a: / 2GB
b: swap 6GB (optional)
c: -
d: /tmp 4GB
e: /usr 4GB
f: /usr/local 4GB
g: /home rest
h: /var 270GB
On the OpenBSD installer, press s for a shell.
Find your harddisk device: dmesg | grep "^[sw]d"
Mostly, this is sd0 or /dev/sd0.
Install MBR and partition table: fdisk -iy sd0
Format the disk:
disklabel -E sd0
Press these key-combinations:
a b
# Defaults are okay, size is "1g"
a a
# Defaults are okay, size is "*", type is "RAID"
w
q
Encrypt the disk: bioctl -c C -l /dev/sd0a softraid0
Now exit and continue with the normal installation process by pressing i.
Make sure you are using the new sd1 disk for the actual file systems.
Note: replace % with your partition.
Create a partition or change the type to RAID:
disklabel -E sd0
d %
a %
Encrypt the disk: bioctl -c C -l /dev/sd0% softraid0
Note: replace _ with your new disk.
Prepare the Disk:
fdisk -iy sd_
disklabel -E sd_
# a a (use defaults)
# w
# q
newfs sd_a
echo "/dev/sd_a /var ffs rw,nodev,nosuid,softdep,noauto 1 2">>/etc/fstab
mount /var
For fast base system selection:
-g*
-x*
Allow ssh access:
echo "pass in on egress proto tcp to any port ssh" >> /etc/pf.conf
pfctl -f /etc/pf.conf
cat <<EOF>> ~/.profile
alias ll="ls -lah"
alias s="doas su -"
alias vim="vi"
export LC_ALL=en_US.UTF-8
export PS1="\u@\h:\w$ "
export PKG_PATH=https://ftp.hostserver.de/pub/OpenBSD/\$(uname -r)/packages/\$(machine -a)/
bind '^[[3~'=delete-char-forward
EOF
cat <<EOF>> ~/.profile
alias ll="ls -lah"
alias vim="vi"
export LC_ALL=en_US.UTF-8
export PS1="\u@\h:\w# "
export PKG_PATH=https://ftp.hostserver.de/pub/OpenBSD/\$(uname -r)/packages/\$(machine -a)/
bind '^[[3~'=delete-char-forward
EOF
echo "permit :wheel" > /etc/doas.conf
Add User to group wheel:
usermod -G wheel <user>
Create User with group:
useradd -G wheel -m <user>
ftp -o ssh-config.sh https://git.giftfish.de/giftfish/scripts/raw/master/ssh-config.sh
chmod 0744 ssh-config.sh
For servers you can disable these:
Note: if you need to send/receive mails do not disable smtpd.
rcctl stop sndiod slaacd
rcctl disable sndiod slaacd
rcctl stop smtpd
rcctl disable smtpd
cat <<EOF> /etc/dhclient.conf
ignore domain-search;
ignore domain-name-servers;
EOF
rcctl stop resolvd
rcctl disable resolvd
cat <<EOF> /etc/resolv.conf
nameserver 9.9.9.9
nameserver 149.112.112.112
lookup file bind
EOF
cat <<EOF> /etc/ntpd.conf
servers pool.ntp.org
server time.cloudflare.com
sensor *
constraint from "9.9.9.9"
constraints from "www.google.com"
EOF
Allow W^X on mountpoint: mount -u wxallowed /
Tag a binary: LDFLAGS += -Wl,-z,wxneeded
echo "https://ftp.hostserver.de/pub/OpenBSD" > /etc/installurl
List available updates: syspatch -c
Install updates: syspatch
List installed updates: syspatch -l
Run sysupgrade to upgrade to a newer release.
Minimal sysupgrade:
sysupgrade -n
rm /home/_sysupgrade/g*.tgz /home/_sysupgrade/x*.tgz
reboot
cd /usr
cvs -qd anoncvs@ftp.hostserver.de:/cvs get -rOPENBSD_6_4 -P src
CVS Server:
CVSROOT=anoncvs@ftp.hostserver.de:/cvs
Location: Frankfurt, Germany.
Maintained by Sebastian Benoit, Peter Hessler.
Protocols: ssh.
Updated hourly from anoncvs1.ca.openbsd.org.
SSH fingerprints:
(RSA) SHA256:XrjDaKqJ6J02iSQ/eoiqII0LxJX9D/41eeC6pSQAJXs, MD5:ab:02:37:76:d9:f8:5b:3a:10:54:dc:8b:47:ef:c0:73
(DSA) SHA256:GYBYarN5A31LlnSRmxoy7f8upzkTZN8x/MPsB3wElLk, MD5:d1:0f:17:ee:06:f3:a4:ed:79:a2:eb:83:40:1b:7b:63
(ECDSA) SHA256:v6G11hMFfS2+zPh44hhZcpUqDEppyvGQe0vzmrtIHA8, MD5:fc:6d:06:54:ba:ed:7e:c2:d6:69:fb:c7:95:58:7b:c4
(ED25519) SHA256:KeG1InAfAnQKqpCewmXw/Egb+4UZZuIMGdlYVG+uxNg, MD5:1d:16:e2:2a:f2:85:28:b6:33:43:cb:de:c5:ad:fb:e9
cd /usr/src
cvs -q up -rOPENBSD_6_4 -Pd
Rebuild the kernel and reboot
Replace GENERIC with GENERIC.MP for multiprocessor systems.
cd /sys/arch/$(machine)/conf
config GENERIC
cd /sys/arch/$(machine)/compile/GENERIC
make clean && make && make install
reboot
If your system has trouble booting the new kernel, you can easily go back and reboot from the old kernel, now called obsd.
rm -rf /usr/obj/*
cd /usr/src
make obj && make build
# network
cat <<EOF> /etc/hostname.vio1
inet autoconf
mtu 1450
EOF
# wireguard ipv4 only
cat <<EOF> /etc/hostname.wg1
inet 192.168.0.1 255.255.255.0
mtu 1390
...
EOF
# wireguard ipv4 + ipv6
cat <<EOF> /etc/hostname.wg1
inet 192.168.0.1 255.255.255.0
mtu 1370
...
EOF
Freeze and 100% CPU usage issue.
References: https://www.brg.ch/openbsd-guest-on-a-kvm-host/
https://forum.proxmox.com/threads/openbsd-client-uses-100-cpu-and-freezes.38690/
Serial Console for guest:
echo -e "serial0: socket\nvga: serial0" >> /etc/pve/qemu-server/<VM_ID>.conf
Attach to serial console: qm terminal <VM_ID>
Preemption timer (reboot is needed, nested=Y is optional):
echo "options kvm-intel nested=Y preemption_timer=N" > /etc/modprobe.d/kvm-intel.conf
After the reboot cat /sys/module/kvm_intel/parameters/preemption_timer should return N.
NOTE: reboot of the guest is needed.
echo -e "stty com0 115200\nset tty com0" > /etc/boot.conf
Edit /etc/ttys
Replace
tty00 "/usr/libexec/getty std.9600" unknown off
by
tty00 "/usr/libexec/getty std.115200" vt220 on secure
a a
500Mi
/
a d
4Gi
/home
a e
1Gi
/tmp
a f
5Gi
/usr
a g
2Gi
/usr/src
a h
2Gi
/usr/obj
a i
1Gi
/usr/X11R6
a j
4Gi
/usr/local
a k
RAID
w
q
systat -a netstat|tail +5
su -l -s /bin/ksh nobody -c <command>
for i in $(fstat -p <pid> -f /var | tail +2 | awk '{print $6}'); do find /var -inum $i; done
Boot into single user mode and select s(shell):
boot> boot bsd.rd
cd /dev
sh MAKEDEV sd0
disklabel -E sd0
b
Starting sector: [64]
Size ('*' for entire disk): [1337] *
c h
Partition h is currently 1337 sectors in size, and can have a maximum
size of 2559 sectors.
size: [1337] 2559
w
q
growfs sd0h
fsck /dev/sd0h