Upgrading from FreeBSD 4.x-RELEASE to 4.x-STABLE
INTRODUCTION/DISCLAIMER
-----------------------
I am, by no means, the foremost authority on FreeBSD upgrading or kernel
tuning. However, this document should serve as a useful guide that reflects
the methods that I've used in the past to successfully upgrade my systems to
the STABLE FreeBSD branch. I can't stress enough that this is an unofficial
document which is strongly influenced by my own style and experience, so please
surf around before taking my word for it. I'm also going to point out some
other (mis)information that may be of use to those of you who are configuring
FreeBSD for use as a dedicated IRC server. If you're looking for finite examples
of tuning a FreeBSD box, you're in the wrong place.
This document may be modified, reproduced, and distributed free of charge, as
long as the "INTRODUCTION/DISCLAIMER" notice and the original author's name are
both included. Also, please go to http://www.freebsd.org/copyright/index.html for
FreeBSD copyright information.
The methods documented here were tested by yours truely by upgrading to
FreeBSD 4.4-STABLE from 4.3-RELEASE and 4.4-RELEASE.
Updated 29-Sep-2001 - David Friedman (driz@irctoo.net) for IRCtoo (www.irctoo.net)
Created 21-Jan-2001 - David Friedman
LET'S BEGIN
-----------
We'll start out by updating to the latest sources below.
1) Modify /usr/share/examples/cvsup/stable-supfile to your liking.
You'll at least need to change the "host=CHANGE_THIS.FreeBSD.org" to something
like "host=cvsup.freebsd.org". I use UUnet's FreeBSD mirror, cvsup11.freebsd.org,
because we have transit via UUnet at work.
Make note of the following 2 lines in the example stable-supfile:
# If your network link is a T1 or faster, comment out the following line.
*default compress
You should make use of ompression if the speed of your internet connection
demands it. It can certainly save time.
2) cvsup -g -L 2 stable-supfile
After this command completes successfully, you've got the latest STABLE sources.
Now you're ready to move on to rebuilding everything.
3) cd /usr/src
4) make buildworld
The buildworld may take a very long time. The fastest buildworld that I've
ever witnessed was somewhere between 60 and 90 minutes on a 1.4GHz ThunderBird.
You may choose to go have a few pots of coffee while you wait, but I suggest
using this time wisely by configuring your kernel.
5) cd /usr/src/sys/i386/conf
6) cp GENERIC MYKERNEL
I generally use the hostname of my machine for my kernel configuration
name, but MYKERNEL will suffice for this document.
7) pico MYKERNEL
Now that you're in pico, the world's most intuitive editor, let's take
some time to point out some kernel options worth mentioning. I'll focus
on a very vanilla IRC server setup with little hardware support.
It's a good idea to remove unnecessary components. If, for example, you have
a ThunderBird 1GHz with only an IDE controller and an Intel EtherExpress NIC,
you should remove all scsi-related kernel options, and remove all network
interface card drivers aside from the fxp0 driver. Keep in mind that many NIC
drivers require the miibus device. Don't lock yourself out! Make sure you
remove things like IPv6 support, math emulation, NFS support, CD-ROM support,
and only define the CPU that you have. For example, if you have a ThunderBird,
you'd use "cpu I686_CPU", and comment the others out. You always need to
leave the "machine i386" part. You should also remove USB support.
Here are some other options worth looking at (some comments were taken from
/usr/src/sys/i386/conf/LINT):
#
# TCP_DROP_SYNFIN adds support for ignoring TCP packets with SYN+FIN. This
# prevents nmap et al. from identifying the TCP/IP stack, but breaks support
# for RFC1644 extensions and is not recommended for web servers.
#
options TCP_DROP_SYNFIN #drop TCP packets with SYN+FIN
# ICMP_BANDLIM enables icmp error response bandwidth limiting. You
# typically want this option as it will help protect the machine from
# D.O.S. packet attacks.
#
options ICMP_BANDLIM
NMBCLUSTERS are a bit deceiving. More is not necessarily better. You shouldn't
need to increase this setting above 16,000 on a very large IRC server.
options NMBCLUSTERS=16000
If you're using an AMD, I recommend the following options:
options "NO_F00F_HACK"
options CPU_WT_ALLOC
options NO_MEMORY_HOLE
A whole slew of options that can be added or removed based
on your hardware can be viewed in /usr/src/sys/i386/conf/LINT.
Assuming you don't have means to filter upstream, you may also want to look
at the bpf, IPFIREWALL, or IPFILTER options. In fact, I recommend enabling
bpf by default for administrative and network diagnostic purposes. If you
do enable IPFIREWALL, I highly suggest that you accompany it by the
IPFIREWALL_DEFAULT_TO_ACCEPT option to prevent locking yourself out of
the box.
Okay, so you've read my rants, and your buildworld is done. Let's
move on to building the kernel. If you've left /usr/src, please go
back to that now. For help using the "cd" command, see "man cd".
8) make buildkernel KERNCONF=MYKERNEL && make installkernel KERNCONF=MYKERNEL
9) if you enabled IPFIREWALL, you should probably temporarily add the following
to /etc/rc.conf:
firewall_enable="YES"
firewall_type="open"
It's good that we've set the firewall type, if enabled, to "open". This
way we can remove ip filtering from the troubleshooting equation in the
(un)likely event that the box doesn't come back up.
10) reboot
..a few moments of anticipation.
..a few moments of sweating.
..a moment of fear.
..a moment of denial.
..a few moments of
..presto! It came back up, but then you knew it was going to all along, didn't you?
Now it's time to install all of those new binaries that you waited so long to
compile.
11) make installworld
Mergemaster will compare your configuration files to the new STABLE ones that
you downloaded with cvsup. This is a very helpful script, but it can also
be your undoing, so I suggest you are very careful not to overwrite any of
your custom files with new default ones. Some potential hazards include
/etc/group, /etc/rc.conf, etc. For more information, see "man mergemaster".
12) mergemaster
If a new MAKEDEV is installed, mergemaster will ask you if you want to
run "cd /dev && /bin/sh MAKEDEV all". You can go ahead and say "yes",
or feel free to do it yourself afterwards.
Let's clean up our mess.
13) make clean
14) reboot
..a few moments of anticipation.
..a few moments of sweating.
..a moment of fear.
..a moment of denial.
..a few moments of
..presto! It came back up, but then you knew it was going to all along, didn't you?
Congratulations! If your system came back up, you're in business. Most of you
can stop here, but I've continued on to cover some other points of interest.
If you enabled IPFIREWALL, you may choose to modify /etc/rc.conf to reflect
firewall_type="client" instead of firewall_type="open", and edit /etc/rc.firewall
accordingly. I'm not going to delve into that, though.
If you want to hold a lot of IRC users, you may need to increase your fd's,
or file descriptors:
sysctl -w kern.maxfiles=32768
sysctl -w kern.maxfilesperproc=32768
As you can see above, file descriptors can be updated on the fly, but they
DO reset upon reboot, so be sure to put the above commands into /etc/sysctl.conf
or /etc/rc.local.
FreeBSD, by default, give users unlimited resources. This is probably not
the best idea. For this reason, I recommend setting up a special "ircd"
class in /etc/login.conf. It's important that you leave most things unlimited,
but I recommend limiting RAM to slightly less than the amount of RAM that your
server has. On a machine with 128MB RAM, I'd limit memory use to 120MB, etc.
It's your choice. Once you're done, you'll need to run the following command:
cap_mkdb /etc/login.conf
Then, simply chfn <ircd account>, and change the login class to "ircd".
A few more things should be modified. I recommend adding the following to
/etc/rc.conf:
portmap_enable="NO"
sendmail_enable="NO"
xntpd_enable="YES"
xntpd_program="ntpd"
usbd_enable="NO"
The above assumes that you don't need portmap, usbd, or sendmail. What's
that, you're going to run an IRC server on a mail server? Lovely.
You'll need to make an /etc/ntpd.conf file. Here's an example:
server 192.168.0.1 prefer
server 192.168.4.2
driftfile /etc/ntp.drift
Replace the private IP's above with an ntpdate server near you.
Check out http://www.gpsclock.com/ for a lot of nifty information
about that.
For those of you who don't have much RAM to spare, you can edit /etc/ttys,
comment out ttyv1 through ttyv8, and then run the command "init q". This
will save you a few megabytes.
<Qually> hey driz you wacky goose in your the freebsd.txt all of the slashes are
backward, and there is no drive name to prexif any of the direcotries!