# Download the official OpenBSD install image
# Fetch the SHA256 checksum file to verify download integrity
fetch https://cdn.openbsd.org/pub/OpenBSD/7.6/amd64/install76.img
fetch https://cdn.openbsd.org/pub/OpenBSD/7.6/amd64/SHA256
 
# Validate the checksum matches on a Unix-like system
sha256sum -c SHA256 --ignore-missing
 
# Burn image to a USB flash drive
sudo dd if=install76.img of=/dev/sdX bs=1M status=progress
sync

# Enter shell from the installer prompt
# 1. Initialize partition layout on disk 'sd0'
fdisk -iy sd0
 
# 2. Create a disklabel with partition 'a' as RAID type
disklabel -E sd0
# (Add partition 'a' spanning the entire disk, type 'RAID')
 
# 3. Create an encrypted softraid container on partition 'sd0a'
bioctl -c C -l sd0a softraid0
# (Enter passphrase to encrypt the volume)
 
# 4. The system maps the new decrypted container to virtual disk 'sd1'
# Exit shell and return to installer, choosing 'sd1' as installation target disk
exit

# /etc/install.conf responses template
System hostname = openbsd-server
Password for root = $1$hashed_password_here$
Change the default console to com0 = no
Setup a user = sysadmin
Password for user = $1$user_hashed_password$
Allow root ssh login = no
What timezone are you in = US/Eastern
Location of sets = http
HTTP Server = cdn.openbsd.org
Server directory = pub/OpenBSD/7.6/amd64
Set name(s) = +* -game*

# Check for and apply system security patches on first boot
sudo syspatch
 
# Configure doas to permit your user 'sysadmin' to run administrative commands
# Create the file /etc/doas.conf
echo "permit keepenv :wheel" | sudo tee /etc/doas.conf
 
# Test doas privilege escalation
doas pkg_add -u

# If a process attempts to allocate memory that is both writeable and executable:
# Kernel raises a SIGSEGV signal and logs the violation to system logs:
# dmesg | tail -n 2
# app[1025] mprotect: W^X violation

# Run an application enabling extra heap checks and junking
export MALLOC_OPTIONS="J"
./my_app

# ~/.profile configuration parameters
export HISTFILE=$HOME/.ksh_history
export HISTSIZE=1000
 
# Set interactive visual prompt showing host and current path
PS1='[OpenBSD] $USER:$PWD $ '
 
# Enable vi-style terminal command line editing
set -o vi
 
# Set default editor path
export EDITOR=vi

# Lock a critical configuration file using the system immutable flag
sudo chflags schg /etc/resolv.conf
 
# Lock syslog logs to prevent attackers from deleting evidence of intrusion
sudo chflags sappnd /var/log/messages

# Add a new group 'admins'
sudo groupadd -g 1010 admins
 
# Create a new user with home directory, shell, and primary group
sudo useradd -u 1010 -g admins -m -s /bin/ksh -c "System Administrator" sysadmin
 
# Set user password
sudo passwd sysadmin
 
# Add 'sysadmin' to the wheel group (required to switch to root shell)
sudo usermod -G wheel sysadmin
 
# Delete a user account and purge their files
sudo userdel -r sysadmin

# /etc/login.conf section entry example
# Limit memory and process boundaries for developer classes
developers:\
        :datasize-max=2048M:\
        :datasize-cur=1024M:\
        :maxproc-max=512:\
        :openfiles-cur=1024:\
        :tc=default:

# Enable a service (e.g., nginx) to start on boot
doas rcctl enable nginx
 
# Start the service immediately
doas rcctl start nginx
 
# Check service running status
rcctl check nginx
 
# Reload service configurations without stopping execution
doas rcctl reload nginx
 
# Restart the service
doas rcctl restart nginx
 
# Disable the service
doas rcctl disable nginx
 
# Change service startup flags (e.g., run httpd in chroot mode)
doas rcctl set httpd flags "-v"

# Example /etc/rc.conf.local entries
pkg_scripts="nginx postgresql"
sshd_flags=""
ntpd_flags="-s"

#!/bin/ksh
#
# Custom daemon startup script
 
daemon="/usr/local/bin/custom_service"
daemon_flags="--daemon --config /etc/custom.conf"
 
. /etc/rc.d/rc.subr
 
# Custom pre-start validation function
rc_pre() {
    if [ ! -f "/etc/custom.conf" ]; then
        return 1
    fi
}
 
rc_cmd $1

# Make executable
doas chmod +x /etc/rc.d/customapp
 
# Enable and start the service
doas rcctl enable customapp
doas rcctl start customapp

# Configure repository mirrors by writing to /etc/installurl
# Example: https://cdn.openbsd.org/pub/OpenBSD
 
# Install a binary package (e.g., git)
doas pkg_add git
 
# Search for a package matching a keyword
pkg_info -Q nmap
 
# List all installed packages
pkg_info
 
# Query which package installed a specific file path
pkg_info -E /usr/local/bin/git
 
# Update all installed packages to their latest versions
doas pkg_add -u
 
# Uninstall a package
doas pkg_delete git
 
# Remove unused dependencies and clean package database
doas pkg_delete -a

# Configure shell HTTP proxy path configurations
export http_proxy="http://proxy.example.com:8080"
export ftp_proxy="http://proxy.example.com:8080"

# Clone the ports tree
cd /usr
doas cvs -qd anoncvs@anoncvs.ca.openbsd.org:/cvs checkout -P ports
 
# Navigate to the target port (e.g., net/nmap)
cd /usr/ports/net/nmap
 
# Compile from source and install
doas make install clean

# Check signature key files for OpenBSD release
ls -la /etc/signify/
# Output: openbsd-76-base.pub, openbsd-76-pkg.pub

# Check filesystem configurations in /etc/fstab
# Example line:
# /dev/sd0a / ffs rw,wxallowed,softdep 1 1
# (softdep indicates Soft Updates is active)

# 1. Initialize softraid partition SD0
# 2. Attach partition SD0 to biomgr driver to create virtual container SD1
# 3. Mount filesystem onto virtual container disk partition 'sd1a'
 
# Check the status of encrypted softraid disks
bioctl softraid0

# Configure a static IP on interface card 'em0'
# Create/edit the file /etc/hostname.em0
inet 192.168.1.100 255.255.255.0 NONE
 
# Configure interface to use DHCP
# Edit the file /etc/hostname.em0
dhcp
 
# Start/Stop the interface
doas sh /etc/netstart em0

# Enable PF
doas pfctl -e
 
# Load and validate pf.conf rule configurations
doas pfctl -f /etc/pf.conf
 
# List active rules
doas pfctl -sr
 
# List active connections state table
doas pfctl -ss

# Master node /etc/hostname.carp0
inet 192.168.1.150 255.255.255.0 192.168.1.255 vhid 1 pass securepass carpdev em0
 
# Backup node /etc/hostname.carp0
inet 192.168.1.150 255.255.255.0 192.168.1.255 vhid 1 pass securepass carpdev em0 advskew 100
# (advskew 100 ensures the backup node defers to the master)

# /etc/dhcpd.conf subnet configuration file
option domain-name "local.net";
option domain-name-servers 192.168.1.1, 8.8.8.8;
 
subnet 192.168.1.0 netmask 255.255.255.0 {
    range 192.168.1.200 192.168.1.250;
    option routers 192.168.1.1;
}

# Enable and start the DHCP daemon on interface 'em1'
doas rcctl enable dhcpd
doas rcctl set dhcpd flags em1
doas rcctl start dhcpd

# /var/unbound/unbound.conf configuration file
server:
        interface: 192.168.1.1
        interface: 127.0.0.1
        access-control: 192.168.1.0/24 allow
        access-control: 127.0.0.0/8 allow
        
        # Validate DNSSEC signatures
        auto-trust-anchor-file: "/var/unbound/db/root.key"
 
forward-zone:
        name: "."
        forward-addr: 8.8.8.8
        forward-addr: 1.1.1.1

# Fetch the root anchor keys for DNSSEC validation
doas unbound-anchor -a "/var/unbound/db/root.key"
 
# Enable and start the Unbound service
doas rcctl enable unbound
doas rcctl start unbound

# Create a 20 GB raw virtual disk file
vmctl create -s 20G /var/vm/guest_vm.raw
 
# Enable and start the VM service
doas rcctl enable vmd
doas rcctl start vmd
 
# Start the virtual machine
doas vmctl start guest_vm
 
# Console access to the running VM
doas vmctl console guest_vm
 
# Stop the virtual machine
doas vmctl stop guest_vm

# Enable IP forwarding
doas sysctl net.inet.ip.forwarding=1
 
# Adjust maximum open files limit
doas sysctl kern.maxfiles=65536

# Enable IP forwarding (useful if acting as a secure gateway)
net.inet.ip.forwarding=1
 
# Disable Console Kernel Debugger Access
ddb.console=0
 
# Block Route Redirect Attacks
net.inet.ip.redirect=0
net.inet.ipv6.redirect=0
 
# Drop SYN+FIN Scan Packets
net.inet.tcp.drop_synfin=1
 
# Disable Source Routing
net.inet.ip.sourceroute=0

# Load sysctl updates immediately
doas sysctl -f /etc/sysctl.conf

/* ==============================================================================
 * File: openbsd_sandbox_simulation.c
 * Description: Simulation of OpenBSD pledge(2) and unveil(2) security sandboxing.
 * Author: VR-Rathod
 * ==============================================================================
 */
 
#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>
#include <stdbool.h>
 
#define MAX_PATHS 8
#define PATH_LEN 64
 
// Sandbox capability flags
typedef struct {
    bool stdio;
    bool rpath;
    bool wpath;
    bool cpath;
    bool inet;
    bool exec;
} SandboxPromises;
 
// Unveiled directory mapping details
typedef struct {
    char path[PATH_LEN];
    char permissions[4]; // e.g. "r", "rw", "rwx"
    bool active;
} UnveiledPath;
 
// Sandbox Process Context structure
typedef struct {
    SandboxPromises promises;
    UnveiledPath paths[MAX_PATHS];
    uint32_t path_count;
    bool pledged;
    bool unveiled_locked;
} SandboxContext;
 
SandboxContext g_ctx;
 
// Initialize sandbox process context
void init_sandbox() {
    g_ctx.promises.stdio = true;
    g_ctx.promises.rpath = true;
    g_ctx.promises.wpath = true;
    g_ctx.promises.cpath = true;
    g_ctx.promises.inet = true;
    g_ctx.promises.exec = true;
    
    for (int i = 0; i < MAX_PATHS; i++) {
        g_ctx.paths[i].active = false;
    }
    g_ctx.path_count = 0;
    g_ctx.pledged = false;
    g_ctx.unveiled_locked = false;
    printf("[SANDBOX] Initialized context with full system privileges.\n");
}
 
// Simulates the pledge(2) system call
bool virtual_pledge(const char *promises_str) {
    if (g_ctx.pledged) {
        printf("[ERROR] pledge() has already been called. Re-pledging is blocked.\n");
        return false;
    }
    
    // Remove default permissions
    g_ctx.promises.stdio = false;
    g_ctx.promises.rpath = false;
    g_ctx.promises.wpath = false;
    g_ctx.promises.cpath = false;
    g_ctx.promises.inet = false;
    g_ctx.promises.exec = false;
    
    // Parse the promises string
    if (strstr(promises_str, "stdio")) g_ctx.promises.stdio = true;
    if (strstr(promises_str, "rpath")) g_ctx.promises.rpath = true;
    if (strstr(promises_str, "wpath")) g_ctx.promises.wpath = true;
    if (strstr(promises_str, "cpath")) g_ctx.promises.cpath = true;
    if (strstr(promises_str, "inet"))  g_ctx.promises.inet = true;
    if (strstr(promises_str, "exec"))  g_ctx.promises.exec = true;
    
    g_ctx.pledged = true;
    printf("[PLEDGE ACTIVE] Promises restricted to: \"%s\"\n", promises_str);
    return true;
}
 
// Simulates the unveil(2) system call
bool virtual_unveil(const char *path, const char *permissions) {
    if (g_ctx.unveiled_locked) {
        printf("[ERROR] unveil() is locked. Further path additions are blocked.\n");
        return false;
    }
    
    // Locking unveil mappings
    if (path == NULL && permissions == NULL) {
        g_ctx.unveiled_locked = true;
        printf("[UNVEIL LOCKED] Path visibility configurations locked.\n");
        return true;
    }
    
    if (g_ctx.path_count >= MAX_PATHS) {
        printf("[ERROR] Maximum unveiled paths limit reached!\n");
        return false;
    }
    
    strncpy(g_ctx.paths[g_ctx.path_count].path, path, PATH_LEN);
    strncpy(g_ctx.paths[g_ctx.path_count].permissions, permissions, 4);
    g_ctx.paths[g_ctx.path_count].active = true;
    
    printf("[UNVEIL PATH] Path \"%s\" unveiled with permissions: \"%s\"\n", path, permissions);
    g_ctx.path_count++;
    return true;
}
 
// Helper function to verify path matches unveiled configurations
bool verify_path_permission(const char *target_path, const char req_perm) {
    // If unveil has not been called, access is allowed by default
    if (g_ctx.path_count == 0 && !g_ctx.unveiled_locked) return true;
    
    for (int i = 0; i < MAX_PATHS; i++) {
        if (g_ctx.paths[i].active && strncmp(target_path, g_ctx.paths[i].path, strlen(g_ctx.paths[i].path)) == 0) {
            if (strchr(g_ctx.paths[i].permissions, req_perm) != NULL) {
                return true;
            }
        }
    }
    return false;
}
 
// Intercept and validate file read operations
bool virtual_read_file(const char *file_path) {
    // 1. Check pledge promises
    if (g_ctx.pledged && !g_ctx.promises.rpath) {
        printf("[KILLED] Process terminated by SIGABRT: pledge violation on read call!\n");
        exit(1);
    }
    
    // 2. Check unveil path limits
    if (!verify_path_permission(file_path, 'r')) {
    // Returns a 'No such file or directory' error
        printf("[ACCESS BLOCKED] read_file failed on path: \"%s\" (not unveiled)\n", file_path);
        return false;
    }
    
    printf("[SUCCESS] File read successful: \"%s\"\n", file_path);
    return true;
}
 
// Intercept and validate file write operations
bool virtual_write_file(const char *file_path) {
    // 1. Check pledge promises
    if (g_ctx.pledged && !g_ctx.promises.wpath) {
        printf("[KILLED] Process terminated by SIGABRT: pledge violation on write call!\n");
        exit(1);
    }
    
    // 2. Check unveil path limits
    if (!verify_path_permission(file_path, 'w')) {
        printf("[ACCESS BLOCKED] write_file failed on path: \"%s\" (not unveiled)\n", file_path);
        return false;
    }
    
    printf("[SUCCESS] File write successful: \"%s\"\n", file_path);
    return true;
}
 
// Intercept and validate network operations
bool virtual_network_connect(const char *address, int port) {
    if (g_ctx.pledged && !g_ctx.promises.inet) {
        printf("[KILLED] Process terminated by SIGABRT: pledge violation on network connect call!\n");
        exit(1);
    }
    
    printf("[SUCCESS] Connected to server: %s:%d\n", address, port);
    return true;
}
 
// Intercept process creation operations
bool virtual_execve(const char *binary_path) {
    if (g_ctx.pledged && !g_ctx.promises.exec) {
        printf("[KILLED] Process terminated by SIGABRT: pledge violation on execve call!\n");
        exit(1);
    }
    printf("[SUCCESS] Successfully executed binary: %s\n", binary_path);
    return true;
}
 
int main() {
    printf("=== OPENBSD PLEDGE AND UNVEIL SIMULATION ===\n");
    init_sandbox();
    
    // 1. Unveil directories and lock path configurations
    virtual_unveil("/usr/home/user/docs", "r");
    virtual_unveil("/tmp", "rw");
    virtual_unveil(NULL, NULL); // Lock further path additions
    
    // Test file access inside unveiled directory
    virtual_read_file("/usr/home/user/docs/report.txt");
    
    // Test file access outside unveiled directories (should be blocked)
    virtual_read_file("/etc/master.passwd");
    
    // 2. Pledge syscall promises
    virtual_pledge("stdio rpath"); // Remove write and network capabilities
    
    // Test read in permitted path (should pass)
    virtual_read_file("/usr/home/user/docs/notes.md");
    
    // Test network connection (should fail and terminate process)
    printf("\n[INFO] Attempting network call (violates pledge stdio rpath)...\n");
    virtual_network_connect("192.168.1.5", 80);
    
    printf("[ERROR] This line should never execute if process was killed.\n");
    return 0;
}

#!/bin/sh
# ==============================================================================
# Script: user_provisioner.sh
# Description: Automates user creation and doas configurations on OpenBSD.
# Author: VR-Rathod
# ==============================================================================
 
USERNAME=$1
USER_CLASS="staff"
 
if [ -z "$USERNAME" ]; then
    echo "Usage: $0 <username>"
    exit 1
fi
 
echo "[INFO] Creating user account: ${USERNAME}"
useradd -m -g =wheel -L ${USER_CLASS} -s /bin/ksh "${USERNAME}"
 
echo "[INFO] Setting up user password..."
passwd "${USERNAME}"
 
# Add permissions to /etc/doas.conf
DOAS_CONF="/etc/doas.conf"
if [ ! -f "$DOAS_CONF" ]; then
    touch "$DOAS_CONF"
    chmod 600 "$DOAS_CONF"
fi
 
# Append permit rules
echo "permit keepenv ${USERNAME} as root" >> "$DOAS_CONF"
echo "[SUCCESS] User ${USERNAME} created and added to ${DOAS_CONF}."
exit 0

#!/bin/sh
# ==============================================================================
# Script: softraid_backup.sh
# Description: Mounts encrypted softraid, backups files, and decrypts pool.
# Author: VR-Rathod
# ==============================================================================
 
CRYPTO_DEV="sd0e" # Raw partition mapped to RAID
DECRYPTED_DISK="sd2" # Decrypted disk mapped by bioctl
MOUNT_DIR="/mnt/secure_backup"
SOURCE_DIR="/var/www"
 
echo "[INFO] Decrypting softraid partition..."
bioctl -c C -l "/dev/${CRYPTO_DEV}" softraid0
 
if [ $? -ne 0 ]; then
    echo "[ERROR] Failed to decrypt partition."
    exit 1
fi
 
echo "[INFO] Mounting volume..."
mkdir -p "$MOUNT_DIR"
mount "/dev/${DECRYPTED_DISK}a" "$MOUNT_DIR"
 
echo "[INFO] Running tar backup..."
tar -czf "${MOUNT_DIR}/www_backup_$(date +%F).tar.gz" "$SOURCE_DIR"
 
echo "[INFO] Unmounting and locking partition..."
umount "$MOUNT_DIR"
bioctl -d "$DECRYPTED_DISK"
 
echo "[SUCCESS] Backup complete. Container encrypted."
exit 0

#!/bin/ksh
# ==============================================================================
# Script: carp_monitor.sh
# Description: Monitors and logs CARP interface state transitions.
# Author: VR-Rathod
# ==============================================================================
 
CARP_IF="carp0"
LOG_FILE="/var/log/carp_monitor.log"
LAST_STATE=""
 
log_event() {
    echo "[$(date '+%F %T')] [CARP] - $1" >> "$LOG_FILE"
}
 
while true; do
    CURRENT_STATE=$(ifconfig "$CARP_IF" 2>/dev/null | grep "carp:" | awk '{print $2}')
    
    if [ -z "$CURRENT_STATE" ]; then
        log_event "ERROR: Interface ${CARP_IF} not found."
        sleep 30
        continue
    fi
    
    if [ "$CURRENT_STATE" != "$LAST_STATE" ]; then
        if [ -n "$LAST_STATE" ]; then
            log_event "WARNING: State transitioned from ${LAST_STATE} to ${CURRENT_STATE}!"
            # If transition to master, reload routing tables
            if [ "$CURRENT_STATE" = "MASTER" ]; then
                pfctl -f /etc/pf.conf
            fi
        else
            log_event "Monitoring active. Current state: ${CURRENT_STATE}"
        fi
        LAST_STATE="$CURRENT_STATE"
    fi
    sleep 5
done

#!/bin/sh
# ==============================================================================
# Script: auto_patcher.sh
# Description: Runs syspatch audits and pkg updates.
# Author: VR-Rathod
# ==============================================================================
 
LOG_FILE="/var/log/system_updates.log"
echo "=== Update Check [$(date)] ===" >> "$LOG_FILE"
 
# 1. Run syspatch to apply binary patches to base system
echo "[INFO] Running syspatch..." >> "$LOG_FILE"
syspatch >> "$LOG_FILE" 2>&1
 
# 2. Update binary packages
echo "[INFO] Running package upgrades..." >> "$LOG_FILE"
pkg_add -u >> "$LOG_FILE" 2>&1
 
echo "[SUCCESS] Maintenance finished." >> "$LOG_FILE"
exit 0

#!/bin/sh
# ==============================================================================
# Script: run_sandboxed.sh
# Description: Concept script detailing OpenBSD daemon sandboxing setups.
# Author: VR-Rathod
# ==============================================================================
 
DAEMON="/usr/sbin/httpd"
CHROOT_DIR="/var/www"
 
# Restrict daemon process execution to read/write within /var/www only
echo "[INFO] Starting daemon in chroot sandboxed container..."
exec "$DAEMON" -d -u -u -t "$CHROOT_DIR"

sysctl -a                       # Query all active kernel variables
sysctl kern.version             # Read kernel version details
sysctl kern.maxfiles            # Query maximum open file descriptors limit
sysctl kern.securelevel         # Query active kernel security level value
uname -a                        # Display system details, architecture, and kernel version
syspatch                        # Apply binary patches to base operating system
syspatch -c                     # Check if binary patches are available
dmesg                           # Read the system boot and kernel message buffers
date                            # Display or adjust system calendar time settings
uptime                          # Show system uptime, load averages, and user count
shutdown -p now                 # Power down the system immediately
reboot                          # Reboot the system immediately
rcctl enable nginx              # Enable service to start on boot
rcctl disable nginx             # Disable service from starting on boot
rcctl start nginx               # Start a system service daemon
rcctl stop nginx                # Stop a system service daemon
rcctl restart nginx             # Restart a system service daemon
rcctl check nginx               # Check if a service is running and view its PID
rcctl get nginx                 # Show all parameters of a service
rcctl set nginx flags "-v"      # Set startup arguments for a service
kldstat                         # List all loaded kernel modules (legacy compat)
locale                          # Print active language and encoding configurations
pciconf -l                      # List PCI bus hardware devices and vendor codes
usbconfig                       # List USB controllers and attached devices
devinfo                         # Print system hardware device trees
installurl                      # File location mapping official mirrors (/etc/installurl)
signify                         # Cryptographic signing utility
signify -C -p pubkey.pub -x check.sig # Verify file checksum signature

fdisk sd0                       # View partition layout on disk sd0
fdisk -iy sd0                   # Initialize partition table on disk sd0
disklabel sd0                   # View partitions within drive label sd0
disklabel -E sd0                # Edit partitions within drive label sd0
newfs /dev/rsd0a                # Format partition with FFS filesystem
fsck -y /dev/rsd0a              # Scan and repair FFS partition, auto-fixing issues
mount /dev/sd0a /mnt            # Mount partition to target directory path
umount /mnt                     # Unmount target device mount point
df -h                           # Display mounted filesystem space usage
du -sh /var/log/                # Calculate directory space usage
bioctl softraid0                # Display status of softraid encryption disks
bioctl -c C -l sd0a softraid0   # Create an encrypted softraid container on sd0a
bioctl -d sd1                   # Detach/lock encrypted softraid disk sd1
mount_cd9660 /dev/cd0 /mnt      # Mount ISO 9660 CD-ROM device
tunefs -p /                     # Print filesystem details for mount point

ps aux                          # Display running processes
pgrep -u root sshd              # Find process IDs matching criteria
pkill -9 -u testuser            # Kill processes matching criteria immediately
kill -15 1024                   # Terminate process gracefully using SIGTERM
kill -9 1024                    # Terminate process immediately using SIGKILL
top -o cpu                      # Monitor system processes, sorted by CPU usage
vmstat -s                       # Display page allocation statistics
iostat -w 2                     # Print disk I/O metrics every two seconds
systat -ifstat                  # Full-screen network interface statistics
systat -vmstat                  # Full-screen virtual memory and scheduling statistics
fstat -p 1024                   # List open files held by specific process ID
sockstat -4 -l                  # List processes listening on open TCP/UDP ports
procstat -f 1024                # Print detailed file descriptor table of a process
limit                           # Display shell session resource limits
ulimit -n 2048                  # Adjust open file descriptors limit in shell
nice -n 10 backup.sh            # Run process with low priority level
renice +15 -p 1024              # Lower priority level of active process ID

ifconfig                        # List active network interfaces and configurations
ifconfig em0 up                 # Enable network interface card em0
ifconfig em0 down               # Disable network interface card em0
ifconfig em0 inet 192.168.1.5   # Configure IP address on interface em0
netstart                        # Shell script executing interface configurations (/etc/netstart)
route add default 192.168.1.1   # Add default gateway path to routing table
route show                      # Display active network routing tables
ping -c 5 1.1.1.1               # Send ICMP echo requests to verify remote host
traceroute 8.8.8.8              # Display hop path to remote destination
netstat -rn                     # Display active routing tables in numeric format
netstat -i                      # Display network interface statistics
netstat -an | grep LISTEN       # List open sockets listening for incoming connections
arp -a                          # Display ARP IP-to-MAC address mapping tables
dig @8.8.8.8 google.com         # Perform DNS lookup queries using Google DNS
host google.com                 # Perform quick DNS host resolution query
nc -zv 192.168.1.100 22         # Test connection to remote port (Netcat)
curl -I https://openbsd.org     # Fetch HTTP headers of target web server
fetch https://site.com/file.zip # Download file over HTTP/FTP
tcpdump -i em0                  # Capture network packets passing through interface em0
ndp -an                         # Display IPv6 neighbor cache mapping details

pkg_add git                     # Install a binary package
pkg_add -u                      # Upgrade all installed binary packages to latest versions
pkg_delete git                  # Uninstall an installed binary package
pkg_info -Q nmap                # Search repositories for matching packages
pkg_info tmux                   # Display metadata details of an installed package
pkg_info -L tmux                # List all files installed by a package
pkg_delete -a                   # Delete orphaned dependencies
pkg_add -ui                     # Upgrade packages interactively

chflags schg critical_file      # Set system immutable flag on a file
chflags noschg critical_file    # Clear system immutable flag on a file
chflags sappnd log_file         # Set system append-only flag on a log file
ls -lao                         # List directory files displaying system flags
useradd -m -g =wheel test       # Create system user account
userdel -r test                 # Delete user account and home directories
vipw                            # Safely edit system master password file
doas -u operator rcctl restart nginx # Run command as another user via doas
pfctl -e                        # Enable the PF firewall engine
pfctl -d                        # Disable the PF firewall engine
pfctl -f /etc/pf.conf           # Load firewall rules from pf.conf file
pfctl -sr                       # Display currently loaded firewall rules
pfctl -ss                       # Display active state tables of the firewall
pfctl -vvss                     # Verbose display of active firewall connections and counters
pfctl -t bad_ips -T show        # List IP addresses stored inside PF table bad_ips
pfctl -t bad_ips -T add 1.1.1.1 # Add IP address to PF firewall table bad_ips
pfctl -t bad_ips -T delete 1.1.1.1 # Delete IP address from PF firewall table bad_ips
pfctl -F all                    # Flush all PF rules, tables, counters, and active states
syspatch -l                     # List all applied binary security patches
syspatch -r                     # Revert the last applied binary security patch
doas -s                         # Open an interactive supervisor root shell session
encrypt -b 8                    # Generate bcrypt hash of a string password using cost 8
signify -V -p /etc/signify/openbsd-76-base.pub -x check.sig -m file # Verify signature on a file
ktrace ./my_app                 # Enable system call tracing on a process (writes to ktrace.out)
kdump                           # View ktrace.out execution log (highly useful for pledge/unveil debugs)
vmctl show                      # List all running guest virtual machines and JIDs under vmd
vmctl status                    # Query virtualization resource allocations and memory pools
unbound-checkconf               # Verify syntax configurations of the unbound resolver file
unbound-anchor                  # Download trust anchor keys for DNSSEC validation
ifconfig carp0 carpdev em0      # Map CARP interface to hardware network controller em0