Here I'm republishing an old blog post of mine originally from March 2016. The article has been slightly improved.
A bit over a month ago, I bought my first refurbished laptop. Previously I used a ThinkPad (owned by the company I work for) for on-call duty. It's running a Linux distro which would not be my first choice at all, it has a small screen and - it's not my property. I wanted my own laptop and since we're allowed to use whatever distro we prefer, I thought that I'd be going with Arch.
(I you're just interested in the commands to enter, have a look at the end of this post where I put a list of them.)
On a second thought: Why not use *BSD? For me it would mean going to use a *BSD desktop "in production" after only running it privately and for fun so far. Thanks to the great _BSDNow!_ show, I feel confident enough now to give it a try. The company that I work for is running some FreeBSD servers, too, so it's not something entirely strange and unknown. I went with asking if using BSD for on-call was ok. The answer was what I expected: If I thought that it would work for me I should well try it. The only requirement was that I'd encrypt the disk (the same rule would apply to Linux, too, of course).
Next question: Which BSD to use? Since I'm just getting into *BSD, I'm not really familiar with all of them now. Net and DragonFly would certainly be interesting, but since I need that box for work that's not an option. I need something that I know enough of to be able to work with it. Of course it would be best if I could learn some more at the same time... So, what's the best way to learn more? Probably tracking _-CURRENT_! But what if something breaks? I cannot afford that. And which BSD to use anyway? I work with some FreeBSD servers, so more in-depth FreeBSD knowledge would make sense. Then again I've really come to like Puffy and all he stands for...
That would be a hard decision! Eventually I decided _not to decide_ - and to just install both of them instead. This also has the advantage of having a second system if either -CURRENT should ever break!
I bought an HP EliteBook 8470p. Why didn't I go with Lenovo even though those are known to work best with *BSD and I obviously need something that seriously works? Well, there's one reason for me: With the ThinkPad laptops, the keyboards just totally suck. I have no idea who came up with that sad story of "Hey, let's just put the _Fn_ key where _Ctrl_ belongs and vice versa!". No idea whatsoever. But I know for sure that it drives me insane. Not fun at all when you're working on-call at four AM, barely awake, and nothing happens when you have to CTRL-C something _quickly_. I could never get used to it ever!
So for that very reason it had to be some other hardware. I had this older HP laptop that a friend sold me for a few bucks a while ago. I can't remember which model exactly and cannot look it up since I don't have it anymore. (When my mother's old computer died when I was over on a visit, my father thought about replacing it with a Windows box since that's the only thing that he knows. To avoid that, I set up said old HP laptop that I had with me as a replacement and gave it to her. She's been using it happily since.) That laptop had been a pleasant experience when I had OpenBSD on it and so I decided to give the EliteBook a try.
It works fairly well for most things. On FreeBSD there was the problem with the Intel video driver but since I'm running 11-CURRENT, video is all working great even when I quit X11. WiFi is detected according to dmesg but for some reason no iwn0 shows up if I run ifconfig. I didn't have time to look into that further, however. On OpenBSD backlight gets turned off if I quit X and thus the screen is a bit dark then. Since I usually quit X to shut down the computer afterwards, anyway, that's only a minor issue. WiFi is correctly detected and I confirmed it to work. Suspend works when I close the laptop but when it wakes up the keyboard does not work anymore. These are the only issues that I ran into so far.
FreeBSD can use ZFS while OpenBSD cannot. I'm not sure if FreeBSD's and OpenBSD's UFS/FFS filesystems are compatible (I think OpenBSD's implementation misses quite some of the newer features). The encryption methods used by the systems however are definitely not compatible. So it doesn't matter anyway in this case and I'm free to choose whichever filesystem I want.
Since I'll be compiling FreeBSD-CURRENT now and then (and in general plan to do some stuff that likes much memory to be available), I decided to go with UFS. Yes, there are scenarios where ZFS is simply overkill! There's only one drive in the laptop, it's not extremely big and it won't hold any important data. I have no need for any particular ZFS feature on that system, so going with UFS should be fine. (That plus the fact that I'm still reading Lucas' and Jude's excellent book on ZFS and intend to play with that filesystem on another machine.)
Prior to version 5.9 (released after I originally wrote this), OpenBSD only really supported the MBR partitioning scheme so going with that was an easy choice. I'll stick to it for now because I need some time to play with GPT on OpenBSD first. I'm going to do everything again in a VM so I can easily take screenshots for this article.
The installation begins just like an ordinary FreeBSD install: Boot up the installer media and make your way through the setup questions. When the installer asks about the partitioning however, we're going to do that by hand.
Choosing to partition manually (PNG)
The pure bourne shell is not very comfortable for interactive use, so it generally makes sense to use a more advanced shell (like tcsh) for convenience features like auto-completion. Should you not know which drives your machine has, _camcontrol_ can help you. If you want to start with a clean drive, you can zero out everything with _dd_ (when I bought my laptop, it had Windows 7 on it that I wanted to get rid of).
If you're not familiar with what _partitions_ and _slices_ are, you may want to have a look at an older post where I wrote up a little excursion about that topic.
Installing FreeBSD - a tutorial from the Linux user's perspective (2015)
First an MBR is created and then two slices are added to it. The first one gets 100 gigabytes, the other the rest (which is also 100 GB in my case). Both slices are created aligned to 4k sector size of the hard drive. Then a BSD disklabel is added in the first slice. After that, boot0 (a simple boot manager) is written on the drive and the standard bootcode into the first slice. Finally the first slice is marked as active for booting.
Now three partitions are created inside the BSD label: One for _boot_ (which will hold the kernel and cannot be encrypted), one for swap and one for the system (which will be encrypted). The _glabel_ command is used to give these partitions a more meaningful name than _ada0s1a_ and the like. Since the system partition will be encrypted, it makes sense to write some garbage all across it so that it is impossible to see which part holds data and which does not. This takes quite a while and you could of course skip this. As long as your patience lives up to your paranoia, that little bit of extra security is worth the wait!
Creating and labeling BSD partitions (PNG)
Next the system partition is initialized with _GELI_, one of FreeBSD's two disk encryption methods. I only use a passphrase to unlock but you can also use a key (or both) if you wish. After attaching the new GELI partition, a new GEOM provider, _system.eli_ is available with the clear data for you (and your programs) to use.
Creating and attaching the GELI partition (PNG)
Now it's time to format the two data partitions (the swap partition does not need any formating). You could also use journaling UFS for the boot partition but it's usually not necessary.
Copy over the boot directory and add two lines to _loader.conf_ so that you'll have the chance to unlock your GELI partition during system startup. What remains to be done is writing an _fstab_. Notice that for some reason I've forgotten to put _swap.eli_ in there on my screenshot (even though that's what I have in my script). What this does is using a one-time key for your swap on each boot, thus making sure that any data that remains on the swap partition is useless once the system was powered down once. You do not have to initialize GELI for this. FreeBSD knows what to do when it sees the ".eli" for a swap partition.
Mount the decrypted system partition on /mnt as that's where the installer expects it. And don't forget to create the _clear_ directory as we demand that in fstab and the system would not boot up correctly if it was missing. Then exit the shell and continue with the installer.
Copying over /boot and writing loader.conf and fstab (png)
Once the installation has finished, the installer will ask you if you wish to make any final modifications. Answer "yes" and it will drop you into a shell in a chroot of your new system. Delete _/boot_ (that directory lives on the encrypted system partition and the bootloader could not find the kernel there anyway) and make it a symlink pointing to _/clear/boot_ instead. This step is not actually required. But if you don't do it, you won't be able to update your system the normal way. If you want to only mount the real _/boot_ by hand whenever you upgrade, that's fine, too, of course.
Chosing to make final modifications (PNG)
Exit the shell, reboot and remove the boot media. Then reboot. Your boot manager (boot0) will offer you two FreeBSD systems. Hit _F1_ to boot up FreeBSD. Don't hit F2. There's no system there, yet.
The OpenBSD installer is neither pretty nor does it offer any kind of menu system. However it is simple, effective and straight-forward. Choose to install OpenBSD, set your keymap, enter a hostname, configure the net and set a root password.
Hostname, network and password configuration (PNG)
Choose to run an SSH server by default, whether to prepare the system for X11, if you want the display manager XDM to be started automatically. Create a user now or do so later. When asked for the timezone, give a _!_ instead to drop into a shell.
If you don't know your disks, look inside the _dmesg_ for the name. Now use _fdisk_ to change the type of the second partition from A5 (FreeBSD) to A6 (OpenBSD). Then use _disklabel_ to create a swap partition and a main partition. Make absolutely sure that the later has the type RAID!
Partitioning for OpenBSD (PNG)
Encrypt the new softraid with _bioctl_ then exit the shell. Now enter the correct timezone and choose the newly created softraid for the installation! Dedicate the whole softraid disk to OpenBSD but edit the partitions to fit your need. You do not need a swap partition on the softraid because we created a separat one on the real disk, remember? For that reason, after OpenBSD formated the partitions you created, the installer will ask you if you want to add any other disks before you start the actual installation. You DO because there's the swap area.
Preparing crypto softraid (PNG)
Once the installer has finished, reboot the machine. Now the boot manager says "F1 - FreeBSD" and "F2 - BSD". The second one is your OpenBSD. The manager knows only the partition type and has no clue which system is on there.
Here's what you could type in for the shell parts of both installers:
In the partitioning shell:
tcsh
dd if=/dev/zero of=/dev/ada0 bs=1m
gpart create -s mbr ada0
gpart add -a 4k -t freebsd -s 98G ada0
gpart add -a 4k -t freebsd ada0
gpart create -s bsd ada0s1
gpart bootcode -b /boot/boot0 ada0
gpart bootcode -b /boot/boot ada0s1
gpart set -a active -i 1 ada0
gpart add -t freebsd-ufs -s 2G ada0s1
gpart add -t freebsd-swap -s 4G ada0s1
gpart add -t freebsd-ufs ada0s1
glabel label clear /dev/ada0s1a
glabel label swap /dev/ada0s1b
glabel label system /dev/ada0s1d
dd if=/dev/random of=/dev/label/system bs=1m
geli init -b -s 4096 -l 256 /dev/label/system
geli attach /dev/label/system
newfs /dev/label/clear
newfs -j /dev/label/system.eli
mount /dev/label/clear /media
cp -Rp /boot /media
echo 'vfs.root.mountfrom="ufs:/dev/label/system.eli"' >> /media/boot/loader.conf
echo 'geom_eli_load="YES"' >> /media/boot/loader.conf
echo '/dev/label/system.eli / ufs rw 1 1' >> /tmp/bsdinstall_etc/fstab
echo '/dev/label/swap.eli none swap sw 0 0' >> /tmp/bsdinstall_etc/fstab
echo '/dev/label/clear /clear ufs rw 1 1' >> /tmp/bsdinstall_etc/fstab
mount /dev/label/system.eli /mnt
mkdir /mnt/clear
exit
exit
In the "final modifications" chroot:
rm -r /boot
ln -s /clear/boot /mnt/boot
i
de
puffy
em0
dhcp
none
done
password
no
yes
no
no
!
dmesg | grep [ws]d0
fdisk -e sd0
setpid 1
A6
quit
disklabel -E sd0
a b
ENTER
4G
swap
a a
ENTER
ENTER
RAID
w
q
bioctl -c C -l /dev/sd0a softraid0
exit
Europe/Berlin
sd1
whole
e
*Your layout here*
w
q
sd0
OpenBSD
w
q
done
http
none
openbsd.cs.fau.de
pub/OpenBSD/5.9/amd64
done
done
And that's it. Enjoy!
