OPNsense – mehr als eine Firewall
Einfache Bedienung, höchste Sicherheit
FreeBSD stellt mehrere Kommandos bereit, die es erlauben Informationen zur verwendeten Hardware anzuzeigen. In diesem Artikel zeigen wir einige dieser Kommandos. Sofern nicht anders angeführt, haben wir einen LES v4 mit OPNsense Version 23.7 verwendet.
Das Dienstprogramm camcontrol ermöglicht die Steuerung des FreeBSD CAM-Subsystems. CAM steht für Common Access Method. Es ist eine generische Möglichkeit, I/O-Busse SCSI-ähnlich anzusprechen. Mit dem Parameter 'devlist' zeigt es die vorhandenen Devices an.
# camcontrol devlist
Die Ausgabe (in diesem Beispiel auf einem LES v4 mit zwei SSDs in einem ZFS Mirror) zeigt:
<ATP SATA III M.2 2242 SBFMB1.1> at scbus0 target 0 lun 0 (pass0,ada0) <INTEL SSDSC2BB080G6 G2010130> at scbus1 target 0 lun 0 (pass1,ada1)
Die Unterstützung für clog wurde mit OPNsense 22.1 entfernt und mit dem Release 22.7 wurden die letzten clog Komponenten entfernt.[1]
root@OPNsense:~ # clog clog: Command not found.
Als Alternative zu clog /var/log/system.log gibt es das Kommando opnsense-log.
# man opnsense-log
wikiOPNSENSE-LOG(8) FreeBSD System Manager's Manual OPNSENSE-LOG(8)
NAME
opnsense-log – OPNsense log utility
SYNOPSIS
opnsense-log [-fln] [type]
DESCRIPTION
The opnsense-log utility will display the current selected log file type
content.
The options are as follows:
-f Use tail(1) instead of cat(1) to display the log content.
-l List all available log types.
-n Display the log file to use if it exists.
EXIT STATUS
The opnsense-log utility exits 0 on success, and >0 if an error occurs.
SEE ALSO
cat(1), tail(1)
AUTHORS
Franco Fichtner <franco@opnsense.org>
FreeBSD 13.2-RELEASE-p5 March 9, 2022 FreeBSD 13.2-RELEASE-p5
# opnsense-log system
Die Ausgabe zeigt:
<45>1 2023-12-11T07:56:52+00:00 OPNsense.localdomain syslog-ng 9339 - [meta sequenceId="1"] syslog-ng starting up; version='4.4.0' <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="2"] ---<<BOOT>>--- <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="3"] Copyright (c) 1992-2021 The FreeBSD Project. <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="4"] Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994 <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="5"] The Regents of the University of California. All rights reserved. <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="6"] FreeBSD is a registered trademark of The FreeBSD Foundation. <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="7"] FreeBSD 13.2-RELEASE-p5 stable/23.7-n254837-8806e8fefb1 SMP amd64 <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="8"] FreeBSD clang version 14.0.5 (https://github.com/llvm/llvm-project.git llvmorg-14.0.5-0-gc12386ae247c) <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="9"] VT(vga): resolution 640x480 <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="10"] CPU: Intel(R) Celeron(R) J6412 @ 2.00GHz (1996.80-MHz K8-class CPU) <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="11"] Origin="GenuineIntel" Id=0x90661 Family=0x6 Model=0x96 Stepping=1 <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="12"] Features=0xbfebfbff<FPU,VME,DE,PSE,TSC,MSR,PAE,MCE,CX8,APIC,SEP,MTRR,PGE,MCA,CMOV,PAT,PSE36,CLFLUSH,DTS,ACPI,MMX,FXSR,SSE,SSE2,SS,HTT,TM,PBE> <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="13"] Features2=0x4ff8ebbf<SSE3,PCLMULQDQ,DTES64,MON,DS_CPL,VMX,EST,TM2,SSSE3,SDBG,CX16,xTPR,PDCM,SSE4.1,SSE4.2,x2APIC,MOVBE,POPCNT,TSCDLT,AESNI,XSAVE,OSXSAVE,RDRAND> <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="14"] AMD Features=0x28100800<SYSCALL,NX,RDTSCP,LM> <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="15"] AMD Features2=0x101<LAHF,Prefetch> <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="16"] Structured Extended Features=0x2394a2c3<FSGSBASE,TSCADJ,FDPEXC,SMEP,ERMS,NFPUSG,PQE,RDSEED,SMAP,CLFLUSHOPT,CLWB,PROCTRACE,SHA> <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="17"] Structured Extended Features2=0x18400124<UMIP,WAITPKG,GFNI,RDPID,MOVDIRI,MOVDIR64B> <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="18"] Structured Extended Features3=0xfc000400<MD_CLEAR,IBPB,STIBP,L1DFL,ARCH_CAP,CORE_CAP,SSBD> <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="19"] XSAVE Features=0xf<XSAVEOPT,XSAVEC,XINUSE,XSAVES> <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="20"] IA32_ARCH_CAPS=0x20c6b<RDCL_NO,IBRS_ALL,SKIP_L1DFL_VME,MDS_NO> <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="21"] VT-x: PAT,HLT,MTF,PAUSE,EPT,UG,VPID,VID,PostIntr <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="22"] TSC: P-state invariant, performance statistics <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="23"] real memory = 8589934592 (8192 MB) <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="24"] avail memory = 8078598144 (7704 MB) <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="25"] Event timer "LAPIC" quality 600 <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="26"] ACPI APIC Table: <ALASKA A M I > <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="27"] WARNING: L1 data cache covers fewer APIC IDs than a core (0 < 1) <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="28"] FreeBSD/SMP: Multiprocessor System Detected: 4 CPUs <13>1 2023-12-11T07:56:53+00:00 OPNsense.localdomain kernel - - [meta sequenceId="29"] FreeBSD/SMP: 1 package(s) x 4 core(s) [...]
# devinfo -rv
Die Ausgabe zeigt:
nexus0
cryptosoft0
aesni0
ram0
I/O memory addresses:
0x0-0x9efff
0x100000-0x762a5fff
0x78c4f000-0x78c4ffff
0x100000000-0x2803fffff
[...]
acpi0
[...]
cpu0 pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR00
acpi_perf0
est0
p4tcc0
cpufreq0
coretemp0
[...]
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR04
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR05
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR06
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR07
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR08
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR09
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR10
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR11
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR12
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR13
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR14
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR15
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR16
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR17
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR18
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR19
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR20
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR21
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR22
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_SB_.PR23
unknown pnpinfo _HID=ACPI000C _UID=0 _CID=none at handle=\_SB_.PAGD (disabled)
acpi_wmi1 pnpinfo _HID=PNP0C14 _UID=0 _CID=none at handle=\_SB_.WFDE
acpi_wmi2 pnpinfo _HID=PNP0C14 _UID=0 _CID=none at handle=\_SB_.WFTE
unknown pnpinfo _HID=INT33A1 _UID=1 _CID=PNP0D80 at handle=\_SB_.PEPD
unknown pnpinfo _HID=INT33D5 _UID=0 _CID=INT33D5 at handle=\_SB_.HIDD (disabled)
pci_link0 pnpinfo _HID=PNP0C0F _UID=1 _CID=none at handle=\_SB_.LNKA
pci_link1 pnpinfo _HID=PNP0C0F _UID=2 _CID=none at handle=\_SB_.LNKB
pci_link2 pnpinfo _HID=PNP0C0F _UID=3 _CID=none at handle=\_SB_.LNKC
pci_link3 pnpinfo _HID=PNP0C0F _UID=4 _CID=none at handle=\_SB_.LNKD
pci_link4 pnpinfo _HID=PNP0C0F _UID=5 _CID=none at handle=\_SB_.LNKE
pci_link5 pnpinfo _HID=PNP0C0F _UID=6 _CID=none at handle=\_SB_.LNKF
pci_link6 pnpinfo _HID=PNP0C0F _UID=7 _CID=none at handle=\_SB_.LNKG
pci_link7 pnpinfo _HID=PNP0C0F _UID=8 _CID=none at handle=\_SB_.LNKH
unknown pnpinfo _HID=PNP0C0D _UID=0 _CID=none at handle=\_SB_.LID0 (disabled)
unknown pnpinfo _HID=MSFT0101 _UID=1 _CID=none at handle=\_SB_.TPM_
acpi_sysresource5 pnpinfo _HID=INT340E _UID=0 _CID=PNP0C02 at handle=\_SB_.PTID
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_TZ_.FN00
unknown pnpinfo _HID=PNP0C0B _UID=0 _CID=none at handle=\_TZ_.FAN0
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_TZ_.FN01
unknown pnpinfo _HID=PNP0C0B _UID=1 _CID=none at handle=\_TZ_.FAN1
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_TZ_.FN02
unknown pnpinfo _HID=PNP0C0B _UID=2 _CID=none at handle=\_TZ_.FAN2
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_TZ_.FN03
unknown pnpinfo _HID=PNP0C0B _UID=3 _CID=none at handle=\_TZ_.FAN3
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\_TZ_.FN04
unknown pnpinfo _HID=PNP0C0B _UID=4 _CID=none at handle=\_TZ_.FAN4
acpi_tz0 pnpinfo _HID=none _UID=0 _CID=none at handle=\_TZ_.TZ00
unknown pnpinfo _HID=INT339B _UID=0 _CID=none at handle=\CHUB (disabled)
unknown pnpinfo _HID=INT3420 _UID=0 _CID=none at handle=\PSM_ (disabled)
unknown pnpinfo _HID=none _UID=0 _CID=none at handle=\PIN_
acpi_timer0 pnpinfo unknown
I/O ports:
0x1808-0x180b
Das Dienstprogramm dmesg zeigt den Inhalt des Systemnachrichtenpuffers (system message buffer) an.
# dmesg
Die Ausgabe zeigt:
Copyright (c) 1992-2021 The FreeBSD Project.
Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994
The Regents of the University of California. All rights reserved.
FreeBSD is a registered trademark of The FreeBSD Foundation.
FreeBSD 13.2-RELEASE-p5 stable/23.7-n254837-8806e8fefb1 SMP amd64
[...]
real memory = 8589934592 (8192 MB)
avail memory = 8078598144 (7704 MB)
Event timer "LAPIC" quality 600
ACPI APIC Table: <ALASKA A M I >
WARNING: L1 data cache covers fewer APIC IDs than a core (0 < 1)
FreeBSD/SMP: Multiprocessor System Detected: 4 CPUs
FreeBSD/SMP: 1 package(s) x 4 core(s)
[...]
igc0: <Intel(R) Ethernet Controller I225-V> mem 0x80300000-0x803fffff,0x80400000-0x80403fff at device 0.0 on pci1
[...]
igc1: <Intel(R) Ethernet Controller I225-V> mem 0x80000000-0x800fffff,0x80100000-0x80103fff at device 0.0 on pci2
[...]
igc2: <Intel(R) Ethernet Controller I225-V> mem 0x7fd00000-0x7fdfffff,0x7fe00000-0x7fe03fff at device 0.0 on pci3
[...]
ZFS filesystem version: 5
ZFS storage pool version: features support (5000)
[...]
ada0: <ATP SATA III M.2 2242 SBFMB1.1> ACS-4 ATA SATA 3.x device
[...]
ada1: <INTEL SSDSC2BB080G6 G2010130> ACS-2 ATA SATA 3.x device
[...]
Das Tool dmidecode zeigt den Inhalt der DMI (Desktop Management Interface) Tabellen:
# dmidecode
Unter FreeBSD und OPNsense muss dmidecode zumeist manuell installiert werden, bei OPNsense kann dmidecode auch über die integrierte Pluginverwaltung installiert werden (Paket "os-dmidecode"):
# pkg install dmidecode
Die Ausgabe zeigt dann:
# dmidecode 3.5
# SMBIOS entry point at 0x78a3f000
Found SMBIOS entry point in EFI, reading table from /dev/mem.
SMBIOS 3.3 present.
72 structures occupying 4145 bytes.
Table at 0x78A3C000.
Handle 0x0000, DMI type 0, 26 bytes
BIOS Information
Vendor: American Megatrends International, LLC.
Version: 5.19
Release Date: 11/21/2022
Address: 0xF0000
Runtime Size: 64 kB
ROM Size: 0 MB
Characteristics:
PCI is supported
BIOS is upgradeable
BIOS shadowing is allowed
Boot from CD is supported
Selectable boot is supported
BIOS ROM is socketed
EDD is supported
ACPI is supported
BIOS boot specification is supported
Targeted content distribution is supported
UEFI is supported
[...]
Das Kommando freebsd-version zeigt die Version sowie den Patchlevel des installierten Systems an.
Die Option '-k' zeigt dabei die Kernel Version:
# freebsd-version -k
Die Ausgabe zeigt:
13.2-RELEASE-p5
Die Option '-u' zeigt dabei die Userland Version:
# freebsd-version -u
Die Ausgabe zeigt:
13.2-RELEASE-p5
Mit den geom Kommandos (Kurzbegriff in FreeBSD für disk geometry) können die unterschiedlichen FreeBSD GEOM Klassen gesteuert werden.
Die aktuellen Partionsinformationen können mit dem folgenden Kommando abgefragt werden:
# gpart show
Die Ausgabe (in diesem Beispiel auf einem LES v4 mit zwei SSDs in einem ZFS Mirror) zeigt:
=> 40 125045344 ada0 GPT (60G)
40 532480 1 efi (260M)
532520 1024 2 freebsd-boot (512K)
533544 984 - free - (492K)
534528 16777216 3 freebsd-swap (8.0G)
17311744 107732992 4 freebsd-zfs (51G)
125044736 648 - free - (324K)
=> 40 156301408 ada1 GPT (75G)
40 532480 1 efi (260M)
532520 1024 2 freebsd-boot (512K)
533544 984 - free - (492K)
534528 16777216 3 freebsd-swap (8.0G)
17311744 138989568 4 freebsd-zfs (66G)
156301312 136 - free - (68K)
Details zu den Partitionen zeigt folgendes Kommando:
# gpart list
Die Ausgabe (in diesem Beispiel auf einem LES v4) zeigt:
Geom name: ada0 modified: false state: OK fwheads: 16 fwsectors: 63 last: 125045383 first: 40 entries: 128 scheme: GPT Providers: 1. Name: ada0p1 Mediasize: 272629760 (260M) Sectorsize: 512 Stripesize: 0 Stripeoffset: 20480 Mode: r1w1e2 efimedia: HD(1,GPT,db64aa8d-74af-11ee-b505-dc58bce05abb,0x28,0x82000) rawuuid: db64aa8d-74af-11ee-b505-dc58bce05abb rawtype: c12a7328-f81f-11d2-ba4b-00a0c93ec93b label: efiboot0 length: 272629760 offset: 20480 type: efi index: 1 end: 532519 start: 40 [...] Consumers: 1. Name: ada0 Mediasize: 64023257088 (60G) Sectorsize: 512 Mode: r3w3e6 Geom name: ada1 modified: false state: OK fwheads: 16 fwsectors: 63 last: 156301447 first: 40 entries: 128 scheme: GPT Providers: 1. Name: ada1p1 Mediasize: 272629760 (260M) Sectorsize: 512 Stripesize: 4096 Stripeoffset: 0 Mode: r0w0e0 efimedia: HD(1,GPT,db995c6c-74af-11ee-b505-dc58bce05abb,0x28,0x82000) rawuuid: db995c6c-74af-11ee-b505-dc58bce05abb rawtype: c12a7328-f81f-11d2-ba4b-00a0c93ec93b label: efiboot1 length: 272629760 offset: 20480 type: efi index: 1 end: 532519 start: 40 [...] Consumers: 1. Name: ada1 Mediasize: 80026361856 (75G) Sectorsize: 512 Stripesize: 4096 Stripeoffset: 0 Mode: r2w2e3
# ifconfig
Die Ausgabe zeigt:
igc0: flags=8863<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> metric 0 mtu 1500
description: WAN1 (wan)
options=4802028<VLAN_MTU,JUMBO_MTU,WOL_MAGIC,NOMAP>
ether dc:58:bc:e0:5a:bb
inet 192.168.0.254 netmask 0xffffff00 broadcast 192.168.0.255
media: Ethernet autoselect (1000baseT <full-duplex>)
status: active
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
igc1: flags=8963<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
description: LAN1 (opt2)
options=4902028<VLAN_MTU,JUMBO_MTU,WOL_MAGIC,NETMAP,NOMAP>
ether dc:58:bc:e0:5a:bc
media: Ethernet autoselect
status: no carrier
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
igc2: flags=8963<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> metric 0 mtu 1500
description: LAN2 (opt1)
options=4902028<VLAN_MTU,JUMBO_MTU,WOL_MAGIC,NETMAP,NOMAP>
ether dc:58:bc:e0:5a:bd
media: Ethernet autoselect
status: no carrier
nd6 options=29<PERFORMNUD,IFDISABLED,AUTO_LINKLOCAL>
[...]
# kldstat
Die Ausgabe zeigt:
Id Refs Address Size Name 1 67 0xffffffff80200000 216c508 kernel 2 1 0xffffffff8236d000 16148 if_lagg.ko 3 2 0xffffffff82384000 3538 if_infiniband.ko 4 1 0xffffffff82388000 4b58 if_enc.ko 5 1 0xffffffff8238d000 59df80 zfs.ko
# pciconf -lv
Die Ausgabe zeigt:
[...]
igc0@pci0:1:0:0: class=0x020000 rev=0x03 hdr=0x00 vendor=0x8086 device=0x15f3 subvendor=0x8086 subdevice=0x0000
vendor = 'Intel Corporation'
device = 'Ethernet Controller I225-V'
class = network
subclass = ethernet
igc1@pci0:2:0:0: class=0x020000 rev=0x03 hdr=0x00 vendor=0x8086 device=0x15f3 subvendor=0x8086 subdevice=0x0000
vendor = 'Intel Corporation'
device = 'Ethernet Controller I225-V'
class = network
subclass = ethernet
igc2@pci0:3:0:0: class=0x020000 rev=0x03 hdr=0x00 vendor=0x8086 device=0x15f3 subvendor=0x8086 subdevice=0x0000
vendor = 'Intel Corporation'
device = 'Ethernet Controller I225-V'
class = network
subclass = ethernet
# pkg info
Die Ausgabe zeigt:
[...] ntp-4.2.8p17_1 The Network Time Protocol Distribution [...] openssh-portable-9.3.p2_2,1 The portable version of OpenBSD's OpenSSH openssl111-1.1.1w TLSv1.3 capable SSL and crypto library openvpn-2.6.8 Secure IP/Ethernet tunnel daemon opnsense-23.7.9 OPNsense community release opnsense-installer-23.1 OPNsense installer scripts opnsense-lang-23.7.8 OPNsense translations opnsense-update-23.7.8_1 OPNsense update utilities [...] suricata-6.0.15 High Performance Network IDS, IPS and Security Monitoring engine syslog-ng-4.4.0 Powerful syslogd replacement [...] unbound-1.19.0 Validating, recursive, and caching DNS resolver wpa_supplicant-2.10_9 Supplicant (client) for WPA/802.1x protocols xorgproto-2022.1_1 X Window System unified protocol definitions zip-3.0_1 Create/update ZIP files compatible with PKZIP
# pkg info opnsense
Die Ausgabe zeigt:
opnsense-23.7.9
Name : opnsense
Version : 23.7.9
Installed on : Tue Nov 28 10:55:41 2023 UTC
Origin : opnsense/opnsense
Architecture : FreeBSD:13:amd64
Prefix : /usr/local
Categories : www sysutils
Licenses : BSD2CLAUSE
Maintainer : project@opnsense.org
WWW : https://opnsense.org/
Comment : OPNsense community release
Annotations :
FreeBSD_version: 1302001
product_abi : 23.7
product_arch : amd64
product_copyright_owner: Deciso B.V.
product_copyright_url: https://www.deciso.com/
product_copyright_years: 2014-2023
product_email : project@opnsense.org
product_hash : 7d9231b7d
product_id : opnsense
product_name : OPNsense
product_nickname: Restless Roadrunner
product_series : 23.7
product_tier : 1
product_version: 23.7.9
product_website: https://opnsense.org/
repo_type : binary
repository : OPNsense
Flat size : 22.8MiB
Description :
7d9231b7d
# sysctl -a
Die Ausgabe zeigt:
kern.ostype: FreeBSD kern.osrelease: 13.2-RELEASE-p5 kern.osrevision: 199506 kern.version: FreeBSD 13.2-RELEASE-p5 stable/23.7-n254837-8806e8fefb1 SMP [...] kern.msgbuf: ---<<BOOT>>--- Copyright (c) 1992-2021 The FreeBSD Project. Copyright (c) 1979, 1980, 1983, 1986, 1988, 1989, 1991, 1992, 1993, 1994 The Regents of the University of California. All rights reserved. FreeBSD is a registered trademark of The FreeBSD Foundation. FreeBSD 13.2-RELEASE-p5 stable/23.7-n254837-8806e8fefb1 SMP amd64 FreeBSD clang version 14.0.5 (https://github.com/llvm/llvm-project.git llvmorg-14.0.5-0-gc12386ae247c) [...] aesni0: <AES-CBC,AES-CCM,AES-GCM,AES-ICM,AES-XTS,SHA1,SHA256> [...] igc0: <Intel(R) Ethernet Controller I225-V> mem 0x80300000-0x803fffff,0x80400000-0x80403fff at device 0.0 on pci1 [...] igc1: <Intel(R) Ethernet Controller I225-V> mem 0x80000000-0x800fffff,0x80100000-0x80103fff at device 0.0 on pci2 [...] igc2: <Intel(R) Ethernet Controller I225-V> mem 0x7fd00000-0x7fdfffff,0x7fe00000-0x7fe03fff at device 0.0 on pci3 [...] ada0: <ATP SATA III M.2 2242 SBFMB1.1> ACS-4 ATA SATA 3.x device [...] ada1: Serial Number BTWA51950A7F080BGN [...] dev.igc.0.wake: 0 dev.igc.0.interrupts.rx_desc_min_thresh: 0 dev.igc.0.interrupts.asserts: 972000 dev.igc.0.mac_stats.tso_txd: 0 dev.igc.0.mac_stats.tx_frames_1024_1522: 11326 dev.igc.0.mac_stats.tx_frames_512_1023: 1404 dev.igc.0.mac_stats.tx_frames_256_511: 16245 dev.igc.0.mac_stats.tx_frames_128_255: 1113 dev.igc.0.mac_stats.tx_frames_65_127: 234306 dev.igc.0.mac_stats.tx_frames_64: 83913 dev.igc.0.mac_stats.mcast_pkts_txd: 0 dev.igc.0.mac_stats.bcast_pkts_txd: 10 dev.igc.0.mac_stats.good_pkts_txd: 348307 dev.igc.0.mac_stats.total_pkts_txd: 348307 dev.igc.0.mac_stats.good_octets_txd: 45049841 dev.igc.0.mac_stats.good_octets_recvd: 898292756 dev.igc.0.mac_stats.rx_frames_1024_1522: 613398 dev.igc.0.mac_stats.rx_frames_512_1023: 3937 dev.igc.0.mac_stats.rx_frames_256_511: 1621 dev.igc.0.mac_stats.rx_frames_128_255: 5029 dev.igc.0.mac_stats.rx_frames_65_127: 18062 dev.igc.0.mac_stats.rx_frames_64: 35532 dev.igc.0.mac_stats.mcast_pkts_recvd: 146 dev.igc.0.mac_stats.bcast_pkts_recvd: 26650 dev.igc.0.mac_stats.good_pkts_recvd: 677579 dev.igc.0.mac_stats.total_pkts_recvd: 699345 dev.igc.0.mac_stats.xoff_txd: 0 dev.igc.0.mac_stats.xoff_recvd: 0 dev.igc.0.mac_stats.xon_txd: 0 dev.igc.0.mac_stats.xon_recvd: 0 dev.igc.0.mac_stats.alignment_errs: 0 dev.igc.0.mac_stats.crc_errs: 0 dev.igc.0.mac_stats.recv_errs: 0 dev.igc.0.mac_stats.recv_jabber: 0 dev.igc.0.mac_stats.recv_oversize: 0 dev.igc.0.mac_stats.recv_fragmented: 0 dev.igc.0.mac_stats.recv_undersize: 0 dev.igc.0.mac_stats.recv_no_buff: 0 dev.igc.0.mac_stats.missed_packets: 0 dev.igc.0.mac_stats.defer_count: 0 dev.igc.0.mac_stats.sequence_errors: 0 dev.igc.0.mac_stats.symbol_errors: 0 dev.igc.0.mac_stats.collision_count: 0 dev.igc.0.mac_stats.late_coll: 0 dev.igc.0.mac_stats.multiple_coll: 0 dev.igc.0.mac_stats.single_coll: 0 dev.igc.0.mac_stats.excess_coll: 0 dev.igc.0.queue_rx_3.rx_irq: 0 dev.igc.0.queue_rx_3.rxd_tail: 581 dev.igc.0.queue_rx_3.rxd_head: 582 dev.igc.0.queue_rx_2.rx_irq: 0 dev.igc.0.queue_rx_2.rxd_tail: 972 dev.igc.0.queue_rx_2.rxd_head: 973 dev.igc.0.queue_rx_1.rx_irq: 0 dev.igc.0.queue_rx_1.rxd_tail: 689 dev.igc.0.queue_rx_1.rxd_head: 690 dev.igc.0.queue_rx_0.rx_irq: 0 dev.igc.0.queue_rx_0.rxd_tail: 518 dev.igc.0.queue_rx_0.rxd_head: 519 dev.igc.0.queue_tx_3.tx_irq: 0 dev.igc.0.queue_tx_3.txd_tail: 958 dev.igc.0.queue_tx_3.txd_head: 958 dev.igc.0.queue_tx_2.tx_irq: 0 dev.igc.0.queue_tx_2.txd_tail: 975 dev.igc.0.queue_tx_2.txd_head: 975 dev.igc.0.queue_tx_1.tx_irq: 0 dev.igc.0.queue_tx_1.txd_tail: 500 dev.igc.0.queue_tx_1.txd_head: 500 dev.igc.0.queue_tx_0.tx_irq: 0 dev.igc.0.queue_tx_0.txd_tail: 578 dev.igc.0.queue_tx_0.txd_head: 578 [...] dev.igc.0.%parent: pci1 dev.igc.0.%pnpinfo: vendor=0x8086 device=0x15f3 subvendor=0x8086 subdevice=0x0000 class=0x020000 dev.igc.0.%location: slot=0 function=0 dbsf=pci0:1:0:0 handle=\_SB_.PC00.RP01.PXSX dev.igc.0.%driver: igc dev.igc.0.%desc: Intel(R) Ethernet Controller I225-V [...]
In Kombination mit 'grep' können Informationen wie Treiberversionen gesammelt ausgegeben werden:[2]
root@OPNsense:~ # sysctl -a | grep -E 'dev.(igb|igc|ix|em).*.%desc:' dev.igc.2.%desc: Intel(R) Ethernet Controller I225-V dev.igc.1.%desc: Intel(R) Ethernet Controller I225-V dev.igc.0.%desc: Intel(R) Ethernet Controller I225-V
Das Tool usbconfig zeit Details zu angeschlossenen USB-Geräten:
# usbconfig
Die Ausgabe zeigt in diesem Fall einen zu Testzwecken am LES v4 installierten USB-WiFi Stick und ein Quectel LTE Modem an:
root@OPNsense:~ # usbconfig ugen0.1: <Intel XHCI root HUB> at usbus0, cfg=0 md=HOST spd=SUPER (5.0Gbps) pwr=SAVE (0mA) ugen0.2: <802.11n USB WLAN> at usbus0, cfg=0 md=HOST spd=HIGH (480Mbps) pwr=ON (500mA) ugen0.3: <Quectel EM12-G> at usbus0, cfg=0 md=HOST spd=SUPER (5.0Gbps) pwr=ON (224mA)
Mit der Option -h erscheinen Informationen zu weiteren Kommandos:
root@OPNsense:~ # usbconfig -h usbconfig - configure the USB subsystem usage: usbconfig [-u <busnum>] [-a <devaddr>] [-i <ifaceindex>] [-v] [cmds...] usage: usbconfig -d [ugen]<busnum>.<devaddr> [-i <ifaceindex>] [-v] [cmds...] commands: set_config <cfg_index> set_alt <alt_index> set_template <template> get_template add_dev_quirk_vplh <vid> <pid> <lo_rev> <hi_rev> <quirk> remove_dev_quirk_vplh <vid> <pid> <lo_rev> <hi_rev> <quirk> add_quirk <quirk> remove_quirk <quirk> detach_kernel_driver dump_quirk_names dump_device_quirks dump_all_desc dump_device_desc dump_curr_config_desc dump_all_config_desc dump_string <index> dump_info dump_stats show_ifdrv suspend resume power_off power_save power_on reset list do_request <bmReqTyp> <bReq> <wVal> <wIdx> <wLen> <data...>
Details zu einem bestimmten Gerät können mit der Option -d zur Auswahl des Gerätes und mit dem Kommando dump_all_desc abgefragt werden:
# usbconfig -d ugen0.2 dump_all_desc
Die Ausgabe zeigt:
root@OPNsense:~ # usbconfig -d ugen0.3 dump_all_desc ugen0.3: <Quectel EM12-G> at usbus0, cfg=0 md=HOST spd=SUPER (5.0Gbps) pwr=ON (224mA) bLength = 0x0012 bDescriptorType = 0x0001 bcdUSB = 0x0310 bDeviceClass = 0x0000 <Probed by interface class> bDeviceSubClass = 0x0002 bDeviceProtocol = 0x0001 bMaxPacketSize0 = 0x0009 idVendor = 0x2c7c idProduct = 0x0512 bcdDevice = 0x0318 iManufacturer = 0x0001 <Quectel> iProduct = 0x0002 <EM12-G> iSerialNumber = 0x0003 <0123456789ABCDEF> bNumConfigurations = 0x0001 Configuration index 0 [...]
Das Tool x86info erlaubt es, zahlreiche Informationen über den verwendeten Prozessor auszulesen, z.B. auch die Intel Microcode Version.
Hinweis: x86info ist bei OPNsense (das auf FreeBSD basiert), nicht enthalten. Damit es dennoch via pkg install x86info installiert werden kann, müssen zuvor FreeBSD Pakete temporär für die Installation zugelassen werden (Eintrag in /usr/local/etc/pkg/repos/FreeBSD.conf auf yes setzen). Nach der Installation sollte dieser Eintrag wieder auf no gestellt werden.
Installation von x86info unter OPNsense:
root@OPNsense:~ # vi /usr/local/etc/pkg/repos/FreeBSD.conf
root@OPNsense:~ # cat /usr/local/etc/pkg/repos/FreeBSD.conf
FreeBSD: { enabled: yes }
root@OPNsense:~ # pkg install x86info
Updating FreeBSD repository catalogue...
[...]
The following 3 package(s) will be affected (of 0 checked):
New packages to be INSTALLED:
libpci: 3.10.0 [OPNsense]
pciids: 20230922 [OPNsense]
x86info: 1.31.s03 [OPNsense]
[...]
root@OPNsense:~ # vi /usr/local/etc/pkg/repos/FreeBSD.conf
root@OPNsense:~ # cat /usr/local/etc/pkg/repos/FreeBSD.conf
FreeBSD: { enabled: no }
root@OPNsense:~ #
Damit das Tool ausgeführt werden kann, muss zuvor das Modul cpuctl mittels kldload geladen werden. Das folgende Beispiel zeigt die Ausgabe von x86info auf einem LES v4.
root@OPNsense:~ # kldload cpuctl
root@OPNsense:~ # x86info -a
x86info v1.31pre
Found 4 identical CPUs
Extended Family: 0 Extended Model: 9 Family: 6 Model: 150 Stepping: 1
Type: 0 (Original OEM)
CPU Model (x86info's best guess): Unknown model.
Processor name string (BIOS programmed): Intel(R) Celeron(R) J6412 @ 2.00GHz
Performance msrs:
MSR_IA32_PERF_STATUS: 0x1bd700001400
MSR_IA32_MISC_ENABLE: 0x850089 [Enabled: TCC PerfMon EnhancedSpeedStep ]
Thermal msrs:
MSR_PM_THERM2_CTL: 0x0 [Thermal monitor: 1]
MSR_IA32_THERM_CONTROL: 0x0 [Software-controlled clock disabled (full speed)]
MSR_IA32_THERM_STATUS: 0x883b0000
Machine check MSRs:
Number of reporting banks : 9
Bank: 0 (0x400)
MC0CTL: 00000000 00000000 00000000 00000000
00000000 00000000 00000000 01011110
MC0STATUS: 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000
MC0ADDR: 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000
[...]
Bank: 8 (0x420)
MC8CTL: 00000000 00000000 00000000 00000000
00000000 00000000 00000000 11111111
MC8STATUS: 00000000 00000000 00000000 00000000
00000000 00000000 00000000 00000000
MC8ADDR: 00000000 00000000 00000000 00000000
11111110 11110101 10011011 01000000
Microcode version: 0x0000000000000016
eax in: 0x00000000, eax = 0000001b ebx = 756e6547 ecx = 6c65746e edx = 49656e69
eax in: 0x00000001, eax = 00090661 ebx = 00800800 ecx = 4ff8ebbf edx = bfebfbff
[...]
eax in: 0x80000008, eax = 00003027 ebx = 00000000 ecx = 00000000 edx = 00000000
Cache info
L1 Data Cache: 32KB, 8-way associative, 64 byte line size
L1 Instruction Cache: 32KB, 8-way associative, 64 byte line size
L2 Unified Cache: 1536KB, 12-way associative, 64 byte line size
L3 Unified Cache: 4096KB, 16-way associative, 64 byte line size
TLB info
Found unknown cache descriptors: fe
Feature flags:
fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflsh ds acpi mmx fxsr sse sse2 ss ht tm pbe sse3 pclmuldq dtes64 monitor ds-cpl vmx est tm2 ssse3 sdbg cx16 xTPR pdcm sse4_1 sse4_2 x2apic movbe popcnt tsc-deadline aes xsave osxsave rdrnd
Extended feature flags:
SYSCALL xd rdtscp em64t lahf_lm prefetchw dts ida arat pln ecmd ptm [6:eax:16] [6:eax:20] fsgsbase tsc_adj fdp_excp smep erms nofpucs pqe rdseed smap clflushopt clwb ipt sha nonstop_tsc
Long NOPs supported: yes
MTRR registers:
MTRRcap (0xfe): 0x0000000000004d0a wc:1 fix:1 vcnt:10
[...]
MTRRdefType (0x2ff): 0x0000000000000c06 (fixed-range flag:1 enable flag:1 default type:0x06 (write-back))
APIC registers:
APIC MSR Base(0x1b): : 0x00000000fee00d00
[...]
APIC Divide Configuration (for Timer) : 0xffffffff
Address sizes : 39 bits physical, 48 bits virtual
2.00GHz processor (estimate).
Total processor threads: 4
This system has 1 dual-core processor with hyper-threading (2 threads per core) running at an estimated 2.00GHz
 |
Autor: Werner Fischer Werner Fischer arbeitet im Product Management Team von Thomas-Krenn. Er evaluiert dabei neueste Technologien und teilt sein Wissen in Fachartikeln, bei Konferenzen und im Thomas-Krenn Wiki. Bereits 2005 - ein Jahr nach seinem Abschluss des Studiums zu Computer- und Mediensicherheit an der FH Hagenberg - heuerte er beim bayerischen Server-Hersteller an. Als Öffi-Fan nutzt er gerne Bus & Bahn und genießt seinen morgendlichen Spaziergang ins Büro.
|
 |
Autor: Thomas Niedermeier Thomas Niedermeier arbeitet im Product Management Team von Thomas-Krenn. Er absolvierte an der Hochschule Deggendorf sein Studium zum Bachelor Wirtschaftsinformatik. Seit 2013 ist Thomas bei Thomas-Krenn beschäftigt und kümmert sich unter anderem um OPNsense Firewalls, das Thomas-Krenn-Wiki und Firmware Sicherheitsupdates.
|
