- •Table of Contents
- •Dedication
- •Foreword
- •Introduction
- •What Is FreeBSD?
- •How Did FreeBSD Get Here?
- •The BSD License: BSD Goes Public
- •The Birth of Modern FreeBSD
- •FreeBSD Development
- •Committers
- •Contributors
- •Users
- •Other BSDs
- •NetBSD
- •OpenBSD
- •Other UNIXes
- •Solaris
- •Linux
- •IRIX, HPUX, etc.
- •FreeBSD's Strengths
- •Portability
- •Power
- •Simplified Software Management
- •Optimized Upgrade Process
- •Filesystem
- •Who Should Use FreeBSD
- •FreeBSD as Your Desktop
- •Who Should Run Another BSD
- •Who Should Run a Proprietary Operating System
- •How to Read This Book
- •What Must You Know?
- •How to Think About UNIX
- •Channels of Communication
- •Working with Channels
- •The Command Line
- •Chapter 1: Installation
- •FreeBSD Hardware
- •Processor
- •Memory (RAM)
- •Hard Drives
- •Downloading FreeBSD
- •Installing by FTP
- •Other FTP Install Information
- •Hardware Setup
- •Actually Installing FreeBSD
- •Configuring the Kernel for ISA Cards
- •Sysinstall: The Ugly FreeBSD Installer
- •Disk Usage
- •Partitioning
- •Root
- •Swap Space
- •Swap Splitting
- •/var, /usr, and /home
- •A Second Hard Drive
- •Soft Updates
- •Block Size
- •What to Install
- •Installation Media
- •Committing
- •Root Password
- •Adding Users
- •Time Zone
- •Mouse
- •Configuring Network Cards
- •Xfree86
- •Software
- •Restart
- •A Note on Editors
- •Chapter 2: Getting More Help
- •Why Not Mail First?
- •The FreeBSD Attitude
- •Man Pages
- •The FreeBSD Manual
- •Man Page Headings
- •The FreeBSD Documentation
- •The Mailing List Archives
- •Other Web Sites
- •Checking the Handbook/FAQ
- •Checking the Man Pages
- •Checking the Mailing List Archives
- •Using Your Answer
- •Mailing for Help
- •Chapter 3: Read This Before You Break Something Else! (Backup and Recovery)
- •Overview
- •System Backups
- •Tape Devices
- •How to Read Dmesg.boot
- •Controlling Your Tape Drive
- •Device Nodes
- •Using the TAPE Variable
- •The mt Command
- •Backup Programs
- •Dump/Restore
- •Restoring from an Archive
- •Checking the Contents of an Archive
- •Extracting Data from an Archive
- •Restoring Interactively
- •Recording What Happened
- •Revision Control
- •Getting Older Versions
- •Breaking Locks
- •Viewing Log Messages
- •Reviewing a File's Revision History
- •Ident and ident Strings
- •Going Further
- •The Fixit Disk
- •Chapter 4: Kernel Games
- •Overview
- •What Is the Kernel?
- •Configuring Your Kernel
- •Sysctl
- •Changing Sysctls
- •Setting Sysctls at Boot
- •Kernel Configuration with Loader.conf
- •Manually Configuring the Loader
- •Viewing Loaded Modules
- •Loading and Unloading Modules
- •Customizing the Kernel
- •Preparation
- •Your Backup Kernel
- •Editing Kernel Files
- •Basic Options
- •Multiple Processors
- •Device Entries
- •Building Your Kernel
- •Troubleshooting Kernel Builds
- •Booting an Alternate Kernel
- •Adding to the Kernel
- •LINT
- •Fixing Errors with Options
- •Tweaking Kernel Performance
- •Sharing Kernels
- •Chapter 5: Networking
- •Overview
- •Network Layers
- •The Physical Layer
- •The Physical Protocol Layer
- •The Logical Protocol Layer
- •The Application Layer
- •The Network in Practice
- •Mbufs
- •What Is a Bit?
- •Ethernet
- •Broadcasting
- •Address Resolution
- •Hubs and Switches
- •Netmasks
- •Netmask Tricks
- •Hexadecimal Netmasks
- •Unusable IP Addresses
- •Routing
- •Network Ports
- •Connecting to an Ethernet Network
- •Multiple IP Addresses on One Interface
- •Using Netstat
- •Chapter 6: Upgrading FreeBSD
- •Overview
- •FreeBSD Versions
- •Release
- •Snapshots
- •Security Updates
- •Which Release Should You Use?
- •Upgrade Methods
- •Upgrading via Sysinstall
- •Upgrading via CVSup
- •Simplifying the CVSup Upgrade Process
- •Building a Local CVSup Server
- •Controlling Access
- •Authentication
- •Combining Authentication and Access
- •Chapter 7: Securing Your System
- •Overview
- •Who Is the Enemy?
- •Script Kiddies
- •Disaffected Users
- •Skilled Attackers
- •FreeBSD Security Announcements
- •Subscribing
- •What You'll Get
- •Installation Security Profiles
- •Moderate
- •Extreme
- •Root, Groups, and Permissions
- •The root Password
- •Groups of Users
- •Primary Group
- •Some Interesting Default Groups
- •Group Permissions
- •Changing Permissions
- •Changing File Ownership
- •Assigning Permissions
- •File Flags
- •Viewing a File's Flags
- •Setting Flags
- •Securelevels
- •Setting Securelevels
- •Which Securelevel Do You Need?
- •What Won't Securelevel and File Flags Do?
- •Living with Securelevels
- •Programs That Can Be Hacked
- •Putting It All Together
- •Chapter 8: Advanced Security Features
- •Traffic Control
- •Default Accept vs. Default Deny
- •TCP Wrappers
- •Configuring Wrappers
- •Daemon Name
- •The Client List
- •Putting It All Together
- •Packet Filtering
- •IPFilter
- •IPFW
- •Default Accept and Default Deny in Packet Filtering
- •Basic Concepts of Packet Filtering
- •Implementing IPFilter
- •Configuring Your Server to Use Jail
- •Configuring Your Kernel to Use Jail
- •Client Setup
- •Final Jail Setup
- •Starting the Jail
- •Managing Jails
- •Shutting Down a Jail
- •Monitoring System Security
- •If You're Hacked
- •Chapter 9: Too Much Information About /etc
- •Overview
- •Varieties of /etc Files
- •Default Files
- •/etc/defaults/rc.conf
- •/etc/adduser.conf
- •/etc/crontab
- •/etc/dhclient.conf
- •/etc/fstab
- •/etc/hosts.allow
- •/etc/hosts.equiv
- •/etc/hosts.lpd
- •/etc/inetd.conf
- •/etc/locate.rc
- •/etc/login.access
- •/etc/login.conf
- •Specifying Default Environment Settings
- •/etc/mail/mailer.conf
- •/etc/make.conf and /etc/defaults/make.conf
- •/etc/master.passwd
- •/etc/motd
- •/etc/mtree/*
- •/etc/namedb/*
- •/etc/newsyslog.conf
- •/etc/passwd
- •/etc/periodic.conf and /etc/defaults/periodic.conf
- •/etc/printcap
- •Working with Printcap Entries
- •/etc/profile
- •/etc/protocols
- •/etc/rc.conf and /etc/defaults/rc.conf
- •/etc/resolv.conf
- •/etc/security
- •/etc/services
- •/etc/shells
- •/etc/spwd.db
- •/etc/sysctl.conf
- •/etc/syslog.conf
- •Chapter 10: Making Your System Useful
- •Overview
- •Making Software
- •The Pain and Pleasure of Source Code
- •Debugging
- •The Ports and Packages System
- •Ports
- •Finding Software
- •Legal Restrictions
- •Using Packages
- •Installing via FTP
- •What Does a Package Install?
- •Uninstalling Packages
- •Package Information
- •Controlling Pkg_add
- •Package Problems
- •Forcing an Install
- •Using Ports
- •Installing a Port
- •Using Make Install
- •Uninstalling and Reinstalling
- •Cleaning Up with Make Clean
- •Building Packages
- •Changing the Install Path
- •Setting Make Options Permanently
- •Upgrading Ports and Packages
- •Upgrading the Ports Collection
- •Ports Collection Upgrade Issues
- •Checking Software Versions
- •Hints for Upgrading
- •Chapter 11: Advanced Software Management
- •Overview
- •Startup and Shutdown Scripts
- •Typical Startup Script
- •Using Scripts to Manage Running Programs
- •Managing Shared Libraries
- •Ldconfig
- •Running Software from the Wrong OS
- •Recompilation
- •Emulation
- •ABI Implementation
- •Foreign Software Libraries
- •Installing and Enabling Linux Mode
- •Identifying Programs
- •What Is Linux_base?
- •Adding to Linux_base
- •Configuring Linux Shared Libraries
- •Installing Extra Linux Packages as RPMs
- •What Is SMP?
- •Kernel Assumptions
- •FreeBSD 3.0 SMP
- •FreeBSD 5 SMP
- •Using SMP
- •SMP and Upgrades
- •Chapter 12: Finding Hosts With DNS
- •How DNS Works
- •Basic DNS Tools
- •The Host Command
- •Getting Detailed Information with Dig
- •Looking Up Hostnames with Dig
- •More Dig Options
- •Configuring a DNS Client: The Resolver
- •Domain or Search Keywords
- •The Nameserver List
- •DNS Information Sources
- •The Hosts File
- •The Named Daemon
- •Zone Files
- •A Real Sample Zone
- •named.conf
- •/var/named/master/absolutebsd.com
- •Making Changes Work
- •Starting Named at Boottime
- •Checking DNS
- •Named Configuration Errors
- •Named Security
- •Controlling Information Order
- •More About BIND
- •Chapter 13: Managing Small Network Services
- •Bandwidth Control
- •Configuring IPFW
- •Reviewing IPFW Rules
- •Dummynet Queues
- •Directional Traffic Shaping
- •Certificates
- •Create a Request
- •Being Your Own CA
- •Testing SSH
- •Enabling SSH
- •Basics of SSH
- •Creating Keys
- •Confirming SSH Identity
- •SSH Clients
- •Connecting via SSH
- •Configuring SSH
- •System Time
- •Setting the Time Zone
- •Network Time Protocol
- •Ntpdate
- •Ntpd
- •Inetd
- •/etc/inetd.conf
- •Configuring Programs in Inetd
- •Inetd Security
- •Starting Inetd
- •Changing Inetd's Behavior
- •Chapter 14: Email Services
- •Email Overview
- •Where FreeBSD Fits In
- •The Email Protocol
- •Email Programs
- •Who Needs Sendmail?
- •Replacing Sendmail
- •Installing Postfix
- •Pieces of Postfix
- •Configuring Postfix
- •Email Aliases
- •Email Logging
- •Virtual Domains
- •Postfix Commands
- •Finding the Correct Mail Host
- •Undeliverable Mail
- •Installing POP3
- •Testing POP3
- •POP3 Logging
- •POP3 Modes
- •Qpopper Preconfiguration Questions
- •Default Qpopper Configuration
- •APOP Setup
- •Configuring Pop3ssl
- •Qpopper Security
- •Chapter 15: Web and FTP Services
- •Overview
- •How a Web Server Works
- •The Apache Web Server
- •Apache Configuration Files
- •Configuring Apache
- •Controlling Apache
- •Virtual Hosting
- •Tweaking Virtual Hosts
- •.NET on FreeBSD
- •Installing the SSCLI
- •FTP Security
- •The FTP Client
- •The FTP Server
- •Chapter 16: Filsystems and Disks
- •Device Nodes
- •Hard Disks and Partitions
- •The /etc/fstab File
- •Disk Basics
- •The Fast File System
- •Vnodes
- •FFS Mount Types
- •FFS Mount Options
- •What's Mounted Now?
- •Dirty Disks
- •Fsck
- •Mounting and Unmounting Disks
- •Mounting Standard Filesystems
- •Mounting with Options
- •Mounting All Standard Filesystems
- •Mounting at Nonstandard Locations
- •Unmounting
- •Soft Updates
- •Enabling Soft Updates
- •IDE Write Caching and Soft Updates
- •Virtual Memory Directory Caching
- •Mounting Foreign Filesystems
- •Using Foreign Mounts
- •Foreign Filesystem Types
- •Mount Options and Foreign Filesystems
- •Filesystem Permissions
- •Removable Media and /etc/fstab
- •Creating a Floppy
- •Creating an FFS Filesystem
- •The Basics of SCSI
- •SCSI Types
- •SCSI Adapters
- •SCSI Buses
- •Termination and Cabling
- •SCSI IDs and LUNs
- •FreeBSD and SCSI
- •Wiring Down Devices
- •Adding New Hard Disks
- •Creating Slices
- •Creating Partitions
- •Configuring /etc/fstab
- •Installing Existing Files onto New Disks
- •Temporary Mounts
- •Moving Files
- •Stackable Mounts
- •Chapter 17: RAID
- •Hardware vs. Software RAID
- •RAID Levels
- •Software RAID
- •Vinum Disk Components
- •Vinum Plex Types
- •Preparing Vinum Drives
- •Dedicating Partitions to Vinum
- •Configuring Vinum
- •Concatenated Plex
- •Removing Vinum Configuration
- •Striped Volumes
- •Mirrored Volumes
- •Starting Vinum at Boot
- •Other Vinum Commands
- •Replacing a Failed Mirrored Plex
- •Chapter 18: System Performance
- •Overview
- •Computer Resources
- •Disk Input/Output
- •Network Bandwidth
- •CPU and Memory
- •Using Top
- •Memory Usage
- •Swap Space Usage
- •CPU Usage
- •When Swap Goes Bad
- •Paging
- •Swapping
- •Are You Swapping or Paging?
- •Fairness in Benchmarking
- •The Initial Test
- •Using Both CPUs
- •Directory Caching
- •Moving /usr/obj
- •Lessons Learned
- •Chapter 19: Now What's It Doing?
- •Status Mails
- •Forwarding Reports
- •Logging with Syslogd
- •Facilities
- •Levels
- •Syslog.conf
- •Wildcards
- •Rotating Logs with Newsyslog.conf
- •Reporting with SNMP
- •Basics of SNMP
- •MIBs
- •Snmpwalk
- •Specific Snmpwalk Queries
- •Translating Between Numbers and Names
- •Setting Up Snmpd
- •Index Numbers
- •Configuring MRTG
- •Sample mrtg.cfg Entry
- •Testing MRTG
- •Tracking Other System Values
- •Monitoring a Single MIB
- •Customizing MRTG
- •MRTG Index Page
- •Sample MRTG Configurations
- •Chapter 20: System Crashes and Panics
- •What Causes Panics?
- •What Does a Panic Look Like?
- •Responding to a Panic
- •Prerequisites
- •Crash Dump Process
- •The Debugging Kernel
- •kernel.debug
- •Dumpon
- •Savecore
- •Upon a Crash
- •Dumps and Bad Kernels
- •Using the Dump
- •Advanced Kernel Debugging
- •Examining Lines
- •Examining Variables
- •Apparent Gdb Weirdness
- •Results
- •Vmcore and Security
- •Symbols vs. No Symbols
- •Serial Consoles
- •Hardware Serial Console
- •Software Serial Console
- •Changing the Configuration
- •Using a Serial Console
- •Serial Login
- •Emergency Logon Setup
- •Disconnecting the Serial Console
- •Submitting a Problem Report
- •Problem Report System
- •What's in a PR?
- •Filling Out the Form
- •PR Results
- •Chapter 21: Desktop FreeBSD
- •Overview
- •Accessing File Shares
- •Prerequisites
- •Character Sets
- •Kernel Support for CIFS
- •SMB Tools
- •Configuring CIFS
- •Minimum Configuration: Name Resolution
- •Other smbutil Functions
- •Mounting a Share
- •Other mount_smbfs Options
- •Sample nsmb.conf Entries
- •CIFS File Ownership
- •Serving Windows File Shares
- •Accessing Print Servers
- •Running a Local Lpd
- •Printer Testing
- •Local Printers
- •X: A Graphic Interface
- •X Prerequisites
- •X Versions
- •Configuring X
- •Making X Look Decent
- •Desktop Applications
- •Web Browsers
- •Email Readers
- •Office Suites
- •Music
- •Graphics
- •Desk Utilities
- •Games
- •Afterword
- •Overview
- •The Community
- •What Can You Do?
- •Getting Things Done
- •Second Opinions
- •Appendix: Some Useful SYSCTL MIBs
- •List of Figures
- •Chapter 1: Installation
- •Chapter 5: Networking
- •Chapter 6: Upgrading FreeBSD
- •Chapter 19: Now What's It Doing?
- •List of Tables
- •Chapter 4: Kernel Games
- •Chapter 5: Networking
- •Chapter 8: Advanced Security Features
- •Chapter 9: Too Much Information About /etc
- •List of Sidebars
- •Chapter 15: Web and FTP Services
When you open the hard drive's case you'll find a stack of round disks, commonly called platters. When the disk drive is on, these platters (commonly made of glass or plastic) spin at thousands of revolutions per minute (RPM). The RPM count on hard drives is a measure of platter rotation speed.
The platters are covered with a layer of magnetic material, which itself is usually covered in iron oxide.[2] This magnetic material is arranged in thousands of circular rings, called tracks, that extend from the platter's inner core to its outer edge, much like growth rings in a tree. These tracks hold data as strings of zeros and ones. Each track is subdivided into sectors, and each sector on the outer tracks holds more data than that same sector on an inner track, and it takes less time to read the same amount of data on an outer track than on an inner track because any point on an outer track is moving faster.
Heads sit over each platter, and all data written to or read from the platters passes through those heads. As a rule, these heads can read and write data quickly, but they have to wait for the disk to move into the proper position under them so that the data can be transferred. Drive performance basically boils down to how quickly those rusty platters can move under the drive heads, which is why RPM is so important.
Each track holds blocks of data, the size and placement of which restricts how efficiently the filesystem works and what sorts of files it can best handle. Each filesystem uses its own particular index to record the placement of data on the platters, and one operating system can't necessarily read another's index. (DOS used a single File Allocation Table (FAT), later expanded to FAT12, FAT16, FAT32, and so on.) The UNIX Fast File System (FFS) uses many scattered index nodes, or inodes, instead.
[2]Yes, iron oxide is rust. Please do not add rust to your platters to make them hold more data; I proved it doesn't work many years ago.
The Fast File System
FreeBSD's filesystem, the Fast File System (FFS) is a direct descendant of the filesystem shipped with BSD4.4. (In fact, as of this writing, one of the original filesystem authors is still developing the FreeBSD filesystem, adding a lot of the nifty features we'll discuss shortly.) FFS is sometimes called UFS for UNIX File System, and many system utilities still call FFS partitions UFS.
Note FFS has moved from BSD into several other vendors. If a UNIX vendor doesn't specifically tout their "improved, advanced" filesystem, they're almost certainly running the BSD filesystem.
FFS is designed to be fast and reliable, and to handle the most common (and uncommon) situations as effectively as possible. FreeBSD ships FFS configured to be as widely useful as possible on relatively modern hardware, but you can choose to optimize it for trillions of small files or a half−dozen 30GB files, if you choose. You don't have to know a huge amount about FFS's internals, but you should know a few basics. To begin with, it helps to know that FFS divides the disk into inodes and blocks.
Inodes Inodes contain very basic information about files, including permissions, size, and so on, as well as a list of the blocks in the file. Collectively, the data in an inode is known as metadata, which is simply data about data.
Blocks Blocks contain the file's actual data.
370
While inodes contain lots of different information, all you need to know is that they're the index of the file on the disk. They are what allows the operating system to find the information it's attempting to retrieve.
Vnodes
Inodes and blocks worked wonderfully back in the early days of UNIX. As years passed, however, it became normal to swap disks between different machines and even different operating systems. CD−ROMs, with their unique layout, became popular; floppy disks slowly converged on FAT32 as a standard; and other UNIXes developed their own variant filesystems. Because BSD needed to speak to all these different systems, another layer of abstraction was needed.
That abstraction was the virtual node, or vnode. You never manipulate vnodes directly, but you'll see references to them throughout the system documentation, so it's important to know what they are. The vnode is a translator between the kernel and whatever sort of filesystem you've mounted. When you write a file to an FFS filesystem, the vnode talks to an inode. When you write a file to a Microsoft−style FAT filesystem, the vnode talks to the file allocation table. (Vnodes are actually used for far more than talking to the filesystem, but we won't get into that here.)
Every tool that reads and writes to disks actually does so through vnodes, which map the data to the appropriate filesystem for the underlying media. You'll see references to inodes only when dealing with FFS filesystems, but you'll see vnodes when you deal with any filesystem.
FFS Mount Types
Unlike Windows or Macintosh filesystems, FFS partitions can be treated in several different ways depending on how they're mounted. The manner in which a partition is mounted is called the mount type. Remember that, as discussed in "Device Nodes," earlier in this chapter, you must know a filesystem's physical device name in order to mount it. And an unmounted filesystem cannot be accessed. You cannot read it, write to it, or see it in any way. You're stuck.
To change the boottime mount options on a partition, add the options to the appropriate line in /etc/fstab in the "options" column.
Read−Only Mounts
If you only want to look at the contents of a disk, and not write to it, you can mount the partition as read−only (or rdonly). This is unquestionably the safest way to mount a disk, and one of the most useless ways to mount a disk for many server uses, because you cannot alter the data or write new data.
Many systems administrators mount the root partition, and perhaps even /usr, as read−only to minimize any potential system damage from a loss of power. Even if you lose the physical hard drive due to a power surge or some other hardware failure, the data on the platters remains intact. That's the advantage of read−only mounts; the disadvantage is that it makes maintenance far more difficult because you can't write to read−only mounted disks!
Synchronous Mounts
Synchronous (or sync) is the old−fashioned way of mounting a filesystem. When a disk is synchronously mounted, you can read from it much as you would expect, but when you write to it, the kernel waits to see whether the write is actually completed before telling the program that the
371
write is completed. If it isn't completed, the program can choose to act appropriately.
Synchronous mounting provides the greatest data integrity in the case of a crash, but it is also slow. ("Slow" is a relative term these days, when even a cheap disk can outperform what was the top end several years ago.) Consider using synchronous mounting when you wish to be truly pedantic on data integrity, but in most cases it's truly overkill.
Asynchronous Mounts
For faster access at a higher risk of data loss, mount your partitions asynchronously (async). When a disk is asynchronously mounted, the kernel writes data to the disk, and tells the program that the write was successful without waiting for the disk to confirm that the data was actually written. Asynchronous is fine on disposable machines, but don't use it with important data.
Noasync Mounts
Finally, we have a method that combines sync and async, called noasync; this is FreeBSD's default. When using noasync, data that affects inodes is written to disk synchronously, while the actual data is handled asynchronously. Noasync is used in combination with soft updates (see the "Soft Updates" section later in the chapter) to create a truly robust filesystem.
FFS Mount Options
FreeBSD supports several mount options in addition to the mount types. While you don't need to know the details of all of the mount options, you should at least know that they exist, should you encounter a circumstance that requires one.
noatime Every file on FFS includes an access−time stamp, called the atime, which records when the file was last accessed. If you have a large number of files and don't need this data, you can mount the disk noatime and not have this time−stamp updated.
noexec The noexec mount option prevents any binaries from being executed on this partition. Mounting /home noexec can help to prevent users from installing and running their own programs, but for it to be effective, be sure to also noexec mount /tmp, /var/tmp, and any other places that they can write files.
nosuid The nosuid option prevents setuid programs from running on your system. Setuid programs allow users to run programs as if they're another user. For example, some programs (such as login(1)) must be run by root, but if you make login setuid, anyone can run it and it will work.
Setuid programs obviously must be carefully written so that they can't be exploited and used to get unauthorized access to your system. As such, many administrators habitually disable all unneeded setuid programs. You can use nosuid to do so, but it will be useless if you have a script wrapper that allows you to run scripts as setuid, such as suidperl, on the system.
nosymfollow The nosymfollow option disables symlinks, or aliases, to files. (Symlinks are mainly used to create aliases to files that reside on other partitions, anyway.) To create an alias to another file on the same partition mounted nosymfollow, use a regular ln(1)−style link.
nodev Finally, the nodev option disallows using any device nodes on the filesystem, which can help prevent mistakes if you're accessing a drive used by another UNIX. Disallowing device nodes
372