Minimum requirements:<\/p>\n
- \n
- FreeBSD<\/strong>\n
- \n
- CPU: 1 core<\/li>\n
- RAM: 1 GB<\/li>\n
- Storage: 2 GB<\/li>\n<\/ul>\n<\/li>\n
- OpenBSD<\/strong>\n
- \n
- CPU: 1 core<\/li>\n
- RAM: 64 MB<\/li>\n
- Storage: 1 GB<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/unix.png\")
<\/p>\nThe main difference between UNIX and Linux:<\/p>\n
- \n
- Linux is just the kernel that gets packaged\/distrubuted is multiple flavours.<\/li>\n
- Linux is UNIX-like or UNIX-inspired and does not share any common source.<\/li>\n
- UNIX got forked multiple times, and each fork is totally independent of the others.<\/li>\n
- UNIX flavours work in synergy to improve themselves and interoperability wherever possible.<\/li>\n<\/ul>\n
Note:<\/strong> TrueNAS (FreeNAS), pfSense, and OPNsense are all based on FreeBSD.<\/p>\n
\nINSTALLATION<\/strong><\/p>\n
For Linux users, the CLI installation of both distributions should be straightforward. The right approach depends on the environment and intended use.<\/p>\n
The ISO image offers the most flexible installation source because it includes a wider variety of hardware drivers. However, if the system will run on specific hardware such as a SBC (like Raspberry Pi) or as a VM, tailored images are also available.<\/p>\n
- \n
- FreeBSD<\/strong><\/li>\n<\/ul>\n
The installation is straightforward and should not pose much of a challenge to a Linux user.<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-15-22-19-03.png\")
<\/p>\n- \n
- OpenBSD<\/strong><\/li>\n<\/ul>\n
Do not expect anything fancy with OpenBSD. It is not pretty or particularly user-friendly.<\/p>\n
When you see the following screen, do not panic. That is simply how it looks.<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-17-21-33-21.png\")
<\/p>\nFollow the steps:<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-17-21-35-33.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-17-21-36-27.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-17-21-46-09.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-17-21-47-26.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-17-21-48-29.png\")
<\/p>\nMirrors are sorted by latency after a ping test. It is recommended to use the first one.<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-17-21-49-09.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-17-21-50-12.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-17-21-55-59.png\")
<\/p>\nRemember to remove the installation media, otherwise it will keep prompting to start the installation on boot.<\/p>\n
\nFIRST ACCESS<\/strong><\/p>\n
Log in with the root credentials set during installation.<\/p>\n
To reboot and shut down:<\/p>\n
reboot<\/pre>\n
shutdown -p now<\/pre>\n
Without the
-p<\/code> flag, the system will not power off after shutdown, similar to issuing just thehalt<\/code> command.<\/p>\nList processes:<\/p>\n
ps aux\r\ntop<\/pre>\n
\nUPDATING, UPGRADING, AND INSTALLING PACKAGES<\/strong><\/p>\n
Update and upgrade all packages using the package manager.<\/p>\n
For FreeBSD:<\/strong><\/p>\n
pkg update && pkg upgrade -y<\/pre>\n
For OpenBSD:<\/strong><\/p>\n
pkg_add -Uu<\/pre>\n
Audit vulnerable installed packages (FreeBSD only):<\/p>\n
pkg audit -F && pkg audit<\/pre>\n
Fetch and install system updates (FreeBSD only):<\/p>\n
freebsd-version\r\nfreebsd-update fetch install<\/pre>\n
Before installing updates, the
vi<\/code> editor will open with output for review and approval. This may be unexpected for Linux users, so take time to read it carefully before proceeding in a production environment. A reboot is always recommended afterward.<\/p>\nThere is no
nano<\/code> by default, but it can be installed.vi<\/code> gets the job done for those comfortable with it.<\/p>\nFor FreeBSD:<\/strong><\/p>\n
pkg install nano<\/pre>\n
For OpenBSD:<\/strong><\/p>\n
pkg_add nano<\/pre>\n
It may first prompt you to install the package manager, then ask for confirmation to install the desired package. If there is no Internet access because the network interfaces need configuration, follow the next steps first.<\/p>\n
\nNETWORK CONFIGURATION<\/strong><\/p>\n
Most likely, two network interfaces will be needed. For this demo, the first interface is treated as WAN (has Internet access) and the second as LAN (internal network access only).<\/p>\n
ifconfig<\/pre>\n
Three network interfaces may appear: em0<\/strong> (WAN), em1<\/strong> (LAN), and lo0<\/strong> (loopback). If any were not properly configured during installation, follow the steps below.<\/p>\n
For FreeBSD:<\/strong><\/p>\n
nano \/etc\/rc.conf<\/pre>\n
...\r\n# WAN (em0)\r\nifconfig_em0=\"DHCP\"\r\n# LAN (em1)\r\nifconfig_em1=\"inet 10.0.0.10 netmask 255.255.255.0\"\r\n...<\/pre>\n
Optionally, if DHCP does not provide a default gateway, one can be added to the same configuration file:<\/p>\n
...\r\ndefaultrouter=\"10.1.1.1\"\r\n...<\/pre>\n
Out of the box, FreeBSD and OpenBSD can route traffic between all configured interfaces, but this requires enabling a single flag:<\/p>\n
gateway_enable=\"YES\"<\/pre>\n
Apply the configuration by restarting the network service:<\/p>\n
service netif restart<\/pre>\n
Check networks and routes:<\/p>\n
netstat -r\r\nnetstat -nr<\/pre>\n
Setting a static route:<\/p>\n
route add -net 192.168.0.0\/16 10.2.2.1<\/pre>\n
To make it persist across reboots:<\/p>\n
nano \/etc\/rc.conf<\/pre>\n
...\r\nstatic_routes=\"net2\"\r\nroute_net2=\"-net 192.168.0.0\/16 10.2.2.1\"\r\n...<\/pre>\n
For more than one static route:<\/p>\n
...\r\nstatic_routes=\"net2 net3\"\r\nroute_net2=\"-net 192.168.0.0\/16 10.2.2.1\"\r\nroute_net3=\"-net 172.16.0.0\/24 10.2.2.1\"\r\n...<\/pre>\n
When configured to use DHCP,
\/etc\/resolv.conf<\/code> will be populated automatically. As with Linux, it can always be managed manually, and auto-population can be suppressed as follows:<\/p>\n\/etc\/dhclient-enter-hooks<\/pre>\n
...\r\nadd_new_resolv_conf() {\r\n # Do not overwrite \/etc\/resolv.conf with the DHCP configuration.\r\n return 0\r\n}\r\n...<\/pre>\nFor OpenBSD:<\/strong><\/p>\n
nano \/etc\/hostname.em0<\/pre>\n
For DHCP:<\/p>\n
inet autoconf<\/pre>\n
For a static IP:<\/p>\n
inet 10.1.1.2 255.255.255.0 10.1.1.1<\/pre>\n
Apply:<\/p>\n
sh \/etc\/netstart<\/pre>\n
\nMANAGING USERS<\/strong><\/p>\n
Create a new user:<\/p>\n
adduser userName<\/pre>\n
Delete a user:<\/p>\n
rmuser userName<\/pre>\n
Change the current user’s password or another user’s password:<\/p>\n
passwd<\/pre>\n
passwd userName<\/pre>\n
To grant administrator privileges, add the user to the
wheel<\/code> group.<\/p>\nFor FreeBSD:<\/strong><\/p>\n
pw groupmod -n wheel -m userName<\/pre>\n
To remove a user from the group, replace
-m<\/code> with-d<\/code>. To list members of thewheel<\/code> group:<\/p>\npw groupshow -n wheel<\/pre>\n
For OpenBSD:<\/strong><\/p>\n
usermod -G wheel userName<\/pre>\n
List the groups a user belongs to:<\/p>\n
id userName<\/pre>\n
Since the
root<\/code> user cannot SSH by default (as with most Linux systems), use the newly created user to connect remotely, then switch to root withsu<\/code>.<\/p>\nThe SSHd service may need to be restarted to allow the new user to connect.<\/p>\n
For FreeBSD:<\/strong><\/p>\n
service sshd restart\r\nservice sshd status<\/pre>\n
For OpenBSD:<\/strong><\/p>\n
rcctl restart sshd\r\nrcctl check sshd<\/pre>\n
\nFILE SYSTEM<\/strong><\/p>\n
Originally, UFS<\/strong> (Unix File System) was the default file system, but ZFS<\/strong> (Zettabyte File System) is now the default due to its support for advanced features like snapshots, compression, and RAID.<\/p>\n
Besides UFS and ZFS, there is also a native file system called HAMMER<\/strong> (Highly Available, Multi-Master, Elastic Replicated Object Store), developed by DragonFly BSD. It provides high availability and fault tolerance, and is worth exploring if those features are relevant to your use case.<\/p>\n
FAT, NTFS, EXT2 through EXT4, APFS, and ISO 9660 are also supported, along with the network file systems NFS (Linux) and CIFS (Windows). Note that XFS is NOT<\/span> officially supported.<\/p>\n
Linux users will find the directory structure and file\/permission management largely familiar.<\/p>\n
\nFIREWALL ON FREEBSD<\/strong><\/p>\n
Enable the firewall:<\/p>\n
nano \/etc\/rc.conf<\/pre>\n
...\r\nfirewall_enable=\"YES\"\r\n...<\/pre>\n
Create the ruleset:<\/p>\n
nano \/etc\/ipfw.rules<\/pre>\n
ipfw add allow tcp from any to any 80 in\r\nipfw add allow ip from any to any 21 out\r\nipfw add allow tcp from 10.20.30.0\/24 to 10.1.1.1 22 in\r\nipfw add deny udp from any to any 53\r\nipfw add deny all from 192.168.0.10 to any in\r\nipfw add deny tcp from any to any 22 in via em0\r\nipfw add deny tcp from any to any 10000-20000 fwd em0<\/pre>\n
- \n
- in<\/strong> \/ out<\/strong>\n
- \n
- Applied only to traffic to and from the local system.<\/li>\n<\/ul>\n<\/li>\n
- in via<\/strong> \/ out via<\/strong>\n
- \n
- Applied to traffic on the specified interface, including forwarded packets.<\/li>\n<\/ul>\n<\/li>\n
- fwd<\/strong>\n
- \n
- Applied only to packets being forwarded to the specified interface.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Load the rules into the kernel:<\/p>\n
\/sbin\/ipfw \/etc\/ipfw.rules<\/pre>\n
To make the firewall rules persist across reboots, add the same line to the following file:<\/p>\n
nano \/etc\/rc.local<\/pre>\n
...\r\n\/sbin\/ipfw \/etc\/ipfw.rules\r\n...<\/pre>\n
\nFIREWALL<\/strong><\/p>\n
PF<\/strong> (Packet Filter) is the default firewall in FreeBSD, GhostBSD, and others in the family.<\/p>\n
nano \/etc\/pf.conf<\/pre>\n
- \n
- Example for routing between WAN and LAN.<\/li>\n<\/ul>\n
wan=\"em0<\/strong>\"\r\nlan=\"em1<\/strong>\"\r\n\r\nset skip on lo0\r\nset block-policy drop\r\n\r\nblock drop all\r\n\r\nblock in all\r\nblock out all\r\n\r\npass quick in all keep state\r\npass in on $wan proto tcp<\/strong> from any to any port 80<\/strong>\r\npass in on $lan proto { tcp<\/strong> udp<\/strong> } from $lan:network to port { 139<\/strong> 445<\/strong> }\r\npass out inet proto icmp<\/strong> icmp-type { echoreq<\/strong> }\r\npass in on $lan proto icmp<\/strong> all icmp-type { echoreq<\/strong>, echorep<\/strong> }<\/pre>\nOptionally, replace
keep state<\/code> withmodulate state<\/code> for additional security. This randomizes the initial sequence number of TCP packets to help prevent TCP session hijacking.<\/p>\n- \n
- Example for blocking all ports except SSH.<\/li>\n<\/ul>\n
ext_if = \"vtnet0<\/strong>\"\r\ntcp_services = \"{ 22<\/strong> }\"\r\n\r\nset skip on lo0\r\nset block-policy drop\r\n\r\nscrub in all\r\nblock all\r\n\r\npass out on $ext_if keep state\r\npass in on $ext_if proto tcp<\/strong> to port $tcp_services keep state\r\npass in on $ext_if inet proto icmp<\/strong> icmp-type echoreq<\/strong><\/pre>\nTest and temporarily apply (auto-revert safety net):<\/p>\n
pfctl -nf \/etc\/pf.conf && pfctl -f \/etc\/pf.conf && sleep 60 && pfctl -d<\/pre>\n
If the response is it
pfctl: Failed to open netlink: No such file or directory<\/code> means the kernel module is not loaded yet.<\/p>\nkldstat\r\nkldload pf\r\nkldload pflog<\/pre>\n
Test if the allowed inbound connection works, then apply it permanently.<\/p>\n
pfctl -e\r\nservice pf start<\/pre>\n
Enable the firewall on boot:<\/p>\n
sysrc pf_enable=YES\r\nsysrc pflog_enable=YES<\/pre>\n
Check the firewall status:<\/p>\n
pfctl -si<\/pre>\n
Check the applied rules:<\/p>\n
pfctl -sr<\/pre>\n
\nTROUBLESHOOTING<\/strong><\/p>\n
- \n
- System Logs<\/strong><\/li>\n<\/ul>\n
Watch logs in real time:<\/p>\n
tail -f \/var\/log\/messages<\/pre>\n
Filter for a specific entry type:<\/p>\n
tail -f \/var\/log\/messages | grep error<\/pre>\n
grep ssh \/var\/log\/messages<\/pre>\n
- \n
- Diagnostic Tools<\/strong><\/li>\n<\/ul>\n
ping 8.8.8.8<\/pre>\n
traceroute 1.1.1.1<\/pre>\n
top<\/pre>\n
tcpdump -i em0<\/pre>\n
dmesg | less<\/pre>\n
- \n
- Configuration<\/strong><\/li>\n<\/ul>\n
hostname myNewHostname<\/pre>\n
sysrc hostname=\"myNewHostname\"<\/pre>\n
- \n
- Enabling IPv6<\/strong><\/li>\n<\/ul>\n
sysrc ipv6_activate_all_interfaces=\"YES\"\r\nsysrc ifconfig_em0<\/strong>_ipv6=\"inet6 accept_rtadv\"\r\nsysrc rtsold_enable=\"YES\"\r\nsysrc dhcpcd_enable=\"YES\"\r\npkg install -y dhcpcd\r\nnano \/etc\/dhcpcd.conf<\/pre>\n
allowinterfaces em0<\/strong>\r\nipv6only\r\nnoipv6rs<\/pre>\n
Reboot then test.<\/p>\n
reboot\r\nifconfig | grep inet6\r\nping 2606:4700:4700::1111\r\nping 1.1.1.1<\/pre>\n
Replace
em0<\/code> with the interface name for your environment.<\/p>\n- \n
- Setting Timezone.<\/li>\n<\/ul>\n
tzsetup<\/pre>\n","protected":false},"excerpt":{"rendered":"While Linux is not a direct descendant of Unix, it was inspired by Unix and […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-3395","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3395","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3395"}],"version-history":[{"count":22,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3395\/revisions"}],"predecessor-version":[{"id":6014,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3395\/revisions\/6014"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3395"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3395"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3395"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Setting Timezone.<\/li>\n<\/ul>\n
- Enabling IPv6<\/strong><\/li>\n<\/ul>\n
- Configuration<\/strong><\/li>\n<\/ul>\n
- Diagnostic Tools<\/strong><\/li>\n<\/ul>\n
- System Logs<\/strong><\/li>\n<\/ul>\n
- Example for blocking all ports except SSH.<\/li>\n<\/ul>\n
- Example for routing between WAN and LAN.<\/li>\n<\/ul>\n
- Applied only to packets being forwarded to the specified interface.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
- in<\/strong> \/ out<\/strong>\n
- OpenBSD<\/strong><\/li>\n<\/ul>\n
- FreeBSD<\/strong><\/li>\n<\/ul>\n