Helgrim.com

This describes the steps I have taken to install FreeBSD 6.2 on a recycled server. I'm writing/making notes as I go along, so there isn't any particular aim or focus. I also won't format this until later (i.e. never). The server to which I am installing in an Intel rackmount server which had a previous life as a Windows Server 2003 box.

The Windows bit

First, I had to figure out which architecture I had. I didn't have complete documentation on the hardware, so I wasn't sure if the processor was 32 bit or 64 bit. While Windows reported the speed of the processor, it didn't specify the capabilities . I *think* Windows Server 2003 has a seperate 64 bit version, so I assume the version installed was 32 bit. However, I didn't know if that meant the processor was 32 bit as well, or wheter it was 64 bit running a 32 bit OS. To check, I installed the Intel Processor Identification Utility which gave the following specs:

P4 630
3.0GHz CPU
800MHz system bus
Hyper Threading Technology
Intel Extended Memory 64 Technology
no Intel Virtualization Technolgy
Enhanced Intel SpeedStep technology
Intel MMX technology
Streaming SIMD extensions
Streaming SIMD extensions 2
Streaming SIMD extensions 3

Processor classification		Processor details
CPU Type	0	Level 2 cache	2 MB
CPU Family	F	Level 1 data cache	16 KB
CPU Model	4	Level 1 trace cache	12 Kµops
CPU Stepping	3	Packaging	2 MB	LGA 775
CPU Revision	4	Platform Compatability Guide	2 MB	04A
Other Intel Processor features
Execute Disable Bit	No
Enhanced Halt State	No

With my limited knowledge, it still didn't make it clear whether it was 64 bit or not, but looking at Intel's Processor Spec Finder, I narrowed it down to either a SL7Z9, or SL8Q7, the only difference being the Stepping - either N0 or R0, respectively. Unfortunately the tool was reporting stepping as "3", so I still wasn't sure which it was. Looking at their respective specs, the CPUID strings are 0F43h and 0F4ah respectively. Both referred to the same documentation. Looking further, I found Intel's Processor Number Details page which finally gave me an answer. According to it, it support Intel 64. However, it does also say that it supports Execute Disable Bit, which Processor ID Utility set it didn't. Who to believe? I don't know, but I'm going to believe that it does support Intel 64.

In the meantime, I noticed there had been quite a few BIOS updates since the machine was built. The existing BIOS was at P05, while P08 was latest release, and the notes indicated fixes to quite a lot of problems, so I decided it wouldn't do any harm. I downloaded the zip archive, unpacked it and, having read the README, ran the executable which created a boot floppy. I then rebooted, and crossed my fingers. It appears to have worked, and while I don't see any difference, at least now if I have weird controller problems I can at least say "The BIOS is up to date".

Anyway, as I had discovered, the CPU supported Intel 64, so at first glance I thought this meant that I should get the FreeBSD Ia64 distribution. However, it turns out this is just for Itanium processors, with the AMD distribution being the correct one. The confusion lies in the fact that AMD were first out of the gates with their 64 bit architecture that Intel conformed to the AMD64 specification, but came up with their own name. I guess I grew up used to Intel naming everything, so I'd assumed the AMD distribution was solely for AMD-made processors.

Installation

With this in mind, I downloaded the FreeBSD 6.2-RELEASE ISO image and burned my CD.

The server I had didn't have a CD drive. I had plenty spare, but none of them were slim enough to fit in the 1U case. That wasn't a requirement though, as I only needed it for the installation. As there is an IDE slot on the Motherboard I could just leave the case open, connect the CD drive, and use it that way for the duration of the install. To complicate matters further, there was no power cable available that would connect to my CD drive. To get around this, I used the power supply from another computer to provide power to the CD drive.

I had one more thing to do before beginning my installation. The server had two identical 80Gb SATA disks, but only one was in use by Windows. I wanted to set up a RAID-1 array. I had planned to take advantage of FreeBSD's GEOM with gmirror to do it in software, but after upgrading the BIOS, I spotted an option to enable RAID. Hoping that this meant there was an onboard RAID controller, I enabled it, and sure enough, when I booted up, a RAID setup utility appeared. I set up the two disks as a RAID-1 array, and put off reading up on gmirror for another day. (That's not actually true, I read a lot on what gmirror could due, specifically in conjunction with ggated, in the hope that I could get some HA going. More on that later.)

With my RAID set up, I began my installation. I noted that when booting, FreeBSD gave an id of "0xf43" for the CPU, which I'm guessing corresponds to the CPUID of 0F43h specified for the SL7Z9 chip, at this stage it's a moot point anyway. Happily, it recognised the RAID array, and told me I had a LSILogic v3 MegaRAID controlle. Happy days

I chose Custom Install, and went into the Partitions menu. It gave me a choice of installing to either disk, ad4 or ad6, or to the RAID array, ar0. I chose ar0, and instuced it to use the entire disk.

For my slices, I chose defaults for all, and then deleted the default /usr which had been allocated 67Gb. I recreated /usr, with 8Gb, and then added two more slices, /data0 and /data1, giving the 40Gb and 20Gb respectively.

Distributions, I chose Developer, as I wanted to have my sources, and of course, the Ports tree.

That was all, I hit install and let it run. When it finished, I rebooted, and the system came up cleanly. Logging in, I ran /usr/sbin/sysinstall to complete my configuration. I set the root password, added an account for myself, configured one of the network interfaces to use DHCP, enabled sshd, and enabled NFS. I didn't add any prepackaged software, as I want to figure out the best way for the system to maintain itself and it's ports.

At this point, I powered down again to disconnect the CD drive, and put the cover back on.

Now I installed the following ports: shells/bash, shells/es, net/cvsup-without-gui, security/sudo, editors/vim (-DNO_GUI). I also built the locate database by running sh /etc/periodic/weekly/310.locate

At this stage, I want to set the system up to be as easy to maintain as possible. First, the ports collection: 6.2 comes with portsnap as part of the base installation. This is a utility to allow you to keep your ports tree up to day. I had a look at /etc/postsnap.conf and it indicated that there wasn't really any point in changing anything, so I didn't. I ran portsnap fetch to download the latest snapshot of the tree. This takes a few minutes the first time around. When finished, I ran portsnap extract to extract the tree.

To update the tree, now all I need to do is run portsnap fetch update

I've set this up to run from my cron tab

0	22	*	*	*	root	portsnap -I cron update && pkg_version -vIL=

Install sysutils/portupgrade

Run pkgdb -F to check the package registry is clean and up to date.

We need to update the ports and generate an index for the ports tree. This really needs to be done after each update of the portstree. It takes a while the first time out. portsdb -U

Next up, my main source tree: I copied /usr/share/examples/cvsup/stable-supfile to /usr/sup/stable-supfile, edited it, and changed the host to cvsup.ie.FreeBSD.org. I also copied the refuse file, and then ran cvsup stable-supfile cd /usr/src less UPDATING make buildworld make buildkernel make installkernel reboot into single user mode (boot -s) OR shutdown now mergemaster -p make installworld mergemaster reboot

TODO

look at security/portaudit
look at Mandatory Access Control (MAC)
Mark ptys as insecure.
Look at securelevels.
Look at mounting / read-only.
Look at process accounting
Lock down sshd
Strip the kernel
Configure ipfilter

IM Status