Basic OpenBSD Security

This is a minimal OpenBSD configuration I use to enhance the security of the system. Adjust it for your needs.

pf

This is a minimal pf config. Put it in /etc/pf.conf


        # Do not do anything on the lo interface
set skip on lo

# Block everything except specified otherwise below
block all

anitspoof quick for egress



# Allow connecting to this computer over ssh
pass in on egress proto tcp to port ssh

# Allow incoming https(s) connections
pass in on egress proto tcp to port { http https }

# Allow incoming smtp(s), submission and imaps connections
pass in on egress proto tcp to port { smtp smtps submission imaps }

# Allow incoming dhcp
pass in on egress port proto udp to port bootpc

# Allow incomin icmp so ping works
pass in proto { icmp icmp6 }



# Allow outgoing dns and ntp
pass outin egress proto { tcp udp } to port { domain ntp }

# Allow outgoing http(s)
# Required for syspatch and sysupgrade
pass out on egress proto tcp to port { http http }

# Allow outgoing smtp
pass out on egress proto tcp to port smtp

# Allow outgoing dhcp
pass out on egress proto udp to port bootps

Load the rules with doas pfctl -f /etc/pf.conf. The rules in this file automatically loads on boot.

SSH

Upload your ssh key with the command ssh-copy-id on the computer you are connecting from.

Set PermitRootLogin to no and PasswordAuthentication to no in /etc/ssh/sshd_config. Restart the ssh daemon with doas rcctl restart sshd. Make sure you have uploaded your ssh key before doing this.