OpenBSD Upgrade Guide: 3.9 to 4.0

[FAQ Index] | [3.8 -> 3.9] | [4.0 -> 4.1]

Note: Upgrades are only supported from one release to the release immediately following it. Do not skip releases.

It is highly recommended that you read through and fully understand this process before attempting it. If you are doing it on a critical or physically remote machine, it is recommended that you test this process on an identical, local system to verify its success before attempting on a critical or remote computer.

Upgrading is a convenient way to bring your OpenBSD system up to the most recent version. However, the results are not intended to precisely match the results of a wipe-and-reload installation. Old library files in particular are not removed in the upgrade process, as they may be required by older applications that may or may not be upgraded at this time. If you REALLY wish to get rid of all these old files, you are probably better off reinstalling from scratch.

Table of Contents:

Before upgrading
The upgrade process
Final steps

Before upgrading

Check whether you have made any modifications to your kernel. For example, you might have modified your network device to use a non-default setting using config(8). Note your changes, so you can repeat them for the new 4.0 kernel.

The upgrade process

Upgrading by install media

The easiest and safest way to upgrade is to boot from install media and follow the upgrade steps, which are very similar to the install process. Afterwards, complete the upgrade by following the final steps as detailed below.

Upgrading without install media

This is NOT the recommended process. Use the install media method if at all possible!

Sometimes, one needs to do an upgrade of a machine when one can't easily use the normal upgrade process. One can usually do this by carefully following a process similar to building the system from source:

Place install files in a "good" location. Make sure you have sufficient space!
Stop any "insecure" applications from starting at boot: There will be a time when PF will be unlikely to be running during this upgrade process, but your applications may still start and run properly. Any application dependent upon PF for security should be disabled before this happens, and should not be re-enabled until proper PF operation is verified after upgrade. There may be other applications which you wish to keep from running during the upgrade, stop and disable them as well.
Check the kernel: Although most people can skip this step, if you had a modified kernel in 3.9, it is likely you will need to modify the stock kernel of 4.0. Especially when you are performing the upgrade process remotely, now is the time to make sure the new kernel will work upon rebooting the machine. If any changes must be made to the kernel, the safest thing to do is to make those changes on a local 4.0 system. This can be as simple as modifying a specific device using config(8), or it can involve a recompilation if the option you need is not included in the GENERIC kernel. Please consult FAQ 5 - Building the system from source before considering to recompile your kernel.
Install new kernel(s)
```
export RELEASEPATH=/yourpath
cd ${RELEASEPATH}
rm /obsd ; ln /bsd /obsd && cp bsd /nbsd && mv /nbsd /bsd
cp bsd.rd bsd.mp /
```
Note the extra steps for copying over the primary kernel: those are done to ensure that there is always a valid copy of the kernel on the disk that the system can boot from should there be a really badly timed power outage or system crash.
Install new /etc/firmware files: Due to the fact that some uploaded "firmware" files may have been updated, you may need to update the files in the /etc/firmware directory. This will impact users of only a few devices, though all users can use this step without harm. To extract the firmware files from base40.tgz, use the following as root:
```
cd /
tar xzpf ${RELEASEPATH}/base40.tgz "*etc/firmware/*"
```
Note: if you use the iwi(4) driver for your wireless adapter, you must upgrade to the version 3.0 firmware files. Due to license problems the firmware is not currently distributed with OpenBSD. The firmware can be installed via the pkg tools with the package at http://damien.bergamini.free.fr/iwifw/OpenBSD/iwi-firmware-3.0.tgz.
Reboot on the new kernel: This might be a tempting step to skip, but it should be done now, as usually, the new kernel will run old userland apps (such as the soon to be important reboot!), but often a new userland will NOT work on the old kernel.
Install new userland applications. Do NOT install etc40.tgz and xetc40.tgz now, because that will overwrite your current configuration files!
```
export RELEASEPATH=/yourpath
cd /
tar xzpf ${RELEASEPATH}/base40.tgz
tar xzpf ${RELEASEPATH}/comp40.tgz
tar xzpf ${RELEASEPATH}/game40.tgz
tar xzpf ${RELEASEPATH}/man40.tgz
tar xzpf ${RELEASEPATH}/misc40.tgz
tar xzpf ${RELEASEPATH}/xbase40.tgz
tar xzpf ${RELEASEPATH}/xfont40.tgz
tar xzpf ${RELEASEPATH}/xserv40.tgz
tar xzpf ${RELEASEPATH}/xshare40.tgz
```
Note: not all file sets will need to be installed for all applications, however if you installed a file set originally, you should certainly upgrade it with the new file set now.
Note: the files in /etc are handled separately below, so etc40.tgz and xetc40.tgz are NOT unpacked here.
Upgrade /dev. The new MAKEDEV file will be copied to /dev by the installation of base40.tgz, so you simply need to do the following:
```
cd /dev
./MAKEDEV all
```
Upgrade /etc as below.
Reboot

During this process, sendmail(8) may produce some error messages like the following:

    Nov 1 12:47:05 puffy sm-mta[16733]: filesys_update failed: No such file or directory, fs=., avail=-1, blocksize=380204

These messages can be safely ignored, or you may wish to halt sendmail(8) during the upgrade process.

Final steps

1. Upgrading `/etc`

Whether you upgrade by using an install media and doing a formal "upgrade" process, or do a "in-place" binary upgrade, there are certain manual steps that have to be performed.

1.1. New users and groups

A mrouted(8) replacement has been started and in order to use this new daemon, a new user and group are required. As root, add the following user and group, using useradd(8):
```
# useradd -u87 -g=uid -c"DVMRP Daemon" -d/var/empty -s/sbin/nologin _dvmrpd
```
This step will add both the new user and its corresponding group. Your environment may allow you to copy/paste those commands.

1.2. Operational changes

IPsec now configured by ipsecctl(8)
IPsec configuration is now fully supported by ipsecctl(8). The obsolete ipsecadm(8) utility has been removed. See the ipsec.conf(5) manual page for configuration examples.
wicontrol(8) removed
Wireless configuration for wi(4) is now fully supported by ifconfig(8). The obsolete wicontrol(8) utility has been removed.

spppcontrol(8) removed

In-kernel PPP configuration is now fully supported by ifconfig(8). The obsolete spppcontrol(8) utility has been removed. See the manual pages sppp(4) and pppoe(4) for configuration examples.

Previously, the /etc/hostname.pppoe0 file looked like this:

pppoedev ne0
!/sbin/ifconfig ne0 up
!/usr/sbin/spppcontrol \$if myauthproto=pap myauthname=testcaller \
        myauthkey=donttell
!/sbin/ifconfig \$if inet 0.0.0.0 0.0.0.1 netmask 0xffffffff
!/sbin/route add default 0.0.0.1
up

This should be updated according to the following example:

inet 0.0.0.0 255.255.255.255 0.0.0.1 pppoedev ne0 \
        authproto pap authname testcaller authkey donttell up
!/sbin/route add default 0.0.0.1

And the physical interface must be marked UP:

# echo "up" > /etc/hostname.ne0

1.3. `/etc` file changes

You will want to extract the etc40.tgz files to a temporary location:

cd /tmp
tar xzpf ${RELEASEPATH}/etc40.tgz

Files that can probably be copied from etc40.tgz "as is":

chio.conf
dvmrpd.conf
netstart
pf.os
rc
security
services
mail/helpfile
mail/localhost.cf
mail/sendmail.cf
mail/submit.cf
mtree/*
ppp/ppp.conf.sample

Note that it IS possible to locally modify these files, if this has been done, manual merging will be needed. Pay special attention to mail/sendmail.cf if you are using something other than the default Sendmail(8) configuration. Here are copy/paste lines for copying these files, assuming you unpacked etc40.tgz in the above recommended place:

cd /tmp/etc
cp chio.conf dvmrpd.conf netstart pf.os rc security services /etc
cp mail/helpfile mail/localhost.cf mail/submit.cf /etc/mail
cp ppp/ppp.conf.sample /etc/ppp
cp mtree/* /etc/mtree/
cp mail/sendmail.cf /etc/mail    # careful on this one!!

A couple pages for httpd(8)'s documentation changed:

/var/www/htdocs/manual/mod/core.html
/var/www/htdocs/manual/mod/mod_proxy.html

This can be copied (if desired) by:

cd /tmp/var/www/htdocs/manual/mod/
cp core.html mod_proxy.html /var/www/htdocs/manual/mod

Files that must be manually merged, respecting any local changes made to them, if they were modified from the default, otherwise, just copy them over, too:

changelist
ftpusers
mail/aliases
rc.conf
ssh/ssh_config
ssh/sshd_config

The changes to these files are in this patch file. You can attempt to use this by executing the following as root:

cd /
patch -C -p0 < upgrade40.patch

This will test the patch to see how well it will apply to YOUR system, to actually apply it, leave off the "-C" option. Note that it is likely that if you have customized files or not kept them closely updated, or are upgrading from a snapshot of 3.9, they may not accept the patch cleanly. In those cases, you will need to manually apply the changes. Please test this process before relying on it for a machine you can not easily get to.

The following files have had changes which should be looked at, but it is unlikely they should be directly copied or merged (i.e., if you are using pf.conf, look at the suggested change of strategy, and decide if it is appropriate for your use).

hostapd.conf
ipsec.conf
rc.local
sensorsd.conf
spamd.conf

Finally, use mtree(8) to create any new directories:

mtree -qdef /etc/mtree/4.4BSD.dist -p / -u

2. Checking the kernel

Note: most people can skip this step!

If you followed the instructions for the upgrade process without install media, you have already completed this step. However, if you used the install media, and if you had a modified kernel in 3.9, it is likely you will need to modify the stock kernel of 4.0. This can be as simple as modifying a specific device using config(8), or it can involve a recompilation if the option you need is not included in the GENERIC kernel. Please consult FAQ 5 - Building the system from source before considering to recompile your kernel.

3. Upgrading packages

If you installed any packages on your system, you may want to upgrade them after completing the upgrade of the base system. The package tools support in-place updating using pkg_add -u. For instance, to update all your packages, make sure PKG_PATH is pointing to the 4.0 packages directory on your CD or nearest FTP mirror, and use something like

# pkg_add -ui -F update -F updatedepends

where the -u indicates update mode, and -i specifies interactive mode, so pkg_add will prompt you for input when it encounters some ambiguity. Read the pkg_add(1) manual page and the package management chapter of the FAQ for more information.

[FAQ Index] | [3.8 -> 3.9] | [4.0 -> 4.1]

$OpenBSD: upgrade40.html,v 1.24 2019/05/28 01:53:11 bentley Exp $