I had tried FreeBSD on an x86 machine about eight years ago and really liked it: good install, nice tools, excellent documentation. FreeBSD is the glitter of the BSD’s for it’s x86 centrality. So when I heard that FreeBSD was available for PowerPC’s I decided right away to try. Ok, it’s been a couple years, but I haven’t been in these circles lately. This is a guide to getting started on FreeBSD with the PowerPC differences being noted.
Read the whole guide before deciding to commit to FreeBSD. FreeBSD is still a newcomer to the PPC world and requires a good amount of attention. Or you might just want to help it out anyway.
Here are some Things You Just Learn As You Go
-
Always check the hardware compatibility list, and the architecture faq. I missed this second one which told me alot too late.
-
Check and see if the if the packages you need are supported for your platform. This is FreeBSD’s fault there is no mention about the ports which I’ll get to later.
-
Take the time and try to get to know someone in the ircchannel. No offense to the guys are #freebsd (a couple were very very helpful) but for the most part they are busy developing or working and they knew do book-loads of documentation for handbook and don’t want to repeat themselves.
-
Take your time with it. I thought coming from Linux I’d feel right at home but some tools are completely different – even versions of tools you have in Linux work slightly different.
The BSD that’s Right For You
Before you get into one BSD, all three are pretty unique, make sure you choose the right one. I got this great detail from jdbaker’s page (it’s several years old) but details it nicely.
FreeBSD
…the one with the most bells and whistles is FreeBSD… FreeBSD has the largest development team, the largest user base, the largest number of ported applications, and the largest collection of active e-mail lists. It also has the best documentation… FreeBSD is extremely easy to install directly via an Internet connection.
FreeBSD currently runs on Intel-compatible 32-bit processors (including the AMD Athlon) and on the DEC Alpha processor (now out of production), and is being ported to Itanium, AMD’s x86-64 (Opteron/Sledgehammer), PowerPC, and Sparc64. While porting the operating system helps to flush out subtle bugs, portability is not FreeBSD’s specialty– it’s primarily of interest to owners of Intel-compatible hardware.
OpenBSD: Rock Solid Security, Fanatical Attention to Detail
OpenBSD is the perfectionist’s version of BSD. Almost Spartan compared to the others, it installs with many features intentionally disabled to avoid potential security holes. Its highly focused development team is constantly tweaking, critiquing, and auditing every line of the code, and their commitment to excellence shows in the operating system’s track record…
OpenBSD requires more technical knowledge and skill to use effectively than FreeBSD, and therefore is not the best choice for beginners… OpenBSD is available and actively developed for a wide range of hardware platforms, from x86 to Mac to Sun. It does not, however, cover as many platforms as does NetBSD…
NetBSD: Now playing everywhere
NetBSD is the portability champ of the BSDs, running on everything from generic x86 boxes to exotic hardware such as the BeBox and the Sega Dreamcast…. Keeping the operating system portable means keeping the code clean, and so the other BSDs often borrow code from NetBSD…
FreeBSD Beginning
FreeBSD can be downloaded and put on a cd:
FreeBSD’s PowerPC installer has limited support for partitioning a disk. I discovered it was easiest to use mac-fdisk. I booted up my Minimal InstallCD and partitioned on a 10G disk as:
partition2 /usr 3.0G
partition3 / 4.3G
partition4 /tmp 500M
partition5 /var 700M
mac-fdisk:
c # create partition
1p # 1st partition…
1100M
swap # name of partition
c
2p
3G
usr
c
3p
4500M
root
c
4p
500M
tmp
c
5p
var
I bobbed a bit from the FreeBSD recommendations. They recommended most the disk space should go to /usr and very little to root. I planned to do back ups to / though and made it bigger, but /usr may not have been big enough – /usr can fill up really fast with packages and the ports tree. If building a mail-server /var should be much larger and closer to the top.
Beginning Install
On older Newworld Power Macs the cd will not boot by holding down C, rather it has to be invoked from Open Firmware. Hold down Apple+Option+O+F at boot and type in this to boot the CD.
The FreeBSD Handbook is excellent documentation so I’ll just give a quick glance here and note differences in the PPC installer.
The arrow keys, space, and tab will navigate through the installer, read the quick start guide and other docs – they’re not that big.
Options
NFS Secure yes, DHCP yes PCCard NO, set ftp username and password, /usr/bin/vi, media type CD.
Don’t worry if you forget anything you can latter enter sysinstall from disk and add what you need in configure post install.
Beginner Install Notes
Theres no console keymap selector yet but USB keyboards are supported. The disk editor is a trimmed down version of the one in the install guide, but with the disk already partitioned Iwas able to apply partitions to mount points. There’s also no boot manager setup and we’ll have to use Open Firmware again later to boot the new install.
When it come to Distribution types choose Kern-Developer so that the ports tree is added as well as the kernel sources (a custom kernel will likely have to be built). Now you will have to wait a bit as the files get loaded to disk.
Configuring Network
A few network questions will be asked: DHCP, Gateway (for use as a network route which is what I’m doing), NO to inetd (very very insecure)… Don’t bother connecting to the network now as the install has no firewall and wouldn’t be secure. Besides with no packages available (besides the CD ones) it doesn’t do any good at this stage anyway.
No systemconsole settings or timezone. When you exit you’ll be asked to use UTC or local time. If this is the only OS you install on this machine choose UTC.
No Linux Compatibility or Mouse Settings. You’ll now get a message, “Unable to target packages/INDEX file from the selectedmedia” because you’re not connected to the internet but I doubt it would work even if you were.
Setup other users, When you get to “Visit the general configuration menu for a chance to set any last options?” I said yes and added ntpdate.
First Boot
Grehan said this the best:
Here’s the rub: OpenFirmware doesn’t understand UFS2. It does understand iso9660 and HFS+, so the loader must live on a disk/partition of that type. So, you can…:
Define your own / hard-disk parition.
FreeBSD Details
Alot of utilities in FreeBSD match those in Linux but at times provide a slight different flavor.
/etc/rc.conf is a general one-in-all configuration file for FreeBSD. rc.conf will have options to start services, configure network cards… /etc/inetd.conf will allow connections on ports and pass control of the connection to whichever program is listed.
Getting Hardware Working
During the boot process you may see that FreeBSD sees a device but will tell you (no driver attached). If you missed the boot up messages, you can look at them with:
FreeBSD will only load what it’s told to or what is built into the kernel. If your devices are on the hardware supported list then your device must be a module that was not loaded. Look in /usr/src/sys/conf/NOTES or better /usr/src/sys/<yourarch>/conf/NOTES and discover what the modules name is. Then locate the <module>.ko file:
The realtek chip I have on my network card wasn’t automatically loaded. To load a module:
kldstat will show loaded modules. Also check dmesg to see if it loaded correctly. To have it load permanently on boot add it to /boot/loader.conf (this file may have to be created).
re_load=”YES”
You can see helpful examples of loader.conf stuff in /usr/share/examples/bootforth/ and “man loader.conf”.
*_type Defines the module’s type. If none is given, it defaults
*_flags Defines options to pass onto the module
Networking/Firewall/Kernel
Ok, thats long in tooth, I’ll try to make this next part more down to earth.
I don’t do anything without first creating a firewall to protect the pc and to build a firewall a kernel has to be compiled with support for it. When building a custom kernel you can also add any drivers you need and remove the ones you don’t for a leaner kernel.
FreeBSD provides three different firewalls, from the FreeBSD mailling list:
In my option the PF firewall has the easiest to use rule set and built in table functions for automated black listing attacking IP address. Its major weakness is it has very poorly designed logging function that results in very cumbersome usage.
IPFilter comes next. It has easy logging and rules usage. It lacks the auto black listing table building of PF. These two firewalls were ported to FreeBSD from other Unix flavored operating systems. Both have teams supporting and maintaining them.
The final firewall is IPFW that is the first firewall included in FreeBSD many years ago and was developed by the FreeBSD team. IPFW also lacks the auto black listing table building of PF, and its nated rules are much harder to get working using all stateful rules…
PF was originally designed as replacement for Darren Reed’s IPFilter, from which it derives much of its rule syntax. PF looks to be becoming the defacto firewall for FreeBSD and is listed first in the documentation.
Kernel Build
PF by FreeBSD 7.1 isn’t built into the kernel so a custom kernel will need to be built. If you never compiled you own kernel before, don’t fret, if you know your hardware it’s realatively simple. There’s a configuration file where you enable any hardware and options:
cp GENERIC POWERMACG4
vi POWERMACG4
/usr/src/sys/conf/NOTES will better describe the drivers and options available but it’s best not to add drivers/options from it as they are probably not supported in the PowerPC kernel yet. Also look at at “man <driver>” for more details about drivers and what other driver/options they depend on.
I uncommented the realtek-driver and took out a couple drivers I didn’t need:
device miibus
Here are the other options I did. I passed safe-cflags for this particular Power Mac in CONF_CFLAGS. Though the kernel doesn’t support altivec, GCC (the compiler) does, which will help build the kernel quicker. I also had to tolerate denying strict aliasing (which is normally a good idea to leave in) because the pf driver and a couple others refused to build with strict aliasing:
cpu OEA
ident POWERMACG4
maxusers 0 # Auto sizing of memory tables
makeoptions CONF_CFLAGS=”-mcpu=7400 -O2 -pipe -maltivec -mabi=altivec -fno-strict-aliasing”
makeoptions KERNEL=POWERMACG4
All other modules, drivers should be left in unless you know what you’re doing. The 7.1 powerpc kernel is still relatively young and the kernel config has all the options it needs or are available, tinkering too much will likely only bring problems.
Now build your kernel and install it:
make buildkernel KERNCONF=POWERMACG4
make installkernel KERNCONF=POWERMACG4
If there is an error in your config gcc will recognize it and exit defining the config file followed by the line in doesn’t understand: .../usr/src/sys/powerpc/conf/POWERMACG4:7
Or it will tell you options that are not allowed. “installkernel” will transfer your kernel to the boot directory and have it load automatically at boot.
Before you reboot your computer you may as well set up your firewall so that it will load at boot and you can get on the network.
Firewall Bricks
The rc.conf file will need to be edited so that PF will be loaded at boot:
pf_rules=”/etc/pf.conf” # rules definition file for pf
pf_flags=”” # additional flags for pfctl startup
pflog_enable=”YES” # start pflogd
pflog_logfile=”/var/log/pflog” # where pflogd should store the logfile
pflog_flags=”” # additional flags for pflogd
Most times when you see an “*_enable” listing in rc.conf, it is a daemon and can manually started (e.g. /etc/rc.d/pf start) or else the system will need to be restarted for the daemon to load.
Rules Building
The /etc/pf.conf file is the configuration file for the firewall. All rules for the firewall are put here. PF goes by the policy of “last match win”. That means that is a ruleset has a rule to “block all” before a rule allowing traffic that traffic will be allowed.
A few things to watch for when doing rules:
- “Last match wins” except for “quick” which disables any further rule processing for that packet.
- Alot of people use the policy: allow all out and filter in. This is good in most cases.
- ORDER is very very important. A missed placed rule, option, table, queing will not allow PF to load.
I’m not going to give my firewall out (it’s not there yet) but here’s a template to follow (NIC’s) can be found out with ifconfig:
# Firewall for router with two NIC’s (Network Cards)
# http://bash.cyberciti.biz/firewall/pf-ipv6-ipv4-firewall-for-freebsd-openbsd-netbsd/
# http://www.openbsd.org/faq/pf
#
# ! PF on FreeBSD 7.1 (OpenBSD 4.1) !
#
################ FreeBSD pf.conf ##########################
# Required order: options, normalization, queueing, translation, filtering.
# Note: translation rules are first match while filter rules are last match.
################ Macros ###################################
# — List Variables (Macros) —
# Define Network Interface Cards (NIC)s.
WAN_NIC=”<YOURNIC>”
LAN_NIC=”<YOUROTHERNIC>”
# Define LAN Address(s)
MYNAME-PC=”192.168.2.10″
# Ports to open for network services
# ssh, https, smtp nix, www, pop3, auth, ftp, sftp, imap
# auth, domain, ftp, imap, imaps, https, pop3, pop3s, ntp, sftp, smtp, spamd
# ssh, www
#TCP_SERVICES = “{ ftp, ftp-data, https, www }”
TCP_SERVICES = “{ domain, ftp, ftp-data, https, www }”
UDP_SERVICES = “{ domain, ntp }”
# Pings Allowed
# ping options: echorep – echo reply, echoreq – echo request,
# unreach, unreachable, timex…
# DNS server will need at least echoreq
#ICMP_TYPES = “echoreq, unreach”
ICMP_TYPES=”echoreq”
# — Tables —
# table define for all subnets and ips to block
# add ips and subnets to /etc/pf-nat-home-blocked.conf
table <blockedip> persist file “/etc/pfblocked.conf”
# — Options —
# Default response for block filter rules and turns on statistics logging.
set block-policy drop
set loginterface $WAN_NIC
set require-order yes
# Aggresively expire connections, reduce memory at cost of dropping idle
set optimization aggressive
# — Traffic Normalization —
# Normalization – reassemble packets and resolve or reduce traffic
# ambiguities. Also helps with troublesome SYN/FIN packets.
scrub in all
# — Traffic Shaping (Queing) —
# — Translation Rules (NAT) —
# — Filter Rules —
# last match wins (except quick)
# Antispoof
antispoof log quick for lo0 inet
# — Block —
# Block all incoming
block in all
# — Allow TCP —
# — Allow UDP —
To check your PF configuration for errors, run:
Setup Networking
To setup your NIC in rc.conf:
ifconfig_<LAN NIC>=”inet 192.168.1.222 netmask 255.255.255.0″
Your hostname will need to be set too. The best I could figure it is look in your Windows, Mac, Linux(/etc/resolve.con), Networking program and look for search address. On Linux it came before the DNS servers and looked like: lookup.isp.domain.com.
Replace search with the hostname you want to call your pc.
Reboot
Reboot your computer add you network cable and if all goes well, you have a new kernel load with firewall as a bonus. If it doesn’t just go back and select and select the old kernel (kernel.old) in Open Firmware.
A Few PF Commands
pfctl -e # Enable PF – required won’t do it starting init
pfctl -d # Disable PF
pfctl -sn # Show the current NAT rules
pfctl -sr # Show the current filter rules
pfctl -ss # Show the current state table
pfctl -si # Show filter stats and counters
pfctl -sa # Show EVERYTHING it can show
pfctl -F all # Flush all rules, nat, states, options, tables:
tcpdump -n -e -ttt -i pflog0 # Watch pf logs in real time
Compiler Details
Now that network is going you can begin adding packages to FreeBSD. The first program to add is a lightweight DNS server so I can connect to the LAN, but before doing that the compiler needs to be setup.
Because we have to use the ports collection to add packages the compiler needs to be set up to compile them. With the compiler setup then we’ll compile cvsup to update the ports tree.
I built my make.conf with known compiler flags for the Power MAC G4 processor for optimized builds and added the CVSup flags that will tell cvsup how to work:
CHOST=”powerpc-unknown-linux-gnu”
CFLAGS=”-mcpu=7400 -O2 -pipe -maltivec -mabi=altivec”
CXXFLAGS=”${CFLAGS}”
# CVSup options
SUP_UPDATE=yes
SUP= /usr/local/bin/cvsup
SUPFLAGS= -g -L 2
SUPHOST= cvsup4.us.freebsd.org
SUPFILE= /usr/share/examples/cvsup/standard-supfile
PORTSSUPFILE= /usr/share/examples/cvsup/ports-supfile
Package Compile
If we were on a system supporting pre-build packages, adding a package would be easy:
However, since PPC users don’t have a package repository packages must be built with source-code. If you didn’t add the ports collection, go back into sysintall (in configuration) and install it now. You might also want to choose a nearby FTP (in Options). The ports tree will likely need to be updated the best way to do this is with cvsup. Cvsup will need to be installed first:
make install distclean clean
‘distclean‘ removes the downloaded source file and ‘clean‘ removes the compiling files.
Each time you update the ports tree make sure you run ‘make index’ to build an index file.
make index
Give yourself some time as this process can take awhile.
About updating grom Matthew on the FreeBSD mailing list:
…recommended (if you choose this route) that the first port
you install should be sysutils/portupgrade, then use portupgrade to
install everything else.
portsdb -U will update the ports tree and make an index (though cvsup is supposed to be faster).
Other FreeBSD Utils
pkg_delete <package-name-version> # To delete a package
portsclean -CD # To delete the downloaded sources
portupgrade <package-name-version> # To upgrade a port use
# To compare the installed package with the one in the ports tree:
pkg_version <package>
To find a port with it’s information:
make search name=lsof
make search key=string # searches names, comments, descriptions, and dependencies.
ports-mgmt/portaudit which will automatically check all installed applications for known vulnerabilities; a check will be also performed before any port build.
Send a BugReport
DHCP
To be able to connect the LAN to the internet defining static-routes turned out to be a humungous task, so I decided to install a DNS server on the Network Router to define routes for me rather trying to manually define them.
FreeBSD by default installs BIND the well-known industry-standard of name servers. BIND is powerful and robust but is overkill for a Network Router serving one or two machines and a pc that only as 512 of memory.
Adieu
I really like FreeBSD and I wanted to build it. I’m done a backup and haven’t made up my mind to what I’m going to do. For now I just need to find out how to get a network router up and running.
Resources
There’s alot of attribution going out. To the guys at #freenode, thanks understanding my Linux-presupposition. And to JohnBlue in the FreeBSD forums when I made things tougher than they needed to be. A big thanks to cyberciti who had a lot of good tips on configuring FreeBSD. And anyone elses wikis, blogs that Iread. FreeBSD makes me want to get an x86. :)
Linux Tidbits 
I’ll try it on my Pegasos G3, just for fun — afaik it’s not supported by FreeBSD, but I’ll take a try :)
Gotta know if it-works. If it doesn’t try OpenBSD, it has better hardware support:
After some reading, it seems not possible to boot it well on this machine :D. Of course I’ll try it, but later because I have not much spare time. OpenBSD doesn’t supports it because of some bullshiting between the developers and the hardware manufacturer.
It’s not possible to use CVSup on powerpc because it’s written in modula-3.
The recommended alternative even on x86 now is csup, which comes default since 6.2 and is implemented in C.
You’ll find freebsd/ppc is actually quite ok.
Good to know Horst. Yeah, iwas wondering about that, didn’t quite get to that point though. i do plan to give freebsd another try when i get the oppurtunity.