OpenBSD: a security-focused BSD operating system

Development model and licensing

The OpenBSD team develops the kernel, core utilities and associated tools together, producing a cohesive distribution with consistent policy and coordinated releases. This model differs from many Linux-based distributions where components come from multiple upstream projects. Development is led by Theo de Raadt and a group of contributors who maintain a small, security-conscious base. OpenBSD is released under permissive terms derived from the BSD license, allowing wide reuse of code with minimal restrictions.

Security philosophy and built-in features

Security in OpenBSD is achieved through repeated manual code review, conservative defaults, and numerous runtime mitigations. The project is well known for pioneering or popularizing techniques that reduce exposure to common exploitation methods. Examples include compiler and runtime hardening, stack protection mechanisms, address space layout techniques, randomized heap and stack behavior, and strict memory protections such as W^X (write xor execute). OpenBSD also emphasizes privilege separation, sandboxing, and replacing older, insecure network services with safer alternatives; for instance, the project distributed ssh early as a replacement for legacy protocols like rlogin and telnet. Many of these ideas have been adopted by other projects and operating systems.

History, culture and mascot

The project grew from work on BSD sources with a distinct emphasis on security auditing and portability. OpenBSD has a reputation for careful review and a minimal but highly curated core. Its mascot history reflects project culture: an early haloed BSD daemon is part of the visual archive and the team later adopted a pufferfish named Puffy as a familiar emblem. Historical references to the original mascot and its halo persist in documentation and artwork.

Releases, support and packages

OpenBSD follows a regular release cadence with a new major release approximately every six months and a defined support window for security updates after each release. The base system is developed in-tree, while additional third-party applications are provided via a maintained ports tree and binary packages. This separation allows administrators to deploy a minimal, auditable base and selectively add packages as needed.

Typical uses and deployments

Because of its conservative defaults and emphasis on secure defaults, OpenBSD is widely chosen for firewalls, routers, VPN gateways and other network-facing appliances. It is also used for general servers where robustness and correctness are priorities. With optional graphical environments and additional packages, it can be adapted for desktop use and to provide a look-and-feel comparable to other systems such as Microsoft Windows or commercial desktops when required.

Community, contributions and influence

A relatively small but dedicated developer community maintains the project, performs security audits and develops tools that have influenced many other systems. Contributions come from volunteers and organizations that rely on OpenBSD for networking and security infrastructure. The project documents its security work and design decisions publicly, enabling other projects and administrators to learn from and reuse its approaches.

Further reading

• Introduction and getting started guides are available on the project website: OpenBSD home.
• Policy and licence texts are published with the source tree and linked from the project pages: BSD license documentation.
• Comparisons with other operating systems and best practices for secure deployments can be found in community-maintained resources and books: see entries that discuss Linux and BSD design differences.