Headless installation (w/o monitor and keyboard, over ssh)

Should one of the official install images provide a headless installation by default?

  • Yes

    Votes: 10 58.8%
  • No

    Votes: 5 29.4%
  • Don't know

    Votes: 0 0.0%
  • I don't care

    Votes: 2 11.8%

  • Total voters
    17
  • This poll will close: .
While I prepare the preliminary patch(1) file version 0.1 (MILESTONE 1: Usable with basic UNIX knowledge AND a UNIX machine to prepare the image (apply the patch)), anyone interested in this topic can
1. dive into the rc(8) scripts of the install image and figure out how to NOT start bsdinstall(8) on the console:
/usr/libexec/bsdinstall/runconsoles /usr/libexec/bsdinstall/startb...
is running. Instead we want that to run on our ssh(1) login, preferably dont start it before we login. And then
2. since we already have the network interface configured via DHCP, how to disable this step in bsdinstall(8)
Thx in advance!
P.S. I forgot: I'm using an install image of FreeBSD-15.0-STABLE (March, 12th IIRC). Usually there are no major differences in bsdinstall(8) to the preceding major version, but this time there are!

Thats's why I told you to use a proper install, configured with your user account, to boot the blind server. There is no need to use an installer image. sysinstall can be started from any installed system.
 
Thats's why I told you to use a proper install, configured with your user account, to boot the blind server. There is no need to use an installer image. sysinstall can be started from any installed system.
You mean bsdinstall(8)? Hm yes, a minimal basic install where
sshd(8) runs as the only service after boot. Then we don't have to worry about breaking the install procedure, because it does not apply. IIUC that's exactly what mfsBSD does. So
1. I take mfsBSD,
2. it should be pretty easy to adopt for 14.4-REL or 15.0-STABLE,
3. create a user fbsdinstall
4. Enable DHCP,
5. Enable sshd(8)
that's it, it will be able to do what I want. I can remotely login as fbsdinst and start bsdinstall(8). Sorry I needed so long to catch it ... ;)
 
I “voted” no. How often do you need to (re‑)install FreeBSD per (headless) machine? This isn’t VVindoh’s, you know. For once in your life you can hook up the box to a keyboard and display.​
That's not the point. The point is that some innocent newbie might want to install FBSD on his/her headless box. My intention was to provide an install medium that they can download to do that. I can create it, you can create it, but most non-UNIX folk can't do it. They might be interested to give FBSD a try on their NAS box or such, but they can't install it because there is no headless install image they can download.
 
I say go for it. I'm growing tired of the "nay"'s and "no"'s. What is it to them?
That's a really nice short poem! I still have hope that FBSD becomes even more welcoming to interested newbies. At least AFAICT there has been a lot of improvement concerning this in the last decade.
Now I'm going to ask some Q how to set up my new box in another thread.
 
Either use mfsBSD or mount a FreeBSD installer image (rw!), chroot into it and manually start sshd once (to generate the host ssh keys). Add your own public ssh key to /root/.ssh/known_hosts, edit /etc/ssh/sshd_config at will and then add sshd_enabled to rc.conf and a basic network configuration that suits your needs and the target host. Save, exit, dd to a usb disk and boot it. For a one-off installation this is still the quickest and easiest way IMHO.
After logging in via ssh you just start bsdinstall and proceed as with any other installation.

I haven't used either method for a while, since pretty much every system I've set up over the last years either was a real server with a BMC supporting console redirection (e.g. via web interface), some embedded platform with a serial console (for that you need to setup comconsole in loader.conf and maybe switch from vt to sc, since vt often tries to do fancy stuff that may lock up the serial console...) or a VM (bhyve) with direct console access.
I regularly used mfsBSD with some 'cloud-init'-like scripts to set up throwaway cloud instances for a while - if you have to do this more than once, this might also be an option as it is easily customizable and makes it pretty simple to produce up-to-date installer images without doing eveything from scratch over and over again.

RE the poll:
The installer images already have a headless mode: on systems without any graphics adapter it defaults to serial console. The problem with that is that most emulation layers for this in EFI firmwares are broken some way or another and need some tweaking.
Mounting the image and putting 1-2 lines in /boot/loader.conf isn't that hard - if one can't do that, they also won't be able to install, let alone set up and run a server anyways. (and sholdn't be allowed to - especially if its hooked up to the interwebs...)
So i voted "no" - it's already there and only needs to be adjusted for the actual use case. I don't think its worth wasting valuable developer time trying to make something that automagically catches each and every weird, ancient hardware reliably (how should it know which network interface you want it to use anyways? most servers have more than one...)
 
That's not the point. The point is that some innocent newbie might want to install FBSD on his/her headless box. My intention was to provide an install medium that they can download to do that. I can create it, you can create it, but most non-UNIX folk can't do it. They might be interested to give FBSD a try on their NAS box or such, but they can't install it because there is no headless install image they can download.

An innocent newbie would not even attempt this, they would drag a monitor and keyboard to the closet. Or get an IPMI capable mainboard.

How is a newbie going to figure out which IP address the thing lands on after USB boot?
 
[...] I regularly used mfsBSD with some 'cloud-init'-like scripts to set up throwaway cloud instances for a while - if you have to do this more than once, this might also be an option as it is easily customizable and makes it pretty simple to produce up-to-date installer images without doing eveything from scratch over and over again. [...]
I'm with you 99%
[...] if one can't do that, they also won't be able to install, let alone set up and run a server anyways. (and sholdn't be allowed to - especially if its hooked up to the interwebs...) [...]
...except with this. These folks repair our roofs, drill our teeths, etc. pp. They have every right on earth to have access to good IT stuff. I really think it's a matter of attitude. Why is Linux so omnipresent in consumer hardware? Because some guys understood how to make it accessible for non-IT-nerds. It would benefit FreeBSD if it's easier to access. Then the young kid that learns FBSD now could become a skilled kernel developer in 15-20 years.
How is a newbie going to figure out which IP address the thing lands on after USB boot?
All the DHCP servers I've seen on consumer hw let the client choose it's hostname. So then they could easily use the name (freebsd) instead of the IP#.
 
Last edited:
Why is Linux so omnipresent in consumer hardware? Because some guys understood how to make it accessible for non-IT-nerds. It would benefit FreeBSD if it's easier to access. Then the young kid that learns FBSD now could become a skilled kernel developer in 15-20 years.
Making stuff easier for appeal is what had Wayland years-early, systemd, and Docker-reliance everywhere :p


I have the opinion learning should be encouraged with self-interest; I wanted FreeBSD, looked into it, and had it on my server and laptop within a few days after years of Linux. If a sysadmin has passion, they'd want the best? That takes research (syadmins should know how to do that :p)

I feel looking for a fast/easy solution right out the gate removes the passion of doing it right, along with presenting an expectancy of perfection (unless everything's turn-key easy, the first sign of complexity likely involves a OS swap to one doing the thing easier/stuff like Docker)

Plus if I can host 7 websites and game servers of varying tech with no BSD-specific instructions, surely others can figure out how too? FreeBSD's free, along with the knowledge to use it :D
 
Well, either way. I carry around a USB mass storage device (a NVMe in a USB enclosure) that has a FreeBSD and a Linux on it in dual-boot. Fully configured with my user account and my utils and packages I need. I use that in situations where I want to boot some random computer into something useful.

If you had that you could use that to blind boot the headless machine and then cross-install.

I don't know why you want to hack up some form of crippled installer thing.
 
  • Thanks
Reactions: sko
I want to create a solution for the 99/100 days when the network devices can come up and everything goes fine until that happens.
If you are talking about updates/upgrades (as opposed to installing for the first time) I am more sympathetic. I have never liked freebsd-update, nor am I thrilled about pkg-izing the base. Updates should be as painless as possible. Ideally no installed apps breaks even when a major update is made.
 
Trust me been long on this forum. Some persons like to create FrankenStein-OS. Then find out they shoot themselves in the foot.
Even myself when i had lines in /etc/make.conf. Even "" , chromium did not liked.
 
I voted "Yes" with the added desire that headless installer be controlled via a serial console where the serial port is provided by a PCI serial card (motherboard based serial console works fine).

I've tried to get the installer to recognise PCI card supplied serial port, so far without success using BIOS boot.

I saw a post on these forums on how to rework a UEFI installer boot that loads PCI serial card drivers into the UEFI environment and then starts the installer but was hoping for a simpler solution to install using a serial console.
 
Maybe now it's time to think about some basic security? Does a password make sense when it's written all over the net? Can or shall we easily create a OTP, maybe based on the time of day, that is only valid for let's say 5-10 minutes, and an attacker can not know when we're going to use it? Or is that nonsense, because the gangster could easily wait & listen if the network is already compromized?
I was thinking about doing something using the mac address which assumes you have something on the same local network. The ip address might work too, perhaps with the hostname.

... and
3. Where do we have to patch service sshd keygen into the boot sequence?
Maybe you don't. Set it to a fixed key you already know. I would have your install run sshd out of /tmp so the real system can be set up properly with out all the security holes that might be forgotten later.
.
Thinking about the passwd in the 1st part and the fact that you only need root privileges, and this should be running out of /tmp or a mem image, maybe have a user "ipXXX" where the passwd is the ip address and "arpXXXX" where the mac address but you will need that per interface. If eth3 comes up with 1.2.3.45 then"ip45"'s passwd could be "54.3.2.1" and that gives a root user called "ip45" (see existing user toor as an example). Doing this in /tmp means all this is gone after a reboot so get it right the 1st time or reinstall it as the rootish passwords won't work using the new system installed sshd_conf
 
The current boot already have a serial console support for installation and all modern servers have support for out of band management like ILO,IPMI,IDRAC and so on. For commercial computers you have Intel ME so you can use VNC to connect to and perform installation over serial console.

If you plan to automate the installation take a look at sysinstall bsdinstall(8) script.
 
I don't know why you want to hack up some form of crippled installer thing.
Wrong preliminary: I do NOT want to hack up a crippled installer thing. Instead, all I wanted was a version of the official DEFAULT installer with just one difference (which most likely will require more than one configuration knob to be changed, thus it should be tested and thought out thoroughly):
  • allow for a headless installation via ssh(1) by default, where the target box gets it's IP# via DHCP and does not have a fixed IP#.
I.e. the console is still available, you can login w/o password if the machine has a keyboard, and you can see the console output if a monitor is connected or via serial console (IIRC the default behaviour is to switch to serial if no keyboard is found), like with the default install image. Just that the bsdinstall(8) is not started on the console automatically, but instead must be started manually. The 1st enhancement would be to start it automagically on the 1st login via ssh(1), or on every ssh-login and you can select the "start a shell" menu entry if you need a shell.

I'm aware that UNIX wizzards like you usually do not need such a thing bacause you can easily create one taylored to your likings, but you're not the only human on earth who might want to install FreeBSD on a headless machine or remote via ssh(1) by instructing s/o to plug in a USB thumb drive or CD with that tweaked installer into the target machine, and you can install remotely over the internet.
 
Wrong preliminary: I do NOT want to hack up a crippled installer thing. Instead, all I wanted was a version of the official DEFAULT installer with just one difference (which most likely will require more than one configuration knob to be changed, thus it should be tested thoroughly):
  • allow for a headless installation via ssh(1) by default, where the target box gets it's IP# via DHCP and does not have a fixed IP#.
I.e. the console is still available, you can login w/o password if the machine has a keyboard, and you can see the console output if a monitor is connected or via serial console (IIRC the default behaviour is to switch to serial if no keyboard is found), like with the default install image. Just that the bsdinstall(8) is not started on the console, but must be started manually. The 1st enhancement would be to start it automagically on the 1st login via ssh(1), or on every ssh-login and you can select the "start a shell" menu entry if you need a shell.

I'm aware that UNIX wizzards like you usually do not need such a thing, but you're not the only human on earth who might want to install FreeBSD on a headless machine or remote via ssh(1)
by telling s/o to plug in a USB thumb drive or CD with that tweaked installer into the target machine, and you can install remotely.
Interesting challenge. Reminds me of copying the DOS Fastlynx program to a target system without using floppies. You had to set the serial port as command input source. The remote program gets a ready signal and transfers itself to the c: current dir on the other side. ..
Wouldn't there be anyting similar possible with nc? 1 problem is that everything is closed on a booted installer medium. I would try to blindly open the installer shell and initiate some kind of listening link that takes commands. Maybe nc -l with some pipe to run preparation script code? Then redirect the rarget console I/O to the source system.
 
I voted "Yes" with the added desire that headless installer be controlled via a serial console where the serial port is provided by a PCI serial card (motherboard based serial console works fine).

I've tried to get the installer to recognise PCI card supplied serial port, so far without success using BIOS boot.

I saw a post on these forums on how to rework a UEFI installer boot that loads PCI serial card drivers into the UEFI environment and then starts the installer but was hoping for a simpler solution to install using a serial console.
IIRC the default behaviour is that boot(8) switches the console to serial if no keyboard is found. Thus booting w/o a keyboard should get you where you want? Else you could edit the rc.conf(5) on the install medium to load the appropiate driver, i.e. you must know it's name and add the line kld_list="${kld_list} serial_driver_here". Unfortunately, the automagic driver loading of FreeBSD is far from beeing perfect, at least in 14.x. But then you have an installation image specifically for that hardware. I'd like to have the topic of this thread beeing s/th like "an installer image to perform a headless install over network via ssh(8)" on ANY hardware, i.e. most, as many as possible. Sorry I forgot that "headless" also includes serial console. Maybe I have to open another thread that includes network and ssh?
 
Well, either way. I carry around a USB mass storage device (a NVMe in a USB enclosure) that has a FreeBSD and a Linux on it in dual-boot. Fully configured with my user account and my utils and packages I need. I use that in situations where I want to boot some random computer into something useful.

If you had that you could use that to blind boot the headless machine and then cross-install.

I don't know why you want to hack up some form of crippled installer thing.
The whole thing seems kind and of weird to me as the main situations where you're likely to want this are ones when you'd likely have hardware support for a network monitor or the ability to plug one if those cool network Raspberry Pi KVM clients.

Personally, I don't particularly care either way, but I find it hard to believe that enough developers will be interested to not just create the installer, but keep patching the inevitable security issues that crop up over time.
 
The whole thing seems kind and of weird to me as the main situations where you're likely to want this are ones when you'd likely have hardware support for a network monitor or the ability to plug one if those cool network Raspberry Pi KVM clients.
No, the environment I had in mind is a SOHO of non-IT-nerds. It would also work in more advanced networks of hobbyists and professionally managed network environments, but these can easily create such thing themself, taylored to their specific needs and likings.
 
Wrong preliminary: I do NOT want to hack up a crippled installer thing. Instead, all I wanted was a version of the official DEFAULT installer with just one difference

The official install media are a crippled Unix install.

You are better off with a USB thing with a full install on it, with user account and password set.
 
The official install media are a crippled Unix install.

You are better off with a USB thing with a full install on it, with user account and password set.
The installer supports full breakout from the shell if you have enough memory but headless is not funny. 😆
I doubt if anyone manages to take over the hardware console of a system with a running installer on screen. (Or somehow change everything to serial on the fly like a Raspberry. Never tried that. Change a primary console output value from monitor to serial?)
 
  • The official install media are a crippled Unix install.
OTOH that means 1. it runs on most machines and 2. it's reasonably small.
You are better off with a USB thing with a full install on it, with user account and password set.
Yes, this is the mfsBSD way, likely what I prefer too, as it has one huge advantage: it doesn't access any storage except the install medium, because the running OS is on a md(4). And once that is up and if it fits into RAM, you should be able to plug it out, so you can install to a medium pluged into that same hardware interface (are there machines with just one USB port?). 2nd advantage is you can have a password, but that applies to the default installer image as well -- if you want, you can edit the config and set any pw you like.

What are the tools you would expect or like to have on a "headless network install" image?
  • neovim?
    It can create a .orig on the 1st modification, and uses the standard backup marker ~ afterwards. This is a very valuable feature.
  • mc To comfortably browse through the filesystem
  • manpages
  • minicom
  • your choice here, please.
    If you like, you may separate "must-have", "expected/should-have" and "nice-to-have/extra/goodies". Call these categories as you like as long as others can grasp what you mean.
 
Back
Top