View
319
Download
6
Category
Preview:
Citation preview
MOD server and FreeBSD
Kevin Lomsi funtoro
The FreeBSD project
The beginning ...
Why choose FreeBSD
It was chosen by accident
Apart from that, there are a couple of good reasons
Why choose FreeBSD, cont.● The community is always willing to help out● The ports tree contains a large collection of 3rd party
software● Service initialization is simple
rc.conf(5)● Creating a customized memstick/iso is easy
release(7)● The BSD license, high performance network, stable, etc.
ArchitectureFrom http://www.funtoroeurope.com/files/clankove/struktura-bus.jpg
development(7)
Based on -CURRENT; see Benno Rice's talk on keeping current:
https://goo.gl/C5tWYa
Building a memstick/iso on bhyve(4)
Making root file system read only● /etc/fstab:
# Device Mountpoint FStype Options Dump Pass#/dev/gpt/rootfs / ufs ro 1 1
● /etc/rc.conf:
hostid_enable="NO"
sendmail_enable="NONE"
syslogd_enable="NO"
dumpdev="NO"
root_rw_mount="NO"
update_motd="NO"
Making root file system read only,cont.
● A Few things which should be taken care of
3rd party applications such as MySQL
/etc/localtime, /etc/resolv.conf
/var/db/pkg
For example, you might add a line to /etc/rc.d/var that symlinks the directory to /var/db/pkg
Managing services boot orderServices can be skipped during the boot time because impacted services haven't access to resources that haven't been booted yet
Control services boot order with rcorder(8)
# rcorder /etc/rc.d/* /usr/local/etc/rc.d/*
...
/etc/rc.d/moused
rcorder: requirement `usbd' in file `/usr/local/etc/rc.d/hald' has no providers.
/usr/local/etc/rc.d/hald
...
Multicast TFTP server (atftpd)Clients need to download an image of the kernel through TFTP
Unfortunately atftpd only built on Linux machine
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=522192
Ported to FreeBSD (r262417)
Issues and solutions in our deployment
File systems
Networking
File systems
FUSE
MSDOSFS
NTFS
UFS2
EXT2FS
TMPFS
FUSE
FUSE is SLOW
MSDOSFSLack of Unicode support
Added Unicode support to MSDOSFS, SMBFS, and NTFS (r227650, r228023)
Cannot export a msdosfs file system bigger than 128GB with NFS
Doesn't change ctime and mtime
NTFS
Lack of write support
GSoC 2012 project "NTFS for FreeBSD" was based on Apple implementation
Removed NTFS kernel support (r241636, r247665)
Possible solution: Tuxera NTFS kernel driver
UFS2In rw mode, softupdates + journaling = corruption ?!
We disable journaling on all our UFS2 devices and in addition use this:
background_fsck="NO"
fsck_y_enable="YES"
There's no open source utility that can read and write to UFS(2) partitions in Windows
EXT2FSLack of journaling and EXT4 write supports
Open source utilities (Ext2Fsd, Ext2IFS) are available for Windows that
allow both reading and writing EXT2/3/4 partitions
TMPFSCould not be exported over NFS
Quick fix for adding NFS export support to TMPFS (r230208);
plus a bug fixed by jh:
allow update mounts only for certain options(r234346)
NetworkingNICs
rpcbind(8)
Firewalls
NICs: em(4)Works good without known wired behavior and has produced good performance over a gigabit wire
The datasheet is available
The client was unable to mount NFS share over UDP
Fixed by yongari (r214441)
Incorrect Rx checksum handling when testing VLC's UDP-Lite (r264212) streaming mode
Corrections to the RX checksum code (r249509)
NICs: re(4)
Fails at high traffic; stress test with ftp/axel
re0: watchdog timeout
re0: link state changed to DOWN
Use the vendor driver with minor modifications but it has one drawback: it doesn't use miibus(4)
The datasheet is not available
rpcbind(8)
rpcbind can be abused by remote attackers for rpc amplification attacks(DDoS)
Prevent rpcbind from listening on all interfaces for UDP and TCP connections
rpcbind_flags="-h 192.168.1.1"
nfs_server_flags="-h 192.168.1.1"
mountd_flags="-h 192.168.1.1"
Firewalls: ipfw(4) & pf(4)
Kernel panic with pf kept happening
locking issue; fixed as r226938
Switching to ipfw makes me/us happy
Support the FreeBSD project
https://www.freebsdfoundation.org/donate/
Recommended