Synopsis #
A new OpenBSD installation is usable immediately, but several administrative tasks should be completed before it enters service. This guide establishes a conservative baseline: verify the installed system, read the initial administrative mail, install firmware and errata, update packages, test a non-root administrator account, review enabled services, and record enough information to support recovery.
Complete remote-access changes from a local console or provider console. Do not disable an existing access method until its replacement has been tested in a separate session.
Establish an Administrator Account #
The installer can create a regular user. If no administrative account exists, create one with adduser(8)
and place it in the wheel group when prompted. See the administrator-account guide
for the complete account, doas, and SSH-key setup.
Run in the root shell:
adduser
Create a minimal /etc/doas.conf rule using doas.conf(5)
. The following rule permits members of wheel to run commands as root after authentication:
permit persist :wheel
Validate the file before ending the root session:
doas -C /etc/doas.conf
Open a separate session as the administrator and test both an unprivileged command and a privileged command.
id
doas id
The second command should report an effective user ID of 0. Keep the root console open until this test succeeds.
Verify the System and Network #
Record the release and architecture with uname(1) , the principal hardware characteristics with sysctl(8) , and filesystem use with df(1) . Inspect interfaces with ifconfig(8) , routes with route(8) , and unresolved hardware messages with dmesg(8) .
uname -a
# Record the installed release and architecture
sysctl hw.model hw.ncpu hw.physmem
# Record the principal hardware characteristics
df -h
# Confirm that every expected filesystem is mounted and has free space
ifconfig
# Confirm interface state and assigned addresses
route -n show
# Confirm the default route and other installed routes
dmesg | grep -i 'not configured\|unknown'
# Identify devices that the kernel did not attach to a driver
A not configured line indicates that the kernel recognized a device but did not attach a driver. It does not necessarily indicate a device required by the intended workload. Preserve the complete dmesg before investigating individual lines.
Read the Initial Root Mail #
The installation creates local mail for root with release-specific information. Read it with mail(1)
:
doas mail
Daily, weekly, and monthly maintenance reports are also delivered to root. Configure an alias or a regular review procedure so that these reports are not ignored. The system configuration chapter
describes root mail and /etc/mail/aliases.
Install Firmware and Base-System Patches #
Use fw_update(8) to install firmware required by detected devices. Without operands, it examines the running system and installs or updates the applicable firmware.
Use syspatch(8) to install binary errata patches on supported release and architecture combinations.
doas fw_update
# Install or update firmware required by detected devices
doas syspatch
# Install available binary patches for the base system
If wireless firmware is required before an Internet connection can be established, follow Bootstrap Wi-Fi Firmware Without Ethernet .
Reboot when syspatch reports that a reboot is required. A reboot also verifies that the system can start from disk without the installation media.
Update Installed Packages #
Packages are maintained separately from the base system. Update installed packages with pkg_add(1) :
doas pkg_add -u
This command updates installed packages from the configured package source. It does not upgrade the OpenBSD base system to a new release. The packages and ports chapter and updating and upgrading chapter describe those lifecycles separately.
Review Services and Packet Filtering #
List enabled services with rcctl(8) :
doas rcctl ls on
Enable only services required by the system’s role. Confirm that Packet Filter is loaded and inspect the active rules with pfctl(8) :
doas pfctl -si
doas pfctl -sr
Before changing SSH or PF remotely, preserve a working console and test the revised configuration. The SSH chapter and PF chapter contain the detailed configuration material.
Record a Recoverable Baseline #
Store the following information somewhere other than the new system:
- the hosting provider or physical location and console-access procedure;
- the installed OpenBSD release and architecture;
- disk identifiers and filesystem layout;
- network addresses, gateways, and DNS policy;
- the administrator public key and the location of its private-key backup;
- services intentionally enabled;
- a copy of important configuration files;
- the recovery-media location and backup procedure.
Run a final restart, confirm the expected services, and review the boot messages.
doas reboot
After login, repeat the network, filesystem, firmware, patch, and service checks. This establishes a known-good baseline before application data is introduced.