2

I want to install a minimal OpenBSD 6.5 (x86_64) server to run a Tor relay. On Debian I would select ssh-server and usually standard system utilities in tasksel for a basic server install. What is the closest equivalent to such a configuration in OpenBSD?

The documentation is not clear about this merely stating: "New users are recommended to install all of them." As generally it is not advisable to install unneeded packages on a server, I am looking for a more specific 'best practices' recommendation for OpenBSD.

The available selections are: [with my questions/comments in square brackets]

General file sets

  • bsd - The kernel (required) [do I need this, if I install bsd.mp?]
  • bsd.mp - The multi-processor kernel [required for multi-core CPUs?]
  • bsd.rd - The ramdisk kernel [required for upgrades?]
  • baseXX.tgz - The base system (required)
  • compXX.tgz - The compiler collection, headers and libraries [not needed on a server, right?]
  • manXX.tgz - Manual pages [not needed, as they're available online]
  • gameXX.tgz - Text-based games [definitely not needed ;-) ]

X11 related file sets

  • xbaseXX.tgz - Base libraries and utilities for X11 (requires xshareXX.tgz)
  • xshareXX.tgz - X11's man pages, locale settings and includes
  • xfontXX.tgz - Fonts used by X11
  • xservXX.tgz - X11's X servers (xservXX.tgz set is rarely needed)

My inclination would be to not install compilers or any of the X11 related packages on a server, but the FAQ mentions, that some (non-X11) applications require fonts and fontconfig, which would require xbase, xshare and xfont file sets. Would many applications break, when not installing these? I doubt that a Tor relay would have any need for font manipulation.

What are the generally accepted best practices when setting up an OpenBSD server?

Improve this question

1 Answer 1

Reset to default
5

The "generally accepted best practice" is to install all the file sets, (which should not be confused with "run all daemons"). If you are inclined to keep some sets out because of safety concerns, remember that if someone has penetrated your system deep enough so that they can run a compiler, start daemons (like X) or something like that, you have much bigger problems already. Also, remember that even if OpenBSD comes with an (awesomely) large array of daemons in it base install, they won't be running by default unless you configure them to. In short, the files on the "non-core" data sets being there only pose a problem (security-wise), if they can be maliciously used, and if someone has enough privileges to use them against your will, you are already screwed.

If you are leaving out some sets because of disk space constraints, then that's a different story. I have some small/old machines doing IPSec and some routing which run on small SD cards, so I tend to leave out everything but the kernels (including bsd.rd) and base**.tgz. Oh, and man**.tgz because I'm too lazy to switch terminals just to lookup some man page. But this has nothing to do with security.

The FAQ mention has to do with cases like running a webserver that hosts some PHP app that do image/font manipulation with things like GD (via the php-gd module). I've had to install xbase on a headless server because of this. I don't think you'll need it for tor, but you can always leave X stuff out and add it later.

In short, you can leave comp*, x* and games* out, but remember you did leave them out, be aware that somethings might break and be prepared to add the sets post-install, if needed be. Also, bear in mind that you need to know which sets you installed when upgrading the machine. It's easy to forget you added xbase to your (e.g.) 6.4 system, de-select it when upgrading to 6.5, and ending up with a frankenstein.

Most of the time it's just easier to install everything and not having to worry about any of this.

Update: sysupgrade, the tool for automated upgrades that ships with OpenBSD will automatically install all the sets when upgrading a system.

Improve this answer
4
  • 1
    Thanks for your insights! Your answer clears up most of my questions. - "you need to know which sets you installed when upgrading the machine" is a very good point, which I would not really have considered. Is there a command, that can check which file sets are currently installed before upgrading a system?
    – ChrisW
    Sep 10, 2019 at 17:59
  • 2
    Not that I know of. Some are obvious (game*tgz puts stuff in /usr/share/games, man*tgz puts stuff in /usr/share/man, comp* puts stuff in /usr/lib, etc), some are less so, like the x* sets, which should mostly reside inside /usr/X11R6. The best bet is to get the file sets for the installed release, list their contents with tar -tzf, pick a couple of files and see if you have them.
    – Zé Loff
    Sep 11, 2019 at 15:42
  • 1
    I noticed, that most Packer templates which create OpenBSD VMs or Vagrant boxes install without compilers, games and X (-comp* -game* -x*). So I wrote a little script to check for the presence of a sample file from each file set. That will probably be sufficient as a check before upgrading my VMs. - Gist: Display a list of file sets which have been installed by the OpenBSD installer
    – ChrisW
    Sep 12, 2019 at 7:35
  • 2
    Seen on the OpenBSD "misc" mailing list, but I haven't tested it as I always install all sets: sysupgrade -n; rm /home/_sysupgrade/xserv66.tgz; reboot (to not upgrade the xserv set). Not running a default setup pretty much disqualifies you from getting useful help from the OpenBSD team on the mailing lists.
    – Kusalananda ♦
    Sep 16, 2019 at 14:33

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .