✎ infra:servers:updatingfreebsd [ABI Knowledge Base]

You've loaded an old revision of the document! If you save it, you will create a new version with this data.

====== Updating FreeBSD Servers ======

All four physical hosts run FreeBSD. Upgrade them in this order:

- mustafar
  - hoth
  - geonosis
  - bane

This order matters: start with the least critical server so any issues are caught early.

===== OS Patches =====

SSH into the server and become root:

<code>
ssh mustafar
su -
</code>

Check for available updates:

<code>
freebsd-rustdate check-fetch
</code>

Fetch and install patches:

<code>
freebsd-rustdate fetch
freebsd-rustdate install
</code>

===== Packages =====

Review automatically installed packages -- decide what to keep and what to remove:

<code>
pkg noauto
</code>

Then update and upgrade all packages:

<code>
pkg update
pkg upgrade
</code>

===== Before Rebooting =====

Before restarting, check who is currently connected:

<code>
root@mustafar:~ # sockstat -4
USER COMMAND      PID FD PROTO LOCAL ADDRESS         FOREIGN ADDRESS
root sshd-sessi 79454  7 tcp4  172.20.200.90:22      172.20.96.2:40808
root sshd-sessi 78971  7 tcp4  172.20.200.90:22      172.20.96.2:40808
root sshd       47125  7 tcp4  *:22                  *:*
root nfsd       34681  7 tcp4  *:2049                *:*
ntpd ntpd        3208 21 udp4  *:123                 *:*
ntpd ntpd        3208 22 udp4  172.20.200.90:123     *:*
ntpd ntpd        3208 25 udp4  127.0.0.1:123         *:*
??   ??            ?? ?? udp4  *:2049                *:*
</code>

If you need more detail on connections:

<code>
root@mustafar:~ # netstat -4
Active Internet connections
Proto     Recv-Q Send-Q Local Address          Foreign Address        (state)  
tcp4           0    108 mustafar.ssh           172.20.96.2.40808      ESTABLISHED
udp4           0      0 localhost.ntp          *.*
udp4           0      0 mustafar.ntp           *.*
</code>

When you've confirmed it's safe to reboot:

<code>
shutdown -r now
</code>

The ''-r'' flag tells the system to reboot.

===== Jails and VMs =====

Some servers have jails and VMs that need attention after reboot.

==== Jails (bane, geonosis) ====

Jails on bane and geonosis start automatically on boot.

==== VMs (bane) ====

VMs on bane need to be configured for auto-start. For example, to enable ''scontrol-01'':

<code>
root@bane:~ # sysrc vm_list="scontrol-01"
root@bane:~ # cat /etc/rc.conf| grep vm_list
vm_list="scontrol-01" 
</code>

Confirm auto-start is enabled:

<code>
root@bane:~ # vm list
NAME          DATASTORE  LOADER  CPU  MEMORY  VNC  AUTO     STATE
mitte-dev-01  default    uefi    1    4G      -    No       Stopped
scontrol-01   default    uefi    2    4G      -    Yes [1]  Running (5469)
</code>

==== Updating Jails ====

Aside from all the jails on the bane server and others, we have a status page jail running UptimeKuma. For understandable reasons, this jail must outlive the other ones to be able to notify us about the others' instability from time to time. So UptimeKuma is held in a remote FreeBSD server in chicago called bespin (taken from Vultr), in a jail called st-01.

What is specific about this Bespin server: it is NOT pkg-base; meaning you cannot use pkg to update/upgrade the OS. So there are two ways to upgrade freebsd in respect with it being pkg-base or NOT pkg-base.

The jail st-01 /for astatus.abi.am/ uses pkg-base (Using pkg for updating the base. That's why its called package base. This is a relatively new practice in freeBSD available since 15.0. Before pkg update/upgrade people would use freebsd-update or freebsd-rustpdate [neo alternative] for updating the OS. See /etc/pkg/base for further information.

So in Bespin, the /etc/pkg/FreeBSD.conf had a field saying freebsd-base{..., enabled: no, ...} meaning it is not pkg base. FAQ: Yes, there is a way to migrate it to pkg base, look that up!

==== Updating pkgbase Jails =====

mount -t devfs devfs <path/to/jail>/dev
pkg-static -c </path/to/jail> update && pkg-static -c </path/to/jail> upgrade

==== Updating NOT pkgbase Jails ====

you can use update or rustdate ON the jail, by giving the freebsd-rustdate command the path of base with -b flag and the path of the updating tool with -w, and passing the subcommand at the end to be executed։

freebsd-rustdate -b /path/to/jail -w /path/to/jail/var/db/freebsd-update/ <subcommand>

More precisely in our case we run:

freebsd-rustdate -b /usr/local/jails/<jailname> -w /usr/local/jails/<jailname>/var/db/freebsd-update/ check-fetch
freebsd-rustdate -b /usr/local/jails/<jailname> -w /usr/local/jails/<jailname>/var/db/freebsd-update/ fetch
freebsd-rustdate -b /usr/local/jails/<jailname> -w /usr/local/jails/<jailname>/var/db/freebsd-update/ install

===== See Also =====

* [[infra:servers|Server Inventory]]
  * [[infra:virtual_machines|Virtual Machine Mechanics]]

Edit summary