OpenBSD
Prepare OpenBSD devices for QUARK Config Backup.
This guide covers OpenBSD hosts used as routers, firewalls, or servers.
OpenBSD
Create a backup account. Create a dedicated local user for QUARK:
An unprivileged user can read most of the configuration QUARK collects. For files readable only by root (for example /etc/pf.conf on some setups), grant narrowly scoped rights with doas by adding a rule to /etc/doas.conf that permits the backup user to run only the required read commands as root.
Enable SSH. OpenSSH is part of the base system and sshd is enabled by default on a standard install. To restrict access to the Netwatch collector, add a PF rule permitting TCP port 22 only from the collector's address, or limit the account in /etc/ssh/sshd_config:
Replace 203.0.113.10 with the collector's address and reload sshd.
Platform notes. SSH key authentication is recommended; add the collector's public key to /home/netwatch-backup/.ssh/authorized_keys.
Enable backup in Netwatch
Once the device is prepared, open its host in Netwatch (Data collection > Hosts) and add the Config Backup macros — the supported status flag, the model code for this platform, and the credentials you created. See Getting started for the full macro list and values.