OpenBSD for Linux Users

Synopsis #

This chapter maps common Linux administration tasks to OpenBSD. For installation, see Installing OpenBSD .

Base system and packages #

OpenBSD consists of two parts: base, installed from OpenBSD’s file sets, and packages, added afterward. The file sets selected in the installer determine which parts of base are installed.

Base: the installer file sets #

Base is built and released as one system, divided into these files and sets:

The kernel and base set provide a command-line system that can serve SSH connections, filter network traffic, resolve or serve DNS, and host a static website. The comp set adds tools for building software.

The four X sets provide the graphical foundation. Desktop environments such as KDE Plasma and Xfce, and applications such as Firefox, are installed as packages on top of it.

OpenBSD recommends installing all standard sets, including the X sets: some applications use X libraries even without a graphical display. See Installing OpenBSD for set selection.

Packages: software added to base #

Packages add applications such as KDE Plasma, Firefox, Python, and MariaDB, or alternatives to base tools such as Bash, Vim, and nginx. They are built from the ports tree and usually install under /usr/local.

The pkg_* tools manage this additional software:

• pkg_add installs and updates packages.
• pkg_delete removes packages.
• pkg_info lists and queries installed packages.

These tools do not manage the installer file sets or the programs they contain. For example, pkg_info lists an installed nginx package but not the system’s httpd. To obtain or update base tools such as doas or httpd, use the base installation and maintenance tools rather than looking for a separate package.

Maintaining both parts #

For a release installation, update both layers:

Running syspatch does not update Firefox, nginx, or other packages. Running pkg_add -u does not patch the kernel, OpenSSH, or other base components.

For a release upgrade, follow Upgrading OpenBSD : upgrade base, reboot into the new release, then update packages with doas pkg_add -u.

Shells #

The default shell is ksh(1) . Commands that use Bash-specific syntax need Bash or must be adapted for ksh. Changing the login shell does not change the interpreter selected by a script’s #! line.

Bash and Zsh are available as packages. To use Bash for future logins:

doas pkg_add bash
chsh -s /usr/local/bin/bash

Keep root’s shell as /bin/ksh so it remains available when /usr/local is not mounted.

Privilege escalation: doas (instead of sudo) #

doas(1) lets a regular account run individual commands as root. Rules in /etc/doas.conf determine which users and commands are allowed.

Follow Create an Administrative Account to configure access, then prefix administrative commands with doas. It is included in base; sudo is available as a package.

Software management #

Installing a package records its files and dependencies in the local package database. pkg_add(1) and pkg_delete(1) maintain those records; pkg_info(1) uses them to answer questions about installed software.

For software not yet installed, query the repository or a package-file index as described below. See Managing Software: Packages and Ports for details.

Package-manager equivalents #

Replace name with a package name.

Package names can differ from those used by Linux distributions. pkg_info -Q searches repository package names, while apt search and dnf search also search descriptions. Use the package search when the name is unknown.

The package tools query the repository directly, so there is no separate apt update step. For example, search for and install rsync:

pkg_info -Q rsync
doas pkg_add rsync

Some applications have several versions or flavors, such as builds with different features. If the name matches more than one choice, pkg_add prompts for a selection.

Find which package provides a command or file #

The local package database can identify a file’s owner only if its package is installed:

pkg_info -E /usr/local/bin/rsync

Base files have no entry in this database, so this query does not identify their owner.

To search files in available packages, install pkglocatedb and use pkg_locate. This corresponds to apt-file search or filename searches with dnf provides (yum whatprovides):

doas pkg_add pkglocatedb
pkg_locate bin/urxvt

This is a separate index of package contents, updated through pkglocatedb package updates. It searches file paths, not RPM-style virtual capabilities.

For an online lookup, use the File field at OpenPorts .

Dependencies, removal, and package instructions #

pkg_add distinguishes packages requested explicitly from dependencies installed to support them. Dependencies are installed automatically. To see which installed packages require rsync:

pkg_info -R rsync

Removing an application can leave dependencies behind. Like apt autoremove or dnf autoremove, pkg_delete -a removes packages no longer needed by any manually installed package. Preview the list with doas pkg_delete -an, then remove them with doas pkg_delete -a.

Unlike apt purge, pkg_delete -c removes only the extra configuration files, users, and groups declared in the package’s packing list.

Installation supplies the files, but a server package may still need a database, configuration, or an enabled service. Read its instructions in /usr/local/share/doc/pkg-readmes/; pkg_info -M name redisplays its installation message.

Updating (same release) #

Within a release, syspatch(8) applies available binary fixes to base, while pkg_add -u updates installed packages. Run both as shown under Maintaining both parts ; neither upgrades to a newer OpenBSD release.

Upgrading (to a new release) #

A release upgrade replaces base with the next release using sysupgrade(8) . Packages must then be updated for that release. Follow Upgrading OpenBSD for the complete sequence and release-specific configuration changes.

Networking #

OpenBSD keeps persistent network settings in text files read at boot. Interface addresses, the default route, the hostname, and DNS settings are configured separately. Changes made directly with ifconfig(8) affect the running system but do not update those files.

Interface names identify the driver and unit number, such as re0 or em0. Use ifconfig to find the actual name before creating its configuration file. See Networking on OpenBSD for wireless and other configurations.

Interface configuration with hostname.if #

Each interface has a hostname.if(5) file, where if is the full interface name. For example, /etc/hostname.re0 can request IPv4 configuration through DHCP and IPv6 configuration through router advertisements:

inet autoconf
inet6 autoconf

These mechanisms can supply addresses, default routes, and DNS servers. For a static IPv4 address instead, replace the inet autoconf line with:

inet 10.0.0.100 255.255.255.0

With static addressing, configure a gateway and DNS servers separately, as described below.

netstart(8) reads the saved settings at boot. To apply this interface’s file now:

doas sh /etc/netstart re0

Reconfiguring an interface can interrupt connections through it, including SSH.

Hostname #

The system hostname is stored in myname(5) (/etc/myname):

host.example.com

This takes effect at boot. To change the running hostname as well, use hostname(1) :

doas hostname host.example.com

Default gateway #

The default gateway carries traffic beyond the local network. When automatic configuration supplies it, no /etc/mygate entry is needed. For a static IPv4 setup, put the gateway in mygate(5) (/etc/mygate):

10.0.0.1

Run doas sh /etc/netstart to apply the saved interface and gateway settings together.

DNS resolvers #

DNS is separate from addressing and routing: a host can reach an IP address yet fail to resolve a name. resolvd(8) writes learned DNS servers to resolv.conf(5) (/etc/resolv.conf) and preserves user-added lines.

For a network without automatically supplied DNS, add its resolver address:

nameserver 192.0.2.1

Daemons and startup #

OpenBSD starts services through rc scripts rather than systemd units. Base and package daemons are managed through rcctl(8) , which saves local startup settings in /etc/rc.conf.local.

Enabling a daemon makes it start at boot; starting it runs it now. These are separate actions. After configuring httpd , enable and start it:

doas rcctl enable httpd
doas rcctl start httpd

Likewise, rcctl stop stops a daemon now, while rcctl disable removes it from startup. Use rcctl reload after configuration changes when the daemon supports reloading, or rcctl restart to stop and start it.

Hardware command equivalents #

OpenBSD reports detected hardware and attached drivers in dmesg(8) . Start there to find the driver name, then read its manual page for supported hardware and any firmware requirements. The following commands list devices by bus: