Introduction to OpenBSD

Synopsis #

OpenBSD is a Unix-like operating system developed with an emphasis on code correctness, security, and permissive licensing. This chapter covers the project’s background, release model, documentation, and common uses. Continue to installation or configuration for setup instructions.

Historical Background #

OpenBSD began in 1995 as a fork of NetBSD. The project was founded by Theo de Raadt after his departure from the NetBSD core team. Development emphasizes public review, code quality, and security.

OpenBSD has focused on code correctness, security audits, regular releases, and permissive licensing since its early development. Other operating systems have adopted several of its security technologies.

The OpenBSD project is headquartered in Calgary, Alberta, Canada, but maintains a global developer community that collaborates through CVS and mailing lists. The project’s motto, “Secure by default,” reflects its mission to ship an operating system with secure defaults and minimal attack surface.

Project Goals and Development Model #

The project emphasizes code correctness, portability, security, and maintainability.

Development is coordinated through a central CVS repository. Developers submit patches for review before they are added. Daily snapshots and semi-annual releases are produced from this repository. The source and change history are publicly accessible.

Unlike distributions that assemble packages from external sources, OpenBSD provides a coherent base system with consistent interfaces and documentation. Users are expected to consult the manual pages for detailed technical behavior. These pages are maintained with the same care as the code.

Release Process #

OpenBSD follows an approximately six-month release cycle. Publication dates can vary. Releases are named numerically, such as 8.0, and are considered stable for production use.

Each release is supported with binary security patches for approximately one year. Patches are distributed using syspatch(8) and are available for supported architectures only. Daily snapshots are also produced for those who wish to follow development more closely.

Features that are not ready for a release are deferred.

Licensing and Code Reuse #

OpenBSD favors permissive software licenses, such as the ISC license and BSD license. The project explicitly avoids incorporating code under the GNU General Public License (GPL) whenever possible. Permissive licenses allow reuse under their stated terms.

The kernel, base utilities, libraries, and core services are developed and released together. Additional applications are installed separately through packages.

Code from OpenBSD is used widely in other systems. Notable examples include the adoption of pf(4) in FreeBSD, the use of OpenSSH across nearly all UNIX-like platforms, and the integration of OpenBSD’s malloc(3) implementation in various environments.

Supported Architectures #

OpenBSD places a strong emphasis on portability and supports a wide range of hardware architectures . As of the current release, the officially supported platforms include amd64 , arm64 , macppc , riscv64 , and several others. Each supported platform must successfully complete full system builds, regression tests, and boot validation prior to release.

Architectures are added or retired based on hardware availability, developer interest, and build quality.

Security Philosophy #

Security work in OpenBSD is part of system design and development. The project proactively addresses potential classes of vulnerabilities through code auditing, compiler-based mitigation, and system call restrictions.

Several features have originated in OpenBSD, including:

• W^X memory protection, which enforces non-executable writable memory regions
• pledge(2) and unveil(2) , which restrict process capabilities and file system access
• Integrated cryptographic support in the kernel and userland
• Packet filtering with pf(4) and rules set by the administrator
• Secure memory allocation routines in libc

The default PF rules include a general pass rule. To block traffic by default, configure a default-deny ruleset .

Security features are typically enabled by default. For example, userland binaries are compiled with stack protection, ASLR is enabled across supported platforms, and the default install enables only essential services.

Documentation and Manual Pages #

The primary source of documentation in OpenBSD is the manual page system . Every utility, system call, configuration file, and daemon is documented in a consistent and well-maintained format.

Manual pages are categorized by section. For instance, rcctl(8) documents service management , while vm.conf(5) describes the configuration file format for virtual machines . When conflicting information arises, the manual pages are considered the authoritative reference.

The OpenBSD Handbook adds explanations and step-by-step guidance to the manual pages. Read both, and check commands and options against the source when needed.

Community and Support #

OpenBSD developers and users communicate primarily through mailing lists. The project does not operate official forums or user-facing support infrastructure. Instead, communication takes place on mailing lists such as misc@openbsd.org and in real-time on IRC channels like #openbsd on Libera.Chat.

Questions are expected to be specific, well-researched, and accompanied by relevant system output . Include enough information for others to reproduce the problem.

Bug tracking is conducted via mailing lists, not web-based trackers. Patches and problem reports should be submitted in plain text, and developers may respond directly with requests for clarification or additional diagnostics.

OpenBSD encourages users to audit, understand, and contribute to the system. All code is publicly accessible, and contributions are welcomed if they align with the project’s goals.

Use Cases #

Common uses include:

• Internet Services: OpenBSD is often used to provide core Internet-facing services. These include:

  • Web servers using httpd(8) or relayd(8)
  • Mail servers using smtpd(8)
  • DNS resolvers and authoritative name servers with nsd(8) and unbound(8)
  • Secure file transfers using sftp(1) , scp(1) , or rsync over SSH
  • VPN endpoints using ipsecctl(8) or iked(8)

• Network Infrastructure: OpenBSD is used as a foundation for reliable and maintainable routing systems:

  • BGP routing using OpenBGPD
  • OSPF and RIP routing via ospfd(8) and ripd(8)
  • High-availability clusters using carp(4)
  • Load balancing and proxying with relayd(8)
  • NAT gateways and packet filtering using pf(4)

• Firewalls and Gateways: Many deploy OpenBSD as a hardened perimeter system:

  • Stateful firewalling with pf(4)
  • NAT and port redirection
  • DHCP and DNS relay services (dhcrelay(8) and unbound(8) )
  • Traffic shaping and filtering

• Development and Testing: OpenBSD is frequently used by software developers who require a reproducible and minimal environment. It offers:

  • A base system with an integrated compiler and standard development tools
  • A clean C-based userland and compiler toolchain
  • Safe defaults and strong user-space isolation using pledge(2) and unveil(2)

• Research and Education: OpenBSD provides a fully auditable and cohesive system for:

  • Operating systems research and kernel instrumentation
  • Secure software design studies
  • Network protocol experimentation
  • Systems programming and C language education

• Appliances and Headless Systems: OpenBSD can run network appliances and systems administered through a serial console or SSH.

For workstation use, see X11 , sound devices , and wireless networking . Check hardware and application support before choosing a system.