Security and data integrity of OpenBSD vs FreeBSD

[doobie0710]

I want to set up a home server, primarily for storing files and accessing them at or away from home (I will do other things with it in the future). I was going to just use Debian but wanted to give something new a try and I've heard the BSD experience is really cohesive compared with Linux distributions, which is very appealing. I hear that OpenBSD is security focused and thoroughly audited, so I am drawn to it for something that will be facing the internet and storing all my data. FreeBSD supposedly has great ZFS integration and bit rot concerns me a lot; this distinction makes choosing between the two difficult. Three possibilities occur to me:

1. set up some data integrity tools on OpenBSD to avoid bit rot,
2. harden FreeBSD (or just accept it as is, if the difference between the two is overstated),
3. use two servers, OpenBSD facing the internet and FreeBSD storing the bulk of the data and backups and providing it locally.

Perhaps there is some Linux or illumos distribution that would be more appropriate for my needs? Please advise me on which way to go with this.

[J65nko]

I would suggest option 3, using OpenBSD facing the internet. On FreeBSD you then can use ZFS.
On OpenBSD, besides a pf firewall, you could configure Wireguard for remote client file access.

But I would only do ZFS on a system that has ECC memory. You cannot rely on ZFS for disk storage bit rot prevention, when the memory to calculate and verify the ZFS checksums can flip memory bits undetected.....

[victorvas]

Originally Posted by J65nko

But I would only do ZFS on a system that has ECC memory. You cannot rely on ZFS for disk storage bit rot prevention, when the memory to calculate and verify the ZFS checksums can flip memory bits undetected.....

Is it only ZFS, or there are other filesystems that are dependent on ECC memory?

[Onauk]

I would guess that every time you do checksumming you are using RAM and thus you can be subject to bit flips if not using ECC memory. So every filesystem is liable to bit flips.

[doobie0710]

Reading about the fragility of ZFS without ECC RAM, I see it is a contentious topic. Personally I am not convinced that using ZFS without ECC RAM will actively sabotage a system more than using some other file system. ECC RAM is obviously good if you can get it.

Originally Posted by J65nko

[...]besides a pf firewall, you could configure Wireguard for remote client file access.

Something like this is what I had in mind, along with hosting a Transmission server, DNS sinkhole for adverts and whatever other services are useful. The more I think about it, one server for storage and another for services makes a lot of sense.