OpenBSD Fundamentals – From System Architecture to Daily Operation

The System as a Whole

OpenBSD is a Unix operating system whose components are developed together and released as an integrated system. The Base System includes the kernel, system utilities, libraries, and configuration as well as network services such as httpd, smtpd, relayd, and ntpd. Additional software is installed separately as packages.

Security mechanisms are part of this system architecture. Services that are not needed are disabled by default. Many programs use Privilege Separation to divide tasks among multiple processes. pledge(2) limits the system operations available to a process, while unveil(2) can restrict its view of the file system. W^X separates writable and executable memory.

The individual areas of the system do not exist in isolation. Services run with specific privileges, access files, use network interfaces, and are controlled through system configuration. Anyone administering OpenBSD therefore encounters the same components repeatedly in different contexts.

From the Installed System to Daily Operation

The installation already determines parts of the later system, including disk layout, network configuration, and the installed sets. Afterward, the installed system is configured step by step for its intended purpose.

This includes local system configuration, additional packages, users and permissions, networking and routing, packet filtering, and finally the services the system is intended to provide. Maintenance and updates accompany ongoing operation.

These individual areas interact with one another. Network configuration provides interfaces and addresses through which a service can be reachable. Routing determines which paths packets can take. PF can filter traffic and influence its routing. A service, in turn, runs with specific privileges and uses its configuration and files.

Prior Knowledge and Terminology

We explain general Unix fundamentals where they are necessary for the respective context. Topics that extend beyond OpenBSD are covered in more detail in separate fundamentals articles when needed.

This allows us to explain relationships without overloading every article with general fundamentals or simply assuming unfamiliar terminology.

OpenBSD Fundamentals at a Glance

System Fundamentals

OpenBSD Introduction: Security Begins with Design

The introduction examines OpenBSD as a system: its origins, fundamental design decisions, and the role of security within the project.

Read Article

Installation and First Steps: Setting Up the System

Installation of the Base System, disk layout, network configuration, selection of sets, and the first steps in the installed system.

Read Article

Configuration and Administration

System Configuration: Network, Time, Permissions

Basic system configuration using the designated files and tools – from networking and time to permissions and local adjustments.

Read Article

Package Management: pkg_add, Updates, Ports

Install, update, and remove additional software and understand how packages, package tools, and ports work together.

Read Article

Security and Networking

Security Architecture: pledge, unveil, W^X

OpenBSD security mechanisms and how they work together – including Privilege Separation, pledge(2), unveil(2), W^X, and additional protection mechanisms.

Read Article

Networking and Routing: Interfaces, IPv6, dhcpd

Configure interfaces and addresses, understand routing, and learn about the tools OpenBSD uses to configure and examine networks.

Read Article

Firewall with PF

Firewall Fundamentals: PF and Filter Rules

Fundamentals of the Packet Filter, the structure of pf.conf, rules and states, and the interaction between PF and the network stack.

Coming soon

NAT and Port Forwarding with PF

Address translation and forwarding with PF and their place within packet flow, filtering, and routing.

Coming soon

PF: Advanced Concepts

Advanced PF capabilities such as tables and anchors and their use in more extensive rulesets.

Coming soon

Services and Operation

Services and Daemons: httpd, smtpd, relayd

Base System services, their configuration, and their interaction with networking, privileges, and the rest of the system.

Coming soon

Users and Automation: Administration, cron, rc Scripts

Manage users and groups, assign permissions, control services, and automate recurring tasks.

Coming soon

Virtualization and Maintenance

Virtualization with vmm

Set up virtual machines with vmm(4), vmd(8), and vmctl(8) and place them within the networking and operation of the host system.

Coming soon

Backups and Maintenance

Backups, updates, and regular maintenance of a running OpenBSD system.

Coming soon

Related Fundamentals

Some topics extend beyond OpenBSD or are covered in more detail elsewhere:

• Network Fundamentals: TCP/IP concepts and relationships that are not tied to a specific operating system (online)
• Backup Strategies: Fundamentals for planning backups (online)