How-to Guides

Synopsis #

The How-to Guides connect several Handbook subsystems into complete administrative outcomes. Detailed reference material remains in the main chapters; these guides provide an ordered path, verification steps, recovery precautions, and links to the underlying configuration.

Installation and First Use #

• Install OpenBSD from verified media describes media selection, signature verification, installation, and the first boot.
• Complete the first 30 minutes after installation establishes updates, administrative access, services, and a recoverable baseline.
• Check hardware compatibility before installing provides a repeatable architecture and device-support assessment.
• Bootstrap Wi-Fi firmware without Ethernet installs required firmware from removable media.
• Install OpenBSD with full-disk encryption creates a bootable softraid CRYPTO volume with explicit device checks and recovery precautions.
• Dual-boot OpenBSD on a UEFI system preserves another operating system, uses only verified free space, and retains independent recovery paths.
• Automate OpenBSD installation with autoinstall and PXE builds a restricted DHCP, TFTP, HTTP, and response-file provisioning path.
• Install OpenBSD on a VPS or cloud server covers provider-neutral console, media, networking, SSH, and recovery preparation.
• Run OpenBSD as a virtual machine guest covers third-party hypervisor devices, consoles, shutdown, snapshots, and recovery.

Workstations and Shells #

• Set up OpenBSD as a laptop or workstation connects installation, X, desktop packages, networking, audio, power checks, security, and backups.
• Configure laptop power management establishes apmd, suspend and resume tests, lid behavior, battery actions, and diagnostics.
• Configure multimedia covers audio playback, recording privacy, cameras, packaged media tools, and focused diagnostics.
• Troubleshoot web browsers isolates package, profile, resource-limit, session, sandbox, graphics, and recording failures.
• Install Z shell installs zsh, changes the login shell, and creates a minimal initial configuration.
• Configure the X Window System covers Xenocara, graphical login, sessions, displays, and troubleshooting.
• Install a graphical environment covers packaged desktop environments and window managers.

Networking and Remote Access #

• Create an administrator account with doas and SSH keys establishes and verifies a non-root administrative path.
• Configure secure remote access with OpenSSH applies a lockout-safe authentication and network policy without brittle algorithm lists.
• Use FIDO security keys with OpenSSH covers non-resident and resident credentials, backup tokens, and recovery.
• Configure Wi-Fi roaming and wired failover maintains an auto-join credential list and prefers Ethernet through a failover trunk.
• Build a simple router and firewall configures routing, NAT, DHCP, PF, and local DNS service.
• Route multiple VLANs with PF configures a tagged trunk, IPv4 forwarding, inter-VLAN policy, local service exceptions, and diagnostics.
• Configure a road-warrior WireGuard VPN provides split-tunnel access from a roaming OpenBSD client to a private LAN.
• Route IPv6 networks without NAT configures a delegated prefix, router advertisements, ICMPv6, and PF.
• Configure NAT and port forwarding with PF provides one complete outbound NAT, inbound redirection, and internal-access scenario.
• Troubleshoot PF, NAT, and routing traces links, routes, forwarding, rules, translation, state, DNS, and packet captures.
• Configure networking covers interfaces, addressing, wireless networks, DNS, routes, bridges, trunks, and VLANs.
• Administer Packet Filter covers rules, NAT, redirection, logging, tables, anchors, policies, and diagnostics.
• Configure advanced networking covers VPNs, high availability, multi-WAN, IPv6, routing, and network design.
• Configure CARP and pfsync covers redundant firewalls and state synchronization.
• Configure multi-WAN routing covers failover and policy routing across multiple uplinks.
• Configure VPNs and encrypted tunnels covers site-to-site IKEv2 and related advanced patterns.
• Configure dynamic routing with OpenBGPD keeps BGP material in the advanced reference where routing policy and operational risk can be treated explicitly.
• Configure SSH covers the base OpenSSH server, authentication, policy, and troubleshooting.

Services #

• Build a mail server with OpenSMTPD, Dovecot, and Rspamd combines transfer, IMAP, LMTP delivery, filtering, TLS, DNS, and operational checks.
• Configure Unbound as a LAN resolver provides validating recursive DNS to a controlled network without disrupting local resolver ownership.
• Set up WordPress deploys WordPress with httpd, PHP-FPM, and MariaDB.
• Configure web services covers httpd, ACME TLS, FastCGI, reverse proxying, and related services.
• Serve websites with httpd covers static sites, virtual hosts, FastCGI, and ACME-managed TLS.
• Build reverse proxies with relayd covers TLS termination, backend health checks, protocols, and forwarding policy.
• Configure name services covers authoritative and recursive DNS.
• Serve authoritative DNS with NSD covers zone configuration, validation, delegation, and service operation.
• Configure mail services covers OpenSMTPD and related mail components.
• Relay outgoing mail through a smarthost remains in the mail reference because provider authentication and rewriting policy are part of the same service contract.
• Configure file services covers NFS, Samba, and file transfer.
• Share files with NFS remains in the file-services reference, including exports, client mounts, and controlled-network boundaries.

Security, Maintenance, and Recovery #

• Establish a conservative security baseline reduces unnecessary authority and exposure while preserving updates, monitoring, and recovery.
• Monitor an OpenBSD system establishes resource, service, sensor, log, maintenance-mail, and update checks.
• Collect OpenBSD diagnostic evidence gathers focused hardware, kernel, service, network, storage, package, and log context without indiscriminate disclosure.
• Troubleshoot package installation and update failures distinguishes unsupported releases, source overrides, mirror lag, package availability, version mismatches, and interrupted transactions.
• Schedule recurring maintenance uses cron and the daily scripts with explicit users, environment, overlap control, output mail, and missed-run handling.
• Back up and restore an OpenBSD system creates FFS dumps, tests restores, and configures /altroot as a local recovery copy.
• Configure softraid RAID1 creates, monitors, and rebuilds a mirror with explicit destructive-operation checks.
• Recover an OpenBSD system that does not boot separates boot-loader, kernel, filesystem, and multi-user configuration failures.
• Recover access and reset the root password uses authorized console access and single-user mode without assuming a fixed filesystem layout.
• Update and upgrade OpenBSD covers firmware, packages, errata patches, release upgrades, and -current.
• Manage storage covers disks, filesystems, encrypted volumes, softraid, backups, /altroot, and recovery tools.
• Configure the base system covers services, persistent settings, root mail, login classes, boot settings, and scheduled maintenance.

Automation, Software, and Virtualization #

• Manage OpenBSD with Ansible prepares managed nodes, Python, SSH, doas, inventory, packages, checks, and rollout boundaries.
• Build third-party software from ports uses a release-matched ports tree, supported flavors, package creation, verification, and cleanup.
• Build OpenBSD from source follows the kernel-before-userland build order with exact branch, reboot, merge, and recovery boundaries.
• Manage packages and ports covers the package-first workflow and maintenance boundaries.
• Create and network virtual machines with vmm covers OpenBSD’s native hypervisor.
• Plan a Docker workload migration to OpenBSD maps Linux container requirements to packages, service accounts, application restrictions, chroots, virtual machines, or a separate Linux host.

Board-specific ARM installation is not presented as one generic procedure. Support depends on the exact board, firmware, architecture, and OpenBSD release; consult the official platform page and INSTALL.arch file after identifying the exact hardware.