主题： freebsd
-
FreeBSD 的 rc.conf、sysrc 与 service：启用、启动并检查开机运行项
FreeBSD 服务通过 rc.conf 变量声明式启用，变量位于 /etc/rc.conf 或 /etc/rc.conf.d 中的单服务文件。sysrc 和 service <name> enable 都只是写入该变量；rc.conf 本身不应直接运行任何操作，只设置供 /etc/rc.d 中 rc 脚本读取的变量。sysrc 可由脚本安全编辑这些变量，service 则启动、停止对应 rc.d 脚本并报告状态。
-
Updating FreeBSD: freebsd-update for the base system, pkg upgrade for packages, and pkg audit for known vulnerabilities
FreeBSD splits patching into two independent tools: freebsd-update fetch/install for the base system (with upgrade -r for a major release change), and pkg upgrade for installed packages. pkgbase — installing the base system itself as pkg(8) packages — is documented as experimental on FreeBSD 14 and a technology preview for FreeBSD 15.0, not yet the default path.
-
FreeBSD jails: an administrative overview of jail.conf, jls, jexec and resource limits with rctl
A jail extends chroot(2) with its own process, network and (optionally) resource view, configured declaratively in jail.conf rather than via ad hoc jail(8) command lines. jls lists running jails, jexec enters one, and rctl caps what a jail's processes may consume — all administered from the host, which is also where compromise of one jail is meant to be contained.
-
The PF firewall on FreeBSD: testing pf.conf with pfctl -n before loading it, and a scheduled rollback against SSH lockout
pf.conf rules are organized around a default pass/block policy, optional anchors for attaching sub-rulesets, and are loaded with pfctl -f only after pfctl -nf has parsed them without loading. Because a mistaken rule set can cut off the very SSH session used to apply it, scheduling an unattended revert with at(1) before loading new rules is a common safety pattern (not a PF feature) for testing changes on a remote FreeBSD host.
-
ZFS boot environments with bectl: a rollback path around FreeBSD and package upgrades
bectl clones the root ZFS dataset into a boot environment in seconds; creating one before a freebsd-update or large pkg upgrade gives an instant, loader-menu-selectable way back to a known-good system, independent of and in addition to freebsd-update's own patch/install/rollback machinery.
机器可读： JSON