En aquest article t'explique lo fàcil que és mantenir un servidor FreeBSD actualitzat, perquè arran de les últimes vulnerabilitat de PHP cal actualitzar totes les màquines que tinguen PHP.
Hui tocava fer-ho a un parell de Raspberry Pi que tinc per al desenvolupament, i ací veuràs lo senzill que és actualitzar un sistema BSD.
Actualment tinc instal·lada la versió 15.0-STABLE per a l'arquitectura ARM (arm64):
$ uname -a
FreeBSD desenvolupament15 15.0-STABLE FreeBSD 15.0-STABLE stable/15-n281473-d9b9de6608b3 GENERIC arm64
Actualitzarem les fonts amb:
joan@desenvolupament15:~ $ pkg update
pkg: Insufficient privileges to update the repository catalogue.
joan@desenvolupament15:~ $ doas pkg update
Updating FreeBSD-ports repository catalogue...
Fetching meta.conf: 100% 168 B 0.2 k/s 00:01
Fetching data: 100% 9 MiB 2.4 M/s 00:04
Processing entries: 0%
Newer FreeBSD version for package zzuf:
To ignore this error set IGNORE_OSVERSION=yes
- package: 1501000
- running userland: 1500503
Ignore the mismatch and continue? [y/N]: y
Processing entries: 100%
FreeBSD-ports repository update completed. 37314 packages processed.
All repositories are up to date.
Ara vaig a mirar la versió de PHP que tinc corrent actualment als meus projectes web:
joan@desenvolupament15:~ $ pkg info | grep php
php84-8.4.15 PHP Scripting Language (8.4.X branch)
php84-composer-2.9.2 Dependency Manager for PHP
php84-ctype-8.4.16 The ctype shared extension for php
php84-curl-8.4.15 The curl shared extension for php
php84-dom-8.4.15 The dom shared extension for php
php84-filter-8.4.15 The filter shared extension for php
php84-gd-8.4.15 The gd shared extension for php
php84-intl-8.4.16 The intl shared extension for php
php84-mbstring-8.4.15 The mbstring shared extension for php
php84-opcache-8.4.15 The opcache shared extension for php
php84-pdo-8.4.15 The pdo shared extension for php
php84-pdo_mysql-8.4.15 The pdo_mysql shared extension for php
php84-pdo_sqlite-8.4.16 The pdo_sqlite shared extension for php
php84-phar-8.4.16 The phar shared extension for php
php84-session-8.4.15 The session shared extension for php
php84-simplexml-8.4.15 The simplexml shared extension for php
php84-tokenizer-8.4.15 The tokenizer shared extension for php
php84-xml-8.4.15 The xml shared extension for php
php84-zip-8.4.15 The zip shared extension for php
php84-zlib-8.4.15 The zlib shared extension for php
joan@desenvolupament15:~ $
I iniciem l'actualització de tot el sistema i dels paquets:
joan@desenvolupament15:~ $ doas pkg upgrade
Updating FreeBSD-ports repository catalogue...
FreeBSD-ports repository is up to date.
All repositories are up to date.
New version of pkg detected; it needs to be installed first.
The following 1 package(s) will be affected (of 0 checked):
Installed packages to be UPGRADED:
pkg: 2.5.1 -> 2.8.4 [FreeBSD-ports]
Number of packages to be upgraded: 1
The process will require 23 MiB more space.
12 MiB to be downloaded.
Proceed with this action? [y/N]: y
[1/1] Fetching pkg-2.8.4: 100% 12 MiB 6.3 M/s 00:02
Checking integrity... done (0 conflicting)
[1/1] Upgrading pkg from 2.5.1 to 2.8.4...
[1/1] Extracting pkg-2.8.4: 100%
Updating FreeBSD-ports repository catalogue...
pkg: need to re-create repo FreeBSD-ports to upgrade schema version
Fetching meta.conf: 100% 168 B 0.2 kB/s 00:01
Fetching data: 100% 9280 KiB 2.4 MB/s 00:04
Processing entries: 0%
Newer FreeBSD version for package zzuf:
To ignore this error set IGNORE_OSVERSION=yes
- package: 1501000
- running userland: 1500503
Ignore the mismatch and continue? [y/N]: y
Processing entries: 100%
FreeBSD-ports repository update completed. 37314 packages processed.
All repositories are up to date.
Checking for upgrades (118 candidates): 100%
Processing candidates (118 candidates): 100%
The following 124 package(s) will be affected (of 0 checked):
New packages to be INSTALLED:
libXres: 1.2.3 [FreeBSD-ports]
libpcap: 1.11.0 [FreeBSD-ports]
lua54: 5.4.8 [FreeBSD-ports]
py312-packaging: 26.3 [FreeBSD-ports]
py312-setuptools: 63.1.0_3 [FreeBSD-ports] (vulnerable!)
python312: 3.12.15 [FreeBSD-ports] (vulnerable!)
Installed packages to be UPGRADED:
at-spi2-core: 2.56.6 -> 2.60.4 [FreeBSD-ports]
bash: 5.3.9 -> 5.3.20 [FreeBSD-ports]
boost-libs: 1.89.0_1 -> 1.92.0 [FreeBSD-ports]
ca_root_nss: 3.117_2 -> 3.131 [FreeBSD-ports] (vulnerable!)
capstone: 5.0.6 -> 5.0.9 [FreeBSD-ports]
cloudflared: 2025.8.0_4 -> 2026.2.0_9 [FreeBSD-ports]
colord: 1.4.8 -> 1.4.8_2 [FreeBSD-ports]
cups: 2.4.15_1 -> 2.4.20 [FreeBSD-ports]
curl: 8.17.0 -> 8.22.0 [FreeBSD-ports] (vulnerable!)
dav1d: 1.5.1_1 -> 1.5.4 [FreeBSD-ports]
dbus-glib: 0.114 -> 0.116 [FreeBSD-ports]
doas: 6.3p13 -> 6.4 [FreeBSD-ports]
emacs: 30.2,3 -> 31.1_2,3 [FreeBSD-ports] (vulnerable!)
expat: 2.7.3 -> 2.9.0 [FreeBSD-ports]
fontconfig: 2.15.0_3,1 -> 2.18.3,1 [FreeBSD-ports]
freetype2: 2.14.1 -> 2.14.3 [FreeBSD-ports]
fribidi: 1.0.16 -> 1.0.17 [FreeBSD-ports]
galera26: 26.4.22_2 -> 26.4.27_1 [FreeBSD-ports]
gcc13: 13.3.0_3 -> 13.5.0 [FreeBSD-ports]
gettext-runtime: 0.23.1 -> 1.0_1 [FreeBSD-ports]
giflib: 5.2.2 -> 6.1.3 [FreeBSD-ports]
git: 2.52.0 -> 2.56.0 [FreeBSD-ports]
glib: 2.84.4,2 -> 2.88.3,2 [FreeBSD-ports]
gnutls: 3.8.11 -> 3.8.13 [FreeBSD-ports]
gobject-introspection: 1.84.0,1 -> 1.86.0,1 [FreeBSD-ports]
graphite2: 1.3.14 -> 1.3.15_1 [FreeBSD-ports]
gtk3: 3.24.51 -> 3.24.52 [FreeBSD-ports]
harfbuzz: 10.3.0 -> 14.6.0 [FreeBSD-ports]
htop: 3.4.1 -> 3.5.3 [FreeBSD-ports]
hwdata: 0.401,1 -> 0.412,1 [FreeBSD-ports]
jpeg-turbo: 3.1.2 -> 3.1.4.1 [FreeBSD-ports]
lcms2: 2.17 -> 2.19.1 [FreeBSD-ports]
lerc: 4.0.0 -> 4.2.0 [FreeBSD-ports]
libX11: 1.8.12,1 -> 1.8.14,1 [FreeBSD-ports]
libXcomposite: 0.4.6_1,1 -> 0.4.7,1 [FreeBSD-ports]
libXdamage: 1.1.6 -> 1.1.7 [FreeBSD-ports]
libXext: 1.3.6,1 -> 1.3.7,1 [FreeBSD-ports]
libXfixes: 6.0.1 -> 6.0.2 [FreeBSD-ports]
libXft: 2.3.8 -> 2.3.9 [FreeBSD-ports]
libXi: 1.8.2,1 -> 1.8.4,1 [FreeBSD-ports]
libXinerama: 1.1.5,1 -> 1.1.6,1 [FreeBSD-ports]
libXmu: 1.1.4,1 -> 1.3.1,1 [FreeBSD-ports]
libXpm: 3.5.17_1 -> 3.5.20 [FreeBSD-ports]
libXrandr: 1.5.4 -> 1.5.5 [FreeBSD-ports]
libXrender: 0.9.12 -> 0.9.13 [FreeBSD-ports]
libXt: 1.3.0,1 -> 1.3.1,1 [FreeBSD-ports]
libXtst: 1.2.5 -> 1.2.6 [FreeBSD-ports]
libdatrie: 0.2.14 -> 0.2.14_1 [FreeBSD-ports]
libdeflate: 1.25 -> 1.26 [FreeBSD-ports]
libedit: 3.1.20251016_1,1 -> 3.1.20260512,1 [FreeBSD-ports]
libevent: 2.1.12 -> 2.1.13 [FreeBSD-ports]
libffi: 3.5.1 -> 3.8.0 [FreeBSD-ports]
libidn: 1.43 -> 1.44 [FreeBSD-ports]
libltdl: 2.5.4 -> 2.6.2 [FreeBSD-ports]
libnghttp2: 1.68.0 -> 1.70.0 [FreeBSD-ports]
libpsl: 0.21.5_2 -> 0.23.3 [FreeBSD-ports]
librsvg2-rust: 2.61.2_1 -> 2.62.3_3 [FreeBSD-ports]
libssh2: 1.11.1,3 -> 1.11.1_1,3 [FreeBSD-ports]
libtasn1: 4.20.0_1 -> 4.21.0 [FreeBSD-ports]
libthai: 0.1.29_1 -> 0.1.30 [FreeBSD-ports]
libudev-devd: 0.6.0 -> 0.7.0 [FreeBSD-ports]
libunistring: 1.4.1 -> 1.4.2 [FreeBSD-ports]
libxkbcommon: 1.13.0 -> 1.13.2 [FreeBSD-ports]
libxml2: 2.14.6 -> 2.15.4 [FreeBSD-ports]
libzip: 1.11.4 -> 1.12.1 [FreeBSD-ports]
lzo2: 2.10_1 -> 2.10_2 [FreeBSD-ports]
mailutils: 3.19_1 -> 3.21 [FreeBSD-ports]
mariadb118-client: 11.8.5 -> 11.8.9 [FreeBSD-ports]
mariadb118-server: 11.8.5 -> 11.8.9 [FreeBSD-ports]
mpc: 1.3.1_1 -> 1.4.1 [FreeBSD-ports]
nginx: 1.28.0_8,3 -> 1.30.6_3,3 [FreeBSD-ports]
nmap: 7.94_3 -> 7.992 [FreeBSD-ports]
p11-kit: 0.25.10 -> 0.26.5_1 [FreeBSD-ports]
p5-Authen-SASL: 2.1900 -> 2.2100 [FreeBSD-ports]
p5-Crypt-URandom: 0.54 -> 0.55 [FreeBSD-ports]
p5-IO-Socket-SSL: 2.095 -> 2.099 [FreeBSD-ports]
p5-Mozilla-CA: 20250602 -> 20260813 [FreeBSD-ports]
pango: 1.56.4 -> 1.57.1 [FreeBSD-ports]
pcre2: 10.47_1 -> 10.49 [FreeBSD-ports]
perl5: 5.42.0_1 -> 5.42.3 [FreeBSD-ports]
php84: 8.4.15 -> 8.4.26 [FreeBSD-ports] (vulnerable!)
php84-composer: 2.9.2 -> 2.10.3 [FreeBSD-ports]
php84-ctype: 8.4.16 -> 8.4.26 [FreeBSD-ports]
php84-curl: 8.4.15 -> 8.4.26 [FreeBSD-ports]
php84-dom: 8.4.15 -> 8.4.26 [FreeBSD-ports]
php84-filter: 8.4.15 -> 8.4.26 [FreeBSD-ports]
php84-gd: 8.4.15 -> 8.4.26 [FreeBSD-ports]
php84-intl: 8.4.16 -> 8.4.26 [FreeBSD-ports]
php84-mbstring: 8.4.15 -> 8.4.26 [FreeBSD-ports]
php84-opcache: 8.4.15 -> 8.4.26 [FreeBSD-ports]
php84-pdo: 8.4.15 -> 8.4.26 [FreeBSD-ports]
php84-pdo_mysql: 8.4.15 -> 8.4.26 [FreeBSD-ports]
php84-pdo_sqlite: 8.4.16 -> 8.4.26 [FreeBSD-ports]
php84-phar: 8.4.16 -> 8.4.26 [FreeBSD-ports]
php84-session: 8.4.15 -> 8.4.26 [FreeBSD-ports]
php84-simplexml: 8.4.15 -> 8.4.26 [FreeBSD-ports]
php84-tokenizer: 8.4.15 -> 8.4.26 [FreeBSD-ports]
php84-xml: 8.4.15 -> 8.4.26 [FreeBSD-ports]
php84-zip: 8.4.15 -> 8.4.26 [FreeBSD-ports]
php84-zlib: 8.4.15 -> 8.4.26 [FreeBSD-ports]
pixman: 0.46.2 -> 0.46.4 [FreeBSD-ports]
png: 1.6.50 -> 1.6.59_1 [FreeBSD-ports]
polkit: 125_1 -> 127 [FreeBSD-ports]
py311-packaging: 25.0 -> 26.3 [FreeBSD-ports]
python311: 3.11.14 -> 3.11.17 [FreeBSD-ports] (vulnerable!)
readline: 8.3.1 -> 8.3.6 [FreeBSD-ports]
rsync: 3.4.1_4 -> 3.5.1 [FreeBSD-ports]
screen: 5.0.1_5 -> 5.0.2_1 [FreeBSD-ports]
sqlite3: 3.50.4_2,1 -> 3.53.4,1 [FreeBSD-ports] (vulnerable!)
tiff: 4.7.1 -> 4.7.2 [FreeBSD-ports]
tmux: 3.6_1 -> 3.8 [FreeBSD-ports]
tree-sitter: 0.25.10 -> 0.27.1 [FreeBSD-ports]
wayland: 1.24.0_2 -> 1.26.0 [FreeBSD-ports]
xkeyboard-config: 2.41_4 -> 2.48 [FreeBSD-ports]
xorgproto: 2024.1 -> 2026.1 [FreeBSD-ports]
xxhash: 0.8.3 -> 0.8.4 [FreeBSD-ports]
zstd: 1.5.7_1 -> 1.5.7_2 [FreeBSD-ports]
Installed packages to be REINSTALLED:
json-glib-1.10.8 [FreeBSD-ports] (direct dependency changed: python311 (removed), python312 (added))
Number of packages to be installed: 6
Number of packages to be upgraded: 117
Number of packages to be reinstalled: 1
The process will require 263 MiB more space.
403 MiB to be downloaded.
WARNING: 8 package(s) have known vulnerabilities
Proceed with this action? [y/N]:
Fem "y" i començarà el procés d'actualtizació, i en pocs minuts ja tindrem el nostre servidor al dia.
BSD Rules.
