Security Adviser | Roger A. Grimes | InfoWorld | Installing OpenBSD for the first time | December 30, 2006 11:29 AM

MORE ENTRIES

Installing OpenBSD for the first time

December 30, 2006 | Comments: (0)

Installing OpenBSD for the first time

Step-by-step instructions for installing OpenBSD 4.0 for Windows admins trying to do it for the first time.

I’ve already had a lot of positive feedback on my support for OpenBSD in my recent column.

About half the mail is from Windows users interested in trying OpenBSD for the first time. I’m thrilled more people want to try it. If you want to play with it for the first time, I suggest installing it on an available PC or using VMware (or one of the other suitable virtual host applications). If you use an available PC, make life easy and don’t try a dual boot scenario. It works, but it is probably more problematic than the entire rest of the install. I know dozens of friends who simply gave up trying to install BSD or Linux just because of the dual-boot questions and problems. Install it on an available PC or in a VM instead.

There are dozens of ways to install OpenBSD. The following tasks will help you install OpenBSD on an i386-compatible computer for the first time, using one of the most common scenarios:

1. First you’ll need to download all of OpenBSD or a bootable OpenBSD installer. The latter is more common.
2. You can download a bootable installer from www.openbsd.org or any of the mirror sites, or pay $50 for the complete CD-ROMs.
3. If you want to download it for free start at www.openbsd.org and click on the Getting Releases link.
4. Select your download type (e.g. http, ftp, etc.) and select a download mirror site.
5. Navigate to the download directory of /pub/OpenBSD/4.0
6. Most people will want to install OpenBSD on an IBM/Intel/Windows-compatible computer. If so, choose the i386 folder (i.e. /pub/OpenBSD/4.0/i386)
7. Now you can choose what type of OpenBSD file (or set) to download.
8. Choose and download cd40.iso. It is a cd-rom bootable image of OpenBSD. Burn it to a CD-ROM. If you don’t have burner software, download the excellent, and free, CDBurner XP Pro.
9. If you want to install OpenBSD in VMWare, start the VMware workstation wizard and choose Other as the guest OS type, and then choose FreeBSD. It’s close enough. Choose a 1-4GB partition, 256 MB of RAM, and the appropriate networking (e.g. bridged). You need to be connected to the Internet in order to download the complete OpenBSD software (called “sets”), so make sure your VMWare guest machine networking works.Start the VMWare guest install booting up on the OpenBSD burned install CD-ROM.
10. Or if not using VMware, just boot up on the OpenBSD install CD-ROM.
11. Eventually OpenBSD will ask you for what type of install, choose Install.
12. Hit ENTER to choose the VT220 terminal type when prompted.
13. Hit ENTER to accept the default keybd mapping.
14. Reply yes to proceed with the install.
15. OpenBSD will detect your available hard drives. SCSI drives will be labeled something like sd0 or sd1. IDE drives will be labeled something like rwd0 or wd0. The r is for raw mode, the wd for IDE and the number for the number of the found drive.
16. You will probably be installing OpenBSD on wd0. Say yes when prompted to install OpenBSD on all of wd0.
17. Soon you should be in the OpenBSD disk partitioning program, called disklabel (although usually you won’t see that name anywhere).
18. You should be at a > prompt.
19. You can type in p and hit ENTER to list your partitions.
20. Normally you’ll see an a and c partition.
21. Type in d and hit ENTER to delete a partition. Type in a for the partition to delete.
22. Then type in a to add a partition. Just hit ENTER to accept the default offset value. This will be your main partition. Type in something like 1000M to make a 1GB main partition and hit ENTER. Accept the FS type of 4.2BSD. If asked for a mount point type in /.
23. Type in a to add another partition. This will be the swap partition. Accept the defaults, except make a size equal to twice your RAM (e.g. 512M) and make the FS type swap.
24. Type in q to quit the disklabel program and choose y to write new values.
25. You will then be prompted to set host name and a bunch of standard networking parameters. To make life easy, choose dhcp if you have a dhcp server and take all the defaults.
26. You’ll be prompted twice to enter in the root password. Do so and hit ENTER.
27. Eventually, you’ll be asked to download the OpenBSD sets. These are the OpenBSD programs. To make life easy, just say all and hit ENTER.
28. Then you’ll be prompted to give OpenBSD the download location. You can put in the same place as you download the install file from. If in doubt, try http for the first value and hit ENTER.
29. Type in a proxy server name and IP information if needed.
30. Type in the download site’s host name (e.g. mirrors.24-7-solutions.net) and hit ENTER. Don’t put in the http:// part here or else it will duplicate.
31. When prompted for the host download location type in /pub/OpenBSD/4.0/i386 or something validly similar. Hitting ENTER should result in the sets downloading and installing.
32. When finished, it will prompt you for more sets again, and you can say done this time and hit ENTER (don’t take the default).
33. Say yes to start sshd(8) by default.
34. You can choose whether or not to start the ntpd (network time protocol daemon).
35. You can choose whether or not to start the X Windows system, but most Windows people like me do. It is required for most GUIs and required for some other non-GUI programs. The default is no.
36. When prompted to change the default console to Com0, say no.
37. OpenBSD will then save the new settings.
38. When prompted, put in the correct time zone (e.g.EST). You can type in ? to choose among various options. If you are going to run security devices, consider using UTC (universal coordinated time), so that logs you create can be discussed through multiple time zones. After hitting ENTER, OpenBSD will be ready to go.
39. Type in reboot and hit ENTER. Restart and enjoy.

Of course, don’t forget that Google is your best friend. www.openbsd.org has many great mailing lists and discussion groups. However, research and read all you can before you ask a question. They don’t suffer newbies lightly. If you’re new to Linux and/or OpenBSD buy one of the many books as a good, solid starting place. My favorite book is Absolute OpenBSD: Unix for the Practical Paranoid (by Michael W. Lucas from No Starch Press). Addison Wesley publishes another good secondary book called Secure Architectures with OpenBSD (by Palmer and Nazario) and if you’re interested in the PF firewall mainly, try The OpenBSD PF Packet Filter Book edited by Reed.

Posted by Roger Grimes on December 30, 2006 11:29 AM

RATE THIS ARTICLE:

COMMENTS

The partitioning step is the most painful part; hopefully they will improve this.

The choice of video drivers also leaved something to be desired. This is also a sore spot in Linux land, where video card manufacturers want to keep their drivers top secret, because of competition.

But I think ISPs will be looking at this more and more as a Tomcat and/or Glassfish hosting platform, especially when JVMs start getting ported to it, thanks to Sun Open Sourcing Java. Up until now, there has been a schism between Sun and de Raddt (I believed Sun didn't accord him as much respect as they could have, because he didn't command a lot of marketshare as of yet).

Would make a great platform for Asterisk and messaging too.

But you can't expect the latest and greatest releases of packages, because of the lag time with Open BSD's code review process (that's a security cost you have to figure in, if you are going to use it in your projects...)

Posted by: Security Appraisers at December 30, 2006 02:34 PM

Yes, you can expect the latest (which doesn't mean greatest) packages. Packages are 3rd party software, not part of the OS, and as such are not audited. And JVMs have already been ported to it for a long time, including Sun's jdks, 1.3, 1.4 and 1.5 are all available in the ports tree. The "schism" between sun and openbsd is that sun lies and pretends they are open, yet they refuse to release docs for their hardware, making openbsd's support of ultrasparc III chipsets perform far worse than it should.

Posted by: Doug at December 31, 2006 12:36 PM

Where can I find the JDK 1.5? I just looked under:

ftp://ftp.openbsd.org/pub/OpenBSD/4.0/packages/i386/

and could not find it.

I had heard wrong then on the reason for the delay; I thought packages posted on openbsd.com were audited (at least in some rudimentary way...)

As for the lag time of releases: I see asterisk-1.2.9.1p0.tgz, but not Asterisk 1.4

(cf., http://www.isp-planet.com/news/2006/asterisk_1.4.html)

Don't take my observation on the lag time for package releases as a "dis"; I just wouldn't want newbies turned off on the distro because they had unrealistic expectations going in. Given time, I'm sure the lag time will close more; and also, given time, many won't need the latest and greatest packages (but, for example, treating Voice messages as IMAP is a nice feature I would like to have now; nonetheless, I know the 1.4 package will _eventually_ show up on OpenBSD...)

Maybe one can run Asterisk 1.4 in Linux emulation mode? Are there problems (in the case of Asterisk...) with doing that??

Posted by: Steve at January 1, 2007 09:00 AM

Potential new OpenBSD users would do themselves a big service by reading the excellent documentation. The FAQ is a good starting point, and the installation guide in particular is worth reading before starting. In general with this OS you are encouraged to do your own groundwork and the documentation leads people towards learning for themselves how to do things and why, rather than just asking that they follow a set of instructions without understanding them. If you want somebody to lead you by the hand all the way, this is not the OS for you, but if you're happy to put the work in, it's a great choice.

@Steve: Asterisk 1.4 is still pretty new, and if you look at the history of the software there have been some major fixes in early releases of a new branch (1.0, 1.2) before it settles down in later releases. The development OpenBSD ports tree does have the latest 1.2 release (1.2.14), 1.4 will follow later. For OpenBSD 4.0 the 1.2.9.1p1 package does fix the chan_skinny security vulnerability addressed by Asterisk 1.2.13 (generally only security fixes are made for third-party software packaged for a particular OpenBSD release; non-security updates are often just made available in development snapshots and -current, then available in the next OS release after more testing). You certainly shouldn't need Linux emulation to run Asterisk 1.4, it should compile from source without much effort, but if you want to keep the advantages of the packages framework you'll have to wait a while longer.

Incidentally Linux emulation does generally work pretty well; it's usually used for software provided without source code, such as Acrobat Reader, Opera, the great office apps from Softmaker (Textmaker and Planmaker), RealPlayer, etc. There's little point to running most open-source software under emulation though.

Java works well on OpenBSD; unfortunately Sun's current license prohibits uncertified binary packages from being distributed, so you have to build it yourself from ports. This used to be quite an effort but is comparatively painless now (if a little slow). There's hope for binary packages in the future; Sun have changed a couple of the components of Java SE to being licensed under GPL and stated their intention of changing the remaining unencumbered parts of the JDK during 2007 - when this is done (providing there's nothing critical that's encumbered and thus not GPL'd...), packages can be provided.

Posted by: sthen at January 1, 2007 04:33 PM

You can find the jdks in the ports tree like I said. Sun does not allow the distribution of binary packages of their jdks, so you can't just pkg_add them, you have to download the source, download the patch set and then build it from ports. Hooray for Sun's openness.

Wether or not any given port is updated to the latest version depends on many factors. Alot of software is written in a very linux centric fasion (asterisk happens to be in this category), and requires quite some effort to port, or sometimes just plain doesn't work (wine for instance). Some times its just that the port's maintainer is busy and hasn't updated it.

Posted by: Doug at January 1, 2007 05:02 PM

Due to the licensing of JDK 1.5, you can ONLY get it by downloading various source pieces and building it, which is a royal pain for which you have to thank Sun, not OpenBSD :-) The eventual licensing of JDK1.6 under the GPL is not retroactive to 1.5 because there is a lot of non-Sun code that has to be replaced, so it does not permit OpenBSD to use the 1.6 licensing on the existing 1.5 code.

As for Linux emulation for Asterisk, I'd advise against it . I think you'll see Asterisk 1.4 (which, btw, was only released last week, and it was holiday time) available before too long.

However, do understand (speaking of avoiding unrealistic expectations) that Asterisk on OpenBSD does not support the Digium or Sangoma hardware at this point, due to device drivers being quite different and due to Asterisk having been coded at a fairly low level (there is a code fork called OpenPBX which claims to address some of these issues).

Posted by: Ian Darwin at January 1, 2007 06:20 PM

I was aware that Sun was the one being difficult!

Thanks for the "handholding" instruction on the JDKs; as you confirmed, this will probably be changing in a few months, and we will probably be seeing a JDK package at openbsd.com before long.

And after it has been completely GPL'ed, ironically, OpenBSD might become a secure platform of choice for ISPs hosting Java web apps.

And thanks for the great info on where Asterisk stands, Ian; driver implementations are always the heartbreak of psoriasis for many software projects (hence, "Project Evil", which would NEVER be sanctioned by OpenBSD...)

Can any OpenBSD afficionado point me to the URL of a good article contrasting Linux to BSD drivers? (a search is not readily turning up something apropos) I have a Linux kernel mode drivers book in my library, but I am beginning to wonder what's involved with retooling drivers (or writing them from the ground up...) for OpenBSD...

Posted by: Steve at January 2, 2007 12:56 AM

Wish I would have had these instructions when I wrote my article on this very topic.... OpenBSD Installed in 20 minutes.

Besides the fdisk portion the install was great. Very quick and easy. The fdisk portion was likely just me being used to linux fdisk.

Brock

Posted by: BASH Cures Cancer at February 16, 2007 05:13 PM

Technology White Papers

InfoWorld Technology Marketplace

» Technology White Papers Library

Technology White Papers by Topic

Technology White Papers E-mail Alert