OpenBSD Upgrade Guide: 4.3 to 4.4

[FAQ Index] | [4.2 -> 4.3] | [4.4 -> 4.5]

Note: Upgrades are only supported from one release to the release immediately following it. Do not skip releases.

It is highly recommended that you read through and fully understand this process before attempting it. If you are doing it on a critical or physically remote machine, it is recommended that you test this process on an identical, local system to verify its success before attempting on a critical or remote computer.

Upgrading is a convenient way to bring your OpenBSD system up to the most recent version. However, the results are not intended to precisely match the results of a wipe-and-reload installation. Old library files in particular are not removed in the upgrade process, as they may be required by older applications that may or may not be upgraded at this time. If you REALLY wish to get rid of all these old files, you are probably better off reinstalling from scratch.

Table of Contents:

• Before upgrading
  • New sysmerge tool
  • dhcpd.interfaces no longer used
  • New X drivers
  • pfsync
  • rc.conf
  • Modified kernel
• The upgrade process
• Final steps
  • New and changed Users and Groups
  • Upgrading /etc
  • Checking the kernel
  • Upgrading packages

Before upgrading: things to think about and be aware of

• New sysmerge(8) utility:
  OpenBSD 4.4 includes the new sysmerge(8) utility, which helps administrators update configuration files after upgrading their system. Sysmerge(8) compares the current files on your system with the files that would have been installed with a new install, and gives you the option of keeping the old file, installing the new file, or assisting you in the manual merging of the old and new files, using sdiff. For past upgrades, we've presented a list of files that are usually copied over "as-is", and a list of files which should be changed, and a patch file that applies those changes to what might be in those files on your system. For the 4.3 to 4.4 upgrade, instead of using the patch file, you may opt to use sysmerge to make the changes.

  Who should use sysmerge(8):
  People running highly modified systems or systems that didn't start out at the previous release (for example, a snapshot partway between releases), who are upgrading to a snapshot or who have not carefully upgraded their system in the past will find sysmerge vastly superior to using the patches, as it works with what is actually on your system, instead of what we expected was on your system. It will also give you much greater control over your upgrade process, and will involve you in it more closely.

  Who may wish to NOT use sysmerge(8):
  People who have a lot of machines to upgrade that were kept fairly simple and at the previous release/stable point will probably find the old patch file system much faster.

  Note that while sysmerge can handle ALL the changes of /etc, /dev, /root and /var, we highly recommend that you do some steps manually before hand, as it will save time and reduce the possibility of user error. In particular, it is highly recommended that you do not use sysmerge to update your user and group accounts, as it is very easy to chose the wrong option leading to erasing your entire user base and setting the root password to an empty value, preventing remote login to fix the problem.

• dhcpd.interfaces no longer used:
  The file /etc/dhcpd.interfaces is no longer used to select which interfaces dhcpd listens on. This can now be specified in the dhcpd_flags setting in /etc/rc.conf.local. Most users can probably just let dhcpd(8) figure out which interface it can listen on from the configuration information in the dhcpd.conf file.

• New X drivers The xf86-video-openchrome driver has been added to Xenocara for VIA chipsets in place of the old, "via" driver. If you're using a VIA chipset with a configuration file, replace Driver "via" with Driver "openchrome" in /etc/X11/xorg.conf to use the new driver. See the openchrome(4) manual page for more configuration options.

  The ati(4) driver has been updated. This update of xf86-video-ati brings about some important changes.

  • No more MergedFB: Support for MergedFB mode has been removed in favor of xrandr(1).
  • Quirk option for Macbooks changed: Users with Macs or Macbooks that use the following quirk Option "iBookHacks" "on" should read the radeon(4) man page, specifically the "MacModel" section, if there are problems.
    As of this revision this quirk has been removed.

• pfsync:
  Due to changes in the pf(4) state table, the pfsync(4) protocol version number has been incremented; firewalls with differing version numbers will be unable to synchronise state tables, and existing connections will be terminated on failover.

• rc.conf:
  Unlike earlier versions of this process, since 4.1 it is assumed that /etc/rc.conf is not a user-altered file. If you have made changes to your /etc/rc.conf file, merge those changes into /etc/rc.conf.local. If you have NO /etc/rc.conf.local, simply copy your existing /etc/rc.conf file to /etc/rc.conf.local and delete the last line of the script! Otherwise, pull your existing rc.conf into the top of your existing rc.conf.local file and remove the last line before doing the rest of this process.

• Modified kernel:
  Check whether you have made any modifications to your kernel. For example, you might have modified your network device to use a non-default setting using config(8). Note your changes, so you can repeat them for the new 4.4 kernel.

The upgrade process

Upgrading by install kernel

One easy way to boot from the install kernel is to place the 4.4 version of bsd.rd in the root of your boot drive, then instruct the boot loader to boot using this new bsd.rd file. On amd64 and i386, you do this by entering "boot bsd.rd" at the initial boot> prompt.

Upgrading without install kernel

Sometimes, one needs to do an upgrade of a machine when one can't easily use the normal upgrade process. The most common case is when the machine is in a remote location and you don't have easy access to the system console. One can usually do this by carefully following this process:

• Place install files in a "good" location. Make sure you have sufficient space!

• Stop any "insecure" applications from starting at boot: There will be a time when PF will be unlikely to be running during this upgrade process, but your applications may still start and run properly. Any application dependent upon PF for security should be disabled before this happens, and should not be re-enabled until proper PF operation is verified after upgrade. There may be other applications which you wish to keep from running during the upgrade, stop and disable them as well.

• Check the kernel: Although most people can skip this step, if you had a modified kernel in 4.3, it is likely you will need to modify the stock kernel of 4.4. Especially when you are performing the upgrade process remotely, now is the time to make sure the new kernel will work upon rebooting the machine. If any changes must be made to the kernel, the safest thing to do is to make those changes on a local 4.4 system. This can be as simple as modifying a specific device using config(8), or it can involve a recompilation if the option you need is not included in the GENERIC kernel. Please consult FAQ 5 - Building the system from source before considering to recompile your kernel.

• Install new kernel(s)

  export RELEASEPATH=/usr/rel   # where you put the files
  cd ${RELEASEPATH}
  rm /obsd ; ln /bsd /obsd && cp bsd /nbsd && mv /nbsd /bsd
  cp bsd.rd bsd.mp /
  

  (if you are using the multiprocessor kernel, use
       rm /obsd ; ln /bsd /obsd && cp bsd.mp /nbsd && mv /nbsd /bsd
  instead)

  Note the extra steps for copying over the primary kernel: those are done to ensure that there is always a valid copy of the kernel on the disk that the system can boot from should there be a really badly timed power outage or system crash.

• Install new /etc/firmware files and other critical utilities: Some uploaded "firmware" files may have been updated, so you may need to update the files in the /etc/firmware directory. This will impact users of only a few devices, though all users can use this step without harm. To make sure your network is fully functional on reboot, the new kernel will need updated ifconfig and pfctl utilities to be configured properly after the reboot in the next step. Again, it's something that all users can do without harm, but if you are performing your remote upgrade over a pppoe(4) connection this step can be crucial. To extract the firmware files and utilities from base44.tgz, use the following as root:

  tar -C / -xzphf ${RELEASEPATH}/base44.tgz ./etc/firmware ./sbin/ifconfig ./sbin/pfctl
  

• Reboot on the new kernel: This might be a tempting step to skip, but it should be done now, as usually, the new kernel will run old userland apps (such as the soon to be important reboot!), but often a new userland will NOT work on the old kernel.

• Install new userland applications. Do NOT install etc44.tgz and xetc44.tgz now, because that will overwrite your current configuration files!

  export RELEASEPATH=/usr/rel
  cd ${RELEASEPATH}
  tar -C / -xzphf base44.tgz
  tar -C / -xzphf comp44.tgz
  tar -C / -xzphf game44.tgz
  tar -C / -xzphf man44.tgz
  tar -C / -xzphf misc44.tgz
  tar -C / -xzphf xbase44.tgz
  tar -C / -xzphf xfont44.tgz
  tar -C / -xzphf xserv44.tgz
  tar -C / -xzphf xshare44.tgz
  

  Note: not all file sets will need to be installed for all applications, however if you installed a file set originally, you should certainly upgrade it with the new file set now.

  Note: the files in /etc are handled separately below, so etc44.tgz and xetc44.tgz are NOT unpacked here.

• Upgrade /dev. The new MAKEDEV file will be copied to /dev by the installation of base44.tgz, so you simply need to do the following:

  cd /dev
  ./MAKEDEV all
  

• Upgrade /etc as below.

• Reboot

    Nov 1 12:47:05 puffy sm-mta[16733]: filesys_update failed: No such file or directory, fs=., avail=-1, blocksize=380204

These messages can be safely ignored for the moment, or you may wish to halt sendmail(8) during the upgrade process. Note that sendmail is not working properly at this point, and will need to be restarted (as part of the reboot) before mail is expected to be handled properly.

Final steps

1. New Users and Groups

useradd -u92 -g=uid -c"IPv6 Router Advertisement Daemon" -d/var/empty -s/sbin/nologin _rtadvd
useradd -u93 -g=uid -c"YP to LDAP Daemon" -d/var/empty -s/sbin/nologin _ypldap

2. Upgrading /etc

You will want to extract the etc44.tgz files to a temporary location:

tar -C /tmp -xzphf ${RELEASEPATH}/etc44.tgz

etc/magic
etc/netstart
etc/rc
etc/rc.conf
etc/security
etc/services
etc/mail/localhost.cf
etc/mail/sendmail.cf
etc/mail/submit.cf
etc/mtree/4.4BSD.dist

cd /tmp/etc
cp magic netstart rc rc.conf security services /etc
cp mtree/* /etc/mtree
cp mail/*.cf /etc/mail # Careful on this one!!

3a. Merging locally changed files via a patch file

These files likely have local changes, but should be updated for 4.4. IF you have not altered these files, you can copy over the new version, otherwise the changes must be merged with your files:

etc/changelist
etc/ftpusers
etc/hosts.lpd
etc/man.conf
etc/sudoers
etc/mail/aliases
etc/ssh/ssh_config
etc/ssh/sshd_config

cd /
patch -C -p0 < upgrade44.patch

The following files have had changes which should be looked at, but it is unlikely they should be directly copied or merged (i.e., if you are using pf.conf, look at the suggested change of strategy, and decide if it is appropriate for your use).

etc/dhclient.conf
etc/pf.conf
var/www/conf/httpd.conf

There is a file that can be deleted as it is no longer used in 4.4:

rm /etc/dhcpd.interfaces

newaliases
mtree -qdef /etc/mtree/4.4BSD.dist -p / -u

3b. Merging locally changed files via sysmerge(8)

The new sysmerge(8) utility will compare the files that are actually on your system with those that would be installed to a fresh install, and assist you in merging the changes into your system. Note that unlike the patch file, there are no assumptions made about what is actually on your system, so you can use sysmerge(8) to move between more arbitrary points in the development process, such as from an earlier -current to 4.4-release or from one -current to a later one.

Please read the sysmerge(8) manual page before using it on your system. You are also advised to read the diff(1), sdiff(1) and even review more(1) manual pages before continuing.

Assuming the etc44.tgz and xetc44.tgz files exists in your $RELEASEPATH, run it with:

# sudo sysmerge -as $RELEASEPATH/etc44.tgz -x $RELEASEPATH/xetc44.tgz

  Use 'd' to delete the temporary ./var/www/htdocs/index.html
  Use 'i' to install the temporary ./var/www/htdocs/index.html
  Use 'm' to merge the temporary and installed versions
  Use 'v' to view the diff results again

  Default is to leave the temporary file to deal with by hand

If you wish to retain your existing file, delete the temporary file, if you wish to replace your existing file with the new version, install the temporary file. If you wish to merge the two together, choosing 'm' will put you into sdiff(1), where you can manually merge the file. The default is to come back and deal with the file later, manually.

While it can work, we do not recommend you use sysmerge to integrate new users into the system, but rather use the useradd(8) line above. We believe it is much less error prone. (hint: do not install the temporary master.passwd file over your existing one!).

Sysmerge(8) saves all your replaced files into a temporary directory, similar to /var/tmp/sysmerge.24959/backups, so if you accidentally clobber something that was probably not such a good idea, you have a chance to recover it. Note that daily(8) cleans old files from this directory.

4. Checking the kernel

If you followed the instructions for the upgrade process without install kernel, you have already completed this step. However, if you used the install kernel, and if you had a modified kernel in 4.3, it is likely you will need to modify the stock kernel of 4.4. This can be as simple as modifying a specific device using config(8), or it can involve a recompilation if the option you need is not included in the GENERIC kernel. Please consult FAQ 5 - Building the system from source before considering to recompile your kernel.

5. Upgrading packages

The following packages are known to have significant upgrade issues that will impact a large number of users. The fact that a package is not on this list doesn't mean it will have a trivial upgrade. You must do some homework on the applications YOU use.

• ejabberd: When upgrading ejabberd from 1.x to 2.x you will need to dump and restore database as described at https://www.ejabberd.im/migrate-host.
• Postgresql: you must dump your database before upgrade and restore it after.

The package tools support in-place updating using pkg_add -u. For instance, to update all your packages, make sure PKG_PATH is pointing to the 4.4 packages directory on your CD or nearest FTP mirror, and use something like

# pkg_add -ui -F update -F updatedepends

[FAQ Index] | [4.2 -> 4.3] | [4.4 -> 4.5]