Creating a new user on OpenBSD

Working as root all the time is a bad habit on any Unix-like system, and OpenBSD is no exception. The usual pattern is: create a normal user account, give that account the ability to escalate to root when needed, and stop logging in as root directly. Here’s how to do that properly on OpenBSD.

Creating the account with adduser

OpenBSD ships with an interactive adduser utility that walks you through account creation with prompts, rather than expecting you to remember a long list of flags. Log in as root (or via the account created during install) and run it with no arguments:

# adduser

It checks /etc/shells, /etc/master.passwd, and /etc/group for consistency first, then steps through the following prompts:

1. Username – letters, numbers, underscore, and dash are allowed. adduser shows you the legal character set as it prompts.
2. Full name – a free-text “real name” for the account, stored in the password database.
3. Shell – chosen from the shells listed in /etc/shells, plus a nologin option for service accounts. The default is shown in brackets; press Enter to accept it.
4. UID – adduser picks the next available UID starting from 1000 by default; you can accept the suggestion or override it.
5. Login group – by default each new user gets their own group matching their username. This is where you can instead add the account to an existing group, such as wheel.

At the end, adduser shows you a summary of everything you’ve entered and gives you the chance to go back and fix mistakes before it commits the account – there’s no need to get every answer perfect on the first pass.

Adding the user to wheel

The wheel group is OpenBSD’s traditional marker for “this account is allowed to escalate to root.” You can add the user to it during the adduser group prompt, or afterwards with:

# usermod -G wheel yourusername

Membership in wheel on its own doesn’t grant any privileges – it’s just a group. What actually uses it is your privilege escalation tool, covered next.

doas vs sudo: use doas

If you’ve come from Linux, you’ll be reaching for sudo out of habit. On OpenBSD, don’t – sudo isn’t installed at all by default and has to be pulled in separately via pkg_add. OpenBSD’s native tool is doas, a much smaller, simpler privilege escalation utility that the OpenBSD project wrote itself and ships in the base system. It’s the idiomatic choice on OpenBSD: fewer moving parts, a much smaller configuration syntax, and no third-party package to track.

doas is configured via a single file, /etc/doas.conf, which doesn’t exist by default. Create it as root:

# vi /etc/doas.conf

A minimal, sensible configuration that lets anyone in the wheel group run commands as root, after entering their own password, looks like this:

permit persist :wheel

The persist keyword caches the authentication for a short period, similar to how sudo behaves by default, so you’re not re-entering your password for every single command in a session. If you’d rather it ask every time, drop persist and just use permit :wheel.

The file must be owned by root and not world-writable, or doas will refuse to use it:

# chown root:wheel /etc/doas.conf
# chmod 0400 /etc/doas.conf

From this point, log out of root and log back in as your new user. Test it with:

$ doas whoami

It should prompt for your password and return root. From here on, keep root logins to a minimum and do your day-to-day administration through doas instead.