kernel processing of the received and/or sent data.

- New functionality:
o eeprom(8) is now able to display the OpenPROM device tree on
systems that have it.
o Support for X11 on sgi has been added.
o The periodic security(8) reports now include package changes.
o The cmpci(4) driver now supports multichannel audio playback if
the hardware supports it.
o The auvia(4) driver now supports multichannel audio playback if
the hardware supports it.
o The auich(4) driver now supports recording from the microphone as
well as full-duplex mode.
o The eso(4) driver now supports recording as well as full-duplex mode.
o The ffs layer is now 64-bit disk block address clean. This means that
disks, partitions and filesystems larger than 2TB are now supported,
with the exception of statfs(2) and quotas.
o DMA is now enabled for 1-sector devices such as flash drives,
providing significant speed improvement.
o Sparc and Sparc64 disklabels now provide automatic recognition of
ext2fs partitions.
o Filesystems on USB devices are automatically dismounted if the device
is disconnected.
o The configuration of carp(4) load balancing has been vastly simplified.
o fstab(5) entries referring to non-existent mount points are now ignored,
allowing subsequent entries to be processed.
o Additional configuration files can now be included in pf.conf(5).
o sppp(4) now has IPv6 support.

- Assorted improvements and code cleanup:
o Improved support for an lkm(4) subsystem on amd64.
o ossaudio(3) received several bug fixes and enhancements including but
not limited to improved recording and full-duplex support.
o audio(4) received several bug fixes and enhancements including but
not limited to improved recording and full-duplex support.
o make(1) was heavily modified, mostly to improve support for parallel
build. Parallel builds now run commands in the same way the sequential
builds do, and the output from commands is more readable. A large part
of the source tree, xenocara, and quite a few ports now build correctly
with make -j.
o rcs tools improvements and bug fixes.
o RTM_VERSION was increased so that all routing messages could be modified
to include additional fields for upcoming networking features.
o sendbug(1) has stricter comment parsing, to avoid mangling diffs.
o umass(4) devices no longer detect bogus LUNs.
o USB st(4) devices can now successfully disconnect.
o More deviant umass devices accommodated.
o svnd(4) devices now work on block devices.
o disklabel(8) is now aware of NTFS partitions.
o raidctl(8) now correctly handles trailing whitespace in configuration
files.
o mt(1) no longer triggers panics when processing the 'rewoffl' command.
o raid(4) devices no longer hang when searching for components during boot.
o sd(4) devices no longer receive spurious SYNCHRONIZE CACHE commands that
confuse some hardware.
o sd(4) no longer claim that SYNCHRONIZE CACHE commands are 16 bytes long
when they are actually 10 bytes. Some devices took this too literally.
o dhcpd(8) now always issues packets equal or larger than the minimum
IP MTU.
o The disklabel(8) -E mode does not allow manual editing of the 'c'
partition, which is always set to cover the entire disk.
o The disklabel(8) -E mode does not allow changing the cpg value of a
partition.
o The disklabel(8) -E mode command 'r' now displays the list of free
chunks on the disk.
o The disklabel(8) -E mode no longer permits assigning arbitrary sizes to
FS_BOOT and FS_UNUSED partitions.
o The bge(4) driver problems receiving jumbo frames have been resolved.
o Many dangerous unsigned comparisons with -1 when checking the results of
read and write calls have been eliminated.
o The new M_ZERO flag for malloc(9) replaces many malloc+bzero/memset
combinations, fixing a number of bugs in memory initialization and
shrinking the kernel.
o dhcpd(8) now correctly constructs response packets that use the
overflow buffers to store options.
o SCSI drivers are more reliable in MP machines due to better locking
around command completion.
o TCP responses to highly fragmented packets are now constructed without
risking corruption of kernel memory.
o Sockets now allow 4095 multicast group memberships.

- Install/Upgrade process changes:
o All platforms now have serial console support when installing.
o Serial console speed is detected and appropriate /etc/ttys entries
automatically created.
o OpenBSD/vax now also has both kinds of install ISO CD images.
o DNS server addresses are remembered if an install is restarted.
o OpenBSD/sgi can now be installed using the glass console.

- OpenBGPD 4.3:
o Correctly handle prefixes which would cause a routing loop.
o bgpctl's detailed RIB output shows additional attributes like
extended communities or the cluster id list.

- OpenNTPD 4.3:
o Handle IP changes of clients more gracefully.
o Log peer and sensor status to syslog if the majority of either is
bad, or if a SIGINFO signal is received.
o Allow offsetting of time sensors that have a systematic error.

- OpenOSPFD 4.3:
o Equal cost multipath support -- don't forget to set the right sysctls.
o Parser and commandline options are now in sync with bgpd.

- relayd 4.3:
o hoststated(8)/hoststatectl(8) were renamed to relayd(8)/relayctl(8).
o Improved configuration grammar for relayd.conf(5).
o Allow to send SNMP traps via snmpd(8) when host states change.
o Improved support for URL filtering and protocol actions.
o Added support for UDP-based DNS relaying with request ID randomisation.
o Various bug fixes, optimisations, and cleanups.
o Improved reload support.

- OpenSSH 4.8:
o Added chroot(2) support for sshd(8), controlled by a new option
"ChrootDirectory". Please refer to sshd_config(5) for details, and
please use this feature carefully.
o Linked sftp-server(8) into sshd(8). The internal sftp server is used
when the command "internal-sftp" is specified in a Subsystem or
ForceCommand declaration. When used with ChrootDirectory, the internal
sftp server requires no special configuration of files inside the
chroot environment. Please refer to sshd_config(5) for more information.
o Added a protocol extension method "posix-rename@..." for
sftp-server(8) to perform POSIX atomic rename() operations.
o Removed the fixed limit of 100 file handles in sftp-server(8). The
server will now dynamically allocate handles up to the number of
available file descriptors.
o ssh(1) will now skip generation of SSH protocol 1 ephemeral server keys
when in inetd mode and protocol 2 connections are negotiated. This
speeds up protocol 2 connections to inetd-mode servers that also
allow Protocol 1.
o Accept the PermitRootLogin directive in a sshd_config(5) Match block.
Allows for, e.g. permitting root only from the local network.
o Reworked sftp(1) argument splitting and escaping to be more internally
consistent (i.e. between sftp commands) and more consistent with sh(1).
Please note that this will change the interpretation of some quoted
strings, especially those with embedded backslash escape sequences.
o Support "Banner=none" in sshd_config(5) to disable sending of a
pre-login banner (e.g. in a Match block).
o ssh(1) ProxyCommands are now executed with $SHELL rather than /bin/sh.
o ssh(1)'s ConnectTimeout option is now applied to both the TCP
connection and the SSH banner exchange (previously it just covered
the TCP connection). This allows callers of ssh(1) to better detect
and deal with stuck servers that accept a TCP connection but don't
progress the protocol, and also makes ConnectTimeout useful for
connections via a ProxyCommand.
o Many new regression tests, including interop tests against PuTTY's plink.
o SSH2_MSG_UNIMPLEMENTED packets did not correctly reset the client
keepalive logic, causing disconnections on servers that did not
explicitly implement "keepalive@...".
o ssh(1) used the obsolete SIG DNS RRtype for host keys in DNS, instead
of the current standard RRSIG.
o Correctly drain ACKs when a sftp(1) upload write fails midway, avoids
a fatal() exit from what should be a recoverable condition.
o Fixed packet size advertisements. Previously TCP and agent forwarding
incorrectly advertised the channel window size as the packet size,
causing fatal errors under some conditions.
o Many more bugfixes. Please refer to the Release Notes.

- Over 4,500 ports, minor robustness improvements in package tools.
o Many pre-built packages for each architecture:
i386: 4782 sparc64: 4613 alpha: 4233 sh: 2046
amd64: 4708 powerpc: 4634 sparc: 3159 m68k: 830
arm: 3377 hppa: 3971 m88k: 27 mips64: 1897
vax: 296
o Highlights include:
o Gnome 2.20.3.
o GNUstep 1.14.2.
o KDE 3.5.8.
o Mozilla Firefox 2.0.0.12.
o Mozilla Thunderbird 2.0.0.12.
o MySQL 5.0.51a
o OpenMotif 2.3.0.
o OpenOffice.org 2.3.1.
o PostgreSQL 8.2.6.
o Xfce 4.4.2.

- As usual, steady improvements in manual pages and other documentation.

- The system includes the following major components from outside
suppliers:
o Xenocara (based on X.Org 7.2 + patches, freetype 2.2.1,
fontconfig 2.4.2, expat 2.0.0, Mesa 6.5.2, xterm 225 and more)
o Gcc 2.95.3 (+ patches) and 3.3.5 (+ patches)
o Perl 5.8.8 (+ patches)
o Our improved and secured version of Apache 1.3, with SSL/TLS and DSO
support
o OpenSSL 0.9.7j (+ patches)
o Groff 1.15
o Sendmail 8.14.1, with libmilter
o Bind 9.3.4 (+ patches)
o Lynx 2.8.5rel.4 with HTTPS and IPv6 support (+ patches)
o Sudo 1.6.9p4
o Ncurses 5.2
o Latest KAME IPv6
o Heimdal 0.7.2 (+ patches)
o Arla 0.35.7
o Binutils 2.15 (+ patches)
o Gdb 6.3 (+ patches)

If you'd like to see a list of what has changed between OpenBSD 4.2
and 4.3, look at

http://www.OpenBSD.org/plus43.html

Even though the list is a summary of the most important changes
made to OpenBSD, it still is a very very long list.

------------------------------------------------------------------------
- SECURITY AND ERRATA --------------------------------------------------

We provide patches for known security threats and other important
issues discovered after each CD release. As usual, between the
creation of the OpenBSD 4.3 FTP/CD-ROM binaries and the actual 4.3
release date, our team found and fixed some new reliability problems
(note: most are minor and in subsystems that are not enabled by
default). Our continued research into security means we will find
new security problems -- and we always provide patches as soon as
possible. Therefore, we advise regular visits to

http://www.OpenBSD.org/security.html
and
http://www.OpenBSD.org/errata.html

Security patch announcements are sent to the security-announce@...
mailing list. For information on OpenBSD mailing lists, please see:

http://www.OpenBSD.org/mail.html

------------------------------------------------------------------------
- CD-ROM SALES ---------------------------------------------------------

OpenBSD 4.3 is also available on CD-ROM. The 3-CD set costs $50 CDN
(EUR 50 including VAT) and is available via mail order and from a number
of contacts around the world. The set includes a colourful booklet
which carefully explains the installation of OpenBSD. A new set
of cute little stickers is also included (sorry, but our FTP mirror
sites do not support STP, the Sticker Transfer Protocol). As an
added bonus, the second CD contains an audio track, a song entitled
"Home to Hypocrisy". MP3 and OGG versions of the audio track can be
found on the first CD.

Lyrics (and an explanation) for the songs may be found at:

http://www.OpenBSD.org/lyrics.html#43

Profits from CD sales are the primary income source for the OpenBSD
project -- in essence selling these CD-ROM units ensures that OpenBSD
will continue to make another release six months from now.

The OpenBSD 4.3 CD-ROMs are bootable on the following four platforms:

o i386
o amd64
o macppc
o sparc64

(Other platforms must boot from floppy, network, or other method).

For more information on ordering CD-ROMs, see:

http://www.OpenBSD.org/orders.html

The above web page lists a number of places where OpenBSD CD-ROMs
can be purchased from. For our default mail order, go directly to:

https://https.OpenBSD.org/cgi-bin/order

or, for European orders:

https://https.OpenBSD.org/cgi-bin/order.eu

All of our developers strongly urge you to buy a CD-ROM and support
our future efforts. Additionally, donations to the project are
highly appreciated, as described in more detail at:

http://www.OpenBSD.org/goals.html#funding

------------------------------------------------------------------------
- OPENBSD FOUNDATION ---------------------------------------------------

For those unable to make their contributions as straightforward gifts,
the OpenBSD Foundation (http://www.openbsdfoundation.org) is a Canadian
not-for-profit corporation that can accept larger contributions and
issue receipts. In some situations, their receipt may qualify as a
business expense writeoff, so this is certainly a consideration for
some organizations or businesses. There may also be exposure benefits
since the Foundation may be interested in participating in press releases.
In turn, the Foundation then uses these contributions to assist OpenBSD's
infrastructure needs. Contact the foundation directors at
directors@... for more information.

------------------------------------------------------------------------
- T-SHIRT SALES --------------------------------------------------------

The OpenBSD distribution companies also sell tshirts and polo shirts.
And our users like them too. We have a variety of shirts available,
with the new and old designs, from our web ordering system at:

https://https.OpenBSD.org/cgi-bin/order

and for Europe:

https://https.OpenBSD.org/cgi-bin/order.eu

The OpenBSD 4.3 t-shirts are available now. The new shirt for 4.3 has
a newly drawn version of Puffy (the blowfish) on a simple green shirt.
We also sell our older shirts, as well as a selection of OpenSSH t-shirts.

------------------------------------------------------------------------
- FTP INSTALLS ---------------------------------------------------------

If you choose not to buy an OpenBSD CD-ROM, OpenBSD can be easily
installed via FTP. Typically you need a single small piece of boot
media (e.g., a boot floppy) and then the rest of the files can be
installed from a number of locations, including directly off the
Internet. Follow this simple set of instructions to ensure that
you find all of the documentation you will need while performing
an install via FTP. With the CD-ROMs, the necessary documentation
is easier to find.

1) Read either of the following two files for a list of ftp
mirrors which provide OpenBSD, then choose one near you:

http://www.OpenBSD.org/ftp.html
ftp://ftp.OpenBSD.org/pub/OpenBSD/4.3/ftplist

As of May 1, 2008, the following ftp mirror sites have the 4.3 release:

ftp://ftp.kd85.com/pub/OpenBSD/4.3/ Austria
ftp://ftp.stacken.kth.se/pub/OpenBSD/4.3/ Sweden
ftp://ftp2.usa.openbsd.org/pub/OpenBSD/4.3/ NYC, USA
ftp://ftp3.usa.openbsd.org/pub/OpenBSD/4.3/ CO, USA
ftp://ftp5.usa.openbsd.org/pub/OpenBSD/4.3/ CA, USA
ftp://rt.fm/pub/OpenBSD/4.3/ IL, USA

The release is also available at the master site:

ftp://ftp.openbsd.org/pub/OpenBSD/4.3/ Alberta, Canada

However it is strongly suggested you use a mirror.

Other mirror sites may take a day or two to update.

2) Connect to that ftp mirror site and go into the directory
pub/OpenBSD/4.3/ which contains these files and directories.
This is a list of what you will see:

ANNOUNCEMENT amd64/ macppc/ sys.tar.gz
Changelogs/ armish/ mvme68k/ tools/
HARDWARE ftplist packages/ vax/
PACKAGES hp300/ ports.tar.gz xenocara.tar.gz
PORTS hppa/ root.mail zaurus/
README i386/ sparc/
SIZES landisk/ sparc64/
alpha/ mac68k/ src.tar.gz

It is quite likely that you will want at LEAST the following
files which apply to all the architectures OpenBSD supports.

README - generic README
HARDWARE - list of hardware we support
PORTS - description of our "ports" tree
PACKAGES - description of pre-compiled packages
root.mail - a copy of root's mail at initial login.
(This is really worthwhile reading).

3) Read the README file. It is short, and a quick read will make
sure you understand what else you need to fetch.

4) Next, go into the directory that applies to your architecture,
for example, i386. This is a list of what you will see:

INSTALL.i386 cd43.iso floppyB43.fs pxeboot*
INSTALL.linux cdboot* floppyC43.fs xbase43.tgz
MD5 cdbr* game43.tgz xetc43.tgz
base43.tgz cdemu43.iso index.txt xfont43.tgz
bsd* comp43.tgz install43.iso xserv43.tgz
bsd.mp* etc43.tgz man43.tgz xshare43.tgz
bsd.rd* floppy43.fs misc43.tgz

If you are new to OpenBSD, fetch _at least_ the file INSTALL.i386
and the appropriate floppy*.fs or install43.iso files. Consult the
INSTALL.i386 file if you don't know which of the floppy images
you need (or simply fetch all of them).

If you use the install43.iso file (roughly 200MB in size), then you
do not need the various *.tgz files since they are contained on that
one-step ISO-format install CD.

5) If you are an expert, follow the instructions in the file called
README; otherwise, use the more complete instructions in the
file called INSTALL.i386. INSTALL.i386 may tell you that you
need to fetch other files.

6) Just in case, take a peek at:

http://www.OpenBSD.org/errata.html

This is the page where we talk about the mistakes we made while
creating the 4.3 release, or the significant bugs we fixed
post-release which we think our users should have fixes for.
Patches and workarounds are clearly described there.

Note: If you end up needing to write a raw floppy using Windows,
you can use "fdimage.exe" located in the pub/OpenBSD/4.3/tools
directory to do so.

------------------------------------------------------------------------
- X.ORG FOR MOST ARCHITECTURES -----------------------------------------

X.Org has been integrated more closely into the system. This release
contains X.Org 7.2.0. Most of our architectures ship with X.Org, including
amd64, sparc, sparc64 and macppc. During installation, you can install
X.Org quite easily. Be sure to try out xdm(1) and see how we have
customized it for OpenBSD.

------------------------------------------------------------------------
- PORTS TREE -----------------------------------------------------------

The OpenBSD ports tree contains automated instructions for building
third party software. The software has been verified to build and
run on the various OpenBSD architectures. The 4.3 ports collection,
including many of the distribution files, is included on the 3-CD
set. Please see the PORTS file for more information.

Note: some of the most popular ports, e.g., the Apache web server
and several X applications, come standard with OpenBSD. Also, many
popular ports have been pre-compiled for those who do not desire
to build their own binaries (see BINARY PACKAGES, below).

------------------------------------------------------------------------
- BINARY PACKAGES WE PROVIDE -------------------------------------------

A large number of binary packages are provided. Please see the PACKAGES
file (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.3/PACKAGES) for more details.

------------------------------------------------------------------------
- SYSTEM SOURCE CODE ---------------------------------------------------

The CD-ROMs contain source code for all the subsystems explained
above, and the README (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.3/README)
file explains how to deal with these source files. For those who
are doing an FTP install, the source code for all four subsystems
can be found in the pub/OpenBSD/4.3/ directory:

xenocara.tar.gz ports.tar.gz src.tar.gz sys.tar.gz

------------------------------------------------------------------------
- THANKS ---------------------------------------------------------------

OpenBSD 4.3 includes artwork and CD artistic layout by Ty Semaka,
who also arranged an audio track on the OpenBSD 4.3 CD set. Ports
tree and package building by Antoine Jacoutot, Nikolay Sturm,
Robert Nagy and Christian Weisgerber. System builds by Theo de Raadt,
and Miod Vallat. X11 builds by Todd Fries. ISO-9660 filesystem
layout by Theo de Raadt.

We would like to thank all of the people who sent in bug reports, bug
fixes, donation cheques, and hardware that we use. We would also like
to thank those who pre-ordered the 4.3 CD-ROM or bought our previous
CD-ROMs. Those who did not support us financially have still helped
us with our goal of improving the quality of the software.

Our developers are:

Alexander Bluhm, Alexander von Gernler, Alexandre Anriot,
Alexandre Ratchov, Anders Magnusson, Antoine Jacoutot,
Artur Grabowski, Austin Hook, Bernd Ahlers, Bob Beck, Brad Smith,
Bret Lambert, Can Erkin Acar, Chad Loder, Charles Longeau,
Chris Kuethe, Christian Weisgerber, Christopher Pascoe,
Claudio Jeker, Constantine A. Murenin, Dale Rahn, Damien Bergamini,
Damien Miller, Daniel Hartmeier, Darren Tucker, David Gwynne,
David Krause, Deanna Phillips, Eric Faurot, Esben Norby,
Federico G. Schwindt, Felix Kronlage, Gilles Chehade,
Gordon Willem Klok, Hans-Joerg Hoexer, Henning Brauer,
Henric Jungheim, Hugh Graham, Ian Darwin, Igor Sobrado,
Jacob Meuser, Jakob Schlyter, Janne Johansson, Jason Dixon,
Jason McIntyre, Jasper Lievisse Adriaanse, Joel Knight, Joel Sing,
Johan Mson Lindman, Jolan Luff, Jonathan Gray, Jordan Hargrave,
Joris Vink, Kenneth R Westerback, Kevin Steves, Kjell Wooding,
Kurt Miller, Landry Breuil, Laurent Fanis, Marc Balmer, Marc Espie,
Marc Winiger, Marco Peereboom, Marco Pfatschbacher, Marco S Hyman,
Marcus Glocker, Mark Kettenis, Mark Uemura, Markus Friedl,
Martin Reindl, Martynas Venckus, Mathieu Sauve-Frankel,
Mats O Jansson, Matthias Kilian, Matthieu Herrb, Michael Erdely,
Michael Knudsen, Mike Belopuhov, Miod Vallat, Moritz Grimm,
Moritz Jodeit, Niall O'Higgins, Nick Holland, Nikolay Sturm,
Okan Demirmen, Oleg Safiullin, Otto Moerbeek, Owain Ainsworth,
Peter Stromberg, Peter Valchev, Pierre-Yves Ritschard, Ray Lai,
Reyk Floeter, Robert Nagy, Rui Reis, Ryan Thomas McBride,
Saad Kadhi, Simon Bertrang, Stefan Kempf, Steven Mestdagh,
Stuart Henderson, Ted Unangst, Theo de Raadt, Thordur I. Bjornsson,
Tobias Stoeckmann, Tobias Weingartner, Todd C. Miller,
Todd T. Fries, Tomoyuki Sakurai, Uwe Stuehler, Will Maier,
Wim Vandeputte, Xavier Santolaria, Joshua Stein

UltraSPARC T1 support

2008-04-03T13:59:37Z

Yesterday I committed the last bit of code to support machines with
Sun's UltraSPARC T1 CPUs. Below is a dmesg for the SPARC Enterprise
T1000, and although other machines have not been tested yet, machines
like the SPARC Enterprise T2000 and Sun Blade T6300 are expected to
work too. As you can see, we support SMP right from the start.

All this is included in a standard OpenBSD/sparc64 kernel. Snapshots
with UltraSPARC T1 support are now available at ftp.openbsd.org and
its mirrors. It would be great if people could try these snapshots on
a few more UltraSPARC T1 machines.

LDOM support is not yet complete; I'm still working on drivers for
virtual network interfaces and virtual disks. But domains with access
to real hardware should work fine.

UltraSPARC T2 machines are not yet supported, but hopefully that'll
change soon.

Cheers,

Mark

console is /virtual-devices@100/console@1
Copyright (c) 1982, 1986, 1989, 1991, 1993
The Regents of the University of California. All rights reserved.
Copyright (c) 1995-2008 OpenBSD. All rights reserved. http://www.OpenBSD.org

OpenBSD 4.3-current (GENERIC.MP) #3: Thu Apr 3 21:13:13 CEST 2008
kettenis@...:/usr/src/sys/arch/sparc64/compile/GENERIC.MP
real mem = 17045651456 (16256MB)
avail mem = 16679108608 (15906MB)
mainbus0 at root: SPARC Enterprise T1000
cpu0 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu1 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu2 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu3 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu4 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu5 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu6 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu7 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu8 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu9 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu10 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu11 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu12 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu13 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu14 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu15 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu16 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu17 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu18 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu19 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu20 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu21 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu22 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu23 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu24 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu25 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu26 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu27 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu28 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu29 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu30 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
cpu31 at mainbus0: SUNW,UltraSPARC-T1 (rev 0.0) @ 1000 MHz
vbus0 at mainbus0
"channel-devices" at vbus0 not configured
"flashprom" at vbus0 not configured
vcons0 at vbus0
vrtc0 at vbus0
"fma" at vbus0 not configured
"sunvts" at vbus0 not configured
"sunmc" at vbus0 not configured
"explorer" at vbus0 not configured
"led" at vbus0 not configured
"flashupdate" at vbus0 not configured
"ncp" at vbus0 not configured
vpci0 at mainbus0: bus 2 to 2, dvma map 80000000-ffffffff
pci0 at vpci0
ebus0 at mainbus0
com0 at ebus0 addr c2c000-c2c007 ivec 0xa: st16650, 32 byte fifo
vpci1 at mainbus0: bus 2 to 4, dvma map 80000000-ffffffff
pci1 at vpci1
ppb0 at pci1 dev 0 function 0 "ServerWorks PCIE-PCIX" rev 0xb3
pci2 at ppb0 bus 3
bge0 at pci2 dev 4 function 0 "Broadcom BCM5714" rev 0xa2, BCM5715 A1 (0x9001): ivec 0x7d4, address 00:14:4f:83:47:7a
brgphy0 at bge0 phy 1: BCM5714 10/100/1000baseT PHY, rev. 0
bge1 at pci2 dev 4 function 1 "Broadcom BCM5714" rev 0xa2, BCM5715 A1 (0x9001): ivec 0x7d5, address 00:14:4f:83:47:7b
brgphy1 at bge1 phy 1: BCM5714 10/100/1000baseT PHY, rev. 0
ppb1 at pci2 dev 8 function 0 "ServerWorks HT-1000 PCIX" rev 0xb3
pci3 at ppb1 bus 4
bge2 at pci3 dev 1 function 0 "Broadcom BCM5704C" rev 0x10, BCM5704 B0 (0x2100): ivec 0x7c2, address 00:14:4f:83:47:7c
brgphy2 at bge2 phy 1: BCM5704 10/100/1000baseT PHY, rev. 0
bge3 at pci3 dev 1 function 1 "Broadcom BCM5704C" rev 0x10, BCM5704 B0 (0x2100): ivec 0x7c1, address 00:14:4f:83:47:7d
brgphy3 at bge3 phy 1: BCM5704 10/100/1000baseT PHY, rev. 0
mpi0 at pci3 dev 2 function 0 "Symbios Logic SAS1064" rev 0x02: ivec 0x7c0
scsibus0 at mpi0: 63 targets
sd0 at scsibus0 targ 0 lun 0: <FUJITSU, MAY2073RCSUN72G, 0501> SCSI2 0/direct fixed
sd0: 70007MB, 14100 cyl, 24 head, 423 sec, 512 bytes/sec, 143374738 sec total
sd1 at scsibus0 targ 1 lun 0: <FUJITSU, MAY2073RCSUN72G, 0501> SCSI2 0/direct fixed
sd1: 70007MB, 14100 cyl, 24 head, 423 sec, 512 bytes/sec, 143374738 sec total
softraid0 at root
bootpath: /pci@7c0,0/pci@0,0/pci@8,0/scsi@2,0/disk@1,0
root on sd1a swap on sd1b dump on sd1b

Announce: OpenSSH 5.0 released

2008-04-03T03:48:30Z

OpenSSH 5.0 has just been released. It will be available from the
mirrors listed at http://www.openssh.com/ shortly.

We apologise for any inconvenience resulting from this release
being made so shortly after 4.9. Unfortunately we only learned of
the below security issue from the public CVE report. The Debian
OpenSSH maintainers responsible for handling the initial report of
this bug failed to report it via either the private OpenSSH security
contact list (openssh@...) or the portable OpenSSH Bugzilla
(http://bugzilla.mindrot.org/).

We ask anyone wishing to report security bugs in OpenSSH to please use
the openssh@... contact and to practice responsible disclosure.

OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0
implementation and includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots and purchased
T-shirts or posters.

T-shirt, poster and CD sales directly support the project. Pictures
and more information can be found at:
http://www.openbsd.org/tshirts.html and
http://www.openbsd.org/orders.html

For international orders use http://https.openbsd.org/cgi-bin/order
and for European orders, use http://https.openbsd.org/cgi-bin/order.eu

Changes since OpenSSH 4.9:
============================

Security:

* CVE-2008-1483: Avoid possible hijacking of X11-forwarded connections
by refusing to listen on a port unless all address families bind
successfully.

Checksums:
==========

- SHA1 (openssh-5.0.tar.gz) = 729fb3168edf6a68408223b5ed82e59d13b57c47
- SHA1 (openssh-5.0p1.tar.gz) = 121cea3a730c0b0353334b6f46f438de30ab4928

Reporting Bugs:
===============

- please read http://www.openssh.com/report.html
and http://bugzilla.mindrot.org/

OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and
Ben Lindstrom.

Mailing list downtime: April 5th

2008-04-01T07:30:15Z

The OpenBSD mailing lists will be down on Saturday April 5th from
4am MDT to 6pm MDT for machine room maintainance. This will also
affect anoncvs3.usa.openbsd.org and ftp.usa.openbsd.org which are
located in the same machine room.

- todd

Announce: OpenSSH 4.9 released

2008-03-30T18:35:53Z

OpenSSH 4.9 has just been released. It will be available from the
mirrors listed at http://www.openssh.com/ shortly.

OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0
implementation and includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots and purchased
T-shirts or posters.

T-shirt, poster and CD sales directly support the project. Pictures
and more information can be found at:
http://www.openbsd.org/tshirts.html and
http://www.openbsd.org/orders.html

For international orders use http://https.openbsd.org/cgi-bin/order
and for European orders, use http://https.openbsd.org/cgi-bin/order.eu

Note that OpenSSH 4.8 was an OpenBSD-only release shipped with the
OpenBSD 4.3 CD.

Changes since OpenSSH 4.7:
============================

Security:

* Disable execution of ~/.ssh/rc for sessions where a command has been
forced by the sshd_config ForceCommand directive. Users who had
write access to this file could use it to execute abritrary commands.
This behaviour was documented, but was an unsafe default and an extra
hassle for administrators.

New features:

* Added chroot(2) support for sshd(8), controlled by a new option
"ChrootDirectory". Please refer to sshd_config(5) for details, and
please use this feature carefully. (bz#177 bz#1352)
* Linked sftp-server(8) into sshd(8). The internal sftp server is
used when the command "internal-sftp" is specified in a Subsystem
or ForceCommand declaration. When used with ChrootDirectory, the
internal sftp server requires no special configuration of files
inside the chroot environment. Please refer to sshd_config(5) for
more information.
* Added a "no-user-rc" option for authorized_keys to disable execution
of ~/.ssh/rc
* Added a protocol extension method "posix-rename@..." for
sftp-server(8) to perform POSIX atomic rename() operations.
(bz#1400)
* Removed the fixed limit of 100 file handles in sftp-server(8). The
server will now dynamically allocate handles up to the number of
available file descriptors. (bz#1397)
* ssh(8) will now skip generation of SSH protocol 1 ephemeral server
keys when in inetd mode and protocol 2 connections are negotiated.
This speeds up protocol 2 connections to inetd-mode servers that
also allow Protocol 1 (bz#440)
* Accept the PermitRootLogin directive in a sshd_config(5) Match
block. Allows for, e.g. permitting root only from the local
network.
* Reworked sftp(1) argument splitting and escaping to be more
internally consistent (i.e. between sftp commands) and more
consistent with sh(1). Please note that this will change the
interpretation of some quoted strings, especially those with
embedded backslash escape sequences. (bz#778)
* Support "Banner=none" in sshd_config(5) to disable sending of a
pre-login banner (e.g. in a Match block).
* ssh(1) ProxyCommands are now executed with $SHELL rather than
/bin/sh.
* ssh(1)'s ConnectTimeout option is now applied to both the TCP
connection and the SSH banner exchange (previously it just covered
the TCP connection). This allows callers of ssh(1) to better detect
and deal with stuck servers that accept a TCP connection but don't
progress the protocol, and also makes ConnectTimeout useful for
connections via a ProxyCommand.
* Many new regression tests, including interop tests against PuTTY's
plink.
* Support BSM auditing on Mac OS X

The following bugs have been fixed in this release:

- scp(1) incorrectly reported "stalled" on slow copies. (bz#799)
- scp(1) date underflow for timestamps before epoch. (bz#828)
- scp(1) and sftp(1) progressmeter type fixes. (bz#842)
- SSH2_MSG_UNIMPLEMENTED packets did not correctly reset the client
keepalive logic, causing disconnections on servers that did not
explicitly implement "keepalive@...". (bz#1307)
- ssh(1) used the obsolete SIG DNS RRtype for host keys in DNS,
instead of the current standard RRSIG. (bz#1317)
- Extract magic buffer size constants in scp(1) to #defines.
(bz#1333)
- Correctly drain ACKs when a sftp(1) upload write fails midway,
avoids a fatal() exit from what should be a recoverable condition.
(bz#1354)
- Avoid pointer arithmetic and strict aliasing warnings. (bz#1355)
- Fixed packet size advertisements. Previously TCP and agent
forwarding incorrectly advertised the channel window size as the
packet size, causing fatal errors under some conditions. (bz#1360)
- Document KbdInteractiveAuthentication in sshd_config(5). (bz#1367)
- Fixed sftp(1) file handle leak on download when the local file
could not be opened. (bz#1375)
- Fixed ssh-keygen(1) selective host key hashing (i.e.
"ssh-keygen -HF hostname") to not include any IP address in the
data to be hashed. (bz#1376)
- Fix clobbering of struct passwd from multiple getpwid calls,
resulting in fatal errors inside tilde_expand_filename. (bz#1377)
- Fix parsing of port-forwarding specifications to correctly
detect errors in either specified port number. (bz#1378)
- Fix memory leak in ssh(1) ~ escape commandline handling. (bz#1379)
- Make ssh(1) skip listening on the IPv6 wildcard address when a
binding address of 0.0.0.0 is used against an old SSH server that
does not support the RFC4254 syntax for wildcard bind addresses.
(bz#1381)
- Remove extra backslashes in the RB_PROTOTYPE macro definition.
(bz#1385)
- Support ssh(1) RekeyLimits up to the maximum allowed by the
protocol: 2**32-1. (bz#1390)
- Enable IPV6_V6ONLY socket option on sshd(8) listen socket, as is
already done for X11/TCP forwarding sockets. (bz#1392)
- Fix FD leak that could hang a ssh(1) connection multiplexing
master. (bz#1398)
- Improve error messages when hostname resolution fails due to a
system error. (bz#1417)
- Make ssh(1) -q option documentation consistent with reality.
(bz#1427 bz#1429)

Portable OpenSSH bugs fixed:

- Fixed sshd(8) PAM support not calling pam_session_close(), or
failing to call it with root privileges. (bz#926)
- Made sshd(8) use configuration-specified SyslogFacility for
hosts_access(3) messages for denied connections. (bz#1042)
- Implement getgrouplist(3) for AIX, enabling NSS LDAP to work on
this platform. (bz#1081)
- Fix compilation errors on AIX due to misdefinition of LLONG_MAX.
(bz#1347)
- Force use of local glob(3) implementation on Mac OS X and FreeBSD,
as the platform versions lack features or have unexpected
behaviour. (bz#1407)
- Reduce stdout/stderr noise from ssh-copy-id. (bz#1431)
- Fix activation of OpenSSL engine support when requested in
configure. (bz#1437)

Checksums:
==========

- SHA1 (openssh-4.9.tar.gz) = fa7d1b3dcb093bd0dfc643b33b1a57a26f459373
- SHA1 (openssh-4.9p1.tar.gz) = 91575878883065bd777f82b47e0d481ac69ee7fe

Reporting Bugs:
===============

- please read http://www.openssh.com/report.html
and http://bugzilla.mindrot.org/

OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and
Ben Lindstrom.

Call for Papers: Eurobsdcon2008 in Strasbourg, France

2008-03-30T13:52:04Z

EuroBSDcon 2008: Family Meeting

The European BSD Conference, October 18-19th 2008, Strasbourg, France

FreeBSD, NetBSD, OpenBSD, MacOS X, DragonFlyBSD, PC-BSD, DesktopBSD: Are you
doing interesting things with one of these BSD based operating system?

Anything hot you are working on? Come to Strasbourg and talk about it!

EuroBSDCon is a conference for users and developers on BSD based systems. We
are looking for papers about all aspects of BSD based operating systems
especially if you can tell our audience something new about:

* Products embedding BSD systems
* Desktop computing with BSD systems
* BSD based products, how, why, what
* How you are reworking ports pkgsrc
* What are the BSD developers working on now
* Virtualizing BSD based systems
* Installing BSD system on your coffee machine
* File systems, networking, security, and general kernel hacking
* Tools for monitoring, measuring, debugging, and optimizing BSD systems
* The science and art of open source programming

Extended abstract (two A4 pages) in English, with an outline of your proposed
talk, a few keywords and a bit about yourself should be sent to us by email at
pc@... before June 1st 2008.

If you are interested in presenting a tutorial, please let us know.

Practical Information

Speakers attend the conference for free and we will reimburse speakers travel
and lodging if nobody else will pay for it. We will aim to finalize the
program and notify the selected speakers by July 1st 2008. All speakers will
be expected to produce a final paper and electronic files for the conference
web site by September 15th, 2008.

We will not waste money and trees on printed proceedings but will distribute
the conference material electronically and expect to receive your final slides
no later than 4 weeks before the conference. Please let us know if you want
to include other materials (articles, HOWTO etc). All papers should be
considered 'open source', and as such, non-disclosure agreements and other
limits will require us to return the paper.

If you want to give a short talk about recent developments, early projects or
a new idea not yet ready to be published, a ?Works In Progress? session can
be organized during the conference. We are particularly interested in
presentation of student work.

The language of the conference is English. If we can arrange it, all talks
will be videotaped (unless the speaker objects).

Find more info about the conference, travel, accommodation and more, at the
conference website http://2008.euroBSDCon.org/.

The conference program is in the capable hands of:

* Mathieu Arnold
* Emmanuel Dreyfus
* Philip Paeps
* Ollivier Robert
* Thierry Thomas
* Wim Vandeputte
* Robert Watson

--
Mathieu Arnold

mailing list server downtime

2008-01-25T15:35:30Z

The OpenBSD mailing list server will be down from 5am to 6pm MST
on Saturday, Jan 26th. Facilities needs to shut down the computer
room cooling system for some plumbing work, and they are scheduled
to finish by 6pm. If they finish earlier the list server will be
back sooner.

This also affects anoncvs3.usa.openbsd.org which resides in the
same machine room.

- todd

ComixWall 4.2 released

2008-01-06T04:52:44Z

I am pleased to announce that ComixWall ISG 4.2 has been released.
ComixWall is an Internet Security Gateway (ISG): FOSS UTM firewall
running on OpenBSD, with a user-friendly web interface for
administration and monitoring. ComixWall is unique, first of its kind in
many ways.

Highlights of this release are:
- OpenBSD 4.2-stable, i.e. includes all of the stable patches as of
December
- Support for both amd64 and i386 architectures, thus there are 2
installation CD images
- Upgrade support, from ComixWall 4.1b amd64 to 4.2 amd64
- New install/upgrade scripts, based on OpenBSD installation scripts
- xbase install set stripped down to save space on the CD image and the
file system
- SnortIPS: Intrusion Prevention System (IPS) based on snort alerts,
totally relies on pfctl
- Snort 2.8.0.1: Intrusion Detection System (IDS), with alerts log
rotate and 64-bit time stamp patches
- ClamAV 0.92: Anti-virus scanner
- DansGuardian 2.9.9.2 with clamd: Content scanning web filter
- IMSpector, CVS build as of 20071130: Message logging IM proxy which
supports MSN, IRC, Yahoo, etc.
- pfw 0.7.8: Web interface for pf, patched for bugs
- Updated software packages from OpenBSD ports collection
- Additions, enhancements, and fixes to the Web Administration
Interface, too numerous to list here
- Full English, partial Turkish, and even less complete Spanish support
on the web interface
- Installation and System Administration Guides, both in English and
Turkish

ComixWall ISG comes bundled with other software too, which are either
included in OpenBSD and its ports collection or specifically ported to
OpenBSD for ComixWall:

- SpamAssassin: Anti-spam scanner
- OpenBSD spamd: spam deferral daemon
- P3scan: POP3 anti-virus/anti-spam proxy
- smtp-gated: SMTP anti-virus/anti-spam proxy
- Dante: SOCKS proxy
- Squid: HTTP proxy
- Apache Web Server (OpenBSD httpd)
- OpenBSD ftp-proxy
- DNS server
- DHCP server
- OpenSSH
- symon: System monitoring daemon
- pmacct: Network monitoring daemon

The Web Administration Interface is developed specifically for
ComixWall. In most cases, you won't have to go to the command line for
basic configuration of the system, but one of its most important design
goals is that you can use the web interface and the command line
completely interchangeably, namely it never recreates configuration
files, but modifies only the specific setting you want to change within
the configuration file (e.g. your custom comments remain intact). The
web interface provides statistics and logs pages for most modules. Its
other features are too numerous to list here.

ComixWall installation is designed so that the system is configured with
basic settings and usable out-of-the-box, right after first boot.

Please visit http://comixwall.org for further details and documentation.

Only bittorrent download is supported for CD iso files. You can obtain
the torrent files for both amd64 and i386 archs under ComixWall 4.2
Release Downloads section on the project web site. Please note that
ComixWall System Administration Guides (SAG), both English and Turkish,
are available in the CD image too (on the System > Downloads page of the
web administration interface), you don't have to download them
separately from the project web site.

You can download the torrent files on torrentbox tracker web site too:
http://torrentbox.com/download/161535/comixwall42_amd64.iso.torrent
http://torrentbox.com/download/161536/comixwall42_i386.iso.torrent

All of the software running on ComixWall are BSD, GPL, or similarly
licensed. The web interface is released under BSD license too.

Downloads on the project web site include all of the ports packages of
the software not in the OpenBSD ports collection yet. Binary packages
are in the installation CD images, naturally.

Anonymous CVS is available for the latest web interface source code. You
can use the CVSweb on the project web site to browse the source code
too.

The project has misc@ mailing list, where you can receive announcements
and get community help. (However, if possible, be sure to whitelist
comixwall.org and its IP address if your MTA rejects e-mails coming from
ADSL connections. Also check your Spam/Junk folder if your MTA or mail
client considers such e-mail as spam.)

If you want to support the ComixWall project, please:
1. Seed the torrent files
2. Translate the ComixWall web interface into your native language (it's
easy, and main menus and labels are enough)
3. Purchase an official OpenBSD CD set, if you haven't done so yet
(rhymed nicely too :))

Soner Tari, The ComixWall project.

The Book of PF by Peter N.M. Hansteen.

2007-12-24T08:28:01Z

The Book of PF by Peter N.M. Hansteen.

Book blurb: The Book of PF is a practical, how-to guide to building the
network you need with the powerful BSD Packet Filter, PF. From simple
NAT to load balancing, queues, and more, there's something for every BSD
admin.

http://www.nostarch.com/pf.htm

This book has now been printed and is in transit or already arrived at
your favorite computer book store.

We would also like to announce it's availablity on the OpenBSD website,
where part of the proceeds goes to help support the project:

http://www.openbsd.org/orders.html

AsiaBSDCon 2008 in Tokyo - extension of submission deadline

2007-11-28T11:55:39Z

Hello,

AsiaBSDCon 2008 will be held in March 27-30, 2008, in Tokyo. We are
now requesting proposals for papers, presentations, and tutorials.
The submission deadline has been extended to December 11, 2007.

Due to some server problems submission interface in the official web
site is not ready yet, so please submit your proposal directly to
secretary@... via email (submission via web site will be
available this weekend).

Also, if you are interested in attending the conference, please
subscribe the announce mailing list. See
http://lists.asiabsdcon.org/mailman/listinfo/announce for details.
You can find the last time conference program, proceedings, and so on
at http://2007.asiabsdcon.org/.

Important dates:

11 December 2007 (extended)
Extended abstracts for papers and presentations acceptance ends.

24 December 2007
Authors and presenters notified by the program committee.

31 January 2008
Final papers and presentations due.

27-30 March 2008
Day of the conference

--
| Hiroki SATO

attachment0 (194 bytes) Download Attachment

OpenBSD 4.2 released Nov 1, 2007

2007-10-31T20:16:50Z

------------------------------------------------------------------------
- OpenBSD 4.2 RELEASED -------------------------------------------------

Nov 1, 2007.

We are pleased to announce the official release of OpenBSD 4.2.
This is our 22nd release on CD-ROM (and 23rd via FTP). We remain
proud of OpenBSD's record of more than ten years with only two remote
holes in the default install.

We dedicate this release to the memory of long-time developer
Jun-ichiro "itojun" Itoh Hagino, who focused his life on IPv6
deployment for everyone. Without his BSD and IETF participation, IPv6
would not be where it is today. Only now people are becoming aware of
his numerous contributions because he took credit for much less than
he accomplished. The developers in our project will all miss him.

As in our previous releases, 4.2 provides significant improvements,
including new features, in nearly all areas of the system:

- New/extended platforms:
o OpenBSD/sparc64.
The PCIe UltraSPARC IIIi machines like the V215 and V245 are
now supported.
o OpenBSD/hppa.
Four-digit B/C/J-class workstations like the B2000, C3750 or J6750
are now supported (in 32-bit mode).
o OpenBSD/alpha.
Add support in the alpha platform for a couple of new Alpha models,
AlphaServer 1200 and 4100.

- Platforms skipped this release:
o OpenBSD/sgi.
This architecture will not be released this time.

- Install/Upgrade process changes:
o New install method!!
For the most popular architectures, the FTP sites have a ~200MB
install ISO file, which contains the base set, permitting
non-network installs.
o Allow the specification of an NTP server during installation.
o Allow no fsck'ing of clean non-root partitions during upgrade.
o Check for INSTALL.<arch> to confirm sets are for the correct
architecture.
o Create and format the MSDOS partition for macppc installs
in a more flexible and reliable way.

- Improved hardware support, including:
o Native Serial-ATA support:
o ahci(4) driver for SATA controllers conforming to the Advanced
Host Controller Interface specification.
o jmb(4) driver for the JMicron JMB36x SATA II and PATA Host Controller.
o sili(4) driver for SATA controllers using the Silicon Image
3124/3132/3531 SATALink chipsets.
o The pciide(4) driver has had support added for newer chipsets, including:
o Intel ICH8M PATA
o JMicron JMB36x PATA
o VIA CX700/VX700 PATA
o The lm(4) driver now supports Winbond W83627DHG and W83627EHF-A
Super I/O Hardware Monitors.
o The siop(4) driver now has support for NCR 53C720/770 controllers in
big endian mode. In particular this means that the onboard Fast-Wide
SCSI on many hppa machines is supported now.
o New tht(4) driver for Tehuti Networks 10Gb Ethernet controllers.
o The malo(4) driver now supports Marvell 88W8385 802.11g based
Compact Flash devices.
o New uts(4) driver for USB touch screens, supported by the xtsscale(1)
calibration utility.
o The i810(4) X.Org driver and the PCI AGP driver now support
Intel i965GM chips.
o New led(4) driver for the front panel LEDs on the V215/245.
o New bbc(4) driver providing support for the BootBus Controllers in
UltraSparc III systems.
o New pmc(4) driver for the watchdog(4) timer on the National Semiconductor
PC87317 SuperIO chip.
o New pyro(4) driver for the SPARC64 Host/PCIe bridge.
o New astro(4) driver for the Astro Memory and I/O controller on hppa.
o New elroy(4) driver for the Elroy PCI hostbridge on hppa.
o New lcd(4) driver for the front panel LCD display on hppa.
o New ssio(4) driver for the National Semiconductor PC87560 Legacy IO on
hppa.
o New pxammc(4) driver for the MMC/SD/SDIO controller on zaurus.
o New xlights(4) driver for the front panel lights on the Xserve G4.
o New sysbutton(4) driver for the system identification button on
the Xserve G4.
o New piixpcib(4) driver for System Management Mode initiated speedstep
frequency scaling on certain pairings of the Intel PIIX4 ISA bridges
and Intel Pentium 3 processors.
o CPU frequency and voltage can now be scaled on all CPUs when running
GENERIC.MP on a multiprocessor i386 or AMD64 machine with enhanced
speedstep or powernow.
o Intel enhanced speedstep is now supported on OpenBSD/amd64.
o New support for the on die CPU temperature sensor found on the
Intel Core family of processors.
o The nvram(4) driver is now available on OpenBSD/amd64.

- New tools:
o cwm(1) has replaced wm2 as a simple-looking low-resource window manager.
o zless(1), view compressed files with less(1).
o mount_vnd(8), a utility to configure vnode disks from fstab(5).

- New functionality:
o FFS2, the updated version of the fast file system.
o ftp(1) now can send cookies loaded from a netscape-like cookiejar,
supports proxies requiring a password, and has a keep-alive option
to avoid over-aggressive control connection dropping.
o pkg_add(1) has been vastly improved. It is more robust, outputs more
consistent error messages, and can deal with a lot more update
scenarios gracefully. It also has much better look-up capabilities for
multiple entries in PKG_PATH, stopping at the first directory with
suitable candidates.
o ftp-proxy(8) is now able to automatically tag packets passing through
the pf(4) rule with a supplied name.
o Kernel work queues, workq_add_task(9), workq_create(9),
workq_destroy(9) provides a mechanism to defer tasks to a process
context when it is impossible to run such a task in the current context.
o ifconfig(8) now understands IP address/mask in CIDR notation.
o Add IP (v4 and v6) load balancing to carp(4), similar to the
ARP balancing.
o sensorsd(8) now supports a zero-configuration monitoring and has
a more intuitive logging for all sensors that automatically provide
sensor state. It also features advancements in user-specified
monitoring, including monitoring of sensors that are periodically
flagged as invalid.
o sensorsd.conf(5) now supports sensor matching by sensor type,
allowing easier configuration.
o The i386 bootloader can now load amd64 kernels.
o The amd64 bootloader can now load i386 kernels.

- Assorted improvements and code cleanup:
o Large (>1TB) disk and partition support in the disklabel and buffer
cache code and in the userland utilities that manipulate disk blocks.
Note that some parts of the system are not 64-bit disk block clean
yet, so partitions larger than 2TB cannot be used at the moment.
o Large (>2^32-1 sectors) SCSI disk sizes now probed.
o Thread support for the Objective-C library (libobjc).
o carp route handling has been fixed, solving some problems the
routing daemons were exhibiting.
o Various improvements in pf increase performance drastically,
stateful passing more than twice as fast than before.
o A change in how the kernel random pool is stirred increases performance
with network interface cards that support interrupt mitigation a lot.
o i386 TLB handling improved to avoid possible corruption on
Core2Duo processors.
o Rework TLB shootdown code for i386 and amd64, gives fairly large speed
improvements.
o i386 and amd64 use the BIOS disk geometry when creating default
disklabels.
o Default disk geometry changed from 64 heads/32 sectors to
255 heads/63 sectors.
o More USB devices with various quirks coerced to work.
o Archive/Wangtek cartridge tape drives (wt*) no longer supported.
o rcs has improved GNU compatibility.
o make(1) has improved stability of -j option.

- OpenSSH 4.7:
o Prevent ssh(1) from using a trusted X11 cookie if creation of an
untrusted cookie fails.
o sshd(8) in new installations defaults to SSH Protocol 2 only.
Existing installations are unchanged.
o The SSH channel window size has been increased, and both ssh(1)
sshd(8) now send window updates more aggressively. These improves
performance on high-BDP (Bandwidth Delay Product) networks.
o ssh(1) and sshd(8) now preserve MAC contexts between packets, which
saves 2 hash calls per packet and results in 12-16% speedup for
arcfour256/hmac-md5.
o A new MAC algorithm has been added, UMAC-64 (RFC4418) as
"umac-64@...". UMAC-64 has been measured to be
approximately 20% faster than HMAC-MD5.
o A -K flag was added to ssh(1) to set GSSAPIAuthentication=Yes
o Failure to establish a ssh(1) TunnelForward is now treated as a
fatal error when the ExitOnForwardFailure option is set.
o ssh(1) returns a sensible exit status if the control master goes
away without passing the full exit status.

- OpenBGPD 4.2:
o Include support for Four-octet AS Number Space.
o Allow matching on communities using 0 in the AS part.
o Filtering on IPv6 prefixes is now possible.
o Various bugs in the encoding of multiprotocol updates were fixed.
o Allow the use of pkill -HUP bgpd to reload the config.
o bgpctl can filter prefix output by community now.

- OpenOSPFD 4.2:
o Added support for RFC 3137: OSPF Stub Router Advertisement.
o It is possible to specify a carp demote group on interfaces and areas.
o Added support for mapping route labels to AS-external route
tags and vice versa.
o Allow the use of pkill -HUP ospfd to reload the config.

- HostStated 4.2:
o Added support for Layer 7 load balancing (or relay).
o Added support for reloading through hoststatectl or SIGHUP.
o Added support for testing name-based virtual hosts.

- Over 4,500 ports, minor robustness improvements in package tools.
o Many pre-built packages for each architecture:
i386: 4360 sparc64: 4205 alpha: 3779 sh: 817
amd64: 4283 powerpc: 4230 sparc: 3283 m68k: 1107
arm: 2131 hppa: 3215
o Highlights include:
o Gnome 2.18.
o GNUstep 1.14.
o KDE 3.5.7 and koffice 1.6.3.
o Xfce 4.4.1.
o OpenMotif 2.3.0.
o OpenOffice.org 2.2.1.
o Mozilla Firefox 2.0.0.6.
o PostgreSQL 8.2.4.
o GHC 6.6.1 (amd64 and i386 only)

- As usual, steady improvements in manual pages and other documentation.

- The system includes the following major components from outside
suppliers:
o Xenocara (based on X.Org 7.2 + patches, freetype 2.2.1,
fontconfig 2.4.2, expat 2.0.0, Mesa 6.5.2, xterm 225 and more)
o Gcc 2.95.3 (+ patches) and 3.3.5 (+ patches)
o Perl 5.8.8 (+ patches)
o Our improved and secured version of Apache 1.3, with SSL/TLS and DSO
support
o OpenSSL 0.9.7j (+ patches)
o Groff 1.15
o Sendmail 8.14.1, with libmilter
o Bind 9.3.4 (+ patches)
o Lynx 2.8.5rel.4 with HTTPS and IPv6 support (+ patches)
o Sudo 1.6.9p4
o Ncurses 5.2
o Latest KAME IPv6
o Heimdal 0.7.2 (+ patches)
o Arla 0.35.7
o Binutils 2.15 (+ patches)
o Gdb 6.3 (+ patches)

If you'd like to see a list of what has changed between OpenBSD 4.1
and 4.2, look at

http://www.OpenBSD.org/plus42.html

Even though the list is a summary of the most important changes
made to OpenBSD, it still is a very very long list.

------------------------------------------------------------------------
- SECURITY AND ERRATA --------------------------------------------------

We provide patches for known security threats and other important
issues discovered after each CD release. As usual, between the
creation of the OpenBSD 4.2 FTP/CD-ROM binaries and the actual 4.2
release date, our team found and fixed some new reliability problems
(note: most are minor and in subsystems that are not enabled by
default). Our continued research into security means we will find
new security problems -- and we always provide patches as soon as
possible. Therefore, we advise regular visits to

http://www.OpenBSD.org/security.html
and
http://www.OpenBSD.org/errata.html

Security patch announcements are sent to the security-announce@...
mailing list. For information on OpenBSD mailing lists, please see:

http://www.OpenBSD.org/mail.html

------------------------------------------------------------------------
- CD-ROM SALES ---------------------------------------------------------

OpenBSD 4.2 is also available on CD-ROM. The 3-CD set costs $50USD
(EUR 50 including VAT) and is available via mail order and from a number
of contacts around the world. The set includes a colourful booklet
which carefully explains the installation of OpenBSD. A new set
of cute little stickers is also included (sorry, but our FTP mirror
sites do not support STP, the Sticker Transfer Protocol). As an
added bonus, the second CD contains an audio track, a song entitled
"100001 1010101".

Lyrics (and an explanation) for the songs may be found at:

http://www.OpenBSD.org/lyrics.html#42

Profits from CD sales are the primary income source for the OpenBSD
project -- in essence selling these CD-ROM units ensures that OpenBSD
will continue to make another release six months from now.

The OpenBSD 4.2 CD-ROMs are bootable on the following four platforms:

o i386
o amd64
o macppc
o sparc64

(Other platforms must boot from floppy, network, or other method).

For more information on ordering CD-ROMs, see:

http://www.OpenBSD.org/orders.html

The above web page lists a number of places where OpenBSD CD-ROMs
can be purchased from. For our default mail order, go directly to:

https://https.OpenBSD.org/cgi-bin/order

or, for European orders:

https://https.OpenBSD.org/cgi-bin/order.eu

All of our developers strongly urge you to buy a CD-ROM and support
our future efforts. Additionally, donations to the project are
highly appreciated, as described in more detail at:

http://www.OpenBSD.org/goals.html#funding

------------------------------------------------------------------------
- OPENBSD FOUNDATION ---------------------------------------------------

For those unable to make their contributions as straightforward gifts,
the OpenBSD Foundation (http://www.openbsdfoundation.org) is a Canadian
not-for-profit corporation that can accept larger contributions and
issue receipts. In some situations, their receipt may qualify as a
business expense writeoff, so this is certainly a consideration for
some organizations or businesses. There may also be exposure benefits
since the Foundation may be interested in participating in press releases.
In turn, the Foundation then uses these contributions to assist OpenBSD's
infrastructure needs. Contact the foundation directors at
directors@... for more information.

------------------------------------------------------------------------
- T-SHIRT SALES --------------------------------------------------------

The project continues to expand its funding base by selling t-shirts
and polo shirts. And our users like them too. We have a variety
of shirts available, with the new and old designs, from our web
ordering system at:

https://https.OpenBSD.org/cgi-bin/order

and for Europe:

https://https.OpenBSD.org/cgi-bin/order.eu

The OpenBSD 4.2 t-shirts are available now. The new shirt for 4.2 has
a newly drawn version of Puffy (the blowfish) on a simple black shirt.
We also sell our older shirts, as well as a selection of OpenSSH t-shirts.

------------------------------------------------------------------------
- FTP INSTALLS ---------------------------------------------------------

If you choose not to buy an OpenBSD CD-ROM, OpenBSD can be easily
installed via FTP. Typically you need a single small piece of boot
media (e.g., a boot floppy) and then the rest of the files can be
installed from a number of locations, including directly off the
Internet. Follow this simple set of instructions to ensure that
you find all of the documentation you will need while performing
an install via FTP. With the CD-ROMs, the necessary documentation
is easier to find.

1) Read either of the following two files for a list of ftp
mirrors which provide OpenBSD, then choose one near you:

http://www.OpenBSD.org/ftp.html
ftp://ftp.OpenBSD.org/pub/OpenBSD/4.2/ftplist

As of Nov 1, 2007, the following ftp mirror sites have the 4.2 release:

ftp://ftp.kd85.com/pub/OpenBSD/4.2/ Austria
ftp://ftp.stacken.kth.se/pub/OpenBSD/4.2/ Sweden
ftp://ftp2.usa.openbsd.org/pub/OpenBSD/4.2/ NYC, USA
ftp://ftp3.usa.openbsd.org/pub/OpenBSD/4.2/ CO, USA
ftp://ftp5.usa.openbsd.org/pub/OpenBSD/4.2/ CA, USA
ftp://rt.fm/pub/OpenBSD/4.2/ IL, USA

The release is also available at the master site:

ftp://ftp.openbsd.org/pub/OpenBSD/4.2/ Alberta, Canada

However it is strongly suggested you use a mirror.

Other mirror sites may take a day or two to update.

2) Connect to that ftp mirror site and go into the directory
pub/OpenBSD/4.2/ which contains these files and directories.
This is a list of what you will see:

ANNOUNCEMENT amd64/ macppc/ sys.tar.gz
Changelogs/ armish/ mvme68k/ tools/
HARDWARE ftplist packages/ vax/
PACKAGES hp300/ ports.tar.gz xenocara.tar.gz
PORTS hppa/ root.mail zaurus/
README i386/ sparc/
SIZES landisk/ sparc64/
alpha/ mac68k/ src.tar.gz

It is quite likely that you will want at LEAST the following
files which apply to all the architectures OpenBSD supports.

README - generic README
HARDWARE - list of hardware we support
PORTS - description of our "ports" tree
PACKAGES - description of pre-compiled packages
root.mail - a copy of root's mail at initial login.
(This is really worthwhile reading).

3) Read the README file. It is short, and a quick read will make
sure you understand what else you need to fetch.

4) Next, go into the directory that applies to your architecture,
for example, i386. This is a list of what you will see:

INSTALL.i386 cd42.iso floppyB42.fs pxeboot*
INSTALL.linux cdboot* floppyC42.fs xbase42.tgz
MD5 cdbr* game42.tgz xetc42.tgz
base42.tgz cdemu42.iso index.txt xfont42.tgz
bsd* comp42.tgz install42.iso xserv42.tgz
bsd.mp* etc42.tgz man42.tgz xshare42.tgz
bsd.rd* floppy42.fs misc42.tgz

If you are new to OpenBSD, fetch _at least_ the file INSTALL.i386
and the appropriate floppy*.fs or install42.iso files. Consult the
INSTALL.i386 file if you don't know which of the floppy images
you need (or simply fetch all of them).

If you use the install42.iso file (roughly 200MB in size), then you
do not need the various *.tgz files since they are contained on that
one-step ISO-format install CD.

5) If you are an expert, follow the instructions in the file called
README; otherwise, use the more complete instructions in the
file called INSTALL.i386. INSTALL.i386 may tell you that you
need to fetch other files.

6) Just in case, take a peek at:

http://www.OpenBSD.org/errata.html

This is the page where we talk about the mistakes we made while
creating the 4.2 release, or the significant bugs we fixed
post-release which we think our users should have fixes for.
Patches and workarounds are clearly described there.

Note: If you end up needing to write a raw floppy using Windows,
you can use "fdimage.exe" located in the pub/OpenBSD/4.2/tools
directory to do so.

------------------------------------------------------------------------
- X.ORG FOR MOST ARCHITECTURES -----------------------------------------

X.Org has been integrated more closely into the system. This release
contains X.Org 7.2.0. Most of our architectures ship with X.Org, including
amd64, sparc, sparc64 and macppc. During installation, you can install
X.Org quite easily. Be sure to try out xdm(1) and see how we have
customized it for OpenBSD.

------------------------------------------------------------------------
- PORTS TREE -----------------------------------------------------------

The OpenBSD ports tree contains automated instructions for building
third party software. The software has been verified to build and
run on the various OpenBSD architectures. The 4.2 ports collection,
including many of the distribution files, is included on the 3-CD
set. Please see the PORTS file for more information.

Note: some of the most popular ports, e.g., the Apache web server
and several X applications, come standard with OpenBSD. Also, many
popular ports have been pre-compiled for those who do not desire
to build their own binaries (see BINARY PACKAGES, below).

------------------------------------------------------------------------
- BINARY PACKAGES WE PROVIDE -------------------------------------------

A large number of binary packages are provided. Please see the PACKAGES
file (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.2/PACKAGES) for more details.

------------------------------------------------------------------------
- SYSTEM SOURCE CODE ---------------------------------------------------

The CD-ROMs contain source code for all the subsystems explained
above, and the README (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.2/README)
file explains how to deal with these source files. For those who
are doing an FTP install, the source code for all four subsystems
can be found in the pub/OpenBSD/4.2/ directory:

xenocara.tar.gz ports.tar.gz src.tar.gz sys.tar.gz

------------------------------------------------------------------------
- THANKS ---------------------------------------------------------------

OpenBSD 4.2 includes artwork and CD artistic layout by Ty Semaka,
who also arranged an audio track on the OpenBSD 4.2 CD set. Ports
tree and package building by Antoine Jacoutot, Peter Valchev,
Robert Nagy and Christian Weisgerber. System builds by Theo de Raadt,
Kenji Aoyama, and Miod Vallat. X11 builds by Todd Fries. ISO-9660
filesystem layout by Theo de Raadt.

We would like to thank all of the people who sent in bug reports, bug
fixes, donation cheques, and hardware that we use. We would also like
to thank those who pre-ordered the 4.2 CD-ROM or bought our previous
CD-ROMs. Those who did not support us financially have still helped
us with our goal of improving the quality of the software.

Our developers are:

Alexandre Anriot, Antoine Jacoutot, Aleksander Piotrowski,
Kenji Aoyama, Artur Grabowski, Anil Madhavapeddy, Bob Beck,
Bernd Ahlers, Bjorn Sandell, Alexander Bluhm, Camiel Dobbelaar,
Can Erkin Acar, David Cathcart, Charles Longeau, Chris Kuethe,
Claudio Jeker, Chad Loder, Constantine A. Murenin, Damien Couderc,
Damien Bergamini, Dan Harnett, David Collins, David Krause,
David Berghoff, Deanna Phillips, Theo de Raadt, Daniel Hartmeier,
David Hill, Dimitry Andric, Damien Miller, David Gwynne,
Don Stewart, Dale Rahn, Darren Tucker, Eric Faurot, Marc Espie,
Federico G. Schwindt, Felix Kronlage, Mike Frantzen, Gilles Chehade
Alexander Yurchenko, Alexander von Gernler, Gordon Willem Klok,
Henning Brauer, Henric Jungheim, Hans Insulander, Hakan Olsson,
Hans-Joerg Hoexer, Hugh Graham, Ian Darwin,
Jun-ichiro "itojun" Itoh Hagino, Jakob Schlyter, Jared Yanovich,
Jason Wright, Jacob Meuser, Jasper Lievisse Adriaanse, Joshua Stein,
Jason Dixon, Janne Johansson, Jason McIntyre, Joel Knight,
Jolan Luff, Jordan Hargrave, Joris Vink, Jonathan Gray,
Jan-Uwe Finck, Mark Kettenis, Kevin Lo, Matthias Kilian,
Kenjiro Cho, Kjell Wooding, Kenneth R Westerback, Kurt Miller,
Mats O Jansson, Marco S Hyman, Marco Peereboom, Marc Matteo,
Markus Friedl, Martin Reindl, Martynas Venckus, Matthieu Herrb,
Marc Balmer, Ryan Thomas McBride, Michael Erdely, Marcus Glocker,
Moritz Grimm, Michele Marchetto, Todd C. Miller, Miod Vallat,
Michael Coulter, Michael Knudsen, Moritz Jodeit,
Marco Pfatschbacher, Mathieu Sauve-Frankel, Christian Weisgerber,
Nathan Binkert, Niall O'Higgins, Nick Holland, Nils Nordman,
Esben Norby, Thomas Nordin, Otto Moerbeek, Christopher Pascoe,
Patrick Latifi, Philipp Buehler, Peter Valchev,
Pierre-Yves Ritschard, Alexandre Ratchov, Ray Lai, Robert Nagy,
Reyk Floeter, Rui Reis, Saad Kadhi, Simon Bertrang,
Stephen Kirkham, Igor Sobrado, Steven Mestdagh, Kevin Steves,
Stuart Henderson, Nikolay Sturm, Ted Unangst,
Thordur I. Bjornsson, Tobias Stoeckmann, Todd T. Fries,
Tom Cosgrove, Uwe Stuehler, Tobias Weingartner, Peter Stromberg,
Marc Winiger, Wim Vandeputte, Xavier Santolaria.

4.2 song

2007-10-06T11:55:11Z

Just back from my (hiking) trip, I am happy to announce the 4.2
song has been added to the lyrics page at

http://www.openbsd.org/lyrics.html

Yes, it is designed to sound like a mid-era Rush song, ie. something
from Grace Under Pressure or such. And there's a few easter eggs
hidden in the song as well. It also explains the inside sleeve
image...

Announce: OpenSSH 4.7 released

2007-09-04T18:14:09Z

OpenSSH 4.7 has just been released. It will be available from the
mirrors listed at http://www.openssh.com/ shortly.

OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0
implementation and includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots and purchased
T-shirts or posters.

T-shirt, poster and CD sales directly support the project. Pictures
and more information can be found at:
http://www.openbsd.org/tshirts.html and
http://www.openbsd.org/orders.html

For international orders use http://https.openbsd.org/cgi-bin/order
and for European orders, use http://https.openbsd.org/cgi-bin/order.eu

Changes since OpenSSH 4.6:
============================

Security bugs resolved in this release:

* Prevent ssh(1) from using a trusted X11 cookie if creation of an
untrusted cookie fails; found and fixed by Jan Pechanec.

Other changes, new functionality and fixes in this release:

* sshd(8) in new installations defaults to SSH Protocol 2 only.
Existing installations are unchanged.

* The SSH channel window size has been increased, and both ssh(1)
sshd(8) now send window updates more aggressively. These improves
performance on high-BDP (Bandwidth Delay Product) networks.

* ssh(1) and sshd(8) now preserve MAC contexts between packets, which
saves 2 hash calls per packet and results in 12-16% speedup for
arcfour256/hmac-md5.

* A new MAC algorithm has been added, UMAC-64 (RFC4418) as
"umac-64@...". UMAC-64 has been measured to be
approximately 20% faster than HMAC-MD5.

* A -K flag was added to ssh(1) to set GSSAPIAuthentication=Yes

* Failure to establish a ssh(1) TunnelForward is now treated as a
fatal error when the ExitOnForwardFailure option is set.

* ssh(1) returns a sensible exit status if the control master goes
away without passing the full exit status. (bz #1261)

* The following bugs have been fixed in this release:

- When using a ProxyCommand in ssh(1), set the outgoing hostname with
gethostname(2), allowing hostbased authentication to work (bz #616)
- Make scp(1) skip FIFOs rather than hanging (bz #856)
- Encode non-printing characters in scp(1) filenames.
these could cause copies to be aborted with a "protocol error"
(bz #891)
- Handle SIGINT in sshd(8) privilege separation child process to
ensure that wtmp and lastlog records are correctly updated
(bz #1196)
- Report GSSAPI mechanism in errors, for libraries that support
multiple mechanisms (bz #1220)
- Improve documentation for ssh-add(1)'s -d option (bz #1224)
- Rearrange and tidy GSSAPI code, removing server-only code being
linked into the client. (bz #1225)
- Delay execution of ssh(1)'s LocalCommand until after all forwadings
have been established. (bz #1232)
- In scp(1), do not truncate non-regular files (bz #1236)
- Improve exit message from ControlMaster clients. (bz #1262)
- Prevent sftp-server(8) from reading until it runs out of buffer
space, whereupon it would exit with a fatal error. (bz #1286)

* Portable OpenSSH bugs fixed:

- Fix multiple inclusion of paths.h on AIX 5.1 systems. (bz #1243)
- Implement getpeereid for Solaris using getpeerucred. Solaris
systems will now refuse ssh-agent(1) and ssh(1) ControlMaster
clients from different, non-root users (bz #1287)
- Fix compilation warnings by including string.h if found. (bz #1294)
- Remove redefinition of _res in getrrsetbyname.c for platforms that
already define it. (bz #1299)
- Fix spurious "chan_read_failed for istate 3" errors from sshd(8),
a side-effect of the "hang on exit" fix introduced in 4.6p1.
(bz #1306)
- pam_end() was not being called if authentication failed (bz #1322)
- Fix SELinux support when SELinux is in permissive mode. Previously
sshd(8) was treating SELinux errors as always fatal. (bz #1325)
- Ensure that pam_setcred(..., PAM_ESTABLISH_CRED) is called before
pam_setcred(..., PAM_REINITIALIZE_CRED), fixing pam_dhkeys.
(bz #1339)
- Fix privilege separation on QNX - pre-auth only, this platform does
not support file descriptior passing needed for post-auth privilege
separation. (bz #1343)

Thanks to everyone who has contributed patches, reported bugs and
tested releases.

Checksums:
==========

- SHA1 (openssh-4.7.tar.gz) = 9ebaab9b31e01bd0d04425dc23536bcc78f8d990
- SHA1 (openssh-4.7p1.tar.gz) = 58357db9e64ba6382bef3d73d1d386fcdc0508f4

Reporting Bugs:
===============

- please read http://www.openssh.com/report.html
and http://bugzilla.mindrot.org/

OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and
Ben Lindstrom.

EuroBSDCon 2007 - less than four weeks!

2007-08-21T14:47:34Z

DO NOT MISS THE EUROPEAN BSD EVENT OF THE YEAR
==============================================

EuroBSDCon 2007

September 14th - 15th 2007
-------------------------------

The sixth EuroBSDCon - the annual European BSD conference for users
and developers begins Friday September 14th. It's being held at
Symbion Science Park in Copenhagen, Denmark. Come, meet and talk to
BSD people from all over the world.

Program
-------

20+ interesting speakers in a program which includes:

Kirk McKusick: Kirk is the epitome of BSD - an all-time Berkley guy
will talk about the history of the UFS file system.

Sam Leffler: Sam is another of the original BSD people. For a while
he has been working a lot with wireless networks and and his name can
be found in a lot of the open source wireless code. At the conference
he will be talking about long distance wireless.

Marc Balmer: Marc became an active OpenBSD developer in 2004 and has
since be responsible for several prominent OpenBSD projects. At the
conference he will talk about Support for Radio Clocks in OpenNTPD.

Steven Murdoch: Steven is working on computer security research at
Cambridge University and he will be talking about hidden channels
between computers which even the best firewall cannot close.

John Hartmann: Very few if any UNIX people have heard about John
Hartmann, despite the fact that he completed the work Dennis and Ken
started with pipes. John will talk about "CMS pipes" a minor and
cheap entry in the IBM product catalogue which is a radical
generalization of the UNIX pipe concept.

Read more about the speakers and the program on:

http://2007.eurobsdcon.org/talks.html

More information about the tutorials can be found at:

http://2007.eurobsdcon.org/tutorials.html

Prices
------

The conference costs 1800 DKK for 2 days.

It is also possible to register for a social event which will take
place on Friday night or register for the tutorials which will take
place in the two days leading up to the conference (September 12th -
13th).

You can register at:

http://2007.eurobsdcon.org/shop.html

Sponsors
--------

The conference is organized by the Danish BSD user group BSD-DK in
co-operation with the Danish UNIX User group DKUUG.

The conference is sponsored by:

catpipe Aps
FreeBSD Foundation
Fullrate
GlobalConnect
Google
LogicLAB
pil.dk
Security6.net
Soekris Engineering
Telia Danmark
USENIX
zen.systems

We are looking forward to seeing you in Denmark!

Best,

The EuroBSDCon 2007 Organizing Committee

--
Simon L. Nielsen

Announcing: The OpenBSD Foundation

2007-07-25T17:44:29Z

The OpenBSD Foundation is pleased to announce today it has completed
its organization as a Canadian federal non-profit corporation and is
ready for public interaction.

The OpenBSD Foundation has been formed for the purpose of supporting
the OpenBSD project, and related projects such as OpenSSH, OpenBGPD,
OpenNTPD, and OpenCVS.

In particular it will act as a single point of contact for persons and
organizations requiring a legal entity to deal with when they wish to
support OpenBSD in any way.

The OpenBSD Foundation will initially concentrate on facilitating
larger donations of equipment, funds, documentation and
resources. Small scale donations should continue to be submitted
through the existing mechanisms.

The OpenBSD Foundation corporate charter, bylaws, and goals can be found at
http://www.openbsdfoundation.org. The foundation directors may be contacted
via email at directors@....

EuroBSDcon2007 registration is open! (plus poster-session info!)

2007-06-17T03:43:56Z

The registration to EuroBSDcon2007 is open now:

http://2007.eurobsdcon.org/shop.html

300DKK early bird discount until July 1st.

The conference price is 1800 DKK (EUR 240) a bit higher than we
wanted, but we have managed to secure very cheap lodging, Youth
Hostel style, at only 165 DKK, (EUR 22) per night.

Check out the talks and tutorials on our web-page:

http://2007.eurobsdcon.org

See you in Wonderful Copenhagen, september 14-15 2007!

(And don't miss the trip to LEGOLand!)

=============================
EuroBSDcon2007 Poster Session
=============================

EuroBSDcon2007 will not have a "Work In Progress" session, it will have
poster session instead, possibly two, if we get many poster presenters.

The way it works is simple: During the lunch break the poster presenter
gets a place to stand with his poster, and people wander around looking
for stuff that interests them and the poster presenter makes his pitch
to who ever stops by.

Rules of the game:
------------------

Topics:
Any moderately BSD related topic is fair game.

You must be this tall:

Proposals will be accepted or rejected solely on the graphical
quality of the poster.

A number of slots will be reserved for students.

Registration:

To get a slot, send email to <posters@...> with:

Your name & email address

Topic of poster (1 paragraph)

URL to pdf or photo of your poster
Do not attach the pdf or photo to the email, just
include a URL to it!

It's OK to update your poster after I have seen it.

Deadline:

Right before I run out of slots.

Do I get free transportation, entrance to the conference etc ?

Sorry, we can't afford that (unless a sponsor volunteers)

Web-site:

If you want your poster on the web-site with the other conference
material, make sure to send us the final PDF version.

Poster size:

Up to approx ISO-A0 portrait.
Width < 90cm (35")
Height < 130cm (51")

Poster production:
This is your own responsibility.

Ask your university, school, local engineering company,
friend who works with CAD etc.

Many graphics companies and sign-shops can print posters
for around EUR80 for A0.

Use a good solid stock if you want to reuse your poster
many times.

If you want to have it printed in Denmark, try:
http://www.vesterkopi.synonym.dk/

If all else fails, drop me an email, and I can try to see if
I can work something out.

Poster transportation:
Use a tube if you can, folds are nothing but trouble.

If you don't want to bring your poster on the plane, you
are welcome to mail it to us in advance.

Poster Layout:

Be creative, but cram all the stuff in there that you will
need to show people.

Don't be afraid to use small print (12 point), people
will be standing right in front of your poster.

Here are some good examples for your inspiration:

http://einstein.stanford.edu/content/aps_posters/index.html#posters

--
Poul-Henning Kamp | UNIX since Zilog Zeus 3.20
phk@... | TCP/IP since RFC 956
FreeBSD committer | BSD since 4.3-tahoe
Never attribute to malice what can adequately be explained by incompetence.

OpenBSD 4.1 Released

2007-05-01T08:51:49Z

------------------------------------------------------------------------
- OpenBSD 4.1 RELEASED -------------------------------------------------

May 1, 2007.

We are pleased to announce the official release of OpenBSD 4.1.
This is our 21st release on CD-ROM (and 22nd via FTP). We remain
proud of OpenBSD's record of ten years with only two remote
holes in the default install. As in our previous releases, 4.1
provides significant improvements, including new features, in nearly
all areas of the system:

- New/extended platforms:
o OpenBSD/landisk.
Various SH4-based appliances, made by IO-Data and resold by
Plextor.
o OpenBSD/sparc64.
UltraSPARC III based machines are supported even better, and
now run at full speed!

- Improved hardware support, including:
o New USB client controller support:
o Support for the USB client functionality in the pxaudc(4)
driver on the Zaurus.
o New usbf(4) midlayer for USB Client controllers.
o New cdcef(4) driver for providing a CDCE function on USB
client controllers.
o New cas(4) driver for Sun Cassini 10/100/Gigabit Ethernet devices.
o New uow(4) driver for Maxim/Dallas DS2490 USB 1-Wire devices.
o New owsbm(4) driver for 1-Wire smart battery monitor devices.
o New zyd(4) driver for ZyDAS ZD1211/ZD1211B USB IEEE 802.11b/g
wireless network devices.
o New moscom(4) driver for MosChip Semiconductor MCS7703 based USB
serial adapters.
o New glxsb(4) driver for hardware random numbers and AES
acceleration on the AMD Geode LX processor.
o New vic(4) driver for VMware VMXnet Virtual Interface Controllers.
o New malo(4) driver for Marvell Libertas IEEE 802.11b/g wireless
network devices.
o New pwdog(4) driver for Quancom PWDOG1 watchdog timer devices.
o New uberry(4) driver for Research In Motion Blackberry devices.
o New mbg(4) driver for Meinberg Funkuhren radio clocks.
o New mesh(4) driver for the on-board SCSI controller of old world
Apple Power Macintosh systems.
o New mc(4) driver for the on-board Ethernet of many old world Apple
Power Macintosh systems
o Improved msk(4) driver now supports many more Marvell Yukon-2
variants including dual port cards and fiber cards.
o The gem(4) driver now supports fiber cards.
o The OpenBSD/amd64 platform now has more accurate and robust time
keeping.
o The OpenBSD/i386 boot(8) program now works properly on Intel-based
Macs.
o The pciide(4) driver has had support added for newer chipsets,
including:
o AMD CS5536 IDE;
o Intel i31244;
o NVIDIA MCP67 PATA, MCP67 SATA.
o The com(4) driver now supports ST16C654 devices.
o The adt(4) driver supports some newer chipsets, such as the
ADT7475.
o The OpenBSD/macppc platform now automatically turns the machine
back on following an unexpected loss of power.
o boot.mac, an XCOFF formated boot loader for OpenBSD/macppc capable
of booting on many old world macs.

- New tools:
o BSD-licensed pkg-config(1), a complete rewrite of the GNU tool of
the same name, significantly smaller and more maintainable.
o hoststated(8), a layer 3 and layer 7 server load balancing daemon
with host monitoring capacities.
o new BSD-licensed ripd(8).
o bgplg(8), a CGI looking glass for OpenBGPD, is now available for
use with the system httpd.
o bgplgsh(8), a looking glass shell for OpenBGPD, is now available
for use as a restricted read-only command line interface.

- New functionality:
o syslogd(8) can now pipe logs directly to other programs, making
real-time log analysis easier.
o The IP_RECVTTL ip(4) socket option allows programs to receive the
incoming ttl on raw and udp sockets.
o The IP_MINTTL ip(4) socket option allows programs to ask the
kernel to discard any packets with a ttl smaller than the given
one, for implementing the IP TTL security hack aka the Generalized
TTL Security Mechanism specified in RFC 3682.
o Multiple, independent routing tables, with pf(4) acting as
selector. route(8) can be told which table to work with now, and
routing daemons have been modified to cope as well.
o The pflog(4) interface is now clonable. pf(4) can log to multiple
pflog interfaces now, each rule can specify which pflog interface
to log to. pflogd(8) and spamlogd(8) can now be told which pflog
interface to work with.
o The pfsync(4) interface is now clonable as well, thus only there
when actually needed.
o pfctl(8) can now expire table entries.
o keep state is now the default for pf.conf(5) rules, as is the
flags S/SA option on TCP connections. no state and flags any can
be used to disable stateful filtering or TCP flags checking.
o The pfctl(8) ruleset optimiser can be enabled in pf.conf(5).
o pf(4) anchors can now be loaded inline in the main pf.conf(5) and
can be printed recursively.
o Allow pf(4) rules inside anchors to have their counters reset, and
make counter read & reset an atomic operation.
o sensorsd(8) dampens status changes now, thus not alerting for a
single wrong sensor read, since many sensors lie once in a while.
o spamd(8) and spamlogd(8) now support synchronisation of the
greylist database across multiple hosts. The greytrapping
mechanism now allows for whole domain traps, and noticing out of
order MX use.
o spamd(8) database format has changed from DB_BTREE to DB_HASH for
much better performance on large installations with big
databases.
o The bridge(4) driver and the brconfig(8) tool now support the
Rapid Spanning Tree Protocol (RSTP). The new RSTP mode is now used
by default when enabled with the stp option.
o cd(4) now supports reading from region protected DVDs.
o Detect MS-DOS filesystems and spoof disklabel partitions for them
even when there is no MBR, e.g. on some newer iPods.

- Assorted improvements and code cleanup:
o The fsck_ffs(8) command has been improved to be more robust to
various forms of inode and superblock corruption.
o The top(1) command got some new ways of filtering the display.
o pthreads(3) file descriptor handling has been improved to
eliminate several race and deadlock conditions and improve
performance.
o The MS-DOS filesystem has had a potential corruption issue fixed,
and is more reliable when given a corrupted filesystem to mount.
o The MS-DOS filesystem and the fdisk(8) command have been enhanced
to work on devices with 2048 byte sectors, e.g. newer iPods.
o The OpenRCS tools are smarter at handling files, especially when
dealing with binary files. GNU RCS compatibility has also been
improved.
o The mg(1) editor now displays column numbers in the status bar. It
has also received several improvements which make it more
reliable: line numbers, file insertions, and search wrapping all
now work as expected.
o The systat(1) command has a cleaner look, and a display was added
for hardware sensors.
o The OpenBSD/alpha platform now uses gcc3.
o Improved support for USB-attached CD-ROM drives and ever more odd
umass(4) devices.
o Don't treat NetBSD or FreeBSD MBR partitions as substitutes for an
OpenBSD partition. i.e. don't try to boot from them or use them to
store OpenBSD disklabels.

- Install/Upgrade process changes:
o More reliable detection of disk and CD devices.
o More reliable installation from MS-DOS FAT partitions.
o New sanity check in case sets for the wrong architecture are
selected.
o No need to specify the filesystem types of source partitions
during disk or CD-ROM installs.
o No need to select a source partition during disk or CD installs
when there is only one to choose from.

- OpenSSH 4.6:
o sshd now allows the enabling and disabling of authentication
methods on a per user, group, host and network basis via the Match
directive in sshd_config(5).

- OpenBGPD 4.1:
o Fixes for sessions with tcp md5sig and ipsec. Now sessions can be
migrated from and to any form of ipsec and tcpmd5 with just a
simple bgpctl reload, and the session migrates the next time it
gets established.
o Include file support in the config parser.
o Can now use the new IP_MINTTL socket option to implement the ttl
security mechanism.

- OpenOSPFD 4.1:
o Reload support added. It is no longer needed to restart ospfd
after a configuration change.
o Multiple networks per interface are now supported.
o It is now possible to specify the route metric and type for each
redistribution rule.

- OpenNTPD 4.1:
o Greatly improved support for timedelta sensors.
o ntpd now uses a strictly monotonically increasing time (uptime,
basically) for its internal timers, so setting the system clock
doesn't influence query rates, trust levels, etc. any more.

- Over 4,200 ports, 4,000 pre-built packages (for i386), minor robustness
improvements in package tools. Some highlights:
o gstreamer-0.10 tools.
o OpenOffice.org package, available through ftp for size reasons.
o KDE 3.5.6 and koffice 1.6.2.
o a large (> 500) number of new/updated perl modules, from CPAN,
including most of the catalyst web framework.
o NetBeans 5.5 Java IDE.
o updated Linux emulation support by using Fedora Core libraries.
o Mozilla Firefox 2.0.0.2 (with translations).
o PostgreSQL 8.2.3.

- As usual, steady improvements in manual pages and other documentation.

- The system includes the following major components from outside
suppliers:
o X.Org 6.9.0 (+ patches, and i386 contains XFree86 3.3.6 servers (+
patches) for legacy chipsets not supported by X.Org)
o Gcc 2.95.3 (+ patches) and 3.3.5 (+ patches)
o Perl 5.8.8 (+ patches)
o our improved and secured version of Apache 1.3, with SSL/TLS and
DSO support
o OpenSSL 0.9.7j (+ patches)
o Groff 1.15
o Sendmail 8.14.0, with libmilter
o Bind 9.3.4 (+ patches)
o Lynx 2.8.5rel.4 with HTTPS and IPv6 support (+ patches)
o Sudo 1.6.8p9
o Ncurses 5.2
o Latest KAME IPv6
o Heimdal 0.7.2 (+ patches)
o Arla 0.35.7
o Binutils 2.15 (+ patches)
o Gdb 6.3 (+ patches)

If you'd like to see a list of what has changed between OpenBSD 4.0
and 4.1, look at

http://www.OpenBSD.org/plus41.html

Even though the list is a summary of the most important changes
made to OpenBSD, it still is a very very long list.

------------------------------------------------------------------------
- SECURITY AND ERRATA --------------------------------------------------

We provide patches for known security threats and other important
issues discovered after each CD release. As usual, between the
creation of the OpenBSD 4.1 FTP/CD-ROM binaries and the actual 4.1
release date, our team found and fixed some new reliability problems
(note: most are minor and in subsystems that are not enabled by
default). Our continued research into security means we will find
new security problems -- and we always provide patches as soon as
possible. Therefore, we advise regular visits to

http://www.OpenBSD.org/security.html
and
http://www.OpenBSD.org/errata.html

Security patch announcements are sent to the security-announce@...
mailing list. For information on OpenBSD mailing lists, please see:

http://www.OpenBSD.org/mail.html

------------------------------------------------------------------------
- CD-ROM SALES ---------------------------------------------------------

OpenBSD 4.1 is also available on CD-ROM. The 3-CD set costs $50USD
(EUR 50 including VAT) and is available via mail order and from a number
of contacts around the world. The set includes a colourful booklet
which carefully explains the installation of OpenBSD. A new set
of cute little stickers is also included (sorry, but our FTP mirror
sites do not support STP, the Sticker Transfer Protocol). As an
added bonus, the second CD contains an audio track, a song entitled
"Puffy Baba and the 40 Vendors".

Lyrics (and an explanation) for the songs may be found at:

http://www.OpenBSD.org/lyrics.html#41

Profits from CD sales are the primary income source for the OpenBSD
project -- in essence selling these CD-ROM units ensures that OpenBSD
will continue to make another release six months from now.

The OpenBSD 4.1 CD-ROMs are bootable on the following five platforms:

o i386
o amd64
o macppc
o sparc
o sparc64 (UltraSPARC)

(Other platforms must boot from floppy, network, or other method).

For more information on ordering CD-ROMs, see:

http://www.OpenBSD.org/orders.html

The above web page lists a number of places where OpenBSD CD-ROMs
can be purchased from. For our default mail order, go directly to:

https://https.OpenBSD.org/cgi-bin/order

or, for European orders:

https://https.OpenBSD.org/cgi-bin/order.eu

All of our developers strongly urge you to buy a CD-ROM and support
our future efforts. Additionally, donations to the project are
highly appreciated, as described in more detail at:

http://www.OpenBSD.org/goals.html#funding

------------------------------------------------------------------------
- T-SHIRT SALES --------------------------------------------------------

The project continues to expand its funding base by selling t-shirts
and polo shirts. And our users like them too. We have a variety
of shirts available, with the new and old designs, from our web
ordering system at:

https://https.OpenBSD.org/cgi-bin/order

and for Europe:

https://https.OpenBSD.org/cgi-bin/order.eu

The OpenBSD 4.1 t-shirts are available now. The new shirt for 4.1
shows Puffy Babba with a bag of documentation heading out over the
desert on his sea horse. We also sell our older shirts, as well as a
selection of OpenSSH t-shirts.

------------------------------------------------------------------------
- FTP INSTALLS ---------------------------------------------------------

If you choose not to buy an OpenBSD CD-ROM, OpenBSD can be easily
installed via FTP. Typically you need a single small piece of boot
media (e.g., a boot floppy) and then the rest of the files can be
installed from a number of locations, including directly off the
Internet. Follow this simple set of instructions to ensure that
you find all of the documentation you will need while performing
an install via FTP. With the CD-ROMs, the necessary documentation
is easier to find.

1) Read either of the following two files for a list of ftp
mirrors which provide OpenBSD, then choose one near you:

http://www.OpenBSD.org/ftp.html
ftp://ftp.OpenBSD.org/pub/OpenBSD/4.1/ftplist

As of May 1, 2007, the following ftp mirror sites have the 4.1 release:

ftp://ftp.kd85.com/pub/OpenBSD/4.1/ Austria
ftp://openbsd.informatik.uni-erlangen.de/pub/OpenBSD/4.1/ Germany
ftp://ftp.stacken.kth.se/pub/OpenBSD/4.1/ Sweden
ftp://ftp2.usa.openbsd.org/pub/OpenBSD/4.1/ NYC, USA
ftp://ftp3.usa.openbsd.org/pub/OpenBSD/4.1/ CO, USA
ftp://ftp5.usa.openbsd.org/pub/OpenBSD/4.1/ CA, USA
ftp://rt.fm/pub/OpenBSD/4.1/ IL, USA

The release is also available at the master site:

ftp://ftp.openbsd.org/pub/OpenBSD/4.1/ Alberta, Canada

However it is strongly suggested you use a mirror.

Other mirror sites may take a day or two to update.

2) Connect to that ftp mirror site and go into the directory
pub/OpenBSD/4.1/ which contains these files and directories.
This is a list of what you will see:

ANNOUNCEMENT amd64/ mac68k/ sparc64/
Changelogs/ armish/ macppc/ src.tar.gz
HARDWARE avioon/ mvme68k/ sys.tar.gz
PACKAGES ftplist mvme88k/ tools/
PORTS hp300/ packages/ vax/
README hppa/ ports.tar.gz zaurus/
SIZES i386/ root.mail
XF4.tar.gz landisk/ sgi/
alpha/ luna88k/ sparc/

It is quite likely that you will want at LEAST the following
files which apply to all the architectures OpenBSD supports.

README - generic README
HARDWARE - list of hardware we support
PORTS - description of our "ports" tree
PACKAGES - description of pre-compiled packages
root.mail - a copy of root's mail at initial login.
(This is really worthwhile reading).

3) Read the README file. It is short, and a quick read will make
sure you understand what else you need to fetch.

4) Next, go into the directory that applies to your architecture,
for example, i386. This is a list of what you will see:

CKSUM bsd.rd etc41.tgz misc41.tgz
INSTALL.i386 cd41.iso floppy41.fs pxeboot
INSTALL.linux cdboot floppyB41.fs xbase41.tgz
MD5 cdbr floppyC41.fs xetc41.tgz
base41.tgz cdemu41.iso game41.tgz xfont41.tgz
bsd cdrom41.fs index.txt xserv41.tgz
bsd.mp comp41.tgz man41.tgz xshare41.tgz

If you are new to OpenBSD, fetch _at least_ the file INSTALL.i386
and the appropriate floppy*.fs or cd41.iso file. Consult the
INSTALL.i386 file if you don't know which of the floppy images
you need (or simply fetch all of them).

5) If you are an expert, follow the instructions in the file called
README; otherwise, use the more complete instructions in the
file called INSTALL.i386. INSTALL.i386 may tell you that you
need to fetch other files.

6) Just in case, take a peek at:

http://www.OpenBSD.org/errata.html

This is the page where we talk about the mistakes we made while
creating the 4.1 release, or the significant bugs we fixed
post-release which we think our users should have fixes for.
Patches and workarounds are clearly described there.

Note: If you end up needing to write a raw floppy using Windows,
you can use "fdimage.exe" located in the pub/OpenBSD/4.1/tools
directory to do so.

------------------------------------------------------------------------
- X.ORG FOR MOST ARCHITECTURES -----------------------------------------

X.Org has been integrated more closely into the system. This release
contains X.Org 6.9.0. Most of our architectures ship with X.Org, including
amd64, sparc, sparc64 and macppc. During installation, you can install
X.Org quite easily. Be sure to try out xdm(1) and see how we have
customized it for OpenBSD.

------------------------------------------------------------------------
- PORTS TREE -----------------------------------------------------------

The OpenBSD ports tree contains automated instructions for building
third party software. The software has been verified to build and
run on the various OpenBSD architectures. The 4.1 ports collection,
including many of the distribution files, is included on the 3-CD
set. Please see the PORTS file for more information.

Note: some of the most popular ports, e.g., the Apache web server
and several X applications, come standard with OpenBSD. Also, many
popular ports have been pre-compiled for those who do not desire
to build their own binaries (see BINARY PACKAGES, below).

------------------------------------------------------------------------
- BINARY PACKAGES WE PROVIDE -------------------------------------------

A large number of binary packages are provided. Please see the PACKAGES
file (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.1/PACKAGES) for more details.

------------------------------------------------------------------------
- SYSTEM SOURCE CODE ---------------------------------------------------

The CD-ROMs contain source code for all the subsystems explained
above, and the README (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.1/README)
file explains how to deal with these source files. For those who
are doing an FTP install, the source code for all four subsystems
can be found in the pub/OpenBSD/4.1/ directory:

XF4.tar.gz ports.tar.gz src.tar.gz sys.tar.gz

------------------------------------------------------------------------
- THANKS ---------------------------------------------------------------

OpenBSD 4.1 includes artwork and CD artistic layout by Ty Semaka,
who also arranged an audio track on the OpenBSD 4.1 CD set. Ports
tree and package building by Peter Valchev, Nikolay Sturm and
Christian Weisgerber. System builds by Theo de Raadt, Kenji Aoyama,
and Miod Vallat. X11 builds by Todd Fries. ISO-9660 filesystem
layout by Theo de Raadt.

We would like to thank all of the people who sent in bug reports, bug
fixes, donation cheques, and hardware that we use. We would also like
to thank those who pre-ordered the 4.1 CD-ROM or bought our previous
CD-ROMs. Those who did not support us financially have still helped
us with our goal of improving the quality of the software.

Our developers are:

Aaron Campbell, Aleksander Piotrowski, Alex Feldman, Alexander Guy,
Alexander von Gernler, Alexander Yurchenko, Alexandre Anriot,
Andreas Gunnarsson, Angelos D. Keromytis, Anil Madhavapeddy,
Antoine Jacoutot, Artur Grabowski, Ben Lindstrom, Bernd Ahlers,
Bjorn Sandell, Bob Beck, Brad Smith, Brandon Creighton,
Brian Caswell, Brian Somers, Bruno Rohee, Camiel Dobbelaar,
Can Erkin Acar, Cedric Berger, Chad Loder, Chris Cappuccio,
Chris Kuethe, Christian Weisgerber, Christopher Pascoe,
Claudio Jeker, Constantine Sapuntzakis, Dale Rahn, Damien Bergamini,
Damien Couderc, Damien Miller, Dan Harnett, Daniel Hartmeier,
Darren Tucker, David B Terrell, David Gwynne, David Hill,
David Krause, David Lebel, David Leonard, Dimitry Andric,
Don Stewart, Dug Song, Eric Jackson, Esben Norby,
Federico G. Schwindt, Felix Kronlage, Fernando Gont,
Gordon Willem Klok, Greg Taleck, Grigoriy Orlov, Hakan Olsson,
Hans Insulander, Hans-Joerg Hoexer, Heikki Korpela, Henning Brauer,
Henric Jungheim, Hiroaki Etoh, Horacio Menezo Ganau, Hugh Graham,
Ian Darwin, Jacob Meuser, Jakob Schlyter, Jan-Uwe Finck,
Jared J. Yanovich, Jason Ish, Jason McIntyre, Jason Peel,
Jason Wright, Jasper Lievisse Adriaanse, Jean-Baptiste Marchand,
Jean-Francois Brousseau, Jean-Jacques Bernard-Gundol, Jim Rees,
Joel Knight, Jolan Luff, Jonathan Gray, Jordan Hargrave, Joris Vink,
Jose Nazario, Joshua Stein, Jun-ichiro itojun Hagino, Kenji Aoyama,
Kenjiro Cho, Kenneth R Westerback, Kevin Lo, Kevin Steves,
Kjell Wooding, Kurt Miller, Louis Bertrand, Magnus Holmberg,
Marc Aurele La France, Marc Balmer, Marc Espie, Marc Matteo,
Marco Peereboom, Marco Pfatschbacher, Marco S Hyman, Marcus Glocker,
Marcus Watts, Margarida Sequeira, Marius Eriksen, Mark Grimes,
Mark Kettenis, Mark Uemura, Markus Friedl, Martin Reindl,
Mathieu Sauve-Frankel, Mats O Jansson, Matt Behrens, Matt Smart,
Matthias Kilian, Matthew Jacob, Matthieu Herrb, Michael Coulter,
Michael Knudsen, Michael Shalayeff, Michael T. Stolarchuk,
Mike Frantzen, Mike Pechkin, Miod Vallat, Moritz Jodeit,
Nathan Binkert, Niall O'Higgins, Nick Holland, Niels Provos,
Niklas Hallqvist, Nikolay Sturm, Nils Nordman, Oleg Safiullin,
Otto Moerbeek, Patrick Latifi, Paul Janzen, Pedro Martelletto,
Peter Galbavy, Peter Stromberg, Peter Valchev, Philipp Buehler,
Reinhard J. Sammer, Ray Lai, Reyk Floeter, Rich Cannings,
Robert Nagy, Ryan Thomas McBride, Saad Kadhi, Shell Hin-lik Hung,
Stephen Kirkham, Steve Murphree, Steven Mestdagh, Ted Unangst,
Theo de Raadt, Thierry Deval, Thomas Nordin, Thordur I. Bjornsson,
Thorsten Lockert, Tobias Weingartner, Todd C. Miller, Todd T. Fries,
Tom Cosgrove, Uwe Stuehler, Vincent Labrecque, Wilbern Cobb,
Wim Vandeputte, Xavier Santolaria.

Announce: OpenSSH 4.6 released

2007-03-07T15:10:22Z

OpenSSH 4.6 has just been released. It will be available from the
mirrors listed at http://www.openssh.com/ shortly.

OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0
implementation and includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots and purchased
T-shirts or posters.

T-shirt, poster and CD sales directly support the project. Pictures
and more information can be found at:
http://www.openbsd.org/tshirts.html and
http://www.openbsd.org/orders.html

For international orders use http://https.openbsd.org/cgi-bin/order
and for European orders, use http://https.openbsd.org/cgi-bin/order.eu

Changes since OpenSSH 4.5:
============================

* sshd now allows the enabling and disabling of authentication
methods on a per user, group, host and network basis via the
Match directive in sshd_config.

* The following bugs have been fixed in this release:

- Clear SIGALRM when restarting due to SIGHUP. Prevents stray
signal from taking down sshd if a connection was pending at
the time SIGHUP was received
- sftp returned a zero exit status when upload failed due to write
errors (bugzilla #1252)
- fixed an inconsistent check for a terminal when displaying scp
progress meter (bugzilla #1265)
- Parsing of time values in Match blocks was incorrectly applied
to the global configuration (bugzilla #1275)
- Allow multiple forwarding options to work when specified in a
PermitOpen directive (bugzilla #1267)
- Interoperate with ssh.com versions that do not support binding
remote port forwarding sessions to a hostname (bugzilla #1019)

* Portable OpenSSH bugs fixed:

- "hang on exit" when background processes are running at the time
of exit on a ttyful/login session (bugzilla #52)
- Fix typos in the ssh-rand-helper(8) man page (bugzilla #1259)
- Check that some SIG records have been returned in getrrsetbyname
(bugzilla #1281)
- Fix contrib/findssl for platforms that lack "which" (bugzilla
#1237)
- Work around bug in OpenSSH 0.9.6e that broke aes256-ctr,
aes192-ctr, arcfour256 (bugzilla #1291)

Checksums:
==========

- SHA1 (openssh-4.6.tar.gz) = c1700845be464a769428f34ef727c1f530728afc
- SHA1 (openssh-4.6p1.tar.gz) = b2aefeb1861b4688b1777436035239ec32a47da8

Reporting Bugs:
===============

- please read http://www.openssh.com/report.html
and http://bugzilla.mindrot.org/

OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and
Ben Lindstrom.

OpenBSD 3.8 End of Life

2006-11-13T15:18:57Z

Due to the release of OpenBSD 4.0, the 3.8-STABLE branch will be
out of regular maintainance. There will be NO MORE fixes commited
to this branch nor new patches.

People relying on 3.8-STABLE (or older releases even) are strongly
advised to upgrade to a more recent release (preferrably 4.0)
as soon as possible.

Announce: OpenSSH 4.5 released

2006-11-07T10:40:36Z

OpenSSH 4.5 has just been released. It will be available from the
mirrors listed at http://www.openssh.com/ shortly.

OpenSSH is a 100% complete SSH protocol version 1.3, 1.5 and 2.0
implementation and includes sftp client and server support.

Once again, we would like to thank the OpenSSH community for their
continued support of the project, especially those who contributed
code or patches, reported bugs, tested snapshots and purchased
T-shirts or posters.

T-shirt, poster and CD sales directly support the project. Pictures
and more information can be found at:
http://www.openbsd.org/tshirts.html and
http://www.openbsd.org/orders.html

For international orders use http://https.openbsd.org/cgi-bin/order
and for European orders, use http://https.openbsd.org/cgi-bin/order.eu

Changes since OpenSSH 4.4:
============================

This is a bugfix only release. No new features have been added.

Security bugs resolved in this release:

* Fix a bug in the sshd privilege separation monitor that weakened its
verification of successful authentication. This bug is not known to
be exploitable in the absence of additional vulnerabilities.

This release includes the following non-security fixes:

* Several compilation fixes for portable OpenSSH

* Fixes to Solaris SMF/process contract support (bugzilla #1255)

Thanks to everyone who has contributed patches, reported bugs and
tested releases.

Checksums:
==========

- SHA1 (openssh-4.5.tar.gz) = def3de1557181062d788695b9371d02635af39fb
- SHA1 (openssh-4.5p1.tar.gz) = 2eefcbbeb9e4fa16fa4500dec107d1a09d3d02d7

Reporting Bugs:
===============

- please read http://www.openssh.com/report.html
and http://bugzilla.mindrot.org/

OpenSSH is brought to you by Markus Friedl, Niels Provos, Theo de Raadt,
Kevin Steves, Damien Miller, Darren Tucker, Jason McIntyre, Tim Rice and
Ben Lindstrom.

OpenBGPD 4.0 released Nov 1, 2006

2006-11-01T06:43:07Z

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

We are pleased to announce the official release of OpenBGPD 4.0.

OpenBGPD is a fairly complete implementation of the Border Gateway
Protocol, Version 4, as described in RFC 1771. BGP is a protocol used
by routers to exchange routing information, and is one of the core
protocols of the Internet.

Highlights include:
* full support for the BGP protocol as defined in RFC 1771
* full support for tcp md5 signatures (RFC 2385)
* full ipsec integration, with both static and dynamic keying supported
* pf and CARP integration
* communities support (RFC 1997)
* route refresh (RFC 2918)
* capabilities advertisement (RFC 3392)
* low memory footprint
* kernel routing table can be coupled and decoupled any time
* easy, straightforward configuration language
* very good performance
* easy to use bgpctl program, to control bgpd at runtime
* complete and accurate manpages

Improvements since OpenBGPD 3.9 include:
* new nexthop selection logic ignoring bgpd routes, helps in complex setups
with ospfd
* add a "detailed" show rib view to bgpctl, including communities
* allow requesting a route refresh from a peer that supports it
* have bgpd always report back the result of an operation to bgpctl, so the
operator can spot errors quicker
* allow bgpd to manipulate carp demotion counters based on session states,
gives even greater failover support
* support restarting sessions that reached max-prefix after a given time
* bgpctl can now show all routes received from a neighbor before filters
were applied, and routes sent to neighbors
* assorted fixes and improvements, as usual

OpenBGPD is in use in many production environments, with dozens to
hundreds of peers.

OpenBGPD 4.0 comes with OpenBSD 4.0, or can be downloaded seperately
from one of the mirrors listed at http://www.openbgpd.org/.

OpenBGPD is developed as part of the OpenBSD project, which offers CDs,
T-Shirts and Posters. Sales of these items help funding OpenBGPD
development. Orders can be placed via
http://www.openbsd.org/orders.html

OpenBGPD is primarily written by Claudio Jeker and Henning Brauer.
Parts of the design were done by Andre Oppermann. Many thanks to him, the
whole OpenBSD developer base and especially Theo de Raadt for their
continued help and support.

MD5 (openbgpd-4.0.tgz) = aced25bd206de43738f9be9c87a6a322

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.5 (OpenBSD)

iD8DBQFFSLI8qmHuiTqD3zIRAij3AJ9ydoQRAf0Hn6fHRHe9UWgjhGmQ3wCfcW1+
8M2zGBNJDHEo0N2IRtuWi1s=
=HSQp
-----END PGP SIGNATURE-----

OpenBSD 4.0 released Nov 1, 2006

2006-10-31T16:15:58Z

------------------------------------------------------------------------
- OpenBSD 4.0 RELEASED -------------------------------------------------

Nov 1, 2006.

We are pleased to announce the official release of OpenBSD 4.0.
This is our 20th release on CD-ROM (and 21st via FTP). We remain
proud of OpenBSD's record of ten years with only a single remote
hole in the default install. As in our previous releases, 4.0
provides significant improvements, including new features, in nearly
all areas of the system:

- New/extended platforms:
o OpenBSD/armish.
Various ARM-based appliances, using the Redboot boot loader, currently
only supporting the Thecus N2100 and IOData HDL-G.
o OpenBSD/sparc64.
UltraSPARC III based machines are now supported!
o OpenBSD/zaurus.
Support for the Zaurus SL-C3200.

- Improved hardware support, including:
o New msk(4) driver for Marvell/SysKonnect Yukon-2 Gigabit Ethernet.
o New bnx(4) driver for Broadcom NetXtreme II Gigabit Ethernet.
o New xge(4) driver for Neterion Xframe/Xframe II 10Gb Ethernet.
o New rum(4) driver for Ralink Technology 2nd gen USB IEEE
802.11a/b/g wireless.
o New acx(4) driver for Texas Instruments ACX100/ACX111
IEEE 802.11a/b/g wireless.
o New pgt(4) driver for Connexant/Intersil Prism GT Full-MAC
IEEE 802.11a/b/g wireless.
o New uath(4) driver for Atheros USB IEEE 802.11a/b/g wireless.
o New binary blob free wpi(4) driver for Intel PRO/Wireless
3945ABG IEEE 802.11a/b/g wireless.
o New arc(4) driver for Areca Technology Corporation SATA RAID;
including RAID management via bio(4).
o New mfi(4) driver for LSI Logic & Dell MegaRAID SAS RAID; including
RAID management via bio(4).
o New azalia(4) driver for generic High Definition Audio.
o New SD/MMC/SDIO drivers (sdhc(4), sdmmc(4)), currently supporting
SD memory cards as fake SCSI sd(4) drives.
o New udcf(4) driver for Gude ADS Expert mouseCLOCK DCF77/HBG time
signal station receivers.
o New uslcom(4) driver for Silicon Laboratories CP2101/CP2102 based
USB serial adapters.
o New ucycom(4) driver for Cypress microcontroller based USB serial
adapters.
o New uark(4) driver for Arkmicro Technologies ARK3116 based USB
serial adapters.
o New umsm(4) driver for Qualcomm MSM EVDO based modems.
o New Dallas/Maxim 1-Wire bus support, including:
o New gpioow(4) driver for 1-Wire bus bit-banging through GPIO pin
o New onewire(4) 1-Wire bus driver
o New owid(4) 1-Wire ID family driver
o New owtemp(4) 1-Wire temperature family driver
o New isagpio(4) driver for ISA I/O mapped as GPIO.
o New nmea(4) line discipline for NMEA 0183 (GPS) devices. The new
nmeaattach(8) utility can be used to receive NMEA 0183 data and
provide the time received as a timedelta sensor to be used by, for
example, ntpd(8).
o New VAX framebuffer drivers:
o New lcg(4) driver for VAXstation 4000/60 and VLC color frame buffers
o New lcspx(4) driver for Low-Cost SPX color frame buffers
o New gpx(4) driver for GPX color frame buffers
o smg(4) driver for Small Monochrome Graphics frame buffers heavily
updated to be a modern wscons(4) driver
o Support for VAX-based Digital VXT2000 and VXT2000+ terminals.
o The bge(4) driver supporting newer chipsets, such as the Broadcom
BCM5754, BCM5755, BCM5786, and BCM5787.
o The em(4) driver supporting newer chipsets, such as the Intel ESB2
and ICH8.
o The nfe(4) driver supporting newer chipsets, such as the NVIDIA
MCP61 and MCP65.
o The re(4) driver supporting newer chipsets, such as the Realtek
RT8101E, RT8168, and RT8169SC.
o The dc(4) driver supporting newer chipsets, such as the ADMtek
ADM9511 and ADM9513.
o The pciide(4) driver supporting newer chipsets, such as:
o ATI IXP300 SATA, IXP600 IDE
o Intel 6321ESB IDE/SATA, 82801G SATA, and 82801H SATA
o IT Express IT8211F IDE
o NVIDIA MCP61 SATA, MCP65 SATA
o Promise PDC205xx SATA
o ServerWorks SATA
o VIA VT8237A SATA
o The mpt(4) driver has been replaced with mpi(4), a more stable driver
that supports more hardware.
o The com(4) driver now supports pcmcia and cardbus cards on macppc.
o Working interrupt routing on Sun Netra t1 105, Ultra 60 and possibly
other sparc64 systems.
o Work around broken VIA and NVIDIA MPBIOSes, fixes interrupt routing
with GENERIC.MP on several systems.
o Initial bio(4) support for Compaq/HP ciss(4) Smart ARRAY 5/6
SAS/SCSI RAID controllers.
o Improved speed control on some systems:
o New SpeedStep detection code, also adds support for VIA C7-M,
and several newer Pentium M's.
o Support SpeedStep in rudimentary fashion on most unknown CPU's
that advertise the feature.
o Zaurus can be moved into slower speeds now too.
o The Pentium 4 Thermal Clock Control driver now supports more
CPU's including the Intel Pentium M and Xeon, and provides an
estimated performance impact.
o Numerous improvements to PowerNow K7 and K8 support on i386,
and support for K8 was added to amd64.
o Support for Intel 945G/GM video chipsets (on i386).
o Support for additional I2C sensors:
o The adt(4) driver now supports the National Semiconductor
LM9600, SMSC EMC6D10x and SMSC SCH5017 chips.
o The admtemp(4) driver now supports the Analog Devices ADM1023,
Genesys Logic GL523SM and Global Mixed-mode Technology G781 chips.

- New tools:
o GNU RCS has been replaced with OpenRCS.

- New functionality:
o IPsec has been greatly improved:
o ipsecctl(8) has been greatly extended and completely supersedes
ipsecadm(8):
o Lots of documentation improvements (man ipsec.conf)
o IPv6 support
o AH support
o Transport mode support
o Dynamic IKE support for roaming users
o USER_FQDN id support
o sasyncd(8) works much better:
o communicates with isakmpd(8), telling it to run active or
passive depending on the master/slave state of the carp(4)
interfaces. This makes IPsec failover setups much more robust.
o looks at the carp(4) interface group by default to suppress
preemption of IPsec traffic during system boot.
o isakmpd(8) can now be safely configured by ipsecctl(8) on startup.
o ftp(1) now supports HTTPS.
o cdio(1) can now perform track-at-once burning and rewritable blanking.
o spppcontrol(8) and wicontrol(8) functionality has been merged into
ifconfig(8).
o gcc(1) provides a new warning, -Wstack-larger-than-N, to report functions
which are too greedy in stack variables, see gcc-local(1) for details.
o An in-kernel getcwd(3) implementation.
o A new system call adjfreq(2) to allow ntpd(8) to adjust the tick rate of
the system clock automatically.
o Support for X11 on VAX has been added
o Virtual Allocation Table (VAT) support for UDF.
o C99 functions round(3), roundf(3), trunc(3), and truncf(3) have been
added to libm, the math library.
o pf(4) now supports Unicast Reverse Path Forwarding (uRPF) checks for
simplified ingress filtering.
o bpf(4) can now ignore packets based on their direction (inbound/outbound)
using the BIOCSDIRFILT ioctl.
o pdisk(8) can now set up slices on HFS(DPME) partitioned disks on mac68k.
o New dissectors have been added to tcpdump(8):
o Cisco's VQP (VLAN Query Protocol)
o IEEE 802.1AB LLDP (Link Layer Discovery Protocol)
o trunk(4) now supports the new loadbalance mode to balance outgoing
traffic based on hashed protocol header information.
o bioctl(8) has been extended to provide runtime information on rebuilds,
scrubs and initialization.
o New sysctls to check the system vendor, product, version, serial number,
and UUID.
o Equal cost multipath routing support. Needs to be enabled by a sysctl.
o Prebind, a secure implementation of prelinking, has been added to
ldconfig(8), it speeds up launching of shared binaries. Prebind is
compatible with address space randomization, unlike prelink.
o vnconfig(8) can now use PKCS #5 PBKDF2 to create a more secure key when
using encryption.

- Assorted improvements and code cleanup:
o Much better time keeping for multiprocessor OpenBSD/i386 systems.
o Much improved implementation of telldir(3) and friends.
o Replacement of many malloc(3) calls that follow a pattern prone to
integer overflow with safer constructs.
o Improved failover handling in carp(4):
o Extend the carp protocol with the demotion counter to act smarter
on multiple failures.
o Group failovers now work without carp running preempt mode.
o Demotion can now be controlled via interface groups.
o chio(1) is now a useful tool for controlling tape changers.
o Much improved st(4) device setup, tape handling and error processing.
o Many dhclient(8) fixes, including 'alias' handling and improved interface
initialization.
o scsi(4) devices detect the correct SCSI version.
o More umass(4) devices properly detected.
o Improved detection of fibre channel devices and devices in SCSI enclosures
o The new RSSI header has been added to the ieee80211_radiotap(9) framework
as a replacement for ANTSIGNAL headers.
o Many integer type safety cleanups with lint(1).

- Install/Upgrade process changes:
o Host specific site files add easy customization for individual hosts
o X Window aperture support, where available, now defaults to off

- New functionality for hostapd(8), the Host Access Point Daemon:
o IP based roaming to build wireless networks without the requirement of
a single broadcast domain.
o New event rules to match optional elements of radiotap headers:
signal percentage, transmit rate and channel frequency.
o Various bug fixes and improvements.

- OpenSSH 4.4:
o Conditional configuration in sshd_config(5) using the Match directive.
This allows some configuration options to be selectively overridden if
specific criteria (based on user, group, hostname and/or address) are met.
o Add support for Diffie-Hellman group exchange key agreement with a final
hash of SHA256.
o Added a ForceCommand directive to sshd_config(5), similar to the
command="..." option in ~/.ssh/authorized_keys.
o Added a PermitOpen directive to sshd_config(5), similar to the
permitopen="..." option in authorized_keys, to allow control over the
port-forwardings that a user is allowed to establish.
o Added an ExitOnForwardFailure option to cause ssh(1) to exit (with a
non-zero exit code) when requested port forwardings could not be
established.
o Added optional logging of transactions to sftp-server(8).
o ssh(1) will now record port numbers for hosts stored in
~/.ssh/authorized_keys when a non-standard port has been requested.
o Extended the sshd_config(5) "SubSystem" directive to allow the
specification of commandline arguments.
o Many manpage fixes and improvements

- OpenBGPD 4.0:
o new nexthop selection logic ignoring bgpd routes, helps in complex
setups with ospfd
o add a "detailed" show rib view to bgpctl, including communities
o allow requesting a route refresh from a peer that supports it
o have bgpd always report back the result of an operation to bgpctl, so
the operator can spot errors quicker
o allow bgpd to manipulate carp demotion counters based on session states,
gives even greater failover support
o support restarting sessions that reached max-prefix after a given time
o bgpctl can now show all routes received from a neighbor before filters
were applied, and routes sent to neighbors
o assorted fixes and improvements, as usual

- OpenOSPFD 4.0:
o Track uptime of the daemon itself.
o Track uptime of all ospf enabled interfaces.
o Adjust logging behaviour to prevent unwanted logging.
o Delay LSA updates when removing and adding - prevent flapping.
o Fix plaintext authentication.
o Improve the output of 'ospfctl show interfaces'.
o Support rtlabels when redistributing routes.

- OpenNTPD 4.0:
o support timedelta sensors, such as DCF77 receivers supported by
udcf(4) and GPS receivers supported by nmea(4).
o Adjust the kernel tick frequency, using adjfreq(2), improving accuracy
on many machines.
o allow for weight to be added to sensors or servers, so that one can
weight timedelta sensors higher than ntp peers

- Over 3700 ports, 3400 pre-built packages, improved package tools.
- Full support for pkg_add(1) over ssh(1), using one single connection.

- As usual, steady improvements in manual pages and other documentation.

- The system includes the following major components from outside suppliers:
o X.Org 6.9.0 (+ patches, and i386 contains XFree86 3.3.6 servers
(+ patches) for legacy chipsets not supported by X.Org)
o Gcc 2.95.3 (+ patches) and 3.3.5 (+ patches)
o Perl 5.8.8 (+ patches)
o Apache 1.3.29, mod_ssl 2.8.16, DSO support (+ patches)
o OpenSSL 0.9.7j (+ patches)
o Groff 1.15
o Sendmail 8.13.8, with libmilter
o Bind 9.3.2-P1 (+ patches)
o Lynx 2.8.5rel.4 with HTTPS and IPv6 support (+ patches)
o Sudo 1.6.8p9
o Ncurses 5.2
o Latest KAME IPv6
o Heimdal 0.7.2 (+ patches)
o Arla 0.35.7
o Binutils 2.15 (+ patches)
o Gdb 6.3 (+ patches)

If you'd like to see a list of what has changed between OpenBSD 3.9
and 4.0, look at

http://www.OpenBSD.org/plus40.html

Even though the list is a summary of the most important changes
made to OpenBSD, it still is a very very long list.

------------------------------------------------------------------------
- SECURITY AND ERRATA --------------------------------------------------

We provide patches for known security threats and other important
issues discovered after each CD release. As usual, between the
creation of the OpenBSD 4.0 FTP/CD-ROM binaries and the actual 4.0
release date, our team found and fixed some new reliability problems
(note: most are minor and in subsystems that are not enabled by
default). Our continued research into security means we will find
new security problems -- and we always provide patches as soon as
possible. Therefore, we advise regular visits to

http://www.OpenBSD.org/security.html
and
http://www.OpenBSD.org/errata.html

Security patch announcements are sent to the security-announce@...
mailing list. For information on OpenBSD mailing lists, please see:

http://www.OpenBSD.org/mail.html

------------------------------------------------------------------------
- CD-ROM SALES ---------------------------------------------------------

OpenBSD 4.0 is also available on CD-ROM. The 3-CD set costs $50USD
(EUR 50 including VAT) and is available via mail order and from a number
of contacts around the world. The set includes a colourful booklet
which carefully explains the installation of OpenBSD. A new set
of cute little stickers is also included (sorry, but our FTP mirror
sites do not support STP, the Sticker Transfer Protocol). As an
added bonus, the second CD contains an audio track, a song entitled
"Humppa Negala".

OpenBSD 4.0 comes with another OpenBSD Audio CD which celebrates the
artwork and songs that have been released with each OpenBSD release. All
the songs from the 3.0 to 4.0 releases are included (plus one bonus
track by Ty Semaka explaining his role in the development of the art
that accompanies OpenBSD releases). Includes a 11cm silver-on-clear
die-cut wireframe Puffy sticker!

Lyrics (and an explanation) for the songs may be found at:

http://www.OpenBSD.org/lyrics.html#40

Profits from CD sales are the primary income source for the OpenBSD
project -- in essence selling these CD-ROM units ensures that OpenBSD
will continue to make another release six months from now.

The OpenBSD 4.0 CD-ROMs are bootable on the following five platforms:

o i386
o amd64
o macppc
o sparc
o sparc64 (UltraSPARC)

(Other platforms must boot from floppy, network, or other method).

For more information on ordering CD-ROMs, see:

http://www.OpenBSD.org/orders.html

The above web page lists a number of places where OpenBSD CD-ROMs
can be purchased from. For our default mail order, go directly to:

https://https.OpenBSD.org/cgi-bin/order

or, for European orders:

https://https.OpenBSD.org/cgi-bin/order.eu

All of our developers strongly urge you to buy a CD-ROM and support
our future efforts. Additionally, donations to the project are
highly appreciated, as described in more detail at:

http://www.OpenBSD.org/goals.html#funding

------------------------------------------------------------------------
- T-SHIRT SALES --------------------------------------------------------

The project continues to expand its funding base by selling t-shirts
and polo shirts. And our users like them too. We have a variety
of shirts available, with the new and old designs, from our web
ordering system at:

https://https.OpenBSD.org/cgi-bin/order

and for Europe:

https://https.OpenBSD.org/cgi-bin/order.eu

The OpenBSD 4.0 t-shirts are available now. The new shirt for 4.0 is
a colourful parody of a well-known French comic. We also sell our older
shirts, as well as a selection of OpenSSH t-shirts.

------------------------------------------------------------------------
- FTP INSTALLS ---------------------------------------------------------

If you choose not to buy an OpenBSD CD-ROM, OpenBSD can be easily
installed via FTP. Typically you need a single small piece of boot
media (e.g., a boot floppy) and then the rest of the files can be
installed from a number of locations, including directly off the
Internet. Follow this simple set of instructions to ensure that
you find all of the documentation you will need while performing
an install via FTP. With the CD-ROMs, the necessary documentation
is easier to find.

1) Read either of the following two files for a list of ftp
mirrors which provide OpenBSD, then choose one near you:

http://www.OpenBSD.org/ftp.html
ftp://ftp.OpenBSD.org/pub/OpenBSD/4.0/ftplist

As of Nov 1, 2006, the following ftp mirror sites have the 4.0 release:

ftp://ftp.catai.net/pub/OpenBSD/4.0/ Austria
ftp://ftp.kd85.com/pub/OpenBSD/4.0/ Austria
ftp://openbsd.informatik.uni-erlangen.de/pub/OpenBSD/4.0 Germany
ftp://ftp.stacken.kth.se/pub/OpenBSD/4.0 Sweden
ftp://ftp3.usa.openbsd.org/pub/OpenBSD/4.0 CO, USA
ftp://ftp5.usa.openbsd.org/pub/OpenBSD/4.0 CA, USA
ftp://rt.fm/pub/OpenBSD/4.0 IL, USA

The release is also available at the master site:

ftp://ftp.openbsd.org/pub/OpenBSD/4.0/ Alberta, Canada

However it is strongly suggested you use a mirror.

Other mirror sites may take a day or two to update.

2) Connect to that ftp mirror site and go into the directory
pub/OpenBSD/4.0/ which contains these files and directories.
This is a list of what you will see:

ANNOUNCEMENT alpha/ luna88k/ sgi/
Changelogs/ amd64/ mac68k/ sparc/
HARDWARE armish/ macppc/ sparc64/
PACKAGES cats/ mvme68k/ src.tar.gz
PORTS ftplist mvme88k/ sys.tar.gz
README hp300/ packages/ tools/
SIZES hppa/ ports.tar.gz vax/
XF4.tar.gz i386/ root.mail zaurus/

It is quite likely that you will want at LEAST the following
files which apply to all the architectures OpenBSD supports.

README - generic README
HARDWARE - list of hardware we support
PORTS - description of our "ports" tree
PACKAGES - description of pre-compiled packages
root.mail - a copy of root's mail at initial login.
(This is really worthwhile reading).

3) Read the README file. It is short, and a quick read will make
sure you understand what else you need to fetch.

4) Next, go into the directory that applies to your architecture,
for example, i386. This is a list of what you will see:

CKSUM bsd.rd etc40.tgz misc40.tgz
INSTALL.i386 cd40.iso floppy40.fs pxeboot
INSTALL.linux cdboot floppyB40.fs xbase40.tgz
MD5 cdbr floppyC40.fs xetc40.tgz
base40.tgz cdemu40.iso game40.tgz xfont40.tgz
bsd cdrom40.fs index.txt xserv40.tgz
bsd.mp comp40.tgz man40.tgz xshare40.tgz

If you are new to OpenBSD, fetch _at least_ the file INSTALL.i386
and the appropriate floppy*.fs or cd40.iso file. Consult the
INSTALL.i386 file if you don't know which of the floppy images
you need (or simply fetch all of them).

5) If you are an expert, follow the instructions in the file called
README; otherwise, use the more complete instructions in the
file called INSTALL.i386. INSTALL.i386 may tell you that you
need to fetch other files.

6) Just in case, take a peek at:

http://www.OpenBSD.org/errata.html

This is the page where we talk about the mistakes we made while
creating the 4.0 release, or the significant bugs we fixed
post-release which we think our users should have fixes for.
Patches and workarounds are clearly described there.

Note: If you end up needing to write a raw floppy using Windows,
you can use "fdimage.exe" located in the pub/OpenBSD/4.0/tools
directory to do so.

------------------------------------------------------------------------
- X.ORG FOR MOST ARCHITECTURES -----------------------------------------

X.Org has been integrated more closely into the system. This release
contains X.Org 6.9.0. Most of our architectures ship with X.Org, including
amd64, sparc, sparc64 and macppc. During installation, you can install
X.Org quite easily. Be sure to try out xdm(1) and see how we have
customized it for OpenBSD.

------------------------------------------------------------------------
- PORTS TREE -----------------------------------------------------------

The OpenBSD ports tree contains automated instructions for building
third party software. The software has been verified to build and
run on the various OpenBSD architectures. The 4.0 ports collection,
including many of the distribution files, is included on the 3-CD
set. Please see the PORTS file for more information.

Note: some of the most popular ports, e.g., the Apache web server
and several X applications, come standard with OpenBSD. Also, many
popular ports have been pre-compiled for those who do not desire
to build their own binaries (see BINARY PACKAGES, below).

------------------------------------------------------------------------
- BINARY PACKAGES WE PROVIDE -------------------------------------------

A large number of binary packages are provided. Please see the PACKAGES
file (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.0/PACKAGES) for more details.

------------------------------------------------------------------------
- SYSTEM SOURCE CODE ---------------------------------------------------

The CD-ROMs contain source code for all the subsystems explained
above, and the README (ftp://ftp.OpenBSD.org/pub/OpenBSD/4.0/README)
file explains how to deal with these source files. For those who
are doing an FTP install, the source code for all four subsystems
can be found in the pub/OpenBSD/4.0/ directory:

XF4.tar.gz ports.tar.gz src.tar.gz sys.tar.gz

------------------------------------------------------------------------
- THANKS ---------------------------------------------------------------

OpenBSD 4.0 includes artwork and CD artistic layout by Ty Semaka,
who also arranged an audio track on the OpenBSD 4.0 CD set. Ports
tree and package building by Peter Valchev, Nikolay Sturm and
Christian Weisgerber. System builds by Theo de Raadt, Kenji Aoyama,
and Miod Vallat. X11 builds by Todd Fries. ISO-9660 filesystem
layout by Theo de Raadt.

We would like to thank all of the people who sent in bug reports, bug
fixes, donation cheques, and hardware that we use. We would also like
to thank those who pre-ordered the 4.0 CD-ROM or bought our previous
CD-ROMs. Those who did not support us financially have still helped
us with our goal of improving the quality of the software.

Our developers are:

Aaron Campbell, Aleksander Piotrowski, Alex Feldman, Alexander Guy,
Alexander von Gernler, Alexander Yurchenko, Alexandre Anriot,
Andreas Gunnarsson, Angelos D. Keromytis, Anil Madhavapeddy,
Antoine Jacoutot, Artur Grabowski, Ben Lindstrom, Bernd Ahlers,
Bjorn Sandell, Bob Beck, Brad Smith, Brandon Creighton,
Brian Caswell, Brian Somers, Bruno Rohee, Camiel Dobbelaar,
Can Erkin Acar, Cedric Berger, Chad Loder, Chris Cappuccio,
Chris Kuethe, Christian Weisgerber, Christopher Pascoe,
Claudio Jeker, Constantine Sapuntzakis, Dale Rahn, Damien Bergamini,
Damien Couderc, Damien Miller, Dan Harnett, Daniel Hartmeier,
Darren Tucker, David B Terrell, David Gwynne, David Hill,
David Krause, David Lebel, David Leonard, Dimitry Andric,
Don Stewart, Dug Song, Eric Jackson, Esben Norby,
Federico G. Schwindt, Felix Kronlage, Fernando Gont,
Gordon Willem Klok, Greg Taleck, Grigoriy Orlov, Hakan Olsson,
Hans Insulander, Hans-Joerg Hoexer, Heikki Korpela, Henning Brauer,
Henric Jungheim, Hiroaki Etoh, Horacio Menezo Ganau, Hugh Graham,
Ian Darwin, Jacob Meuser, Jakob Schlyter, Jan-Uwe Finck,
Jared J. Yanovich, Jason Ish, Jason McIntyre, Jason Peel,
Jason Wright, Jasper Lievisse Adriaanse, Jean-Baptiste Marchand,
Jean-Francois Brousseau, Jean-Jacques Bernard-Gundol, Jim Rees,
Joel Knight, Jolan Luff, Jonathan Gray, Jordan Hargrave, Joris Vink,
Jose Nazario, Joshua Stein, Jun-ichiro itojun Hagino, Kenji Aoyama,
Kenjiro Cho, Kenneth R Westerback, Kevin Lo, Kevin Steves,
Kjell Wooding, Kurt Miller, Louis Bertrand, Magnus Holmberg,
Marc Aurele La France, Marc Balmer, Marc Espie, Marc Matteo,
Marco Peereboom, Marco Pfatschbacher, Marco S Hyman, Marcus Glocker,
Marcus Watts, Margarida Sequeira, Marius Eriksen, Mark Grimes,
Mark Kettenis, Mark Uemura, Markus Friedl, Martin Reindl,
Mathieu Sauve-Frankel, Mats O Jansson, Matt Behrens, Matt Smart,
Matthias Kilian, Matthew Jacob, Matthieu Herrb, Michael Coulter,
Michael Knudsen, Michael Shalayeff, Michael T. Stolarchuk,
Mike Frantzen, Mike Pechkin, Miod Vallat, Moritz Jodeit,
Nathan Binkert, Niall O'Higgins, Nick Holland, Niels Provos,
Niklas Hallqvist, Nikolay Sturm, Nils Nordman, Oleg Safiullin,
Otto Moerbeek, Patrick Latifi, Paul Janzen, Pedro Martelletto,
Peter Galbavy, Peter Stromberg, Peter Valchev, Philipp Buehler,
Reinhard J. Sammer, Ray Lai, Reyk Floeter, Rich Cannings,
Robert Nagy, Ryan Thomas McBride, Saad Kadhi, Shell Hin-lik Hung,
Stephen Kirkham, Steve Murphree, Steven Mestdagh, Ted Unangst,
Theo de Raadt, Thierry Deval, Thomas Nordin, Thordur I. Bjornsson,
Thorsten Lockert, Tobias Weingartner, Todd C. Miller, Todd T. Fries,
Tom Cosgrove, Uwe Stuehler, Vincent Labrecque, Wilbern Cobb,
Wim Vandeputte, Xavier Santolaria.