OpenBSD server: basic install
I have been running Debian on my servers for years. Recently I wanted to challenge myself to something new, so I started playing around with OpenBSD. OpenBSD is a minimal, security-focused OS, but still quite simple to use, which fit my needs perfectly.
Install
For the VPS provider, I went with Hetzner, as I have been a customer for 7 years and never had a single problem with them. Conveniently Hetzner provides OpenBSD as an ISO image directly, skipping the need to fumble with their Rescue system to upload a custom ISO.
When the installer has booted enter (I)nstall mode by typing I and pressing Enter.
Choose the keyboard layout. For me it is de
Enter the system hostname next, e.g. vps.
The installer will scan for usable network interfaces next. In case of my VPS provider it is vio0. Press Enter to choose the default selection.
Press Enter on the IPv4 and IPv6 autoconfig. Enter again to complete the network configuration.
Next, enter the password for the root user.
Press Enter on Start sshd(8) by default? [yes] to have the ssh daemon start on boot.
As I don’t plan to have a graphical interface on the server, type No and press Enter on the next prompt.
Press Enter on the next prompt as well.
User creation is next. I like to create a separate user from the root account, that is used to log in to the server. Enter a name with no spaces and press Enter, as well as on the prompt for the full name. Enter the password for that user next (we will disable password login and switch to public key authentication in a bit).
When asked to Allow root ssh login? [no], Press Enter to keep the default and disallow the root user from logging in via SSH.
Choose the timezone, e.g. Europe/Amsterdam.
The installer will scan for disks next. Press Enter on the auto chosen disk. For the encryption press Enter to disable it. If there are any, the partitions on the drive will be shown.
Type C and press Enter to create a partition layout.
Type z and press Enter to delete the existing partitions. To add a partition type a and the label of the partition (e.g. a). Press Enter on the offset. For the size enter 2g for example, and press Enter. Press Enter on the FS type as well. Lastly specify the mount point (e.g. /home for the home partition).
For my use case I created the following partitions:
a size 2g mount /
b size 1g fstype swap
d size 1g mount /tmp
e size 5g mount /usr
f size 4g mount /usr/local
g size 6g mount /var
h size * mount /home (will be about ~19 GB)
Type w, press Enter to write and q followed by Enter as well to quit.
The automatic partition layout is fine for most setups. I simplified the partition scheme to maximise the available disk space in the /home partition.
Press Enter on the location of sets (OS components), Enter on the proxy URL, and the HTTP server (location of the OS components to download) and server directory as well.
Next you choose the sets to install. For my case I am omitting the game and x11 sets by typing -game* -x* and pressing Enter. Press Enter once more to start the installation.
If the installer asks for the location of sets again, just press Enter, as well on when it asks to reboot.
That is the base install finished! Next we are going to setup doas to run commands as root, harden SSH and install a few basic programs.
First login
Until doas is configured, the following commands are run as root.
Login with your newly created user and switch to root with su -.
Make sure the system is up to date:
syspatch
Install a few basic tools, that are needed later on:
pkg_add rsync vim git
Change hostname
The installer asked for the hostname earlier, and appended the default domain FQDN to it like vps.my.domain.
If you have a domain connected to the vps you can use that. Change the system hostname in /etc/myname to vps.domain.tld.
Update /etc/hosts as well:
YOUR_IPv4 hostname.domain.tld hostname
You can check your servers IP address with ifconfig -a.
Secure SSH
Secure the ssh configuration in /etc/ssh/sshd_config:
PasswordAuthentication no
Make sure to have copied an ssh key to the server with ssh-copy-id server-ip, and also verify login works. Then restart the ssh service:
rcctl restart sshd
Firewall setup
Setup the configuration in /etc/pf.conf:
set skip on lo
block return
pass out
pass in on vio0 proto tcp to port { 22 80 443 }
This will open incoming connections on port 22 for SSH, port 80 for HTTP and port 443 for HTTPS.
You might want to consider changing the block type to drop instead of return, as return rejects a connection, but tells the other side that the port is closed. drop on the other hand silently discards the connection attempt.
Apply the new settings:
pfctl -nf /etc/pf.conf
pfctl -f /etc/pf.conf
pfctl -e
If it shows show pfctl: pf already enabled, that’s fine.
Setup doas
For running commands as root with the user we used to login to the server we will use doas. It comes pre-installed with OpenBSD.
Create the configuration:
echo "permit persist :wheel" > /etc/doas.conf
Log out and in to apply.
The installer adds your user to the wheel group by default.
Test with:
doas syspatch
doas pkg_add -Uu
That’s a wrap
This will conclude the basic setup of an OpenBSD server. Check out Part 2 on how to configure the httpd web server and obtain HTTPS certificates.