GoWiki | openbsd | Installation

# Installation

## Disk Formatting

```
a: / 2GB
b: swap 6GB (optional)
c: -
d: /tmp 4GB
e: /usr 4GB
f: /usr/local 4GB
g: /home rest
h: /var 270GB
```

### Full Disk Encryption

On the OpenBSD installer, press `s` for a shell.

Find your harddisk device: `dmesg | grep "^[sw]d"`

Mostly, this is `sd0` or `/dev/sd0`.

Install MBR and partition table: `fdisk -iy sd0`

Format the disk:

```
disklabel -E sd0

Press these key-combinations:
a b
# Defaults are okay, size is "1g"

a a
# Defaults are okay, size is "*", type is "RAID"

w
q
```

Encrypt the disk: `bioctl -c C -l /dev/sd0a softraid0`

Now `exit` and continue with the normal installation process by pressing `i`.  
Make sure you are using the new `sd1` disk for the actual file systems.

### Partition Disk Encryption

Note: replace `%` with your partition.

Create a partition or change the type to `RAID`:

```
disklabel -E sd0

d %
a %
```

Encrypt the disk: `bioctl -c C -l /dev/sd0% softraid0`

Note: replace `_` with your new disk.

Prepare the Disk:

```
fdisk -iy sd_
disklabel -E sd_
# a a (use defaults)
# w
# q
newfs sd_a
echo "/dev/sd_a /var ffs rw,nodev,nosuid,softdep,noauto 1 2">>/etc/fstab
mount /var
```

## Base files

For fast base system selection:

`-g*`  
`-x*`

## pf
Allow ssh access:

```
echo "pass in on egress proto tcp to any port ssh" >> /etc/pf.conf
pfctl -f /etc/pf.conf
```

## .profile

### User

```
cat <<EOF>> ~/.profile
alias ll="ls -lah"
alias s="doas su -"
alias vim="vi"
export LC_ALL=en_US.UTF-8
export PS1="\u@\h:\w$ "
export PKG_PATH=https://ftp.hostserver.de/pub/OpenBSD/\$(uname -r)/packages/\$(machine -a)/
bind '^[[3~'=delete-char-forward
EOF
```

### Root

```
cat <<EOF>> ~/.profile
alias ll="ls -lah"
alias vim="vi"
export LC_ALL=en_US.UTF-8
export PS1="\u@\h:\w# "
export PKG_PATH=https://ftp.hostserver.de/pub/OpenBSD/\$(uname -r)/packages/\$(machine -a)/
bind '^[[3~'=delete-char-forward
EOF
```

## doas

```
echo "permit :wheel" > /etc/doas.conf
```

Add User to group `wheel`:  
`usermod -G wheel <user>`

Create User with group:
`useradd -G wheel -m <user>`

## SSH Config

```
ftp -o ssh-config.sh https://git.giftfish.de/giftfish/scripts/raw/master/ssh-config.sh
chmod 0744 ssh-config.sh
```

## Not needed services

For servers you can disable these:

Note: if you need to send/receive mails do not disable `smtpd`.

```
rcctl stop sndiod slaacd
rcctl disable sndiod slaacd
rcctl stop smtpd
rcctl disable smtpd
```

## DHCP

```
cat <<EOF> /etc/dhclient.conf
ignore domain-search;
ignore domain-name-servers;
EOF
```

## DNS

```
rcctl stop resolvd
rcctl disable resolvd
cat <<EOF> /etc/resolv.conf                                                                                            
nameserver 9.9.9.9
nameserver 149.112.112.112
lookup file bind
EOF
```

## NTP

```
cat <<EOF> /etc/ntpd.conf
servers pool.ntp.org
server time.cloudflare.com
sensor *

constraint from "9.9.9.9"
constraints from "www.google.com"
EOF
```

## WxorX

Allow W^X on mountpoint: `mount -u wxallowed /`

Tag a binary: `LDFLAGS += -Wl,-z,wxneeded`

# System Update

## syspatch

```
echo "https://ftp.hostserver.de/pub/OpenBSD" > /etc/installurl
```

List available updates: `syspatch -c`

Install updates: `syspatch`

List installed updates: `syspatch -l`

## sysupgrade

Run `sysupgrade` to upgrade to a newer release.

Minimal sysupgrade:

```
sysupgrade -n
rm /home/_sysupgrade/g*.tgz /home/_sysupgrade/x*.tgz
reboot
```

## Source Checkout

```
cd /usr
cvs -qd anoncvs@ftp.hostserver.de:/cvs get -rOPENBSD_6_4 -P src
```

CVS Server:
```
CVSROOT=anoncvs@ftp.hostserver.de:/cvs
Location: Frankfurt, Germany.
Maintained by Sebastian Benoit, Peter Hessler.
Protocols: ssh.
Updated hourly from anoncvs1.ca.openbsd.org.
SSH fingerprints:
(RSA) SHA256:XrjDaKqJ6J02iSQ/eoiqII0LxJX9D/41eeC6pSQAJXs, MD5:ab:02:37:76:d9:f8:5b:3a:10:54:dc:8b:47:ef:c0:73
(DSA) SHA256:GYBYarN5A31LlnSRmxoy7f8upzkTZN8x/MPsB3wElLk, MD5:d1:0f:17:ee:06:f3:a4:ed:79:a2:eb:83:40:1b:7b:63
(ECDSA) SHA256:v6G11hMFfS2+zPh44hhZcpUqDEppyvGQe0vzmrtIHA8, MD5:fc:6d:06:54:ba:ed:7e:c2:d6:69:fb:c7:95:58:7b:c4
(ED25519) SHA256:KeG1InAfAnQKqpCewmXw/Egb+4UZZuIMGdlYVG+uxNg, MD5:1d:16:e2:2a:f2:85:28:b6:33:43:cb:de:c5:ad:fb:e9
```

## Source Update

```
cd /usr/src
cvs -q up -rOPENBSD_6_4 -Pd
```

## Rebuild Kernel

Rebuild the kernel and reboot

Replace GENERIC with GENERIC.MP for multiprocessor systems.

```
cd /sys/arch/$(machine)/conf
config GENERIC
cd /sys/arch/$(machine)/compile/GENERIC
make clean && make && make install
reboot
```

If your system has trouble booting the new kernel, you can easily go back and reboot from the old kernel, now called obsd.

## Rebuild Userland

```
rm -rf /usr/obj/*
cd /usr/src
make obj && make build
```

# OpenBSD on Hetzner Cloud

## Private Networks

```
# network
cat <<EOF> /etc/hostname.vio1                                                                                
inet autoconf
mtu 1450
EOF

# wireguard ipv4 only 
cat <<EOF> /etc/hostname.wg1  
inet 192.168.0.1 255.255.255.0
mtu 1390
...
EOF

# wireguard ipv4 + ipv6 
cat <<EOF> /etc/hostname.wg1  
inet 192.168.0.1 255.255.255.0
mtu 1370
...
EOF
```

# OpenBSD on Proxmox

Freeze and 100% CPU usage issue.

References:
https://www.brg.ch/openbsd-guest-on-a-kvm-host/

https://forum.proxmox.com/threads/openbsd-client-uses-100-cpu-and-freezes.38690/

http://openbsd-archive.7691.n7.nabble.com/Openbsd-6-1-and-Current-Console-Freezes-and-lockup-Proxmox-PVE5-0-tp322999p323465.html

## Proxmox host

Serial Console for guest:

`echo -e "serial0: socket\nvga: serial0" >> /etc/pve/qemu-server/<VM_ID>.conf`

Attach to serial console: `qm terminal <VM_ID>`

Preemption timer (reboot is needed, `nested=Y` is optional):

`echo "options kvm-intel nested=Y preemption_timer=N" > /etc/modprobe.d/kvm-intel.conf`

After the reboot `cat /sys/module/kvm_intel/parameters/preemption_timer` should return `N`.

## OpenBSD guest

NOTE: reboot of the guest is needed.

`echo -e "stty com0 115200\nset tty com0" > /etc/boot.conf`

Edit `/etc/ttys`

```
Replace
tty00	"/usr/libexec/getty std.9600"	unknown	off
by
tty00	"/usr/libexec/getty std.115200"	vt220	on  secure
```

# Cheatsheet

## Hetzner Cloud

### Disk Layout

```
a a

500Mi

/
a d

4Gi

/home
a e

1Gi

/tmp
a f

5Gi

/usr
a g

2Gi

/usr/src
a h

2Gi

/usr/obj
a i

1Gi

/usr/X11R6
a j

4Gi

/usr/local
a k

RAID
w
q
```

## Connections

`systat -a netstat|tail +5`

## su to user

`su -l -s /bin/ksh nobody -c <command>`

## Inode to file

`for i in $(fstat -p <pid> -f /var | tail +2 | awk '{print $6}'); do find /var -inum $i; done`

## Resize Partition

Boot into single user mode and select `s(shell)`:

```
boot> boot bsd.rd
```

```
cd /dev
sh MAKEDEV sd0
disklabel -E sd0

b
Starting sector: [64]
Size ('*' for entire disk): [1337] *
c h
Partition h is currently 1337 sectors in size, and can have a maximum
size of 2559 sectors.
size: [1337] 2559
w
q

growfs sd0h
fsck /dev/sd0h
```