FreeBSD post
Signed-off-by: Christine Dodrill <me@christine.website>
This commit is contained in:
parent
41585dbbdd
commit
f49c967865
|
|
@ -0,0 +1,280 @@
|
|||
---
|
||||
title: "A Trip into FreeBSD"
|
||||
date: 2021-02-13
|
||||
tags:
|
||||
- freebsd
|
||||
---
|
||||
|
||||
# A Trip into FreeBSD
|
||||
|
||||
I normally deal with Linux machines. Linux is what I know and it's what I've
|
||||
been using since I was in college. A friend of mine has been coaxing me into
|
||||
trying out [FreeBSD](https://www.freebsd.org), and I decided to try it out and
|
||||
see what it's like. Here's some details about my experience and what I've
|
||||
learned.
|
||||
|
||||
## Hardware
|
||||
|
||||
I've tried out FreeBSD on the following hardware:
|
||||
|
||||
- qemu/KVM on amd64
|
||||
- Raspberry Pi 4 (4 GB)
|
||||
- Raspberry Pi 3B (1 GB)
|
||||
|
||||
I've had the most luck with the Raspberry Pi 3 though. The KVM machine would
|
||||
hang infinitely after the install process waiting for the mail service to do a
|
||||
DNS probe of its own hostname (I do not host automagic FQDNS for my vms). I'm
|
||||
pretty sure I was doing something wrong there but I wasn't able to figure out
|
||||
what I needed to do in order to disable the DNS probe blocking startup.
|
||||
|
||||
[If you know what we were doing wrong here, please feel free to <a
|
||||
href="/contact">contact</a> us with the thing we messed
|
||||
up.](conversation://Mara/hacker)
|
||||
|
||||
After waiting for about 5 minutes I gave up and decided to try out the Raspberry
|
||||
Pi 4. The Raspberry Pi 4 is the most powerful arm board I own. It has 4 GB of
|
||||
ram and a quad core processor that is way more than sufficient for my needs. I
|
||||
was hoping to use FreeBSD on that machine so I could benefit from the hardware
|
||||
the most. Following the instructions on [the wiki
|
||||
page](https://wiki.freebsd.org/arm/Raspberry%20Pi), I downloaded the 12.2 RPI
|
||||
image and flashed it to an SD card using Etcher. I put the SD card in, turned
|
||||
the raspi on and then waited for it to show up on the network.
|
||||
|
||||
Except it never showed up on the network. I ran scans with nmap (specifically
|
||||
with the command `sudo nmap -sS -p 22 192.168.0.0/24`) and the IP address never
|
||||
showed up. I also didn't see any new MAC addresses on the network, so that lead
|
||||
me to believe that the pi was failing to boot. I downloaded an image for 13-BETA
|
||||
and followed [this
|
||||
guide](https://medium.com/swlh/freebsd-usb-boot-on-raspberry-pi-4-765cb6e75570)
|
||||
that claims to make it work on the pi 4, but I got the same issue. The Raspberry
|
||||
Pi 4 unfortunately has a micro-HDMI port on it, so I was unable to attach it to
|
||||
my monitor to see any error messages. After trying for a while to see if I could
|
||||
set up a serial port to get the serial log messages (spoiler: I couldn't), I dug
|
||||
up my Pi 3 and stuck the same SD card into it, hooked it up to my monitor,
|
||||
attached a spare keyboard to it and booted into FreeBSD first try.
|
||||
|
||||
## Using FreeBSD
|
||||
|
||||
FreeBSD is a very down to earth operating system. It also has a
|
||||
[handbook](https://docs.freebsd.org/en/books/handbook/) that legitimately
|
||||
includes all of the information you need to get up and running. Following the
|
||||
handbook, I set a new password, installed the `pkg` tool, set up
|
||||
[fish](https://fishshell.com) and then also installed the Go compiler toolchain
|
||||
for the hell of it.
|
||||
|
||||
`pkg` is a very minimal looking package manager. It doesn't have very many
|
||||
frills and it is integrated into the system pretty darn well. It looks like it
|
||||
prefers putting everything into `/usr/local`, including init scripts and other
|
||||
configuration files.
|
||||
|
||||
This interestingly lets you separate out the concerns of the base system from
|
||||
individual machine-local configuration. I am not sure if this also works with
|
||||
files like `/etc/resolv.conf` or other system configuration files, but it does
|
||||
really give `/usr/local` a reason to exist beyond being a legacy location for
|
||||
yolo-installed software that may or may not be able to be upgraded separately.
|
||||
|
||||
## Custom Services
|
||||
|
||||
Speaking of services, I wanted to see how hard it would be to get a custom
|
||||
service running on a FreeBSD box. At the minimum I would need the following:
|
||||
|
||||
- The binary built for freebsd/aarch64 and installed to `/usr/local/bin`
|
||||
- A user account for that service
|
||||
- An init script for that service
|
||||
- To enable the init script in `/etc/rc.conf`
|
||||
|
||||
I decided to do this with a service I made years ago called
|
||||
[whatsmyip](https://github.com/Xe/whatsmyip).
|
||||
|
||||
### Building a Binary
|
||||
|
||||
Building the service is easy, I just go into the directory and run `go build`.
|
||||
Then I get a binary. Running it in another tmux tab, we can see it in action:
|
||||
|
||||
```console
|
||||
$ curl http://[::1]:9090
|
||||
::1
|
||||
```
|
||||
|
||||
I can also run the curl command from my macbook:
|
||||
|
||||
```console
|
||||
$ curl http://pai:9090
|
||||
100.72.190.5
|
||||
```
|
||||
|
||||
Cool, I've got a working service! Let's install it to `/usr/local/bin`:
|
||||
|
||||
```console
|
||||
$ doas cp ./whatismyip /usr/local/bin
|
||||
```
|
||||
|
||||
[Wait, `doas`? What is `doas`? It looks like it's doing something close to what
|
||||
sudo does.](conversation://Mara/hmm)
|
||||
|
||||
[doas](https://en.wikipedia.org/wiki/Doas) is a program that does most of the
|
||||
same things that sudo does, but it's a much smaller codebase. I decided to try
|
||||
out doas for this install for no other reason than I thought it would be a cool
|
||||
thing to learn. It's actually pretty simple, and I'm going to look at using it
|
||||
elsewhere (with an alias for `sudo` -> `doas`).
|
||||
|
||||
### Service User
|
||||
|
||||
The handbook says that we use the
|
||||
[adduser](https://people.freebsd.org/~blackend/en_US.ISO8859-1/books/handbook/users-synopsis.html)
|
||||
command to add users to the system. So, let's run `adduser` to create a
|
||||
`whatsmyip` user:
|
||||
|
||||
```console
|
||||
# adduser
|
||||
Username: whatsmyip
|
||||
Full name: github.com/Xe/whatsmyip
|
||||
Uid (Leave empty for default): 666
|
||||
Login group [whatsmyip]:
|
||||
Login group is whatsmyip. Invite whatsmyip into other groups? []:
|
||||
Login class [default]:
|
||||
Shell (sh csh tcsh bash rbash git-shell fish nologin) [sh]: sh
|
||||
Home directory [/home/whatsmyip]: /var/db/whatsmyip
|
||||
Home directory permissions (Leave empty for default):
|
||||
Use password-based authentication? [yes]: no
|
||||
Lock out the account after creation? [no]: yes
|
||||
Username : whatsmyip
|
||||
Password : <disabled>
|
||||
Full Name : github.com/Xe/whatsmyip
|
||||
Uid : 666
|
||||
Class :
|
||||
Groups : whatsmyip
|
||||
Home : /var/db/whatsmyip
|
||||
Home Mode :
|
||||
Shell : /bin/sh
|
||||
Locked : yes
|
||||
OK? (yes/no): yes
|
||||
adduser: INFO: Successfully added (whatsmyip) to the user database.
|
||||
adduser: INFO: Account (whatsmyip) is locked.
|
||||
Add another user? (yes/no): no
|
||||
Goodbye!
|
||||
```
|
||||
|
||||
It's a bit weird that there's not a flow for creating a "system user" that
|
||||
automatically sets the flags that I expect from Linux system administration, but
|
||||
I was able to specify the values manually without too much effort.
|
||||
|
||||
Something interesting is that when I set the user account to `nologin` I
|
||||
actually was unable to log in as the user. Usually in Linux you can hack around
|
||||
this with `su` flags but FreeBSD doesn't have this escape hatch. Neat.
|
||||
|
||||
### Init Script
|
||||
|
||||
Now that I had the service account set up, I need to write an init service that
|
||||
will start this program on boot. Following other parts of the handbook I was
|
||||
able to get a base script that looks like this:
|
||||
|
||||
```shell
|
||||
#!/bin/sh
|
||||
#
|
||||
# PROVIDE: whatsmyip
|
||||
# REQUIRE: DAEMON
|
||||
# KEYWORD: shutdown
|
||||
|
||||
. /etc/rc.subr
|
||||
|
||||
name=whatsmyip
|
||||
rcvar=whatsmyip_enable
|
||||
|
||||
command="/usr/sbin/daemon"
|
||||
command_args="-S -u whatsmyip -r -f -p /var/run/whatsmyip.pid /usr/local/bin/whatsmyip"
|
||||
load_rc_config $name
|
||||
|
||||
#
|
||||
# DO NOT CHANGE THESE DEFAULT VALUES HERE
|
||||
# SET THEM IN THE /etc/rc.conf FILE
|
||||
#
|
||||
whatsmyip_enable=${whatsmyip_enable-"NO"}
|
||||
pidfile=${whatsmyip_pidfile-"/var/run/whatsmyip.pid"}
|
||||
|
||||
run_rc_command "$1"
|
||||
```
|
||||
|
||||
Now I can copy this file to `/usr/local/etc/rc.d/whatsmyip` and then make sure
|
||||
it's set to the permissions `0555` with something like:
|
||||
|
||||
```console
|
||||
$ chmod 0555 ./whatsmyip.rc
|
||||
$ doas cp ./whatsmyip.rc /usr/local/etc/rc.d/whatsmyip
|
||||
```
|
||||
|
||||
### Enabling The Service
|
||||
|
||||
Once I had the file in the right place, I enabled the service in `/etc/rc.conf`
|
||||
like this:
|
||||
|
||||
```shell
|
||||
# whatsmyip
|
||||
whatsmyip_enable="YES"
|
||||
```
|
||||
|
||||
Then I started the service with `service whatsmyip start`, and I was unable to
|
||||
start the service. I got this error:
|
||||
|
||||
```
|
||||
Feb 13 20:40:00 pai freebsd[1519]: /usr/local/etc/rc.d/whatsmyip: WARNING: failed to start whatsmyip
|
||||
```
|
||||
|
||||
And no other useful information to help me actually fix the problem. I assume
|
||||
there's some weirdness going on with permissions, so let's sidestep the user
|
||||
account for now and just run the service as root directly by changing the
|
||||
`command_args` in `/usr/local/etc/rc.d/whatsmyip`:
|
||||
|
||||
```shell
|
||||
command_args="-S -r -p /var/run/whatsmyip.pid /usr/local/bin/whatsmyip"
|
||||
```
|
||||
|
||||
Restarting the service, everything works! I can hit that service all I want and
|
||||
I get back the IP address that I used to hit that service.
|
||||
|
||||
## What I Learned
|
||||
|
||||
FreeBSD has _excellent_ documentation. The people on the documentation team
|
||||
really care about making the handbook useful. I wish it went into more detail
|
||||
about best practices for making your own services (I had to crib from some other
|
||||
service files as well as googling for a minimal template), but overall it gives
|
||||
you enough information to get off the ground.
|
||||
|
||||
FreeBSD is also fairly weird. It's familiar-ish, but it's a very different
|
||||
experience. It's also super-minimal. Looking at the output of `ps x`, there's
|
||||
only 45 processes running on the system, including kernel threads.
|
||||
|
||||
```
|
||||
root@pai ~# ps x | wc -l
|
||||
45
|
||||
```
|
||||
|
||||
The only processes are `init`, `dhclient`, a device manager, `syslog`,
|
||||
`tailscaled`, `sshd`, `cron`, `whatsmyip`, `fish` and a few instances of `getty`
|
||||
to allow me to log in with an HDMI monitor and keyboard should I need to. That's
|
||||
it. That's all that's running. It's only using 96 MB of ram and most of the
|
||||
machine's power is left over to me.
|
||||
|
||||
It's just a shame that FreeBSD support for programming languages is so poor in
|
||||
general. Go works fine on it, but Rust doesn't have any pre-built binaries for
|
||||
the compiled (and using ports/pkg isn't an option because aarch64 is a tier-2
|
||||
architecture in FreeBSD land which means that it's not guaranteed to have
|
||||
prebuilt binaries for everything). Compiling Rust from source also really isn't
|
||||
an option because I don't have enough ram on my raspi to do that. Go works
|
||||
though.
|
||||
|
||||
I really wonder how this kind of network effect will boil down with more and
|
||||
more security libraries like
|
||||
[pyca](https://github.com/pyca/cryptography/issues/5771) integrating Rust deeper
|
||||
into core security components. It probably means that people are going to have
|
||||
to step up and actually do the legwork required to get Rust working on more
|
||||
platforms, however it definitely is going to leave some older hardware or less
|
||||
commonly used configurations (like aarch64 FreeBSD) in the dust if we aren't
|
||||
careful. Maybe this isn't a technical problem, but it is definitely something
|
||||
interesting to think about.
|
||||
|
||||
Overall, FreeBSD is an interesting tool and if I ever have a good use for it in
|
||||
my server infrastructure I will definitely give it a solid look. I just wish it
|
||||
was as easy to manage a FreeBSD system as it is to manage a NixOS system. A lot
|
||||
of my faffing about with `rc.conf` and rc scripts wouldn't have needed to
|
||||
happen if that was the case.
|
||||
Loading…
Reference in New Issue