Complete the First 30 Minutes After Installation

Synopsis #

A new OpenBSD installation is usable immediately, but several administrative tasks should be completed before it enters service. This guide establishes a conservative baseline: verify the installed system, read the initial administrative mail, install firmware and errata, update packages, test a non-root administrator account, review enabled services, and record enough information to support recovery.

Complete remote-access changes from a local console or provider console. Do not disable an existing access method until its replacement has been tested in a separate session.

Verify the System and Network #

Record the release and architecture with uname(1) , the principal hardware characteristics with sysctl(8) , and filesystem use with df(1) . Inspect interfaces with ifconfig(8) , routes with route(8) , and unresolved hardware messages with dmesg(8) .

$ uname -a
  # Record the installed release and architecture
$ sysctl hw.model hw.ncpu hw.physmem
  # Record the principal hardware characteristics
$ df -h
  # Confirm that every expected filesystem is mounted and has free space
$ ifconfig
  # Confirm interface state and assigned addresses
$ route -n show
  # Confirm the default route and other installed routes
$ dmesg | grep -i 'not configured\|unknown'
  # Identify devices that the kernel did not attach to a driver

A not configured line indicates that the kernel recognized a device but did not attach a driver. It does not necessarily indicate a device required by the intended workload. Preserve the complete dmesg before investigating individual lines.

Read the Initial Root Mail #

The installation creates local mail for root with release-specific information. Read it with mail(1) :

# mail

Daily, weekly, and monthly maintenance reports are also delivered to root. Configure an alias or a regular review procedure so that these reports are not ignored. The system configuration chapter describes root mail and /etc/mail/aliases.

Install Firmware and Base-System Patches #

Use fw_update(8) to install firmware required by detected devices. Without operands, it examines the running system and installs or updates the applicable firmware.

Use syspatch(8) to install binary errata patches on supported release and architecture combinations.

# fw_update
  # Install or update firmware required by detected devices
# syspatch
  # Install available binary patches for the base system

If wireless firmware is required before an Internet connection can be established, follow Bootstrap Wi-Fi Firmware Without Ethernet .

Reboot when syspatch reports that a reboot is required. A reboot also verifies that the system can start from disk without the installation media.

Update Installed Packages #

Packages are maintained separately from the base system. Update installed packages with pkg_add(1) :

# pkg_add -u

This command updates installed packages from the configured package source. It does not upgrade the OpenBSD base system to a new release. The packages and ports chapter and updating and upgrading chapter describe those lifecycles separately.

Establish an Administrator Account #

The installer can create a regular user. If no administrative account exists, create one with adduser(8) and place it in the wheel group when prompted.

# adduser

Create a minimal /etc/doas.conf rule using doas.conf(5) . The following rule permits members of wheel to run commands as root after authentication:

permit persist :wheel

Validate the file before ending the root session:

$ doas -C /etc/doas.conf

Open a separate session as the administrator and test both an unprivileged command and a privileged command.

$ id
$ doas id

The second command should report an effective user ID of 0. Keep the root console open until this test succeeds.

Review Services and Packet Filtering #

List enabled services with rcctl(8) :

# rcctl ls on

Enable only services required by the system’s role. Confirm that Packet Filter is loaded and inspect the active rules with pfctl(8) :

# pfctl -si
# pfctl -sr

Before changing SSH or PF remotely, preserve a working console and test the revised configuration. The SSH chapter and PF chapter contain the detailed configuration material.

Record a Recoverable Baseline #

Store the following information somewhere other than the new system:

  • the hosting provider or physical location and console-access procedure;
  • the installed OpenBSD release and architecture;
  • disk identifiers and filesystem layout;
  • network addresses, gateways, and DNS policy;
  • the administrator public key and the location of its private-key backup;
  • services intentionally enabled;
  • a copy of important configuration files;
  • the recovery-media location and backup procedure.

Run a final restart, confirm the expected services, and review the boot messages.

# reboot

After login, repeat the network, filesystem, firmware, patch, and service checks. This establishes a known-good baseline before application data is introduced.

Report a bug