FreeBSD
De Wiki de l'internet libre.
Installation d'un serveur domestique, avec quelques services de base (partage de fichiers et multimedia, virtualisation, download ...)
Ce n'est pas un tuto à proprement parler, mais un exemple de config qui marche bien chez moi ne faites pas un simple copier/coller, ça plantera, vous perdrez vos données et un virus FB dira à tous vos amis que vous êtes une tache en informatique. Lisez le handbook de FreeBSD, lisez les pages de man, lisez les scripts et comprenez-les avant de les lancer.
Sommaire |
Installation
à partir du shell du live-cd
#!/bin/sh
# création de la table GPT sur le disque ada0 (1er disque sata de la machine, à adapter chez vous)
#gpart -s gpt ada0
# création d'une partition de boot, début au secteur 34, taille 512 secteurs
#gpart add -s 34 -b 512 -t freebsd-boot ada0
# création de la partition système, début au secteur 2048 (4k ready), sur tout le disque restant, label "ssd-intel"
#gpart add -s 2048 -t freebsd-zfs -l ssd-intel ada0
# utile ...
mkdir /boot/zfs
# on crée un dataset ZFS nomée sys_tank sur la partition gpt/ssd-intel
zpool create sys_tank /dev/gpt/ssd-intel
# on change le checksum
zfs set checksum=fletcher4 sys_tank
# on active la deduplication
zfs set dedup=on sys_tank
# on desactive la compression par défaut
zfs set compression=off sys_tank
# on export et réimporte le pool dans /mnt, en préservant zroot.cache dans /tmp
zpool export sys_tank
zpool import -o cachefile=/tmp/zpool.cache -o altroot=/mnt sys_tank
# on crée l'arboréscence ZFS
# on installe le système dans sys_tank/root, ça permet de changer le /root si besoin (upgrade ...)
zfs create sys_tank/root
zfs create sys_tank/usr
zfs create -o compression=lzjb -o setuid=off sys_tank/usr/ports
zfs create -o compression=off -o exec=off -o setuid=off sys_tank/usr/ports/distfiles
zfs create -o compression=off -o exec=off -o setuid=off sys_tank/usr/ports/packages
zfs create -o compression=lzjb -o exec=off -o setuid=off sys_tank/usr/src
zfs create sys_tank/var
zfs create -o compression=lzjb -o exec=off -o setuid=off sys_tank/var/crash
zfs create -o exec=off -o setuid=off sys_tank/var/db
zfs create -o compression=lzjb -o exec=on -o setuid=off sys_tank/var/db/pkg
zfs create -o exec=off -o setuid=off sys_tank/var/empty
zfs create -o compression=lzjb -o exec=off -o setuid=off sys_tank/var/log
zfs create -o compression=gzip -o exec=off -o setuid=off sys_tank/var/mail
zfs create -o exec=off -o setuid=off sys_tank/var/run
zfs create -o compression=lzjb -o exec=on -o setuid=off sys_tank/var/tmp
zfs create -o compression=on -o exec=on -o setuid=off sys_tank/tmp
# on définit l'emplacement de la racine pour le boot
zpool set bootfs=sys_tank/root sys_tank
# /var/empty en lecture seule
zfs set readonly=on sys_tank/var/empty
# swap de 10Go, sans dedup ni checksum
zfs create -V 10G sys_tank/swap
zfs set org.freebsd:swap=on sys_tank/swap
zfs set checksum=off sys_tank/swap
zfs set dedup=off sys_tank/swap
# on umount le tout et on refait les points de montage propres
zfs umount -a
zfs set mountpoint=none sys_tank
zfs set mountpoint=/ sys_tank/root
zfs set mountpoint=/tmp sys_tank/tmp
zfs set mountpoint=/usr sys_tank/usr
zfs set mountpoint=/var sys_tank/var
# on export et importe le pool
zpool export sys_tank
zpool import -o cachefile=/tmp/zpool.cache -o altroot=/mnt sys_tank
chmod 1777 /mnt/tmp
chmod 1777 /mnt/var/tmp
# Install de FreeBSD dans sys_tank/root, monté sur /mnt
cd /usr/freebsd-dist
export DESTDIR=/mnt
for file in base.txz lib32.txz kernel.txz doc.txz ports.txz src.txz;
do (cat $file | tar --unlink -xpvJf - -C ${DESTDIR:-/}); done
# on remet le cache zfs
cp /tmp/zpool.cache /mnt/boot/zfs/zpool.cache
# Installe fstab, rc.conf sysctl.conf, make.conf et loader.conf
cd /mnt/etc/ ; fetch http://192.168.1.96/zurp_fs/sys_conf/rc.conf
cd /mnt/etc/ ; fetch http://192.168.1.96/zurp_fs/sys_conf/sysctl.conf
cd /mnt/etc/ ; fetch http://192.168.1.96/zurp_fs/sys_conf/make.conf
cd /mnt/boot/ ; fetch http://192.168.1.96/zurp_fs/sys_conf/loader.conf
touch /mnt/etc/fstab
# Install du script post_install
mkdir /mnt/usr/scripts
mkdir /mnt/usr/scripts/userland
cd /mnt/usr/scripts
fetch http://192.168.1.96/zurp_fs/scripts/update_scripts.sh
chmod +x update_script.sh
shutdown -r now
/etc/rc.conf
# FreeBSD /etc/rc.conf # # Enable network daemons for user convenience. # Please make all changes to this file, not to /etc/defaults/rc.conf. # This file now contains just the overrides from /etc/defaults/rc.conf. # Zurpatator2 Conf file # FreeBSD 9 RELEASE # Ti nicO # 06/2011 # 01/2012 ######### # Systeme ######### zfs_enable="YES" #amd_enable="YES" #acpi_enable="YES" #apm_enable="YES" #apmd_enable="YES" dbus_enable="YES" hald_enable="YES" ############## # Secure Tips ############## clear_tmp_enable="YES" ############## # Network Conf ############## # NVidia PCIe 1GBps #1 ifconfig_nfe0="up" # NVidia PCIe 1GBps #2 ifconfig_nfe1="up" # LAG Interface cloned_interfaces="lagg0" ifconfig_lagg0="up laggproto lacp laggport nfe0 laggport nfe1 DHCP" # jail.sharebox ifconfig_lagg0_alias0="inet 192.168.1.10 netmask 255.255.255.0" # jail.desktopX ifconfig_lagg0_alias1="inet 192.168.1.11 netmask 255.255.255.0" # jail.subsonic ifconfig_lagg0_alias2="inet 192.168.1.12 netmask 255.255.255.0" # jail.seedbox ifconfig_lagg0_alias3="inet 192.168.1.13 netmask 255.255.255.0" # jail.test ifconfig_lagg0_alias4="inet 192.168.1.14 netmask 255.255.255.0" # jail.virtualbox ifconfig_lagg0_alias5="inet 192.168.1.15 netmask 255.255.255.0" # Intel PCI 100Mb network_interfaces="fxp0" ifconfig_fxp0="dhcp" # options communes hostname="Zurpatator2.lan" tcp_extensions="YES" ######### # Locales ######### keymap="fr.iso.acc" ########## # Services ########## # Inet inetd_enable="NO" # EZ Jail ezjail_enable="YES"
/boot/loader.conf
# FreeBSD /boot/loader.conf autoboot_delay="3" # Kernel tunables kern.maxdsiz="700000000" # Set the max data size zfs_load="YES" ahci_load="YES" vboxdrv_load="YES" vfs.root.mountfrom="zfs:sys_tank/root" cd9660_load="YES" # ISO 9660 filesystem # Driver ATAPI devices atapicam_load="YES" # The use of applications like cdrdao or cdrecord if_lagg_load="YES" nvidia_load="YES"
/etc/sysctl.conf
# $FreeBSD: src/etc/sysctl.conf,v 1.8.34.1.6.1 2010/12/21 17:09:25 kensmith Exp $ # # This file is read when going to multi-user and its contents piped thru # ``sysctl'' to adjust kernel values. ``man 5 sysctl.conf'' for details. # # Uncomment this to prevent users from seeing information about processes that # are being run under another UID. #security.bsd.see_other_uids=0 kern.module_path=/boot/kernel;/boot/modules;/usr/local/modules net.inet.tcp.sendbuf_max=16777216 net.inet.tcp.recvbuf_max=16777216 kern.ipc.maxsockbuf=8192000 net.inet.tcp.rfc1323=1 net.inet.tcp.sack.enable=1 net.inet.tcp.inflight.enable=0 net.inet.tcp.sendspace=1024000 net.inet.tcp.recvspace=1024000 net.inet.udp.recvspace=1024000
configuration de base
#!/bin/sh ############################ ### Configuration du système ############################ # set root password passwd root # Mail cd /etc/mail make aliases # Time Zone cd /etc/ ln -s /usr/share/zoneinfo/Europe/Paris localtime # cvsup cp /usr/share/examples/cvsup/stable-supfile /usr/src/ cp /usr/share/examples/cvsup/ports-supfile /usr/src/ echo 'Edit du fichier /usr/src/stable-supfile' echo 'modifier la ligne :' echo 'default host=cvsup1.fr.FreeBSD.org' read -p "Appuyer sur une touche pour continuer ..." ee /usr/src/stable-supfile ee /usr/src/ports-supfile ################################ ### Copie des fichiers de config ################################ cp /etc/rc.conf /etc/rc.conf.dist cp /etc/sysctl.conf /etc/sysctl.conf.dist cp /boot/loader.conf /boot/loader.conf.dist # Kernel cd /usr/src/sys/amd64/conf/ cp GENERIC zurpatator2 ######################## ### Config système ######################## ################### ### Security Tweaks ################### chmod 640 /var/log/messages ############ ### Ports ### ############ # met à jour les ports portsnap fetch extract update # Ports management cd /usr/ports/ports-mgmt/portupgrade && make config-recursive && make install clean # fail lors de l'install de gcc, donc install à part cd /usr/ports/archivers/unzip && make config-recursive && make install clean # Compile tools portinstall gcc # tools portinstall wget sudo nano gzip logrotate portinstall ezjail echo 'security.jail.allow_raw_sockets=1' >> /etc/sysctl.conf echo 'ezjail_enable="YES"' >> /etc/rc.conf # Shells portinstall bash cd /bin/ ln -s /usr/local/bin/bash echo '/bin/bash' >> /etc/shells
mise à jour du kernel
#!/bin/sh # Clean cd /usr/src make clean # Récuperer les sources à jour cvsup stable-supfile # Compile le nouveau monde make buildworld -j4 # Compile le nouveau noyau make buildkernel -j4 KERNCONF=zurpatator2 make installkernel KERNCONF=zurpatator2 # reboot echo "" echo "" echo "reboot necessaire (shutdown -r now) !!" echo "" echo ""
mise à jour du monde
#!/bin/sh cd /usr/src #mergemaster -p make installworld make delete-old make delete-old-libs #mergemaster -U -i make delete-old-libs portsnap fetch update # retype root passwd passwd # reboot echo "reboot necessaire (shutdown -r now) !!"
installation de Xorg (avec les drivers nvidia)
#!/bin/sh ######################## ### Install X server ### ######################## # Xorgx portinstall xorg xorg-drivers liberation-fonts-ttf x11/nvidia-driver nvidia-xconfig nvidia-settings # Configure X cd /root/ X -configure mv xorg.conf.new /etc/X11/xorg.conf echo 'nvidia_load="YES"' >> /boot/loader.conf # Localisation cd /usr/local/etc/hal/fdi/policy/ fetch http://192.168.1.96/zurp_fs/misc/x11-input.fdi echo 'setenv LANG fr_FR.UTF-8' >> /etc/csh.login echo 'setenv MM_CHARSET UTF-8' >> /etc/csh.login echo 'setenv LC_ALL fr_FR.UTF-8' >> /etc/csh.login #echo "exec ck-launch-session gnome-session" >> /root/.xinitrc
x11-input.fdi
<?xml version="1.0" encoding="UTF-8"?>
<deviceinfo version="0.2">
<device>
<match key="info.capabilities" contains="input.keyboard">
<merge key="input.xkb.layout" type="string">fr</merge>
</match>
</device>
</deviceinfo>
netatalk (partage mac)
# installe netatalk via les ports # veiller à ajouter l'option 'PAM' lors de la config portinstall avahi netatalk # installe les fichiers de config cd /usr/local/etc/ fetch http://192.168.1.96/zurp_fs/usr_conf/afpd.conf fetch http://192.168.1.96/zurp_fs/usr_conf/netatalk.conf fetch http://192.168.1.96/zurp_fs/usr_conf/AppleVolumes.default fetch http://192.168.1.96/zurp_fs/usr_conf/AppleVolumes.timemachine echo 'lagg0' >> /usr/local/etc/atalkd.conf # configure le daemon dans /etc/rc.conf echo '# Netatalk & AFP' >> /etc/rc.conf echo 'netatalk_enable="YES"' >> /etc/rc.conf echo 'afpd_enable="YES"' >> /etc/rc.conf echo 'cnid_metad_enable="YES"' >> /etc/rc.conf echo '' >> /etc/rc.conf # Installe les services avahi cd /usr/local/etc/avahi/services fetch http://192.168.1.96/zurp_fs/usr_conf/avahi.services/backup.timemachine.service fetch http://192.168.1.96/zurp_fs/usr_conf/avahi.services/service.netatalk.service # redémarre avahi-daemon /usr/local/etc/rc.d/avahi-daemon restart
afpd.conf
# default: - -tcp -noddp -savepassword -uamlist uams_dhx.so,uams_guest.so,uams_clrtxt.so "timemachine" -tcp -noddp -port 12002 -savepassword -defaultvol /usr/local/etc/AppleVolumes.timemachine -uamlist uams_dhx.so,uams_guest.so,uams_clrtxt.so
samba
# Samba portinstall samba36 samba36-libsmbclient pam_smb # installe les fichiers de config cd /usr/local/etc mv smb.conf smb.conf.dist fetch http://192.168.1.96/zurp_fs/usr_conf/smb.conf chmod 644 smb.conf # configure le service dans /etc/rc.conf echo '# Samba' >> /etc/rc.conf echo 'samba_enable="YES"' >> /etc/rc.conf echo '' >> /etc/rc.conf read -p "pensez à ajouter les membres des groupes 1000 et 1001 dans samba via webmin :)" # Configure le système chmod 644 smb.conf cd /etc ln -s ../usr/local/etc/smb.conf ln -s ..//usr/local/etc/samba cd rc.d ln -s ../../usr/local/etc/rc.d/samba # installe le service dans avahi cd /usr/local/etc/avahi/services fetch http://192.168.1.96/zurp_fs/usr_conf/avahi.services/service.samba.service # redémarre avahi-daemon /usr/local/etc/rc.d/avahi-daemon restart
smb.conf
# Samba config file created using SWAT # from UNKNOWN (0.0.0.0) # Date: 2011/03/31 12:17:55 [global] dns proxy = No log file = /var/log/samba/log.%m netbios name = Zurpatator2 server string = Zurpatator2 guest account = media workgroup = WORKGROUP security = user os level = 20 null passwords = yes encrypt passwords = yes max log size = 50 ;[printers] ; comment = All Printers ; path = /var/spool/samba ; printable = Yes ; browseable = No [Ti_nicO] comment = Ti nicO Docs path = /home/Ti_nicO valid users = "Ti nicO" public = no writable = yes printable = no [Aurel] comment = Aurel Docs path = /home/aurel valid users = "aurel" public = no writable = yes printable = no [Mediatheque] path = /home/media comment = Mediatheque public = yes writable = yes printable = no write list = @user [public] path = /home/public public = yes only guest = yes writable = yes printable = no
