OpenBSD Upgrade Guide: 5.6 to 5.7

[FAQ Index] | [5.5 -> 5.6] | [5.7 -> 5.8]

Note: Upgrades are only supported from one release to the release immediately following it. Do not skip releases. If you got lucky skipping releases in the past, you may not this time.

It is highly recommended that you read through and fully understand this process before attempting it. If you are doing it on a critical or physically remote machine, it is recommended that you test this process on an identical, local system to verify its success before attempting on a critical or remote computer.

Before upgrading: things to think about and be aware of

• No etc*.tgz file sets
  The etcXX.tgz and xetcXX.tgz files have been merged into the base system files. On first install, config files will be built, but for upgrades, basic configuration files will be untouched. Rather than having unused config files cluttering up /etc, example files are now stored in /etc/examples. These samples will be blindly updated every upgrade, your configured files will NOT be touched.

• Sendmail, nginx, BIND have been removed from base
  Though these applications are all available as a packages if their use is required. For new installations, smtpd(8), httpd(8), nsd(8)/unbound(8) are recommended alternatives in base.

• Other changes
  
  • rc.conf.local is no longer a shell script. Variables (notably pkg_scripts) must now be on single lines.
  • pf.conf: altq backwards compatibility has been removed. Remove "oldqueue" entries from pf.conf(5) if present, otherwise PF rules will not be loaded.
  • MACs, modes and ciphers permitted by sshd have been tightened. Some clients (notably Paramiko and old versions of PuTTY) may not be able connect after upgrade without sshd_config changes.
  • IPv6 autoconfiguration overhaul. Link-local addresses are no longer configured on every network interface by default - an explicit step to enable an IPv6 address must be taken in order to enable this. Configuring a static IPv6 address or using "rtsol" automatically adds the necessary link-local address so in many cases no changes are needed, but IPv6 pppoe(4) users must add "inet6 eui64" to their /etc/hostname.pppoe* files.
  • /etc/rc and /etc/rc.conf have moved from etc*.tgz to base57.tgz and will be replaced at upgrade time. If you have made local changes to these files, save a copy before upgrading.

The upgrade process

Afterwards, complete the upgrade by following the final steps as detailed below. Pick one of the following install processes:

• Upgrade using Install Kernel (RECOMMENDED)

This involves booting from the install kernel, bsd.rd. This can be done by booting from an install floppy, CD, or file system image, or you can place the 5.7 version of bsd.rd in the root of your file system, and instructing the boot loader to boot this kernel instead of your usual kernel (bsd). On amd64 and i386, you do this by entering "boot bsd.rd" at the initial boot> prompt.

Once this kernel is booted, chose the "Upgrade" option, and follow the prompts. The upgrade process is very much like the installation process, though it retains all your configuration. info.

• Upgrade without the Install Kernel

Sometimes, one needs to do an upgrade of a machine when one can't easily use the normal upgrade process. The most common case is when the machine is in a remote location and you don't have easy access to the system console. One can usually do this by carefully following this process:

• Place install files in a "good" location. Make sure you have sufficient space! Running out of space on a remote upgrade could be...unfortunate. Note that using softdeps can exaggerate the situation as deleted and overwritten files do not release their space immediately. Having at least 200MB free on /usr would be recommended.

• Become root with ksh(1): While using sudo(8) before each command is generally a good practice, the sudo(8) command will be broken by the last steps, so you should be root before starting this process. Also, the use of the OpenBSD ksh(1) shell is assumed.

• Stop and/or disable any appropriate applications: During this process, all the userland applications will be replaced but may not be runnable, and strange things may happen as a result. You may also have issues with DNS resolution during the first reboot, so PF rules and NFS mounts dependent upon DNS may cause boot-up problems. There may be other applications which you wish to keep from running immediately after the upgrade, stop and disable them as well.

• Install new boot blocks: This should actually be done at the end of any upgrade, but we will assume this has been neglected. Failure to do this may break serial console or other things, depending on platform.

  installboot -v sd0
  

• Install new kernel(s):
  • If you are using the multiprocessor kernel:

    export RELEASEPATH=/usr/rel   # where you put the files
    cd ${RELEASEPATH}
    rm /obsd ; ln /bsd /obsd && cp bsd.mp /nbsd && mv /nbsd /bsd
    cp bsd.rd /
    cp bsd /bsd.sp
    

  • If using a single processor kernel:

    export RELEASEPATH=/usr/rel   # where you put the files
    cd ${RELEASEPATH}
    rm /obsd ; ln /bsd /obsd && cp bsd /nbsd && mv /nbsd /bsd
    cp bsd.rd bsd.mp /
    

    (note: you will get a harmless error message if your platform doesn't have a bsd.mp):

  Note the extra steps for copying over the primary kernel: those are done to ensure that there is always a valid copy of the kernel on the disk that the system can boot from should there be a really badly timed power outage or system crash.

• Save a copy of reboot(8), install new userland applications. You are still running the old kernel, it is possible the new reboot command will not run on the old kernel, so we will start by saving a copy of the old reboot command. Note that we are installing base57.tgz LAST, because it will include a new tar(1) utility, which may or may not run on the old kernel. We reboot immediately, as the system is probably barely runnable after the unpacking of all the new files.

  cp /sbin/reboot /sbin/oreboot
  tar -C / -xzphf xserv57.tgz
  tar -C / -xzphf xfont57.tgz
  tar -C / -xzphf xshare57.tgz
  tar -C / -xzphf xbase57.tgz
  tar -C / -xzphf game57.tgz
  tar -C / -xzphf comp57.tgz
  tar -C / -xzphf man57.tgz
  tar -C / -xzphf base57.tgz # Install last!
  /sbin/oreboot
  

  Not all file sets will need to be installed for all applications, however if you installed a file set originally, you should certainly upgrade it with the new file set now.

  Again, the files in /etc are handled separately below, so etc57.tgz and xetc57.tgz are NOT unpacked here.

• After reboot completes, upgrade /dev. The new MAKEDEV file was copied to /dev by the installation of base57.tgz, so you simply need to do the following:

  cd /dev
  ./MAKEDEV all
  

• Install the upgraded boot loader: installboot(8) has been "unified" across platforms, so a common (and simplified!) syntax can be used:

  installboot -v sd0
  

  assuming "sd0" is your boot disk.

Final steps

1. Run sysmerge(8)

Please read the sysmerge(8) manual page before using it on your system. You are also advised to read the diff(1), sdiff(1) and even review more(1) manual pages before continuing. A wide terminal window (i.e., significantly more than 80 characters), if available, will make sdiff(1) easier to use.

Sysmerge(8) is run simply by invoking it as root:

# sysmerge

  Use 'd' to delete the temporary ./var/www/htdocs/index.html
  Use 'i' to install the temporary ./var/www/htdocs/index.html
  Use 'm' to merge the temporary and installed versions
  Use 'v' to view the diff results again

  Default is to leave the temporary file to deal with by hand

If you wish to retain your existing file, delete the temporary file. If you wish to replace your existing file with the new version, install the temporary file. If you wish to merge the two together, choosing 'm' will put you into sdiff(1), where you can manually merge the file. The default is to come back and deal with the file later, manually.

Sysmerge(8) saves all your replaced files into a temporary directory, similar to /var/tmp/sysmerge.24959/backups, so if you accidentally clobber something that was probably not such a good idea, you have a chance to recover it. Note that daily(8) cleans old files from this directory, but it will survive a reboot.

2. Files to delete and move

cd /etc/X11/app-defaults
rm Beforelight Bitmap Bitmap-color Bitmap-nocase Chooser Clock-color
rm Editres Editres-color KOI8RXTerm SshAskpass UXTerm Viewres
rm Viewres-color XCalc XCalc-color XClipboard XClock
rm XClock-color XConsole XFontSel XLoad XLock XLogo
rm XLogo-color XMore XSm XTerm XTerm-color Xedit
rm Xedit-color Xfd Xgc Xgc-color Xmag Xman Xmessage
rm Xmessage-color Xsystrace Xvidtune

rm -f /etc/rc.d/named
rm -f /usr/sbin/dnssec-keygen
rm -f /usr/sbin/dnssec-signzone
rm -f /usr/sbin/named
rm -f /usr/sbin/named-checkconf
rm -f /usr/sbin/named-checkzone
rm -f /usr/sbin/nsupdate
rm -f /usr/sbin/rndc
rm -f /usr/sbin/rndc-confgen
rm -f /usr/share/man/man5/named.conf.5
rm -f /usr/share/man/man5/rndc.conf.5
rm -f /usr/share/man/man8/dnssec-keygen.8
rm -f /usr/share/man/man8/dnssec-signzone.8
rm -f /usr/share/man/man8/named.8
rm -f /usr/share/man/man8/named-checkconf.8
rm -f /usr/share/man/man8/named-checkzone.8
rm -f /usr/share/man/man8/nsupdate.8
rm -f /usr/share/man/man8/rndc-confgen.8
rm -f /usr/share/man/man8/rndc.8

rm -f /usr/sbin/openssl
rm -f /etc/rc.d/nginx
rm -f /usr/sbin/nginx
rm -f /usr/share/man/man8/nginx.8
rm -f /usr/share/man/man5/nginx.conf.5
rm -f /sbin/mount_procfs
rm -f /usr/share/man/man8/mount_procfs.8
rm -rf /usr/include/libmilter
rm -rf /usr/libdata/perl5/site_perl/`uname -p`-openbsd/libmilter
rm -rf /usr/libexec/sendmail
rm -rf /usr/share/sendmail  # preserve mc files first if needed

rm -f /etc/rc.d/sendmail
rm -f /usr/lib/{libmilter.a,libmilter.so.3.0,libmilter_p.a}
rm -f /usr/libexec/smrsh
rm -f /usr/sbin/{editmap,mailstats,praliases}
rm -f /usr/share/man/man1/{hoststat.1,praliases.1,purgestat.1}
rm -f /usr/share/man/man8/{editmap.8,mailq.8,mailstats.8,smrsh.8}
rm -f /var/log/sendmail.st
rmdir /usr/libexec/sm.bin
rm -rf /usr/lkm /usr/share/lkm /dev/lkm
rm -f /usr/bin/modstat
rm -f /sbin/mod{,un}load
rm -f /usr/share/man/man8/mod{stat,load,unload}.8
rm -f /usr/share/man/man4/lkm.4
rm -f /usr/share/mk/bsd.lkm.mk /usr/include/sys/lkm.h

rm -f /usr/include/ressl.h
rm -f /usr/lib/libressl.* /usr/lib/libressl_*
rm -f /usr/share/man/man3/ressl_*
rm /usr/mdec/installboot /usr/share/man/man8/sparc64/installboot.8
rm /etc/rc.d/rtsold /sbin/rtsol /usr/sbin/rtsold
rm /usr/share/man/man8/rtsol.8 /usr/share/man/man8/rtsold.8
rm -f /usr/X11R6/include/GL/glcorearb.h
rm -f /usr/X11R6/include/EGL/eglextchromium.h

rm -r /var/tmp
ln -s /tmp /var/tmp

groupdel _lkm
userdel smmsp
groupdel smmsp

rm -rf /var/www/icons
rmdir /var/www/conf/{modules,modules.sample}
rmdir /var/www/users
rm -f /var/www/cgi-bin/{printenv,test-cgi}
rm -f /var/www/conf/{httpd.conf,magic,mime.types}
rm -f /var/www/htdocs/{apache_pb.gif,blowfish.jpg,bsd_small.gif,index.html}
rm -f /var/www/htdocs/{lock.gif,logo23.jpg,logo24.jpg,mod_ssl_sb.gif}
rm -f /var/www/htdocs/{openbsd_pb.gif,openbsdpower.gif,openssl_ics.gif}
rm -f /var/www/htdocs/smalltitle.gif

3. Upgrading packages

• Package Upgrade Tips

The following packages are known to have significant upgrade issues that will impact users. The fact that a package is not on this list doesn't mean it will have a trivial upgrade. You must do some homework on the applications YOU use.

• BIND has moved to packages.
  Using the base system's nsd(8) and unbound(8) is recommended, but BIND is still available as a package. Note that while BIND has both the authoritative and resolving features in one program, the functions are separate for nsd and unbound. An example configuration might be to have nsd running on localhost, and unbound running on an exposed address, and unbound forwarding locally defined names to nsd for authoritative information.
• nginx has been moved to ports
  nginx has been removed in favor of OpenBSD's own httpd(8).

• puppetdb split single config file into multiple files
  With puppetdb-2.1.0p1 the single puppetdb.ini file was split into multiple .ini files. The configuration needs to be adapted after upgrade. More information in the puppetdb package README.

• collectd updated to 5.4.1
  sysutils/collectd has been updated to version 5.4.1, users of previous 4.10.1 version should review this upgrade guide to migrate their existing setups.

• symon package split
  The split between subpackages for symon has been adjusted. Depending on which subpackage you installed previously, you may lose the "symux" monitor after a pkg_add -u, if so, just run "pkg_add symux".

• php version bump
  The default version of PHP has been switched to 5.5. After updating to new packages when they are available, you will need to move the configuration across from 5.4. Check for local changes in /etc/php-5.4.ini and apply them to php-5.5.ini, and create new symbolic links for any required extensions in /etc/php-5.5. For the common case where you would like to keep existing extensions you can do this:

  	cd /etc/php-5.4
  	for i in *; do ln -s ../php-5.5.sample/$i ../php-5.5/; done
  

  pecl-APC does not support newer PHP versions and has been retired; xcache is still available, or you can use the new opcode cache built-in to 5.5:

  	ln -s ../php-5.5.sample/opcache.ini /etc/php-5.5
  

• gnustep sudoku renamed
  Because the ports games/sudoku and x11/gnustep/sudoku used the same package name, the gnustep one had been renamed to gnustep-sudoku. If you have the gnustep version installed (the exact package is currently sudoku-0.7p5), you should delete it before and re-add it after updating installed packages, like this:

  	pkg_delete sudoku-0.7p5
  	pkg_add -u
  	pkg_add gnustep-sudoku
  

• PostgreSQL 9.4.0
  Major update to 9.4.0. A dump/restore is required.

• wordpress 4.1
  The twentytwelve theme from wordpress 4.0.x is no longer included with wordpress 4.1.x. If you are using this theme, back it up before updating:

  	cd /var/www/wordpress/wp-content/themes &&
  	cp -Rp twentytwelve twentytwelve.bak
  

  and restore it after wordpress update:

  	cd /var/www/wordpress/wp-content/themes &&
  	mv twentytwelve.bak twentytwelve
  

• MySQL replaced with MariaDB
  MySQL has been replaced with the MariaDB fork. The changeover should be straightforward and package updates will be handled by pkg_add -u, but there are a couple of additional steps to take:
  • Before upgrading to OpenBSD 5.7, run mysqladmin flush-logs to simplify recovery in case of problems
  • After upgrading, run mysql_upgrade to upgrade system tables
  • Replace "skip-locking" in /etc/my.cnf with "skip-external-locking"
  Note that replication between MySQL 5.1.x and MariaDB 10.x should work, but is not a supported configuration.

The package tools support in-place updating using pkg_add -u. For instance, to update all your packages, make sure PKG_PATH is pointing to the 5.7 packages directory on your CD or nearest FTP mirror, and use something like

pkg_add -u

[FAQ Index] | [5.5 -> 5.6] | [5.7 -> 5.8]