OpenBSD Jumpstart: Learn to Tame OpenBSD Quickly
Very nice, here&#x27;s the plain text version instead of slide format.<p>Learn to tame OpenBSD quickly.<p>December 24, 2015<p>History<p>Forked from NetBSD. Theo De Raadt is the founder and leader of the OpenBSD project. The first OpenBSD release (1.1&#x2F;CVS) appear on October 18, 1995.<p>Why use OpenBSD ?<p><pre><code>    UNIX-like
    Get the last version of OpenSSH, OpenSMTPD, OpenNTPD, OpenBGPD, OpenOSPFD, LibreSSL
    Get the last PF (Packet Filter) features
    Security focused Operating System
    Thorough documentation
    Cryptography

</code></pre>
Forked from NetBSD. Theo De Raadt is the founder and leader of the OpenBSD project. The first OpenBSD release (1.1&#x2F;CVS) appear on October 18, 1995.<p>OpenBSD Version numbers<p><pre><code>    Six month release cycle
    New release is incremented by 0.1

</code></pre>
OpenBSD&#x27;s Flavors<p><pre><code>    -release: The version of OpenBSD shipped every six months
    -current: Development just after the release
    -stable: Release, plus patches (support ~ 1 year)

</code></pre>
Installation<p>Really simple, ready in 5 minutes (KISS).<p>Get more information: <a href="http:&#x2F;&#x2F;www.openbsd.org&#x2F;faq&#x2F;faq4.html" rel="nofollow">http:&#x2F;&#x2F;www.openbsd.org&#x2F;faq&#x2F;faq4.html</a><p>Networking (Files)<p><pre><code>  File 	Contain
  &#x2F;etc&#x2F;myname 	Default hostname.
  &#x2F;etc&#x2F;hostname.if 	Configuration for each network interface, for example: &#x2F;etc&#x2F;hostname.bge0
  &#x2F;etc&#x2F;mygate 	Default gateway.
  &#x2F;etc&#x2F;resolv.conf 	Resolver (DNS).
  &#x2F;etc&#x2F;hosts 	Known hosts on the network.
</code></pre>
Networking<p><pre><code>  # See available network cards:
  &#x2F;sbin&#x2F;ifconfig
  
  # Restart networking service:
  &#x2F;bin&#x2F;sh &#x2F;etc&#x2F;netstart
  
  # Set DHCP for &#x27;re0&#x27; interface, on the fly:
  &#x2F;sbin&#x2F;dhclient re0

</code></pre>
Networking (Routing)<p><pre><code>  # Show the routing table (ipv4):
  &#x2F;usr&#x2F;bin&#x2F;netstat -rnf inet
  
  # Show the routing table (ipv6):
  &#x2F;usr&#x2F;bin&#x2F;netstat -rnf inet6
  
  # Delete all gateway entries from the routing table:
  &#x2F;sbin&#x2F;route -n flush

</code></pre>
Networking (set at startup)<p>Example 1: configure static IP address for re0.<p><pre><code>  ## file: &#x2F;etc&#x2F;hostname.re0
  inet 192.168.0.58 255.255.255.0
  
  # For more information, read the manual: hostname.if(5)
</code></pre>
Don&#x27;t forget to run &#x27;sh &#x2F;etc&#x2F;netstart re0&#x27; to apply changes to running system.<p>Example 2: configure DHCP for bge0.<p><pre><code>  ## file: &#x2F;etc&#x2F;hostname.bge0
  dhcp
  
  # For more information, read the manual: hostname.if(5)
</code></pre>
Don&#x27;t forget to run &#x27;sh &#x2F;etc&#x2F;netstart bge0&#x27; to apply changes to running system.<p>Example 3: configure wireless.<p><pre><code>  ## file: &#x2F;etc&#x2F;hostname.iwn0
  nwid ACCESS_POINT_NAME
  wpakey THE_SECRET_KEY
  dhcp
  
  # For more information, read the manual: hostname.if(5)
</code></pre>
Don&#x27;t forget to run &#x27;sh &#x2F;etc&#x2F;netstart iwn0&#x27; to apply changes to running system.<p>PF (Packet Filter)<p><pre><code>  Ruleset: &#x2F;etc&#x2F;pf.conf
</code></pre>
Useful commands.<p><pre><code>  # Disable PF
  &#x2F;sbin&#x2F;pfctl -d
  
  # Enable PF and load the rules
  &#x2F;sbin&#x2F;pfctl -ef &#x2F;etc&#x2F;pf.conf
  
  # Just load the rules (apply changes)
  &#x2F;sbin&#x2F;pfctl -f &#x2F;etc&#x2F;pf.conf
  
  # View the loaded rules
  &#x2F;sbin&#x2F;pfctl -s rules
</code></pre>
For more information, read the manual: pfctl(8)<p>Pf ruleset sample<p><pre><code>  ## file: &#x2F;etc&#x2F;pf.conf
  # Protect a laptop (allow only ping&#x2F;ssh from anywhere)
  set skip on lo
  set fingerprints &quot;&#x2F;dev&#x2F;null&quot;
  block log all
  pass in on egress inet proto icmp all icmp-type echoreq
  pass in on egress inet proto tcp from any to any port ssh
  pass out
  
  # For more information, read the manual: pf.conf(5)

</code></pre>
Debug PF with tcpdump(8)<p><pre><code>  &#x2F;usr&#x2F;sbin&#x2F;tcpdump -nettti pflog0

</code></pre>
Manage users<p>Manually<p><pre><code>  &#x2F;usr&#x2F;sbin&#x2F;user [add|del|info|mod] user_name
</code></pre>
The interactive way<p><pre><code>  # Add users
  &#x2F;usr&#x2F;sbin&#x2F;adduser  
  
  # Remove users
  &#x2F;usr&#x2F;sbin&#x2F;rmuser
</code></pre>
For more information, read the manual: adduser(8)<p>Manage Groups<p><pre><code>  File: &#x2F;etc&#x2F;group  
  
  &#x2F;usr&#x2F;sbin&#x2F;group [add|del|info|mod] group_name
</code></pre>
Members in &#x27;wheel&#x27; group can use su(1) to become &#x27;root&#x27;.<p>For more information, read the manual: group(8,5)<p>sudo replaced with doas(1)<p><pre><code>  ## file: &#x2F;etc&#x2F;doas.conf
  # Permit the user &#x27;Marc&#x27; to reboot the box
  permit nopass marc as root cmd reboot
</code></pre>
Marc can now reboot the box:<p><pre><code>  $ doas reboot
</code></pre>
For more information, read the manual: doas.conf(5)<p>Install Packages<p><pre><code>  export PKG_PATH=http:&#x2F;&#x2F;ftp.openbsd.org&#x2F;pub&#x2F;OpenBSD&#x2F;5.8&#x2F;packages&#x2F;amd64&#x2F;
  
  # OR use &#x27;installpath&#x27; variable in &#x2F;etc&#x2F;pkg.conf:
 installpath=http:&#x2F;&#x2F;ftp2.fr.openbsd.org&#x2F;pub&#x2F;OpenBSD&#x2F;%c&#x2F;packages&#x2F;%a&#x2F;

  # Add sudo package
  &#x2F;usr&#x2F;sbin&#x2F;pkg_add sudo
</code></pre>
Some packages provide configuration and other information in a file located in &#x27;&#x2F;usr&#x2F;local&#x2F;share&#x2F;doc&#x2F;pkg-readmes&#x27;.<p>For more information, read the manual: pkg.conf(5)<p>Packages<p><pre><code>  # List packages installed
  &#x2F;usr&#x2F;sbin&#x2F;pkg_info
  
  # View install-message for a specific package
  &#x2F;usr&#x2F;sbin&#x2F;pkg_info -M package_name
  
  # Remove a Package
  &#x2F;usr&#x2F;sbin&#x2F;pkg_delete package_name
  
  # Delete unused dependencies 
  &#x2F;usr&#x2F;sbin&#x2F;pkg_delete -a
</code></pre>
For more information, read the manual: packages(7)<p>Install non-free firmware packages<p><pre><code>  &#x2F;usr&#x2F;sbin&#x2F;fw_update
</code></pre>
Firmware is downloaded from release-specific directories at: <a href="http:&#x2F;&#x2F;firmware.openbsd.org&#x2F;firmware&#x2F;" rel="nofollow">http:&#x2F;&#x2F;firmware.openbsd.org&#x2F;firmware&#x2F;</a><p>Manage daemons, services<p><pre><code>  File: &#x2F;etc&#x2F;rc.conf.local
  
  &#x2F;usr&#x2F;sbin&#x2F;rcctl [enable|disable|start|stop|reload|restart] daemon_name
  
  # Examples
  &#x2F;usr&#x2F;sbin&#x2F;rcctl enable ipsec
  &#x2F;usr&#x2F;sbin&#x2F;rcctl enable isakmpd
  &#x2F;usr&#x2F;sbin&#x2F;rcctl set isakmpd flags -K
  &#x2F;usr&#x2F;sbin&#x2F;rcctl start isakmpd
</code></pre>
For more information, read the manual: rcctl(8)<p>Run a script at startup<p><pre><code>  File: &#x2F;etc&#x2F;rc.local
</code></pre>
For more information, read the manual: rc.local(8)<p>Update OpenBSD<p>Any security or reliability fixes can be found at:
<a href="http:&#x2F;&#x2F;www.openbsd.org&#x2F;errata.html" rel="nofollow">http:&#x2F;&#x2F;www.openbsd.org&#x2F;errata.html</a><p>You can also use the openup tool from M:tier<p>Upgrade OpenBSD<p>To upgrade 5.6 to 5.8, you need to follow instructions:<p><a href="http:&#x2F;&#x2F;www.openbsd.org&#x2F;faq&#x2F;upgrade57.html" rel="nofollow">http:&#x2F;&#x2F;www.openbsd.org&#x2F;faq&#x2F;upgrade57.html</a>
&amp;
<a href="http:&#x2F;&#x2F;www.openbsd.org&#x2F;faq&#x2F;upgrade58.html" rel="nofollow">http:&#x2F;&#x2F;www.openbsd.org&#x2F;faq&#x2F;upgrade58.html</a><p>OpenBSD Filesystem<p><pre><code>  The most important:
  &#x2F; 	Root directory.
  &#x2F;home 	User home directories.
  &#x2F;root 	Default home directory for the superuser.
  &#x2F;mnt 	A temporary mount point.
  &#x2F;etc 	System configuration files and scripts.
  &#x2F;etc&#x2F;examples 	Example configuration files for base system daemons.
  &#x2F;etc&#x2F;skel 	(dot) files for new accounts.
  &#x2F;etc&#x2F;signify 	Key files used for signify(1).
  &#x2F;tmp 	Cleaned after a reboot.
  &#x2F;var&#x2F;tmp 	Symbolic link to the system &#x2F;tmp.
  &#x2F;var&#x2F;log 	Log files.
  &#x2F;var&#x2F;run 	pid, socket files, utmp, dmesg.boot
  &#x2F;var&#x2F;db 	Database files.
  &#x2F;var&#x2F;www 	Configuration files for httpd(8).
  &#x2F;usr&#x2F;local 	Used for third packages installed.
  &#x2F;usr&#x2F;src 	BSD and&#x2F;or local source files.
</code></pre>
For more information, read the manual: hier(7)<p>OpenBSD Kernels<p><pre><code>  &#x2F;bsd
  Pure kernel executable (the operating system loaded into memory at boot-time).
  &#x2F;bsd.mp
  Pure kernel executable for multiprocessor machines.
  &#x2F;bsd.rd
  Installation kernel. The built-in RAM disk contains utilities which can be run without an external file system, so this kernel is useful for limited system maintenance too.

</code></pre>
Tune the system<p><pre><code>  sysctl(8) get or set kernel state
  config(8) modify a kernel
</code></pre>
Need more help ?<p><pre><code>  FAQ: http:&#x2F;&#x2F;www.openbsd.org&#x2F;faq&#x2F;
  Manual page: afterboot(8)
  Mailing list: misc@

</code></pre>
Presentations &amp; Papers<p><pre><code>  http:&#x2F;&#x2F;www.openbsd.org&#x2F;papers&#x2F;

</code></pre>
Supporting OpenBSD<p><pre><code>  Donations [1]
  
  OpenBSD Foundation [2]
  
  OpenBSD Store [3]
</code></pre>
Thank you.
Feedback: contact@<p>[1] <a href="http:&#x2F;&#x2F;www.openbsd.org&#x2F;donations.html" rel="nofollow">http:&#x2F;&#x2F;www.openbsd.org&#x2F;donations.html</a><p>[2] <a href="http:&#x2F;&#x2F;www.openbsdfoundation.org&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.openbsdfoundation.org&#x2F;</a><p>[3] <a href="http:&#x2F;&#x2F;www.openbsdstore.com&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.openbsdstore.com&#x2F;</a>