logo

6.4 Updated!

December 03, 2018, proudly hosted by ARP Networks. Follow me on Twitter.

history

Forked from NetBSD. Theo de Raadt is the founder and leader of the OpenBSD project. The first OpenBSD release 1.1/CVS appear on October 18, 1995.

why use openbsd

openbsd innovations

Software and ideas developed or maintained by the OpenBSD project: http://www.openbsd.org/innovations.html

openbsd version numbers

  • Biannual release cycle
  • New release is incremented by 0.1

openbsd's flavors

  • -release, shipped every six months
  • -stable, release, plus patches (support for 6.3 & 6.4)
  • -current, development branch

cvs repository

http://cvsweb.openbsd.org

manual pages

http://man.openbsd.org

installation

Really simple, ready in 5 minutes (KISS). A response file is emailed to the root user on next boot.

Get more information: http://www.openbsd.org/faq/faq4.html

auto-install

Use autoinstall(8) or you can try upobsd package for a full unattended install/upgrade process.

networking files

/etc/myname Default hostname
/etc/mygate Default gateway
/etc/hosts Known hosts on the network
/etc/resolv.conf Resolver (DNS)
/etc/hostname.if Configuration for each network interface, for example: /etc/hostname.bge0
Read: myname(5) hostname.if(5) resolv.conf(5) hosts(5)

networking


            # Display the current configuration of network interfaces
            ifconfig

            # Set DHCP for 're0' interface, on the fly
            dhclient re0

            # Perform network (re)initialisation
            sh /etc/netstart

          

Networking (set at startup)

Example 1: configure static IP address for re0


            ## file: /etc/hostname.re0
            inet 192.168.0.58 255.255.255.0
            
          
Don't forget to run sh /etc/netstart re0 to apply changes to running system.

Networking (set at startup)

Example 2: configure DHCP for bge0


            ## file: /etc/hostname.bge0
            dhcp

          
Don't forget to run sh /etc/netstart bge0 to apply changes to running system.

Networking (set at startup)

Example 3: configure wireless


            # First, see a list of available wireless networks: 
            ifconfig iwn0 scan

          

            ## file: /etc/hostname.iwn0
            nwid ACCESS_POINT_NAME wpakey THE_SECRET_KEY
            dhcp

            # Or, for multiple access points
            join AT_HOME wpakey THE_SECRET_KEY
            join AT_WORK wpakey THE_SECRETKEY
            dhcp

          
Don't forget to run sh /etc/netstart iwn0 to apply changes to running system.

routing


            # Show the routing table (ipv4)
            route -n show -inet

            # Show the routing table (ipv6)
            route -n show -inet6

            # Delete all gateway entries from the routing table
            route -n flush

          

PF ruleset sample


            ## file: /etc/pf.conf
            # Protect a laptop (allow only ping/ssh from anywhere)

            set skip on lo
            set fingerprints "/dev/null"
            block log all
            pass in on egress inet proto icmp all icmp-type echoreq
            pass in on egress inet proto tcp from any to any port ssh
            pass out

          
Read: pf.conf(5)

PF (Packet Filter)

(Useful commands)


            # Disable PF
            pfctl -d

            # Enable PF and load the rules
            pfctl -ef /etc/pf.conf

            # Just load the rules (apply changes)
            pfctl -f /etc/pf.conf

            # View the loaded rules
            pfctl -s rules

          
Read: pfctl(8)

Debug PF with tcpdump


            tcpdump -nettti pflog0

          
Read: tcpdump(8)

PF User's Guide

http://www.openbsd.org/faq/pf

Manage users


          # Manually
          user [add|del|info|mod] foobar

          # Add users interactively
          adduser

          # Remove users interactively
          rmuser

          
Read: adduser(8)

Manage Groups

File: /etc/group


            group [add|del|info|mod] foobar

          
Members in wheel group can use su(1) to become root.
Read: group(8), group(5)

sudo replaced with doas(1)


            ## file: /etc/doas.conf
            # Permit the user 'Marc' to reboot the box
            permit nopass marc as root cmd /sbin/reboot

          

            # Marc can now reboot the box
            $ doas reboot

          
Read: doas(1), doas.conf(5)
Try doas mastery website.

Install Packages


            # By default, the /etc/installurl file already contains an OpenBSD mirror server URL
            https://cdn.openbsd.org/pub/OpenBSD
            
            # For example, to install Package Manager
            pkg_add pkg_mgr

          
Look in /usr/local/share/doc/pkg-readmes for extra documentation.
Read: pkg_add(1), installurl(5)

Packages


            # List packages installed
            pkg_info

            # Show the files within each package
            pkg_info -L foobar

            # View install-message for a specific package
            pkg_info -M foobar

          
Read: pkg_info(1), packages(7)

Packages (continued)


            # Delete a Package
            pkg_delete foobar

            # Show unused dependencies
            pkg_delete -an

            # Delete unused dependencies
            pkg_delete -a

            # Delete all except 'nginx'
            pkg_delete -X nginx

          
Read: pkg_delete(1)

Install non-free firmware packages


            fw_update

          
Firmware is downloaded from release-specific directories at: http://firmware.openbsd.org/firmware
Read: fw_update(1)

Manage daemons, services

File: /etc/rc.conf.local


            rcctl [enable|disable|start|stop|reload|restart] foobar

            # For example, to start the apmd(8) daemon for CPU scaling, you might do
            rcctl enable apmd
            rcctl set apmd flags -A
            rcctl start apmd

            # For example, tune ntpd(8) to try to set the time immediately at startup
            rcctl enable ntpd
            rcctl set ntpd flags -s
            rcctl restart ntpd

          
Read: rcctl(8)

Run a script at startup

File: /etc/rc.local

Read: rc.local(8)

Update OpenBSD (-stable)

Any security or reliability fixes can be found at:
http://www.openbsd.org/errata.html

Errata patches are generated for the 2 last releases (6.3, 6.4).

Update OpenBSD (-stable), the tools

Use syspatch(8) to update your kernel and userland, available for the last 2 release. You can also use the openup tool from M:tier to update packages and the base system.

Upgrade OpenBSD

To upgrade 6.2 to 6.4, you need to follow instructions:

http://www.openbsd.org/faq/upgrade63.html
and then
http://www.openbsd.org/faq/upgrade64.html

OpenBSD Filesystem

The most important

/ Root directory
/home User home directories
/root Default home directory for the superuser
/mnt A temporary mount point

OpenBSD Filesystem (continued)

/etc System configuration files and scripts
/etc/examples Example configuration files for base system daemons
/etc/skel (dot) files for new accounts
/etc/signify Key files used for signify(1)

OpenBSD Filesystem (continued)

/tmp Cleaned after a reboot
/var/tmp Symbolic link to the system /tmp
/var/log Log files
/var/run pid, socket files, utmp, dmesg.boot

OpenBSD Filesystem (continued)

/var/db Database files
/var/www Configuration files for httpd(8)
/var/www/htdocs Web repository for httpd(8)
/usr/local Used for third packages installed
/usr/src BSD and/or local source files
Read: hier(7)

OpenBSD Kernels

/bsd
Pure kernel executable (the operating system loaded into memory at boot-time).

OpenBSD Kernels (continued)

/bsd.booted
Pure kernel executable, a resume from hibernation (handled by the bootloader).

OpenBSD Kernels

/obsd
Old kernel, next boot it will use the new kernel /bsd (kernel relinking).

OpenBSD Kernels (continued)

/bsd.sp
Pure kernel executable for single processor.

OpenBSD Kernels (continued)

/bsd.mp
Pure kernel executable for multiprocessor machines.

OpenBSD Kernels (continued)

/bsd.rd
Installation kernel. The built-in RAM disk contains utilities which can be run without an external file system, so this kernel is useful for limited system maintenance too.

Tune the system

sysctl(8) get or set kernel state
config(8) modify a kernel

Setting laptop hibernation (sysctl)

machdep.lidaction=0 do nothing
machdep.lidaction=1 suspend
machdep.lidaction=2 hibernate

Maintenance

pkg_check -F Check the filesystem for random objects
dmesg -s Review rc(8) system startup messages
ldd foobar List dynamic object dependencies
df -h See disk usage
top -s .1 Check load (cpu/mem)
Read: pkg_check(8), dmesg(8), ldd(1), ld.so(1), df(1), top(1)

Some useful packages

screenfetch Display system information in the terminal
w3m Text-based web browser
pstree List processes as a tree
tmate Share your terminal on the web without open any ports
testdisk Scan and repair disk partitions

Presentations & Papers

http://www.openbsd.org/events.html

Need more help

FAQ: http://www.openbsd.org/faq/
Manual page: afterboot(8)
IRC Channel: #openbsd
Mailing list: misc@

Supporting OpenBSD

Donations

OpenBSD Foundation

OpenBSD Store

** Bonus

Join us on Telegram!

** Gift!

Visit our HowTo section!

Thank you.

Feedback: contact@