OpenBSD is a security-focused, free software, Unix-like operating system based on the Berkeley Software Distribution (BSD). Theo de Raadt created OpenBSD in 1995 by forking NetBSD 1.0. The OpenBSD project emphasizes portability, standardization, correctness, proactive security, and integrated cryptography.
The OpenBSD project maintains portable versions of many subsystems as packages for other operating systems. Because of the project's preferred BSD license, which allows binary redistributions without the source code, many components are reused in proprietary and corporate-sponsored software projects. The firewall code in Apple's macOS is based on OpenBSD's PF firewall code, Android's Bionic C standard library is based on OpenBSD code, LLVM uses OpenBSD's regular expression library, and Windows 10 uses OpenSSH (OpenBSD Secure Shell) with LibreSSL.
The word "open" in the name OpenBSD refers to the availability of the operating system source code on the Internet, although the word "open" in the name OpenSSH means "OpenBSD". It also refers to the wide range of hardware platforms the system supports. OpenBSD supports a variety of system architectures including x86-64, IA-32, ARM, PowerPC, and 64-bit RISC-V. Its default GUI is FVWM on X11.
History
In December 1994, Theo de Raadt, a founding member of the NetBSD project, was asked to resign from the NetBSD core team over disagreements and conflicts with the other members of the NetBSD team. In October 1995, de Raadt founded OpenBSD, a new project forked from NetBSD 1.0. The initial release, OpenBSD 1.2, was made in July 1996, followed by OpenBSD 2.0 in October of the same year. Since then, the project has issued a release every six months, each of which is supported for one year.
On 25 July 2007, OpenBSD developer Bob Beck announced the formation of the OpenBSD Foundation, a Canadian non-profit organization formed to "act as a single point of contact for persons and organizations requiring a legal entity to deal with when they wish to support OpenBSD."
In 2024, the project had separated far enough that all files which were part of the original fork from NetBSD had been either modified or removed, with the replacement of a data file for the "quiz" program being the determining change.
Usage statistics
It is hard to determine how widely OpenBSD is used, because the developers do not publish or collect usage statistics.
In September 2005, the BSD Certification Group surveyed 4330 individual BSD users, showing that 32.8% used OpenBSD, behind FreeBSD with 77%, ahead of NetBSD with 16.3% and DragonFly BSD with 2.6%. However, the authors of this survey clarified that it is neither "exhaustive" nor "completely accurate", since the survey was spread mainly through mailing lists, forums and word of mouth. This combined with other factors, like the lack of a control group, a pre-screening process or significant outreach outside of the BSD community, makes the survey unreliable for judging BSD usage globally.
Uses Network appliances OpenBSD features a robust TCP/IP networking stack, and can be used as a router or wireless access point. OpenBSD's security enhancements, built-in cryptography, and packet filter make it suitable for security purposes such as firewalls, intrusion-detection systems, and VPN gateways.
Several proprietary systems are based on OpenBSD, including devices from Armorlogic (Profense web application firewall), Calyptix Security, GeNUA, RTMX, and .vantronix.
Other operating systems
Some versions of Microsoft's Windows Services for UNIX, an extension to the Windows operating system to provide Unix-like functionality, used much of the OpenBSD code base that is included in the Interix interoperability suite, developed by Softway Systems Inc., which Microsoft acquired in 1999. Core Force, a security product for Windows, is based on OpenBSD's pf firewall. The pf firewall is also found in other operating systems: including FreeBSD, and macOS.
Personal computers OpenBSD ships with Xenocara, an implementation of the X Window System, and is suitable as a desktop operating system for personal computers, including laptops. , OpenBSD includes approximately 8000 packages in its software repository, including desktop environments such as Lumina, GNOME, KDE Plasma, and Xfce, and web browsers such as Firefox and Chromium. The project also includes three window managers in the main distribution: cwm, FVWM (part of the default configuration for Xenocara), and twm.
Servers OpenBSD features a full server suite and can be configured as a mail server, web server, FTP server, DNS server, router, firewall, NFS file server, or any combination of these. Since version 6.8, OpenBSD has also shipped with native in-kernel WireGuard support.
Security
Shortly after OpenBSD was created, de Raadt was contacted by a local security software company named Secure Networks (later acquired by McAfee). The company was developing a network security auditing tool called Ballista, which was intended to find and exploit software security flaws. This coincided with de Raadt's interest in security, so the two cooperated leading up to the release of OpenBSD 2.3. This collaboration helped to define security as the focus of the OpenBSD project.
OpenBSD includes numerous features designed to improve security, such as: Secure alternatives to POSIX functions in the C standard library, such as strlcat for strcat and strlcpy for strcpy Toolchain alterations, including a static bounds checker Memory protection techniques to guard against invalid accesses, such as ProPolice and the W^X page protection feature Strong cryptography and randomization System call and filesystem access restrictions to limit process capabilities
To reduce the risk of a vulnerability or misconfiguration allowing privilege escalation, many programs have been written or adapted to make use of privilege separation, privilege revocation and chrooting. Privilege separation is a technique, pioneered on OpenBSD and inspired by the principle of least privilege, where a program is split into two or more parts, one of which performs privileged operations and the other—almost always the bulk of the code—runs without privilege. Privilege revocation is similar and involves a program performing any necessary operations with the privileges it starts with then dropping them. Chrooting involves restricting an application to one section of the file system, prohibiting it from accessing areas that contain private or system files. Developers have applied these enhancements to OpenBSD versions of many common applications, such as tcpdump, file, tmux, smtpd, and syslogd.
OpenBSD developers were instrumental in the creation and development of OpenSSH (aka OpenBSD Secure Shell), which is developed in the OpenBSD CVS repositories. OpenBSD Secure Shell is based on the original SSH. It first appeared in OpenBSD 2.6 and is now by far the most popular SSH client and server, available on many operating systems.
The project has a policy of continually auditing source code for problems, work that developer Marc Espie has described as "never finished ... more a question of process than of a specific bug being hunted." He went on to list several typical steps once a bug is found, including examining the entire source tree for the same and similar issues, "try[ing] to find out whether the documentation ought to be amended", and investigating whether "it's possible to augment the compiler to warn against this specific problem."
Security record The OpenBSD website features a prominent reference to the system's security record. Until June 2002, it read:
In June 2002, Mark Dowd of Internet Security Systems disclosed a bug in the OpenSSH code implementing challenge–response authentication. This vulnerability in the OpenBSD default installation allowed an attacker remote access to the root account, which was extremely serious not only to OpenBSD, but also to the large number of other operating systems that were using OpenSSH by that time. This problem necessitated the adjustment of the slogan on the OpenBSD website to:
The quote remained unchanged as time passed, until on 13 March 2007, when Alfredo Ortega of Core Security Technologies disclosed a network-related remote vulnerability. The quote was subsequently changed to:
This statement has been criticized because the default install contains few running services, and many use cases require additional services. Also, because the ports tree contains unaudited third-party software, it is easy for users to compromise security by installing or improperly configuring packages. However, the project maintains that the slogan is intended to refer to a default install and that it is correct by that measure.
One of the fundamental ideas behind OpenBSD is a drive for systems to be simple, clean, and secure by default. The default install is quite minimal, which the project states is to ensure novice users "do not need to become security experts overnight", which fits with open-source and code auditing practices considered important elements of a security system. Additional services are to be enabled manually to make users think of the security implications first.
Alleged backdoor On 11 December 2010, Gregory Perry, a former technical consultant for the Federal Bureau of Investigation (FBI), emailed de Raadt alleging that the FBI had paid some OpenBSD ex-developers 10 years prior to insert backdoors into the OpenBSD Cryptographic Framework. De Raadt made the email public on 14 December by forwarding it to the openbsd-tech mailing list and suggested an audit of the IPsec codebase. De Raadt's response was skeptical of the report and he invited all developers to independently review the relevant code. In the weeks that followed, bugs were fixed but no evidence of backdoors was found. De Raadt stated "I believe that NetSec was probably contracted to write backdoors as alleged. If those were written, I don't believe they made it into our tree. They might have been deployed as their own product."
Criticisms In December 2017, Ilja van Sprundel, director at IOActive, gave a talk at the CCC as well as DEF CON, entitled "Are all BSDs created equally? — A survey of BSD kernel vulnerabilities", in which he stated that although OpenBSD was the clear winner of the BSDs in terms of security, "Bugs are still easy to find in those kernels, even in OpenBSD".
Two years later, in 2019, Julien Voisin, a developer who is cited in discovering many CVE documented exploits, gave a talk named "A systematic evaluation of OpenBSD's mitigations" at the CCC. While admitting OpenBSD has some effective mitigations, he alleged a significant number were "useless at best and based on pure luck and superstition".
Subprojects Many open source projects started as components of OpenBSD, including:
bioctl, a generic RAID management interface similar to ifconfig CARP, a free alternative to Cisco's patented HSRP/VRRP redundancy protocols cwm, a stacking window manager doas, a replacement for sudo OpenBSD httpd, an implementation of httpd Game of Trees, an implementation of Git's formats and protocols hw.sensors, a sensors framework used by over 100 drivers LibreSSL, an implementation of the SSL and TLS protocols, forked from OpenSSL 1.0.1g mandoc, a utility used for formatting man pages OpenBGPD, an implementation of BGP-4 OpenIKED, an implementation of IKEv2 OpenNTPD, a simpler alternative to ntp.org's NTP daemon OpenOSPFD, an implementation of OSPF OpenSMTPD, an SMTP daemon with IPv4/IPv6, PAM, Maildir, and virtual domains support OpenSSH, an implementation of SSH PF, an IPv4/IPv6 stateful firewall with NAT, PAT, QoS and traffic normalization support pfsync, a firewall state synchronization protocol for PF with high availability support using CARP