FreeBSD

Upgrade FreeBSD 13.1 to 13.2

reading some NewFeeds, FreeBSD 13.2 got released … Let’s do an upgrade and see if it’s working fine.

Patch it first

freebsd-update fetch
freebsd-update install

reboot

may not needed, but you have to boot anyway a few times …

Fetch and Upgrade to 13.2

this needs some time ! depending on your internet speed, and specially to power and filesystem performance of your machine. 5-10min for a common VM is not unreal :(

Fireup FreeBSD 14 Instance on AWS ?!?

Install Packages

pkg install gmake go git vim

Install Lima

git clone https://github.com/lima-vm/lima /opt/lima

Patch File

cat << EOF > /opt/lima/pkg/sshutil/sshutil_others.go
//go:build !darwin && !linux
// +build !darwin,!linux

package sshutil

import (
        "runtime"

        "github.com/sirupsen/logrus"
)

func detectAESAcceleration() bool {
        var err error
        const fallback = runtime.GOARCH == "amd64"
        logrus.WithError(err).Warnf("cannot detect whether AES accelerator is available, assuming %v", fallback)
        return fallback
}
EOF

Build

gmake

Copy Binaries

cp /opt/lima/_output/bin/* /usr/local/bin/

mkdir -p /usr/local/share/doc/lima && cp -r /opt/lima/_output/share/doc/lima/* /usr/local/share/doc/lima/
cp -r /opt/lima/_output/share/lima /usr/local/share/lima

Install QEMU

pkg install qemu-nox11

Get CPU

root@freebsd:/opt/lima # qemu-system-x86_64 -cpu help | grep -i cascadelake

x86 Cascadelake-Server    (alias configured by machine type)
x86 Cascadelake-Server-noTSX  (alias of Cascadelake-Server-v3)
x86 Cascadelake-Server-v1  Intel Xeon Processor (Cascadelake)
x86 Cascadelake-Server-v2  Intel Xeon Processor (Cascadelake) [ARCH_CAPABILITIES]
x86 Cascadelake-Server-v3  Intel Xeon Processor (Cascadelake) [ARCH_CAPABILITIES, no TSX]
x86 Cascadelake-Server-v4  Intel Xeon Processor (Cascadelake) [ARCH_CAPABILITIES, no TSX]
x86 Cascadelake-Server-v5  Intel Xeon Processor (Cascadelake) [ARCH_CAPABILITIES, EPT switching, XSAVES, no TSX]

Export CPU

export QEMU_SYSTEM_X86_64="qemu-system-x86_64 -cpu Cascadelake-Server"

Start Lima

switch to user

bhyve, pronounced “beehive” is a hypervisor/virtual machine manager for FreeBSD that supports most Intel and AMD processors that report the “POPCNT” (POPulation Count) processor feature in dmesg(8).

Download ISO and boot it

… in a new Virtual Machine …

cat << 'EOF' > run_bhyve.sh
#!/usr/bin/env bash

iso=FreeBSD-13.1-RELEASE-amd64-bootonly.iso
vm=guest.img

# Load Module if needed
kldstat |grep vmm.ko || kldload vmm

ifconfig tap0 create
sysctl net.link.tap.up_on_open=1

ifconfig
ifconfig bridge0 create
ifconfig bridge0 addm vmx0 addm tap0
ifconfig bridge0 create
ifconfig bridge0 up

# Get ISO
test -f $iso || fetch https://download.freebsd.org/releases/amd64/amd64/ISO-IMAGES/13.1/$iso

# Prepare Disk File
test -f $vm || truncate -s 16G $vm

# Boot from ISO
sh /usr/share/examples/bhyve/vmrun.sh -m 1024M -t tap0 -d guest.img -i -I $iso vm001

exit 0
EOF

Set Permission and run it

chmod 700 run_bhyve.sh
./run_bhyve.sh

-> Run Live System or install a brand new System

List Packages Prime

[root@freebsd13 ~]# pkg prime-list
bash
doas
fping
git
go
gohugo
gsed
hping3
htop
jq
...

List Packages Origin

[root@freebsd13 ~]# pkg prime-origins |sort
archivers/py-borgbackup
devel/git
devel/py-pip
devel/py-poetry-core
editors/vim
emulators/open-vm-tools
ftp/wget
lang/go
lang/python310
net/fping
...

Package Cleanup

pkg autoremove

Pkg Audit

audit installed packages against known vulnerabilities

pkg audit -F

Any Comments ?

sha256: 41490d57eaf6f60005156ccf31d91c8293d7086bb6b203dc23e32d7b2c3489a6

Upgrade FreeBSD 13.0 to 13.1

should be a easy task, right ?

Patch it first

freebsd-update fetch
freebsd-update install

reboot

may not needed, but you have to boot anyway a few times …

Fetch and Upgrade to 13.1

this needs some time ! depending on your internet speed, and specially to power and filesystem performance of your machine. 20-30min for a common VM is not unreal :(

time freebsd-update upgrade -r 13.1-RELEASE
time freebsd-update install

Reboot

shutdown -r now

Finish Install

freebsd-update install

Final Reboot

shutdown -r now

Any Comments ?

sha256: f5d56eadc5e7a757d4a2af764da5a0446ebb246ce6ea630b158a53dc3a160996

While ago since i installed FreeBSD “by Hand” on a APU … let’s take some Notes (as we’re all getting older …) ;)

Links

Get Install Image

wget https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/13.0/FreeBSD-13.0-RELEASE-amd64-memstick.img.xz
xz -dv FreeBSD-13.0-RELEASE-amd64-memstick.img.xz

Write to USB Stick

time dd if=FreeBSD-13.0-RELEASE-amd64-memstick.img of=/dev/da1 bs=1M conv=sync status=progress

Mount Stick

mount /dev/da1s2a /mnt

Redirect Serial Console

and set other Stuff

cat <<EOF>/mnt/boot/loader.conf
boot_multicons="YES"
boot_serial="YES"
comconsole_speed="115200"
console="comconsole,vidconsole"
EOF

Unmount Image

umount /mnt

Write to USB Stick

time dd if=FreeBSD-13.0-RELEASE-amd64-memstick.img of=/dev/da1 bs=1M conv=sync status=progress

Boot APU with USB Stick

Insert USB Stick into APU and Press F10 -> Boot from USB Device

WG Tunnel between OpenBSD and OPNsense

How to Setup an WG Tunnel between OpenBSD and OPNSense ? That’s quite simple …

OpenBSD

Install Packages

pkg_add wireguard-tools--

Gen Key Onliner

wg genkey | tee privatekey | wg pubkey > publickey

Build Interface

r=$(openssl rand -base64 32)
remote_ip="1.2.3.4"
remote_net="192.168.0.0/24"

cat << 'EOF' > /etc/hostname.wg0
# WG Tunnel to OPNsense
wgkey   ${r}
wgport  51820
wgpeer  xxxxx - PUBLIC-KEY-OF-REMOTE-HOST - xxxxx= wgendpoint ${remote_ip} 51820 wgaip ${remote_net}
inet    10.0.0.1/24
!route add ${remote_net} 10.0.0.2
up
EOF

sh /etc/netstart wg0
ifconfig wg0

update pf.conf

# skip on wg Interface
set skip on { lo0 wg0 }

# Wireguard
pass in log quick inet proto udp from ${remote_ip}/32 to (self) port 51820

OPNsense

Install Wireguard

Menu System -> Firmware -> Plugins -> Install Wireguard

Fix Broken Package Manager

pkg add -f https://pkg.freebsd.org/FreeBSD:12:amd64/latest/All/pkg-1.14.2.txz

pkg bootstrap -f; pkg update -f

Any Comments ?

sha256: eb6263c0896e059168e9491b1f29e3bbf4e0fec278a42dd13929483ff0c8a5a3