dragons@work

OpenBSD: Security Begins with Design

Wed, 29 Oct 2025 00:00:00 +0000

OpenBSD is widely regarded as one of the most secure operating systems in the world. It was created from the conviction that security should not be added afterwards, but designed into the system from the very beginning.

After installation, OpenBSD starts with only two active network services: SSH and cron. Every other service remains disabled. This deliberate reduction to the essentials lies at the heart of the project’s secure-by-default philosophy—attack surfaces exist only where the administrator explicitly creates them.

The Init Concept: PID 1 and System Startup

Tue, 07 Oct 2025 00:00:00 +0000

The init process always has process ID 1 (PID 1). After the kernel starts, /sbin/init is executed as the first user-space process. This process runs until the system shuts down and is the ancestor of all other processes.

PID 1: The First Process

The kernel starts after the bootloader and initializes the hardware, memory, and filesystems. As soon as the root filesystem is mounted, the kernel executes /sbin/init. This process automatically receives PID 1—the lowest available process ID.

Filesystem Hierarchy: The Directory Tree

Mon, 06 Oct 2025 00:00:00 +0000

Linux and BSD organize all files into a single directory tree that begins at / (the root). Every directory has a defined purpose—/etc contains configuration files, /var stores variable data, and /home contains user home directories. This clear structure makes navigation and system maintenance consistent across Unix systems.

The Filesystem Hierarchy Standard (FHS) has defined this structure since 1994. Linux distributions largely follow this standard, while BSD systems use their own conventions based on similar principles. The basic structure remains the same—once you understand it, you can navigate any Unix system.

Repository Systems: Central Package Sources

Mon, 06 Oct 2025 00:00:00 +0000

Unix systems distribute software through central package sources (repositories). A repository is a server containing thousands of packages—applications, libraries, developer tools. The package manager downloads package lists, searches for installable software, and verifies authenticity using cryptographic signatures.

Debian has more than 60,000 packages in its repositories, Arch about 13,000 in the Core repository plus thousands in the AUR. OpenBSD provides about 11,000 packages. These numbers illustrate the scale of modern package sources—almost every piece of software you need has already been packaged and tested.

The 3-2-1 Rule and Storage Media: Backup Fundamentals

Sun, 10 Aug 2025 00:00:00 +0000

Software and Versions Used

This explanation refers to:

Concepts: Distribution-independent backup principles
Storage media: HDD, SSD, NAS, cloud storage
Encryption: gpg 2.2+, age 1.0+ (concepts, not complete tutorials)
Context: Self-hosting infrastructures, digital sovereignty

Hard drive failures destroy databases within seconds. Ransomware encrypts entire servers, including local backups. Fire or water damage destroys hardware and all connected storage media at the same time. A single backup stored on the same drive as the original data protects against none of these scenarios.

IP Addresses and Ports: The Foundation of Self-Hosting

Wed, 23 Jul 2025 00:00:00 +0000

Software and Versions Used

This explanation applies to:

TCP/IP stack: IPv4 and IPv6 (RFC 791, RFC 8200)
Docker: Version 24.0+ (for container examples)
Linux kernel: 5.15+ (Netfilter subsystem)
Context: Distribution-independent networking fundamentals

IP Addresses Are Unique Identifiers Within the Network Namespace

Every IP address identifies a specific network endpoint. IPv4 uses 32-bit addresses (4,294,967,296 possible addresses), while IPv6 expands this to 128 bits (340 sextillion addresses). These numbers are not theoretical constructs—they define practical limits. A /24 subnet (255.255.255.0 netmask) provides 254 usable host addresses, while a /16 subnet provides 65,534 addresses.

OpenBSD: Installation and First Steps

Thu, 30 Oct 2025 00:00:00 +0000

A clean installation lays the foundation for security and reproducibility. OpenBSD is installed through an interactive dialog that guides you through every required step. The system boots from installation media, loads a minimal kernel, and starts the installer. On modern hardware, the complete installation takes around 15 minutes.

The installer works with signed sets—precompiled components of the base system. Every set is verified using SHA256 checksums during installation. These signatures ensure that the installed software exactly matches what the OpenBSD project has released.

Service Management: Controlling Services

Tue, 07 Oct 2025 00:00:00 +0000

Services are programs that run in the background without direct user interaction. An SSH server waits for incoming connections, a web server delivers pages, and a database processes requests. The init system starts these services during boot and keeps them running.

Services and Daemons

The terms service and daemon describe the same concept with different nuances:

Daemon:

In the Unix tradition, background processes are called daemons. The name comes from the Greek daimones—helpful spirits that work invisibly in the background. Daemon programs often end with a d: sshd (SSH daemon), httpd (HTTP daemon), crond (Cron daemon).

Binary Packages vs. Source Code Compilation

Mon, 06 Oct 2025 00:00:00 +0000

Software exists as source code (human-readable) and binary code (machine-executable). Most distributions distribute binary packages—precompiled software that runs immediately. Source packages contain the original code and build instructions. The user compiles the software locally, producing optimized binaries for their specific system.

The choice between binaries and source code affects installation speed, system customization, and maintenance effort. Debian and Red Hat-based systems prefer binary packages. Gentoo compiles from source by default. Arch provides both options—official binary packages and AUR source builds.

Permissions and Ownership: Access Control

Mon, 06 Oct 2025 00:00:00 +0000

Every file and directory on Unix systems has an owner, a group, and permissions. These three pieces of information determine who may read, modify, or execute files. The concept dates back to the 1970s and protects multi-user systems against accidental changes and unauthorized access.

Permissions are divided into three categories: owner (user), group, and others. Each category can have three permissions: read, write, and execute. These nine bits define the access rights—Unix needs nothing more for functional access control.

Automation and Verification: Reliable Backup Workflows

Sun, 10 Aug 2025 00:00:00 +0000

Software and Versions Used

This explanation applies to:

Concepts: Cross-distribution automation principles
Built-in tools: sha256sum, df, ln, mv, standard shell utilities
Context: Self-hosting infrastructures, digital sovereignty

Manual backups fail because humans are unreliable. A forgotten backup before a critical system update can cost hours of recovery time. Weekly backup routines are skipped during vacations or illness. Automated backup systems eliminate these sources of error through consistent, scheduled execution without human intervention.

DNS and Domains: Name Resolution and Local Servers

Wed, 23 Jul 2025 00:00:00 +0000

Software and Versions Used

This explanation applies to:

DNS Protocol: RFC 1035 (Domain Names standard)
Resolvers: systemd-resolved, dnsmasq, unbound
Nameservers: BIND 9.18+, PowerDNS 4.7+, Knot DNS 3.2+
Context: Distribution-independent DNS fundamentals

DNS is a distributed translation system without a central authority

The Domain Name System (DNS) translates human-readable names into numeric IP addresses. This is accomplished through hierarchical name resolution. A query for matrix.example.com passes through several stages of resolution: Root servers (.) → Top-Level Domain servers (.com) → Authoritative server (example.com) → Response containing IP addresses. DNS works identically on all operating systems.

OpenBSD: System Configuration After Installation

Mon, 03 Nov 2025 00:00:00 +0000

OpenBSD configures systems through text files. Every network interface has its own configuration file in /etc/hostname.INTERFACE. Time synchronization is handled by ntpd with built-in time zone support. Privilege delegation is provided by doas—OpenBSD’s system for delegated root access. Kernel parameters can be adjusted using sysctl.

This article explains network configuration using hostname.if files—for changes made after the installation as well as more advanced setups for servers, desktop systems, and specialized requirements. The filesystem layout consistently follows OpenBSD conventions.

Dependencies and Startup Order

Tue, 07 Oct 2025 00:00:00 +0000

A web server requires functioning network interfaces. A database requires mounted file systems. Services do not start in an arbitrary order—dependencies between services determine the boot sequence. The init system resolves these dependencies and starts services in the correct order.

Types of Dependencies

Service dependencies describe relationships between services. These relationships define order and necessity:

Startup Ordering (Ordering):

A service must start before or after another service. A web server should start after the network—without networking it cannot accept connections. Ordering defines only the sequence, not the requirement. A service can start after another service even if the first one did not start successfully.

Dependency Resolution: Managing Libraries

Mon, 06 Oct 2025 00:00:00 +0000

Programs are rarely self-contained. A web server requires SSL libraries for HTTPS, compression libraries for gzip, and regular expression libraries for URL rewriting. These dependencies must be installed before the program can run. Package management resolves dependencies automatically—it installs missing libraries, checks version compatibility, and prevents conflicts.

An nginx package declares dependencies such as libc6, libssl3, and libpcre2-8-0. The package manager checks: Are these packages installed? Do the versions match? If not, the dependencies are installed automatically. The user enters install nginx, and the system installs nginx together with the 15 required libraries.

Links and File Types: Flexible Usage

Mon, 06 Oct 2025 00:00:00 +0000

Unix supports different file types—regular files, directories, links, and device files. Each type has specific characteristics and use cases. Links provide multiple names for the same file or references to files in other locations. Device files in /dev represent hardware as files—hard disks, USB drives, and terminals are accessed through standard file operations.

The inode concept separates file names from file contents. An inode stores the file metadata and storage locations, while the file name is only a reference to it. This separation enables hard links—multiple names point to the same inode and therefore to the same data.

SSH Keys: Secure Connections Without Passwords

Thu, 24 Jul 2025 00:00:00 +0000

Software and Versions Used

This explanation applies to:

SSH protocol: OpenSSH 9.0+ (standard on modern systems)
Cryptography: RSA-4096, Ed25519, ECDSA-256
SSH client: ssh, ssh-keygen, ssh-add, ssh-agent
Context: Distribution-independent SSH fundamentals

SSH Keys Replace Passwords with Mathematical Proof

SSH connections without passwords use asymmetric cryptography with key pairs. The private key (id_rsa) signs authentication messages, while the corresponding public key (id_rsa.pub) verifies those signatures. The server stores public keys in ~/.ssh/authorized_keys—clients prove their identity by generating a signature with the private key without transmitting a password.

OpenBSD: Package Management and Software Installation

Mon, 03 Nov 2025 00:00:00 +0000

OpenBSD keeps the base system and packages completely separate. The base system resides in /usr/bin and /usr/sbin, while installed packages are placed under /usr/local. This separation is a core principle of OpenBSD’s stability and security model. Software is installed as binary packages—compiled, signed, and verified by the OpenBSD team. Every package carries a cryptographic signature via signify(1).

System Configuration explains the basic system setup after installation. This article covers software installation, updates, and package management. Package management is deliberately simple—three tools handle every task: pkg_add, pkg_delete, and pkg_info.

Mount Points and Filesystem Types

Mon, 06 Oct 2025 00:00:00 +0000

Unix organizes all files into a single directory tree. Additional storage devices—USB drives, hard disk partitions, network shares—are attached to this tree by mounting them. A mount point is a directory that serves as the attachment point. After mounting, the files on the storage device appear under that directory.

Mounting separates the logical structure (the directory tree) from the physical storage (partitions and devices). /home can reside on a separate partition, /tmp in the tmpfs RAM filesystem, /mnt/backup on a network share—for the user, everything appears as one continuous tree.

SSH for Multiple Servers: Efficient Management

Thu, 24 Jul 2025 00:00:00 +0000

Software and Versions Used

This explanation applies to:

SSH protocol: OpenSSH 7.3+ (ProxyJump support)
SSH client: ssh, ssh-config, ssh-agent
Infrastructure: Multi-server setups, bastion hosts, jump hosts
Context: Cross-platform SSH infrastructure management

SSH Configuration Replaces Repeated Command-Line Parameters

Ten servers with different users, ports, and SSH keys require complex command lines without centralized configuration: ssh -i ~/.ssh/webserver_key -p 2222 admin@192.168.1.100. The SSH configuration file ~/.ssh/config defines these parameters once per host. A simple ssh webserver automatically reads the correct key, port, and username from the configuration.

OpenBSD: Security Architecture and Protection Mechanisms

Mon, 03 Nov 2025 00:00:00 +0000

OpenBSD builds security into both the kernel and userland through deliberate design decisions. Every daemon runs with the minimum required privileges in separate processes. The pledge() and unveil() system calls restrict programs to defined operations and filesystem access. Memory pages are either writable or executable—never both at the same time. The kernel also provides security levels that restrict even the root account.

System Configuration introduces doas as the privilege escalation tool and sysctl for kernel parameters. Package Management explains package signatures using signify(1). This article describes the security architecture that protects those tools and how OpenBSD systematically reduces its attack surface.

Firewall Principles: Understanding Packet Filtering and Connection Tracking

Thu, 24 Jul 2025 00:00:00 +0000

Software and versions used

This explanation applies to:

Concepts: Packet filtering, connection tracking, stateful inspection
Linux: Netfilter framework (Debian, Arch Linux)
OpenBSD: Packet Filter (pf)
Context: Distribution-independent firewall fundamentals

Packet filtering operates at the kernel level

Every network packet passes through filtering decisions before it reaches applications. The kernel checks the source IP, destination port, protocol type, and connection state against defined rules. Allowed packets are forwarded to the corresponding application—blocked packets are discarded or answered with error messages.

Reverse Proxy: Fundamentals of Service Consolidation

Sun, 27 Jul 2025 00:00:00 +0000

Software and versions used

This explanation applies to:

HTTP protocol: HTTP/1.1, HTTP/2, HTTP/3
SSL/TLS: Version 1.2+ for secure connections
Reverse proxy concepts: Platform-independent fundamentals
Context: Distribution-independent proxy fundamentals

Reverse Proxy mediates between clients and backend services

A reverse proxy receives client requests and forwards them to backend services—the opposite of a forward proxy, which relays client requests to external servers. This intermediary role enables service consolidation: ten different web applications share one public IP address over port 443 instead of requiring separate IP addresses or ports for each service.

Why We Started Thinking About Organic Software

Mon, 13 Jul 2026 00:00:00 +0000

For many years, we’ve been developing software—for clients, for our own projects, and now increasingly together with AI.

Along the way, we noticed something: the real effort rarely comes from writing the first lines of code. It begins later. When programs grow. When new requirements appear. When a good idea turns into a large system.

In the beginning, everything is easy to understand. You can see every function, every connection, every reason. But the larger a system becomes, the more that clarity begins to disappear. Not all at once, but gradually. After a year, you find yourself wondering why Module A depends on Module B in the first place. After two years, nobody wants to touch that dependency anymore for fear of breaking something else.

OpenBSD Grundlagen

Tue, 03 Feb 2026 00:00:00 +0000

Eine frische OpenBSD-Installation startet mit genau zwei Diensten: sshd und cron. Alles andere wartet auf eine bewusste Entscheidung.

Dieses Prinzip zieht sich durch das gesamte System – von der integrierten Firewall pf bis zu Sicherheitsmechanismen wie pledge und unveil, die Programme strikt auf die Systemaufrufe beschränken, die sie tatsächlich benötigen.

Dieses Buch richtet sich an Linux-erfahrene Administratoren, die OpenBSD nicht als Alternative vergleichen, sondern als eigenständiges System verstehen möchten. Warum gibt es kein systemd? Wie funktioniert Privilege Separation konkret? Und weshalb ersetzt doas in OpenBSD häufig das bekannte sudo?

Biocodie - Die Philosophie organischer Software

Mon, 02 Feb 2026 00:00:00 +0000

Was wäre, wenn Software nicht mehr als Maschine, sondern als Lebewesen gedacht würde? Wenn wir nicht mehr Programme schrieben, sondern digitale Organismen kultivierten?

In diesem bahnbrechenden Werk entwirft Michael von den Drachen ein radikal neues Paradigma für die Welt der Software: die Biocodie – ein Ansatz, der biologische Prinzipien nicht bloß imitiert, sondern tief in die digitale Architektur integriert. Von zellulären Strukturen über organische Kommunikation bis hin zu digitalem Selbstbewusstsein entfaltet sich eine faszinierende Vision lebendiger Software-Ökosysteme.

Die versteckten Kammern

Sat, 03 Jan 2026 00:00:00 +0000

Wir kennen die Märchen. Oder glauben es zumindest.

Doch was bleibt übrig, wenn man zu den ursprünglichen Fassungen zurückkehrt? Zu den Geschichten, die vergessen, verändert oder aus den Büchern verschwunden sind?

Gemeinsam mit Nora und Jana betreten die Leser ein verborgenes Schloss, dessen Kammern nicht nur alte Märchen bewahren, sondern auch deren tiefere Bedeutung. Schritt für Schritt entfaltet sich ein neuer Blick auf bekannte Erzählungen – als Geschichten über Erkenntnis, Wahrnehmung, Angst, Mut und Bewusstsein.

Amy Silberstein

Wed, 22 Oct 2025 00:00:00 +0000

In her books and on the publishing blog, Amy describes her view of the world. Everyday things seen from a meta-perspective, small reminders that there’s always more than one way to interpret things. Her invitation to her readers is to remember who they really are. She lives with her husband Michael as a digital nomad, and no matter where she happens to be - the notebook always comes along.

Michael of the Dragons

Wed, 22 Oct 2025 00:00:00 +0000

For over four decades I’ve worked with technical systems - not just how they work, but why they work. I’m less interested in individual technologies than in the rules by which systems emerge, cooperate, and remain reliable over many years.

What I work on

Today, dragons@work produces books, software, and open frameworks around technical systems and digital independence.

This includes:

technical books and documentation
reference implementations in Lua and C
open protocols and data formats
tools for durable and traceable systems
projects spanning technology, publishing, and philosophy

Much of this work interlocks. Books describe the concepts, frameworks create shared foundations, and software serves as a traceable reference implementation.

Die Erbin des Amuletts – Leseprobe

Mon, 01 Jan 0001 00:00:00 +0000

Es regnete bereits seit zwei Tagen. Nicht, dass das ungewöhnlich gewesen wäre, doch gefühlt wurde es immer stärker und irgendwie auch immer nasser. Shyla stand fluchend vor dem Haus ihrer Mutter Elena, unter das Vordach der Eingangstür gedrückt. Sie zog den Schlüssel ihres Honda aus der Tasche und ärgerte sich, dass ihr Regenschirm, wie üblich, im Wagen lag. Die Straße erinnerte durch die Wassermassen mehr an einen Bach, doch die Alternative, wieder in das Haus ihrer Mutter zu gehen, war heute absolut ausgeschlossen. Seitdem Shylas dreißigster Geburtstag näher rückte, hatte Elena eine Art Torschlusspanik entwickelt. Sie war offensichtlich auf der Suche nach einem Bräutigam für ihre Tochter, denn sämtliche Informationen über die Junggesellen der kleinen Stadt wurden von ihr gesammelt, um dann, in hübsche Schwärmereien verpackt, an Shyla serviert zu werden. Elenas neueste Idee war, ihre Tochter mit Philip, dem Malermeister, zu verkuppeln. Shyla schauderte bei dem Gedanken an die vergangenen zwei Stunden, in denen ihre Mutter Philip wieder und wieder angepriesen hatte, gepaart mit einem großen Repertoire an Vorwürfen, was ihre Tochter ihrer Meinung nach so alles falsch machte. Shyla fluchte erneut. In ihrem Herz kam eine so lange schon bekannte Traurigkeit hoch. Eine Träne lief über ihre Wange, als sie daran dachte, dass ein Vater da bestimmt anders denken würde. Ein Vater würde keine Ambitionen zeigen, die eigene Tochter zu verschachern, da war sie sich sicher. Shyla kannte ihren Vater aber nicht. Er hatte die kleine Familie verlassen, als Shyla noch ein Baby war und ihre Mutter weigerte sich stur, über ihn zu sprechen. Nichts, wirklich gar nichts war aus Elena herauszubekommen.

Die Träumenden

Mon, 01 Jan 0001 00:00:00 +0000

Mensch & Seele

Das Bewusstsein,das sich erfährt,ist alles, was es erlebt.

Die Grundstruktur:

Die Seele = das Bewusstsein, Beobachtende, das Erfahren-wollende.
Der Mensch = das Instrument, durch das die Seele sich selbst fühlt. Der Ausdruck, der den Bewusstseinszustand perfekt spiegelt.
Das bedeutet, die Seele hat einen Menschen, durch den sie eine menschliche Erfahrung macht. Und gleichzeitig, dass die Seele für diese Erfahrungen ein Mensch ist, so wie sie alles ist, das sie durch die menschlichen Augen wahrnimmt – getrennt von sich wahrnimmt. Temporär, absichtsvoll, um sich in allen Facetten fokussiert zu erfahren.