Minimum requirements:<\/p>\n
- \n
- FreeBSD<\/strong>\n
- \n
- CPU: 1 core<\/li>\n
- RAM: 1 GB<\/li>\n
- Storage: 2 GB<\/li>\n<\/ul>\n<\/li>\n
- OpenBSD<\/strong>\n
- \n
- CPU: 1 core<\/li>\n
- RAM: 64 MB<\/li>\n
- Storage: 1 GB<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
The main difference that reflect on the amount of resources each distribution used is the amount of modules that come pre-installed. OpenBSD is more minimalistic and only comes with the bare minimum out of the box, while FreeBSD comes with a collection of features.<\/p>\n
Note:<\/strong> TrueNAS (FreeNAS), pfSense, and OPNsense are based on FreeBSD.<\/p>\n
\nINSTALLATION<\/strong><\/p>\n
For Linux users, the CLI installation of both distributions might not be a big deal and it all depends on the environment and what the system will be used for.<\/p>\n
The ISO image will provide the most flexible installation source because it contains wider variety of hardware drivers but if it is going to be running a specific hardware such as a SBC (like Raspberry Pi) or as a VM, there are tailored images from them too.<\/p>\n
- \n
- FreeBSD<\/strong><\/li>\n<\/ul>\n
It’s installation is straight forward and does not offer much challenge to a Linux user.<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-15-22-19-03.png\")
<\/p>\n- \n
- OpenBSD<\/strong><\/li>\n<\/ul>\n
Don’t expect anything fancy on OpenBSD, it is not pretty or friendly.<\/p>\n
When you see the following screen, don’t panic! That is how it looks.<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-17-21-33-21.png\")
<\/p>\nFollow the steps:<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-17-21-35-33.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-17-21-36-27.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-17-21-46-09.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-17-21-47-26.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-17-21-48-29.png\")
<\/p>\nThey are sorted by latency after a ping test. It is recommended to use the first.<\/p>\n
![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-17-21-49-09.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-17-21-50-12.png\")
<\/p>\n![\"\"](\"https:\/\/dft.wiki\/wp-content\/uploads\/sites\/15\/2023\/02\/Screenshot-from-2023-02-17-21-55-59.png\")
<\/p>\nRemember to remove the installation media or it will keep prompting to start the installation on boot.<\/p>\n
\nFIRST ACCESS<\/strong><\/p>\n
Log with the root credentials set during the installation.<\/p>\n
First of all, how to reboot and shut it down.<\/p>\n
reboot<\/pre>\n
shutdown -p now<\/pre>\n
If not informed
-p<\/code> it will not power off after shutdown, like if you only issue the commandhalt<\/code>.<\/p>\nList processes.<\/p>\n
ps aux\r\ntop<\/pre>\n
\nUPDATING, UPGRADING, AND INSTALLING PACKAGES<\/strong><\/p>\n
Regular package manager update and upgrade all its packages.<\/p>\n
For FreeBSD:<\/strong><\/p>\n
pkg update && pkg upgrade<\/pre>\n
For OpenBSD:<\/strong><\/p>\n
pkg_add -Uu<\/pre>\n
Audit the vulnerable installed packages (FreeBSD only).<\/p>\n
pkg audit -F && pkg audit<\/pre>\n
Fetch and install system updates (FreeBSD only).<\/p>\n
freebsd-version\r\nfreebsd-update fetch install<\/pre>\n
Before it install the updates the
vi<\/code> file editor with some output for review and approval. It is not expected by Linux users, so take time to read and understand before proceeding with the installation if in a production environment. A reboot is always recommended right after.<\/p>\nThere is no
nano<\/code> butvi<\/code> gets the job done for those who like it. I don’t!<\/p>\nFor FreeBSD:<\/strong><\/p>\n
pkg install nano<\/pre>\n
For OpenBSD:<\/strong><\/p>\n
pkg_add nano<\/pre>\n
It will probably ask you to first install the package manager then it will prompt for the confirmation to install the desired package. But if there is no Internet because the network interfaces need configuration, follow the next steps first.<\/p>\n
\nNETWORK CONFIGURATION<\/strong><\/p>\n
Most likely, two network interfaces will be required and for this demo I will consider the first interface as a WAN (has Internet access) and the second as a LAN (has only internal network access).<\/p>\n
ifconfig<\/pre>\n
Three network interfaces might show up: em0<\/strong> (WAN), em1<\/strong> (LAN), and lo0<\/strong> (loopback). If any was not properly configured during the installation of the system forllow the next steps.<\/p>\n
For FreeBSD:<\/strong><\/p>\n
nano \/etc\/rc.conf<\/pre>\n
...\r\n# WAN (em0)\r\nifconfig_em0=\"DHCP\"\r\n# LAN (em1)\r\nifconfig_em1=\"inet 10.0.0.10 netmask 255.255.255.0\"\r\n...<\/pre>\n
Optionally, if the DHCP does not provide a default a default gateway can be added to this same configuration file as follows:<\/p>\n
...\r\ndefaultrouter=\"10.1.1.1\"\r\n...<\/pre>\n
Out-of-the-box, FreeBSD and OpenBSD are native routers, capable of routing traffic between all configured interfaces but it requires a single flag to be turned on:<\/p>\n
gateway_enable=\"YES\"<\/pre>\n
Apply the configuration by restarting the network service.<\/p>\n
service netif restart<\/pre>\n
Check the networks and routes.<\/p>\n
netstat -r\r\nnetstat -nr<\/pre>\n
Setting a static route:<\/p>\n
route add -net 192.168.0.0\/16 10.2.2.1<\/pre>\n
To make it persist reboots:<\/p>\n
nano \/etc\/rc.conf<\/pre>\n
...\r\nstatic_routes=\"net2\"\r\nroute_net2=\"-net 192.168.0.0\/16 10.2.2.1\"\r\n...<\/pre>\n
For more then one:<\/p>\n
...\r\nstatic_routes=\"net2 net3\"\r\nroute_net2=\"-net 192.168.0.0\/16 10.2.2.1\"\r\nroute_net3=\"-net 172.16.0.0\/24 10.2.2.1\"\r\n...<\/pre>\n
If configured to use DHCP, it will automatically populate the file
\/etc\/resolv.conf<\/code>, and like on Linux it can always be manually managed and the auto population can be suppressed as follows:<\/p>\n\/etc\/dhclient-enter-hooks<\/pre>\n
...\r\nadd_new_resolv_conf() {\r\n # Do not overwritte \/etc\/resolv.conf with the DHCP configuration.\r\n return 0\r\n}\r\n...<\/pre>\nFor OpenBSD:<\/strong><\/p>\n
nano \/etc\/hostname.em0<\/pre>\n
For HDCP:<\/p>\n
inet autoconf<\/pre>\n
For static IP:<\/p>\n
inet 10.1.1.2 255.255.255.0 10.1.1.1<\/pre>\n
Apply<\/p>\n
sh \/etc\/netstart<\/pre>\n
\nMANAGING USERS<\/strong><\/p>\n
Create a new used.<\/p>\n
adduser userName<\/pre>\n
Delete a user:<\/p>\n
rmuser userName<\/pre>\n
Changing current user’s password and another user’s password:<\/p>\n
passwd<\/pre>\n
passwd userName<\/pre>\n
To make it an administrator add it to the
wheel<\/code> group.<\/p>\nFor FreeBSD:<\/strong><\/p>\n
pw groupmod -n wheel -m userName<\/pre>\n
To remove, replace the argument
-m<\/code> with-d<\/code>. Then, list the members of thewheel<\/code> group.<\/p>\npw groupshow -n wheel<\/pre>\n
For OpenBSD:<\/strong><\/p>\n
usermod -G wheel userName<\/pre>\n
List what groups the user is part of.<\/p>\n
id userName<\/pre>\n
Since by default the
root<\/code> user is not allowed to SSH (like in most Linux systems), use the newly created user to connect from remote then switch to root with the commandsu<\/code>.<\/p>\nProbably it will require to restart the the SSHd service to allow the new user to connect.<\/p>\n
For FreeBSD:<\/strong><\/p>\n
service sshd restart\r\nservice status restart<\/pre>\n
For OpenBSD:<\/strong><\/p>\n
rcctl restart sshd\r\nrcctl check sshd<\/pre>\n
\nFILE SYSTEM<\/strong><\/p>\n
Originally, UFS<\/strong> (Unix File System) was the default file system but now ZFS<\/strong> (Zettabyte File System) is the default one because it supports advanced features like snapshots, compression, RAID…<\/p>\n
Besides UFS and ZFS, there is also another native file systems called HUMMER<\/strong> (Highly Available, Multi-Master, Elastic Replicated Object Store). It was developed by DragonFly BSD that can provide high availability and fault tolerance. It is worthy taking a look into it if these features are desirable for your use case.<\/p>\n
It also supports FAT<\/strong>, NTFS<\/strong>, EXT2 <\/strong>to EXT4<\/strong>, APFS<\/strong>, and ISP 9660<\/strong> plus the network NFS<\/strong> (Linux) and CIFS<\/strong> (Windows). Note that it does NOT<\/span> officially suport XFS.<\/p>\n
Linux users feel familiar with most of the Directory Structure and how to navigate and manager files, directories, permissions and so on.<\/p>\n
\nFIREWALL ON FREEBSD<\/strong><\/p>\n
Enable the firewall.<\/p>\n
nano \/etc\/rc.conf<\/pre>\n
...\r\nfirewall_enable=\"YES\"\r\n...<\/pre>\n
Create the set of rules.<\/p>\n
nano \/etc\/ipfw.rules<\/pre>\n
ipfw add allow tcp from any to any 80 in\r\nipfw add allow ip from any to any 21 out\r\nipfw add allow tcp from 10.20.30.0\/24 to 10.1.1.1 22 in\r\nipfw add deny udp from any to any 53\r\nipfw add deny all from 192.168.0.10 to any in\r\nipfw add deny tcp from any to any 22 in via em0\r\nipfw add deny tcp from any to any 10000-2000 fwd em0<\/pre>\n
- \n
- in <\/strong>\/ out<\/strong>\n
- \n
- only applied to and from the local system.<\/li>\n<\/ul>\n<\/li>\n
- in<\/strong> via<\/strong> \/ out via<\/strong>\n
- \n
- applied the rule to the traffic on the interface, which also applied to the forwarded packets.<\/li>\n<\/ul>\n<\/li>\n
- fwd<\/strong>\n
- \n
- only applied the filter to the packets being forwarded to the specified interface.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
Load the rules to the kernel.<\/p>\n
\/sbin\/ipfw \/etc\/ipfw.rules<\/pre>\n
Make firewall rules persist to reboots, add the same line to the following file.<\/p>\n
nano \/etc\/rc.local<\/pre>\n
...\r\n\/sbin\/ipfw \/etc\/ipfw.rules\r\n...<\/pre>\n
\nFIREWALL ON OPENBSD<\/strong><\/p>\n
nano \/etc\/pf.conf<\/pre>\n
wan=\"em0\"\r\nlan=\"em1\"\r\n\r\nset skip on lo0\r\nset block-policy drop\r\n\r\nblock drop all\r\n\r\nblock in all\r\nblock out all\r\n\r\npass quick in all keep state\r\npass in on $wan proto tcp from any to any port 80\r\npass in on $lan proto { tcp udp } from $lan:network to port { 139 445 }\r\npass out inet proto icpm icmp-type { echoreq }\r\npass in on $lan proto icmp all icmp-type { echoreq, echorep }<\/pre>\nOptionally, replace
keep state<\/code> withmodulate state<\/code> for additional security because it randomises the initial sequence number pf TCP packet to prevent prevention and TCP session hijacking attack.<\/p>\nApply<\/p>\n
pfctl -f \/etc\/pf.conf<\/pre>\n
Enable the firewall on boot.<\/p>\n
nano \/etc\/rc.conf.local<\/pre>\n
...\r\npf=YES\r\n...<\/pre>\n
Check the status of the firewall.<\/p>\n
pfctl -si<\/pre>\n
Check the applied roles.<\/p>\n
pfctl -sr<\/pre>\n
\nTROUBLESHOOTING<\/strong><\/p>\n
- \n
- System Logs<\/strong><\/li>\n<\/ul>\n
Watch the logs\u00a0as they happens.<\/p>\n
tail -f \/var\/log\/messages<\/pre>\n
Search for a specific entry type.<\/p>\n
tail -f \/var\/log\/messages | grep error<\/pre>\n
grep ssh \/var\/log\/messages<\/pre>\n
- \n
- Diagnostic Tools<\/span><\/strong><\/li>\n<\/ul>\n
ping 8.8.8.8<\/pre>\n
traceroute 1.1.1.1<\/pre>\n
top<\/pre>\n
tcpdump -i em0<\/pre>\n
dmesg | less<\/pre>\n","protected":false},"excerpt":{"rendered":"While Linux is not a direct descendant of any particular version of Unix, it was […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[4],"tags":[],"class_list":["post-3395","post","type-post","status-publish","format-standard","hentry","category-linux"],"_links":{"self":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3395","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3395"}],"version-history":[{"count":14,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3395\/revisions"}],"predecessor-version":[{"id":3503,"href":"https:\/\/dft.wiki\/index.php?rest_route=\/wp\/v2\/posts\/3395\/revisions\/3503"}],"wp:attachment":[{"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3395"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3395"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dft.wiki\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3395"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
- Diagnostic Tools<\/span><\/strong><\/li>\n<\/ul>\n
- System Logs<\/strong><\/li>\n<\/ul>\n
- only applied the filter to the packets being forwarded to the specified interface.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
- in <\/strong>\/ out<\/strong>\n
- OpenBSD<\/strong><\/li>\n<\/ul>\n
- FreeBSD<\/strong><\/li>\n<\/ul>\n