OpenBSD FAQ: System Management

Most daemons and services that come with OpenBSD are controlled on boot by variables defined in /etc/rc.conf. You'll see lines similar to this:

Do not alter rc.conf(8) directly. Instead, use the rcctl(8) utility to maintain the /etc/rc.conf.local file. This makes future upgrades easier as all the changes are in the one file that isn't touched during upgrade.

Executing Commands as Another User

For example, if appropriately configured, the following command would display root's crontab(5) file:

Editing the Password File

Always use vipw(8) to edit the password file. After you are done editing, it will first sanity check the changes, then recreate /etc/passwd and the password databases, and finally install the copy in place of the original /etc/master.passwd file.

Resetting the Root Password

Clock Syncing

To use OpenNTPD as a server, add a listen on * line to ntpd.conf(5) file and restart the daemon. You can also instruct it to only listen on a specific address or interface.

When you have ntpd(8) listening, other machines may not be able to synchronize their clocks right away. This is because time information won't be served until the local clock is synced with a reasonable level of stability. Once this level is reached, a "clock is now synced" message will appear in /var/log/daemon.

Time Zones

If having the hardware clock set to UTC is a problem, you can change the default behavior of OpenBSD via sysctl.conf(5). For example, put the following in /etc/sysctl.conf to configure OpenBSD to use a hardware clock set to US Eastern Standard Time (5 hours behind UTC, so minus 300 minutes):

Note that the hardware clock must already be running at the desired offset before booting OpenBSD with the above configuration or the system time will be incorrectly adjusted at boot.

Normally, the time zone is set during install. If you have need to change the time zone, you can create a new symbolic link to the appropriate time zone file in /usr/share/zoneinfo. For example, to set the machine to use EST5EDT as the new local time zone:

Character Sets and Localization

To use the Unicode character set in UTF-8 encoding wherever supported, set the LC_CTYPE environment variable to the value en_US.UTF-8:

The OpenBSD base system completely ignores all locale-related environment variables except LC_CTYPE; even LC_ALL and LANG only affect the character encoding. Some ports may respect other LC_* variables, but using them or setting LC_CTYPE to any value other than C, POSIX or en_US.UTF-8 is not recommended.

Symmetric Multithreading, or "Why are only half of my CPUs used?"

This feature can improve performance for some workloads but reduces it for others.

SMT has been involved in various CPU vulnerabilities, in particular relating to speculative execution. This can result in processes learning information about other processes which they should not have access to. To mitigate this, OpenBSD disables running code on detected SMT "virtual" cores by default.

They can be reenabled by setting the sysctl hw.smt to 1, however doing so is generally not recommended.

Using S/Key

Setting Up S/Key

Generating S/Key Passwords

Using S/Key to Log In

Directory Services

Of course, you could use various directory services on OpenBSD. But YP is the only one that can be accessed directly using standard C-library functions like getpwent(3), getgrent(3), gethostbyname(3) and so on. Thus, if you keep your data in a YP database, you do not need to copy it to local configuration files like master.passwd(5) before you can use it, for example to authenticate system users.

YP is a directory service compatible with Sun Microsystems NIS (Network Information System). See yp(8) for an overview of the available manual pages. Be careful, some operating systems contain directory services bearing similar names but all the same being incompatible, for example NIS+.

To use directory services other than YP, you either need to populate local configuration files from the directory, or you need a YP frontend to the directory. For example, you can use the sysutils/login_ldap port when you choose the former, while the ypldap(8) daemon provides the latter.

For some applications, simply synchronizing a small number of configuration files among a group of machines using tools like rdist(1), cron(8), scp(1) or rsync (available from ports) constitutes an easy and robust alternative to a full-blown directory service.

YP Security Considerations

Thus, before setting up any YP server, you should consider whether these inherent security flaws are acceptable in your context. In particular, YP is inadequate if potential attackers have physical access to your network. Anybody gaining root access to any computer connected to your network segments carrying YP traffic can bind your YP domain and retrieve its data. In some cases, passing YP traffic through SSL or IPsec tunnels might be an option.

Setting Up a YP Server

Use the domainname(1) utility to set the domain name, and put it into the defaultdomain(5) file to have it automatically set at system startup time.

Decide where to store the source files to generate your YP maps from. Keeping the server configuration separate from the served configuration helps to control which information will be served and which won't, so the default /etc often isn't the best choice.

The only inconvenience caused by changing the source directory is that you will not be able to add, remove and modify users and groups in the YP domain using utilities like user(8) and group(8). Instead, you will have to edit the configuration files with a text editor.

To define the source directory, edit the file /var/yp/`domainname`/Makefile and change the DIR variable, e.g.

For example, even in case you use the default source directory /etc, you do not usually need all accounts and groups existing on the server on all your client hosts. In particular, not serving the root account and thus keeping root's password hash confidential is often beneficial to security. Review the values of MINUID, MAXUID, MINGID and MAXGID and adjust them to you needs.

If all your YP clients run OpenBSD or FreeBSD, exclude the encrypted passwords from the passwd maps by setting UNSECURE="" in /var/yp/`domainname`/Makefile.

The former practice of editing the template file /var/yp/Makefile.yp is no longer recommended. Changes to that file affect all domains initialized after the change, but do not affect domains initialized before the change, so this is error-prone either way: You both risk that the intended changes do not take effect, and you risk to forget about them and have them affect other domains later which they were never intended for.

Create the source directory and populate it with the configuration files you need. See Makefile.yp(8) to learn which YP maps require which source files. For the format of the individual configuration files, refer to passwd(5), group(5), hosts(5) and so on, and look at the examples in /etc.

YP uses rpc(3) (remote procedure calls) to communicate with clients, so it is necessary to enable portmap(8). To do so, use rcctl(8).

Setting Up a YP Client

The second part of configuring a YP client involves editing local configuration files such that certain YP maps get used by various system facilities. Not all servers serve all standard maps supported by the operating system, some servers serve additional non-standard maps, and you are by no means compelled to use all those maps. Which of the available maps shall or shall not be used, and for which purposes they shall be used, is fully at the discretion of the client host's system administrator.

If you want to include all user accounts from the YP domain, append the default YP marker to the master password file and rebuild the password database:

If you want to include all groups from the YP domain, append the default YP marker to the group file: