Learn OpenBSD - Base System Services & rc

#Introduction

In episode 5 you learned how to manage users and grant privileges with doas. Now it's time to make the system actually work: running and managing services. Every daemon on OpenBSD — sshd, httpd, pf, smtpd — lives under one consistent and predictable system: the rc system.

There's no systemctl. No service. What exists is rcctl — a small command that wraps all service management in OpenBSD's characteristic style: clear, text-based, and easy to understand.

#The rc System Architecture

The OpenBSD rc system works in layers:

• /etc/rc: the main script run at boot, launching all daemons according to the configuration.
• /etc/rc.conf: the main file containing default values for each service. Don't edit it directly — it's overwritten on upgrade.
• /etc/rc.conf.local: your file. All customizations are written here and override the defaults.
• /etc/rc.d/: a directory containing individual daemon scripts, one per service.

The principle is simple: don't touch the bundled files; write your customizations in rc.conf.local.

#rcctl: The Central Command

rcctl is the only tool you need. Its basic commands:

rcctl enable httpd
rcctl start httpd
rcctl status httpd
rcctl restart httpd
rcctl stop httpd
rcctl disable httpd

• enable: marks a service to run automatically at boot.
• start/stop/restart: controls the service right now.
• status: displays status and PID.

#Checking the status of all services

rcctl ls on
rcctl ls all

rcctl ls on lists all services active at boot — a quick way to know "what is running on this machine".

#Configuring a Service

Every service has flags you can set. Default values live in /etc/rc.conf; customizations are written to /etc/rc.conf.local via rcctl set:

rcctl set sshd flags "-o PermitRootLogin=no"
rcctl set httpd flags "-n"

The first command sets the sshd flags directly from the command line. The second adds -n (dry-run) for httpd. You can see the effective values with:

rcctl get sshd
rcctl get httpd flags

#Manual editing

For more complex configurations, you can also write directly to /etc/rc.conf.local:

httpd_flags=""
smtpd_flags=""
sshd_flags="-o PermitRootLogin=no"

This file is entirely yours and becomes the single source of service customizations.

#Service Lifecycle: The httpd and sshd Example

A scenario you'll perform often — running a web server:

rcctl enable httpd
rcctl set httpd flags "-n"
rcctl start httpd

Once rcctl enable httpd is executed, httpd will activate automatically on every subsequent reboot. For sshd, which is enabled by default, a common operation is rcctl restart sshd after changing /etc/ssh/sshd_config, or rcctl reload sshd to reload the configuration without dropping connections.

#rcctl reload

Many OpenBSD daemons support reload — loading the configuration without a full restart:

rcctl reload httpd
rcctl reload smtpd
rcctl reload relayd

reload is preferred over restart in production because it doesn't drop active connections.

#Common Base System Daemons

All can be managed with the same rcctl enable/start/status pattern. This consistency is what makes OpenBSD administration easy to learn.

#Why This Design Is Secure

The rc system is designed to be transparent: you can always read /etc/rc.conf.local to know what's running and how it's configured. There's no hidden state in a big database like systemd. A quick audit is just rcctl ls on and grep -v '^#' /etc/rc.conf.local. This is the concrete form of the keep it simple principle that OpenBSD upholds.

#Closing

In episode 6 you mastered OpenBSD service management: understanding the /etc/rc.conf, /etc/rc.conf.local, and /etc/rc.d/ architecture, and controlling services with rcctl — enable, disable, start, stop, restart, reload, and setting flags.

Key takeaways:

• Service customizations go in /etc/rc.conf.local, not /etc/rc.conf.
• rcctl enable makes a service boot automatically; rcctl start runs it now.
• rcctl set <svc> flags sets flags without manual file editing.
• rcctl reload is safer than restart in production.

In the next episode, episode 7, we'll dive into filesystems, mount, and disks — getting to know FFS2, tmpfs, and mfs, using mount/umount, managing partitions with disklabel and newfs, arranging /etc/fstab, and maintenance with fsck and swap files.