Bsd on Geek Cabinet https://geekcabi.net/tags/bsd/ Recent content in Bsd on Geek Cabinet Hugo -- gohugo.io en-us Tue, 14 Feb 2023 00:00:00 +0000 Check for Updates to OPNSense from the Command Line https://geekcabi.net/posts/opnsense-check-update/ Tue, 14 Feb 2023 00:00:00 +0000 https://geekcabi.net/posts/opnsense-check-update/ <p>As part of my morning routine, I have a few scripts I run to make sure my laptop and servers are up to date.</p> <p>Rather than login to the web GUI of my OPNSense firewall, I created an alias to check for updates from the CLI.</p> <p>Add the following line to <code>.bash_aliases</code> or directly to <code>.bashrc</code>:</p> <pre tabindex="0"><code>alias check-update=&#39;sudo /usr/local/opnsense/scripts/firmware/launcher.sh check&#39; </code></pre><p>There are a few small, but interesting, additional steps required for the alias to work over a &ldquo;non-interactive&rdquo; SSH session.</p> As part of my morning routine, I have a few scripts I run to make sure my laptop and servers are up to date.

Rather than login to the web GUI of my OPNSense firewall, I created an alias to check for updates from the CLI.

Add the following line to .bash_aliases or directly to .bashrc:

alias check-update='sudo /usr/local/opnsense/scripts/firmware/launcher.sh check'

There are a few small, but interesting, additional steps required for the alias to work over a “non-interactive” SSH session.

First, include the -t parameter with ssh to force the use of a psuedo-tty (so sudo will work). And instead of calling the alias directly, invoke bash and pass the alias as the command. The combined flags of -ic to bash make all that work together. (Credit goes to Cyberciti.biz for explaining these options to me.)

All of the above results in allowing me to run this from my terminal:

me@macbookpro:~ ssh -t opnsense /usr/local/bin/bash -ic 'check-update'

resulting in output similar to the following:

Updating OPNsense repository catalogue...
Fetching meta.conf: . done
Fetching packagesite.pkg: .......... done
Processing entries: .......... done
OPNsense repository update completed. 822 packages processed.
All repositories are up to date.
Checking integrity... done (0 conflicting)
Your packages are up to date.
Checking for upgrades (0 candidates): . done
Processing candidates (0 candidates): . done
Checking integrity... done (0 conflicting)
Your packages are up to date.
]]> OPNSense and BSD Boot Environments https://geekcabi.net/posts/opnsense-boot-environments/ Fri, 04 Nov 2022 00:00:00 +0000 https://geekcabi.net/posts/opnsense-boot-environments/ <p>I&rsquo;ve been using OPNSense for my home firewall for many years now, and I previously ran it as a VM in a Proxmox virtual server. That worked great for my purposes, but I&rsquo;ve since upgraded to a dedicated physical device (Protectli) running OPNSense and I love it.</p> <p>However, with the migration away from a VM, I lost the ability to create a snapshot of the system prior to an upgrade - just in case something went wrong I could easily roll back.</p> I’ve been using OPNSense for my home firewall for many years now, and I previously ran it as a VM in a Proxmox virtual server. That worked great for my purposes, but I’ve since upgraded to a dedicated physical device (Protectli) running OPNSense and I love it.

However, with the migration away from a VM, I lost the ability to create a snapshot of the system prior to an upgrade - just in case something went wrong I could easily roll back.

Recently I learned about BSD Boot Environments and the bectl utility and how they can help fill that gap!

  1. Login via SSH and start a shell session

  2. List any current/previoius boot environment (BE) snapshots

root@opnsense-fw:~ # bectl list
BE     Active Mountpoint Space Created
22.7.2 -      -          1.04G 2021-09-05 10:57
22.7.4 -      -          388M  2022-09-02 09:28
22.7.5 NR     /          4.09G 2022-10-05 08:58

In the “Active” column, the “N” stands for “Now” and “R” is “Reboot”, showing which BE is active now vs after the next reboot.

  1. Create and activate a new BE
root@opnsense-fw:~ # bectl create [new_version]
root@opnsense-fw:~ # bectl activate [new_version]
  1. Reboot and upgrade
  2. Validate BE; Remove oldest BE
root@opnsense-fw:~ # bectl list
BE     Active Mountpoint Space Created
22.7.2 -      -          1.04G 2021-09-05 10:57
22.7.4 -      -          896M  2022-09-02 09:28
22.7.5 NR     /          4.84G 2022-10-05 08:58
root@opnsense-fw:~ # bectl destroy 22.7.2
root@opnsense-fw:~ # bectl list
BE     Active Mountpoint Space Created
22.7.4 -      -          1.13G 2022-09-02 09:28
22.7.5 NR     /          3.80G 2022-10-05 08:58
]]>