PuffySpace

6.6

sixdotsix Released Oct 17, 2019
Copyright 1997-2019, Theo de Raadt.


Artwork by Natasha Allegri.
  • See the information on the FTP page for a list of mirror machines.
  • Go to the pub/OpenBSD/6.6/ directory on one of the mirror sites.
  • Have a look at the 6.6 errata page for a list of bugs and workarounds.
  • See a detailed log of changes between the 6.5 and 6.6 releases.

  • signify(1) pubkeys for this release:

    openbsd-66-base.pub: RWSvK/c+cFe24BIalifKnqoqdvLlXfeZ9MIj3MINndNeKgyYw5PpcWGn
    openbsd-66-fw.pub: RWSKyzM3wogTrgHkO88MnRiK/yuu8xy2OeIqhnP/uGL/j2IF4I5djMIM
    openbsd-66-pkg.pub: RWSS4lqHZ5ayOFMBPj3leAkE9tCsSWG9OxD6MmAIS5Y3H3tD6F4vP/eF
    openbsd-66-syspatch.pub: RWRQMmZg6mMlSTfHsJH9czeLAvf9e+ViLvkQ4id4dxaQqWU3aX9Cl/W1

All applicable copyrights and credits are in the src.tar.gz, sys.tar.gz, xenocara.tar.gz, ports.tar.gz files, or in the files fetched via ports.tar.gz.

What's New

This is a partial list of new features and systems included in OpenBSD 6.6. For a comprehensive list, see the changelog leading to 6.6.

  • General improvements and bugfixes:
    • Fixed support for amd64 machines with greater than 1023GB physical memory.
    • drm(4) updates.
    • The octeon platform is now using clang(1) as the base system compiler.
    • The powerpc architecture is now provided with clang(1), in addition to aarch64, amd64, armv7, i386, mips64el, sparc64.
    • Disabled gcc in base on armv7 and i386.
    • Prevented dhclient(8) from repeatedly obtaining a new lease when the mtu is given in a lease.
    • Prevented more than one thread from opening a wscons(4) device in read/write mode.
    • Allowed non-root users to become owner of the drm(4) device when they are the first to open it.
    • Added regular expression support for the format search, match and substitute modifiers in tmux(1).
    • Added a -v flag to source-file in tmux(1) to show the commands and line numbers.
    • Added simple menus usable with mouse or keyboard in tmux(1). Introduced the command "display-menu" to show a menu bound to the mouse on status line by default, and added menus in tree, client and buffer modes.
    • Changed the behavior of swap-window -d in tmux(1) to match swap-pane.
    • Allow panes to be empty in tmux(1), and enabling output to be piped to them with split-window or display-message -I.
    • Adjusted tmux(1) to automatically scroll when dragging to create a selection with the mouse when the cursor reaches the top or bottom line.
    • Fixed a tmux(1) crash when killing the current window, and other bugfixes.
  • SMP-Improvements, System call unlocking:
  • Improved hardware support, including:
    • Implemented Linux compatible acpi(4) interfaces and enabled the ACPI support code in radeon(4) and amdgpu(4).
    • Implemented backlight control for amdgpu(4), allowing setting of the backlight using wsconsctl(8).
    • Both sets of speakers work by default on the ThinkPad X1C7.
    • Added amdgpu(4), an AMD Radeon GPU video driver.
    • Added TSC synchronization for multiprocessor machines and re-enabled TSC as the default amd64 time source.
    • Added support for Realtek ALC285 in azalia(4).
    • Added uvideo(4) support for the KSMedia 8-bit IR format and for dual functions on integrated USB cameras.
    • Added the aplgpio(4) driver for the GPIO controllers on Intel's Apollo Lake SoC.
    • Implemented MSI-X support on sparc64.
    • Skipped PCI host bridges and devices not present with acpi(4) when establishing the mapping between ACPI device nodes and PCI devices.
    • Added the ukspan(4) driver for the Keyspan USA19HS USB serial adapter.
    • Improved support for SAS3 controllers, made device enumeration during boot more reliable, and enabled 64bit DMA for io in mpii(4).
    • Fixed MSI/MSI-X on arm64 machines with agintc(4).
    • Added MSI-X support in acpipci(4), pciecam, dwpcie(4) and rkpcie(4).
    • Improved support for type4 devices in the ubcmtp(4) multi-touch trackpad driver.
    • Support for virtio(4) 1.0 specification for PCI devices.
    • Improved support for the AR9271 chipset in athn(4) .
    • Repaired support for athn(4) 9280 1T2R devices (broken since OpenBSD 6.5).
    • Added support for the trackpad and trackpoint of the Dell Precision 7520 laptop.
    • Added the Colemak keyboard layout.
    • New fusbtc(4) driver for the Fairchild FUSB302 USB Type-C controller.
    • Added a fallback to ehci(4) which enables the USB ports on the RockPro64.
    • Added support for more Intel 300 Series PCH devices to ichiic(4).
    • Added mcx(4) driver for Mellanox ConnectX-4 (and later) Ethernet controllers.
    • Added support for the cryptographic coprocessor found on newer AMD Ryzen CPUs/APUs.
    • Improved the envy(4) codec API and used it on ESI Juli@ cards.
    • Enabled EnvyHT-specific sample rates (above 96kHz) on the host controller for envy(4) devices.
    • Added support for the USB serial adapter found in Juniper SRX 300 to uslcom(4).
    • Updated shared drm code, inteldrm(4) and radeondrm(4) to linux 4.19.78. This adds support for Intel Broxton/Apollo Lake, Amber Lake, Gemini Lake, Coffee Lake, Whiskey Lake, and Comet Lake hardware.
    • Made startx(1) and xinit(1) work again on modern systems using inteldrm(4), radeondrm(4) and amdgpu(4).
    • Added mcprtc(4), a driver for the Microchip MCP79400 RTC and similar.
    • Added I2C clock gates to mvclock(4).
    • Added support for MSI-X to bnxt(4).
    • Added octpip(4), a driver for the Octeon packet input processing unit.
    • Added the octiic(4) driver for OCTEON two-wire serial interfaces.
    • Enabled nvme(4) on octeon.
    • Added octpcie(4), a driver for the PCIe controller found on OCTEON II and OCTEON III.
    • Fixed random kernel hangs on some sparc64 machines by blocking interrupts while sending an IPI on sunv4 (as on sun4u).
    • ure(4) now supports RTL8153B devices, adding support for Ethernet on Lenovo USB-C docks.
    • Added new ksmn(4) driver for temperature sensor on AMD Family 17h CPUs.
    • Explicitly disable BCM4331 wifi chips present in 2011-2012 Apple Mac systems. Fixes an interrupt storm that consumes about 50% of CPU0 on affected machines.
  • Improved arm64 hardware support, including:
    • Added support for Ampere eMAG CPU based systems.
    • Added support to amlclock(4) for obtaining CPU clock frequency.
    • Enabled amlmmc(4), a driver for the SD/MMC controller found on various Amlogic SoCs.
    • Implemented setting the CPU clock for Allwinner A64 SoCs in sxiccmu(4).
    • Added amldwusb(4), amlusbphy(4) and amlpciephy(4), drivers for the USB controller and PHYs on the Amlogic G12A/B SoCs.
    • Added imxtmu(4), a driver to support the temperature sensors on i.MX8M SoCs.
    • Added amlrng(4), a simple random number generator driver for Amlogic SoCs.
    • Added amclock(4), a driver for the Amlogic SoC clocks.
    • Added amluart(4), a driver for the UARTs found on various Amlogic SoCs.
    • Added support for the SMBus System Interfaces (SSIF) to ipmi(4).
    • PXE booting using U-Boot works now.
    • Added clock support to sxisyscon(4), a driver for the system controller found on various Allwinner SoCs.
    • Implemented smbios(4) support on arm64.
    • Added ucrcom(4), a driver for the serial console of chromebooks.
    • Enabled mvmdio(4) and mvneta(4) on arm64.
    • Added pinctrl(4) support for 'pinconf-single' devices and support for bias and drive-strength properties, needed for HiSilicon SoCs.
    • Added mvdog(4), a driver to support the watchdog on the Armada 3700 SoC.
    • Added support for the Allwinner H6 to sxipio(4) and sxiccmu(4).
    • Added mviic(4), a driver to support the I2C controller on the Armada 3700 SoC.
    • Added mvuart(4) to support the Armada 3720's serial console.
    • Added support for the Armada 3720 clocks to mvclock(4).
    • Added support for the Armada 3720 pinctrl controller to mvpinctrl(4). This controller also includes GPIO controller functionality.
    • Added the RK3328 and RK3399 GMAC clocks to rkclock(4).
    • Increased MAXCPUs to 32 in arm64, allowing use of all cores on the Ampere eMAG.
    • Added support for the Cortex-A65 CPU.
    • Implemented interrupt controller functionality in rkgpio(4), allowing use of the fusbtc(4) interrupt on the RockPro64.
  • IEEE 802.11 wireless stack improvements:
    • Repaired the ifconfig(8) 'nwflag' command (broken since OpenBSD 6.4).
    • Added a new 'stayauth' nwflag which can be set to ignore deauth frames. This is useful when deauth frames are being spoofed by an attacker.
    • Repaired the ifconfig(8) 'mode' command to properly force a wireless interface into 11a/b/g/n mode.
    • Made 11n Tx rate selection more sensitive to transmission failures.
    • Fixed automatic use of HT protection in 11n hostap mode.
    • Fixed WPA APs occasionally appearing as non-WPA APs during AP selection.
    • Fixed some eligible APs being ignored during AP selection after a roaming failure.
    • Added support for 802.11n Tx aggregation to net80211 and the iwn(4) driver.
    • Made net80211 expose reasons for association failures to have ifconfig(8) display them in "scan" output and on the ieee80211(9) status line.
    • Made all wireless drivers submit a batch of received packets to the network stack during one interrupt if possible, rather than submitting each packet individually. Prevents packet loss under high load due to backpressure from the network stack.
  • Generic network stack improvements:
    • Enabled TCP and UDP checksum offloading by default for ix(4).
    • Added tpmr(4), a 802.1Q two-port MAC relay implementation.
    • Added iavf(4), a driver for Intel SR-IOV Virtual Functions of Intel 700 series Ethernet controllers.
    • Added aggr(4), a dedicated driver to implement 802.1AX link aggregation.
    • Added port protection support to switch(4). Domain membership is checked for unicast, flooded (broadcast) and local (host-network-bound, e.g. trunk) traffic.
    • Disabled mobileip(4).
    • Added support to ifconfig(8) for getting and setting rxprio, finishing support for RFC 2983. Implemented configuring rxprio in vlan(4), gre(4), mpw(4), mpe(4), mpip(4), etherip(4) and bpe(4).
    • Implemented Tx mitigation by calling the hardware transmit routine per several packets rather than for individual packets. Defers calls to the transmit routine to a network taskq, or until a backlog of packets has built up.
    • Stopped using splnet(9) when running the network stack now that it is using the NET_LOCK for protection, reducing latency spikes.
    • Added support for reading SFPs to some ethernet cards.
  • Installer improvements:
    • Allowed quoted SSIDs in the installer, rather than ignoring those containing whitespace.
    • Introduced sysupgrade(8) that can be used to upgrade OpenBSD unattended.
    • A syspatch was provided which adds sysupgrade(8) to 6.5, so unattended upgrades to 6.6 can be performed on amd64/arm64/i386 with # syspatch && sysupgrade.
    • Created an octeon bootloader which is a modified kernel. To use this bootloader, the firmware must be configured to load file "boot" instead of "bsd".
    • Included mount_nfs(8) on the amd64 CD ramdisk.
    • Added tee(1) to the ramdisk, and display a moving progress bar during auto upgrade/install.
    • Repaired and improved v6 default route selection, fixing autoinstalls.
    • Added sysupgrade(8) support to the sparc64 bootloader.
    • The DHCP configuration is now preserved when restarting an install.
    • The installer now remembers 'autoconf' when restarting an install.
    • Stopped prompting for disks that do not contain a root partition during upgrades. This defaults to the correct disk when full disk encryption is in use, and will be useful for future unattended upgrades.
  • Security improvements:
    • unveil(2) is now used in 77 userland programs to redact filesystem access.
    • Various changes in unveil(2) to improve application behavior when encountering hidden filesystem paths.
    • ps(1) can show which processes have called unveil(2) with the u and U flags in STATE field.
    • ps(1) can show the list of pledge(2) options processes use with the -o pledge option.
    • Further and improved mitigations against Spectre side-channel vulnerability in Intel CPUs built since 2012.
    • Mitigations for Intel's Microarchitectural Data Sampling vulnerability, using the new CPU VERW behavior if available or by using the proper sequence from Intel's "Deep Dive" doc in the return-to-userspace and enter-VMM-guest paths. Updated vmm(4) to pass through the MSR bits so that guests can apply the optimal mitigation.
    • Rewrote doas(1) environment inheritance not to inherit, and instead reset to the target user's values by default.
    • Prepare the amd64 BIOS bootloader for loading the kernel at a random virtual address (future work).
    • Introduced malloc_conceal(3) and calloc_conceal(3), which return memory in pages marked MAP_CONCEAL and call freezero(3) on free(3).
    • Make 'systat pf' not require root permissions (systat(1)).
    • Added support for the EFI Random Number Generator Protocol, using it to XOR random data into the buffer we feed the kernel for amd64.
    • Added information about system call memory write protection and stack mapping violations to system accounting. Now daily(8) will print a list of affected processes and lastcomm(1) will flag violations with 'M'.
  • Routing daemons and other userland network improvements:
    • The ntpd(8) daemon now gets and sets the clock in a secure way when booting even when a battery-backed clock is absent.
    • slaacd(8) now removes IPv6 addresses when it detects a link-state change but no new router advertisement is received.
    • ifconfig(8) now reports SFP, SFP+ and QSFP module information when using the sff option.
    • Imported snmp(1), a new SNMP client which aims to be netsnmp-compatible for supported features, and removed snmpctl(8).
    • Improvements in ntpd(8) DNS resolving and constraints checking, especially during startup. Unreliable NTP peers are removed from the pool and DNS resolving is repeated to add replacements.
    • Changed the bgpd(8) Adj-RIB-Out to a per-peer set of RB trees, improving speed.
    • Rewrote bgpd(8) community matching and handling code and improved performance for setups using many communities.
    • Checked the type of a network statement when looking for duplicates in bgpd(8). This fixes added network 0.0.0.0/0 after 'network inet static'.
    • Made improvements to bgpd(8) speed when configuring many peers.
    • Implemented bgpctl(8) 'show mrt neighbors', to print the neighbor table of MRT TABLE_DUMP_V2 dumps.
    • Moved bgpd(8) pfkey socket to the parent process. The refreshing of the keys for MD5 and IPSEC is done whenever the session state changes to IDLE or ACTIVE, which should behave better when reloading configs with auth changes.
    • In bgpd(8), fixed reloading of network statements that have no fixed prefix specification.
    • Extended the maximum size of the bgpd(8) shutdown communication message to 255 bytes.
    • Improvements in pfctl(8), to always check for namespace collisions on table commands. Introduced 'pfctl -FR' to reset pfctl(8) settings to defaults.
    • Imported Kristaps Dzonsons' RPKI validator, rpki-client(8).
    • relayd(8) now supports binary protocol health checking. See relayd.conf(5).
    • Added support for OCSP stapling to relayd(8).
    • Added relayd(8) support for SNI with new 'tls keypair' option to load additional certificates.
    • Added support for 'from/to address[/prefix]' in relayd(8) filter rules.
    • Implemented RFC 8555 "Automatic Certificate Management Environment (ACME)" to enable acme-client(1) to communicate with the v02 Let's Encrypt API. Read the upgrade guide for more information.
    • tcpdump(8) support for '-T erspan' and arbitrary gre(4) protocols.
    • Allowed specifying area by number as well as id in ospf6d(8).
    • ospfctl(8) now accepts both address and number format for 'ospfctl show database area XXX'.
    • ospfd(8) reload improvements.
    • Added a check to ospfd(8) and ospf6d(8) that any "depend on" interfaces are in the same rdomain.
    • Make 'passive' (announce a network configured on an interface as a stub network) work with P2P interfaces in ospfd(8).
    • Shutdown the service port when behind a captive portal with unwind(8), allowing bypass of captive portals that correctly answer SOA queries for the root zone and return NXDOMAIN for the captive portal redirect domain if edns0 is present.
    • Implemented DNS block lists in unwind(8).
    • Added support for IKEv2 Message Fragmentation (RFC 7383) to iked(8).
    • Enabled switching between wireless and wired interfaces in dhclient(8), setting the default route with the interface address and allowing two default routes in the routing table. A wired interface will be preferred when connected.
    • Added consistent use of 'ifconfig $_if [-inet| -inet6]' to clear existing configurations completely after restarting an install.
    • Added 'forwarded' log format extending the 'combined' log format in httpd(8).
  • Assorted improvements:
    • The filesystem buffer cache now more aggressively uses memory outside the DMA region, to improve cache performance on amd64 machines.
    • The BER API previously internal to ldap(1), ldapd(8), ypldap(8), and snmpd(8) has been moved into libutil. See ber_read_elements(3).
    • Removed the old userland realpath(3) and replaced it with __realpath(2), a kernel implementation. This will prevent calling readlink(2) on every component of a path and improve performance for unveil(2).
    • ld.so(1) speedups, improving dynamic linker performance for large objects.
    • Modified systat(1) to allow the use of 'b' to switch to stats since boot.
    • From perldoc(1), always produce man(7) output in UTF-8, which gives better results with our mandoc(1) renderer no matter which LC_CTYPE the user selected.
  • VMM/VMD improvements
    • Added support for 'boot device' to vm.conf(5) grammar, the '-B device' counterpart from vmctl(8).
    • Emulated kvm pvclock in vmm(4), compatible with pvclock(4) in OpenBSD.
    • Enabled reporting of the vm state through use of the vmctl(8) 'status' command.
    • Synced vm state in vmd(8) when (un)pausing a vm to ensure both vmm(4) and vmd(8) processes know the vm is paused.
    • Handled some unhandled instructions for SVM which led to vmm(4) guest termination, as well as RDTSCP and INVLPGA instructions.
    • Modified vmm(4) to flush guest TLB entries if the guest disables paging.
  • OpenSMTPD 6.6.0
    • New Features
      • Introduced support for ECDSA certificates with an ECDSA privsep engine.
      • Introduced builtin filters to allow basic filtering of incoming sessions in smtpd(8).
      • Introduced option to deliver junk to a Junk folder in mail.maildir(8).
    • Bug fixes
      • Fixed the smtp(1) client so it uses correct default port for SMTPS.
      • Fixed an smtpd(8) crash on excessively large input.
      • Ensured mail rejected by an LMTP server will stay queued rather than bouncing.
    • Experimental Features
      • Introduced a filters API to allow writing standalone filters for smtpd(8), with multiple filters made available in ports.
      • Introduced support for proxy-v2 protocol allowing smtpd(8) to operate behind proxy.
  • LibreSSL 3.0.2
    • API and Documentation Enhancements
      • Completed the port of RSA_METHOD accessors from the OpenSSL 1.1 API.
      • Documented undescribed options and removed unfunctional options description in openssl(1) manual.
    • Compatibility Changes
    • Testing and Proactive Security
      • A plethora of small fixes due to regular oss-fuzz testing.
      • Various side channels in DSA and ECDSA were addressed. These are some of the many issues found in an extensive systematic analysis of bignum usage by Samuel Weiser, David Schrammel et al.
      • Try to compute the cofactor if a nonsensical value was provided for ECC parameters. Fix from Billy Brumley.
    • Internal Improvements
    • Portable Improvements
      • Enabled performance optimizations when building with Visual Studio on Windows.
      • Enabled openssl(1) speed subcommand on Windows platform.
    • Bug Fixes
      • Fixed issue where SRTP extension would not be sent by server.
      • Fixed incorrect carry operation in 512 addition for Streebog.
      • Fixed -modulus option with openssl(1) dsa subcommand.
      • Fixed PVK format output issue with openssl(1) dsa and rsa subcommand.
      • Fixed a padding oracle attack in PKCS7_dataDecode() and CMS_decrypt_set1_pkey() (CMS is currently disabled). From Bernd Edlinger.
  • OpenSSH 8.1
    • New Features
      • ssh(1): Allow %n to be expanded in ProxyCommand strings
      • ssh(1), sshd(8): Allow prepending a list of algorithms to the default set by starting the list with the '^' character, E.g. "HostKeyAlgorithms ^ssh-ed25519"
      • ssh-keygen(1): add an experimental lightweight signature and verification ability. Signatures may be made using regular ssh keys held on disk or stored in a ssh-agent and verified against an authorized_keys-like list of allowed keys. Signatures embed a namespace that prevents confusion and attacks between different usage domains (e.g. files vs email).
      • ssh-keygen(1): print key comment when extracting public key from a private key. bz#3052
      • ssh-keygen(1): accept the verbose flag when searching for host keys in known hosts (i.e. "ssh-keygen -vF host") to print the matching host's random-art signature too. bz#3003
      • All: support PKCS8 as an optional format for storage of private keys to disk. The OpenSSH native key format remains the default, but PKCS8 is a superior format to PEM if interoperability with non-OpenSSH software is required, as it may use a less insecure key derivation function than PEM's.
    • Bugfixes
      • ssh(1): if a PKCS#11 token returns no keys then try to login and refetch them. Based on patch from Jakub Jelen; bz#2430
      • ssh(1): produce a useful error message if the user's shell is set incorrectly during "match exec" processing. bz#2791
      • sftp(1): allow the maximum uint32 value for the argument passed to -b which allows better error messages from later validation. bz#3050
      • ssh(1): avoid pledge sandbox violations in some combinations of remote forwarding, connection multiplexing and ControlMaster.
      • ssh-keyscan(1): include SHA2-variant RSA key algorithms in KEX proposal; allows ssh-keyscan to harvest keys from servers that disable old SHA1 ssh-rsa. bz#3029
      • sftp(1): print explicit "not modified" message if a file was requested for resumed download but was considered already complete. bz#2978
      • sftp(1): fix a typo and make <esc><right> move right to the closest end of a word just like <esc><left> moves left to the closest beginning of a word.
      • sshd(8): cap the number of permitopen/permitlisten directives allowed to appear on a single authorized_keys line.
      • All: fix a number of memory leaks (one-off or on exit paths).
      • Regression tests: a number of fixes and improvements, including fixes to the interop tests, adding the ability to run most tests on builds that disable OpenSSL support, better support for running tests under Valgrind and a number of bug-fixes.
      • ssh(1), sshd(8): check for convtime() refusing to accept times that resolve to LONG_MAX Reported by Kirk Wolf bz2977
      • ssh(1): slightly more instructive error message when the user specifies multiple -J options on the command-line. bz3015
      • ssh-agent(1): process agent requests for RSA certificate private keys using correct signature algorithm when requested. bz3016
      • sftp(1): check for user@host when parsing sftp target. This allows user@[1.2.3.4] to work without a path. bz#2999
      • sshd(8): enlarge format buffer size for certificate serial number so the log message can record any 64-bit integer without truncation. bz#3012
      • sshd(8): for PermitOpen violations add the remote host and port to be able to more easily ascertain the source of the request. Add the same logging for PermitListen violations which where not previously logged at all.
      • scp(1), sftp(1): use the correct POSIX format style for left justification for the transfer progress meter. bz#3002
      • sshd(8) when examining a configuration using sshd -T, assume any attribute not provided by -C does not match, which allows it to work when sshd_config contains a Match directive with or without -C. bz#2858
      • ssh(1), ssh-keygen(1): downgrade PKCS#11 "provider returned no slots" warning from log level error to debug. This is common when attempting to enumerate keys on smartcard readers with no cards plugged in. bz#3058
      • ssh(1), ssh-keygen(1): do not unconditionally log in to PKCS#11 tokens. Avoids spurious PIN prompts for keys not selected for authentication in ssh(1) and when listing public keys available in a token using ssh-keygen(1). bz#3006
  • Mandoc
    • Slowly start implementing tagging support for man(7) pages: tag alphabetic arguments of .IP, .TP, and .TQ macros.
    • In HTML output, wrap text and phrasing elements in paragraphs unless already contained in flow containers; never put them directly into sections. This helps to format paragraphs with the CSS class selector .Pp.
    • Implement the roff(7) .break request to break out of a .while loop.
    • If messages are shown and output is printed without a pager, display a heads-up on standard error output at the end because otherwise, users may easily miss the messages.
    • Let mandoc.css support prefers-color-scheme: dark.
    • For pages lacking a SYNOPSIS, let man(1) show the NAME section.

  • Ports and packages:

    Many pre-built packages for each architecture:

    • aarch64: 10075
    • amd64: 10736
    • armv7: 8943
    • i386: 10682
    • mips64: 7921
    • mips64el: 6583
    • powerpc: 9700
    • sparc64: 9685
  • As usual, steady improvements in manual pages and other documentation.
  • The system includes the following major components from outside suppliers:
    • Xenocara (based on X.Org 7.7 with xserver 1.20.5 + patches, freetype 2.10.1, fontconfig 2.12.4, Mesa 19.0.8, xterm 344, xkeyboard-config 2.20 and more)
    • LLVM/Clang 8.0.1 (+ patches)
    • GCC 4.2.1 (+ patches) and 3.3.6 (+ patches)
    • Perl 5.28.2 (+ patches)
    • NSD 4.2.2
    • Unbound 1.9.4
    • Ncurses 5.7
    • Binutils 2.17 (+ patches)
    • Gdb 6.3 (+ patches)
    • Awk Aug 10, 2011 version
    • Expat 2.2.8

How to install

Please refer to the following files on the mirror site for extensive details on how to install OpenBSD 6.6 on your machine:

Quick installer information for people familiar with OpenBSD, and the use of the "disklabel -E" command. If you are at all confused when installing OpenBSD, read the relevant INSTALL.* file as listed above!

OpenBSD/alpha:

Write floppy66.fs or floppyB66.fs (depending on your machine) to a diskette and enter boot dva0. Refer to INSTALL.alpha for more details.

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.

OpenBSD/amd64:

If your machine can boot from CD, you can write install66.iso or cd66.iso to a CD and boot from it. You may need to adjust your BIOS options first.

If your machine can boot from USB, you can write install66.fs or miniroot66.fs to a USB stick and boot from it.

If you can't boot from a CD, floppy disk, or USB, you can install across the network using PXE as described in the included INSTALL.amd64 document.

If you are planning to dual boot OpenBSD with another OS, you will need to read INSTALL.amd64.

OpenBSD/arm64:

Write miniroot66.fs to a disk and boot from it after connecting to the serial console. Refer to INSTALL.arm64 for more details.

OpenBSD/armv7:

Write a system specific miniroot to an SD card and boot from it after connecting to the serial console. Refer to INSTALL.armv7 for more details.

OpenBSD/hppa:

Boot over the network by following the instructions in INSTALL.hppa or the hppa platform page.

OpenBSD/i386:

If your machine can boot from CD, you can write install66.iso or cd66.iso to a CD and boot from it. You may need to adjust your BIOS options first.

If your machine can boot from USB, you can write install66.fs or miniroot66.fs to a USB stick and boot from it.

If you can't boot from a CD, floppy disk, or USB, you can install across the network using PXE as described in the included INSTALL.i386 document.

If you are planning on dual booting OpenBSD with another OS, you will need to read INSTALL.i386.

OpenBSD/landisk:

Write miniroot66.fs to the start of the CF or disk, and boot normally.

OpenBSD/loongson:

Write miniroot66.fs to a USB stick and boot bsd.rd from it or boot bsd.rd via tftp. Refer to the instructions in INSTALL.loongson for more details.

OpenBSD/luna88k:

Copy 'boot' and 'bsd.rd' to a Mach or UniOS partition, and boot the bootloader from the PROM, and then bsd.rd from the bootloader. Refer to the instructions in INSTALL.luna88k for more details.

OpenBSD/macppc:

Burn the image from a mirror site to a CDROM, and power on your machine while holding down the C key until the display turns on and shows OpenBSD/macppc boot.

Alternatively, at the Open Firmware prompt, enter boot cd:,ofwboot /6.6/macppc/bsd.rd

OpenBSD/octeon:

After connecting a serial port, boot bsd.rd over the network via DHCP/tftp. Refer to the instructions in INSTALL.octeon for more details.

OpenBSD/sparc64:

Burn the image from a mirror site to a CDROM, boot from it, and type boot cdrom.

If this doesn't work, or if you don't have a CDROM drive, you can write floppy66.fs or floppyB66.fs (depending on your machine) to a floppy and boot it with boot floppy. Refer to INSTALL.sparc64 for details.

Make sure you use a properly formatted floppy with NO BAD BLOCKS or your install will most likely fail.

You can also write miniroot66.fs to the swap partition on the disk and boot with boot disk:b.

If nothing works, you can boot over the network as described in INSTALL.sparc64.

How to upgrade

If you already have an OpenBSD 6.5 system, and do not want to reinstall, upgrade instructions and advice can be found in the Upgrade Guide.

Notes about the source code

src.tar.gz contains a source archive starting at /usr/src. This file contains everything you need except for the kernel sources, which are in a separate archive. To extract: 

# mkdir -p /usr/src
# cd /usr/src
# tar xvfz /tmp/src.tar.gz

sys.tar.gz contains a source archive starting at /usr/src/sys. This file contains all the kernel sources you need to rebuild kernels. To extract: 

# mkdir -p /usr/src/sys
# cd /usr/src
# tar xvfz /tmp/sys.tar.gz

Both of these trees are a regular CVS checkout. Using these trees it is possible to get a head-start on using the anoncvs servers as described here. Using these files results in a much faster initial CVS update than you could expect from a fresh checkout of the full OpenBSD source tree.

Ports Tree

A ports tree archive is also provided. To extract: 

# cd /usr
# tar xvfz /tmp/ports.tar.gz

Go read the ports page if you know nothing about ports at this point. This text is not a manual of how to use ports. Rather, it is a set of notes meant to kickstart the user on the OpenBSD ports system.

The ports/ directory represents a CVS checkout of our ports. As with our complete source tree, our ports tree is available via AnonCVS. So, in order to keep up to date with the -stable branch, you must make the ports/ tree available on a read-write medium and update the tree with a command like: 

# cd /usr/ports
# cvs -d anoncvs@server.openbsd.org:/cvs update -Pd -rOPENBSD_6_6

[Of course, you must replace the server name here with a nearby anoncvs server.]

Note that most ports are available as packages on our mirrors. Updated ports for the 6.6 release will be made available if problems arise.

If you're interested in seeing a port added, would like to help out, or just would like to know more, the mailing list ports@openbsd.org is a good place to know.