Openbsd on Niall Donaghy

OpenBSD sshd hardening with pf and sshguard

Tue, 07 Apr 2026 01:57:29 +0100

Goals:

a sane sshd configuration
a sane pf configuration
optional: add sshguard (but recommended)

setup SSH for your main user

Your main user is not root. :)

Change to your regular user and setup SSH dirs:

su - niall
mkdir -p /home/niall/.ssh
chmod 700 /home/niall/.ssh
chown niall:niall /home/niall/.ssh
# add pubkey(s) you want to be authorised for login
nano /home/niall/.ssh/authorized_keys
<paste in>

Default /etc/ssh/sshd_config has key-based login enabled, so test it now:

Installing OpenBSD 7.8

Tue, 07 Apr 2026 01:33:03 +0100

This guide is VirtualBox-centric, but most everything will translate to your hypervisor or bare metal of choice.

Materials

Installation ISO:

cd78.iso - you will download packages from network
install78.iso - self-contained

Hypervisor

Create a new VM with the required CPU, RAM, and storage specs, and mount the ISO to boot from it and begin installation.

VirtualBox-specific notes:

Network: If using wifi on host, use NAT mode for the NIC; bridge mode performance tanks (does not apply if host is wired).
Storage: make “IDE” type PIIX4, attach ISO there, make “ACHI” type ACHI, enable host IO cache, and attach VDI there.
VDI: Can tick Solid-state drive.
Don’t be tempted by UEFI mode, you will have boot issues.
Don’t be tempted by NVMe mode, disk will deadlock during install; ACHI is faster in Vbox anyway!

Installation

network

Follow instructions to set autoconf(DHCP) or static IP addressing and gateway, DNS, etc. In this doc, in post-install tasks, instructions given to convert DHCP config to static config

OpenBSD Disabling Unused Services

Tue, 07 Apr 2026 00:10:44 +0100

Whilst setting up this OpenBSD VPS I trimmed some unused services. Secure by default, but securer when not running. :)

check_quotas

There are disk quota checks at boot, however, I am not using quotas:

doas rcctl disable check_quotas
doas rcctl stop check_quotas

dhcpleased

The DHCP client daemon; this is not needed as I am using a static IP:

doas rcctl disable dhcpleased
doas rcctl stop dhcpleased

slaacd

IPv6 stateless autoconfiguration; disable if you are not using IPv6, I am not: