Date: Thu, 21 May 2026 23:34:22 +0100 From: Polarian <polarian@polarian.dev> To: freebsd-questions@freebsd.org Subject: Terminal server with consumer hardware Message-ID: <20260521233422.001d364f@Hydrogen>
index | next in thread | raw e-mail
Hello list, This has been discussed on #freebsd a few times now with no success. A common reason you don't full disk encrypt servers is because it makes unattended boot difficult. I believe TPM encryption is now supported recently but undocumented (correct me if I am wrong), however TPM only protects against decryption AFTER you dispose of the disks, if they have the hardware and the disks, its pointless unless paired with keydisk or passphrase. Keydisk works, but requires you to plug in the keydisk to boot, making it infeasible to attend a boot remotely. This leaves passphrase, which is possible to attend a boot remotely provided you have access. Loader supports serial, or a KVM. KVM requires graphics, and on my server there is no integrated graphics, this means powering a graphics card (extra 10-15w) which if you are running 24/7, is more costly. This makes serial ideal, its simple, doesn't require much power, and unlike a KVM, a cheap RPI is all you need. My setup is a RPI running OpenBSD which is accessible via ssh, connected to the FreeBSD server by two WinChipHead CH9102/343/341/340 (not sure which exact chip it is) TTL usb adapters, with the rx and tx soldered together, transitively, a usb to usb serial adapter. This works flawlessly when getty is configured, apart from my shell only rendering a few lines, but I assume this might be a limitation of cu(1) on OpenBSD. It works as an emergency if I get locked out. The final issue I thought would be simple, get loader to output to serial, use the serial access through the terminal server to decrypt the server, call it a day, but after weeks of trying I am on the verge of giving up. My config is the following in loader.conf: # Serial output boot_serial="YES" boot_multicons="YES" console="comconsole" comconsole_speed="115200" I read for EFI you need your motherboard firmware to support serial redirect, so I switched it to bios boot thinking this would be the fix, but no dice. I then think that its just not possible, but after looking through all the loader man pages, I see this in loader.efi(8): > On x86 platforms, if you wish to redirect the loader's output to > a serial port when the EFI BIOS doesn't support it, or to a serial > port that isn't the one the EFI BIOS redirects its output to, set > console to “comconsole”. The default port is COM1 with an I/O > address of 0x3f8. comconsole_port is used to set this to a different > port address. Alright cool, so it is possible, but I already set the console to comconsole and it doesn't work, in fact theres nothing until getty is executed by init. So I assume the output is wrong, it does mention that comconsole_port can be specified for this, so I check further down the man page: > Windows Name I/O Port Address Typical > FreeBSD device COM1 0x3f8 /dev/uart0 > COM2 0x2f8 /dev/uart1 > COM3 0x3e8 /dev/uart2 > COM4 0x2e8 /dev/uart3 (Format broke due to character limitations in plaintext, however the point should still be clear) So /dev/uart is what is listed, with the port addresses, cool but not what I need. With a USB TTL adapter the device is /dev/ttyU0 however I am not smart enough to know what the port address is to set it, maybe someone here can help? I am also concerned this is limited to only certain serial devices, I don't know how much logic is implemented within loader, however the fact you can use keydisk from a USB (haven't managed to get this working myself, but heard its possible) means that the loader has got the ability to read usb devices, but I would question if it would have the device driver for the serial chip, and maybe this is the problem? In any case, could anyone provide more information on this, the more indepth the better. I really want to get this working :D Thank you, -- Polarian Jabber/XMPP: polarian@icebound.devhome | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20260521233422.001d364f>