That pricing is awful. $4/month for 512MB VPS...eeek.
You'll find much better pricing at RackNerd, DediRock, InterServer, BuyVM, etc. Small indy hosting companies are the way to go. 2GB for $5/month or so is the typical price point.
Any host that offers KVM and allows you to upload your own ISO can run OpenBSD (or FreeBSD, NetBSD, whatever you want).
Check out LowEndTalk or LowEndBox for deals. There are other sites but that's where I shop.
Sure, if you need an API, or if you want to host in one of the less common locations, or if you absolutely must have five nines, then DO or Vultr or Linode or Amazon LightSail can be a good fit. But if you just need a VPS with a control panel in a typical hosting location (Amsterdam, LA, New York, Chicago, Singapore, etc.) then I don't see the point of paying more at one of the big hosts.
A warning about openbsdhandbook[.]com - this website has completely incorrect information for some things. Like hallucinated, even though I think it was created before LLMs.
For BSD (especially OpenBSD) you can pretty much just use the man pages and the online FAQ. They are really good.
If you want a book, Absolute OpenBSD is good though a bit out of date now. A lot of it would still be applicable though, if backed up by the current man pages.
Reading undeadly.org is a another good way to keep up on developments.
Dang, I didn't know that. I thought it was decent enough to get people exposed to doas(1), pkg_add(1), syspatch(8), etc... from which they could then read the man pages.
Thanks for pointing this out and I appreciate the other recommendations in this thread. Massive +1 for @jcs. That dude is awesome and puts out great stuff.
I've always gone with Vultr (vultr.com) for BSD VMs, its properly supported by them and while I've never hard verified this, they seem like a nice smaller player. Like they have offered Open/Free BSD VM's for > 10 years, kind of nice.
I have a couple of FreeBSD VMs on Vultr. For quite some time sshd regularly dies on one of them and I am not sure why.
A couple of theories I’ve had is that maybe
a) my VM was compromised and there is a persistent rootkit installed that kills sshd, or
b) file corruption after previous unclean shutdown has left some file needed by sshd corrupted and it leads to this behaviour, or
c) maybe it’s running out of memory sometimes
Each time I want to ssh into the machine I usually have to first connect with the VNC from the vultr dashboard to start sshd up again.
It’s running the latest FreeBSD, as every now and then I log in and do an upgrade on it some time after a new version has been released.
A persistent rootkit may have been installed if it was compromised between when some vulnerability became known and when I later upgraded next time.
If a file was corrupted in an unclean shutdown in the past maybe it’s a file that has not been changed between FreeBSD versions so even though upgrades replace some files maybe it’s the same corrupted file all along.
Ideally I’d just reinstall the machine, but that’s always more of a hassle than it should be so I continue running the VM in this broken state where sshd keeps dying every now and then.
Well, you can at least run "freebsd-update IDS" on this system to verify the base system, "pkg check -s -a" would check the integrity of files installed via pkg also.
While I’m at it I also took a quick look now at output of `top` and it’s sitting at 27 MB free RAM lol. So from that, out of memory is very likely the reason I keep having sshd die on me.
After rebooting the VM now, sshd died even when there was hundreds of megabytes free RAM available. So it seems I spoke too soon when I said it seemed to be for that reason.
Previously I haven't seen much detailed reason for why it dies in system messages. But this time it said something very specific:
> sshd[2036]: fatal: pack_hostkeys: serialize hostkey private: string is too large
Which kind of sounds like one of the sshd hostkey files might be corrupt? And maybe it only triggers after a while becuase it happens when scanners try to connect to it and during ssh negotiation sshd ends up selecting a different hostkey type than the one it uses when I connect to the machine myself?
I'm going to regenerate all of the three hostkey files on the server, and after that also disable the two that I can do without anyway.
They were very helpful when one of the AMD firmware patches in 7.3 caused my VPS to not boot. They even offered to apply a manual fix until patch -015 was available which fixed it.
The admins have access to your data and unless things have changed, that isn't monitored. They also bend to NSLs like any other provider. What they charge vs what things cost hurts.
And to clarify, this means encrypt it before it gets to the VPS. Just having full-disk encryption is not enough because cloud providers can dump RAM. There are tools that easily extract encryption keys from RAM.
So, really, you need to trust the cloud provider unless everything is encrypted on computers you own.
I migrated a client off for the same reason. The “app platform” ran behind Cloudflare, but they run the Cloudflare, so I couldn’t put it behind my own Cloudflare, nor could I configure it and solve the problem. Moved the entire thing to Hetzner, fast. What a week.
They're also too stupid to understand that they've been dropping UDP datagrams with src port == dst port and < 1024. This obviously breaks IPsec IKE. I showed them dummy traffic captured with netcat and tcpdump, but they refused to admit they caused the problem. They repeatedly claimed to see nothing dropped between the pcap files, that I was doing it to myself with a firewall that wasn't even enabled, or that this is just how a network is supposed to work.
You can even go completely free with Cloudflare tunnel with your own office/home hardware. I have a simple web running on my old Raspberry Pi 3 + nginx + golang web app. Also with ssh access to the Pi.
Yes, the cloudflare SSH tunneling works well -- though I think the fact that SSL is provisioned means it'll show up in the cert transparency log, possibly attracting unwanted attention to probe my home systems.
I ended up turning that off and switching to Tailscale. Tailscale is set to advertise my home IP range (I chose one that's not 192.168 based which avoids problems with range conflicts). So I can just connect to Tailscale and connect to 10.X.Y.Z as though I'm home. If I want memorable hostnames I can point DNS records to those private IPs.
You don't even need your own hardware. You can serve your site using the free CF Workers plan. Of course, that's a different goal than running bsd in an aggressively tiny cloud instance.
Does DigitalOcean still only propose up to 4 basic cpu as droplet maximum ?.
All their compute capacities disappeared overnight 2025/2026 without any reason.
Man I always look at this project with nothing by awe. I'd love to start something like this... if you're in central Switzerland and would like to copy their model, hit me up.
They are cool, man they've grown. I used that when there were ~20 VM's on there. Its a great project but think its only physically in Amsterdam which is why I ended up moving back to vultr, as they have many more options.
If you can, it really makes sense to look for low cost dedicated servers. For $35/month I get a whole machine with dual L5520 and 24 GB of ram. I used to have a little nicer server for a little less, but that provider had to close because their costs for electricity and space went up too fast. Yes, the L5520 is ancient, but my server needs are tiny and it's fun to have a whole machine.
Look on webhostingtalk or lowendbox or lowendtalk.
That pricing is awful. $4/month for 512MB VPS...eeek.
You'll find much better pricing at RackNerd, DediRock, InterServer, BuyVM, etc. Small indy hosting companies are the way to go. 2GB for $5/month or so is the typical price point.
Any host that offers KVM and allows you to upload your own ISO can run OpenBSD (or FreeBSD, NetBSD, whatever you want).
Check out LowEndTalk or LowEndBox for deals. There are other sites but that's where I shop.
Sure, if you need an API, or if you want to host in one of the less common locations, or if you absolutely must have five nines, then DO or Vultr or Linode or Amazon LightSail can be a good fit. But if you just need a VPS with a control panel in a typical hosting location (Amsterdam, LA, New York, Chicago, Singapore, etc.) then I don't see the point of paying more at one of the big hosts.
Lightsail does not offer five nines.
A warning about openbsdhandbook[.]com - this website has completely incorrect information for some things. Like hallucinated, even though I think it was created before LLMs.
While we are recommending and un-recommending resources https://romanzolotarev.com/bsd/ has been my go-to.
joshua stein's interest in getting OpenBSD running on anything he can provides useful insight too https://jcs.org/tagged/openbsd
For BSD (especially OpenBSD) you can pretty much just use the man pages and the online FAQ. They are really good.
If you want a book, Absolute OpenBSD is good though a bit out of date now. A lot of it would still be applicable though, if backed up by the current man pages.
Reading undeadly.org is a another good way to keep up on developments.
Dang, I didn't know that. I thought it was decent enough to get people exposed to doas(1), pkg_add(1), syspatch(8), etc... from which they could then read the man pages.
Thanks for pointing this out and I appreciate the other recommendations in this thread. Massive +1 for @jcs. That dude is awesome and puts out great stuff.
I've always gone with Vultr (vultr.com) for BSD VMs, its properly supported by them and while I've never hard verified this, they seem like a nice smaller player. Like they have offered Open/Free BSD VM's for > 10 years, kind of nice.
I have a couple of FreeBSD VMs on Vultr. For quite some time sshd regularly dies on one of them and I am not sure why.
A couple of theories I’ve had is that maybe
a) my VM was compromised and there is a persistent rootkit installed that kills sshd, or
b) file corruption after previous unclean shutdown has left some file needed by sshd corrupted and it leads to this behaviour, or
c) maybe it’s running out of memory sometimes
Each time I want to ssh into the machine I usually have to first connect with the VNC from the vultr dashboard to start sshd up again.
It’s running the latest FreeBSD, as every now and then I log in and do an upgrade on it some time after a new version has been released.
A persistent rootkit may have been installed if it was compromised between when some vulnerability became known and when I later upgraded next time.
If a file was corrupted in an unclean shutdown in the past maybe it’s a file that has not been changed between FreeBSD versions so even though upgrades replace some files maybe it’s the same corrupted file all along.
Ideally I’d just reinstall the machine, but that’s always more of a hassle than it should be so I continue running the VM in this broken state where sshd keeps dying every now and then.
Well, you can at least run "freebsd-update IDS" on this system to verify the base system, "pkg check -s -a" would check the integrity of files installed via pkg also.
It will only take a few min..
Neat! Haven’t tried either of those before.
While I’m at it I also took a quick look now at output of `top` and it’s sitting at 27 MB free RAM lol. So from that, out of memory is very likely the reason I keep having sshd die on me.
Not familiar with BSD but does it not syslog oom kills like linux?
After rebooting the VM now, sshd died even when there was hundreds of megabytes free RAM available. So it seems I spoke too soon when I said it seemed to be for that reason.
Previously I haven't seen much detailed reason for why it dies in system messages. But this time it said something very specific:
> sshd[2036]: fatal: pack_hostkeys: serialize hostkey private: string is too large
Which kind of sounds like one of the sshd hostkey files might be corrupt? And maybe it only triggers after a while becuase it happens when scanners try to connect to it and during ssh negotiation sshd ends up selecting a different hostkey type than the one it uses when I connect to the machine myself?
I'm going to regenerate all of the three hostkey files on the server, and after that also disable the two that I can do without anyway.
I used buyvm.net for BSD a while back. Didn't have any issues, and the few times I contacted their support they were quick to respond and helpful.
rootbsd.net before that, but they don't seem to exist anymore.
They were very helpful when one of the AMD firmware patches in 7.3 caused my VPS to not boot. They even offered to apply a manual fix until patch -015 was available which fixed it.
The admins have access to your data and unless things have changed, that isn't monitored. They also bend to NSLs like any other provider. What they charge vs what things cost hurts.
Any cloud compute vendor will have access to your data unless you encrypt it.
> unless you encrypt it
And to clarify, this means encrypt it before it gets to the VPS. Just having full-disk encryption is not enough because cloud providers can dump RAM. There are tools that easily extract encryption keys from RAM.
So, really, you need to trust the cloud provider unless everything is encrypted on computers you own.
DO burned me recently due to their unwillingness to handle DDOS attacks: "The best we can do is change your IP." Thanks guys.
Switched to OVH immediately.
I tried to warn them that they were hosting a phishing site once and they weren't very receptive.
Otherwise, I hosted a site with them for years and all went well.
I migrated a client off for the same reason. The “app platform” ran behind Cloudflare, but they run the Cloudflare, so I couldn’t put it behind my own Cloudflare, nor could I configure it and solve the problem. Moved the entire thing to Hetzner, fast. What a week.
They're also too stupid to understand that they've been dropping UDP datagrams with src port == dst port and < 1024. This obviously breaks IPsec IKE. I showed them dummy traffic captured with netcat and tcpdump, but they refused to admit they caused the problem. They repeatedly claimed to see nothing dropped between the pcap files, that I was doing it to myself with a firewall that wasn't even enabled, or that this is just how a network is supposed to work.
You can even go completely free with Cloudflare tunnel with your own office/home hardware. I have a simple web running on my old Raspberry Pi 3 + nginx + golang web app. Also with ssh access to the Pi.
Yes, the cloudflare SSH tunneling works well -- though I think the fact that SSL is provisioned means it'll show up in the cert transparency log, possibly attracting unwanted attention to probe my home systems.
I ended up turning that off and switching to Tailscale. Tailscale is set to advertise my home IP range (I chose one that's not 192.168 based which avoids problems with range conflicts). So I can just connect to Tailscale and connect to 10.X.Y.Z as though I'm home. If I want memorable hostnames I can point DNS records to those private IPs.
You don't even need your own hardware. You can serve your site using the free CF Workers plan. Of course, that's a different goal than running bsd in an aggressively tiny cloud instance.
You still have to pay for electricity. If you consider that "completely free" then paying $4 per month should also be considered "completely free".
Back in my day a blog post like this would've included a promotional link for $100 in DigitalOcean credits!
Now DO has to plow those loss-leading Marketing dollars into paying for memory I expect...
Does DigitalOcean still only propose up to 4 basic cpu as droplet maximum ?. All their compute capacities disappeared overnight 2025/2026 without any reason.
I heard all the RAM scheduled to be manufactured next year had already been sold out. Maybe that's a related phenomenon?
https://news.ycombinator.com/item?id=49207236
e.g. Hetzner tripled prices recently.
https://news.ycombinator.com/item?id=48542064
I run OpenBSD at netcup.de for €2/month. It's very low-spec, but it's enough.
For a little bit more you can rent on https://openbsd.amsterdam - they also donate to the OpenBSD foundation!
Man I always look at this project with nothing by awe. I'd love to start something like this... if you're in central Switzerland and would like to copy their model, hit me up.
They are cool, man they've grown. I used that when there were ~20 VM's on there. Its a great project but think its only physically in Amsterdam which is why I ended up moving back to vultr, as they have many more options.
+1 for obsd.ams , great VPS!
Crazy that after so many years of cloud compute a 8GB VM is $48/mo.
If you can, it really makes sense to look for low cost dedicated servers. For $35/month I get a whole machine with dual L5520 and 24 GB of ram. I used to have a little nicer server for a little less, but that provider had to close because their costs for electricity and space went up too fast. Yes, the L5520 is ancient, but my server needs are tiny and it's fun to have a whole machine.
Look on webhostingtalk or lowendbox or lowendtalk.
RamNode does $2/month but just one ipv6 address. Add a ipv4 address and it's $4/month.