View source for Software:OpenBSD

{{Short description|Security-focused Unix-like operating system}}
{{Merge|OpenBSD Foundation
| date = May 2021
| discuss = Talk:OpenBSD#Merger discussion
}}

{{Infobox OS
| name = OpenBSD
| logo = OpenBSD Logo - Cartoon Puffy with textual logo below.svg
| logo caption = ''Free, Functional, and Secure''
| logo size = 200px
| logo alt = Puffy, the pufferfish mascot of OpenBSD posing in the official logo.
| screenshot = Openbsd61 desktop.png
| caption = OpenBSD 6.1 default desktop with various utilities: [[Software:Top|top]], [[Software:Xterm|xterm]], xclock, xcalc, glxgears
| collapsible =
| developer = The OpenBSD Project
| family = [[Unix-like]]
| working state = Current
| source model = [[Open-source software|Open source]]
| released = {{Start date and age|df=yes|1996|07}}
| programmed in = [[C (programming language)|C]], [[Assembly language|assembly]], [[Perl]], [[Unix shell]]
| package manager = OpenBSD package tools<ref name="faq15-pkgs" />
| supported platforms = [[DEC Alpha|Alpha]], [[X86-64|x86-64]], ARMv7, ARMv8 (64-bit), [[PA-RISC]], [[IA-32]], LANDISK, [[Engineering:LUNA|Omron LUNA-88K]], [[Company:Loongson|Loongson]], [[MIPS architecture|MIPS64]], [[PowerPC]], [[SPARC|SPARC64]]<ref name="plat" />
| kernel type = [[Monolithic kernel|Monolithic]]
| userland = BSD
| ui = Modified [[Software:KornShell|pdksh]], [[Software:X Window System|X11]] ([[Software:FVWM|FVWM]])
| license = [[Software:BSD licenses|BSD]], [[ISC license|ISC]], other [[Permissive software license|permissive licenses]]<ref name="policy"/>
}}
'''OpenBSD''' is a [[Security-focused operating system|security-focused]], free and open-source, [[Unix-like]] [[Operating system|operating system]] based on the [[Software:Berkeley Software Distribution|Berkeley Software Distribution]] (BSD). Theo de Raadt created OpenBSD in 1995 by [[Software:Fork (software development)|forking]] [[Software:NetBSD|NetBSD]]. According to the website, the OpenBSD project emphasizes "portability, standardization, correctness, proactive security and integrated cryptography."<ref>{{cite web|url=https://www.openbsd.org/|title=OpenBSD|author=OpenBSD Project|date=2020-05-19|website=OpenBSD.org|access-date=2020-10-12}}</ref>

The OpenBSD project maintains [[Software portability|portable]] versions of many subsystems as [[Package manager|packages]] for other operating systems. Because of the project's preferred BSD license, many components are reused in proprietary and corporate-sponsored software projects. [[Software:Android (operating system)|Android]]'s [[Software:Bionic|Bionic]] [[C standard library]] is based on OpenBSD code,<ref>{{cite web|title=Android's C Library Has 173 Files of Unchanged OpenBSD Code|url=http://undeadly.org/cgi?action=article&sid=20140506132000|access-date=8 October 2018}}</ref> [[Software:LLVM|LLVM]] uses OpenBSD's [[Regular expression|regular expression]] library,<ref>{{cite web|title=LLVM Release License|url=http://releases.llvm.org/7.0.0/LICENSE.TXT|access-date=8 October 2018}}</ref> and [[Software:Windows 10|Windows 10]] uses [[Software:OpenSSH|OpenSSH]] (OpenBSD Secure Shell) with [[Software:LibreSSL|LibreSSL]].<ref>{{cite web|title=OpenSSH for Windows|url=https://twitter.com/nocentino/status/996843655112613888|access-date=8 October 2018}}</ref>

The word "open" in the name OpenBSD refers to the availability of the operating system's [[Source code|source code]] on the [[Internet]], although the word "open" in the name OpenSSH means "OpenBSD". It also refers to the wide range of [[Computer architecture|hardware platforms]] the system supports.<ref name="infoworld_new_years_resolution" />

== History ==
[[File:Bsd distributions usage.svg|thumb|[[Bar chart|Bar chart]] showing the proportion of users of each BSD variant from a 2005 BSD usage survey.<ref name="survey" />{{refn|name=survey_nuance|group=n|Multiple selections were permitted as a user may use multiple BSD variants side by side.}}]]

In December 1994, Theo de Raadt, a founding member of the [[Software:NetBSD|NetBSD]] project, was asked to resign from the NetBSD core team.<ref name="glass"/><ref>{{cite web|url=http://www.theos.com/deraadt/coremail.html|first=Theo|last=de Raadt|title=Archive of the mail conversation leading to Theo de Raadt's departure|date=29 March 2009|access-date=15 January 2010}}</ref>  In October 1995, De Raadt founded OpenBSD, a new project forked from NetBSD 1.0. The initial release, OpenBSD 1.2, was made in July 1996, followed by OpenBSD 2.0 in October of the same year.<ref name="2.0-release" /> Since then, the project has issued a release every six months, each of which is supported for one year.

On 25 July 2007, OpenBSD developer Bob Beck announced the formation of the [[Organization:OpenBSD Foundation|OpenBSD Foundation]], a Canadian non-profit organization formed to "act as a single point of contact for persons and organizations requiring a legal entity to deal with when they wish to support OpenBSD."<ref name="announcing-openbsd-foundation" />

It is hard to determine how widely OpenBSD is used, because the developers do not publish or collect usage statistics. In September 2005, the BSD Certification Group surveyed BSD users, showing that 33 percent used OpenBSD,<ref name="survey" /> behind [[Software:FreeBSD|FreeBSD]] with 77 percent and ahead of NetBSD with 16 percent.{{refn|name=survey_nuance|group=n}}

== Uses ==
[[File:OpenBSD 5.3 Startup.png|thumb|OpenBSD startup in console mode]]
[[File:OpenBSD 5.3 Welcome.png|thumb|OpenBSD console login and welcome message]]

=== Network appliances ===
OpenBSD features a robust TCP/IP [[Computer network|networking]] stack, and can be used as a [[Engineering:Router (computing)|router]]<ref>{{cite web|title=OpenBSD PF - Building a Router|url=https://www.openbsd.org/faq/pf/example1.html|access-date=8 August 2019}}</ref> or [[Wireless access point|wireless access point]].<ref>{{cite web|title=Building an OpenBSD wireless access point|url=https://ctors.net/2013/12/30/openbsd_wireless_access_point|access-date=8 August 2019}}</ref> OpenBSD's [[OpenBSD security features|security enhancements]], built-in [[Cryptography|cryptography]], and [[Software:PF (firewall)|packet filter]] make it suitable for security purposes such as [[Firewall (computing)|firewalls]],<ref name="closer-look-openbsd" /> intrusion-detection systems, and [[Virtual private network|VPN]] gateways.

Several [[Proprietary software|proprietary]] systems are based on OpenBSD, including devices from Armorlogic (Profense web application firewall), Calyptix Security,<ref name="calyptix" /> GeNUA,<ref name="genua" /> RTMX,<ref name="rtmx" /> and .vantronix.<ref name="vantronix" />

=== Foreign operating systems ===

Some versions of [[Company:Microsoft|Microsoft]]'s [[Software:Windows Services for UNIX|Services for UNIX]], an extension to the [[Software:Microsoft Windows|Windows]] operating system to provide Unix-like functionality, use much OpenBSD code included in the [[Interix]] interoperability suite,<ref name="wsu35_review">{{citation
|url         = http://www.osnews.com/story/5751
|archive-url = https://web.archive.org/web/20080211164430/http://www.osnews.com/story/5751
|url-status  = dead
|archive-date = 2008-02-11
|last        = Dohnert
|first       = Roberto J.
|title       = Review of Windows Services for UNIX 3.5
|work        = OSNews
|publisher   = David Adams
|date        = 2004-01-21
}}</ref><ref name=wontfix>{{cite web |url=https://brianreiter.org/2010/01/26/wontfix-select2-in-sua-5-2-ignores-timeout/ |title=WONTFIX: select(2) in SUA 5.2 ignores timeout |first=Brian |last=Reiter |publisher=brianreiter.org |date=2010-01-26 }}</ref> developed by Softway Systems Inc., which Microsoft acquired in 1999.<ref name="softway">{{citation
|url         = http://www.microsoft.com/en-us/news/press/1999/sept99/softwaypr.aspx
|title       = Microsoft Acquires Softway Systems To Strengthen Future Customer Interoperability Solutions
|work        = Microsoft News Center
|publisher   = [[Company:Microsoft|Microsoft]]
|date        = 1999-09-17
}}</ref><ref name="interix">{{cite web |url=https://www.milltech.com/about |title=Milltech Consulting Inc. |date=2019 }}</ref> Core Force, a security product for Windows, is based on OpenBSD's [[Software:PF (firewall)|pf firewall]].<ref name="core-force">{{citation
|url        = http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=project&name=Core_Force
|title      = Core Force
|work       = Core Labs
|access-date = 2011-12-13
|quote      = CORE FORCE provides inbound and outbound stateful packet filtering for TCP/IP protocols using a Windows port of OpenBSD's PF firewall, granular file system and registry access control and programs' integrity validation.
}}</ref>

=== Personal computers ===
OpenBSD ships with [[Software:Xenocara|Xenocara]],<ref name="xenocara" /> an implementation of the [[Software:X Window System|X Window System]], and is suitable as a desktop operating system for [[Engineering:Personal computer|personal computer]]s, including laptops.<ref name="openbsd-desktop" /><ref name="absolute_openbsd" />{{rp|xl}} {{As of|2018|09}}, OpenBSD includes approximately 8000 packages in its [[Software repository|software repository]],<ref name="openports" /> including desktop environments such as [[Software:GNOME|GNOME]], [[Software:KDE Plasma 4|Plasma 4]], and [[Software:Xfce|Xfce]], and web browsers such as [[Software:Firefox|Firefox]] and [[Software:Chromium (web browser)|Chromium]].<ref name="6.0-release" /> The project also includes three window managers in the main distribution: [[Software:Cwm (window manager)|cwm]], [[Software:FVWM|FVWM]] (part of the default configuration for Xenocara), and [[Software:Twm|twm]].<ref name="faq11" />

=== Servers ===
OpenBSD features a full [[Server (computing)|server]] suite and can be configured as a mail server, [[Web server|web server]], FTP server, DNS server, [[Engineering:Router (computing)|router]], [[Firewall (computing)|firewall]], [[Network File System|NFS]] [[File server|file server]], or any combination of these.

== Security ==
Shortly after OpenBSD was created, De Raadt was contacted by a local security software company named Secure Networks (later acquired by [[Company:McAfee|McAfee]]).<ref name="staying-cutting-edge" /><ref name="onlamp-interview" /> They were developing a [[Network security|network security]] auditing tool called Ballista,{{refn|name=ballista|group=n|Later renamed to Cybercop Scanner after SNI was purchased by [[Company:McAfee|Network Associates]].}} which was intended to find and [[Exploit (computer security)|exploit]] software security flaws. This coincided with De Raadt's interest in security, so the two cooperated leading up to the release of OpenBSD 2.3.<ref name="2.3-announcement" /> This collaboration helped to define security as the focus of the OpenBSD project.<ref name="free-for-all" />

OpenBSD includes numerous features designed to improve security, such as:
* Secure alternatives to [[POSIX]] functions in the C standard library, such as <code>strlcat</code> for <code>strcat</code> and <code>strlcpy</code> for <code>strcpy</code><ref name="strlcpy-strlcat-paper" />
* Toolchain alterations, including a static bounds checker<ref name="man_gcc-local" />
* Memory protection techniques to guard against invalid accesses, such as ProPolice and the [[W^X]] [[Paging|page]] protection feature
* Strong [[Cryptography|cryptography]] and [[Randomization|randomization]]<ref name="crypto-openbsd-overview" />
* [[System call]] and filesystem access restrictions to limit process capabilities<ref>{{cite web|title=Pledge() - A New Mitigation Mechanism|url=https://www.openbsd.org/papers/hackfest2015-pledge/mgp00002.html|access-date=8 October 2018}}</ref>

To reduce the risk of a vulnerability or misconfiguration allowing [[Privilege escalation|privilege escalation]], many programs have been written or adapted to make use of [[Privilege separation|privilege separation]], [[Privilege revocation (computing)|privilege revocation]] and [[Chroot|chroot]]ing. Privilege separation is a technique, pioneered on OpenBSD and inspired by the [[Principle of least privilege|principle of least privilege]], where a program is split into two or more parts, one of which performs privileged operations and the other—almost always the bulk of the code—runs without privilege.<ref name="privilege-separated-openssh" /> Privilege revocation is similar and involves a program performing any necessary operations with the privileges it starts with then dropping them. Chrooting involves restricting an application to one section of the [[File system|file system]], prohibiting it from accessing areas that contain private or system files. Developers have applied these enhancements to OpenBSD versions of many common applications, such as [[Software:Tcpdump|tcpdump]], [[Software:File (command)|file]], [[Software:Tmux|tmux]], [[Software:OpenSMTPD|smtpd]], and syslogd.<ref name="openbsd_innovations_privsep" />

OpenBSD developers were instrumental in the creation and development of [[Software:OpenSSH|OpenSSH]] (aka OpenBSD Secure Shell), which is developed in the OpenBSD CVS repositories. OpenBSD Secure Shell is based on the original [[Secure Shell|SSH]].<ref name="openssh-history" /> It first appeared in OpenBSD 2.6 and is now by far the most popular SSH client and server, available on many operating systems.<ref name="openssh-usage" />

The project has a policy of continually auditing source code for problems, work that developer Marc Espie has described as "never finished ... more a question of process than of a specific bug being hunted." He went on to list several typical steps once a bug is found, including examining the entire source tree for the same and similar issues, "try[ing] to find out whether the documentation ought to be amended", and investigating whether "it's possible to augment the [[Compiler|compiler]] to warn against this specific problem."<ref name="interview-espie" />

=== Security record ===
The OpenBSD website features a prominent reference to the system's security record. Until June 2002, it read:

{{cquote|Five years without a remote hole in the default install!}}

In June 2002, Mark Dowd of Internet Security Systems disclosed a bug in the OpenSSH code implementing [[Challenge–response authentication|challenge–response]] [[Authentication|authentication]].<ref>Internet Security Systems. [http://www.iss.net/threats/advise123.html OpenSSH Remote Challenge Vulnerability], June 26, 2002. Visited December 17, 2005.</ref> This vulnerability in the OpenBSD default installation allowed an attacker remote access to the [[Superuser|root]] account, which was extremely serious not only to OpenBSD, but also to the large number of other operating systems that were using OpenSSH by that time.<ref>[http://xforce.iss.net/xforce/xfdb/9169 A partial list of affected operating systems].</ref> This problem necessitated the adjustment of the slogan on the OpenBSD website to:

{{cquote|One remote hole in the default install, in nearly 6 years!}}

The quote remained unchanged as time passed, until on March 13, 2007, when Alfredo Ortega of Core Security Technologies<ref>[http://www.coresecurity.com Core Security Technologies' homepage].</ref> disclosed a network-related remote vulnerability.<ref>Core Security Technologies. ''[http://www.coresecurity.com/content/open-bsd-advisorie OpenBSD's IPv6 mbufs remote kernel buffer overflow.]'' March 13, 2007. Visited March 13, 2007.</ref> The quote was subsequently changed to:

{{cquote|Only two remote holes in the default install, in a heck of a long time!}}

This statement has been criticized because the default install contains few running services, and many use cases require additional services.<ref>{{citation
|url        = http://securityblog.org/brindle/2008/03/30/secure-doesnt-mean-anything/
|title      = Secure doesn't mean anything
|last       = Brindle
|first      = Joshua
|work       = Security Blog
|date       = 2008-03-30
|access-date = 2011-12-13}}</ref> Also, because the ports tree contains unaudited third-party software, it is easy for users to compromise security by installing or improperly configuring packages. However, the project maintains that the slogan is ''intended'' to refer to a default install and that it is correct by that measure.

One of the fundamental ideas behind OpenBSD is a drive for systems to be simple, clean, and [[Secure by default|secure by default]]. The default install is quite minimal, which the project states is to ensure novice users "do not need to become security experts overnight",<ref name="security" /> which fits with open-source and code auditing practices considered important elements of a security system.<ref name="oss-good-for-security" />

=== Alleged backdoor ===
On 11 December 2010, Gregory Perry, a former technical consultant for the Federal Bureau of Investigation (FBI), emailed De Raadt alleging that the FBI had paid some OpenBSD ex-developers 10 years prior to insert backdoors into the [[OpenBSD Cryptographic Framework]]. De Raadt made the email public on 14 December by forwarding it to the openbsd-tech mailing list and suggested an audit of the [[IPsec]] codebase.<ref name="allegations-ipsec" /><ref name="osnews-ipsec" /> De Raadt's response was skeptical of the report and he invited all developers to independently review the relevant code. In the weeks that followed, bugs were fixed but no evidence of backdoors was found.<ref name="no-ipsec-backdoor" /> De Raadt stated "I believe that NetSec was probably contracted to write backdoors as alleged. If those were written, I don't believe they made it into our tree. They might have been deployed as their own product."<ref name="informationweek_ipsec" />

=== Criticisms ===
In December 2017, Ilja van Sprundel, director at [[Company:IOActive|IOActive]], gave a talk at the CCC<ref>{{Cite web|url=https://media.ccc.de/v/34c3-8968-are_all_bsds_created_equally|title=Are all BSDs created equally? — A survey of BSD kernel vulnerabilities.|last=Van Sprundel|first=Ilja|date=December 2017}}</ref> as well as DEF CON,<ref>{{Cite web|url=https://media.defcon.org/DEF%20CON%2025/DEF%20CON%2025%20presentations/DEF%20CON%2025%20-%20Ilja-van-Sprundel-BSD-Kern-Vulns.pdf|title=Are all BSDs created equally? — A survey of BSD kernel vulnerabilities.|last=Van Sprundel|first=Ilja|date=July 2017}}</ref> entitled "Are all BSDs created equally? — A survey of BSD kernel vulnerabilities.", in which he stated that although OpenBSD was the clear winner of the BSDs in terms of security, "Bugs are still easy to find in those kernels, even in OpenBSD".

Two years later, in 2019, a talk named "A systematic evaluation of OpenBSD’s mitigations" was given<ref>{{Cite web|url=https://fahrplan.events.ccc.de/congress/2019/Fahrplan/events/10519.html|title=Lecture: A systematic evaluation of OpenBSD's mitigations|date=December 2019}}</ref> at the CCC, arguing that while OpenBSD has some effective mitigations, a significant part of them are "useless at best and based on pure luck and superstition", arguing for a more rational approach when it comes to designing them.<ref>{{cite web|url=https://isopenbsdsecu.re/|title=Is OpenBSD secure?|date=29 December 2019}}</ref>

==Hardware compatibility==
Supported platforms and devices are listed in the OpenBSD Supported Platforms Notes.<ref name="openbsd_platforms">{{cite web | url = https://www.openbsd.org/plat.html | title =  OpenBSD Supported Platforms | access-date = 2020-07-14 | publisher = OpenBSD Foundation}}</ref> Other configurations may also work, but simply have not been tested or documented yet. Rough automatically extracted lists of supported device ids are available in a third party repository.<ref name="supported_pci_ids">{{cite web | url = https://github.com/bsdhw/Drivers/blob/master/openbsd/openbsd-6.7.list | title = OpenBSD 6.7: ids of supported devices | access-date = 2020-07-14 | publisher = BSD Hardware Project}}</ref>

In 2020, a new project was introduced to automatically collect information about tested hardware configurations.<ref name="bsdhw">{{cite web | url = https://github.com/bsdhw/Trends/tree/master/Dist/OpenBSD | title = OpenBSD Hardware Trends | access-date = 2020-07-14 | publisher = BSD Hardware Project}}</ref>

== Subprojects ==
Many open source projects started as components of OpenBSD, including:

{{div col}}
* [[Software:Bioctl|bioctl]], a generic RAID management interface similar to [[Software:Ifconfig|ifconfig]]
* [[Common Address Redundancy Protocol|CARP]], a free alternative to [[Company:Cisco Systems|Cisco]]'s patented [[Hot Standby Router Protocol|HSRP]]/[[Virtual Router Redundancy Protocol|VRRP]] redundancy protocols
* [[Software:Cwm (window manager)|cwm]], a stacking window manager
* OpenBSD httpd,<ref>{{cite web|url=https://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/httpd/|title=src/usr.sbin/httpd/|website=OpenBSD CVSWeb}}</ref><ref>{{cite web|url=https://www.freshports.org/www/obhttpd/|title=web/obhttpd: OpenBSD http server|website=Freshports}}</ref> an implementation of httpd
* [[Software:Hw.sensors|hw.sensors]], a sensors framework used by over 100 drivers
* [[Software:LibreSSL|LibreSSL]], an implementation of the SSL and [[Transport Layer Security|TLS]] protocols, forked from [[Software:OpenSSL|OpenSSL]] 1.0.1g<ref>{{cite web|title=LibreSSL|url=https://www.libressl.org|access-date=8 August 2019}}</ref>
* [[Software:OpenBGPD|OpenBGPD]], an implementation of [[Border Gateway Protocol|BGP-4]]<ref name="openbgpd">{{cite web|title=OpenBGPD|url=http://www.openbgpd.org|access-date=8 August 2019}}</ref>
* [[Software:OpenIKED|OpenIKED]], an implementation of IKEv2<ref>{{cite web|title=OpenIKED|url=https://www.openiked.org|access-date=8 August 2019|archive-url=https://web.archive.org/web/20170514230834/http://www.openiked.org/|archive-date=14 May 2017|url-status=dead}}</ref>
* [[Software:OpenNTPD|OpenNTPD]], a simpler alternative to ntp.org's [[Network Time Protocol|NTP]] daemon<ref>{{cite web|title=OpenNTPD|url=http://www.openntpd.org|access-date=8 August 2019}}</ref>
* [[Software:OpenOSPFD|OpenOSPFD]], an implementation of [[Open Shortest Path First|OSPF]]<ref name="openbgpd" />
* [[Software:OpenSMTPD|OpenSMTPD]], an [[Simple Mail Transfer Protocol|SMTP]] daemon with [[IPv4]]/[[IPv6]], PAM, Maildir, and virtual domains support<ref>{{cite web|title=OpenSMTPD|url=https://www.opensmtpd.org|access-date=8 August 2019}}</ref>
* [[Software:OpenSSH|OpenSSH]], an implementation of [[Secure Shell|SSH]]<ref>{{cite web|title=OpenSSH|url=https://www.openssh.com|access-date=8 August 2019}}</ref>
* [[Software:PF (firewall)|PF]], an [[IPv4]]/[[IPv6]] stateful firewall with NAT, PAT, [[Quality of service|QoS]] and traffic normalization support
* [[Software:Pfsync|pfsync]], a firewall state synchronization protocol for [[Software:PF (firewall)|PF]] with [[High availability|high availability]] support using [[Common Address Redundancy Protocol|CARP]]
* [[Software:Sndio|sndio]], a compact audio and MIDI framework
* [[Software:Spamd|spamd]], a spam filter with [[Software:Greylisting (email)|greylisting]] support designed to inter-operate with [[Software:PF (firewall)|PF]]
* [[Software:Xenocara|Xenocara]], a customized [[Software:X.Org Server|X.Org]] build infrastructure<ref name="xenocara" />
{{div col end}}

Some subsystems have been integrated into other BSD operating systems,{{r|freebsd_openssh-base|netbsd_openssh-base|dragonflybsd_openssh-base}} and many are available as packages for use in other Unix-like systems.{{r|archlinux_openssh-portable|opensuse_openssh-portable|debian_openssh-portable}}

Linux administrator Carlos Fenollosa commented on moving from Linux to OpenBSD that the system is faithful to the [[Philosophy:Unix philosophy|Unix philosophy]] of small, simple tools that work together well: "Some base components are not as feature-rich, on purpose. Since 99% of the servers don't need the flexibility of Apache, OpenBSD's httpd will work fine, be more secure, and probably faster".<ref name="Fenollosa">https://cfenollosa.com/blog/openbsd-from-a-veteran-linux-user-perspective.html</ref> He characterized the developer community's attitude to components as: "When the community decides that some module sucks, they develop a new one from scratch. OpenBSD has its own NTPd, SMTPd and, more recently, HTTPd. They work great".<ref name="Fenollosa"/> As a result, OpenBSD is relatively prolific in creating components that become widely reused by other systems.

OpenBSD runs nearly all of its standard [[Daemon (computing)|daemon]]s within [[Chroot|chroot]] and [[Privilege separation|privsep]] security structures by default, as part of hardening the base system.<ref name="Fenollosa"/>

The [[Calgary Internet Exchange]] was formed in 2012, in part to serve the needs of the OpenBSD project.<ref name="cuug">{{cite web
 | title = An Internet Exchange for Calgary
 | url = http://www.yycix.ca/talks/cuug-2013-06-18/an-internet-exchange-for-Calgary.pdf
 | last = De Raadt
 | first = Theo
 | date=18 June 2013
 | access-date=9 October 2018}}</ref>

== Third-party components ==
OpenBSD includes a number of [[Third-party software component|third-party components]], many with OpenBSD-specific patches,<ref name="6.0-release" /> such as [[Software:X.Org Server|X.Org]], [[Software:Clang|Clang]]<ref name="man_clang-local" /> (the default [[Compiler|compiler]] on several [[Computer architecture|architectures]]), [[Software:GNU Compiler Collection|GCC]],<ref name="man_gcc-local" />{{refn|group=n|name=compiler-version|{{As of|2018|April|alt=As of OpenBSD 6.3}}, either Clang 5.0.1, GCC 4.2.1 or GCC 3.3.6 is shipped, depending on the platform.<ref name=man_clang-local /><ref name=man_gcc-local />}} [[Perl]], [[Software:NSD|NSD]], [[Software:Unbound (DNS server)|Unbound]], [[Software:Ncurses|ncurses]], GNU binutils, [[Software:GNU Debugger|GDB]], and [[AWK]].

== Development ==
[[File:OpenBSD hackers at c2k++ at MIT.jpg|thumb|right|OpenBSD developers at c2k1 hackathon at MIT, June 2001]]

Development is continuous, and team management is open and tiered. Anyone with appropriate skills may contribute, with commit rights being awarded on merit and De Raadt acting as coordinator.{{r|absolute_openbsd|page=xxxv}} Two official releases are made per year, with the version number incremented by 0.1,<ref name="deraadt_interview_200605" /> and these are each supported for twelve months (two release cycles).<ref name="openbsd_faq_building_system_source" /> Snapshot releases are also available at frequent intervals.

Maintenance patches for supported releases may be applied manually or by updating the system against the patch branch of the [[Software:Concurrent Versions System|CVS]] repository for that release.<ref name="openbsd_faq_system_management" /> Alternatively, a system administrator may opt to upgrade using a snapshot release and then regularly update the system against the {{mono|-current}} branch of the CVS repository, in order to gain pre-release access to recently added features.

The generic OpenBSD kernel provided by default is strongly recommended for end users, in contrast to operating systems that recommend user kernel customization.<ref name="faq9" />

Packages outside the base system are maintained by CVS through a [[Software:Ports collection|ports tree]] and are the responsibility of the individual maintainers, known as porters. As well as keeping the current branch up to date, porters are expected to apply appropriate bug-fixes and maintenance fixes to branches of their package for OpenBSD's supported releases. Ports are generally not subject to the same continuous auditing as the base system due to lack of manpower.

Binary packages are built centrally from the ports tree for each architecture. This process is applied for the current version, for each supported release, and for each snapshot. Administrators are recommended to use the package mechanism rather than build the package from the ports tree, unless they need to perform their own source changes.

OpenBSD's developers regularly meet at special events called hackathons,<ref name="openbsd-hackathons" /> where they "sit down and code", emphasizing productivity.<ref name="deraadt_interview_200603" />
[[File:S2k17.gif|thumb|OpenBSD hackathon s2k17]]

Most new releases include a song.<ref name=lyrics />

== Open source and open documentation ==
OpenBSD is known for its high-quality documentation.<ref name="chisnall2006"/><ref name="smith2013"/>

When OpenBSD was created, De Raadt decided that the [[Source code|source code]] should be available for anyone to read. At the time, a small team of developers generally had access to a project's source code.<ref name="cvs" /> Chuck Cranor<ref name="cranor" /> and De Raadt concluded this practice was "counter to the open source philosophy" and inconvenient to potential contributors. Together, Cranor and De Raadt set up the first public, anonymous [[Software:Concurrent Versions System|CVS]] server. De Raadt's decision allowed users to "take a more active role", and established the project's commitment to open access.<ref name="cvs"/>

OpenBSD does not include closed source binary drivers in the source tree, nor do they include code requiring the signing of [[Social:Non-disclosure agreement|non-disclosure agreement]]s.<ref name="openbsd_goals_code" />

Since OpenBSD is based in Canada, no United States export restrictions on cryptography apply, allowing the distribution to make full use of modern algorithms for encryption. For example, the swap space is divided into small sections and each section is encrypted with its own key, ensuring that sensitive data does not leak into an insecure part of the system.<ref name="closer-look-openbsd" />

OpenBSD randomizes various behaviors of applications, making them less predictable and thus more difficult to attack. For example, PIDs are created and associated randomly to processes; the <code>bind</code> [[System call|system call]] uses random [[Port (computer networking)|port numbers]]; files are created with random [[Inode|inode]] numbers; and IP datagrams have random identifiers.<ref name="crypto-openbsd-overview_randomness" /> This approach also helps expose bugs in the kernel and in user space programs.

The OpenBSD policy on openness extends to hardware documentation: in the slides for a December 2006 presentation, De Raadt explained that without it "developers often make mistakes writing drivers", and pointed out that "the [oh my god, I got it to work] rush is harder to achieve, and some developers just give up."<ref name="deraadtopencon06"/> He went on to say that vendor-supplied binary drivers are unacceptable for inclusion in OpenBSD, that they have "no trust of vendor binaries running in our kernel" and that there is "no way to fix [them] ... when they break."<ref name="deraadtopencon06"/>

== Licensing ==

OpenBSD maintains a strict license policy,<ref name="policy"/> preferring the [[ISC license]] and other variants of the [[Simplified BSD License|BSD license]]. The project attempts to "maintain the spirit of the original Berkeley Unix [[Copyright|copyright]]s," which permitted a "relatively un-encumbered Unix source distribution."<ref name="policy" /> The widely used [[Software:Apache License|Apache License]] and [[Software:GNU General Public License|GNU General Public License]] are considered overly restrictive.<ref name="bsd-cognoscenti-on-linux" />

In June 2001, triggered by concerns over Darren Reed's modification of IPFilter's license wording, a systematic license audit of the OpenBSD ports and source trees was undertaken.<ref name="license-disagreement" /> Code in more than a hundred files throughout the system was found to be unlicensed, ambiguously licensed or in use against the terms of the license. To ensure that all licenses were properly adhered to, an attempt was made to contact all the relevant copyright holders: some pieces of code were removed, many were replaced, and others, such as the [[Engineering:Multicast|multicast]] [[Routing|routing]] tools {{mono|mrinfo}} and {{mono|map-mbone}}, were relicensed so that OpenBSD could continue to use them.<ref name="cvsweb_mrinfo_xerox" /><ref name="cvsweb_map-mbone_xerox" /> Also removed during this audit was all software produced by Daniel J. Bernstein. At the time, Bernstein requested that all modified versions of his code be approved by him prior to redistribution, a requirement to which OpenBSD developers were unwilling to devote time or effort.{{r|djb-ports-removed-1|djb-ports-removed-2|djb-ports-removed-3}}

Because of licensing concerns, the OpenBSD team has reimplemented software from scratch or adopted suitable existing software. For example, OpenBSD developers created the [[Software:PF (firewall)|PF]] packet filter after unacceptable restrictions were imposed on [[Software:IPFilter|IPFilter]]. PF first appeared in OpenBSD 3.0<ref name="pf-design-paper" /> and is now available in many other operating systems.<ref name="pf-book" /> OpenBSD developers have also replaced GPL-licensed tools (such as [[Software:Concurrent Versions System|CVS]], [[Software:Diff|diff]], [[Software:Grep|grep]] and [[Software:Pkg-config|pkg-config]]) with [[Permissive software license|permissively licensed]] equivalents.<ref>{{cite web|title=New BSD licensed CVS replacement for OpenBSD|url=https://slashdot.org/story/52396|access-date=9 October 2018}}</ref><ref>{{cite web|title=pkg-config(1)|url=https://man.openbsd.org/pkg-config.1|access-date=9 October 2018}}</ref>

== Funding ==
Although the operating system and its portable components are used in commercial products, De Raadt says that little of the funding for the project comes from the industry: "traditionally all our funding has come from user donations and users buying our CDs (our other products don't really make us much money). Obviously, that has not been a lot of money."<ref name="deraadt_interview_200605" />

For a two-year period in the early 2000s, the project received funding from DARPA, which "paid the salaries of 5 people to work completely full-time, bought about $30k in hardware, and paid for 3 hackathons", from the POSSE project.<ref name="deraadt_interview_200605" />

In 2006, the OpenBSD project experienced financial difficulties.<ref name="slashdot_financial_danger" /> The [[Organization:Mozilla Foundation|Mozilla Foundation]]<ref name="slashdot_mozilla_donate" /> and [[Company:GoDaddy|GoDaddy]]<ref name="thehostingnews_godaddy_donate" /> are among the organizations that helped OpenBSD to survive. However, De Raadt expressed concern about the asymmetry of funding: "I think that contributions should have come first from the vendors, secondly from the corporate users, and thirdly from individual users. But the response has been almost entirely the opposite, with almost a 15-to-1 dollar ratio in favor of the little people. Thanks a lot, little people!"<ref name="deraadt_interview_200605" />

On 14 January 2014, Bob Beck issued a request for funding to cover electrical costs. If sustainable funding was not found, Beck suggested the OpenBSD project would shut down.<ref name="funding-2014" /> The project soon received a US$20,000 donation from Mircea Popescu, the Romanian creator of the MPEx bitcoin stock exchange, paid in [[Software:Bitcoin|bitcoin]]s.<ref name="Bright" /> The project raised US$150,000<ref name="2014_fundraising_campaign" /> in response to the appeal, enabling it to pay its bills and securing its short-term future.<ref name="Bright" /> Since 2014, several large contributions to the [[Organization:OpenBSD Foundation|OpenBSD Foundation]] have come from corporations such as Microsoft,<ref name="register_rain_cash" /> Facebook, and Google as well as the Core Infrastructure Initiative.<ref name="foundation_contributors" />

During the 2016 and 2017 fundraising campaigns, [[Company:Smartisan|Smartisan]], a Chinese company, was the leading financial contributor to the project.<ref>{{cite web|title=OpenBSD Donors|url=http://www.openbsdfoundation.org/contributors.html}}</ref><ref>{{cite web|title=Smartisan Makes Another Iridium Donation to the OpenBSD Foundation|url=http://undeadly.org/cgi?action=article&sid=20170817195416|website=Undeadly}}</ref>

== Distribution ==
OpenBSD is freely available in various ways: the source can be retrieved by anonymous [[Software:Concurrent Versions System|CVS]],<ref name="anoncvs" /> and binary releases and development snapshots can be downloaded by FTP, HTTP, and rsync.<ref name="ftp" /> Prepackaged CD-ROM sets through version 6.0 can be ordered online for a small fee, complete with an assortment of stickers and a copy of the release's theme song. These, with their artwork and other bonuses, have been one of the project's few sources of income, funding hardware, Internet service, and other expenses.<ref name="orders" /> Beginning with version 6.1, CD-ROM sets are no longer released.

OpenBSD provides a [[Package manager|package management system]] for easy installation and management of programs which are not part of the base operating system.<ref name="faq15" /> Packages are binary files which are extracted, managed and removed using the package tools. On OpenBSD, the source of packages is the ports system, a collection of [[Makefile]]s and other infrastructure required to create packages. In OpenBSD, the ports and base operating system are developed and released together for each version: this means that the ports or packages released with, for example, 4.6 are not suitable for use with 4.5 and vice versa.<ref name="faq15" />

=== Songs and artwork ===
[[File:Puffy mascot openbsd.gif|thumb|Puffy, the [[Social:Mascot|mascot]] of OpenBSD]]
[[File:Puffyanim.gif|thumb|right|3D-rendered, animated OpenBSD mascot ''Puffy'']]
Initially, OpenBSD used a haloed version of the BSD daemon mascot drawn by Erick Green, who was asked by De Raadt to create the logo for the 2.3 and 2.4 versions of OpenBSD. Green planned to create a full daemon, including head and body, but only the head was completed in time for OpenBSD 2.3. The body as well as pitchfork and tail was completed for OpenBSD 2.4.<ref name="mckusick_openbsd_shirt" />
[[File:Openbsd23cover.gif|thumb|OpenBSD 2.3 cover]]

Subsequent releases used variations such as a police daemon by Ty Semaka,<ref name="openbsd_2.5_release" /> but eventually settled on a pufferfish named Puffy.<ref name="2.7-release" /> Since then, Puffy has appeared on OpenBSD promotional material and featured in release songs and artwork.

The promotional material of early OpenBSD releases did not have a cohesive theme or design, but later the CD-ROMs, release songs, posters and tee-shirts for each release have been produced with a single style and theme, sometimes contributed to by Ty Semaka of the Plaid Tongued Devils.<ref name="lyrics" /> These have become a part of OpenBSD advocacy, with each release expounding a moral or political point important to the project, often through parody.<ref name="4.0-review" />

Themes have included ''Puff the Barbarian'' in OpenBSD 3.3, which included an 80s rock song and parody of Conan the Barbarian alluding to open documentation,<ref name="lyrics" /> ''The Wizard of OS'' in OpenBSD 3.7, related to the project's work on wireless drivers, and ''Hackers of the Lost RAID'', a parody of Indiana Jones referencing the new RAID tools in OpenBSD 3.8.

== See also ==
*[[Software:Comparison of BSD operating systems|Comparison of BSD operating systems]]
*[[Company:Comparison of free and open-source software licenses|Comparison of free and open-source software licenses]]
*[[Software:Comparison of open-source operating systems|Comparison of open-source operating systems]]
*[[KAME project]], responsible for OpenBSD's IPv6 support
*[[OpenBSD Journal]]
*[[OpenBSD security features]]
*[[Software:OpenBSD version history|OpenBSD version history]]
*[[Security-focused operating system]]
*[[Unix security]]

== Notes ==
{{reflist|group=n}}

== References ==
{{Reflist|refs=

<ref name="2014_fundraising_campaign">{{cite web
|url         = http://www.openbsdfoundation.org/campaign2014.html
|title       = The OpenBSD Foundation 2014 Fundraising Campaign
|work        = [[Organization:OpenBSD Foundation|OpenBSD Foundation]]
|access-date  = 24 May 2014
}}</ref>

<ref name="2.0-release">{{cite mailing list
|url         = http://wolfram.schneider.org/bsd/ftp/releases/OpenBSD-2.0
|title       = The OpenBSD 2.0 release
|first       = Theo
|last        = De Raadt
|date        = 18 October 1996
|mailing-list = openbsd-announce
}}</ref>

<ref name="2.3-announcement">{{cite mailing list
|url         = http://wolfram.schneider.org/bsd/ftp/releases/OpenBSD-2.3
|title       = 2.3 release announcement
|first       = Theo
|last        = De Raadt
|date        = 19 December 2005
|mailing-list = openbsd-misc
|quote       = Without [SNI's] support at the right time, this release probably would not have happened.
}}</ref>

<ref name="2.7-release">{{cite web
|url        = http://www.openbsd.org/27.html
|title      = OpenBSD 2.7
|work       = OpenBSD
|access-date = 22 May 2016
}}</ref>

<ref name="4.0-review">{{cite web
|last       = Matzan
|first      = Jem
|url        = http://www.softwareinreview.com/bsd/openbsd_4.0_review.html
|title      = OpenBSD 4.0 review
|work       = Software in Review
|date       = 1 December 2006
|access-date = 13 December 2011
|quote      = Each OpenBSD release has a graphical theme and a song that goes with it. The theme reflects a major concern that the OpenBSD programmers are addressing or bringing to light.
}}</ref>

<ref name="6.0-release">{{cite web
|url        = https://www.openbsd.org/59.html
|title      = OpenBSD 6.0
|work       = OpenBSD
|access-date = 1 November 2016
}}</ref>

<ref name="absolute_openbsd">{{cite book
| last          = Lucas
| first         = Michael W.
| title         = Absolute OpenBSD: Unix for the Practical Paranoid
|url            = https://www.nostarch.com/obenbsd2e
| edition       = 2nd
| date          = April 2013
| publisher     = No Starch Press
|location       = San Francisco, California
| isbn          = 978-1-59327-476-4
}}</ref>

<ref name="allegations-ipsec">{{cite mailing list
|url          = http://marc.info/?l=openbsd-tech&m=129236621626462&w=2
|title        = Allegations regarding OpenBSD IPSEC
|first        = Theo
|last         = De Raadt
|date         = 14 December 2010
|access-date   = 28 May 2016
|mailing-list = openbsd-tech
}}</ref>

<ref name="announcing-openbsd-foundation">{{cite web
|url         = http://undeadly.org/cgi?action=article&sid=20070726015128
|title       = Announcing – The OpenBSD Foundation
|author      = <!--Not stated-->
|work        = [[OpenBSD Journal]]
|date        = 26 July 2007
}}</ref>

<ref name="anoncvs">{{cite web
|url        = http://www.openbsd.org/anoncvs.html
|title      = Anonymous CVS
|work       = OpenBSD
|access-date = 13 December 2011
}}</ref>

<ref name="archlinux_openssh-portable">{{cite web
|url        = https://www.archlinux.org/packages/core/x86_64/openssh/
|title      = Arch Linux – openssh 7.2p2-1 (x86_64)
|work       = [[Software:Arch Linux|Arch Linux]]
|access-date = 17 May 2016
}}</ref>

<ref name="Bright">{{cite web
|last       = Bright
|first      = Peter
|url        = https://arstechnica.com/information-technology/2014/01/openbsd-rescued-from-unpowered-oblivion-by-20k-bitcoin-donation/
|title      = OpenBSD rescued from unpowered oblivion by $20K bitcoin donation
|work       = [[Ars Technica]]
|date       = 20 January 2014
|access-date = 20 January 2014
}}</ref>

<ref name="calyptix">{{cite web
|url        = http://www.calyptix.com/products/models/ae800/
|title      = AccessEnforcer Model AE800
|work       = Calyptix Security
|access-date = 28 May 2016
}}</ref>

<ref name="bsd-cognoscenti-on-linux">{{cite web
|url         = https://www.linux.com/news/bsd-cognoscenti-linux
|title       = BSD cognoscenti on Linux
|first       = Jem
|last        = Matzan
|work        = NewsForge
|publisher   = Linux.com
|date        = 15 June 2005
|access-date  = 28 May 2016
}}</ref>

<ref name="chisnall2006">{{cite web
 |url         = http://www.informit.com/articles/article.aspx?p=439601&seqNum=3
 |title       = BSD: The Other Free UNIX Family
 |last        = Chisnall
 |first       = David
 |work        = InformIT
 |date        = 20 January 2006
 |archive-url  = https://www.webcitation.org/6O4uQJJs0?url=http://www.informit.com/articles/article.aspx?p=439601&seqNum=3
 |archive-date = 14 March 2014
 |url-status     = live
}}</ref>

<ref name="closer-look-openbsd">{{cite web
|first      = Tim
|last       = McIntire
|url        = http://www.ibm.com/developerworks/aix/library/au-openbsd.html
|title      = Take a closer look at OpenBSD
|work       = Developerworks
|publisher  = [[Company:IBM|IBM]]
|date       = 8 August 2006
|access-date = 13 December 2011
}}</ref>

<ref name="cranor">{{cite web
|url        = http://chuck.cranor.org/
|title      = Chuck Cranor's Home Page
|first      = Chuck D.
|last       = Cranor
|access-date = 13 December 2011
|quote      = I also hosted and helped create the first Anonymous CVS server on the Internet (the original {{URL|anoncvs.openbsd.org}} [...]
}}</ref>

<ref name="crypto-openbsd-overview">{{cite conference
|url           = https://www.usenix.org/legacy/publications/library/proceedings/usenix99/deraadt.html
|title         = Cryptography in OpenBSD: An Overview
|first1        = Theo
|last1         = De Raadt
|first2        = Niklas
|last2         = Hallqvist
|first3        = Artur
|last3         = Grabowski
|first4        = Angelos D.
|last4         = Keromytis
|first5        = Niels
|last5         = Provos
|date          = 6 June 1999
|conference    = [[Organization:USENIX|USENIX]] Annual Technical Conference
|location      = Monterey, California
|access-date    = 27 May 2016
}}</ref>

<ref name="crypto-openbsd-overview_randomness">{{cite conference
|title         = Cryptography in OpenBSD: An Overview
|url           = https://www.usenix.org/legacy/publications/library/proceedings/usenix99/deraadt.html
|chapter-url   = https://www.usenix.org/legacy/publications/library/proceedings/usenix99/full_papers/deraadt/deraadt_html/node18.html
|chapter       = Randomness Used Inside the Kernel
|first1        = Theo
|last1         = De Raadt
|first2        = Niklas
|last2         = Hallqvist
|first3        = Artur
|last3         = Grabowski
|first4        = Angelos D.
|last4         = Keromytis
|first5        = Niels
|last5         = Provos
|date          = 6 June 1999
|conference    = [[Organization:USENIX|USENIX]] Annual Technical Conference
|location      = Monterey, California
|access-date    = 1 February 2014
}}</ref>

<ref name="cvs">{{cite conference
|url        = https://www.usenix.org/legacy/event/usenix99/cranor_f.html
|title      = Opening the Source Repository with Anonymous CVS
|first1     = Chuck D.
|last1      = Cranor
|first2     = Theo
|last2      = De Raadt
|date       = 6 June 1999
|access-date = 13 December 2011
|conference = [[Organization:USENIX|USENIX]] Annual Technical Conference
|location   = Monterey, California
}}</ref>

<ref name="cvsweb_map-mbone_xerox">{{cite web
|url        = http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/map-mbone/mapper.c?rev=1.5&content-type=text/x-cvsweb-markup
|title      = src/usr.sbin/map-mbone/mapper.c – view – 1.5
|work       = cvsweb.openbsd.org
|date       = 31 July 2001 <!-- date from CVS log -->
|access-date = 24 May 2016
|quote      = New license from Xerox!  This code is now FREE!  Took a while and a lot of mails, but it is worth it.
}}</ref>

<ref name="cvsweb_mrinfo_xerox">{{cite web
|url        = http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/usr.sbin/mrinfo/mrinfo.c?rev=1.7&content-type=text/x-cvsweb-markup
|title      = src/usr.sbin/mrinfo/mrinfo.c – view – 1.7
|work       = cvsweb.openbsd.org
|date       = 31 July 2001 <!-- date from CVS log -->
|access-date = 24 May 2016
|quote      = New license from Xerox!  This code is now FREE!  Took a while and a lot of mails, but it is worth it.
}}</ref>

<ref name="debian_openssh-portable">{{cite web
|url        = https://packages.debian.org/jessie/openssh-client
|title      = Debian – Details of package openssh-client in jessie
|work       = [[Software:Debian|Debian]]
|access-date = 17 May 2016
}}</ref>

<ref name="deraadt_interview_200603">{{cite web
|url        = https://www.linux.com/news/interview-theo-de-raadt-openbsd/
|title      = Interview: Theo de Raadt of OpenBSD
|work       = NewsForge
|date       = 28 March 2006
|access-date = 31 March 2016
}}</ref>

<ref name="deraadt_interview_200605">{{cite web
|url         = http://kerneltrap.org/node/6550
|title       = Interview: Theo de Raadt
|first       = Jeremy
|last        = Andrews
|work        = KernelTrap
|date        = 2 May 2006
|archive-url  = https://web.archive.org/web/20130424125958/http://kerneltrap.org/node/6550
|archive-date = 24 April 2013
}}</ref>

<ref name="deraadtopencon06">{{cite web
|url        = http://www.openbsd.org/papers/opencon06-docs/index.html
|title      = Presentation at OpenCON
|last       = De Raadt
|first      = Theo
|website    = OpenBSD
|date       = 5 December 2006 <!-- date from CVS log -->
|access-date = 13 December 2011
}}</ref>

<ref name="djb-ports-removed-1">{{cite mailing list
|url         = http://archives.neohapsis.com/archives/openbsd/2001-08/2544.html
|title       = Re: Why were all DJB's ports removed? No more qmail?
|first       = Theo
|last        = De Raadt
|date        = 24 August 2001
|mailing-list = openbsd-misc
|archive-url  = https://web.archive.org/web/20160419110701/http://archives.neohapsis.com/archives/openbsd/2001-08/2544.html
|archive-date = 19 April 2016
}}</ref>

<ref name="djb-ports-removed-2">{{cite mailing list
|url         = http://archives.neohapsis.com/archives/openbsd/2001-08/2812.html
|title       = Re: Why were all DJB's ports removed? No more qmail?
|first       = Daniel J.
|last        = Bernstein
|date        = 27 August 2001
|mailing-list = openbsd-misc
|archive-url  = https://web.archive.org/web/20120204203539/http://archives.neohapsis.com/archives/openbsd/2001-08/2812.html
|archive-date=4 February 2012
}}</ref>

<ref name="djb-ports-removed-3">{{cite mailing list
|url         = http://archives.neohapsis.com/archives/openbsd/2001-08/2864.html
|title       = Re: Why were all DJB's ports removed? No more qmail?
|first       = Marc
|last        = Espie
|date        = 28 August 2001
|mailing-list = openbsd-misc
|archive-url  = https://web.archive.org/web/20160419080907/http://archives.neohapsis.com/archives/openbsd/2001-08/2864.html
|archive-date = 19 April 2016
}}</ref>

<ref name="dragonflybsd_openssh-base">{{cite web
|title      = dragonfly.git/blob – crypto/openssh/README
|url        = https://gitweb.dragonflybsd.org/dragonfly.git/blob/HEAD:/crypto/openssh/README
|website    = gitweb.dragonflybsd.org
|access-date = 19 May 2016
|quote      = This is the port of OpenBSD's excellent OpenSSH to Linux and other Unices.
}}</ref>

<ref name="faq9">{{cite web
|url        = http://www.openbsd.org/faq/faq1.html#OtherUnixes
|title      = Migrating to OpenBSD
|work       = OpenBSD Frequently Asked Questions
|access-date = 4 January 2017
}}</ref>

<ref name="faq11">{{cite web
|url        = http://www.openbsd.org/faq/faq11.html
|title      = The X Windows System
|work       = OpenBSD Frequently Asked Questions
|access-date = 22 May 2016
|quote      = OpenBSD ships with the cwm(1), fvwm(1) and twm(1) window managers, [...]
}}</ref>

<ref name="faq15">{{cite web
|url        = http://www.openbsd.org/faq/faq15.html
|title      = Packages and Ports
|work       = OpenBSD Frequently Asked Questions
|access-date = 22 May 2016
}}</ref>

<ref name="faq15-pkgs">{{cite web
|url         = https://www.openbsd.org/faq/faq15.html#PkgMgmt
|title       = Package Management
|work        = OpenBSD Frequently Asked Questions
|access-date  = 1 June 2016
}}</ref>

<ref name="foundation_contributors">{{cite web
|title      = Contributors
|url        = http://www.openbsdfoundation.org/contributors.html
|work       = [[Organization:OpenBSD Foundation|OpenBSD Foundation]]
|access-date = 27 May 2016
}}</ref>

<ref name="free-for-all">{{cite book
 |url         = http://www.jus.uio.no/sisu/free_for_all.peter_wayner/index.html
 |title       = Free For All: How Linux and the Free Software Movement Undercut the High Tech Titans
 |chapter     = 18.3 Flames, Fights, and the Birth of OpenBSD
 |first       = Peter
 |last        = Wayner
 |edition     = 1st
 |publisher   = HarperBusiness
 |isbn        = 978-0-06-662050-3
 |date        = 13 July 2000
 |access-date  = 13 December 2011
 |url-status     = dead
 |archive-url = https://web.archive.org/web/20120122011859/http://www.jus.uio.no/sisu/free_for_all.peter_wayner/index.html
 |archive-date = 22 January 2012
 |df          = dmy-all
}}</ref>

<ref name="freebsd_openssh-base">{{cite web
|url        = https://svnweb.freebsd.org/base/stable/10/crypto/openssh/README?view=markup
|title      = Contents of /stable/10/crypto/openssh/README
|website    = svnweb.freebsd.org
|access-date = 19 May 2016
|quote      = This is the port of OpenBSD's excellent OpenSSH to Linux and other Unices.
}}</ref>

<ref name="ftp">{{cite web
|url        = http://www.openbsd.org/ftp.html
|title      = Mirrors
|work       = OpenBSD
|access-date = 22 May 2016
}}</ref>

<ref name="funding-2014">{{cite mailing list
|url          = http://marc.info/?l=openbsd-misc&m=138972987203440&w=2
|title        = Request for Funding our Electricity
|mailing-list = openbsd-misc
|last         = Beck
|first        = Bob
|date         = 14 January 2014
|access-date   = 17 May 2016
}}</ref>

<ref name="genua">{{cite web
|url        = https://www.genua.de/en/products/high-resistance-firewall-genugate.html
|title      = High Resistance Firewall genugate
|work       = GeNUA
|access-date = 29 May 2016
}}</ref>

<ref name="glass">{{cite mailing list
|url         = http://mail-index.netbsd.org/netbsd-users/1994/12/23/0000.html
|title       = Theo De Raadt
|first       = Adam
|last        = Glass
|date        = 23 December 1994
|mailing-list = netbsd-users
}}</ref>


<ref name="informationweek_ipsec">{{cite web
 |title       = OpenBSD Founder Believes FBI Built IPsec Backdoor
 |url         = http://www.darkreading.com/vulnerabilities-and-threats/openbsd-founder-believes-fbi-built-ipsec-backdoor/d/d-id/1095055
 |work        = InformationWeek: DARKreading
 |date        = 22 December 2010
 |author      = Mathew J. Schwartz
 |url-status     = dead
 |archive-url  = https://web.archive.org/web/20170711004138/http://www.darkreading.com/vulnerabilities-and-threats/openbsd-founder-believes-fbi-built-ipsec-backdoor/d/d-id/1095055
 |archive-date = 11 July 2017
}}</ref>

<ref name="infoworld_new_years_resolution">{{cite web
 |title=New year's resolution No. 1: Get OpenBSD
 |url=http://www.infoworld.com/article/2659465/security/new-year-s-resolution-no--1--get-openbsd.html
 |last=Grimes
 |first=Roger A.
 |work=InfoWorld
 |date=29 December 2006
}}</ref>

<ref name="interview-espie">{{cite web
|url        = http://www.onlamp.com/pub/a/bsd/2004/03/18/marc_espie.html
|title      = An Interview with OpenBSD's Marc Espie
|first      = Federico
|last       = Biancuzzi
|work       = ONLamp
|date       = 18 March 2004
|access-date = 13 December 2011
}}</ref>

<ref name="license-disagreement">{{cite web
|url         = http://www.linux.com/feature/12774
|title       = OpenBSD and ipfilter still fighting over license disagreement
|first       = Tina
|last        = Gasperson
|date        = 6 June 2001
|work        = Linux.com
|archive-url  = https://web.archive.org/web/20080626101129/http://www.linux.com/feature/12774
|archive-date = 26 June 2008
}}</ref>

<ref name="lyrics">{{cite web
|url        = http://www.openbsd.org/lyrics.html
|title      = Release Songs
|work       = OpenBSD
|access-date = 22 May 2016
}}</ref>

<ref name="man_clang-local">{{cite web
|url         = http://man.openbsd.org/OpenBSD-6.2/man1/clang-local.1
|title       = clang-local – OpenBSD-specific behavior of LLVM/clang
|work        = OpenBSD manual pages
|access-date  = 2 February 2018
}}</ref>

<ref name="man_gcc-local">{{cite web
|url         = http://man.openbsd.org/OpenBSD-6.0/man1/gcc-local.1
|title       = gcc-local – local modifications to gcc
|work        = OpenBSD manual pages
|access-date  = 1 November 2016
}}</ref>


<ref name="mckusick_openbsd_shirt">{{cite web
|title      = OpenBSD
|url        = http://www.mckusick.com/beastie/shirts/openbsd.html
|website    = mckusick.com
|access-date = 12 December 2014
}}</ref>

<ref name="netbsd_openssh-base">{{cite web
|title      = src/crypto/external/bsd/openssh/dist/README – view – 1.4
|url        = http://cvsweb.netbsd.org/bsdweb.cgi/src/crypto/external/bsd/openssh/dist/README?rev=1.4&content-type=text/x-cvsweb-markup&only_with_tag=MAIN
|website    = NetBSD CVS Repositories
|access-date = 19 May 2016
}}</ref>

<ref name="no-ipsec-backdoor">{{cite web
|url        = https://arstechnica.com/open-source/news/2010/12/openbsd-code-audit-uncovers-bugs-but-no-evidence-of-backdoor.ars
|title      = OpenBSD code audit uncovers bugs, but no evidence of backdoor
|first      = Paul
|last       = Ryan
|work       = [[Ars Technica]]
|date       = 23 December 2010
|access-date = 9 January 2011
}}</ref>

<ref name="onlamp-interview">{{cite web
|url        = http://www.onlamp.com/pub/a/bsd/2003/07/17/openbsd_core_team.html
|title      = The Essence of OpenBSD
|first1     = Cameron
|last1      = Laird
|first2     = George Peter
|last2      = Staplin
|work       = ONLamp
|date       = 17 July 2003
|access-date = 13 December 2011
}}</ref>

<ref name="openbsd_2.5_release">{{cite mailing list
 |title=OpenBSD 2.5 Release Announcement
 |url=http://www.monkey.org/openbsd/archive/announce/9905/msg00002.html
 |mailing-list=openbsd-announce
 |last=De Raadt
 |first=Theo
 |date=19 May 1999
 |archive-url=https://www.webcitation.org/6O4v6pPuG?url=http://www.monkey.org/openbsd/archive/announce/9905/msg00002.html
 |archive-date=14 March 2014
 |quote=OpenBSD 2.5 introduces the new Cop daemon image done by cartoonist Ty Semeka.
 |url-status=dead
}}</ref>

<ref name="openbsd-desktop">{{cite web
|url       = http://archive09.linux.com/articles/52930
|title       = Using OpenBSD on the desktop
|first       = Manolis
|last       = Tzanidakis
|work       = Linux.com
|date       = 21 April 2006
|access-date       = 9 March 2012
|archive-url       = https://web.archive.org/web/20120505103419/http://archive09.linux.com/articles/52930
|archive-date       = 5 May 2012
|url-status       = dead
}}</ref>

<ref name="openbsd_faq_building_system_source">{{cite web
|url        = https://www.openbsd.org/faq/faq5.html#Flavors
|title      = OpenBSD's flavors
|work       = OpenBSD Frequently Asked Questions
|access-date = 22 May 2016
}}</ref>

<ref name="openbsd_faq_system_management">{{cite web
|title      = Applying patches in OpenBSD
|url        = https://www.openbsd.org/faq/faq10.html#Patches
|work       = OpenBSD Frequently Asked Questions
|access-date = 15 May 2016
}}</ref>

<ref name="openbsd_goals_code">{{cite web
|url        = http://www.openbsd.org/goals.html
|title      = Project Goals
|website    = OpenBSD
|access-date = 18 May 2016
|quote      = Integrate good code from any source with acceptable licenses. [...], NDAs are never acceptable.
}}</ref>

<ref name="openbsd-hackathons">{{cite web
|url        = https://www.openbsd.org/hackathons.html
|title      = Hackathons
|work       = OpenBSD
|access-date = 18 May 2016
}}</ref>

<ref name="openbsd_innovations_privsep">{{cite web
|title      = Innovations
|url        = https://www.openbsd.org/innovations.html
|website    = OpenBSD
|access-date = 18 May 2016
|quote      = Privilege separation: [...] The concept is now used in many OpenBSD programs, for example [...] etc.
}}</ref>

<ref name="openports">{{cite web
|url        = http://openports.se/statistics.php
|title      = OpenPorts.se Statistics
|work       = OpenPorts.se
|access-date = 8 February 2018
}}</ref>

<ref name="openssh-history">{{cite web
|url        = http://www.openssh.com/history.html
|title      = Project History and Credits
|work       = [[Software:OpenSSH|OpenSSH]]
|access-date = 13 December 2011
}}</ref>

<ref name="openssh-usage">{{cite web
|url        = http://www.openssh.com/usage/
|title      = SSH usage profiling
|work       = [[Software:OpenSSH|OpenSSH]]
|access-date = 13 December 2011
}}</ref>

<ref name="opensuse_openssh-portable">{{cite web
|url        = https://software.opensuse.org/package/openssh
|title      = openssh
|work       = [[Software:OpenSUSE|OpenSUSE]]
|access-date = 17 May 2016
}}</ref>

<ref name="orders">{{cite web
|url        = http://www.openbsd.org/orders.html
|title        = Orders
|work        = OpenBSD
|access-date        = 20 May 2016
|archive-url        = https://web.archive.org/web/20111219075939/http://openbsd.org/orders.html
|archive-date        = 19 December 2011
|url-status        = dead
}}</ref>

<ref name="osnews-ipsec">{{cite web
|url        = http://www.osnews.com/story/24136/_FBI_Added_Secret_Backdoors_to_OpenBSD_IPSEC_
|title      = FBI Added Secret Backdoors to OpenBSD IPSEC
|first      = Thom
|last       = Holwerda
|work       = OSNews
|date       = 14 December 2010
|access-date = 13 December 2011
}}</ref>

<ref name="oss-good-for-security">{{cite book
|url         = http://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/index.html
|title       = Secure Programming for Linux and Unix HOWTO
|chapter-url = http://www.dwheeler.com/secure-programs/Secure-Programs-HOWTO/open-source-security.html
|chapter     = 2.4. Is Open Source Good for Security?
|first       = David A.
|last        = Wheeler
|date        = 3 March 2003
|access-date  = 13 December 2011
}}</ref>

<ref name="pf-book">{{cite book
|title      = The OpenBSD PF Packet Filter Book: PF for NetBSD, FreeBSD, DragonFly and OpenBSD
|year = 2006
|publisher  = Reed Media Services
|isbn       = 0-9790342-0-5
|url        = http://www.reedmedia.net/books/pf-book/
|access-date = 19 May 2016
}}</ref>

<ref name="pf-design-paper">{{cite conference
|url        = https://www.usenix.org/legacy/event/usenix02/tech/freenix/hartmeier.html
|title      = Design and Performance of the OpenBSD Stateful Packet Filter (pf)
|first      = Daniel
|last       = Hartmeier
|conference = [[Organization:USENIX|USENIX]] Annual Technical Conference
|location   = Monterey, California
|date       = 10 June 2002
|access-date = 13 December 2011
}}</ref>

<ref name="plat">{{cite web
|url        = http://www.openbsd.org/plat.html
|title      = Platforms
|work       = OpenBSD
|access-date = 3 September 2016
}}</ref>

<ref name="policy">{{cite web
|url        = http://www.openbsd.org/policy.html
|title      = Copyright Policy
|work       = OpenBSD
|access-date = 13 December 2011
}}</ref>

<ref name="privilege-separated-openssh">{{cite web
|first      = Niels
|last      = Provos
|url      = http://www.citi.umich.edu/u/provos/ssh/privsep.html
|title      = Privilege Separated OpenSSH
|date      = 9 August 2003
|access-date      = 13 December 2011
|archive-url      = https://web.archive.org/web/20120102075206/http://www.citi.umich.edu/u/provos/ssh/privsep.html
|archive-date      = 2 January 2012
|url-status      = dead
}}</ref>

<ref name="register_rain_cash">{{cite web
|last1=McAllister
|first1=Neil
|title=Microsoft rains cash on OpenBSD Foundation, becomes top 2015 donor
|url=https://www.theregister.co.uk/2015/07/08/microsoft_donates_to_openbsd_foundation/
|website=The Register
|access-date=27 May 2016
|date=8 July 2015
}}</ref>

<ref name="rtmx">{{cite web
|url        = http://www.rtmx.com/
|title      = RTMX O/S IEEE Real Time POSIX Operating Systems
|work       = RTMX
|access-date = 13 December 2011
|quote      = RTMX O/S is a product extension to OpenBSD Unix-like operating system with emphasis on embedded, dedicated applications.
}}</ref>

<ref name="security">{{cite web
|url        = http://www.openbsd.org/security.html
|title      = Security
|work       = OpenBSD
|access-date = 13 December 2011
|quote      = Secure by Default.
}}</ref>

<ref name="slashdot_financial_danger">{{cite web
|title      = OpenBSD Project in Financial Danger
|url        = http://slashdot.org/story/06/03/21/1555243/openbsd-project-in-financial-danger
|work       = [[Social:Slashdot|Slashdot]]
|date       = 21 March 2006
|access-date = 12 December 2014
}}</ref>

<ref name="slashdot_mozilla_donate">{{cite web
|title      = Mozilla Foundation Donates $10K to OpenSSH
|url        = http://slashdot.org/story/06/04/04/1820228/mozilla-foundation-donates-10k-to-openssh
|publisher  = [[Social:Slashdot|Slashdot]]
|date       = 4 April 2006
|access-date = 12 December 2014
}}</ref>

<ref name="smith2013">{{cite web
 |url=http://distrowatch.com/weekly.php?issue=20131118#feature
 |title=OpenBSD 5.4: Puffy on the Desktop
 |last=Smith
 |first=Jesse
 |date=18 November 2013
 |archive-url=https://www.webcitation.org/6PDllNqHA?url=http://distrowatch.com/weekly.php?issue=20131118#feature
 |archive-date=30 April 2014
 |url-status=live
}}</ref>

<ref name="staying-cutting-edge">{{cite web
|url        = http://www.theage.com.au/articles/2004/10/07/1097089476287.html
|title      = Staying on the cutting edge
|first      = Sam
|last       = Varghese
|work       = The Age
|date       = 8 October 2004
|access-date = 13 December 2011
}}</ref>

<ref name="strlcpy-strlcat-paper">{{cite conference
|first1     = Todd C.
|last1      = Miller
|first2     = Theo
|last2      = De Raadt
|url        = http://www.usenix.org/events/usenix99/millert.html
|title      = strlcpy and strlcat&nbsp;- Consistent, Safe, String Copy and Concatenation
|conference = [[Organization:USENIX|USENIX]] Annual Technical Conference
|location   = Monterey, California
|date       = 6 June 1999
|access-date = 13 December 2011
}}</ref>

<ref name="survey">{{cite report
|url        = http://www.bsdcertification.org/downloads/pr-20051031-usage-survey-en-en.pdf
|title      = BSD Usage Survey
|publisher  = The BSD Certification Group
|date       = 31 October 2005
|access-date = 16 September 2012
|page       = 9
}}</ref>

<ref name="thehostingnews_godaddy_donate">{{cite web
|title       = GoDaddy.com Donates $10K to Open Source Development Project
|url         = http://www.thehostingnews.com/article2217.html
|work        = The Hosting News
|date        = 19 April 2006
|url-status     = dead
|archive-url  = https://web.archive.org/web/20061111090358/http://www.thehostingnews.com/article2217.html
|archive-date = 11 November 2006
}}</ref>

<ref name="vantronix">{{cite web
 |url         = http://www.vantronix.com/
 |title       = .vantronix secure system
 |work        = Compumatica secure networks
 |access-date  = 13 December 2011
 |quote       = The Next Generation Firewall is not a standalone device, it is a Router for operation in security critical environments with high requirements for availability, comprehensive support as well as reliable and trusted systems powered by OpenBSD.
 |url-status     = dead
 |archive-url  = https://web.archive.org/web/20120101215138/http://www.vantronix.com/
 |archive-date = 1 January 2012
 |df          = dmy-all
}}</ref>

<ref name="xenocara">{{cite web
|url         = https://xenocara.org/
|title       = About Xenocara
|work        = Xenocara
|access-date  = 13 December 2011
}}</ref>

}}

== External links ==
* [https://github.com/openbsd GitHub mirror]
* [https://man.openbsd.org OpenBSD manual pages]
* [http://ports.su/ OpenBSD ports & packages] ([http://cvsweb.openbsd.org/cgi-bin/cvsweb/ports/ latest])
* [http://BXR.SU/OpenBSD/ OpenBSD source code search]

{{OpenBSD |state=expanded}}
{{Unix-like}}


{{DEFAULTSORT:Openbsd}}
[[Category:Cryptographic software]]
[[Category:Free software programmed in C]]
[[Category:Lightweight Unix-like systems]]
[[Category:OpenBSD software using the ISC license]]
[[Category:PowerPC operating systems]]
[[Category:Software forks]]
[[Category:Software using the BSD license]]
[[Category:ARM operating systems]]
[[Category:IA-32 operating systems]]
[[Category:X86-64 operating systems]]

{{Sourceattribution|OpenBSD}}