在本教程中，我想阐明在服务器环境中（在租用的硬件上或在您自己的数据中心中）手动或使用诸如Ansible之类的编排工具来安装FreeBSD多么容易和优雅。 磁盘加密，方便的空间管理，用于容器和完整VM的虚拟机管理程序，方便且直观的防火墙-仅此而已，不仅可以立即使用，而且只需很少的时间即可使用正确的方法进行配置。

安装方式

让我们从最简单的场景开始。 我们有一块铁或有一块铁，但是我们可以在CD-ROM上或使用IPMI输入.iso（或.img）。 甚至更简单-托管程序直接从界面提供mfsbsd映像。 无论如何，请从mfsbsd引导。

Linux救援CD

碰巧的是，托管人没有以任何形式提供FreeBSD，而是提供Linux Rescue。 我们启动到Linux，下载mfsbsd磁盘映像并将其滚动到硬盘上：

root@rescue:~# wget https://mfsbsd.vx.sk/files/images/12/amd64/mfsbsd-12.1-RELEASE-amd64.img

 root@rescue:~# dd if=mfsbsd-12.1-RELEASE-amd64.img of=/dev/sda bs=4M 22+1 records in 22+1 records out 92307456 bytes (92 MB) copied, 0.386325 s, 239 MB/s 

root@rescue:~# reboot

网络适​​配器设置

当我们可以直接访问监视器或通过IPMI / VNC / Web通过网络接收信号时，一切都很好。 但是，如果没有这种可能性并且只能进行网络连接怎么办？ 为此，我们需要一个已经设置了网络设置的mfsbsd映像。 让我们使用网络适配器和SSH守护程序的设置收集单个映像。 为此，我们需要某种FreeBSD主机来构建映像。

下载原始的.iso

root@ns312777:~ # fetch https://download.freebsd.org/ftp/releases/amd64/amd64/ISO-IMAGES/12.0/FreeBSD-12.0-RELEASE-amd64-dvd1.iso

Mountim

root@ns312777:~ # mount -t cd9660 /dev/ mdconfig -f FreeBSD-12.0-RELEASE-amd64-dvd1.iso /root/cd-rom

下载mfsbsd

root@ns312777:~ # fetch https://github.com/mmatuska/mfsbsd/archive/master.zip

root@ns312777:~ # unzip master.zip && cd mfsbsd-master

我们更改配置文件。 对于IP配置，只需更改从conf/rc.conf.sample创建conf/rc.conf 。 您还应该创建conf/authorized_keys并添加密钥。

root@ns312777:~/mfsbsd-master # ls -la conf/

 total 55 drwxr-xr-x 2 root wheel 13 Dec 8 10:06 . drwxr-xr-x 7 root wheel 13 Dec 8 10:11 .. -rw-r--r-- 1 root wheel 451 Dec 8 10:06 authorized_keys -rw-r--r-- 1 root wheel 50 Nov 30 22:54 authorized_keys.sample -rw-r--r-- 1 root wheel 3 Nov 30 22:54 boot.config.sample -rw-r--r-- 1 root wheel 156 Nov 30 22:54 hosts.sample -rw-r--r-- 1 root wheel 592 Nov 30 22:54 interfaces.conf.sample -rw-r--r-- 1 root wheel 1310 Nov 30 22:54 loader.conf.sample -rw-r--r-- 1 root wheel 739 Dec 8 10:06 rc.conf -rw-r--r-- 1 root wheel 689 Nov 30 22:54 rc.conf.sample -rw-r--r-- 1 root wheel 40 Nov 30 22:54 rc.local.sample -rw-r--r-- 1 root wheel 108 Nov 30 22:54 resolv.conf.sample -rw-r--r-- 1 root wheel 898 Nov 30 22:54 ttys.sample 

好吧，走吧！

root@ns312777:~/mfsbsd-master # make BASE=/root/cd-rom/usr/freebsd-dist

 Extracting base and kernel ... done Removing selected files from distribution ... done Installing configuration scripts and files ... done Generating SSH host keys ... done Configuring boot environment ...x ./ x ./linker.hints x ./kernel done Installing pkgng ... done Compressing usr ... done Creating and compressing mfsroot ... done Creating image file ...87072+0 records in 87072+0 records out 89161728 bytes transferred in 0.905906 secs (98422727 bytes/sec) 87040+0 records in 87040+0 records out 89128960 bytes transferred in 0.877165 secs (101610229 bytes/sec) md3 created md3p1 added partcode written to md3p1 bootcode written to md3 md3p2 added Calculated size of `./mfsbsd-12.0-RELEASE-p10-amd64.img.a47DUe1j': 80281600 bytes, 65 inodes Extent size set to 32768 ./mfsbsd-12.0-RELEASE-p10-amd64.img.a47DUe1j: 76.6MB (156800 sectors) block size 32768, fragment size 4096 using 1 cylinder groups of 76.56MB, 2450 blks, 256 inodes. super-block backups (for fsck -b #) at: 64, Populating `./mfsbsd-12.0-RELEASE-p10-amd64.img.a47DUe1j' Image `./mfsbsd-12.0-RELEASE-p10-amd64.img.a47DUe1j' complete 612+1 records in 612+1 records out 80281600 bytes transferred in 36.018812 secs (2228880 bytes/sec) done 

为什么要使用mfsbsd？

这是FreeBSD OS的紧凑组件，可直接加载到内存中，这意味着我们可以使用所有可用媒体自由地执行我们想要的操作。 类似于Linux救援CD。 该程序集的全部魅力在于，它使您可以通过一条命令从字面上安装FreeBSD。

Linux救援CD或从.iso / .img引导后，我们进入mfsbsd shell。

root@mfsbsd:~ # cd bin/

我们清理磁盘

 root@mfsbsd:~/bin # gpart destroy -F /dev/ada0 root@mfsbsd:~/bin # gpart destroy -F /dev/ada1 

或

root@mfsbsd:~/bin # ./destroygeom -d /dev/ada0 -d /dev/ada1

 Destroying geom ada0: Deleting partition 1 ... done Deleting partition 2 ... done Destroying geom ada1: Deleting partition 1 ... done Deleting partition 2 ... done 

然后安装我们的系统。

 root@mfsbsd:~/bin # ./zfsinstall Usage: ./zfsinstall [-h] -d geom_provider [-d geom_provider ...] [ -u dist_url ] [-r mirror|raidz] [-m mount_point] [-p zfs_pool_name] [-s swap_partition_size] [-z zfs_partition_size] [-c] [-C] [-l] [-4] [-A] 

因为 在最多具有3个磁盘的主机上，我更喜欢将系统放在小分区上所有磁盘上的镜像中。 借助ZFS，您可以根据需要配置剩余空间，但稍后会进行更多配置。 在这里，她是唯一安装整个系统的团队。

root@mfsbsd:~/bin # ./zfsinstall -d /dev/ada0 -d /dev/ada1 -d /dev/ada2 -r mirror -p zsys -z 25G

在镜像的三个磁盘上安装系统

 Fetching base files from: ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/12.0-RELEASE /tmp/base.txz 147 MB 3670 kBps 41s /tmp/kernel.txz 39 MB 2344 kBps 18s Creating GUID partitions on ada0 ... done Configuring ZFS bootcode on ada0 ... done => 40 937703008 ada0 GPT (447G) 40 472 1 freebsd-boot (236K) 512 52428800 2 freebsd-zfs (25G) 52429312 885273736 - free - (422G) Creating GUID partitions on ada1 ... done Configuring ZFS bootcode on ada1 ... done => 40 937703008 ada1 GPT (447G) 40 472 1 freebsd-boot (236K) 512 52428800 2 freebsd-zfs (25G) 52429312 885273736 - free - (422G) Creating GUID partitions on ada2 ... done Configuring ZFS bootcode on ada2 ... done => 40 937703008 ada2 GPT (447G) 40 472 1 freebsd-boot (236K) 512 52428800 2 freebsd-zfs (25G) 52429312 885273736 - free - (422G) Creating ZFS pool zsys on ada0p2 ada1p2 ada2p2 ... done Creating zsys root partition: ... done Creating zsys partitions: var tmp ... done Setting bootfs for zsys to zsys/root ... done NAME USED AVAIL REFER MOUNTPOINT zsys 712K 23.7G 88K none zsys/root 264K 23.7G 88K /mnt zsys/root/tmp 88K 23.7G 88K /mnt/tmp zsys/root/var 88K 23.7G 88K /mnt/var Extracting FreeBSD distribution ... done Writing /boot/loader.conf... done Writing /etc/fstab...Writing /etc/rc.conf... done Copying /boot/zfs/zpool.cache ... done Installation complete. The system will boot from ZFS with clean install on next reboot You may make adjustments to the installed system using chroot: chroot /mnt Some adjustments may require a mounted devfs: mount -t devfs devfs /mnt/dev WARNING - Don't export ZFS pool "zsys"! 

安装后，已安装的OS的文件系统位于/mnt/ ，因此我们在重新引导之前进行一些配置：

将已经添加到mfsbsd映像中的密钥复制到系统中

root@mfsbsd:~/bin # mkdir /mnt/root/.ssh && cp /root/.ssh/authorized_keys /mnt/root/.ssh/

我们编辑SSH配置（例如，更改端口和 允许登录root ）

root@mfsbsd:~/bin # ee /mnt/etc/ssh/sshd_config

编辑系统引导程序文件

root@mfsbsd:~/bin # ee /mnt/etc/rc.conf

 zfs_enable="YES" sshd_enable="YES" hostname="hyper.bitbsd.org" # # You need a gateway defined for a working network setup defaultrouter="37.79.8.254" ifconfig_em0="inet 37.79.8.111 netmask 255.255.255.0" 

请注意您网络熟练的制造商，因为 接口的名称取决于它。 在某些情况下，您可以这样做：

/etc/rc.conf ifconfig_DEFAULT="DHCP"

我们公开DNS

root@mfsbsd:~/bin # ee /mnt/etc/resolv.conf

 nameserver 8.8.8.8 

好吧，你通常可以这样做

root@mfsbsd:~ # chroot /mnt

并添加用户，并且通常可以在新安装的OS环境中进行所有操作。

好吧，我们继续前进

root@mfsbsd:~ # reboot

更红眼

在继续配置已安装的OS之前，我想说明另外两种引导到mfsbsd的方法。

标准的FreeBSD安装程序：

选择Live CD

创建内存磁盘

 # mdconfig -a -t swap -s 2g -u 9 # newfs -U md9 # mount /dev/md9 /tmp # cd /tmp 

使用mfsbsd文件不需要使用内存中的磁盘；此外，mfsbsd在安装期间使用/tmp/ ，因此那里应该有足够的可用空间。

# fetch https://github.com/mmatuska/mfsbsd/archive/master.zip

# unzip master.zip && cd mfsbsd-master/tools

好吧，那么同样的事情./destroygeom和./zfsinstall

从预装的Linux映像进行安装：

如果服务器提供商为您提供了已经安装的Linux，那么我们还可以通过更改GRUB bootloader的配置以自己的方式“安装”。 为此，将以下行添加到当前系统上的grub.cfg中：

 menuentry "mfsbsd-10.0-RELEASE-amd64.iso" { # Path to the iso set isofile=/boot/boot-isos/mfsbsd-12.0-RELEASE-amd64.iso # (hd0,1) here may need to be adjusted of course depending where the partition is loopback loop (hd0,1)$isofile kfreebsd (loop)/boot/kernel/kernel.gz -v # kfreebsd_loadenv (loop)/boot/device.hints # kfreebsd_module (loop)/boot/kernel/geom_uzip.ko kfreebsd_module (loop)/boot/kernel/ahci.ko kfreebsd_module (loop)/mfsroot.gz type=mfs_root set kFreeBSD.vfs.root.mountfrom="ufs:/dev/md0" set kFreeBSD.mfsbsd.autodhcp="YES" # Define a new root password # set kFreeBSD.mfsbsd.rootpw="foobar" # Alternatively define hashed root password # set kFreeBSD.mfsbsd.rootpwhash="" } 

好吧，将.iso相应地放在/boot/boot-isos/

我从来没有自己做过，所以如果您发现配置中的错误或缺陷，请告诉我。

我不知道，也许我还能怎么躲避安装FreeBSD。

系统配置

好了，我们已经安装，加载了所有东西……首先，我们需要安装和配置网络-在我们的情况下， pf将起主要作用，我喜欢此解决方案的简洁性和清晰度。 我们需要配置服务器文件系统-我们使用ZFS，因为它是一个非常灵活和高效的文件系统。 配置网络和FS后，我们将安装虚拟机监控程序。 如果需要提高安全性，则可以配置其他实用程序 ，在本教程中将省略其说明。 为了说明ZFS的灵活性，我将描述两台服务器的配置，其中一台有2个磁盘，一台有3个磁盘。 另外，不要忘记在安装后升级系统 ，有时会发现只有古老的东西可用于安装。

freebsd-update -r 12.1-RELEASE upgrade

在撰写本文时，最新版本为12.1。

双磁盘服务器

我们在以下配置中创建了它：

 root@:~ # gpart show /dev/ada0 => 40 5860533088 ada0 GPT (2.7T) 40 472 1 freebsd-boot (236K) 512 8388608 2 freebsd-swap (4.0G) 8389120 167772160 3 freebsd-zfs (80G) 176161280 2097152000 4 freebsd-zfs (1.0T) 2273313280 3587219848 5 freebsd-zfs (1.7T) root@:~ # gpart show /dev/ada1 => 40 5860533088 ada1 GPT (2.7T) 40 472 1 freebsd-boot (236K) 512 8388608 2 freebsd-swap (4.0G) 8389120 167772160 3 freebsd-zfs (80G) 176161280 2097152000 4 freebsd-zfs (1.0T) 2273313280 3587219848 5 freebsd-zfs (1.7T) 

 root@:~ # zpool status pool: appdata state: ONLINE scan: none requested config: NAME STATE READ WRITE CKSUM appdata ONLINE 0 0 0 mirror-0 ONLINE 0 0 0 ada0p4.eli ONLINE 0 0 0 ada1p4.eli ONLINE 0 0 0 errors: No known data errors pool: miscdata state: ONLINE scan: none requested config: NAME STATE READ WRITE CKSUM miscdata ONLINE 0 0 0 ada0p5.eli ONLINE 0 0 0 ada1p5.eli ONLINE 0 0 0 errors: No known data errors pool: zsys state: ONLINE scan: none requested config: NAME STATE READ WRITE CKSUM zsys ONLINE 0 0 0 mirror-0 ONLINE 0 0 0 ada0p3 ONLINE 0 0 0 ada1p3 ONLINE 0 0 0 errors: No known data errors 

这一切是什么意思？ 我们有一块带有两个磁盘的铁片，这两个磁盘大小均为3 TB。 我们将在服务器上启动多个应用程序，其中一些是有条件的，一些是“在玩”的，因此丢失数据并不可惜。 用于最有效的磁盘空间配置。 短促的操作会得到什么？

 root@:~ # zfs list NAME USED AVAIL REFER MOUNTPOINT appdata 75.5K 961G 23K /appdata miscdata 75.5K 3.21T 23K /miscdata zsys 2.02G 75.0G 88K none zsys/root 2.02G 75.0G 1.18G / zsys/root/tmp 88K 75.0G 88K /tmp zsys/root/var 862M 75.0G 862M /var 

至关重要的应用程序数据的appdata池（来自/dev/ada0p4.eli和/dev/ada1p4.eli的镜像），miscdata池（“条带”，即/dev/ada0p5.eli和/上的数据） dev / ada1p5.eli）。 还有一个系统池和交换，它们也是来自两个磁盘分区的镜像。

对于我们的应用程序而言，总共有1TB的镜像空间和3.2TB的实验空间。

如何设置呢？ 很简单 初始安装后，我们的磁盘如下所示：

 root@:~ # gpart show /dev/ada0 => 40 5860533088 ada0 GPT (2.7T) 40 472 1 freebsd-boot (236K) 512 8388608 2 freebsd-swap (4.0G) 8389120 167772160 3 freebsd-zfs (80G) 176161280 684371848 free (2.7T) 

我们将部分添加到磁盘，首先我们将对其进行镜像

root@:~ # gpart add -t freebsd-zfs -s 1000g /dev/ada0

root@:~ # gpart add -t freebsd-zfs -s 1000g /dev/ada1

然后其他的一切

root@:~ # gpart add -t freebsd-zfs /dev/ada0

root@:~ # gpart add -t freebsd-zfs /dev/ada1

我们现在有/ dev / ada0p4，/ dev / ada0p5，/ dev / ada1p4和/ dev / ada0p5分区。 因为 我们对DC主机上的服务器没有物理访问权限，建议使用我们的数据对部分进行加密。

root@:~ # geli init /dev/ada0p4

root@:~ # geli init /dev/ada0p5

root@:~ # geli init /dev/ada1p4

root@:~ # geli init /dev/ada1p5

输入加密密码，然后解密以下部分：

root@:~ # geli attach /dev/ada0p4

root@:~ # geli attach /dev/ada0p5

root@:~ # geli attach /dev/ada1p4

root@:~ # geli attach /dev/ada1p5

现在我们有/dev/ada0p4.eli、/dev/ada0p5.eli、/dev/ada1p4.eli和/dev/ada0p5.eli部分，我们可以从这些部分构建池

您可以编写以下脚本：

 root@:~ # cat /root/attach_disks.sh #!/bin/sh geli attach /dev/ada0p4 geli attach /dev/ada0p5 geli attach /dev/ada1p4 geli attach /dev/ada1p5 

root@:~ # zpool create appdata mirror /dev/ada0p4.eli /dev/ada1p4.eli

对于没有镜像的数据

root@:~ # zpool create miscdata /dev/ada0p5.eli /dev/ada1p5.eli

好了，我们的服务器已经准备好战斗了。 我们拥有一些池，以后可以通过增加池来扩展。 驱动器。 还有快照，如何使用快照，我将对此进行介绍。

具有三个驱动器的服务器

这里的配置略有不同。 我们有一块带有三个450GB SSD的硬件。 该服务器将主要用于完全虚拟化，因此我们需要尽可能多的空间，但是有可能在丢失一个磁盘之后继续工作。 初始安装后，我们的磁盘如下所示：

root@:~ # gpart show /dev/ada[0-9]

 => 40 937703008 ada0 GPT (447G) 40 472 1 freebsd-boot (236K) 512 52428800 2 freebsd-zfs (25G) 52429312 885273736 - free - (422G) => 40 937703008 ada1 GPT (447G) 40 472 1 freebsd-boot (236K) 512 52428800 2 freebsd-zfs (25G) 52429312 885273736 - free - (422G) => 40 937703008 ada2 GPT (447G) 40 472 1 freebsd-boot (236K) 512 52428800 2 freebsd-zfs (25G) 52429312 885273736 - free - (422G) 

我们创建420 GB的分区（直到不创建磁盘的末尾，因为在更换磁盘时，其实际大小可能会略有不同）

 root@hyper:~ # gpart add -t freebsd-zfs -s 420g /dev/ada0 ada0p3 added root@hyper:~ # gpart add -t freebsd-zfs -s 420g /dev/ada1 ada1p3 added root@hyper:~ # gpart add -t freebsd-zfs -s 420g /dev/ada2 ada2p3 added 

我们加密

 root@hyper:~ # geli init /dev/ada0p3 Enter new passphrase: Reenter new passphrase: Metadata backup for provider /dev/ada0p3 can be found in /var/backups/ada0p3.eli and can be restored with the following command: # geli restore /var/backups/ada0p3.eli /dev/ada0p3 root@hyper:~ # geli init /dev/ada1p3 Enter new passphrase: Reenter new passphrase: Metadata backup for provider /dev/ada1p3 can be found in /var/backups/ada1p3.eli and can be restored with the following command: # geli restore /var/backups/ada1p3.eli /dev/ada1p3 root@hyper:~ # geli init /dev/ada2p3 Enter new passphrase: Reenter new passphrase: Metadata backup for provider /dev/ada2p3 can be found in /var/backups/ada2p3.eli and can be restored with the following command: # geli restore /var/backups/ada2p3.eli /dev/ada2p3 

什么是元数据备份？

该文件可用于将加密密码重置为我们输入的密码。 好吧，以防万一我后来改变而忘了。 无论如何，值得牢记这一细微差别。

附加磁盘并创建池

 root@hyper:~ # geli attach /dev/ada0p3 Enter passphrase: root@hyper:~ # geli attach /dev/ada1p3 Enter passphrase: root@hyper:~ # geli attach /dev/ada2p3 Enter passphrase: root@hyper:~ # zpool create safestore raidz1 /dev/ada0p3.eli /dev/ada1p3.eli /dev/ada2p3.eli 

在输出处，我们得到一个具有820 GB磁盘空间的池

 root@hyper:~ # zfs list NAME USED AVAIL REFER MOUNTPOINT safestore 89.2K 810G 29.3K /safestore ... 

您可以根据需要收集ZFS池和具有不同配置的不同磁盘。 这是一种可以永久扩展的存储设计器。 ZFS在设备上创建了一个抽象层，使您可以实现极为惊人的配置。

管理程序的安装和配置

FreeBSD提供了两种现成的来宾OS解决方案-jails和bhyve。 有cbsd ，它是FreeBSD Jails，bhyve和XEN的包装。 在本指南中，我将不涉及后者，因为 我自己从未使用过。

单元是FreeBSD系统的克隆。 一个非常方便的隔离过程的工具。 主机系统可以托管低于其自身版本的任何版本的单元。 单元可以在主机之间传输，快照和回滚，甚至可以随时回滚。 尽可能使用klektki是值得的，因此可以最佳地使用系统资源，而不用花在完全虚拟化上。

反过来，bhyve是一个功能强大的虚拟机管理程序，您可以使用它来引发各种Ubuntu和dockers。

root@:~ # pkg install cbsd

值得注意的是，在撰写本文时，cbsd仅提取11个大小为35 MB的依赖项。

 New packages to be INSTALLED: cbsd: 12.1.2 sudo: 1.8.28 gettext-runtime: 0.20.1 indexinfo: 0.3.1 libssh2: 1.8.2,3 ca_root_nss: 3.47.1 rsync: 3.1.3_1 libiconv: 1.14_11 pkgconf: 1.6.3,1 libedit: 3.1.20190324,1 sqlite3: 3.29.0 readline: 8.0.0 Number of packages to be installed: 12 The process will require 33 MiB more space. 8 MiB to be downloaded. Proceed with this action? [y/N]: y 

在池上为单元创建一个单独的部分

root@:~ # zfs create miscdata/jails

初始化cbsd

root@:~ # env workdir="/miscdata/jails" /usr/local/cbsd/sudoexec/initenv

 -------[CBSD v.12.1.2]------- This is install/upgrade scripts for CBSD. Don't forget to backup. ----------------------------- Do you want prepare or upgrade hier environment for CBSD now? [yes(1) or no(0)] 1 >>> Installing or upgrading [Stage 1: account & dir hier] * Check hier and permission... ./.rssh missing (created) ./.ssh missing (created) ./.ssh/sockets missing (created) ./basejail missing (created) ./etc missing (created) ./etc/defaults missing (created) ./export missing (created) ./ftmp missing (created) ./import missing (created) ./jails missing (created) ./jails-data missing (created) ./jails-fstab missing (created) ./jails-rcconf missing (created) ./jails-system missing (created) ./share missing (created) ./share/dialog missing (created) ./share/helpers missing (created) ./share/FreeBSD-jail-puppet-skel missing (created) ./share/FreeBSD-jail-skel missing (created) ./share/FreeBSD-jail-vnet-skel missing (created) ./share/emulators missing (created) ./src missing (created) ./tmp missing (created) ./var missing (created) ./var/cron missing (created) ./var/cron/tabs missing (created) ./var/db missing (created) ./var/log missing (created) ./var/mail missing (created) ./var/run missing (created) ./var/spool missing (created) * write directory id: jaildatadir * write directory id: jailsysdir * write directory id: jailrcconfdir * write directory id: dbdir [Stage 2: build tools] Shall i add cbsd user into /usr/local/etc/sudoers.d/cbsd_sudoers sudo file to obtain root privileges for the most cbsd commands? [yes(1) or no(0)] 1 [Stage 3: local settings] Shall i modify the /etc/rc.conf to sets cbsd_workdir="/miscdata/jails"?: [yes(1) or no(0)] 1 /etc/rc.conf: cbsd_workdir: -> /miscdata/jails [Stage 4: update default skel resolv.conf] [Stage 5: refreshing inventory] nodename: CBSD Nodename for this host eg the hostname. Warning: this operation will recreate the ssh keys in /miscdata/jails/.ssh dir: hostname.org Empty inventory database created: /miscdata/jails/var/db/inv.hostname.org.sqlite nodeip: Node management IPv4 or IPv6 address (used for node interconnection), eg: 151.106.27.106 jnameserver: Jails default DNS name-server (for jails resolv.conf), eg: 9.9.9.9,149.112.112.112 8.8.8.8,8.8.4.4 nodeippool: Jail pool IP address range (networks for jails) Hint: use space as delimiter for multiple networks, eg: 10.0.0.0/16 151.106.27.106/24 192.168.0.0/24 nat_enable: Enable NAT for RFC1918 networks? [yes(1) or no(0)] 0 fbsdrepo: Use official FreeBSD repository? When no (0) the repository of CBSD is preferred (useful for stable=1) for fetching base/kernel? [yes(1) or no(0)] 1 zfsfeat: You are running on a ZFS-based system. Enable ZFS feature? [yes(1) or no(0)] 1 parallel: Parallel mode stop/start ? (0 - no parallel or positive value (in seconds) as timeout for next parallel sequence) eg: 5 0 stable: Use STABLE branch instead of RELEASE by default? Attention: only the CBSD repository has a binary base for STABLE branch ? (STABLE_X instead of RELEASE_X_Y branch for base/kernel will be used), eg: 0 (use release) 0 sqlreplica: Enable sqlite3 replication to remote nodes ? (0 - no replica, 1 - try to replicate all local events to remote nodes) eg: 1 0 statsd_bhyve_enable: Configure CBSD statsd services for collect RACCT bhyve statistics? ? (EXPERIMENTAL FEATURE)? eg: 0 0 statsd_jail_enable: Configure CBSD statsd services for collect RACCT jail statistics? ? (EXPERIMENTAL FEATURE)? eg: 0 0 statsd_hoster_enable: Configure CBSD statsd services for collect RACCT hoster statistics? ? (EXPERIMENTAL FEATURE)? eg: 0 0 [Stage 6: authentication keys] Generating public/private rsa key pair. Your identification has been saved in /miscdata/jails/.ssh/8a3574aa0ec0ad3056e7dcf0f48adb01.id_rsa. Your public key has been saved in /miscdata/jails/.ssh/8a3574aa0ec0ad3056e7dcf0f48adb01.id_rsa.pub. The key fingerprint is: SHA256:bZM/lo6lx40vE48MxZea1KQMKYIBq3HyPWQrF0xn980 root@hostname.org The key's randomart image is: +---[RSA 2048]----+ | ..ooo . . | | +.o....oo . | |oo = . ..+E+ . | | * + o . .* + | |. o = S =o + | | o . ..o+. | | +** | | *Oo | | o..+. | +----[SHA256]-----+ [Stage 7: modules] Installing module pkg.d cmd: pkg Installing module bsdconf.d cmd: tzsetup Installing module bsdconf.d cmd: ssh Installing module bsdconf.d cmd: ftp Installing module bsdconf.d cmd: adduser Installing module bsdconf.d cmd: passwd Installing module bsdconf.d cmd: service Installing module bsdconf.d cmd: sysrc Installing module bsdconf.d cmd: userlist Installing module bsdconf.d cmd: grouplist Installing module bsdconf.d cmd: adduser-tui Installing module bsdconf.d cmd: pw Installing module bsdconf.d cmd: cloudinit Installing module zfsinstall.d cmd: zfsinstall [Stage 9: cleanup] * Remove obsolete files... Configure RSYNC services for jail migration? [yes(1) or no(0)] 0 cbsdrsyncd_enable: -> YES Do you want to enable RACCT feature for resource accounting? [yes(1) or no(0)] 0 Shall i modify the /etc/rc.conf to sets cbsdd_enable=YES ? [yes(1) or no(0)] 0 cbsdd_enable: -> NO Shall i modify the /etc/rc.conf to sets rcshutdown_timeout="900"? [yes(1) or no(0)] 0 rcshutdown_timeout: 90 -> 900 [Stage X: upgrading] * Insert default topology into vm_cpu_topology table * Insert small1 group into vmpackage table >>> Done First CBSD initialization complete. Now your can run: service cbsdd start to run CBSD services. For change initenv settings in next time, use: cbsd initenv-tui Also don't forget to execute: cbsd initenv every time when you upgrade CBSD version. preseedinit: Would you like a config for "cbsd init" preseed to be printed? [yes(1) or no(0)] 0 

运行cbsd守护程序。 我们从开始 我们没有将cbsd添加到系统启动时自动运行，因为 包含来宾OS数据的部分已加密。

root@:~ # service cbsdd onestart

服务器启动时，您需要通过SSH连接到服务器（这就是系统分区未加密的原因，这样系统就可以在没有任何VNC / IPMI密码输入的情况下成功启动），并使用./root/attach_disks.sh脚本解密我们的磁盘分区。

初始化cbsd时，我们指示192.168.0.0/24是我们单元的子网。 我计划将同一子网用于完全虚拟化。 我们扭曲了主机上的几个单元，但是在此之前，我们设置了防火墙，以使这些单元的NAT通过主机工作。

 root@:~ # sysrc pf_enable=YES pf_enable: NO -> YES root@:~ # service pf start /etc/rc.d/pf: WARNING: /etc/pf.conf is not readable. 

为防火墙创建规则文件

root@:~ # ee /etc/pf.conf

 IF_PUBLIC="igb0" IP_PUBLIC="XXXX" JAIL_IP_POOL="192.168.0.0/24" icmp_types="echoreq" set limit { states 100000, frags 20000, src-nodes 20000 } set skip on lo0 scrub in all #NAT for others nat pass on $IF_PUBLIC from $JAIL_IP_POOL to any -> $IP_PUBLIC ## Jail HTTP/S port forward IP_JAIL="192.168.0.2" PORT_JAIL="{ 80, 443 }" rdr pass on $IF_PUBLIC proto tcp from any to $IP_PUBLIC port $PORT_JAIL -> $IP_JAIL 

加载规则

 root@:~ # service pf start Enabling pf. root@:~ # pfctl -f /etc/pf.conf 

好了，现在我们创建单元

root@:~ # cbsd jconstruct-tui

选择从基本存储库中下载单元

通过root@:~ # cbsd jconstruct-tui和另外两个单元格root@:~ # cbsd jconstruct-tui

然后我们开始细胞

root@:~ # cbsd jstart webapp

在内部，我们已经做了我们想要的

root@:~ # cbsd jlogin webapp

 webapp:/root@[12:58] # pkg install nginx Updating FreeBSD repository catalogue... FreeBSD repository is up to date. All repositories are up to date. Updating database digests format: 100% The following 2 package(s) will be affected (of 0 checked): New packages to be INSTALLED: nginx: 1.16.1_4,2 pcre: 8.43_2 Number of packages to be installed: 2 The process will require 8 MiB more space. 2 MiB to be downloaded. Proceed with this action? [y/N]: y [webapp.host.org] [1/2] Fetching nginx-1.16.1_4,2.txz: 100% 442 KiB 452.8kB/s 00:01 [webapp.host.org] [2/2] Fetching pcre-8.43_2.txz: 100% 1 MiB 638.0kB/s 00:02 Checking integrity... done (0 conflicting) [webapp.host.org] [1/2] Installing pcre-8.43_2... [webapp.host.org] [1/2] Extracting pcre-8.43_2: 100% [webapp.host.org] [2/2] Installing nginx-1.16.1_4,2... ===> Creating groups. Using existing group 'www'. ===> Creating users Using existing user 'www'. [webapp.host.org] [2/2] Extracting nginx-1.16.1_4,2: 100% ===== Message from nginx-1.16.1_4,2: -- Recent version of the NGINX introduces dynamic modules support. In FreeBSD ports tree this feature was enabled by default with the DSO knob. Several vendor's and third-party modules have been converted to dynamic modules. Unset the DSO knob builds an NGINX without dynamic modules support. To load a module at runtime, include the new `load_module' directive in the main context, specifying the path to the shared object file for the module, enclosed in quotation marks. When you reload the configuration or restart NGINX, the module is loaded in. It is possible to specify a path relative to the source directory, or a full path, please see https://www.nginx.com/blog/dynamic-modules-nginx-1-9-11/ and http://nginx.org/en/docs/ngx_core_module.html#load_module for details. Default path for the NGINX dynamic modules is /usr/local/libexec/nginx. webapp:/root@[12:59] # sysrc nginx_enable=YES nginx_enable: -> YES webapp:/root@[12:59] # service nginx start Performing sanity check on nginx configuration: nginx: the configuration file /usr/local/etc/nginx/nginx.conf syntax is ok nginx: configuration file /usr/local/etc/nginx/nginx.conf test is successful Starting nginx. webapp:/root@[DING!] # sockstat -l4 USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS www nginx 27982 6 tcp4 192.168.0.2:80 *:* root nginx 27981 6 tcp4 192.168.0.2:80 *:* root sendmail 25361 4 tcp4 192.168.0.2:25 *:* webapp:/root@[13:00] # 

这是典型的细胞动物园：

 root@:~ # jls JID IP Address Hostname Path 1 192.168.0.1 tor.host.org /miscdata/jails/jails/tor 2 192.168.0.2 webapp.host.org /miscdata/jails/jails/webapp 3 192.168.0.3 bitcoind.host.org /miscdata/jails/jails/bitcoind 4 192.168.0.4 ethd.host.org /miscdata/jails/jails/ethd 

webapp nginx , /etc/pf.conf

. .

/etc/rc.conf

 ifconfig_igb0_alias="inet 192.168.0.1 netmask 255.255.255.0" gateway_enable="YES" 

 root@hyper:~ # echo 'vmm_load="YES"' >> /boot/loader.conf root@hyper:~ # echo 'kld_list="vmm if_tap if_bridge nmdm"' >> /etc/rc.conf root@hyper:~ # reboot 

, .

 root@hyper:~ # sysrc pf_enable=YES pf_enable: NO -> YES root@hyper:~ # service pf start Enabling pf. 

,

root@hyper:~ # cbsd bconstruct-tui

VNC 5900, SSH

ssh hyperhost -L 5900:localhost:5900

. IP - 192.168.0.100.

/etc/pf.conf SSH

 ## VM SSH port forward IP_VM="192.168.0.100" PORT_VM="{ 22100 }" rdr pass on $IF_PUBLIC proto tcp from any to $IP_PUBLIC port $PORT_VM -> $IP_VM port 22 

. , .

 root@hyper:~ # zfs list NAME USED AVAIL REFER MOUNTPOINT safestore 5.89G 804G 29.3K /safestore safestore/jails 5.89G 804G 4.46G /safestore/jails safestore/jails/debian 920M 804G 208K /safestore/jails/vm/debian safestore/jails/debian/dsk1.vhd 919M 804G 919M - safestore/jails/linuxjail 329M 804G 329M /safestore/jails/jails-data/linuxjail-data safestore/jails/nginx 89.2M 804G 89.2M /safestore/jails/jails-data/nginx-data safestore/jails/tor 117M 804G 117M /safestore/jails/jails-data/tor-data zsystem 1.85G 21.9G 88K none zsystem/root 1.85G 21.9G 1.20G / zsystem/root/tmp 120K 21.9G 120K /tmp zsystem/root/var 662M 21.9G 662M /var 

root@hyper:~ # zfs snap safestore/jails/debian/dsk1.vhd@fresh

. .

— Ansible

3, 1300 . .

 [hyper-debian-group] hyper-debian [hyper-group] hyper [hyper-group:vars] ansible_python_interpreter=/usr/local/bin/python3.7 

 Host hyper Hostname YYYY User root Port 33696 Host hyper-debian Hostname YYYY User root Port 22100 

 - hosts: hyper-debian gather_facts: no tasks: - name: Install a list of misc packages apt: update_cache: yes pkg: - apt-transport-https - ca-certificates - curl - gnupg2 - software-properties-common - name: Add Docker repo shell: curl -fsSL https://download.docker.com/linux/debian/gpg | apt-key add - - name: Add Docker repo shell: apt-key fingerprint 0EBFCD88 - name: Do some linux repo magic shell: add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/debian $(lsb_release -cs) stable" - name: Install Docker CE suite & composer apt: update_cache: yes pkg: - docker-ce - docker-ce-cli - containerd.io - docker-compose - name: Update all packages to the latest version apt: upgrade: dist 

 - hosts: hyper gather_facts: no tasks: - name: stop debian shell: cbsd bstop debian - name: list ZFS datasets shell: zfs list | grep debian register: zfslist - debug: var=zfslist.stdout_lines - name: rollback debian shell: zfs rollback safestore/jails/debian/dsk1.vhd@fresh - name: list ZFS datasets shell: zfs list | grep debian register: zfslist - debug: var=zfslist.stdout_lines - name: start debian shell: cbsd bstart debian 

, TerraForm

 [user@localhost ~]$ ansible-playbook deploy-docker.yml PLAY [hyper-debian] ******************************************************************************************************* TASK [Install a list of misc packages] ********************************************************************************************* changed: [hyper-debian] TASK [Add Docker repo] ******************************************************************************************************** changed: [hyper-debian] TASK [Add Docker repo] ******************************************************************************************************** changed: [hyper-debian] TASK [Do some linux repo magic] ********************************************************************************************************changed: [hyper-debian] TASK [Install Docker CE suite & composer] ********************************************************************************************************changed: [hyper-debian] TASK [Update all packages to the latest version] ********************************************************************************************************ok: [hyper-debian] PLAY RECAP ********************************************************************************************************hyper-debian : ok=6 changed=5 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 

, iRedMail.

 docker run --privileged -p 80:80 -p 443:443 \ -e "DOMAIN=example.com" -e "HOSTNAME=mail" \ -e "MYSQL_ROOT_PASSWORD=password" \ -e "SOGO_WORKERS=1" \ -e "TIMEZONE=Europe/Prague" \ -e "POSTMASTER_PASSWORD=password" \ -e "IREDAPD_PLUGINS=['reject_null_sender', 'reject_sender_login_mismatch', 'greylisting', 'throttle', 'amavisd_wblist', 'sql_alias_access_policy']" \ -v PATH/mysql:/var/lib/mysql \ -v PATH/vmail:/var/vmail \ -v PATH/clamav:/var/lib/clamav \ --name=iredmail lejmr/iredmail:mysql-latest 

? - Debian.

 [user@localhost ~]$ ansible-playbook rollback-debian.yml PLAY [hyper] ******************************************************************************************************** TASK [stop debian] ********************************************************************************************************changed: [hyper] TASK [list ZFS datasets] ********************************************************************************************************changed: [hyper] TASK [debug] ********************************************************************************************************ok: [hyper] => { "zfslist.stdout_lines": [ "safestore/jails/debian 2.65G 803G 206K /safestore/jails/vm/debian", "safestore/jails/debian/dsk1.vhd 2.65G 803G 2.34G -" ] } TASK [rollback debian] ********************************************************************************************************changed: [hyper] TASK [list ZFS datasets] ********************************************************************************************************changed: [hyper] TASK [debug] ********************************************************************************************************ok: [hyper] => { "zfslist.stdout_lines": [ "safestore/jails/debian 920M 804G 206K /safestore/jails/vm/debian", "safestore/jails/debian/dsk1.vhd 919M 804G 919M -" ] } TASK [start debian] ********************************************************************************************************changed: [hyper] PLAY RECAP ********************************************************************************************************hyper : ok=7 changed=5 unreachable=0 failed=0 skipped=0 rescued=0 ignored=0 

, .

, , 1baysxTdXkwZnBosDdL1veb2zWDo6DC5b

!