I find the implementation very compelling too - it uses kernel support. That really simplifies an otherwise very complicated and security-sensitive code path.
I just locked myself out of an OpenBSD 6.0 box by putting the 'persist' keyword in doas.conf.
doas: syntax error at line 1
The word 'persist' does not occur in 'man doas.conf', so maybe this feature is so new it is not in OpenBSD 6.0? Watch out before you try it out yourself.
This option only got added in recently. I think it would have been better if this were pointed out in the post. But trying not to sound too snide there's something to be said for checking the man page before copying config off the internet.
Sure, it was my mistake on two counts (not keeping a root session AND blindly changing the config). That does not necessarily mean I am alone in making that mistake so I thought I would try to warn others.
Might want to use the technique in this excerpt from the article in the future before saving doas.conf to /etc. I typically work on my /etc files in a scratch directory and then mv them into /etc
> doas
> The doas command itself has a few options.
> Since we just finished looking at the config file syntax, the -C option can be used to syntax check a new file before installing.
Hope the portable OpenDoas version will implement this feature soon. I'm slowly replacing parts of my Void Linux server with more and more OpenBSD utilities, and have probably already added enough that RMS would conciser giving the system it's own name
There is no official portable versions, and any of the current unofficial versions include their own PAM implementations (OpenBSD doesn't use PAM).
Now that OpenBSD doas(1) uses kernel assisted features, i.e: 'persist' is implemented as tty ioctl's, the likelihood of those landing on other systems is remote.
15 comments
[ 3570 ms ] story [ 366 ms ] threaddoas: syntax error at line 1
The word 'persist' does not occur in 'man doas.conf', so maybe this feature is so new it is not in OpenBSD 6.0? Watch out before you try it out yourself.
> doas
> The doas command itself has a few options.
> Since we just finished looking at the config file syntax, the -C option can be used to syntax check a new file before installing.
Naive Q: Is doas any better than envgiduid and envdir? And if so, how?
Now that OpenBSD doas(1) uses kernel assisted features, i.e: 'persist' is implemented as tty ioctl's, the likelihood of those landing on other systems is remote.
I expected better from an article that's been published after the 6.0 release.