A clean installation lays the foundation for security and reproducibility. OpenBSD is installed through an interactive dialog that guides you through every required step. The system boots from installation media, loads a minimal kernel, and starts the installer. On modern hardware, the complete installation takes around 15 minutes.
The installer works with signed sets—precompiled components of the base system. Every set is verified using SHA256 checksums during installation. These signatures ensure that the installed software exactly matches what the OpenBSD project has released.
Download and Verification
OpenBSD publishes releases on openbsd.org and its mirror servers. For amd64 systems, install79.img is available for USB installation, while install79.iso is intended for CD/DVD media. The signature file is always named SHA256.sig, regardless of the release. When working with multiple versions, it is worth organizing downloads by release and architecture:
mkdir -p ~/iso/openbsd/7.9/amd64
cd ~/iso/openbsd/7.9/amd64
wget https://cdn.openbsd.org/pub/OpenBSD/7.9/amd64/install79.img
wget https://cdn.openbsd.org/pub/OpenBSD/7.9/amd64/SHA256.sig
wget https://cdn.openbsd.org/pub/OpenBSD/7.9/openbsd-79-base.pub
Every release is signed using signify, OpenBSD’s own signature verification tool. The SHA256.sig file contains the signed checksums for every release file.
$ signify -C -p openbsd-79-base.pub -x SHA256.sig install79.img
Signature Verified
install79.img: OK
signify tool is available on Linux through package managers (Arch: signify from the AUR, Debian: signify-openbsd). For initial testing, verifying the SHA256 checksum with sha256sum install79.img and comparing it manually with the checksum listed in SHA256.sig is also sufficient.
The public key /etc/signify/openbsd-79-base.pub is included with existing OpenBSD installations. For a first installation, it can be downloaded from the OpenBSD website. Verification fails if the image has been modified or if the signature does not match.
Creating the Installation Media
The install79.img image can be written directly to a USB flash drive:
# dd if=~/iso/openbsd/7.9/amd64/install79.img of=/dev/sdX bs=1M
dd command irreversibly overwrites every existing file on the target device. A typo in /dev/sdX can erase the wrong drive, so verify the device name carefully before executing the command.
The X represents the device identifier—for example /dev/sdb or /dev/sdc, depending on the system. The USB drive does not need to be formatted beforehand; the image already contains a complete partition table and the required filesystems.
Once the image has been written, the system can boot from the USB drive. The BIOS or UEFI firmware must support booting from USB. Most modern systems provide a boot menu via F12 or a similar key.
Boot Process and Starting the Installer
After booting, the boot loader loads /bsd.rd, the RAM disk kernel. This kernel contains the installer together with all required tools inside a temporary filesystem. Existing data remains untouched unless the installer explicitly mounts partitions.
The installer first displays the system console with the kernel boot messages. These messages list the detected hardware, including the processor, memory, storage devices, and network interfaces. They are particularly useful when diagnosing hardware problems, as missing drivers become visible here.
Figure: Installer startup showing hardware detection and installation options
Once the kernel has finished booting, the installer starts automatically and presents the available installation options:
- (I)nstall – Fresh installation (default)
- (U)pgrade – Upgrade an existing installation
- (A)utoinstall – Automatic installation using a configuration file
- (S)hell – A shell for manual repairs or experimentation
For a standard installation, enter I and press Enter.
Keyboard Layout
The first interactive prompt asks for the keyboard layout. Entering ? or L displays the list of available layouts.
Figure: Keyboard layout selection using de.nodead for technical work
German keyboards offer two variants:
- de – Uses dead keys (accent characters require two keystrokes)
- de.nodead – Direct access to backticks, circumflex, and tilde
de.nodead. Direct access to backticks and special characters makes terminal work and programming considerably more convenient.
System Hostname
The hostname identifies the system on the network. The installer asks for a short hostname without a domain—for example server or desktop. The fully qualified domain name (FQDN) is resolved later through DNS or /etc/hosts.
Network Configuration
The installer next asks for the network configuration. All detected network interfaces are listed—for example em0 for Intel network adapters or vio0 in virtual machines.
IPv4 can be configured automatically or assigned manually:
IPv4 address for vio0? (or 'autoconf' or 'none') [autoconf]
For automatic configuration using DHCP, simply press Enter. The installer creates:
/etc/hostname.em0:
inet autoconf
Static IP addresses require explicit configuration:
/etc/hostname.em0:
inet 192.168.1.10 255.255.255.0
!route add default 192.168.1.1
The DNS resolver is configured through /etc/resolv.conf. Automatic configuration overwrites this file. Static configurations require manual entries:
/etc/resolv.conf:
nameserver 192.168.1.1
lookup file bind
The network configuration becomes active after the first boot. The installer does not test network connectivity during installation. If sets are downloaded successfully, the network configuration is working.
Root Password
During installation, the root account is assigned a password. OpenBSD does not permit password-based SSH logins for the root account—only key-based authentication is allowed. This restriction significantly reduces the risk of brute-force attacks.
Password for root account? (will not echo)
Password for root account? (again)
The password is entered twice for confirmation. The characters are not displayed while typing.
SSH Daemon
The installer asks whether the SSH daemon should be enabled automatically at system startup:
Start sshd(8) by default? [yes]
If confirmed, the SSH server is enabled in /etc/rc.conf.local:
/etc/rc.conf.local:
sshd_flags=
Empty flags mean the service is enabled with its default parameters. The SSH server listens on port 22 and accepts connections on all network interfaces.
The SSH configuration can be adjusted after installation in /etc/ssh/sshd_config. Common changes include using a different port, restricting specific interfaces, or applying additional security measures.
X Window System
The installer asks whether you expect to run the X Window System:
Do you expect to run the X Window System? [yes]
This question does not affect the set selection. All sets, including the X11 components, remain selected by default. If you answer yes, however, the installer asks an additional question about the display manager:
Do you want the X Window System to be started by xenodm(1)? [no]
xenodm is OpenBSD’s display manager. It starts the graphical environment automatically during boot and provides a graphical login screen.
- yes – Desktop installation with automatic X11 startup and graphical login
- no – X11 is installed, but must be started manually with
startx
Server installations typically answer no to the first question and later deselect the X11 sets manually during set selection (see Selecting Sets below).
Serial Console
The installer offers to redirect the default system console to the serial interface:
Change the default console to com0? [no]
The serial console (com0) provides system access over RS232/UART without requiring a graphics adapter or monitor. This is relevant for:
- Headless servers in data centers without a local console
- Embedded systems where the serial interface is the primary management interface
- Remote diagnostics through serial console servers
- IPMI, iLO, or iDRAC environments using Serial over LAN (SOL)
Systems with a normal graphics console (VGA or HDMI), as well as virtual machines with a display, do not require a serial console. The default answer [no] is appropriate for desktop systems and standard server installations.
The serial console can also be enabled after installation through /etc/boot.conf:
/etc/boot.conf:
set tty com0
The baud rate (9600 by default) and additional serial parameters are configured during kernel boot. OpenBSD supports baud rates from 9600 up to 115200 bps.
Creating a User
The installer prompts you to create a regular user account:
Setup a user? (enter a lower-case loginname, or 'no') [no]
This account is automatically added to the wheel group, allowing it to execute privileged commands through doas.
Figure: Creating a user account. The root account is a frequent target of brute-force attacks.
After the user account has been created, the installer asks how SSH access for the root account should be configured:
WARNING: root is targeted by password guessing attacks, pubkeys are safer.
Allow root ssh login? (yes, no, prohibit-password) [no]
The available options are:
- no (default) – Completely disable root logins over SSH
- prohibit-password – Allow root logins using SSH keys only
- yes – Allow password-based root logins (not recommended)
[no] blocks all SSH access for the root account. Regular users log in normally and use doas to execute privileged commands. This provides the strongest protection against brute-force attacks.
The selected option is written to /etc/ssh/sshd_config:
# [no]
PermitRootLogin no
# [prohibit-password]
PermitRootLogin prohibit-password
# [yes]
PermitRootLogin yes
The configuration can be changed later in /etc/ssh/sshd_config. Server installations typically use either [no] or prohibit-password.
/etc/doas.conf automatically. This file must be created manually after installation before doas can be used.
Time Zone
The installer asks for the system time zone:
What timezone are you in? ('?' or 'L' for list) [Europe/Berlin]
Entering ? displays the available regions, while L lists every supported time zone. For Germany, Europe/Berlin is the correct choice. The selected time zone is stored in /etc/localtime.
Selecting the Installation Disk
The installer lists all available storage devices—typically sd0 for the first disk. Additional disks appear as sd1, sd2, and so on.
Available disks are: sd0.
Which disk is the root disk? ('?' for details) [sd0]
Encryption (Optional)
Before partitioning begins, the installer offers full-disk encryption using softraid(4):
Encrypt the root disk with a (p)assphrase or (k)eydisk? [no]
- (p)assphrase – Encrypt the disk using a passphrase
- (k)eydisk – Encrypt the disk using a USB device as the key
- [no] – No encryption (default)
On encrypted systems, the passphrase must be entered every time the machine boots. This protects the data if someone gains physical access to the storage device, but adds an additional step during startup.
Choosing the Partition Table
The installer detects the current boot mode and asks which partition table should be used:
Use (W)hole disk MBR, whole disk (G)PT or (E)dit? [whole]
- (W)hole disk MBR – For legacy BIOS systems
- (G)PT – For UEFI systems
- (E)dit – Manual configuration for specialized requirements
Important: The partition table must match the system’s boot mode. Systems booted in legacy BIOS mode require MBR, while UEFI systems use GPT.
Partitioning
OpenBSD uses disklabels for partitioning. A storage device such as /dev/sd0 receives a disklabel containing up to sixteen partitions (a through p). Partition a normally contains the root filesystem, while partition b is used for swap space. The disklabel mechanism abstracts the underlying partition table, so it works the same way on both MBR and GPT systems.
The installer offers both automatic and manual partitioning:
Use (A)uto layout, (E)dit auto layout, or create (C)ustom layout? [a]
With automatic partitioning, the installer creates the standard layout:
Figure: Automatic layout separating system components for improved stability.
- a:
/(root) – Base system and kernel - b:
swap– Swap space - d:
/tmp– Temporary files - e:
/var– Variable data, log files, spool directories - f:
/usr– Programs and libraries - g:
/usr/X11R6– X Window System - h:
/usr/local– Locally installed software - i:
/usr/src– System source code - j:
/usr/obj– Build directory - k:
/home– User home directories
This layout separates system components from user data. A full /var filesystem, for example, does not affect the root filesystem. Log files and spool directories remain isolated.
/tmp, /var, or /usr/local are omitted and become part of the root filesystem instead.
Manual partitioning allows custom layouts. The disklabel -E /dev/sd0c editor displays the current configuration and allows it to be modified. New partitions are created with the a (add) command, while existing partitions are removed with d.
Each partition requires:
- Size, specified in sectors or using suffixes such as
Gfor gigabytes - Offset, defining the starting position on the disk
- Mount point for filesystem partitions
- Filesystem type, typically
4.2BSDfor FFS (Fast File System)
If only partition sizes are specified, the installer calculates the required offsets automatically. No changes are written to disk until the configuration has been confirmed.
Selecting Sets and Installing the System
OpenBSD organizes the base system into sets—compressed tar archives containing individual system components:
- bsd – Kernel for the primary architecture
- bsd.rd – RAM disk kernel for installation and maintenance
- bsd.mp – Multiprocessor kernel (amd64 only)
- base79.tgz – Base system (shell, utilities, libraries)
- comp79.tgz – Compiler and development tools
- man79.tgz – Manual pages
- game79.tgz – BSD games
- xbase79.tgz – Base components of the X Window System
- xfont79.tgz – X11 fonts
- xserv79.tgz – X server
- xshare79.tgz – Additional X11 files
Selecting the Set Source
The installer asks where the installation sets should be loaded from:
Location of sets? (cd0 disk http nfs or 'done') [http]
For an HTTP installation, the installer first asks for an optional proxy before presenting a mirror selection. It either suggests a suitable mirror automatically or displays a list of available servers.
Selecting Sets
Figure: Deselecting X11 components for a server installation.
All sets are selected by default, regardless of the earlier X Window System question. For server installations, the X11 sets should be removed manually:
Set name(s)? (or 'abort' or 'done') [done] -x*
The pattern -x* removes every set whose name begins with x. The BSD games can also be omitted with -game*.
A minimal server installation requires only:
bsd, bsd.rd, bsd.mp, base79.tgz, comp79.tgz, man79.tgz
Desktop systems normally install every set to provide a complete working environment.
Verification and Installation
The selected sets are downloaded from the chosen mirror. The installer first retrieves SHA256.sig, then verifies every set as it is downloaded.
Figure: Downloading and verifying every installed set using SHA256.
Each downloaded set is verified against its SHA256 checksum. Modified or corrupted sets are rejected immediately, and the installation stops with an error.
The installer displays the progress of each set individually: download, verification, and installation. Depending on network speed, installing the complete set collection typically takes between five and fifteen minutes.
After the installation has finished, the installer confirms the source location:
Location of sets? (cd0 disk http nfs or 'done') [done]
Press Enter to accept [done].
Time Synchronization
The installer checks the system clock and offers to correct it if necessary:
Time appears wrong. Set to 'Sat Nov 1 21:26:24 CET 2025'? [yes]
A correct system clock is required for certificate validation and security updates. When the network is configured automatically, the installer usually detects the correct time zone as well.
Completing the Installation
After all sets have been installed, the installer performs the remaining configuration steps:
- Saving configuration files
- Creating device nodes
- Detecting multiprocessor systems (switching to
bsd.mpwhere appropriate) - Checking for firmware updates (
fw_update) - Relinking the kernel for ASLR randomization
Finally, the installer displays:
Figure: Installation complete. The system is ready for its first boot.
CONGRATULATIONS! Your OpenBSD install has been successfully completed!
When you login to your new system the first time, please read your mail
using the 'mail' command.
Exit to (S)hell, (H)alt or (R)eboot? [reboot]
Preparing for the First Boot
The installer offers three options:
- (S)hell – Open a shell for manual changes
- (H)alt – Shut the system down
- (R)eboot – Reboot immediately
Remove the installation media before the first boot.
Recommended procedure:
- Enter
Hto halt the system. - Remove the installation media:
- Virtual machine: eject the ISO or disk image from the virtual drive.
- Physical hardware: remove the USB flash drive or CD.
- Start the system manually.
If you choose R immediately, the machine boots from the installation media again and restarts the installer.
First Steps After Installation
After rebooting, the system starts from its internal storage. The boot loader displays the name of the kernel being loaded—normally /bsd, or /bsd.mp on multiprocessor systems. A login prompt then appears on the system console.
Figure: First boot. System services start and the login prompt appears.
OpenBSD intentionally starts with a minimal set of services in order to reduce the attack surface. As explained in the previous article, only SSH and cron are enabled by default. No additional network services are started. The pf firewall is active, but its default ruleset is empty and therefore blocks nothing.
Reading the Post-Installation Mail
The system sends important information to the first user by local mail:
$ mail
The message contains welcome information, first-boot logs, and installation details. These messages provide useful information for the initial system configuration.
Enabling doas
After the first login, /etc/doas.conf must be created manually:
$ su -
Password: [root password]
# echo "permit persist :wheel" > /etc/doas.conf
# exit
$ doas whoami
root
The persist option caches authentication for a few minutes, so repeated doas commands do not require the password every time.
doas is not available to regular users until this step has been completed.
Installing Updates
Security updates should be installed immediately after the initial installation:
$ doas syspatch
Get/Verify syspatch79-002_smtpd.tgz 100% |***...***| 313 KB 00:00
Installing patch 002_smtpd
Get/Verify syspatch79-003_vmd.tgz 100% |***...***| 114 KB 00:00
Installing patch 003_vmd
Errata can be reviewed under /var/syspatch
syspatch downloads security patches from the official servers and installs them automatically. During its first execution, the utility often updates itself and requests that it be run again. If this happens, simply execute the command a second time. A reboot may be required when kernel patches have been installed; the utility reports this at the end of its output.
syspatch requires Internet connectivity. On offline systems, patches can be installed later from removable media. Patch files are available from the mirror servers under /pub/OpenBSD/patches/.
Package management is initialized with:
$ doas pkg_add -u
The first execution downloads the package index from the selected mirror. Additional software can then be installed with pkg_add package-name. The following articles cover package management and system configuration in greater detail.
rc.conf and Boot Configuration
The file /etc/rc.conf.local overrides the default settings defined in /etc/rc.conf. System services are disabled by default; local service configuration belongs in rc.conf.local:
/etc/rc.conf.local:
httpd_flags=
ntpd_flags=-s
Empty flag variables enable a service with its default parameters. In this example, the HTTP server starts without additional options, while the NTP daemon receives the -s flag to perform an initial time synchronization.
Services are started through the RC scripts located in /etc/rc.d/. The file /etc/rc.conf defines the default flag values, which are usually empty or disabled. Entries in rc.conf.local override these defaults during boot.
Both files are read as part of the boot process. Services start in a defined order according to their dependencies. The following articles explain service management and daemon configuration in detail.
Information Used
This guide is based on:
- OpenBSD: 7.8, 7.9
- Architecture: amd64 (primary), while the general concepts apply to all supported platforms
- Context: Server and desktop installations
- Status: June 2026
The installation provides the foundation for the articles that follow. The next article covers system configuration, including networking, time synchronization, and basic administration.
