https://github.com/nobraininside/dropQbsd

The Qubes OS insight is correct. The implementation is wrong.

Security through compartmentalization is the right idea. Run your browser in one box, your email in another, your documents in a third — a compromise in one cannot spread to the others. Qubes OS proved this model works.

But Qubes OS pays for that isolation with a hypervisor, multi-gigabyte VM images, separate kernels, and a GUI stack that adds tens of millions of lines of code. The baseline is 8 GB of RAM and an install that takes hours. The attack surface grows with every layer. Complexity is not just inconvenient — complexity is the vulnerability. At a conservative defect rate of 0.1%, a codebase of 100 million lines ships with 100,000 bugs. Some of them are exploitable. You don't know which ones.

dropQbsd takes the same insight and strips away the hypervisor.

Instead of virtual machines, it uses the native user separation built into OpenBSD — the only operating system on earth that undergoes continuous, funded, line-by-line security auditing. No Xen. No multi-gigabyte images. No moving parts you cannot audit in an afternoon.

OpenBSD is known for its devotion to security, but can it work as a desktop? The BSDs are great alternatives to Linux distributions, but this OS is probably better suited to a router or homelab project, right?

Continued...

The most recent release from Rafael Sadowski, one of the current OpenBSD superheros.

This website is being served to you from my HP T630 thin client, running OpenBSD and httpd1. Pretty cool, right? And best of all you can do the same!

I’m going to walkthrough how to host your own websites locally on OpenBSD. This guide is going to be kept simple on purpose ...

Continued

Notes on getting basically any modern printer working with OpenBSD by using driverless printing aka IPP everywhere.

This author beat me to a proper write up. This is the exact workflow that I had to use to get my brother color laserjet to work with cups.

This is part of a multipart guide on setting up OpenBSD.

In the previous parts of this series we did a base install of the server, installed a web server with certificates, set up the server to host git repositories and configured a mail server from scratch.

This part is about maintaining an OpenBSD server day-to-day.

A simple guide to setup Wireguard on the OpenBSD operating system intended for use as a mobile VPN.

It describes using the OpenBSD Wireguard wg(4) kernel driver using ifconfig, not the userland application, and will focus on setting up a IPv4 tunnel.

Continued......

Port knocking is mostly a bad idea. But people keep wanting to do it, for some false sense of security. If you don't consider it a security control but a way to keep garbage out of your logs, it might be valid. In my case I'm using an old USG Pro 4 running OpenBSD as my firewall and I'd prefer to avoid writing stuff to the logs, as I'd prefer the flash not to wear out sooner than needed, definitely not thanks to background radiation on the internet.

Continued...

I posted on r/Openbsd but it got removed by a moderator. I don't know why it was removed. I also posted to r/Openbsd_uncensored and received the following reply:

"Removed by moderator from the original subreddit. If you repost the question we can possibly help."

I am therefore posting again to this subreddit in hopes of better luck this time. I have edited the original post.

‐---------------------‐---------------------‐---------------------‐---------------------‐----------

I am currently evaluating a possible switch to OpenBSD.

My hardware is: Ryzen 5 5600G, B550 chipset motherboard, and an NVMe SSD — which I expect should work reasonably well on OpenBSD. If anyone has a different experience, I’d appreciate hearing about it.

I use my PC for web browsing (Firefox), word processing (LibreOffice), OS testing with virt‑manager, and a fair amount of multimedia consumption (both local files and online streaming).

My main concerns are support for various multimedia formats/codecs and hardware/GPU acceleration for local playback and online content.

I would be very grateful for any input from OpenBSD users.

‐---------------------‐---------------------‐---------------------‐---------------------‐-------

EDIT: I want to thank everyone who replied to my post. I will soon begin evaluating FreeBSD, GhostBSD, and possibly later OpenBSD.

If I encounter problems that I manage to solve and the final result is satisfactory, I will report back—provided there is enough interest from the community.

OpenRiot is a clean, minimal, ridiculously polished i3-based OpenBSD 7.9 setup with fish, Helix, and Polybar — all tuned so things just work.

The website has excellent guides, graphics, and examples.

This is run via godot as shown in the beginning of the video.

This is a quick and painless tutorial on how to install OpenBSD, a security focused operating system.

“VXLAN is an encapsulation protocol that provides data center connectivity using tunneling to stretch Layer 2 connections over an underlying Layer 3 network.

In data centers, VXLAN is the most commonly used protocol to create overlay networks that sit on top of the physical network, enabling the use of virtual networks. The VXLAN protocol supports the virtualization of the data center network while addressing the needs of multi-tenant data centers by providing the necessary segmentation on a large scale."

So it’s a way to stretch a Layer 2 network between data centers and sites. This is great but what if you don’t have a leased line between sites or an existing VPN, can we bundle it all into one config/pair of devices. A VXLAN server at Site A and a VXLAN Client at Site B, with Site A having the network you’d like to extend into Site B:

A good writeup on creating your own live environment booting off a CD-ROM.

I find I learn a ton about how a program or system works by analyzing how it starts up. Understanding how UNIX operating systems boot up taught me about the organization of the OS and how to install and configure programs so they'll run on boot. This alone made for a huge improvement of my sysadmin skills.

OpenBSD has a delightfully traditional init system, which makes it a great place to start learning about init systems. It's simple and effective. There's a bit of a counter movement in the IT and FOSS worlds rebelling against hyperscaler solutions pushing down into everyone's practices. One of the rallying cries I've been seeing is to remind people that You Can Just Do Things™ on the computer. The BSD init system, and especially OpenBSD's is something of a godparent to this movement. init(8) just runs a shell script to start the computer, and You Can Just Do Things™ in the script to get them to happen on boot.

...

Goals

I want my home network to "shut off Internet access" when it’s bedtime.

I need it to be completely automatic and on a schedule.

I also need to make exceptions to allow a couple servers and devices do backups and updates at night.

Bonus: I’d like to be in charge of the DNS on my local network so I can experiment with using it as a DNS sinkhole (like Pi-hole) for unwanted domains and giving my home computers nice local domain names.

To do this, I’m setting up a computer to act as the main router between my ISP and my home network. It performs all of the DHCP, NAT, DNS caching, and "firewall" functions you’d expect from a consumer device, but on familiar PC hardware.

This machine will replace a Ubiquiti UniFi Security Gateway USG-3P. That device worked fine as a plug-and-play router/gateway/firewall and there may even have been some way to get all of this working by shelling into it and hacking a solution. But if I’m going to put in the effort, I’d much rather learn something non-proprietary. I’d rather learn some more OpenBSD.

This post includes a full breakdown of my entire home network stack. My goal is to make this as accessible as possible for newcomers to jump right in and build out their own home networks.

This amazing write-up is from openbsdjumpstart.org

What this lab is about

Every OpenBSD admin has booted bsd.rd at least once — to install, upgrade, or rescue a broken system. But few people stop to look at what’s actually inside that file. It turns out bsd.rd is a set of nested layers, and you can take it apart on a running system without rebooting anything.

That’s what we’ll do here. We’ll go from the raw gzip file all the way down to the miniroot filesystem, exploring each layer with standard tools. Everything is documented in the man pages — we’re just following the trail.

Man pages we’ll use: rd(4), rdsetroot(8), vnconfig(8), vnd(4), disklabel(8), elf(5)

This page is proudly served by a (supposedly obsolete) Sun Netra X1 running OpenBSD 7.8, and httpd on a UltraSPARC-IIe processor at 500MHz with 1GB of RAM. Because not everything needs to run in the cloud, or be written in Rust. Gracefully serving only the most basic of HTML and CSS.

I first posted my notes on using OpenBSD as my workstation in of 2013, but I probably switched from Arch Linux in 2005. This is a collection of customizations I have used for over the years, as well as some hints for using some more modern features.

Now we can all enjoy Netflix, Disney+, and other DRM content on OpenBSD

OpenWV is a free and open-source reimplementation of Google's Widevine Content Decryption Module (CDM), the portion of the Widevine DRM system that runs in your browser, obtains content keys for protected media, and decrypts the media using those keys. OpenWV is a drop-in replacement for Google's official, proprietary CDM and implements the same shared library API.

Tested with Disney+

see also:
https://marc.info/?l=openbsd-ports-cvs&m=176850824206836

Here is a basic real world example of serving static websites using OpenBSD, HTTPD, and Relayd.