www.nostarch.com
TH E FI N EST I N G E E K E NTE RTAI N M E NT™
SHELVE IN:OPERATING SYSTEMS/UNIX
$59.95 ($65.95 CDN)
F R E E B S D : N O T J U S T F O R A L P H A G E E K S
A N Y M O R E ! F R E E B S D : N O T J U S T F O R A L P H A G E E K S
A N Y M O R E !
“I LAY FLAT.”
This book uses RepKover —a durable binding that won’t snap shut.
Printed on recycled paper
FreeBSD—the powerful, flexible, and free Unix-like operating system—is the preferred server for many enterprises. But it can be even trickier to use than either Unix or Linux, and harder still to master.
Absolute FreeBSD, 2nd Edition is your complete guide to FreeBSD, written by FreeBSD committer Michael W. Lucas. Lucas considers this completely revised and rewritten second edition of his landmark work to be his best work ever; a true product of his love for FreeBSD and the support of the FreeBSD community. Absolute FreeBSD, 2nd Edition covers installation, networking, security, network services, system performance, kernel tweaking, filesystems, SMP, upgrading, crash debugging, and much more, including coverage of how to:
• Use advanced security features like packet filtering, virtual machines, and host-based intrusion detection
• Build custom live FreeBSD CDs and bootable flash
• Manage network services and filesystems
• Use DNS and set up email, IMAP, web, and FTP services for both servers and clients
• Monitor your system with performance-testing and troubleshooting tools
• Run diskless systems
• Manage schedulers, remap shared libraries, and optimize your system for your hardware and your workload
• Build custom network appliances with embedded FreeBSD
• Implement redundant disks, without special hardware
• Integrate FreeBSD-specific SNMP into your network management system
Whether you’re just getting started with FreeBSD or you’ve been using it for years, you’ll find this book to be the definitive guide to FreeBSD that you’ve been waiting for.
A B O U T T H E A U T H O R
Michael W. Lucas is a network engineer and system administrator responsible for a network that stretches across the Western Hemisphere. He is the author of the critically acclaimed Absolute OpenBSD, Cisco Routers for the Desperate, and PGP & GPG, all from No Starch Press. Despite being from Detroit, Michigan, he knows almost nothing about automobiles. He has been using Unix systems for over 20 years and FreeBSD since 1995.
Fortunately for the rest of us, his writing keeps him too busy to implement his plans for world domination.
With a foreword by
R O B E R T W A T S O N
, President ofthe FreeBSD Foundation
A B S O L U T E
F R E E B S D
2 N D E D I T I O N
A B S O L U T E
F R E E B S D
®2 N D E D I T I O N
T H E
C O M P L E T E
G U I D E T OF R E E B S D
M I C H A E L W . L U C A S
LUCAS
A B S O L U T E F R E E B S D 2 N D E D IT IO N A B S O L U T E F R E E B S D 2 N D E D IT IO N
PRAISE FOR THE FIRST EDITION, ABSOLUTE BSD
“Even longtime users of FreeBSD may be surprised at the power and features it can bring to bear as a server platform, and Absolute BSD is an excellent guide to harnessing that power.”
—UNIXREVIEW.COM
“ . . . provides beautifully written tutorials and reference material to help you make the most of the strengths of this OS.”
—LINUXUSER & DEVELOPER MAGAZINE
“ . . . a great resource for people new to BSD and those who have been using it for years. Michael Lucas has a writing style which is very easy to read and absorb.”
—FRESHMEAT
“A very fine piece of work, it isn’t about how to implement BSD solutions, but it is about managing systems in situ.”
–;LOGIN:
“ . . . packed with a lot of information.”
—DAEMON NEWS
PRAISE FOR ABSOLUTE OPENBSD BY MICHAEL LUCAS
“Absolute OpenBSD by Michael Lucas is a broad and mostly gentle introduction into the world of the OpenBSD operating system. It is sufficiently complete and deep to give someone new to OpenBSD a solid footing for doing real work and the mental tools for further exploration. . . . The potentially boring topic of systems administration is made very readable and even fun by the light tone that Lucas uses.”
—CHRIS PALMER, PRESIDENT, SAN FRANCISCO OPENBSD USERS GROUP
“ . . . a well-written book that hits its market squarely on target. Those new to OpenBSD will appreciate the comprehensive approach that takes them from concept to functional execution. Existing and advanced users will benefit from the discussion of OpenBSD-specific topics such as the security features and pf administration.”
—SLASHDOT
“I recommend Absolute OpenBSD to all programmers and administrators working with the OpenBSD operating system (OS), or considering it.”
—UNIXREVIEW.COM
PRAISE FOR PGP & GPG BY MICHAEL LUCAS
“PGP & GPG is another excellent book by Michael Lucas. I thoroughly enjoyed his other books due to their content and style. PGP & GPG continues in this fine tradition. If you are trying to learn how to use PGP or GPG, or at least want to ensure you are using them properly, read PGP & GPG.”
—TAOSECURITY
“The world’s first user-friendly book on email privacy. Unless you’re a cryptographer, or never use email, you should read this book.”
—LEN SASSAMAN, CODECON FOUNDER
“ Excellent tutorial, quick read, and enough humor to make it enjoyable.”
—INFOWORLD
“An excellent book that shows the end-user in an easy to read and often entertaining style just about everything they need to know to effectively and properly use PGP and OpenPGP.”
—SLASHDOT
PRAISE FOR CISCO ROUTERS FOR THE DESPERATE BY MICHAEL LUCAS
“ . . . this book isn’t a reference—it’s a survival guide, a ‘break glass in case of emergency’ safety harness. . . . What I found remarkable was how it was obviously written for people like me—those of us who have little interest in router management but whose jobs depend on the consistent, trusted func- tioning of such infrastructure.
—ASP.NETPRO
“If only Cisco Routers for the Desperate had been on my bookshelf a few years ago! It would have definitely saved me many hours of searching for config- uration help on my Cisco routers. . . . I would strongly recommend this book for both IT Professionals looking to get started with Cisco routers, as well as anyone who has to deal with a Cisco router from time to time but doesn’t have the time or technological know-how to tackle a more in-depth book on the subject.”
—BLOGCRITICS MAGAZINE
A B S O L U T E
F R E E B S D
2 N D E D I T I O N
T H E C O M P L E T E G U I D E T O F R E E B S D
by Michael W. Lucas
San Francisco
®
ABSOLUTE FREEBSD, 2ND EDITION. Copyright © 2008 by Michael W. Lucas.
All rights reserved. No part of this work may be reproduced or transmitted in any form or by any means, electronic or mechanical, including photocopying, recording, or by any information storage or retrieval system, without the prior written permission of the copyright owner and the publisher.
11 10 09 08 07 1 2 3 4 5 6 7 8 9 ISBN-10: 1-59327-151-4
ISBN-13: 978-1-59327-151-0 Publisher: William Pollock
Production Editors: Christina Samuell and Megan Dunchak Cover and Interior Design: Octopod Studios
Developmental Editor: William Pollock Technical Reviewer: John Baldwin Copyeditor: Dmitry Kirsanov Compositor: Riley Hoffman Proofreader: Alina Kirsanova Indexer: Nancy Guenther
For information on book distributors or translations, please contact No Starch Press, Inc. directly:
No Starch Press, Inc.
555 De Haro Street, Suite 250, San Francisco, CA 94107
phone: 415.863.9900; fax: 415.863.9950; info@nostarch.com; www.nostarch.com Librar y of Congress Cataloging-in-Publication Data
Lucas, Michael, 1967-
Absolute FreeBSD : the complete guide to FreeBSD / Michael W. Lucas. -- 2nd ed.
p. cm.
Includes index.
ISBN-13: 978-1-59327-145-9 ISBN-10: 1-59327-145-X
1. FreeBSD. 2. UNIX (Computer file) 3. Internet service providers--Computer programs. 4. Web servers--Computer programs. 5. Client/server computing. I. Title.
QA76.76.O63L83 2007 004'.36--dc22
2007036190
No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc. Other product and company names mentioned herein may be the trademarks of their respective owners. Rather than use a trademark symbol with every occurrence of a trademarked name, we are using the names only in an editorial fashion and to the benefit of the trademark owner, with no intention of infringement of the trademark.
The mark “FreeBSD” is a registered trademark of The FreeBSD Foundation and is used by Michael W. Lucas with the permission of The FreeBSD Foundation.
The FreeBSD Logo is a trademark of The FreeBSD Foundation and is used by Michael W. Lucas with the permission of The FreeBSD Foundation.
The BSD Daemon is copyright Marshall Kirk McKusick and is used with permission.
The information in this book is distributed on an “As Is” basis, without warranty. While every precaution has been taken in the preparation of this work, neither the author nor No Starch Press, Inc. shall have any liability to any person or entity with respect to any loss or damage caused or alleged to be caused directly or indirectly by the information contained in it.
Printed on recycled paper in the United States of America
For Liz. With luck, this one is the right size to plug that dang gopher hole.
B R I E F C O N T E N T S
Foreword by Robert N.M. Watson ... xxvii
Acknowledgments ... xxix
Introduction ...1
Chapter 1: Getting More Help ...19
Chapter 2: Installing FreeBSD ...33
Chapter 3: Start Me Up! The Boot Process...61
Chapter 4: Read This Before You Break Something Else! (Backup and Recovery)...89
Chapter 5: Kernel Games ...117
Chapter 6: The Network ...145
Chapter 7: Securing Your System ...177
Chapter 8: Disks and Filesystems ...209
Chapter 9: Advanced Security Features ...261
Chapter 10: Exploring /etc ...301
Chapter 11: Making Your System Useful ...315
Chapter 12: Advanced Software Management ...343
Chapter 13: Upgrading FreeBSD ...371
viii B ri ef Con ten t s
Chapter 14: The Internet Road Map: DNS ...411
Chapter 15: Small System Services ...439
Chapter 16: Spam, Worms, and Viruses (Plus Email, If You Insist) ...467
Chapter 17: Web and FTP Services...499
Chapter 18: Disk Tricks with GEOM...529
Chapter 19: System Performance and Monitoring ...569
Chapter 20: The Fringe of FreeBSD ...603
Chapter 21: System (and Sysadmin) Panics and Crashes ...637
Afterword...655
Appendix: Some Interesting sysctl MIBs...661
Index ...675
C O N T E N T S I N D E T A I L
F O REW O R D B Y R O BER T N. M . W AT SO N xxvii
A CK N O W LED G M EN T S xxix
I NT RO D UC TI O N 1
What Is FreeBSD? ... 2
BSD: FreeBSD’s Granddaddy ... 2
The BSD License ... 3
The AT&T/CSRG/BSDi Iron Cage Match ... 4
The Birth of FreeBSD ... 4
FreeBSD Development ... 5
Committers ... 5
Contributors ... 6
Users ... 7
Other BSDs ... 7
NetBSD ... 7
OpenBSD ... 7
Mac OS X ... 8
FreeBSD’s Children ... 8
Other Unixes ... 8
Solaris/OpenSolaris ... 8
AIX ... 9
Linux ... 9
IRIX, HP/UX, and So On ... 9
FreeBSD’s Strengths ... 10
Portability ... 10
Power ... 10
Simplified Software Management ... 10
Optimized Upgrade Process ... 11
Advanced Filesystem ... 11
Who Should Use FreeBSD? ... 11
Who Should Run Another BSD? ... 11
Who Should Run a Proprietary Operating System? ... 12
How to Read This Book ... 12
What Must You Know? ... 12
For the New System Administrator ... 13
Desktop FreeBSD ... 13
How to Think About Unix ... 14
Notes on the Second Edition ... 16
Contents of This Book ... 16
1 G E T TI NG M O R E H EL P 19 Why Not Just Email for Help? ... 20
The FreeBSD Attitude ... 20
Support Options ... 20
x Con t en ts in Det ai l
Man Pages ... 21
Manual Sections ... 22
Navigating Man Pages ... 23
Finding Man Pages ... 23
Section Numbers and Man ... 24
Man Page Contents ... 24
FreeBSD.org ... 25
Web Documents ... 25
The Mailing List Archives ... 26
Other Websites ... 26
Using FreeBSD Problem-Solving Resources ... 26
Checking the Handbook/FAQ ... 27
Checking the Man Pages ... 27
Checking the Mailing List Archives ... 28
Using Your Answer ... 28
Emailing for Help ... 29
Writing Your Email ... 29
Sending Your Email ... 30
Responding to Email ... 31
Email Is Forever ... 31
2 I NS T AL L IN G F REEB S D 33 FreeBSD Hardware ... 34
Sample Hardware ... 35
Proprietary Hardware ... 35
What We Won’t Cover ... 36
Hardware Requirements ... 36
Preinstall Decisions ... 37
Partitioning ... 37
Multiple Hard Drives ... 40
Partition Block Size ... 41
Choosing Your Distribution(s) ... 42
The FreeBSD FTP Site ... 43
FTP Server Content ... 43
The Install Process ... 45
Choosing Boot Media ... 45
Choosing Installation Media ... 46
Preparing Boot Floppies ... 47
Preparing Boot CDs ... 47
FTP Media Setup ... 48
Actually Installing FreeBSD ... 49
Configuring the Network ... 54
Miscellaneous Network Services ... 56
Time Zone ... 56
Linux Mode ... 56
PS/2 Mouse ... 56
Adding Packages ... 56
Adding Users ... 57
Root Password ... 58
Post-Installation Setup ... 58
Restart! ... 59
Con t en ts in Det ail xi 3
S TA RT M E UP ! TH E BOO T P R OCES S 61
Power-On and the Loader ... 62
Single-User Mode ... 63
Disks in Single-User Mode ... 64
Programs Available in Single-User Mode ... 64
The Network in Single-User Mode ... 65
Uses for Single-User Mode ... 65
The Loader Prompt ... 66
Default Files ... 68
Loader Configuration ... 69
Serial Consoles ... 70
Hardware Serial Consoles ... 71
Software Serial Consoles ... 71
Serial Console Physical Setup ... 73
Serial Console Use ... 73
Serial Console Disconnection ... 75
Startup Messages ... 76
Multi-User Startup ... 79
/etc/rc.conf and /etc/defaults/rc.conf ... 79
The rc.d Startup System ... 87
Shutdown ... 88
4 REA D TH I S BEF O R E Y O U B REA K S O M ET HI N G EL S E! ( BA CK U P A ND R EC O VE RY ) 89 System Backups ... 90
Backup Tapes ... 90
Tape Drive Device Nodes, Rewinding, and Ejecting ... 91
The $TAPE Variable ... 91
Tape Status with mt(1) ... 92
Other Tape Drive Commands ... 93
To Rewind or Not? ... 93
Backup Programs ... 94
tar ... 94
tar Modes ... 94
Other tar Features ... 96
gzip ... 97
dump ... 98
User Control ... 98
dump Levels ... 98
dump, Tape Drives, and Files ... 99
dump and Live Filesystems ... 99
Timestamps and dump ... 100
Running dump ... 100
Throwing Data Overboard with nodump ... 101
Restoring from a dump ... 101
Checking the Contents of an Archive ... 101
Restoring dump Data ... 102
Multiple Backups on One Tape ... 105
xii Con te nt s i n De ta il
Revision Control ... 106
Initializing Revision Control ... 107
Editing Files in RCS ... 108
Checking Back In ... 108
Viewing RCS Logs ... 109
Reviewing a File’s Revision History ... 110
Getting Older Versions ... 111
Breaking Locks ... 112
Recording What Happened ... 114
The Fixit Disk ... 114
5 K ERN EL G AM ES 117 What Is the Kernel? ... 118
sysctl ... 119
sysctl MIBs ... 120
sysctl Values ... 121
Viewing sysctls ... 121
Changing sysctls ... 122
Kernel Modules ... 124
Viewing Loaded Modules ... 124
Loading and Unloading Modules ... 125
Loading Modules at Boot ... 125
Build Your Own Kernel ... 126
Preparations ... 126
Buses and Attachments ... 127
Back Up Your Working Kernel ... 128
Configuration File Format ... 128
Configuration Files ... 129
Trimming a Kernel ... 131
CPU Types ... 131
Basic Options ... 131
Multiple Processors ... 134
Device Drivers ... 134
Pseudodevices ... 135
Removable Hardware ... 136
Building a Kernel ... 136
Troubleshooting Kernel Builds ... 137
Booting an Alternate Kernel ... 137
Inclusions, Exclusions, and Expanding the Kernel ... 138
NOTES ... 138
Inclusions and Exclusions ... 139
How Kernel Options Fix Problems ... 139
Sharing Kernels ... 140
Testing Kernels Remotely ... 141
Kernel Stuff You Should Know ... 142
ACPI ... 142
PAE ... 142
Symmetric Multiprocessing ... 143
Lock Order Reversals ... 143
Co nt en t s in Det ai l xiii 6
TH E N ET WO R K 145
Network Layers ... 146
The Physical Layer ... 146
Datalink: The Physical Protocol ... 146
The Network Layer ... 147
Heavy Lifting: The Transport Layer ... 147
Applications ... 148
The Network in Practice ... 148
Getting Bits and Hexes ... 150
Remedial TCP/IP ... 152
IP Addresses and Netmasks ... 152
ICMP ... 155
UDP ... 155
TCP ... 156
How Protocols Fit Together ... 157
Transport Protocol Ports ... 157
Understanding Ethernet ... 158
Protocol and Hardware ... 159
Ethernet Speed and Duplex ... 160
MAC Addresses ... 160
Configuring Your Ethernet Connection ... 161
ifconfig(8) ... 161
Adding an IP to an Interface ... 162
Testing Your Interface ... 163
Set Default Route ... 163
Multiple IP Addresses on One Interface ... 163
Renaming Interfaces ... 164
DHCP ... 165
Reboot! ... 166
Network Activity ... 166
Current Network Activity ... 166
What’s Listening on What Port? ... 167
Port Listeners in Detail ... 168
Network Capacity in the Kernel ... 169
Optimizing Network Performance ... 170
Optimizing Network Hardware ... 170
Memory Usage ... 171
Maximum Incoming Connections ... 173
Polling ... 174
Changing Window Size ... 174
Other Optimizations ... 175
Network Adapter Teaming ... 175
Aggregation Protocols ... 175
Configuring lagg(4) ... 176
7 S ECU RI N G Y O UR S Y S TEM 177 Who Is the Enemy? ... 178
Script Kiddies ... 178
Botnets ... 179
xiv Con te nt s i n De ta il
Disaffected Users ... 179
Motivated Skilled Attackers ... 179
FreeBSD Security Announcements ... 180
User Security ... 181
Creating User Accounts ... 181
Editing Users: passwd(1), chpass(1), and Friends ... 183
Shells and /etc/shells ... 188
root, Groups, and Management ... 189
The root Password ... 189
Groups of Users ... 190
Using Groups to Avoid Root ... 191
Tweaking User Security ... 195
Restricting Login Ability ... 195
Restricting System Usage ... 197
File Flags ... 201
Setting and Viewing File Flags ... 203
Securelevels ... 204
Securelevel Definitions ... 204
Which Securelevel Do You Need? ... 205
What Won’t Securelevels and File Flags Accomplish? ... 206
Living with Securelevels ... 206
Network Targets ... 207
Putting It All Together ... 208
8 DI S K S A ND F I LE SY S TE M S 209 Disk Drives 101 ... 209
Device Nodes ... 210
Hard Disks and Partitions ... 211
The Filesystem Table: /etc/fstab ... 212
What’s Mounted Now? ... 214
Mounting and Unmounting Disks ... 214
Mounting Standard Filesystems ... 214
Mounting at Nonstandard Locations ... 215
Unmounting a Partition ... 215
How Full Is a Partition? ... 215
The Fast File System ... 217
Vnodes ... 218
FFS Mount Types ... 218
FFS Mount Options ... 220
Soft Updates and Journaling with FFS ... 220
Write Caching ... 221
Snapshots ... 222
Dirty Disks ... 222
Forcing Read-Write Mounts on Dirty Disks ... 224
FFS Syncer at Shutdown ... 224
Background fsck, fsck -y, Foreground fsck, Oy Vey! ... 225
Using Foreign Filesystems ... 225
Supported Foreign Filesystems ... 226
Permissions and Foreign Filesystems ... 228
Con t en ts i n Det ail xv
Removable-Media Filesystems ... 228
Formatting FAT32 Media ... 228
Using Removable Media ... 230
Ejecting Removable Media ... 231
Removable Media and /etc/fstab ... 231
Other FreeBSD Filesystems ... 231
Memory Filesystems ... 232
Mounting Disk Images ... 235
Filesystems in Files ... 235
Miscellaneous Filesystems ... 238
Wiring Down Devices ... 238
Adding New Hard Disks ... 240
Creating Slices ... 240
Creating Partitions ... 241
Configuring /etc/fstab ... 241
Installing Existing Files onto New Disks ... 241
Stackable Mounts ... 242
Network Filesystems ... 243
FreeBSD and CIFS ... 248
Prerequisites ... 248
Kernel Support ... 249
Configuring CIFS ... 249
nsmb.conf Keywords ... 249
CIFS Name Resolution ... 250
Other smbutil(1) Functions ... 250
Mounting a Share ... 251
Other mount_smbfs Options ... 251
Sample nsmb.conf Entries ... 252
CIFS File Ownership ... 252
Serving CIFS Shares ... 252
devfs ... 253
devfs at Boot: devfs.conf ... 253
Global devfs Rules ... 255
Dynamic Device Management with devd(8) ... 256
9 A DV A NC ED S EC UR IT Y F EA TU RES 261 Unprivileged Users ... 261
The nobody Account ... 263
A Sample Unprivileged User ... 263
Network Traffic Control ... 263
Default Accept vs. Default Deny ... 264
TCP Wrappers ... 265
Configuring Wrappers ... 265
Wrapping Up Wrappers ... 271
Packet Filtering ... 272
Enabling PF ... 273
Default Accept and Default Deny in Packet Filtering ... 273
Basic Packet Filtering and Stateful Inspection ... 274
Configuring PF ... 275
Complete PF Rule Sample ... 278
Activating PF Rules ... 279
xvi Con te nt s i n De ta il
Public Key Encryption ... 280
Configuring OpenSSL ... 281
Certificates ... 282
SSL Trick: Connecting to SSL-Protected Ports ... 285
Jails ... 286
Jail Host Server Setup ... 287
Jail and the Kernel ... 289
Client Setup ... 290
Decorating Your Cell: In-Jail Setup ... 291
Jail and /etc/rc.conf ... 293
Jail Startup and Shutdown ... 293
Managing Jails ... 294
Jail Shutdown ... 295
What’s Wrong with Jails ... 295
Preparing for Intrusions with mtree(1) ... 296
Running mtree(1) ... 297
Saving the Spec File ... 298
Reacting to an Intrusion ... 299
Monitoring System Security ... 299
If You’re Hacked ... 300
1 0 EXP LO RI N G /E TC 301 /etc Across Unix Species ... 302
/etc/adduser.conf ... 302
/etc/amd.map ... 302
/etc/bluetooth, /etc/bluetooth.device.conf, and /etc/defaults/bluetooth.device.conf ... 302
/etc/crontab ... 302
/etc/csh.* ... 303
/etc/devd.conf ... 303
/etc/devfs.conf, /etc/devfs.rules, and /etc/defaults/devfs.rules ... 303
/etc/dhclient.conf ... 303
/etc/disktab ... 303
/etc/freebsd-update.conf ... 304
/etc/fstab ... 304
/etc/ftp.* ... 304
/etc/group ... 304
/etc/hosts ... 304
/etc/hosts.allow ... 304
/etc/hosts.equiv ... 304
/etc/hosts.lpd ... 305
/etc/inetd.conf ... 305
/etc/localtime ... 305
/etc/locate.rc ... 305
/etc/login.* ... 306
/etc/mail/mailer.conf ... 306
Co nt en t s in Det ai l xvii
/etc/make.conf ... 306
CFLAGS ... 307
COPTFLAGS ... 307
CXXFLAGS ... 307
CPUTYPE=i686 ... 307
INSTALL=install -C ... 308
/etc/master.passwd ... 308
/etc/motd ... 308
/etc/mtree ... 308
/etc/namedb ... 309
/etc/netstart ... 309
/etc/network.subr ... 309
/etc/newsyslog.conf ... 309
/etc/nscd.conf ... 309
/etc/nsmb.conf ... 309
/etc/nsswitch.conf ... 309
/etc/opie* ... 309
/etc/pam.d/* ... 310
/etc/pccard_ether ... 310
/etc/periodic.conf and /etc/defaults/periodic.conf ... 310
daily_output=”root” ... 310
daily_show_success=”YES” ... 310
daily_show_info=”YES” ... 310
daily_show_badconfig=”NO” ... 311
daily_local=”/etc/daily.local” ... 311
/etc/pf.conf ... 311
/etc/pf.os ... 311
/etc/phones ... 311
/etc/portsnap.conf ... 311
/etc/ppp ... 311
/etc/printcap ... 312
/etc/profile ... 312
/etc/protocols ... 312
/etc/rc* ... 312
/etc/remote ... 312
/etc/rpc ... 313
/etc/security/ ... 313
/etc/services ... 313
/etc/shells ... 313
/etc/snmpd.config ... 313
/etc/src.conf ... 313
/etc/sysctl.conf ... 313
/etc/syslog.conf ... 313
/etc/termcap ... 314
/etc/ttys ... 314
1 1 M A KI N G YO UR S Y S TEM US EF UL 315 Making Software ... 316
Source Code and Software ... 316
xviii Cont en t s in Det a il
The Ports and Packages System ... 317
Ports ... 318
Finding Software ... 320
Finding by Name ... 321
Finding by Keyword ... 321
Legal Restrictions ... 322
Using Packages ... 322
CD Packages ... 323
FTP Packages ... 324
Installing Packages ... 325
pkg_add(1) Environment Settings ... 326
What Does a Package Install? ... 327
Uninstalling Packages ... 328
Package Information ... 329
Package Problems ... 330
Using Ports ... 331
Installing a Port ... 332
Integrated Port Customizations ... 334
Port Makefiles ... 336
Uninstalling and Reinstalling ... 337
Tracking Port Build Status ... 338
Cleaning Up Ports ... 338
Building Packages ... 339
Changing the Install Path ... 339
Setting make Options Permanently ... 340
Ports and Package Security ... 340
1 2 A DV A NC ED S O F TW A RE M AN A G EM EN T 343 Using Multiple Processors: SMP ... 344
Kernel Assumptions ... 344
SMP: The First Try ... 345
Today’s SMP ... 346
Processors and SMP ... 347
Using SMP ... 348
Schedulers ... 349
Startup and Shutdown Scripts ... 350
rc Script Ordering ... 350
A Typical rc Script ... 351
Special rc Script Providers ... 352
Using Scripts to Manage Running Programs ... 353
Vendor Startup/Shutdown Scripts ... 353
Debugging Custom rc Scripts ... 353
Managing Shared Libraries ... 354
Shared Library Versions and Files ... 354
Attaching Shared Libraries to Programs ... 355
LD_LIBRARY_PATH ... 357
What a Program Wants ... 358
Threads, Threads, and More Threads ... 358
Userland Threading Libraries ... 359
Remapping Shared Libraries ... 360
Con te nt s i n De ta il xix
Running Software from the Wrong OS ... 361
Recompilation ... 362
Emulation ... 363
ABI Reimplementation ... 363
Binary Branding ... 364
Supported ABIs ... 364
Foreign Software Libraries ... 365
Using Linux Mode ... 365
The Linuxulator Userland ... 366
Testing Linux Mode ... 366
Identifying and Setting Brands ... 367
linprocfs ... 367
Debugging Linux Mode with truss(1) ... 368
Running Software from the Wrong Architecture ... 369
1 3 UP G R A DI N G F RE EBS D 371 FreeBSD Versions ... 372
Releases ... 372
FreeBSD-current ... 373
FreeBSD-stable ... 374
Snapshots ... 375
FreeBSD and Testing ... 376
Which Version Should You Use? ... 376
Upgrade Methods ... 377
Binary Updates ... 378
/etc/freebsd-update.conf ... 378
Running freebsd-update(8) ... 379
Scheduling Binary Updates ... 380
Upgrading via sysinstall ... 380
Upgrading via Source ... 382
Selecting Your Supfile ... 383
Modifying Your Supfile ... 384
A Complete Supfile ... 386
Blocking Updates: The Refuse File ... 386
Updating System Source Code ... 387
Using csup to Get the Whole Source Tree ... 387
Building FreeBSD from Source ... 388
Build the World ... 388
Build, Install, and Test a Kernel ... 389
Optimization with Parallel Builds ... 390
Prepare to Install the New World ... 390
Installing the World ... 393
mergemaster Revisited ... 395
Upgrades and Single-User Mode ... 395
Shrinking FreeBSD ... 396
Updating with csup and make ... 398
Cross-Building FreeBSD ... 399
Building a Local CVSup Server ... 399
Controlling Access ... 402
xx Co nt en t s in Det ai l
Upgrading the Ports Collection ... 403 Configuring portsnap ... 403 Using portsnap(8) ... 404 Updating Installed Ports ... 404 Initial portmaster Setup ... 405 Identifying Unneeded Software ... 406 Identifying and Upgrading Software ... 406 Forcing a Rebuild ... 407 Rebuilding Upward Dependencies ... 408 Changing Dependencies ... 408 Ignoring Ports ... 408 Other portmaster Features ... 409 Reducing the Size of the Ports Tree ... 409 1 4
TH E I N TER N ET RO A D M A P: D NS 411
How DNS Works ... 412 Basic DNS Tools ... 413 The host(1) Command ... 413 Digging for Detail ... 414 Finding Hostnames with dig ... 416 More dig Options ... 417 in-addr.arpa ... 418 Configuring the Resolver ... 419 Host/IP Information Sources ... 419 Setting Local Domain Names ... 420 The Nameserver List ... 421 Local DNS Overrides with /etc/hosts ... 422 Building a Nameserver ... 422 Masters and Slaves ... 423 BIND Configuration Files ... 423 Configuring BIND with named.conf ... 424 Options ... 424 Zones in named.conf ... 425 Configuring a Slave Domain ... 426 Configuring a Master Domain ... 427 Master and Slave File Storage ... 427 Zone Files ... 428 A Real Sample Zone ... 432 Dots and Termination in Zone Files ... 433 Reverse DNS Zones ... 433 Managing named ... 434 Configuring rndc ... 434 Using rndc ... 435 Checking DNS ... 436 Nameserver Security ... 436 Controlling Zone Transfers ... 436 Securing named(8) ... 437 More on BIND ... 437
Con te nt s i n De ta il xxi 1 5
S M AL L S Y S TEM S ERV I C ES 439
SSH ... 439 The SSH Server: sshd(8) ... 440 Configuring the SSH Daemon ... 442 Managing SSH User Access ... 444 SSH Clients ... 445 Network Time ... 447 Setting the Time Zone ... 447 Network Time Protocol ... 448 Name Service Switching and Caching ... 450 /etc/nsswitch.conf ... 450 Name Query Caching with nscd(8) ... 451 inetd ... 453 /etc/inetd.conf ... 453 Configuring inetd Servers ... 454 Starting inetd(8) ... 455 Changing inetd’s Behavior ... 456 DHCP ... 456 How DHCP Works ... 457 Managing dhcpd(8) ... 457 Configuring dhcpd(8) ... 457 Printing and Print Servers ... 459 /etc/printcap ... 460 TFTP ... 461 Root Directory ... 461 tftpd and Files ... 462 File Ownership ... 462 tftpd(8) Configuration ... 462 Scheduling Tasks ... 463 User Crontabs vs. /etc/crontab ... 463 cron and Environment ... 464 Crontab Format ... 464 1 6
S PA M , W O RM S , A N D V IR US ES
( PL U S EM A I L, I F Y O U I N SI S T) 467 Email Overview ... 468
Finding Mail Servers for a Domain ... 468 Undeliverable Email ... 469 The SMTP Protocol ... 470 Relay Control ... 472 Stopping Bad Email ... 472 Sendmail ... 473 mailwrapper(8) ... 474 Submission vs. Reception ... 474 Sendmail Logging ... 476 Configuring Sendmail ... 476 The access File ... 476 The aliases File ... 478
xxii Con t en ts in Det ail
The mailertable File ... 479 The relay-domains File ... 480 Making Changes Take Effect ... 480 Virtual Domains ... 481 The /etc/mail/local-host-names File ... 481 User Mapping ... 481 Changing sendmail.cf ... 483 Custom .mc Files ... 484 Rejecting Spam Sources ... 485 Greylisting ... 487 Configuring milter-greylist ... 488 Attaching milter-sendmail to Sendmail ... 490 Sendmail Authentication with SASL ... 491 saslauthd(8) ... 492 mailer.conf and Your New Sendmail ... 492 Building sendmail.cf ... 492 Testing SASL ... 493 IMAP and POP3 ... 493 Installing Dovecot ... 494 Configuring Dovecot ... 494 Creating a Dovecot SSL Certificate ... 495 Running Dovecot ... 496 Testing POP3S ... 496 Testing IMAPS ... 497 1 7
W EB A N D F TP S ER VI C ES 499
How a Web Server Works ... 500 The Apache Web Server ... 500 Apache Configuration Files ... 501 Core Apache Configuration ... 501 Apache Logs ... 503 Apache Modules ... 505 Directories and Permissions ... 507 Controlling Access by IP Address ... 507 Directory Options ... 508 Configuration by Users ... 510 Other Directory Settings ... 511 Password Protection and Apache ... 512 Including Other Configuration Files ... 515 Virtual Hosting ... 517 Configuring Virtual Hosts ... 517 Tuning Virtual Hosts ... 518 HTTPS Websites ... 520 Controlling Apache ... 521 File Transfer ... 522 FTP Security ... 522 The FTP Client ... 522 Binary and ASCII Transfers ... 523 The FTP Server ... 524 FTP User Control ... 524
Con t en ts in Det ai l xxiii FTP Server Messages ... 525
Setting Up Anonymous FTP Servers ... 526 Chrooting sftp(1) and scp(1) ... 527 1 8
DI S K TR I CK S W I TH G EO M 529
GEOM Essentials ... 530 Disk Drives 102 ... 530 Slicing Disks ... 531 Viewing the Slice Table with fdisk(8) ... 532 Backing Up the Slice Table ... 533 Changing the Slice Table ... 533 Partitioning Slices ... 536 Reading Disklabels ... 537 Backing Up and Restoring Disklabels ... 538 Editing Disklabels ... 538 Replicating Drive Slicing and Partitioning ... 539 Missing Disklabels ... 540 Building Filesystems ... 540 RAID ... 541 Hardware vs. Software RAID ... 541 GEOM RAID and Disk Size ... 542 Parity and Stripe Size ... 542 RAID Types ... 543 Generic GEOM Commands ... 544 Striping Disks ... 545 Creating a Striped Provider ... 546 gstripe Destruction ... 546 Daily Status Check ... 547 Mirroring Disks ... 547 Creating a Mirror ... 547 Repairing Mirrors ... 548 Mirrored Boot Disks ... 549 Destroying Mirrored Disks ... 550 Daily Status Check ... 550 RAID-3 ... 550 Creating a RAID-3 ... 551 Repairing a RAID-3 ... 551 Destroying a RAID-3 ... 553 RAID-10 ... 553 RAID-10 Setup ... 553 RAID-10 Status ... 554 Destroying a RAID-10 ... 554 Journaling Filesystems with gjournal(8) ... 554 Configuring gjournal(8) ... 556 Using a Separate Journal Device ... 557 De-Journaling Partitions ... 557 Filesystem Encryption ... 558 Kernel Configuration ... 559 Generating and Using a Cryptographic Key ... 559 Filesystems on Encrypted Devices ... 560
xxiv Con t en t s in D et ai l
Deactivating Encrypted Disks ... 560 Encrypting Swap Space with geli(8) ... 561 Disk Device Network Exports ... 561 geom_gate Security ... 562 geom_gate Server Setup ... 562 geom_gate Client Setup ... 563 Identifying geom_gate Devices ... 564 Shutting Down geom_gate ... 564 Oops! Rescuing geom_gate ... 564 Mirroring Disks Across the Network ... 565 Backup Server Setup ... 565 Primary Server Setup ... 566 Mirror Failover and Recovery ... 567 1 9
S Y ST E M P ER FO R M A N CE AN D M O N I TO R I NG 569 Computer Resources ... 570 Checking the Network ... 571 General Bottleneck Analysis with vmstat(8) ... 571 Processes ... 572 Memory ... 572 Paging ... 572 Disks ... 573 Faults ... 573 CPU ... 573 Using vmstat ... 573 Continuous vmstat ... 574 Disk I/O ... 574 CPU, Memory, and I/O with top(1) ... 575 PID Values ... 576 Load Average ... 576 Uptime ... 576 Process Counts ... 576 Process Types ... 577 Memory ... 577 Swap ... 578 Process List ... 578 top(1) and I/O ... 579 Following Processes ... 580 Paging and Swapping ... 581 Paging ... 582 Swapping ... 582 Performance Tuning ... 582 Memory Usage ... 583 Swap Space Usage ... 583 CPU Usage ... 583 Rescheduling ... 584 Reprioritizing with Niceness ... 584 Investigating Software ... 586 Status Mail ... 586
Con te nt s in De ta il xxv Logging with syslogd ... 587
Facilities ... 587 Levels ... 588 Processing Messages with syslogd(8) ... 589 syslogd Customization ... 592 Log File Management ... 593 Log File Path ... 594 Owner and Group ... 594 Permissions ... 594 Count ... 594 Size ... 595 Time ... 595 Flags ... 596 Pidfile ... 597 Signal ... 597 Sample newsyslog.conf Entry ... 597 FreeBSD and SNMP ... 598 SNMP 101 ... 598 Configuring bsnmpd ... 600 2 0
TH E F R IN G E O F F REE BS D 603
/etc/ttys ... 604 /etc/ttys Format ... 604 Insecure Console ... 605 Diskless FreeBSD ... 606 Diskless Clients ... 607 DHCP Server Setup ... 607 tftpd and the Boot Loader ... 609 The NFS Server and the Diskless Client Userland ... 609 Diskless Farm Configuration ... 611 The /conf/base Directory ... 611 The /conf/default Directory ... 612 Per-Subnet and Per-Client Directories ... 612 Diskless Packages and Files ... 613 Installing Packages ... 613 Diskless Configuration Files ... 613 NanoBSD: Building Your Own Appliances ... 615 What Is NanoBSD? ... 616 Your Hardware and Your Flash Drive ... 617 The NanoBSD Toolkit ... 618 Expanding FlashDevice.sub ... 618 NanoBSD Configuration Options ... 619 A Sample NanoBSD Configuration ... 621 Building NanoBSD ... 624 Customizing NanoBSD ... 627 Using NanoBSD ... 629 Live Media with FreeSBIE ... 630 Installing the FreeSBIE Toolkit ... 631 Configuring FreeSBIE ... 631 FreeSBIE Plug-ins ... 634
xxvi Con t en t s in D et ai l
Choosing Packages ... 635 Building a FreeSBIE Image ... 636 Rebuilding FreeSBIE ... 636 2 1
S Y ST EM ( A N D S YS A DM IN ) P A N IC S A N D CR AS H ES 637 What Causes Panics? ... 637 Recognizing Panics ... 638 Responding to a Panic ... 639 Preparations ... 640 The Crash Dump in Action ... 640 Configuring Crash Dumps ... 640 Debugging Kernels ... 641 When Panic Strikes: Manual Crash Dumps ... 642 Using the Dump ... 643 Getting a Backtrace ... 643 vmcore and Security ... 645 Submitting Problem Reports ... 646 Before Filing a PR ... 647 Bad PRs ... 648 Good PRs ... 649 A Sample PR ... 652 Submitting the PR ... 653 After Submitting the PR ... 653
A FT ERW O RD 655
The Community ... 655 Why Do We Do It? ... 656 What Can You Do? ... 657 If Nothing Else . . . ... 658 Getting Things Done ... 658 A PP EN DI X
S O M E I N TER ES TI N G S Y S CT L M I BS 661
I ND EX 675
F O R E W O R D
It gives me great pleasure to write the foreword to Michael Lucas’s Absolute FreeBSD. For five years, Michael’s Absolute series has provided the definitive guide to BSD
software, not just as a reference, but also as a narrative for real human beings.
This is an important distinction, because while there is no lack of excellent reference material on FreeBSD, this book provides a nuts-and-bolts tutorial that readers will find an invaluable companion.
Michael is an active long-term contributor in the FreeBSD community.
Absolute FreeBSD draws on his experience with the many ways in which people use FreeBSD in the real world—what they want to do, what works, and what doesn’t. Apart from covering the use of FreeBSD, Michael will tell you about the thousands of software developers—from hobbyists to professional devel- opers and university professors—who write FreeBSD and about the evolution of this community and its software. What I would like to do is invite you to become a part of that community.
FreeBSD is a powerful network operating system with state-of-the-art features that make it not only one of the most widely used pieces of software in the world, but also an easy and practical tool on which to build and provision services. From the Yahoo! and Verio websites to NetApp storage
xxviii F orew ord
products, from Cisco anti-spam appliances and Juniper routers to the root nameservers—it’s hard to throw a rock on the Internet without hitting FreeBSD. However, FreeBSD is not the product of any one company, but of a large open source community: the FreeBSD Project, made up of developers, users, and countless supporters and advocates. While you can, as many people do, use FreeBSD simply as a piece of software without ever interacting with that community, you can significantly enrich your FreeBSD experience by becoming a part of that community.
Whether you are a first-time user or a kernel hacker, the resources avail- able via the http://www.freebsd.org website, countless mailing lists, regional user groups, and conferences can be invaluable. Have a question? Just email questions@FreeBSD.org, and one or more of the hundreds of volunteers will undoubtedly answer it. Want to learn more about the exciting new features coming in future FreeBSD versions? Read the Project’s quarterly status reports, development mailing lists, or attend one of the many regional BSD conferences taking place around the world; at the time of writing, the most recent addition is the first BSDConTR in Istanbul, Turkey.
These resources are a product of the FreeBSD Project and its community, a large number of collaborating individuals and companies, as well as the FreeBSD Foundation, a nonprofit organization coordinating funding, legal resources, and support for development work and community activities.
Michael’s easy-to-use book provides a gateway for newbies to benefit from this community’s expertise and to become active users of FreeBSD themselves.
FreeBSD is open source software, available for you to use and distribute at no charge. By helping to support, advocate, or even develop FreeBSD, you can give back to the FreeBSD Project and help this community grow.
Whether you are a new user of FreeBSD or an experienced one, I am confident you will find Absolute FreeBSD a book you want to keep close at hand.
Robert N.M. Watson
FreeBSD Core Team Member President, FreeBSD Foundation Cambridge, UK
September 2007
A C K N O W L E D G M E N T S
I would like to thank all the members of the FreeBSD community for their hard work, dedication, and friendship. FreeBSD has saved my hide on numerous
occasions, and I’m delighted to give something back. In that community, however, there are a few people who I want to specifically thank by name.
Doug Barton, Ceri Davies, Alex Dupre, Max Laier, Alexander Leidinger, Remko Lodder, Benno Rice, Tom Rhodes, Gleb Smirnoff, and Robert Watson all provided valuable feedback on this book. Some of them read individual chapters that they have special expertise in, while others read the whole manuscript, whether they knew about the topics or not. Wilko Bulte not only did a review of this book, he volunteered to do so after reviewing the entire first edition of this book back in 2001. He certainly deserves some sort of “iron man” award! John Baldwin did an excellent final technical review, catching an astonishing variety of errors ranging from subtle to blatant. Any errors in this book were introduced by myself despite these people’s best efforts.
I’d like to thank David Boyd, David O’Brien, and Wilko Bulte for donating a variety of hardware that made it possible for me to write this book. I’d especially like to thank Matt Olander of iXSystems, who sent me a complete
xxx Ac kn owl edg m en ts
amd64 server when I really, really needed one. Speaking of hardware, as I was finishing this book, I was wondering where I would find a good kernel panic to write about in the last chapter. FreeBSD obliged me. Thanks to Scott Long for fixing that panic, so I could actually write Chapter 18.
As always, the folks at No Starch Press have worked their butts off to bring this to you. You all deserve a long vacation after putting up with me—
tell Bill I said it’s okay. Similarly, the fine staff at the School of Chinese Martial Arts deserve a vacation from me. Sadly, now that this book is done I’ll be spending some quality time on the mats, so they don’t get any time off. Sorry, folks.
And, as always, I’m grateful that my wife did not succumb to the tempta- tion to bash me over the head with a shovel and bury me and my laptop behind the garage while I was finishing this book. She’s been more than patient waiting for me to finish up so I could take out the trash. Last March’s trash, that is . . .
Michael Lucas
St. Clair Shores, Michigan September 2007
I N T R O D U C T I O N
Welcome to Absolute FreeBSD! This book is a one-stop shop for system administrators who want to build, configure, and manage FreeBSD servers. It will also be useful for those folks who want to run FreeBSD on their desktops, servers, diskless system farms, and so on. By the time you finish
this book, you should be able to use FreeBSD to provide network services.
You should also understand how to manage, patch, and maintain your FreeBSD systems and have a basic understanding of networking, system security, and software management. We’ll discuss FreeBSD version 7, which is the version recommended for production use at the time this book is being released; however, most of this book applies to earlier and later versions as well.
2 I n t rod uct io n
What Is FreeBSD?
FreeBSD is a freely available Unix-like operating system, used widely by Internet service providers, in appliances and embedded systems, and anywhere that reliability on commodity hardware is paramount. One day last week, FreeBSD miraculously appeared on the Internet, fully formed, extruded directly from the mutant brain of its heroic creator’s lofty intellect.
Just kidding; the truth is far more impressive. FreeBSD is a result of almost three decades of continuous development, research, and refinement. The story of FreeBSD begins in 1979, with BSD.
BSD: FreeBSD’s Granddaddy
Many years ago, AT&T needed a lot of specialized, custom-written computer software to run its business. It was not allowed to compete in the computer industry, however, so it could not sell its software. Instead, AT&T licensed various pieces of software and the source code for that software to universities at low, low prices. The universities could save money by using this software instead of commercial equivalents with pricey licenses, and university students with access to this nifty technology could read the source code to see how everything worked. In return, AT&T got exposure, some pocket change, and a generation of computer scientists who had cut their teeth on AT&T tech- nology. Everyone got something out of the deal. The best-known software distributed under this licensing plan was Unix.
Compared with modern operating systems, the original Unix had a lot of problems. Thousands of students had access to its source code, however, and hundreds of teachers needed interesting projects for their students. If a pro- gram behaved oddly, or if the operating system itself had a problem, the people who lived with the system on a day-to-day basis had the tools and the motivation to fix it. Their efforts quickly improved Unix and created many features we now take for granted. Students added the ability to control running processes, also known as job control. The Unix S51K filesystem made system administrators cry like small children, so they replaced it with the Fast File System, whose features have spread into every modern filesystem. Many small, useful programs were written over the years, gradually replacing entire swaths of Unix.
The Computer Science Research Group (CSRG) at the University of California, Berkeley, participated in these improvements and also acted as a central clearinghouse for Unix code improvements. The CSRG collected changes from other universities, evaluated them, packaged them, and distributed the compilation for free to anyone with a valid AT&T UNIX license. The CSRG also contracted with the Defense Advanced Research Projects Agency (DARPA) to implement various features in Unix, such as TCP/IP. The resulting collection of software came to be known as the Berkeley Software Distribution, or BSD.
I n tr od uct io n 3 BSD users took the software and improved it further, then fed their enhancements back into BSD. Today, we consider this to be a fairly standard way for an open source project to run, but in 1979 it was revolutionary. BSD was also quite successful; if you check the copyright statement on an old BSD system, you’ll see this:
Copyright 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994 The Regents of the University of California. All rights reserved.
Yep, 15 years of work—a lifetime in software development. How many other pieces of software are not only still in use, but still in active development, 15 years after work began? In fact, so many enhancements and improvements went into BSD that the CSRG found that over the years, it had replaced almost all of the original Unix with code created by the CSRG and its contributors.
You had to look hard to find any original AT&T code.
Eventually, the CSRG’s funding ebbed, and it became clear that the BSD project would end. After some political wrangling within the University of California, in 1992 the BSD code was released to the general public under what became known as the BSD license.
The BSD License
BSD code is available for anyone to use under what is probably the most liberal license in the history of software development. The license can be summarized as follows:
Don’t claim you wrote this.
Don’t blame us if it breaks.
Don’t use our name to promote your product.
This means that you can do almost anything you want with BSD code.
(The original BSD license did require that users be notified if a software product included BSD-licensed code, but that requirement was later dropped.) There’s not even a requirement that you share your changes with the original authors! People were free to take BSD and include it in proprietary products, open source products, or free products—they could even print it out on punch cards and cover the lawn with it. You want to run off 10,000 BSD CDs and distribute them to your friends? Enjoy. Instead of copyright, the BSD license is sometimes referred to as copycenter, as in Take this down to the copy center and run off a few for yourself. Not surprisingly, companies such as Sun Microsystems jumped right on it: It was free, it worked, and plenty of new graduates had experience with the technology. One company, BSDi, was formed specifically to take advantage of BSD Unix.
4 I n t rod uct io n
The AT&T/CSRG/BSDi Iron Cage Match
At AT&T, UNIX work continued apace even as the CSRG went on its merry way. AT&T took parts of the BSD Unix distribution and integrated them with its UNIX, then relicensed the result back to the universities that provided those improvements. This worked well for AT&T until the company was broken up and the resulting companies were permitted to compete in the computer software business. AT&T had one particularly valuable property: a high-end operating system that had been extensively debugged by thousands of people. This operating system had many useful features, such as a variety of small but powerful commands, a modern filesystem, job control, and TCP/IP.
AT&T started a subsidiary, Unix Systems Laboratories (USL), which happily started selling Unix to enterprises and charging very high fees for it, all the while maintaining the university relationship that had given it such an advanced operating system in the first place.
Berkeley’s public release of the BSD code in 1992 was met with great displeasure from USL. Almost immediately, USL sued the university and the software companies that had taken advantage of the software, particularly BSDi. The University of California claimed that the CSRG had compiled BSD from thousands of third-party contributors unrelated to AT&T, and so it was the CSRG’s intellectual property to dispose of as it saw fit.
This lawsuit motivated many people to grab a copy of BSD to see what all the fuss was about, while others started building products on top of it. One of these products was 386BSD, which would eventually be used as the core of FreeBSD 1.0.
In 1994, after two years of legal wrangling, the University of California lawyers proved that the majority of AT&T UNIX was actually taken in its entirety from BSD, rather than the other way around. To add insult to injury, AT&T had actually violated the BSD license by stripping the CSRG copyright from files it had assimilated. (Only a very special company can violate the world’s most liberal software license!) A half-dozen files were the only sources of contention, and to resolve these outstanding issues, USL donated some of them to BSD while retaining some as proprietary information.
Once the dust settled, a new version of BSD Unix was released to the world as BSD 4.4-Lite. A subsequent update, BSD 4.4-Lite2, is the grandfather of the current FreeBSD, as well as ancestor to every other BSD variant in use today.
The Birth of FreeBSD
One early result of BSD was 386BSD, a version of BSD designed to run on the cheap 386 processor.1 The 386BSD project successfully ported BSD to Intel’s 386 processor, but it stalled. After a period of neglect, a group of 386BSD users decided to branch out on their own and create FreeBSD so that they
1 At the time, several thousand dollars for a computer was dirt cheap. You young punks have no idea how good you have it.
I n tr od uct io n 5 could keep the operating system up to date. (Several other groups started their own branches off of 386BSD around the same time, of which only NetBSD remains.)
386BSD and FreeBSD 1 were derived from 1992’s BSD release, the subject of AT&T’s wrath. As a result of the lawsuit, all users of the original BSD were requested to base any further work on BSD 4.4-Lite2. BSD 4.4-Lite2 was not a complete operating system—in particular, those few files AT&T had retained as proprietary were vital to the system’s function. (After all, if those files hadn’t been vital, AT&T wouldn’t have bothered!) The FreeBSD development team worked frantically to replace those missing files, and FreeBSD 2.0 was released shortly afterward. Development has continued ever since.
Today, FreeBSD is used across the Internet by some of the most vital and visible Internet-oriented companies. Yahoo! runs almost entirely on FreeBSD. IBM, Nokia, Juniper, NetApp, and many other hardware com- panies use FreeBSD in embedded systems where you’d never even know it unless someone told you. The fact is, if a company needs to pump serious Internet bandwidth, it’s probably running FreeBSD or one of its BSD relatives.
Like smog, spiders, and corn syrup, FreeBSD is all around you; you simply don’t see it because FreeBSD just works. The key to FreeBSD’s reliability is the development team and user community—which are really the same thing.
FreeBSD Development
There’s an old saying that managing programmers is like herding cats. Despite the fact that the FreeBSD development team is scattered across the world and speaks dozens of languages, for the most part, the members work well together as parts of the FreeBSD team. They’re more like a pride of lions than a collection of house cats. Unlike some other projects, all FreeBSD development happens in public. Three groups of people are responsible for FreeBSD’s progress: committers, contributors, and users.
Committers
FreeBSD has about 500 developers, or committers. Committers have read-and- write access to the FreeBSD master source code repository and can develop, debug, or enhance any piece of the system. (The term committer comes from their ability to commit changes to the source code.) Because these commits can break the operating system in both subtle and obvious ways, committers carry a heavy responsibility. Committers are responsible for keeping FreeBSD working or, at worst, not breaking it as they add new features and evaluate patches from contributors. Most of these developers are volunteers; only a handful are actually paid to do this painstaking work, and most of those people are paid only as it relates to other work. For example, Intel employs a committer to ensure that FreeBSD properly supports its network cards.
FreeBSD has a high profile in the Internet’s heavy-lifting crowd, so Intel needs its cards to work on FreeBSD.
6 I n t rod uct io n
To plug yourself into the beehive of FreeBSD development, consider subscribing to the mailing list FreeBSD-hackers@FreeBSD.org, which contains most of the technical discussion. Some of the technical talk is broken out into more specific mailing lists—for example, fine details of the networking implementation are discussed in FreeBSD-net@FreeBSD.org.
Every few years, the committer team elects a small number of its members to serve as a core team, or Core. Core’s work is simultaneously vital, underrated, and misunderstood. Core is theoretically responsible for the overall manage- ment of FreeBSD, but in practice, it manages little other than resolving personality disputes and procedural conflicts among committers. Core also approves new committers and delegates responsibility for large parts of FreeBSD to individuals or groups. For example, it delegates authority over the ports and packages system to the ports management team. Core does not set architectural direction for FreeBSD, nor does it dictate processes or procedures; that’s up to the committers, who must agree en masse. Core does suggest, cajole, mediate, and inspire, however.
Core also experiences the worst part of management. Some of the key functions of management in a company are oversight, motivation, and handling problems between people. Oversight is provided by the millions of users who will complain loudly when anything breaks or behaves unex- pectedly, and FreeBSD committers are self-motivated. The ugly part of management is settling a squabble between two people, and that’s the part that Core has its hands full of. The status one gets from saying, “I’m in Core”
is an insufficient reward for having to manage an argument between two talented developers who have gotten on each other’s nerves.
Contributors
In addition to the committer team, FreeBSD has thousands of contributors.
Contributors don’t have to worry about breaking the main operating system source code repository; they just submit patches for consideration by committers. Committers evaluate contributor submissions and decide what to accept and what to reject. A contributor who submits many high-quality patches is often asked to become a committer himself.
For example, I spent several years contributing to FreeBSD whenever the urge struck me. Any time I feel that I’ve wasted my life, I can look at the FreeBSD website and see where my work was accepted by the committers and distributed to thousands of people. After I submitted the first edition of this book to the publisher, I spent my spare time submitting patches to the FreeBSD FAQ. Eventually, some members of the FreeBSD Documentation Project approached me and asked me to become a committer. As a reward, I got an email address and the opportunity to humiliate myself before thousands of people, once again demonstrating that no good deed goes unpunished.
If I had never contributed anything, I’d remain a user. Nothing’s wrong with that, either.
I n tr od uct io n 7
Users
Users are the people who run FreeBSD systems. It’s impossible to realistically estimate the number of FreeBSD users, although organizations such as the BSDstats Project (http://www.bsdstats.org) are making an effort. After all, you can download the whole of FreeBSD for free and never register, upgrade, or email a mailing list. Companies such as Netcraft estimate that between 5 and 15 percent of all computers attached to the Internet are BSD-based. If you remove all the Windows boxes on corporate desktops, the percentage rises considerably.
Since FreeBSD is by far the most popular open source BSD, that’s not an inconsiderable number of machines. And since one FreeBSD server can handle hundreds of thousands of Internet domains, a disproportionate number of sites use FreeBSD as their supporting operating system. This means that there are hundreds of thousands, if not millions, of FreeBSD system administrators out in the world today.
Other BSDs
FreeBSD might be the most popular BSD, but it’s not the only one.
BSD 4.4-Lite2 spawned several different projects, each with its own focus and purpose. Those projects in turn had their own offspring, several of which thrive today.
NetBSD
NetBSD is similar to FreeBSD in many ways, and NetBSD and FreeBSD share developers and code. NetBSD’s main goal is to provide a secure and reliable operating system that can be ported to any hardware platform with minimal effort. As such, NetBSD runs on VAXes, PocketPC devices, and high-end SPARC and Alpha servers. I run NetBSD on my HP Jornada handheld computer.2
OpenBSD
OpenBSD branched off from NetBSD in 1996 with the goal of becoming the most secure BSD. OpenBSD was the first to support hardware-accelerated cryptography, and its developers are rightfully proud of the fact that their default installation was largely immune to remote exploits for several years.
The OpenBSD team has contributed several valuable pieces of software to the world, the most notable being the OpenSSH suite used by almost every operating system and hardware vendor today.
2 If you’re ever in a position where you need to prove that you are Alpha Geek amongst the pack, running Unix on your palmtop will almost certainly do it.
8 I n t rod uct io n
Mac OS X
Mac OS X? That’s right. Apple incorporates large chunks of FreeBSD into its Mac OS X on an ongoing basis. If you’re looking for a stable operating system with a friendly face and a powerful core, Mac OS X is unquestionably for you. While FreeBSD makes an excellent desktop for a computer pro- fessional, I wouldn’t put it in front of Grandma. I would put Mac OS X in front of Grandma without a second thought, however, and I’d even feel that I was doing the right thing. But Mac OS X includes many things that aren’t at all necessary for an Internet server, and it only runs on Apple hardware, so I don’t recommend it as an inexpensive general-purpose server.
What’s more, code goes both ways. FreeBSD has incorporated code originally developed for Mac OS X. And while you cannot view the user interface source code for Mac OS X, you can get the source code to its BSD core and Mach kernel. Apple has released both under the code name Darwin.
FreeBSD’s Children
Several projects have taken FreeBSD and built other projects or products on top of it. The award-winning FreeNAS transforms an x 86 system into a network fileserver with just a simple menu. FreeSBIE is a bootable CD that lets you run FreeBSD without installing it. The m0n0wall project is also a bootable CD, but it transforms your system into a firewall with a nice web management interface. PC-BSD puts a friendly face on FreeBSD, trying to make FreeBSD usable by Grandma. Other projects like this appear from time to time; while not all are successful, I’m sure by the time this book comes out, we’ll have one or two more solid members of this group.
Other Unixes
Several other operating systems derive from or emulate primordial Unix in one way or another. This list is by no means exhaustive, but I’ll touch on the high points.
Solaris/OpenSolaris
The best-known Unix is Sun Microsystems’ Solaris and its new offspring, OpenSolaris. Solaris runs on high-end hardware that supports dozens of processors and gobs of disk. (Yes, gobs is a technical term, meaning more than you could possibly ever need, and I know very well that you need more disk than I think you need.) Solaris, especially early versions of Solaris, had strong BSD roots. Many enterprise-level applications run on Solaris. Solaris runs mainly on the SPARC hardware platform manufactured by Sun, which allows Sun to support interesting features such as hot-swappable memory and mainboards.
OpenSolaris increasingly targets commodity hardware, however.
