Skip to main content.

Keeping your BSD up to date

2014-06-25

Live demo in BSD Now Episode 043. Originally written by TJ for bsdnow.tv | Last updated: 2014/06/25

NOTE: the author/maintainer of the tutorial(s) is no longer with the show, so the information below may be outdated or incorrect.

Whether you've got a single laptop or a whole cluster of servers, keeping your system(s) up to date and patched is critical. Fortunately, it's pretty simple to do so in most of the BSDs. This tutorial will show you how to keep both the base system and third party applications up to date on both FreeBSD and OpenBSD.


FreeBSD

By now, you've probably learned the difference between -RELEASE, -STABLE and -CURRENT. Today we're assuming you are just following the normal -RELEASE branch. To patch your base system patched for security and errata, simply do:

# freebsd-update fetch install

Looking up update.FreeBSD.org mirrors... 5 mirrors found.
Fetching metadata signature for 9.2-RELEASE from update2.freebsd.org... done.
Fetching metadata index... done.
Inspecting system... done.
Preparing to download files... done.

And with that, you're patched. You may need to restart services or reboot the system, depending on what was upgraded. Please take note of which versions are supported. If you wanted to jump from one major version to another, the freebsd-update command also does that.

# freebsd-update upgrade -r 10.0-RELEASE

This works for -BETA, -RCx and -RELEASE versions. If you want -STABLE or -CURRENT, consult the previously-mentioned tutorial. During this upgrade process, you will be asked to merge configuration files and reboot twice. Maybe binary upgrades aren't your thing though, or you want to customize part of the system you're using. In that case, the traditional source-based method of upgrading might be better for you. We'll show the same two scenarios as before. This will assume you don't have the source code in /usr/src already. You will need subversion installed for this process. We'll be using 10.0-RELEASE as the example, so change that to whatever version you're running.

# rm -rf /usr/src
# svn co https://svn0.us-east.freebsd.org/base/releng/10.0 /usr/src

This will give you an up-to-date source tree for 10.0-RELEASE, including all security patches. To upgrade your source tree in the future, just run:

# svn update /usr/src

If the kernel was affected and needs rebuilding, do:

# cd /usr/src
# make -j `sysctl -n hw.ncpu` buildkernel  ## Add "KERNCONF=yourkernelname" if you did a custom kernel.
# make installkernel                       ## Add "KERNCONF=yourkernelname" if you did a custom kernel.
# cd /usr/obj && chflags -R noschg * && rm -rf *
# reboot

Or if a part of the userland was vulnerable:

# cd /usr/src
# make -j `sysctl -n hw.ncpu` buildworld
# make installworld
# cd /usr/obj && chflags -R noschg * && rm -rf *

A reboot may or may not be needed, depending on what was changed. Be sure to read the security advisory for more information about any services that might need to be restarted. So how do you know when you need to update your system? Subscribe to the announce list and get notified automatically! It's that easy. You've also probably learned about ports, packages and even building your own repository, so how do updates tie into all of those? You have a number of options. Each of those tutorials goes into detail about staying up to date, so choose the one that matches what you're using.


OpenBSD

Likewise, OpenBSD has different branches you can use. We'll assume you're running the normal -release branch here. Security fixes and other major problems are fixed via errata patches. Usually, you'll only need to recompile one thing per errata patch, instead of the whole userland. This has the benefit of taking a lot less time, but the downside is you have to actually read through each patch to know what needs to be updated. You can, of course, rebuild the whole userland if you want to. In this example, I'll fix a problem in the ftp command in 5.5. This is assuming you don't have the source code in /usr/src already.

# cd /usr/src
# ftp http://ftp.usa.openbsd.org/pub/OpenBSD/5.5/src.tar.gz \
      http://ftp.usa.openbsd.org/pub/OpenBSD/5.5/sys.tar.gz \
      http://ftp.usa.openbsd.org/pub/OpenBSD/5.5/SHA256.sig
# signify -C -p /etc/signify/openbsd-55-base.pub -x SHA256.sig src.tar.gz
# signify -C -p /etc/signify/openbsd-55-base.pub -x SHA256.sig sys.tar.gz
# tar xzf src.tar.gz
# tar xzf sys.tar.gz
# rm src.tar.gz sys.tar.gz SHA256.sig

Now that we have the source code for both the userland and kernel, we can download the errata patch and apply it.

# cd /usr/src
# ftp http://ftp.openbsd.org/pub/OpenBSD/patches/5.5/common/003_ftp.patch.sig

After checking the patch, we learn that the next steps are:

# signify -Vep /etc/signify/openbsd-55-base.pub -x 003_ftp.patch.sig -m - | (cd /usr/src && patch -p0)
# cd /usr/src/usr.bin/ftp
# make obj
# make
# make install
# rm -rf /usr/obj/* /usr/src/003_ftp.patch.sig

Each errata patch will have different instructions, so be sure to read them carefully. Errata patches are announced on the announce list, so subscribe to that. You can also set up a cron job to monitor the errata page for changes. Major version upgrades in OpenBSD are handled a bit differently than FreeBSD. Instead of a tool to upgrade the system, you download the new "bsd.rd" ramdisk kernel and boot from that. Once booted, it presents you with an "(U)pgrade" option for going to the next version. As an example, going from 5.4 to 5.5, we'll do so now. 5.4 didn't actually have the signify command yet, but let's pretend it did.

# ftp -o /bsd.rd http://ftp.usa.openbsd.org/pub/OpenBSD/5.5/`machine`/bsd.rd
# ftp http://ftp.usa.openbsd.org/pub/OpenBSD/5.5/`machine`/SHA256.sig
# signify -C -p /etc/signify/openbsd-55-base.pub -x SHA256.sig /bsd.rd
# rm SHA256.sig
# reboot

You will need console or VGA access at this point. It's possible to jump versions over SSH, but doing so is a bit more involved. At the boot prompt, type "bsd.rd" and hit enter. The "(U)pgrade" option will do most of the work for you at this point, but there are usually more steps involved. You'll need to merge the /etc sets with sysmerge upon a successful reboot. Be sure to read the upgrade guide for your release before attempting an upgrade. It will detail all the specific steps needed, including any workarounds. It also includes the upgrade method for remote systems without console access. Finally, check our ports and packages tutorial for the details on keeping third party software up to date.

Latest News

New announcement

2017-05-25

Hi, Mr. Dexter. Also, we understand that Brad Davis thinks there should be more real news....

Two Year Anniversary

2015-08-08

We're quickly approaching our two-year anniversary, which will be on episode 105. To celebrate, we've created a unique t-shirt design, available for purchase until the end of August. Shirts will be shipped out around September 1st. Most of the proceeds will support the show, and specifically allow us to buy...

New discussion segment

2015-01-17

We're thinking about adding a new segment to the show where we discuss a topic that the listeners suggest. It's meant to be informative like a tutorial, but more of a "free discussion" format. If you have any subjects you want us to explore, or even just a good name...

How did you get into BSD?

2014-11-26

We've got a fun idea for the holidays this year: just like we ask during the interviews, we want to hear how all the viewers and listeners first got into BSD. Email us your story, either written or a video version, and we'll read and play some of them for...


Episode 220: Opening ZFS in 2017

2017-11-15

Direct Download:HD VideoMP3 AudioTorrent This episode was brought to you by Headlines The First PS4 Kernel Exploit: Adieu The First PS4 Kernel Exploit: Adieu Plenty of time has passed since we first demonstrated Linux running on the PS4. Now we will step back a bit and explain how we managed to jump...

Episode 219: We love the ARC

2017-11-08

Direct Download:HD VideoMP3 AudioTorrent This episode was brought to you by Headlines Papers We Love: ARC: A Self-Tuning, Low Overhead Replacement Cache Ever wondered how the ZFS ARC (Adaptive Replacement Cache) works? How about if Bryan Cantrill presented the original paper on its design? Today is that day. Slides It starts by looking back at a fundamental paper...

Episode 218: A KRACK in the WiFi

2017-11-01

Direct Download:HD VideoMP3 AudioTorrent This episode was brought to you by Headlines FreeBSD 10.4-RELEASE Available FreeBSD 10.4-RELEASE is out. The FreeBSD Project dedicates the FreeBSD 10.4-RELEASE to the memory of Andrey A. Chernov. Some of the highlights: 10.4-RELEASE is the first FreeBSD release to feature full support for eMMC storage, including eMMC partitions, TRIM...

Episode 217: Your questions, part II

2017-10-25

Direct Download:HD VideoMP3 AudioTorrent This episode was brought to you by Headlines OpenBSD 6.2 Released OpenBSD continues their six month release cadence with the release of 6.2, the 44th release On a disappointing note, the song for 6.2 will not be released until December Highlights: Improved hardware support on modern platforms including ARM64/ARMv7 and octeon,...