-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathfreebsd-update-server.html
392 lines (309 loc) · 26.5 KB
/
freebsd-update-server.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="utf-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="HandheldFriendly" content="True" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<meta name="robots" content="index, follow" />
<link href="https://fonts.googleapis.com/css2?family=Source+Code+Pro:ital,wght@0,400;0,700;1,400&family=Source+Sans+Pro:ital,wght@0,300;0,400;0,700;1,400&display=swap" rel="stylesheet">
<link rel="stylesheet/less" type="text/css" href="https://tobtob.de/theme/stylesheet/style.less">
<script src="//cdnjs.cloudflare.com/ajax/libs/less.js/2.5.1/less.min.js" type="text/javascript"></script>
<link id="pygments-light-theme" rel="stylesheet" type="text/css"
href="https://tobtob.de/theme/pygments/github.min.css">
<script src="https://tobtob.de/theme/js/lite-yt-embed.js"></script>
<link rel="stylesheet" type="text/css" href="https://tobtob.de/theme/font-awesome/css/fontawesome.css">
<link rel="stylesheet" type="text/css" href="https://tobtob.de/theme/font-awesome/css/brands.css">
<link rel="stylesheet" type="text/css" href="https://tobtob.de/theme/font-awesome/css/solid.css">
<link rel="stylesheet" type="text/css" href="https://tobtob.de/theme/stylesheet/lite-yt-embed.css">
<link href="https://tobtob.de/feeds/all.atom.xml" type="application/atom+xml" rel="alternate" title="Tobias Kaymak"s Blog Atom">
<meta name="author" content="Tobias Kaymak" />
<meta name="description" content="FreeBSD is an operating system that we use to power various things at work. Its most significant advantage lays in the advanced filesystem ZFS and it's proven stability. As of this writing we run 39 servers with FreeBSD and we update them regularly. While normal patches are quite fast to …" />
<meta name="keywords" content="">
<meta property="og:site_name" content="Tobias Kaymak"s Blog"/>
<meta property="og:title" content="Build your own FreeBSD update server"/>
<meta property="og:description" content="FreeBSD is an operating system that we use to power various things at work. Its most significant advantage lays in the advanced filesystem ZFS and it's proven stability. As of this writing we run 39 servers with FreeBSD and we update them regularly. While normal patches are quite fast to …"/>
<meta property="og:locale" content="en_US"/>
<meta property="og:url" content="https://tobtob.de/freebsd-update-server.html"/>
<meta property="og:type" content="article"/>
<meta property="article:published_time" content="2015-01-30 16:01:00+01:00"/>
<meta property="article:modified_time" content="2015-04-20 11:25:00+02:00"/>
<meta property="article:author" content="https://tobtob.de/author/tobias-kaymak.html">
<meta property="article:section" content="FreeBSD"/>
<meta property="og:image" content="https://tobtob.de/images/profile.png">
<title>Tobias Kaymak"s Blog – Build your own FreeBSD update server</title>
</head>
<body class="light-theme">
<aside>
<div>
<a href="https://tobtob.de/">
<img src="https://tobtob.de/images/profile.png" alt="Random Notes about Data Engineering" title="Random Notes about Data Engineering">
</a>
<h1>
<a href="https://tobtob.de/">Random Notes about Data Engineering</a>
</h1>
<p>Tobias Kaymak</p>
<nav>
<ul class="list">
<li>
<a target="_self"
href="https://tobtob.de/about.html#about">
about
</a>
</li>
</ul>
</nav>
<ul class="social">
<li>
<a class="sc-linkedin" href="https://www.linkedin.com/in/tobias-kaymak/" target="_blank">
<i class="fab fa-linkedin"></i>
</a>
</li>
<li>
<a class="sc-github" href="https://github.com/tkaymak" target="_blank">
<i class="fab fa-github"></i>
</a>
</li>
<li>
<a class="sc-stack-overflow" href="https://stackoverflow.com/users/5497956/tobi" target="_blank">
<i class="fab fa-stack-overflow"></i>
</a>
</li>
</ul>
</div>
</aside>
<main>
<nav>
<a href="https://tobtob.de/">Home</a>
<a href="/archives.html">Archives</a>
<a href="/categories.html">Categories</a>
<a href="https://tobtob.de/feeds/all.atom.xml">Atom</a>
</nav>
<article class="single">
<header>
<h1 id="freebsd-update-server">Build your own FreeBSD update server</h1>
<p>
Posted on Fri 30 January 2015 in <a href="https://tobtob.de/category/freebsd.html">FreeBSD</a>
</p>
</header>
<div>
<p><a href="https://www.freebsd.org/">FreeBSD</a> is an operating system that we use to power various
things at work. Its most significant advantage lays in the advanced filesystem
<a href="https://en.wikipedia.org/wiki/ZFS">ZFS</a> and it's proven stability. As of this
writing we run 39 servers with FreeBSD and we update them regularly. While normal
patches are quite fast to fetch and install, the upgrade from version 9.2 to 9.3
took a significant amount of time to fetch all the necessary files from the
official servers.</p>
<p>That is why we started to run our own internal FreeBSD update server. There exists
some documentation for this inside the official <a href="https://www.freebsd.org/doc/en_US.ISO8859-1/articles/freebsd-update-server/article.html">handbook</a> which formed the basis for this blog post.</p>
<h3>Prerequisites</h3>
<p>Important to know is that the update server has to run a newer version than the
version you are trying to distribute. Thus I first upgraded the update server
machine to 9.3 via the <code>freebsd-update -r 9.3-RELEASE upgrade</code> command as
described in point 24.2.3 in the <a href="https://www.freebsd.org/doc/en/books/handbook/updating-upgrading-freebsdupdate.html">handbook</a>.</p>
<p>When running on the newest version, proceed with checking out the SVN repository
that holds all the configuration and scripts for the update server via:</p>
<div class="highlight"><pre><span></span><code>cd /usr/local/
svn co http://svn.freebsd.org/base/user/cperciva/freebsd-update-build freebsd-update-server
</code></pre></div>
<p>I suggest to use <code>/usr/local</code> as this is the 'standard' path of most scripts
within the repository.</p>
<h3>Building update packages</h3>
<p>For upgrading a system from 9.2 to 9.3 we need both versions available via our
update server. This is necessary since the system has to determine the difference
between two versions. For this we have to create the amd64 directory in the <code>scripts</code>
folder and copy over the build.conf from the i386 folder:</p>
<div class="highlight"><pre><span></span><code>cd /usr/local/freebsd-update-server/scripts/9.2-RELEASE
mkdir amd64
cp i386/build.conf amd64/build.conf
</code></pre></div>
<p>Next we edit the <code>amd64/build.conf</code> file and adjust
the SHA256 hash and the EOL date in it to reflect the amd64 version. Also we need to
point it towards the FTP server where to fetch the ISO image of the release from.
The final file should look somewhat like this:</p>
<div class="highlight"><pre><span></span><code><span class="c1"># SHA256 hash of disc1.iso image.</span><span class="w"></span>
<span class="k">export</span><span class="w"> </span><span class="n">RELH</span><span class="o">=</span><span class="n">a8c1751b83646530148766618a89a97009e7500e7057a5cbe3afd74ef480c915</span><span class="w"></span>
<span class="c1"># Components of the world, source, and kernels</span><span class="w"></span>
<span class="k">export</span><span class="w"> </span><span class="n">WORLDPARTS</span><span class="o">=</span><span class="s2">"base doc games"</span><span class="w"></span>
<span class="k">export</span><span class="w"> </span><span class="n">SOURCEPARTS</span><span class="o">=</span><span class="s2">"src"</span><span class="w"></span>
<span class="k">export</span><span class="w"> </span><span class="n">KERNELPARTS</span><span class="o">=</span><span class="s2">"kernel"</span><span class="w"></span>
<span class="c1"># EOL date</span><span class="w"></span>
<span class="k">export</span><span class="w"> </span><span class="n">EOL</span><span class="o">=</span><span class="mi">1419944400</span><span class="w"></span>
<span class="c1"># Location from which to fetch releases</span><span class="w"></span>
<span class="k">export</span><span class="w"> </span><span class="n">FTP</span><span class="o">=</span><span class="n">ftp</span><span class="p">:</span><span class="o">//</span><span class="n">ftp</span><span class="o">.</span><span class="n">freebsd</span><span class="o">.</span><span class="n">org</span><span class="o">/</span><span class="n">pub</span><span class="o">/</span><span class="n">FreeBSD</span><span class="o">/</span><span class="n">releases</span><span class="o">/</span><span class="n">ISO</span><span class="o">-</span><span class="n">IMAGES</span><span class="o">/</span><span class="mf">9.2</span><span class="o">/</span><span class="w"></span>
</code></pre></div>
<p>FreeBSD upgrades are signed by the update server. This is done via a key that is
generated via the first run of the make script, it will ask you for a password to
protect your key. Note that password down somewhere safe, you will need it to sign
all updates in the future:</p>
<div class="highlight"><pre><span></span><code>cd /usr/local/freebsd-update-server
sh scripts/make.sh
</code></pre></div>
<p>Important! The command finishes with the output of the public key fingerprint. Note
this down somewhere as well, you will need this fingerprint on every client so that
it can verify the packages from the update server later on:</p>
<div class="highlight"><pre><span></span><code>Public key fingerprint:
5552a36eb246be88412c56eb6ee7edccab50ec9b2fe18c90767853e90ad52a0a
</code></pre></div>
<p>The next step is to run our initial build. This can take some time thus
I recommend starting a tmux (or screen if you like) session first:</p>
<div class="highlight"><pre><span></span><code>tmux new -s upgrade_server
cd /usr/local/freebsd-update-server
</code></pre></div>
<p>After that we can start our first build:</p>
<div class="highlight"><pre><span></span><code>sh scripts/init.sh amd64 9.2-RELEASE
</code></pre></div>
<p>This process can take up to several hours, depending on the hardware it is run
on. It finishes with the following output:</p>
<div class="highlight"><pre><span></span><code><span class="nv">FreeBSD</span><span class="o">/</span><span class="nv">amd64</span> <span class="mi">9</span>.<span class="mi">2</span><span class="o">-</span><span class="nv">RELEASE</span> <span class="nv">initialization</span> <span class="nv">build</span> <span class="nv">complete</span>. <span class="nv">Please</span>
<span class="nv">review</span> <span class="nv">the</span> <span class="nv">list</span> <span class="nv">of</span> <span class="nv">build</span> <span class="nv">stamps</span> <span class="nv">printed</span> <span class="nv">above</span> <span class="nv">to</span> <span class="nv">confirm</span> <span class="nv">that</span>
<span class="nv">they</span> <span class="nv">look</span> <span class="nv">sensible</span>, <span class="k">then</span> <span class="nv">run</span>
# <span class="nv">sh</span> <span class="o">-</span><span class="nv">e</span> <span class="nv">approve</span>.<span class="nv">sh</span> <span class="nv">amd64</span> <span class="mi">9</span>.<span class="mi">2</span><span class="o">-</span><span class="nv">RELEASE</span>
<span class="nv">to</span> <span class="nv">sign</span> <span class="nv">the</span> <span class="nv">release</span>.
</code></pre></div>
<p>First, we mount our signing key with the password that we encrypted it with,
then we sign our release:</p>
<div class="highlight"><pre><span></span><code>sh -e scripts/mountkey.sh
sh -e scripts/approve.sh amd64 9.2-RELEASE
</code></pre></div>
<p>This finishes with:</p>
<div class="highlight"><pre><span></span><code><span class="n">The</span><span class="w"> </span><span class="n">FreeBSD</span><span class="o">/</span><span class="n">amd64</span><span class="w"> </span><span class="mf">9.2</span><span class="o">-</span><span class="n">RELEASE</span><span class="w"> </span><span class="n">update</span><span class="w"> </span><span class="n">build</span><span class="w"> </span><span class="n">has</span><span class="w"> </span><span class="n">been</span><span class="w"> </span><span class="n">signed</span><span class="w"> </span><span class="ow">and</span><span class="w"> </span><span class="k">is</span><span class="w"></span>
<span class="n">ready</span><span class="w"> </span><span class="n">to</span><span class="w"> </span><span class="n">be</span><span class="w"> </span><span class="n">uploaded</span><span class="o">.</span><span class="w"> </span><span class="n">Remember</span><span class="w"> </span><span class="n">to</span><span class="w"> </span><span class="n">run</span><span class="w"></span>
<span class="c1"># sh -e umountkey.sh</span><span class="w"></span>
<span class="n">to</span><span class="w"> </span><span class="n">unmount</span><span class="w"> </span><span class="n">the</span><span class="w"> </span><span class="n">decrypted</span><span class="w"> </span><span class="n">key</span><span class="w"> </span><span class="n">once</span><span class="w"> </span><span class="n">you</span><span class="w"> </span><span class="n">have</span><span class="w"> </span><span class="n">finished</span><span class="w"> </span><span class="n">signing</span><span class="w"> </span><span class="n">all</span><span class="w"></span>
<span class="n">the</span><span class="w"> </span><span class="n">new</span><span class="w"> </span><span class="n">builds</span><span class="o">.</span><span class="w"></span>
</code></pre></div>
<p>Were done! No - actually we now have to build our <code>9.3-RELEASE</code> upgrade files.
We will copy over the configuration folder from 9.2 and adjust it to our needs:</p>
<div class="highlight"><pre><span></span><code>cp -r /usr/local/freebsd-update-server/scripts/9.2-RELEASE /usr/local/freebsd-update-server/scripts/9.3-RELEASE
</code></pre></div>
<p>Next, as we want to build and distribute only an amd64 version, we delete the
i386 folder:</p>
<div class="highlight"><pre><span></span><code>cd /usr/local/freebsd-update-server/scripts/9.3-RELEASE
rm -rf i386
</code></pre></div>
<p>Let's adjust the <code>amd64/build.conf</code> file for 9.3:</p>
<div class="highlight"><pre><span></span><code><span class="c1"># SHA256 hash of disc1.iso image.</span><span class="w"></span>
<span class="k">export</span><span class="w"> </span><span class="n">RELH</span><span class="o">=</span><span class="mi">5</span><span class="n">a3c82653d77bba7d7ded8bd7efbedc09d52cf4045d98ce52a82c9e0f8fa9b0e</span><span class="w"></span>
<span class="c1"># Components of the world, source, and kernels</span><span class="w"></span>
<span class="k">export</span><span class="w"> </span><span class="n">WORLDPARTS</span><span class="o">=</span><span class="s2">"base doc games"</span><span class="w"></span>
<span class="k">export</span><span class="w"> </span><span class="n">SOURCEPARTS</span><span class="o">=</span><span class="s2">"src"</span><span class="w"></span>
<span class="k">export</span><span class="w"> </span><span class="n">KERNELPARTS</span><span class="o">=</span><span class="s2">"kernel"</span><span class="w"></span>
<span class="c1"># EOL date</span><span class="w"></span>
<span class="k">export</span><span class="w"> </span><span class="n">EOL</span><span class="o">=</span><span class="mi">1483142400</span><span class="w"></span>
<span class="c1"># Location from which to fetch releases</span><span class="w"></span>
<span class="k">export</span><span class="w"> </span><span class="n">FTP</span><span class="o">=</span><span class="n">ftp</span><span class="p">:</span><span class="o">//</span><span class="n">ftp</span><span class="o">.</span><span class="n">freebsd</span><span class="o">.</span><span class="n">org</span><span class="o">/</span><span class="n">pub</span><span class="o">/</span><span class="n">FreeBSD</span><span class="o">/</span><span class="n">releases</span><span class="o">/</span><span class="n">ISO</span><span class="o">-</span><span class="n">IMAGES</span><span class="o">/</span><span class="mf">9.3</span><span class="o">/</span><span class="w"></span>
</code></pre></div>
<p>And fire off our build of the 9.3-RELEASE:</p>
<div class="highlight"><pre><span></span><code>cd /usr/local/freebsd-update-server
sh scripts/init.sh amd64 9.3-RELEASE
</code></pre></div>
<p>This will complete with:</p>
<div class="highlight"><pre><span></span><code><span class="nv">FreeBSD</span><span class="o">/</span><span class="nv">amd64</span> <span class="mi">9</span>.<span class="mi">3</span><span class="o">-</span><span class="nv">RELEASE</span> <span class="nv">initialization</span> <span class="nv">build</span> <span class="nv">complete</span>. <span class="nv">Please</span>
<span class="nv">review</span> <span class="nv">the</span> <span class="nv">list</span> <span class="nv">of</span> <span class="nv">build</span> <span class="nv">stamps</span> <span class="nv">printed</span> <span class="nv">above</span> <span class="nv">to</span> <span class="nv">confirm</span> <span class="nv">that</span>
<span class="nv">they</span> <span class="nv">look</span> <span class="nv">sensible</span>, <span class="k">then</span> <span class="nv">run</span>
# <span class="nv">sh</span> <span class="o">-</span><span class="nv">e</span> <span class="nv">approve</span>.<span class="nv">sh</span> <span class="nv">amd64</span> <span class="mi">9</span>.<span class="mi">3</span><span class="o">-</span><span class="nv">RELEASE</span>
</code></pre></div>
<p>To sign the release run the approve script again (if you unmounted the
key in the meantime don't forget to mount it again via <code>sh -e scripts/mountkey.sh</code>:</p>
<div class="highlight"><pre><span></span><code>sh -e scripts/approve.sh amd64 9.3-RELEASE
</code></pre></div>
<h3>Building newest patches</h3>
<p>After having build our initial version it is time to bring both to their newest level.
The <code>17</code> as a parameter is the desired patchlevel in the following command:</p>
<div class="highlight"><pre><span></span><code>sh scripts/diff.sh amd64 9.2-RELEASE 17
</code></pre></div>
<p>This will conclude with:</p>
<div class="highlight"><pre><span></span><code><span class="nv">FreeBSD</span><span class="o">/</span><span class="nv">amd64</span> <span class="mi">9</span>.<span class="mi">2</span><span class="o">-</span><span class="nv">RELEASE</span> <span class="nv">update</span> <span class="nv">build</span> <span class="nv">complete</span>. <span class="nv">Please</span> <span class="nv">review</span>
<span class="nv">the</span> <span class="nv">list</span> <span class="nv">of</span> <span class="nv">build</span> <span class="nv">stamps</span> <span class="nv">printed</span> <span class="nv">above</span> <span class="nv">and</span> <span class="nv">the</span> <span class="nv">list</span> <span class="nv">of</span> <span class="nv">updated</span>
<span class="nv">files</span> <span class="nv">to</span> <span class="nv">confirm</span> <span class="nv">that</span> <span class="nv">they</span> <span class="nv">look</span> <span class="nv">sensible</span>, <span class="k">then</span> <span class="nv">run</span>
# <span class="nv">sh</span> <span class="o">-</span><span class="nv">e</span> <span class="nv">approve</span>.<span class="nv">sh</span> <span class="nv">amd64</span> <span class="mi">9</span>.<span class="mi">2</span><span class="o">-</span><span class="nv">RELEASE</span>
<span class="nv">to</span> <span class="nv">sign</span> <span class="nv">the</span> <span class="nv">build</span>.
</code></pre></div>
<p>Next step is to approve the 9.2 build followed by starting the build of the newest
upgrade patches for 9.3. At the moment (April 2015) the patchlevel for this version is <code>13</code>,
but you should check <a href="https://www.freebsd.org/security/advisories.html">here</a>
for any new security advisory that announces a new patchlevel. To use the newest
patchlevel currently checked in to the SVN look into the folder
<code>/usr/local/freebsd-update-server/patches/9.3-RELEASE</code>.
The first number of a patchfile tells you its patchlevel. In my case the highest number is
<code>13</code> and therefore this is the highest patchlevel currently available via the SVN.</p>
<p>Approving the patches for 9.2 and starting the
differential build is done via:</p>
<div class="highlight"><pre><span></span><code>sh -e scripts/approve.sh amd64 9.2-RELEASE
sh scripts/diff.sh amd64 9.3-RELEASE 13
</code></pre></div>
<p>The last step is to approve the 9.3 patches and build the upgrade patches between 9.2 and 9.3 via:</p>
<div class="highlight"><pre><span></span><code><span class="n">sh</span><span class="w"> </span><span class="o">-</span><span class="n">e</span><span class="w"> </span><span class="n">scripts</span><span class="o">/</span><span class="n">approve</span><span class="o">.</span><span class="n">sh</span><span class="w"> </span><span class="n">amd64</span><span class="w"> </span><span class="mf">9.3</span><span class="o">-</span><span class="n">RELEASE</span><span class="w"></span>
<span class="n">sh</span><span class="w"> </span><span class="n">tools</span><span class="o">/</span><span class="n">build</span><span class="o">-</span><span class="n">upgrade</span><span class="o">-</span><span class="n">patches</span><span class="o">.</span><span class="n">sh</span><span class="w"> </span><span class="n">pub</span><span class="w"> </span><span class="n">amd64</span><span class="w"> </span><span class="mf">9.3</span><span class="o">-</span><span class="n">RELEASE</span><span class="w"> </span><span class="mf">9.2</span><span class="o">-</span><span class="n">RELEASE</span><span class="w"></span>
</code></pre></div>
<p>This command should finish without any output. Finally we can umount our signing key via:</p>
<div class="highlight"><pre><span></span><code>sh scripts/umountkey.sh
</code></pre></div>
<p>We now have all necessary files to upgrade a 9.2 system to a 9.3 system. To
distribute these we will use the webserver nginx.</p>
<h3>Installing and configuring nginx</h3>
<p>Installing nginx via the pkg package manager starts with:</p>
<div class="highlight"><pre><span></span><code>pkg install nginx
</code></pre></div>
<p>To enable it add</p>
<div class="highlight"><pre><span></span><code>nginx_enable="YES" to
</code></pre></div>
<p>to the <code>\etc\rc.conf</code> file. The standard configuration leaves the server
open to the public, thus we will adjust the nginx configuration
under <code>\usr\local\etc\nginx\nginx.conf</code>, to make the server only available
within our internal network. In our case this is the following address:</p>
<div class="highlight"><pre><span></span><code><span class="nt">server</span><span class="w"> </span><span class="p">{</span><span class="w"></span>
<span class="w"> </span><span class="err">listen</span><span class="w"> </span><span class="err">10.5.128.1:80</span><span class="p">;</span><span class="w"></span>
</code></pre></div>
<p>Also we change the root directory of nginx to point to the update files we
just built:</p>
<div class="highlight"><pre><span></span><code>root /usr/local/freebsd-update-server/pub
</code></pre></div>
<p>The last step is to start it via:</p>
<div class="highlight"><pre><span></span><code>service nginx start
</code></pre></div>
<h3>Configuring the clients</h3>
<p>We now have a working update server that is able to serve our clients, but
they are not yet aware of the fast machine in their neighbourhood. To change
this we have to adjust the <code>\etc\freebsd-update.conf</code>:</p>
<div class="highlight"><pre><span></span><code><span class="err">#</span><span class="w"> </span><span class="n">Trusted</span><span class="w"> </span><span class="n">keyprint</span><span class="p">.</span><span class="w"> </span><span class="n">Changing</span><span class="w"> </span><span class="n">this</span><span class="w"> </span><span class="k">is</span><span class="w"> </span><span class="n">a</span><span class="w"> </span><span class="n">Bad</span><span class="w"> </span><span class="n">Idea</span><span class="w"> </span><span class="n">unless</span><span class="w"> </span><span class="n">you</span><span class="s1">'ve received</span>
<span class="s1"># a PGP-signed email from <security-officer@FreeBSD.org> telling you to</span>
<span class="s1"># change it and explaining why.</span>
<span class="s1"># KeyPrint 800651ef4b4c71c27e60786d7b487188970f4b4169cc055784e21eb71d410cc5</span>
<span class="s1">KeyPrint 5552a36eb246be88412c56eb6ee7edccab50ec9b2fe18c90767853e90ad52a0a</span>
<span class="s1"># Server or server pool from which to fetch updates. You can change</span>
<span class="s1"># this to point at a specific server if you want, but in most cases</span>
<span class="s1"># using a "nearby" server won'</span><span class="n">t</span><span class="w"> </span><span class="n">provide</span><span class="w"> </span><span class="n">a</span><span class="w"> </span><span class="n">measurable</span><span class="w"> </span><span class="n">improvement</span><span class="w"> </span><span class="ow">in</span><span class="w"></span>
<span class="err">#</span><span class="w"> </span><span class="n">performance</span><span class="p">.</span><span class="w"></span>
<span class="err">#</span><span class="w"> </span><span class="n">ServerName</span><span class="w"> </span><span class="k">update</span><span class="p">.</span><span class="n">FreeBSD</span><span class="p">.</span><span class="n">org</span><span class="w"></span>
<span class="n">ServerName</span><span class="w"> </span><span class="mf">10.5.128.1</span><span class="w"></span>
</code></pre></div>
<p>As you can see we used the KeyPrint that the <code>make.sh</code> script generated for us.
You can of course use the DNS name instead of the IP as the <code>ServerName</code>,
but be sure to adjust the <code>/etc/hosts</code> file on each client so that it can resolve local
names.</p>
</div>
<div class="tag-cloud">
<p>
</p>
</div>
</article>
<footer>
<p>© 2023 </p>
<p>
Built with <a href="http://getpelican.com" target="_blank">Pelican</a> using <a href="http://bit.ly/flex-pelican" target="_blank">Flex</a> theme
</p> </footer>
</main>
<script type="application/ld+json">
{
"@context" : "http://schema.org",
"@type" : "Blog",
"name": " Tobias Kaymak"s Blog ",
"url" : "https://tobtob.de",
"image": "https://tobtob.de/images/profile.png",
"description": "Random Notes about Data Engineering - the personal blog of Tobias Kaymak"
}
</script>
</body>
</html>