Install OpenBSD

A minimal OpenBSD on the firewall, reachable over SSH from the admin laptop, with doas and forwarding.

Why Firewall, on the tour

On this page 7 sections

1. Download and verify the installer
2. Write it to the USB stick
3. Install
4. Log in from the laptop
5. doas, for your admin user
6. Let it route
7. Optional: keep a shell history

This chapter installs a minimal OpenBSD, with nothing but the base system, from the USB stick and without any internet connection. The installer sets up only the admin port, so from the first boot you work over SSH from your laptop. Everything later is configured in plain text files under /etc.

Leave the WAN port unplugged for now. The firewall goes online in chapter 3, once SSH is locked down to the admin network.

1. Download and verify the installer#

Download the installer image for amd64, and the SHA256 file from the same folder, then check the image before writing it. (The OpenBSD FAQ lists other mirrors.)

laptop

cd ~/Downloads
curl -O https://cdn.openbsd.org/pub/OpenBSD/8.0/amd64/install80.img
curl -O https://cdn.openbsd.org/pub/OpenBSD/8.0/amd64/SHA256
shasum -a 256 install80.img
grep install80.img SHA256

Check

The two long numbers are the same. On an OpenBSD machine, signify -C checks the file's signature as well, which is better still.

2. Write it to the USB stick#

laptop (macOS)

diskutil list                                   # find the stick, e.g. /dev/disk4
diskutil unmountDisk /dev/disk4
sudo dd if=install80.img of=/dev/rdisk4 bs=1m

Check the size in diskutil list to be sure you have the stick, not another disk. dd prints nothing until it is done. If macOS then says the disk is not readable, choose Ignore.

3. Install#

Connect the screen, the keyboard and the stick, boot from the stick, and choose (I)nstall. The installer asks in this order; the answers that matter:

Question	Answer
System hostname	`fw`
Network interface to configure	`igc1`, the admin port: IPv4 address `192.168.1.1`, netmask `255.255.255.0`, IPv6 `none`. Then `done`; the other ports come in chapter 3.
Default IPv4 route	`none`
DNS domain name	`internal`
DNS nameservers	`none`: there is no internet yet
Password for root	a strong one. You need it once, to set up doas below.
Start sshd by default	yes
X Window System	no
Setup a user	your admin user: this is `@ADMIN_USER@`
Allow root ssh login	no
Time zone	yours, for example `Europe/Stockholm`
Root disk	the internal disk (here `sd0`; the stick is the other one)
Encrypt the root disk	no
Disk layout	whole disk, automatic layout
Location of sets	`disk`. Already mounted: `no`. The disk with the install media: the stick (here `sd1`), partition `a`. Pathname: `8.0/amd64`
Sets	type `-game* -x*` to leave out the games and X, then `done`

When it is done, choose reboot and remove the stick.

4. Log in from the laptop#

Connect the laptop to igc1. There is no DHCP yet, so give its wired port 192.168.1.10, netmask 255.255.255.0, by hand, and leave the router empty. (On a Mac: System Settings, Network, the wired adapter, Details, TCP/IP, Configure IPv4: Manually.)

laptop

ssh @ADMIN_USER@@192.168.1.1

Check

It asks to trust the firewall's host key, then for your password, and you get the fw$ prompt. From here on, everything happens over SSH.

5. doas, for your admin user#

The installer added your user to the wheel group. This lets the group run commands as root, asking for the password once in a while. Become root once with su - (the root password) to set it up:

/etc/doas.confDownload

permit persist :wheel

firewall

su -
echo 'permit persist :wheel' > /etc/doas.conf
chmod 0600 /etc/doas.conf

6. Let it route#

/etc/sysctl.confDownload

net.inet.ip.forwarding=1
net.inet6.ip6.forwarding=0

The first line makes it a router. The second keeps IPv6 off: this network is IPv4 only, and pf drops IPv6.

firewall

printf 'net.inet.ip.forwarding=1\nnet.inet6.ip6.forwarding=0\n' > /etc/sysctl.conf
sysctl net.inet.ip.forwarding=1
exit

Check

firewall

doas id
sysctl net.inet.ip.forwarding

Back as your user: doas asks for your password and answers uid=0(root), and forwarding is 1.

7. Optional: keep a shell history#

OpenBSD's shell, ksh, keeps its history only in memory unless it is given a file. This keeps it, and turns on the arrow keys and Ctrl-R search:

firewall

cat >> ~/.profile <<'EOF'
export HISTFILE=$HOME/.ksh_history
export HISTSIZE=10000
set -o emacs
EOF

Check

After logging out and in again, history | tail shows your recent commands. Every SSH session writes to the same file as it goes.