OpenBSD Handbook

    Theme
    • Part I. Install & Configure
      • Introduction to OpenBSD
      • Installing OpenBSD
      • The X Window System
      • Networking on OpenBSD
      • System Configuration
      • OpenBSD Basics
      • Managing Software: Packages and Ports
    • Part II. Daily Operations
      • OpenBSD Desktop Environments
      • Multimedia
      • Printing
      • Linux Compatibility
      • Windows Compatibility
      • Games
    • Part III. System Administration
      • Virtualization
      • Storage and File Systems
      • Updating and Upgrading
      • Localization
      • The OpenBSD Boot Process
      • Security
    • Part IV. Networking & Daemons
      • Services
        • Database
          • MariaDB
          • PostgreSQL
          • Redis
          • memcached
        • Directory
          • YP (NIS)
          • LDAP
        • File
          • NFS
          • Samba
        • FTP Services
          • ftpd
          • ProFTPD
          • vsftpd
          • Pure-FTPd
          • TFTP
        • Mail
          • OpenSMTPD Mail Server
          • Dovecot IMAP and POP3 Server
          • Postfix
          • Exim
          • Rspamd
        • Name
          • Unbound DNS Resolver
          • NSD Authoritative DNS Server
          • BIND DNS Server
        • Networking
          • OpenBGPD
          • rad
          • DHCP on OpenBSD
          • slaacd
        • Web
          • Apache HTTP Server
          • nginx Web Server
          • OpenBSD httpd Web Server
          • relayd Reverse Proxy
        • Logging
          • syslogd
        • Monitoring
          • SNMP
        • Remote Access
          • Audit OpenSSH
          • OpenSSH Server
        • File Synchronization
          • rsync
        • Messaging
          • RabbitMQ Message Broker
        • Time
          • NTP Time Synchronization
        • Load Balancing
          • Build Redundant Load-Balanced Gateways
          • Load Balance Services with NAT or DSR
          • Build an HA HTTPS Load Balancer
      • PF
        • pfctl cheat sheet
        • PF Anchors
        • PF Filter Rules
        • PF Forwarding
        • PF Lists and Macros
        • PF Load Balancing
        • PF Logging
        • PF NAT
        • PF Options
        • PF Policies
        • PF Shortcuts
        • PF Tables
      • Advanced Networking
        • High Availability and State Replication
        • Multi-WAN and Policy-Based Routing
        • VPN and Cryptographic Tunneling
        • Classic and Lightweight Tunnels
        • IPv6 at Scale
        • QoS and Traffic Shaping
        • MPLS and Label Distribution
        • Network Services at Scale
        • Virtualization and Host Networking
        • Large-Scale L2 and L3 Design
        • Telemetry, Logging, and Flow Export
        • Hardening and Operational Safety
        • Reference Architectures
        • Troubleshooting Playbooks
      • Serial Communication
    • Part V. Miscellaneous
      • Virtualization Cheat Sheet
      • OpenBSD Cheatsheet
      • How-to Guides
        • Installation and First Boot
          • Complete the First 30 Minutes After Installation
          • Check Hardware Compatibility Before Installing
          • Bootstrap Wi-Fi Firmware Without Ethernet
          • Run OpenBSD as a Virtual Machine Guest
          • Install OpenBSD on a VPS or Cloud Server
          • Install OpenBSD with Full-Disk Encryption
          • Dual-Boot OpenBSD on a UEFI System
          • Automate OpenBSD Installation with Autoinstall and PXE
        • Desktops and Laptops
          • Set Up OpenBSD as a Laptop or Workstation
          • Configure Laptop Power Management
          • Troubleshoot Web Browsers on OpenBSD
          • Use Plan 9 Tools on OpenBSD
          • Build a Minimal Desktop with suckless Tools
          • Install Z shell (zsh)
        • Networking and Remote Access
          • Create an Administrator Account with doas and SSH Keys
          • Configure Secure Remote Access with OpenSSH
          • Use FIDO Security Keys with OpenSSH
          • Configure Wi-Fi Roaming and Wired Failover
          • Troubleshoot PF, NAT, and Routing
          • Route Multiple VLANs with PF
          • Configure a Road-Warrior WireGuard VPN
          • Route IPv6 Networks without NAT
          • Test OpenBGPD with Two Providers
          • Unlock an Internal Service with an SSH Key
          • Build a Simple Router and Firewall
        • Servers and Services
          • Set Up WordPress on OpenBSD
          • Build a Mail Server with OpenSMTPD, Dovecot, and Rspamd
        • Security, Maintenance and Recovery
          • Establish a Conservative Security Baseline
          • Recover Access and Reset the Root Password
          • Collect OpenBSD Diagnostic Evidence
          • Troubleshoot Package Installation and Update Failures
          • Schedule Recurring Maintenance
          • Monitor an OpenBSD System
          • Back Up and Restore an OpenBSD System
          • Configure softraid RAID1
          • Recover an OpenBSD System That Does Not Boot
        • Building, Automation and Virtual Machines
          • Manage OpenBSD with Ansible
          • Build Third-Party Software from Ports
          • Build OpenBSD from Source
          • Plan a Docker Workload Migration to OpenBSD
      • OpenBSD for Linux Users
      • OpenBSD for FreeBSD Users
      • OpenBSD for macOS Users
    • OpenBSD FAQ
    • OpenBSD Architectures
      • OpenBSD Package Search
        • Synopsis
        • Install the Complete Base Sets
        • Confirm Graphics and Input
        • Select One Session Path
        • Configure a Graphical Login Only After Testing
        • Configure Networking
        • Verify Audio and Media Devices
        • Evaluate Power Management
        • Add Applications Conservatively
        • Establish Backups Before Daily Use

        Set Up OpenBSD as a Laptop or Workstation

        Synopsis #

        An OpenBSD workstation uses the base system, the Xenocara X Window System, firmware, and packages for the required applications. This guide covers setup in order, with links to the detailed installation, graphics, networking, multimedia, maintenance, and backup chapters.

        Hardware support varies by exact device and release. Complete Check Hardware Compatibility Before Installing before depending on a laptop’s wireless interface, graphics, suspend and resume, or external displays.

        Install the Complete Base Sets #

        For a general workstation, install all release sets, including the Xenocara sets. The official installation guidance recommends all sets for new users. Applications that do not display windows may still depend on libraries or fonts from the X sets.

        If X sets were omitted, boot the installed bsd.rd, choose (U)pgrade, and select the missing sets. Do not copy individual libraries from release archives into a running system.

        Follow Complete the First 30 Minutes After Installation before adding a desktop environment. This establishes current firmware, errata, packages, administrative access, and a known-good reboot.

        Confirm Graphics and Input #

        The base system includes the X server and window managers. OpenBSD currently starts fvwm(1) when no alternative X session is configured. The locally developed cwm(1) window manager is also included in the base system.

        The recommended way to start X is the base xenodm(1) display manager. Configure the intended user session, enable xenodm, and keep a text console available during the first test.

        Confirm keyboard, pointing devices, native resolution, and every required display output. The X Window System chapter contains detailed session configuration and troubleshooting.

        Select One Session Path #

        Use either a base window manager or one packaged desktop environment as the initial configuration. Installing several full desktop environments at once makes session and service failures harder to isolate.

        Search available packages with pkg_info(1) and install the selected package with pkg_add(1) . Package names and required services can change between releases, so consult the package README installed under /usr/local/share/doc/pkg-readmes/ before enabling services or editing login classes.

        pkg_info -Q xfce
        doas pkg_add xfce
        less /usr/local/share/doc/pkg-readmes/xfce
        

        Use the package name and README path reported for the installed release. The graphical environments chapter documents the supported session choices in more detail.

        Configure a Graphical Login Only After Testing #

        Enable xenodm after selecting and configuring the intended session.

        doas rcctl enable xenodm
        doas rcctl start xenodm
        

        Keep a text console available while testing. A failed session normally returns to the display manager; switching to a virtual terminal permits inspection of ~/.xsession-errors and system logs.

        Configure Networking #

        For a single wireless network, store the join and address-configuration lines in the interface’s /etc/hostname.if file. For several known networks, add multiple join lines as an auto-join credential list. Candidate selection considers security and signal quality rather than line order. Protect files that contain WPA keys.

        Use the networking chapter for interface configuration and the wireless firmware guide when the adapter cannot be used before firmware installation. Verify the full path, not only association:

        ifconfig
        route -n show
        host openbsd.org
        

        Verify Audio and Media Devices #

        Test base audio before installing a large media stack. sndioctl(1) displays and changes audio controls, while audioctl(8) reports device parameters.

        sndioctl
        audioctl
        

        OpenBSD applies privacy controls to audio recording and video devices. Grant access only to applications and users that require it. Configure Multimedia on OpenBSD describes audio, microphone, webcam, and recording configuration, while Troubleshoot Web Browsers isolates profile, sandbox, graphics, and conferencing failures.

        Evaluate Power Management #

        Use apm(8) to inspect battery and AC state where supported.

        apm
        

        Test suspend and resume repeatedly before relying on the machine for unsaved work. Include the following conditions in the test:

        • battery and AC power;
        • lid close and explicit suspend;
        • wireless reconnection;
        • audio after resume;
        • each required external display;
        • encrypted storage, if used.

        Hardware that boots successfully can still have incomplete suspend, backlight, or display support. Configure Laptop Power Management provides the complete apmd, suspend, lid-action, verification, and recovery workflow. Preserve a complete dmesg from both a clean boot and a resumed session when reporting a failure.

        Add Applications Conservatively #

        Install applications in small groups and read each relevant package README. Avoid raising login-class limits or changing kernel parameters merely because a guide for another operating system recommends it. Apply a limit change only when the OpenBSD package README or a reproducible failure establishes the requirement.

        Use pkg_add(1) to keep packages current:

        doas pkg_add -u
        

        Base-system errata and release upgrades remain separate operations, described in the updating and upgrading chapter .

        Apply Establish a Conservative Security Baseline after the required workstation services and applications are known. Check service dependencies before disabling daemons or adding permissions to solve an application problem.

        Establish Backups Before Daily Use #

        Back up user data and locally maintained configuration before the workstation becomes the only copy. A useful plan includes:

        • /home and other user-data filesystems;
        • locally changed files under /etc;
        • package and service configuration under /usr/local and /etc;
        • browser profiles and authentication material, subject to encryption and access controls;
        • an independently stored record of disk encryption and recovery requirements.

        Test restoration of selected files. A backup that has never been read is not a verified recovery method. The storage chapter covers OpenBSD backup tools and storage layouts.

        Report a bug
        • Synopsis
        • Install the Complete Base Sets
        • Confirm Graphics and Input
        • Select One Session Path
        • Configure a Graphical Login Only After Testing
        • Configure Networking
        • Verify Audio and Media Devices
        • Evaluate Power Management
        • Add Applications Conservatively
        • Establish Backups Before Daily Use