Qs for switching from Ubuntu to OpenBSD

[JavaUser]

I'm about to reinstall our main server here and I'm thinking of switching from Linux (which we've been using for years) to OpenBSD.

I like the stability and security of OpenBSD. Here are my questions:

1. All of our apps are in Java, running under Tomcat etc. I know that with the new IcedTea project we may have a way of running Java stuff directly on OpenBSD. Any experience with this? Is this a good way to go?

2. Encryption: This is a trickier question. I want to have the entire disk encrypted, so it would even boot from an encrypted FS. On Linux it's easy to install on an encrypted partition, using DM-crypt. I did find an article about using the loopback FS with OpenBSD but somehow it didn't give me much confidence in the system. Is OpenBSD ever going to get more stable FS encryption option, like dm-crypt or GEOM-based disk encryption? It's weird that a security-focused OS like OpenBSD would be so far behind in this area.

I'm ready to switch but I really want #2, a very solid and reliable way of running off an encrypted disk, and I'm not feeling like OpenBSD has it. Comments?

I did pre-order the 4.4 disks so I expect them any day now, and I'm looking forward to trying it out at least on a test machine.

(I posted this before on some other BSD forum but it was a non-functional forum so I found this forum which seems to be better)

[ocicat]

Originally Posted by JavaUser

I know that with the new IcedTea project we may have a way of running Java stuff directly on OpenBSD.

IcedTea is not been officially introduced into the packages/ports system yet, however, Tomcat has been in the packages/ports system for some time now. More information on the packages/ports system can be found at the following:

http://openbsd.org/faq/faq15.html

Is this a good way to go?

If you have the skill set to port IcedTea to OpenBSD, this is a question only you can answer, but if you run into problems, you will not be able to get a lot of help from the project proper. OpenBSD is a small project; there isn't a lot of infrastructure set up to answer questions.

I want to have the entire disk encrypted, so it would even boot from an encrypted FS.

You will want to study vnconfig(8). Data can be encrypted, but the system itself will have to remain unencrypted.

[JavaUser]

Thanks for the info. It sounds like I should stick to Ubuntu for now, until IcedTea and disk encryption can become more mature. I realize Tomcat is in the ports but actually I'll be using JBoss and other things. I don't want to have to roll my own IcedTea or work on it.

I assume that IcedTea will be in ports sooner or later, and then I can reconsider going to OpenBSD.

Also for disk encryption... I know OpenBSD created OpenSSH and has done a lot of work in security, but if the disk is not encrypted, the easiest attack is to just grab the machine. The vnconfig stuff seems like a total kludge. It's unfortunate that both Linux and FreeBSD have better-integrated disk encryption than security-focused OpenBSD.

[drhowarddrfine]

Then why not use FreeBSD?

[JavaUser]

Because, I used to use OpenBSD and I liked it. I'll either stick with Linux, or switch to OpenBSD.

Right now, Linux has great Java support out of the box and it's easy to use and it has well-integrated disk encryption, so I'll stick with it.

It would be great to have the most stable and secure platform (OpenBSD) able to run the current leading web technology (Java) but it's not yet 100% ready for prime time, it seems like.

[jggimi]

I carry an OpenBSD laptop with an encrypted filesystem for private information. I do not have a need for a completely encrypted hard drive; only a user directory hierarchy requires protection.

Both the encrypted filesystem and the passwords in /etc/master.passwd are protected by Bruce Schneier's well-respected Blowfish cipher.

Other OpenBSD platforms I manage have physical security.