Case Study: Modernizing Critical Infrastructure, Identity, and Appliance Decoupling at The Havorzone

The Havorzone (fictitious name to protect client identity) is a multinational corporation based in South America specializing in the design, prototyping, and manufacturing of automotive electronic control units (ECUs, automotive CAN/Ethernet gateways, and secure telematics units).

In this industrial sector, strict compliance with international vehicular cybersecurity standards (such as TISAX and ISO/SAE 21434), intellectual property protection, and code traceability demand granular control over every layer of the technology stack.

The legacy infrastructure relied heavily on conventional proprietary edge appliances from major vendors, Windows Server domain controllers and IIS/.NET application servers, and heterogeneous Windows 10 endpoints. This paradigm introduced steep recurring licensing costs, opaque low-level packet visibility, and dangerous delays in patching zero-day firmware flaws.

Engineering leadership executed a comprehensive infrastructure migration driven by two fundamental UNIX principles:

• OpenBSD: Serving as the perimeter security layer, handling deterministic packet filtering, load balancing, and mission-critical core network services.
• Debian GNU/Linux & ZorinOS: Anchoring corporate identity (Active Directory), scalable mass storage, containerized build systems, and unified desktop workstations.

1. Network Perimeter & Connectivity: OpenBSD, PF, and WireGuard

The Problem with Proprietary Appliances

The prior commercial perimeter appliance suffered catastrophic throughput degradation during concurrent deep inspection of heavy engineering traffic, charged per-tunnel license fees for remote VPNs, and had long lag times for vendor-published firmware security patches.

The Implementation

A redundant high-availability cluster was deployed on industrial x86-64 server hardware running OpenBSD, leveraging CARP (Common Address Redundancy Protocol) and pfsync to ensure real-time connection state synchronization and hitless session failover.

                     [ INTERNET / WAN ]
                              |
                        +-----+-----+
                        | CARP / WAN |
                        +-----+-----+
                              |
                +-------------+-------------+
                |                           |
         +------v------+             +------v------+
         |  OpenBSD 1  |<---pfsync-->|  OpenBSD 2  |
         | pf + wg(4)  |             | pf + wg(4)  |
         +------+------+             +------+------+
                |                           |
                +-------------+-------------+
                              |
                        +-----v-----+
                        | CARP / LAN |
                        +-----+-----+
                              |
       +----------------------+----------------------+
       |                      |                      |
[ VLAN Management ]    [ VLAN DMZ ]            [ VLAN Clients ]

• Deterministic Packet Filter (PF): A strict default-deny policy (block return all) in /etc/pf.conf is paired with stateful packet normalization (scrub), SYN flood protection (synproxy state), and strict 802.1Q VLAN isolation separating automotive lab test benches from corporate segments.
• High-Performance WireGuard (wg(4)): Cross-datacenter site-to-site tunnels and remote telemetry access for field engineers were deployed using OpenBSD’s native kernel-level wg driver. Modern elliptic-curve cryptography eliminated the cumbersome handshake overhead and negotiation bloat of legacy IPsec, minimizing diagnostic latency.

Technical Result: Line-rate 10 Gbps packet routing and filtering with less than 18% peak CPU utilization, reinforced by OpenBSD’s proactive kernel security primitives (W^X, pledge, unveil, and randomized stack placement).

2. Centralized Identity, PKI, and Access Control: Debian and OpenBSD

To decommission Windows Server domain controllers without breaking corporate authentication and policy management, The Havorzone implemented a hybrid architecture:

                  +--------------------------------+
                  |     Root / Intermediate CA     |
                  |      (OpenBSD / EAP-TLS)       |
                  +---------------+----------------+
                                  | X.509 Certificates
          +-----------------------+-----------------------+
          |                                               |
+---------v----------------+                     +--------v---------+
|   Debian Samba AD-DC     |                     | OpenBSD radiusd  |
| (Kerberos, LDAP, GPO)    |<--- Authentication -|    (802.1X)      |
+---------+----------------+                     +--------+---------+
          |                                               |
          +-----------------------+-----------------------+
                                  |
                        [ Managed Switch ]
                                  |
                       +----------v----------+
                       |  ZorinOS Workstation|
                       |   (sssd + realmd)   |
                       +---------------------+

Domain Controller with Samba AD-DC on Debian

• Identity Management: A clustered deployment of Samba 4 (AD-DC) was stood up on Debian GNU/Linux Stable, managing global LDAP catalogs, Kerberos Key Distribution Centers (KDC), and centralized Group Policy Objects (GPOs).
• Interoperability: Samba AD-DC maintains 100% protocol fidelity for domain-joined services while eliminating client access licenses (CALs) across the entire enterprise.

Network Access Control (802.1X) and PKI

• Public Key Infrastructure (PKI): An air-gapped OpenBSD root Certificate Authority issues cryptographic certificates strictly to intermediate CAs dedicated to hardware and service mutual authentication.
• EAP-TLS Authentication: OpenBSD’s native radiusd was integrated as the 802.1X RADIUS server. Managed network switches and wireless access points require mutual X.509 certificate validation before bringing physical access switchports online. Unknown devices without valid enterprise certificates are immediately dropped into a quarantined VLAN.

3. Engineering and Corporate Workstations: ZorinOS Deployment

Corporate workstations and engineering laboratories transitioned from Microsoft Windows to ZorinOS, flattening user learning curves while hardening endpoint security posture.

• Domain Integration: Leveraging sssd and realmd, ZorinOS endpoints authenticate against the Debian Samba AD-DC cluster. Login sequences automatically map user directories and enforce ticketed Kerberos credentials.
• Automotive Engineering Toolchains: On top of the stable ZorinOS LTS base, engineers run cross-compilation toolchains, CAN bus analyzers (such as Wireshark with native SocketCAN integration), firmware flashing utilities, and USB/Ethernet lab instrumentation drivers without emulation overhead.
• Peripheral Access Control: Removable USB storage is blocked via centralized udev rules, strictly whitelisting approved CAN interface adapters, hardware debuggers, and oscilloscopes by vendor and serial number.

4. Core Network Services: DNS and Mail on OpenBSD

Name resolution and messaging routing were cleanly partitioned into dedicated, least-privilege base services:

Authoritative & Recursive DNS

• Authoritative (nsd): OpenBSD’s nsd serves internal corporate and external authoritative zones inside dedicated chroot sandboxes, ensuring high-throughput resiliency against remote exploitation.
• Recursive DNS with DNSSEC (unbound): unbound resolves outbound queries for all ZorinOS endpoints and servers, enforcing strict DNSSEC validation with conditional zone forwarding for internal AD domain lookups.

Mail Infrastructure (OpenSMTPD + Dovecot)

• MTA: OpenSMTPD replaced commercial mail relays for outbound enterprise mail and automated alerts emitted from automated ECU assembly lines.
• Mailboxes & Filtering: Dovecot handles Maildir storage with encryption at rest, TLS-only IMAP access, and modular Sieve scripting to automatically sort automated diagnostic and QA reports.

5. Web Architecture Modernization: From Windows/.NET to Go and relayd

Telemetry collection services and production execution portals were migrated from legacy .NET on IIS to lightweight, statically compiled Go microservices fronted by OpenBSD.

Migration Workflow

1. Service Re-engineering: Monolithic C# backends were rewritten into Go microservices and compiled without dynamic runtime dependencies.
2. TLS Termination with relayd: The native relayd(8) daemon terminates inbound HTTPS connections, enforces client certificate checks where required, and balances traffic across backend Go workers over local UNIX sockets or 127.0.0.1.
3. Defense-in-Depth with pledge and unveil: Go binaries declare their restricted permissions at startup using pledge(2) (dropping unused syscalls) and unveil(2) (limiting filesystem visibility to required paths), neutralizing escape vectors in the event of an application flaw.

6. High-Capacity Storage & Development Infrastructure: Debian GNU/Linux

For storage-heavy workloads and distributed build farms, Debian GNU/Linux (Stable) powers the computing backend:

                        [ Services Segment ]
                                  |
                 +----------------+----------------+
                 |                                 |
        +--------v--------+               +--------v--------+
        |  Debian Server  |               |  Debian Server  |
        |   File Server   |               |  Docker Engine  |
        +--------+--------+               +--------+--------+
                 |                                 |
      +----------+----------+           +----------+----------+
      |                     |           |          |          |
  [ Samba ]             [ NFSv4 ]   [ Toolchains [ Bus Simulation [ CI/CD
(Documents)           (Firmware/Lab) (Compilers)]  (CAN/SOME-IP)]  Runners ]

Enterprise File Storage

• Deployed on Debian with fault-tolerant RAID storage arrays.
• Kerberized NFSv4 integrated with Samba AD-DC for automated firmware flashing test fixtures.
• Samba Network Shares mounted on ZorinOS engineering endpoints backed by granular POSIX ACLs and storage quotas.

Containerized Engineering Environment (Docker Engine)

• Dedicated compute instances running Docker Engine on Debian power automated CI/CD build pipelines.
• Containers isolate diverse automotive cross-compilers (ARM Cortex-R, RISC-V, Infineon TriCore) and simulate vehicular networks (SOME/IP, CAN-FD, LIN) without polluting host operating systems.

Technical Takeaways

The infrastructure overhaul at The Havorzone proves that decoupling from closed proprietary solutions in mission-critical manufacturing environments is not only viable, but superior:

1. Code Sovereignty & Security Posture: Anchoring edge routing, firewalls, and critical services on OpenBSD drastically shrank the attack surface through plain-text configurations, audited code, and kernel mitigations enabled by default.
2. Identity Unification Without Vendor Lock-in: Pairing Debian Samba AD-DC with ZorinOS workstations eliminated licensing overhead while preserving seamless Kerberos authentication across physical and wireless infrastructure.
3. Deterministic Performance: Migrating from IIS/.NET to Go with relayd, paired with isolated Debian build pipelines, boosted compute density and lowered hardware footprints across the company’s datacenters.