FreeBSD

as host OS

as guest OS

Test a ready made image

Get a machine
Get a ready made virtual machine image
Run the machine
following change the bios part
qemu-system-x86_64 -m 4096 -smp 4 -serial mon:stdio -nographic -drive file=FreeBSD-14.0-RELEASE-amd64.qcow2 -enable-kvm
Close the machine from within freebsd
poweroff

Prepare a ready made image

Download say FreeBSD-15.0-RELEASE-amd64-BASIC-CLOUDINIT-ufs.qcow2.xz
Get a machine
cp FreeBSD-15.0-RELEASE-amd64-BASIC-CLOUDINIT-ufs.qcow2.xz vm00.qcow2.xz
Make a copy of the file to avoid future downloads
uzxz vm00.qcow2.zx
Expand the image
qemu-img resize vm00.qcow2 +4G
Resize the hard disk of the work copy to a desired size in our case increase by 4G
 /usr/bin/qemu-system-x86_64 \
	-enable-kvm -m 8192  -cpu host -smp 4 \
	-drive file=./vm00.qcow2 \
	-monitor unix:/run/vm00.sock,server,nowait \
	-nic tap,mac=b4:e1:ad:2b:d3:00 \
	-serial mon:stdio  -nographic \
	-pidfile /run/user/1001/vm00.pid \
	-name vm00,process=vm00

run the machine with access to serial console. For this FreeBSD image some scripts will be run for you on the virtual machine. Subsequently the virtual machine will reboot and you will be greeted with a login for a root user. Just type root to access FreeBSD are root. From within the root console of the virtual machine get some things ready, such as remote access

passwd
set a root password and reboot the virtual machine
vi /etc/rc.config
set the hostname to a meaningful name
vi /etc/ssh/sshd_config
modify sshd to allow root login
reboot
after setting up a root password reboot the machine. Send your public key file to the guest with ssh-copy-id root@192.168.1.XXX or ssh-copy-id root@guest_hostname where guest_hostname resolves to the ip address of the guest. You should be able to log in the guest with ssh root@192.168.1.XXX or ssh root@guest_hostname. Log in with your new root password either from the serial console or remotely.
vi /etc/ssh/sshd_config
modify sshd to allow root login but only with public key authentication.
service sshd restart
make sure the sshd daemon uses the new configuration - there are alternative ways to do it of course
perform any tasks you want on your virtual machine that runs FreeBSD. One good idea would be to add a new user with wheel privileges instead of using root login. Install any software that you need
pkg update
It is a good idea to add the various ports for easier installation of software. Be where of pkg update issue
poweroff
power down your virtual machine if not in use

Expand disk after installation

After creating the guest virtual machine at one point your drive may be full in which case you may need to increase the drive space (Ram and the like are changes to qemu-system-x86_64) options. From the host do

echo system_powerdown | socat - unix-connect:/path/to/work.sock
stop the virtual machine
qemu-img resize work.qcow2 +4G
expand the drive with the desired amount
qemu-system-x86_64 -drive file=work.qcow2
start the virtual machine. Include all options that you regularly use
ssh root@work
access the root console in the guest
gpart show
see the names of the dist as viewed by gpart. In my case ada0
gpart recover ada0
if there is a corruption fix it (possible after expanding the disk with qemu-img
gpart resize -i 5 ada0
here -i 5 points to (the last) partition of the disk where the root partition is stored
df -h
Check where root partition is mounted on /dev mine was different from /dev/ada0p5. It was on /dev/gpt/rootfs
growfs /dev/gpt/rootfs
grow the partition (this is assuming you used ufs type filesystem)
reboot
reboot and log on again to verify the changes

Apache on FreeBSD

Install and configure Apache

pkg install apache24
installs Apache with output
apachectl -M
list loaded modules
vi /etc/rc.local
add apache24_enable="yes" to run apache at start up
cd /usr/local/etc/apache24/
go to the apache24 config directory and create necessary certificate keys
openssl ecparam -name prime256v1 -out p256-apache24.pem
To use https create necessary keys for apache, to use self signed certificates. Start with creating a key
openssl req -x509 -newkey ec:p256-apache24.pem -keyout apache24.key -out apache24.crt -days 365 -nodes
create the certificate and the corresponding key. The files apach24.key and apache24.crt are the needed files.
vi /usr/local/etc/apache24/httpd.conf
and comment out enable
LoadModule ssl_module libexec/apache24/mod_ssl.so
LoadModule socache_shmcb_module libexec/apache24/mod_socache_shmcb.so
LoadModule include_module libexec/apache24/mod_include.so
allow https connections and server side includes
Include etc/apache24/extra/httpd-ssl.conf
within this file there are calls to SSLcertificates and keys. Those certificates must be present - they may not come with the package. Create your own if necessary.
Include etc/apache24/sites-enabled/*.conf
create director /usr/local/etc/apache24/sites-enabled and with the above line place all virtual hosts in that directory. All files ending with .conf will be served by apache
For basic authentication the authentication file must be in the root directory /usr/local/www
vi /usr/local/etc/apache24/extra/httpd-ssl.conf
Verify the correct place of the certificates that were created
  • SSLCertificateFile "/usr/local/etc/apache24/apache24.crt"
  • SSLCertificateKeyFile "/usr/local/etc/apache24/apache24.key"
service apache24 start
Start apache24

Php82 on FreeBSD

install and configure

pkg install php82
or with the script ./bsd_php82_mods.sh which in addition installs apache24 and a bunch of useful extensions and reports
php -m
check available modules it appears json , openssl , pcre and spl (SPL) are installed by default
cp /usr/local/etc/php.ini-developement /usr/local/etc/php.ini
create a php.ini file

PostgreSQL on FreeBSD

Here the operating system runs on a virtual machine. Access its terminal as root

Installation

pkg update
update to the latest package management in FreeBSD
pkg search postgresql
find the latest versions of PostgreSQL available for you
pkg install postgresql18-server postgresql18-client
make sure you have enough space and install the software. postgresql18-client gives you psql command that lest you manage the databases from within the virtual machine.
vi /etc/rc.config
add postgresql_enabled="yes" to start the database on boot

Configuration for local access

Edit /var/db/postgres/data18/postgresql.conf (this is for PostgeSQL v18) and set


	listen_address = 'localhost,192.168.1.88'
	password_encryption = scram-sha-256

where 192.168.1.88 is the IP address of the machine that host PostgeSQL. Make sure the passwords are stored in the specified format before setting passwords of any users.

Next edit /var/db/postgres/data18/pg_hba.conf and set


	host    all             all             127.0.0.1/32            trust
	host    all             all             192.168.68.0/24 scram-sha-256
	

Useful BSD tools

doas

allows you to run code as a different user; sudo alternative

pkg install doas
installs doas
cp /usr/local/etc/doas.conf.example /usr/local/etc/doas.conf
create doas's config file
vi /usr/local/etc/doas.conf
make changes that suit you

OpenSSL

This library comes pre-installed with BSD and Linux variants. The use case here is to create client keys so as to avoid password authentication.

ssh-keygen -t ed25519
create curve ed25519 key pairs, which are stored in your $HOME/.ssh directory
ssh-keygen -t ecdsa
create curve elliptic curve DSA signing key pair, which are stored in your $HOME/.ssh directory
ssh-copy-id user@hostname
copy the created keys to the authorized_keys file on the remote server. From now on you can use publickey authentication instead of password authentication
pkg install fusefs-sshfs
on freebsd
apt-get install sshfs
on Linux variants
vi /etc/fstab
sshfs#user@hostname:/path/to/share /path/to/mountpoint fuse noauto,rw,uid=username,gid=groudname,user,reconnect,IdentityFile=/path/to/home/.ssh/id_ecdsa 0 0
mount /path/to/mountpoint
the above command can be executed as a user. No need for root access

socat

A multi purpose relay, which had multiple use cases

  • You have a personal computer and various firewall rules on your work place or anywhere else are prohibiting you from using ssh to log onto your computer you can hide the ssh trafic as https trafic
  • You manage a virtual machines and need to access the unix socket where the virtual machine monitor (e.g., qemu monitor) accepts connections.
pkg install socat
installs socat on freebsd
openssl req -x509 -newkey rsa:2048 -keyout client.key -out client.crt -days 300 -nodes
create certificate for the client
mv client.* $HOME/.ssh/
place the client certificates in your home ssh directory
openssl req -x509 -newkey rsa:2048 -keyout tunnel.key -out tunnel.crt -days 300 -nodes
create certificate for the server tunnel
avoid fancy parameters both at the server end (where socat runs) and the client end (your laptop from which you connect to your home ps that runs socat) as it makes it more likely for the firewall to filter your traffic, hence the RSA choice
mv tunnel.* /root/
move the tunnel certificate and key to the root home
/path/to/socat -L /run/Socat_21022_22 OPENSSL-LISTEN:21022,fork,reuseaddr,certificate=/root/tunnel.crt,key=/root/tunnel.key,verify=0 tcp:127.0.0.1:22 &
by running the above code at boot (e.g. within /etc/rc.local you can hide your ssh connections within https. The tunnel listens to incoming port 21022 and redirects it to local port 22. Since this is only for hiding traffic no keys are verified (verify=0).
vi $HOME/.ssh/config/
tell ssh to wrap your traffic into https connection by setting
Host vicktricks.net
	ProxyCommand =/usr/bin/socat STDIO OPENSSL-CONNECT:%h:21022,verify=0,cert=/path/to/home/.ssh/client.crt,key=/path/to/home/.ssh/client.key
router
with the above specifications make sure the router you have at home and connects you to the wider internet forwards port 21022 to the IP address associated with your computer (where socat tunnel.crt/tunnel.key are run