OpenBSD 5.4

Released Nov 1, 2013
Copyright 1997-2013, Theo de Raadt.
ISBN 978-0-9881561-2-8
5.4 Song: "Our favorite hacks"

• Order a CDROM from our ordering system.
• See the information on The FTP page for a list of mirror machines.
• Go to the pub/OpenBSD/5.4/ directory on one of the mirror sites.
• Briefly read the rest of this document.
• Have a look at The 5.4 Errata page for a list of bugs and workarounds.
• See a detailed log of changes between the 5.3 and 5.4 releases.

All applicable copyrights and credits can be found in the applicable file sources found in the files src.tar.gz, sys.tar.gz, xenocara.tar.gz, or in the files fetched via ports.tar.gz. The distribution files used to build packages from the ports.tar.gz file are not included on the CDROM because of lack of space.

What's New

This is a partial list of new features and systems included in OpenBSD 5.4. For a comprehensive list, see the changelog leading to 5.4.

• New/extended platforms:
  • OpenBSD/octeon
    New platform for systems based on the Cavium Octeon MIPS-compatible processors. Supported machines include:
    • Portwell CAM-0100
    • Ubiquiti Networks EdgeRouter LITE (no local storage)
  • OpenBSD/beagle
    New platform for OMAP3/4 and AM335x systems using an ARM Cortex-A8 or Cortex-A9 CPU. Supported boards include:
    • BeagleBoard C4 / xM
    • BeagleBone and BeagleBone Black
    • PandaBoard and PandaBoard ES

• Improved hardware support, including:
  • inteldrm(4) has been overhauled, including:
    • Now mostly in sync with Linux 3.8.13.
    • Support for Kernel Mode Setting (KMS) including support for additional output types such as DisplayPort.
    • Sandy Bridge and newer parts which previously had only ShadowFB acceleration now have full hardware acceleration including use of the 3D rings.
    • wsdisplay(4) now attaches to inteldrm(4) and providers a framebuffer console.
  • vgafb(4/macppc) now supports multiple virtual consoles.
  • Support for Elantech touchpads version 4 (clickpad) added to pms(4).
  • Fixed st(4) EOM handling, enabling much better Bacula support.
  • Support for vdsk(4) disks larger than 2TB.

• Generic network stack improvements:
  • Reworked checksum handling for network protocols.
  • divert(4) now recalculates the IP and protocol checksums of reinjected packets.
  • No longer attempt to delete the undeletable RNF_ROOT route.

• Routing daemons and other userland network improvements:
  • Support SSL inspection in relayd(8).
  • Added slowcgi(8), a libevent-based FastCGI implementation.
  • Enabled ECDHE support in httpd(8).
  • Do not start inetd(8) by default any more.
  • Many ldpd(8) improvements, including a speed-up of the session establishment process, support for adjacencies and targeted hellos, support for multiple addresses per interface, and more.

• dhcpd(8) improvements:
  • Improved compliance with RFC 2131 strictures on client-identifiers.
  • Fixed synchronization of leases.
  • Replaced manual date parsing and printing with strftime and strptime.
  • Explicitly label dates in leases files as being UTC dates.

• dhclient(8) improvements:
  • Delete routes added by defunct dhclient processes.
  • Improved handling of client-identifier option.
  • Increased ip_ttl on packets to 128, allowing more distant servers to provide leases.
  • Replaced manual date parsing and printing with strftime and strptime.
  • Explicitly label dates in leases files as being UTC dates.
  • Improved interactions between dhclient processes to make the most recent dhclient started the most likely to persist.
  • Support for static routes and classless static routes options.
  • Fixed log messages to print correct addresses.
  • Reduced log verbosity by emitting debug messages only when debugging.
  • Eliminated unnecessary address and route churn during lease renewal by not binding leases identical to the current one.

• OpenSMTPD 5.3.3:
  • New features:
    • Add support for LMTP local deliveries
    • Add SECURE and AUTH transmission types
    • Add support for transparent queue compression
    • helo names can now be looked up in a db(3) table
    • New "error:" alias kind allows aliasing a user-part to an error
    • Traces can be (de)activated at runtime
  • Improvements:
    • More robust queue can cope with runtime errors
    • Improved routing strategies
    • Assorted minor bug fixes and cleanups

• Performance improvements:
  • Don't require the kernel lock when processing audio interrupts.
  • Improved kernel bcopy/memmove/memcpy implementations and made more careful choices between them.
  • Implemented symbol caching and RELCOUNT/RELACOUNT optimizations in ld.so(1).

• Threading improvements:
  • Closed various race conditions between exit/fork/execve/__tfork/__threxit/ptrace in both the kernel and libpthread.

• Assorted improvements:
  • Added a locale(1) utility.
  • Added ltrace(1), a tool to trace PLT calls.
  • Added a new implementation of cu(1).
  • Added shm_open(3)/shm_unlink(3).
  • Added getprogname(3)/setprogname(3).
  • Added clock_getcpuclockid(3) and pthread_getcpuclockid(3).
  • Added fmemopen(3).
  • Added open_memstream(3)/open_wmemstream(3).
  • Added memmem(3).
  • Added fdatasync(2).
  • Added ppoll(2).
  • Added pselect(2).
  • Added utrace(2).
  • Switched the VAX platform to ELF.
  • Fixed kernel profiling on multiprocessor systems.
  • Experimental support for fuse(4).
  • Added support for write_opt=nodir and the 'path' and 'linkpath' extended headers to pax(1) (aka tar(1)).
  • Brought getconf(1) up to date with recent POSIX updates.
  • Added -L and -P options to ln(1).
  • More structures and symbolic values displayed by kdump(1).
  • pkill(1) now accepts an -I option to ask for confirmation on killing processes.

• OpenSSH 6.3:
  • New features:
    • sshd(8): add ssh-agent(1) support to sshd(8); allows encrypted hostkeys, or hostkeys on smartcards.
    • ssh(1) and sshd(8): allow optional time-based rekeying via a second argument to the existing RekeyLimit option. RekeyLimit is now supported in sshd_config(5) as well as on the client.
    • sshd(8): standardise logging of information during user authentication.
    • ssh(1): add the ability to query supported ciphers, MAC algorithms, key types and key exchange methods.
    • ssh(1): support ProxyCommand=- to allow support cases where stdin and stdout already point to the proxy.
    • ssh(1): allow IdentityFile=none.
    • ssh(1) and sshd(8): add -E option to ssh(1) and sshd(8) to append debugging logs to a specified file instead of stderr or syslog.
    • sftp(1): add support for resuming partial downloads using the reget command and on the sftp(1) commandline or on the get commandline using the -a (append) option.
    • ssh(1): add an IgnoreUnknown configuration option to selectively suppress errors arising from unknown configuration directives.
    • sshd(8): add support for submethods to be appended to required authentication methods listed via AuthenticationMethods.
  • The following significant bugs have been fixed in this release:
    • sshd(8): fix refusal to accept certificate if a key of a different type to the CA key appeared in authorized_keys before the CA key.
    • ssh(1), ssh-agent(1) and sshd(8): Use a monotonic time source for timers so that things like keepalives and rekeying will work properly over clock steps.
    • sftp(1): update progressmeter when data is acknowledged, not when it's sent. (bz#2108)
    • ssh(1) and ssh-keygen(1): improve error messages when the current user does not exist in /etc/passwd. (bz#2125)
    • ssh(1): reset the order in which public keys are tried after partial authentication success.
    • ssh-agent(1): clean up socket files after SIGINT when in debug mode. (bz#2120)
    • ssh(1) and others: avoid confusing error messages in the case of broken system resolver configurations. (bz#2122)
    • ssh(1): set TCP nodelay for connections started with -N. (bz#2124)
    • ssh(1): correct manual for permission requirements on ~/.ssh/config. (bz#2078)
    • ssh(1): fix ControlPersist timeout not triggering in cases where TCP connections have hung. (bz#1917)
    • ssh(1): properly detach a ControlPersist master from its controlling terminal.
    • sftp(1): avoid crashes in libedit when it has been compiled with multi-byte character support. (bz#1990)
    • sshd(8): when running sshd -D, close stderr unless we have explicitly requested logging to stderr. (bz#1976)
    • ssh(1): fix incomplete bzero. (bz#2100)
    • sshd(8): log and error and exit if ChrootDirectory is specified and running without root privileges.
    • Many improvements to the regression test suite. In particular log files are now saved from ssh(1) and sshd(8) after failures.
    • Fix a number of memory leaks. (bz#1967, bz#2096 and others)
    • sshd(8): fix public key authentication when a :style is appended to the requested username.
    • ssh(1): do not fatally exit when attempting to cleanup multiplexing-created channels that are incompletely opened. (bz#2079)

• Over 7,800 ports, major stability improvements in the package build process
  • The parallel ports builder is better at catching up errors on older slower platforms, thus allowing release engineers to better concentrate on real errors.

• Many pre-built packages for each architecture:

  i386: 7976 sparc64: 6959 alpha: 6062 m68k: 3862

  sh: 989 amd64: 7941 powerpc: 7483 m88k: 3951

  sparc: 4823 arm: 5582 hppa: 6607

  vax: 2226 mips64: 6739 mips64el: 6306

• Some highlights:
  • GNOME 3.8.3
  • KDE 3.5.10
  • Xfce 4.10
  • MySQL 5.1.70
  • PostgreSQL 9.2.4
  • Postfix 2.10.1
  • OpenLDAP 2.3.43 and 2.4.35
  • Mozilla Firefox 3.6.28 and 22.0
  • Mozilla Thunderbird 17.0.7
  • GHC 7.6.3
  • LibreOffice 4.0.4.2
  • Emacs 21.4 and 24.3
  • Vim 7.3.850
  • PHP 5.2.17 and 5.3.27
  • Python 2.7.5 and 3.3.2
  • Ruby 1.8.7.374, 1.9.3.448 and 2.0.0.247
  • Tcl/Tk 8.4.20, 8.5.14 and 8.6.0
  • JDK 1.6.0.32 and 1.7.0.21
  • Mono 2.10.9
  • Chromium 28.0.1500.45
  • Groff 1.22.2
  • Go 1.1.1
  • GCC 4.6.4 and 4.8.1
  • LLVM/Clang 3.3
  • Node.js 0.10.12

• As usual, steady improvements in manual pages and other documentation.

• The system includes the following major components from outside suppliers:
  • Xenocara (based on X.Org 7.7 with xserver 1.14.1 + patches, freetype 2.4.12, fontconfig 2.10.91, Mesa 7.11.2, xterm 293, xkeyboard-config 2.7 and more)
  • Gcc 4.2.1 (+patches), 3.3.6 (+ patches) and 2.95.3 (+ patches)
  • Perl 5.16.3 (+ patches)
  • Our improved and secured version of Apache 1.3, with SSL/TLS and DSO support
  • Nginx 1.4.1 (+ patches)
  • OpenSSL 1.0.1c (+ patches)
  • SQLite 3.7.17 (+ patches)
  • Sendmail 8.14.7, with libmilter
  • Bind 9.4.2-P2 (+ patches)
  • NSD 3.2.15
  • Lynx 2.8.7rel.2 with HTTPS and IPv6 support (+ patches)
  • Sudo 1.7.2p8
  • Ncurses 5.7
  • Heimdal 1.5.2 (+ patches)
  • Binutils 2.15 (+ patches)
  • Gdb 6.3 (+ patches)
  • Less 444 (+ patches)
  • Awk Aug 10, 2011 version

How to install

Following this are the instructions which you would have on a piece of paper if you had purchased a CDROM set instead of doing an alternate form of install. The instructions for doing an FTP (or other style of) install are very similar; the CDROM instructions are left intact so that you can see how much easier it would have been if you had purchased a CDROM instead.

• CD1:5.4/i386/INSTALL.i386

• CD2:5.4/amd64/INSTALL.amd64

• CD3:5.4/sparc64/INSTALL.sparc64

• FTP:.../OpenBSD/5.4/alpha/INSTALL.alpha
• FTP:.../OpenBSD/5.4/armish/INSTALL.armish
• FTP:.../OpenBSD/5.4/beagle/INSTALL.beagle
• FTP:.../OpenBSD/5.4/hp300/INSTALL.hp300
• FTP:.../OpenBSD/5.4/hppa/INSTALL.hppa
• FTP:.../OpenBSD/5.4/landisk/INSTALL.landisk
• FTP:.../OpenBSD/5.4/loongson/INSTALL.loongson
• FTP:.../OpenBSD/5.4/luna88k/INSTALL.luna88k
• FTP:.../OpenBSD/5.4/macppc/INSTALL.macppc
• FTP:.../OpenBSD/5.4/mvme68k/INSTALL.mvme68k
• FTP:.../OpenBSD/5.4/mvme88k/INSTALL.mvme88k
• FTP:.../OpenBSD/5.4/octeon/INSTALL.octeon
• FTP:.../OpenBSD/5.4/sgi/INSTALL.sgi
• FTP:.../OpenBSD/5.4/socppc/INSTALL.socppc
• FTP:.../OpenBSD/5.4/sparc/INSTALL.sparc
• FTP:.../OpenBSD/5.4/vax/INSTALL.vax
• FTP:.../OpenBSD/5.4/zaurus/INSTALL.zaurus

Quick installer information for people familiar with OpenBSD, and the use of the "disklabel -E" command. If you are at all confused when installing OpenBSD, read the relevant INSTALL.* file as listed above!

OpenBSD/i386:

Play with your BIOS options to enable booting from a CD. The OpenBSD/i386 release is on CD1. If your BIOS does not support booting from CD, you will need to create a boot floppy to install from. To create a boot floppy write CD1:5.4/i386/floppy54.fs to a floppy and boot via the floppy drive.

Use CD1:5.4/i386/floppyB54.fs instead for greater SCSI controller support, or CD1:5.4/i386/floppyC54.fs for better laptop support.

If you can't boot from a CD or a floppy disk, you can install across the network using PXE as described in the included INSTALL.i386 document.

If you are planning on dual booting OpenBSD with another OS, you will need to read INSTALL.i386.

To make a boot floppy under MS-DOS, use the "rawrite" utility located at CD1:5.4/tools/rawrite.exe. To make the boot floppy under a Unix OS, use the dd(1) utility. The following is an example usage of dd(1), where the device could be "floppy", "rfd0c", or "rfd0a".

# dd if=<file> of=/dev/<device> bs=32k

Make sure you use properly formatted perfect floppies with NO BAD BLOCKS or your install will most likely fail. For more information on creating a boot floppy and installing OpenBSD/i386 please refer to FAQ 4.3.2.

OpenBSD/amd64:

The 5.4 release of OpenBSD/amd64 is located on CD2. Boot from the CD to begin the install - you may need to adjust your BIOS options first. If you can't boot from the CD, you can create a boot floppy to install from. To do this, write CD2:5.4/amd64/floppy54.fs to a floppy, then boot from the floppy drive.

If you can't boot from a CD or a floppy disk, you can install across the network using PXE as described in the included INSTALL.amd64 document.

If you are planning to dual boot OpenBSD with another OS, you will need to read INSTALL.amd64.

OpenBSD/macppc:

Burn the image from the FTP site to a CDROM, and power on your machine while holding down the C key until the display turns on and shows OpenBSD/macppc boot.

Alternatively, at the Open Firmware prompt, enter boot cd:,ofwboot /5.4/macppc/bsd.rd

OpenBSD/sparc64:

Put CD3 in your CDROM drive and type boot cdrom.

If this doesn't work, or if you don't have a CDROM drive, you can write CD3:5.4/sparc64/floppy54.fs or CD3:5.4/sparc64/floppyB54.fs (depending on your machine) to a floppy and boot it with boot floppy. Refer to INSTALL.sparc64 for details.

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.

You can also write CD3:5.4/sparc64/miniroot54.fs to the swap partition on the disk and boot with boot disk:b.

If nothing works, you can boot over the network as described in INSTALL.sparc64.

OpenBSD/alpha:

Write FTP:5.4/alpha/floppy54.fs or FTP:5.4/alpha/floppyB54.fs (depending on your machine) to a diskette and enter boot dva0. Refer to INSTALL.alpha for more details.

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.

OpenBSD/armish:

After connecting a serial port, Thecus can boot directly from the network either tftp or http. Configure the network using fconfig, reset, then load bsd.rd, see INSTALL.armish for specific details. IOData HDL-G can only boot from an EXT-2 partition. Boot into linux and copy 'boot' and bsd.rd into the first partition on wd0 (hda1) then load and run bsd.rd, preserving the wd0i (hda1) ext2fs partition. More details are available in INSTALL.armish.

OpenBSD/hp300:

Boot over the network by following the instructions in INSTALL.hp300.

OpenBSD/hppa:

Boot over the network by following the instructions in INSTALL.hppa or the hppa platform page.

OpenBSD/landisk:

Write miniroot54.fs to the start of the CF or disk, and boot normally.

OpenBSD/loongson:

Write miniroot54.fs to a USB stick and boot bsd.rd from it or boot bsd.rd via tftp. Refer to the instructions in INSTALL.loongson for more details.

OpenBSD/luna88k:

Copy bsd.rd to a Mach or UniOS partition, and boot it from the PROM. Alternatively, you can create a bootable tape and boot from it. Refer to the instructions in INSTALL.luna88k for more details.

OpenBSD/mvme68k:

You can create a bootable installation tape or boot over the network.
The network boot requires a MVME68K BUG version that supports the NIOT and NBO debugger commands. Follow the instructions in INSTALL.mvme68k for more details.

OpenBSD/mvme88k:

You can create a bootable installation tape or boot over the network.
The network boot requires a MVME88K BUG version that supports the NIOT and NBO debugger commands. Follow the instructions in INSTALL.mvme88k for more details.

OpenBSD/octeon:

After connecting a serial port, boot bsd.rd over the network via DHCP/tftp. Refer to the instructions in INSTALL.octeon for more details.

OpenBSD/sgi:

To install on an O2, burn cd54.iso on a CD-R, put it in the CD drive of your machine and select Install System Software from the System Maintenance menu.

On other systems, or if your machine doesn't have a CD drive, you can setup a DHCP/tftp network server, and boot using "bootp()/bsd.rd.IP##" using the kernel matching your system type. Refer to the instructions in INSTALL.sgi for more details.

OpenBSD/socppc:

After connecting a serial port, boot over the network via DHCP/tftp. Refer to the instructions in INSTALL.socppc for more details.

OpenBSD/sparc:

Boot from one of the provided install ISO images, using one of the two commands listed below, depending on the version of your ROM.

ok boot cdrom 5.4/sparc/bsd.rd
or
> b sd(0,6,0)5.4/sparc/bsd.rd

If your SPARC system does not have a CD drive, you can alternatively boot from floppy. To do so you need to write floppy54.fs to a floppy. For more information see FAQ 4.3.2. To boot from the floppy use one of the two commands listed below, depending on the version of your ROM.

ok boot floppy
or
> b fd()

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.

If your SPARC system doesn't have a floppy drive nor a CD drive, you can either setup a bootable tape, or install via network, as told in the INSTALL.sparc file.

OpenBSD/vax:

Boot over the network via mopbooting as described in INSTALL.vax.

OpenBSD/zaurus:

Using the Linux built-in graphical ipkg installer, install the openbsd54_arm.ipk package. Reboot, then run it. Read INSTALL.zaurus for a few important details.

Notes about the source code:

src.tar.gz contains a source archive starting at /usr/src. This file contains everything you need except for the kernel sources, which are in a separate archive. To extract:

# mkdir -p /usr/src
# cd /usr/src
# tar xvfz /tmp/src.tar.gz

sys.tar.gz contains a source archive starting at /usr/src/sys. This file contains all the kernel sources you need to rebuild kernels. To extract:

# mkdir -p /usr/src/sys
# cd /usr/src
# tar xvfz /tmp/sys.tar.gz

Both of these trees are a regular CVS checkout. Using these trees it is possible to get a head-start on using the anoncvs servers as described here. Using these files results in a much faster initial CVS update than you could expect from a fresh checkout of the full OpenBSD source tree.

How to upgrade

If you already have an OpenBSD 5.3 system, and do not want to reinstall, upgrade instructions and advice can be found in the Upgrade Guide.

Ports Tree

A ports tree archive is also provided. To extract:

# cd /usr
# tar xvfz /tmp/ports.tar.gz

The ports/ subdirectory is a checkout of the OpenBSD ports tree. Go read the ports page if you know nothing about ports at this point. This text is not a manual of how to use ports. Rather, it is a set of notes meant to kickstart the user on the OpenBSD ports system.

The ports/ directory represents a CVS (see the manpage for cvs(1) if you aren't familiar with CVS) checkout of our ports. As with our complete source tree, our ports tree is available via AnonCVS. So, in order to keep current with it, you must make the ports/ tree available on a read-write medium and update the tree with a command like:

# cd /usr/ports
# cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_5_4

[Of course, you must replace the server name here with a nearby anoncvs server.]

Note that most ports are available as packages through FTP. Updated packages for the 5.4 release will be made available if problems arise.

If you're interested in seeing a port added, would like to help out, or just would like to know more, the mailing list ports@openbsd.org is a good place to know.