general/other Internet facing server: FreeBSD or SmartOS hypervisor?

S

Steve1

I'm not quite sure where to ask this (networking, firewalls, network services or emulation might also work); mods please move if there's a better location.

I've got a server currently running Windows-only software for my IP camera monitoring and I'd like to use it as a public facing web server located in a DMZ behind my firewall. The problem is I also:
  • need/want to use this as a Plex server to replace a 12 year old Synology, meaning it will have access to my 'internal' network
  • Continue to host the IP camera software
  • Work as a NAS, also on the internal network
Buying a NUC or mini PC would be my preferred choice, but both cost and space/heat constrain that. The most practical location is in an unventilated server closet where temperatures are typically 34C, and short of drilling holes through the outside walls, I don't think I can fit any more hardware there. CPU temps on the firewall are usually in the 50+C range, and I've ruined 2 UPSs because the heat destroys the batteries and trips the entire house electricity off, and I can't use them any more. My IP cameras have network cables that could be accessed with little effort from outside the house, and then there's the Internet exposure, though limited by the firewall.

My current thinking is to install a 4-port network card and virtualise the systems in a secure manner.

So, I'm looking for a setup that has the 'best' security and isolation. Common wisdom would point to SmartOS, and what I'd like to know from someone more knowledge is: 'how true is it that SmartOS is more secure' in this scenario? I don't mind learning SMF (I knew it at one time), but that's another complication, and it seems it will be simpler to have the hypervisor be FreeBSD for simpler consistent configuration among all the machines (VMs and hosts).

Is anyone here confident enough in FreeBSD or SmartOS security that they would deploy one in this scenario?
 
I wanted to give SmartOS a try several times, however, I have always had hardware issues. I have tried older, decommisioned entry-level servers by IBM, Dell and Supermicro as well as standard PC hardware which was roughly 6-8 years old at the time of testing and I did not succeed. Though I like Solaris, I do think you're off with FreeBSD.
 
cracauer@ said:
Never heard if SmartOS. As such I just assume it isn't very big and hence not very security-reviewed.
Click to expand...
From their wiki:
"SmartOS is a Type 1 Hypervisor platform based on illumos that supports OS and hardware virtualization. Learn how to install, use, and develop SmartOS and Triton, the data center product powered by SmartOS."
 
mer said:
From their wiki:
"SmartOS is a Type 1 Hypervisor platform based on illumos that supports OS and hardware virtualization. Learn how to install, use, and develop SmartOS and Triton, the data center product powered by SmartOS."
Click to expand...

OK, but that makes it a whole Unix implementation with lack of person-power. It might be great overall, but for its security that is problematic.
 
  • Like
Reactions: mer
Steve1, all.


I have a little background here from my previous life at Sun and Oracle after they bought us, and knowing some folks at Joyent - not sure if it will help with your decision or not, but here goes.

SmartOS ultimately under the hood is Solaris, but a fork of Solaris, from the OpenSolaris days.

A few forks happened following Oracle buying Sun. OpenIndiana was one where folks, IIRC, kept a lot of the things from OpenSolaris and Solaris 11, but there was some who were not keen on the newer package manager ‘pkg’, and reverted to/kept SVR4 packaging from Solaris 10 and prior days. There was a few others too I think, or attempts anyway.

SmartOS was developed as another fork by the folks at Joyent, again, IIRC, they added in a Solaris native KVM, and everything ultimately ran in zones (Solaris’ container technology - there were regular lightweight Solaris/SmartOS zones that share the kernel) or KVM virtual machines. Don’t think ‘kernel zones’ were available to SmartOS… that may be something developed later into Solaris 11.

From what I recall, SmartOS, at least initially, they typically ran node.js workloads at Joyent, and make it ultra scalable. Why use a Solaris base? Probably a bunch of reasons at the time. They had some great talent at Joyent, and hired in Bryan Cantrill (may be known as Mr. DTrace) as their engineering VP, and a whole bunch of other talent who know Solaris inside and out to continue on their journey to build a high scale, secure, and reliable cloud solution. A person I used to work with years prior also was working there, and they were doing very cool stuff.

Joyent was later acquired, and I stopped following so much what was going on over there. I am not sure how much of the talented team who were working on it still work on SmartOS, or the current state, but I am certainly a fan of them and all they did.

Nevertheless, I am also a fan of FreeBSD, and ‘came home’ after over a decade primarily on Solaris, OpenSolaris and trying out various forks and what not.

I never ran SmartOS in more than just a ‘try it out’ environment, but can truly appreciate it, and its history, and some of the cool tech. Although I love SmartOS’ Solaris roots, and I am a huge Solaris fan and worked on it/with it in various ways through my career, today, my decision is to run FreeBSD - and I run all of our critical infrastructure on it.

Why I decided myself on FreeBSD instead of SmartOS or another Solaris based OS?

I am just not sure the Solaris derivatives have the extensive support and that enough people have sufficient time to work on the various Solaris OS derivatives to be able to keep up with the number of folks who work on FreeBSD. There’s some very passionate engineers that do still contribute to these derivatives, and they are great people, but for some number of them, it is no longer their day job, and after I think multiple acquisitions of the company / tech that is SmartOS, I am just not sure they are going to have the same focus on creating an OS for the community that FreeBSD does. They might - could be wrong… but I think the number of folks, and companies as well behind making FreeBSD successful for general purpose workloads is something to consider, and the fact that it has ‘stayed the course’ for decades… coming back to it after so long, it feels like home… it’s progressed in so many great ways, but also kept the solid roots too, I just love it.

FreeBSD is well supported, and to this day ‘just works’… it has all the things I used to love about it, when I used to be a big FreeBSD guy back in the 4, 5, 6, 7, 8 days… I recently upgrade a host from FreeBSD 11 to FreeBSD 13 or 14… I think it was 13.2 … in one single step… zero issues. I was super impressed, but also had a feeling it may just work. And it did.

FreeBSD also has almost everything I love from Solaris - ZFS, DTrace, a form of/clone of beadm (boot environments). It’s fast, it kept the things I loved about it from way back when (and found less ideal in Solaris’ progression), like simple init scripts instead of SMF (which has its benefits, but I still like it simple)…. and the community continues on, the releases continue on, the support is there, and there’s some great people here in this community.

All in all, not telling you what to do of course - but knowing both platforms reasonably well (or at least its roots, Solaris), having worked in developing large Solaris deployments for some of the biggest businesses, multi-site Solaris clusters in enterprise, working directly with the Solaris engineering folks when I worked on SPARC virtualisation… and as a result loving Solaris and what those brilliant folks created… and being confident you can rely on it… But also loving FreeBSD too… and knowing how fragmented the Solaris derivative communities got.. at least as I see it... My decision was to go FreeBSD.

I think FreeBSD is vibrant, alive and just smashing it, and to put my money where my mouth is - my choice for my business is FreeBSD, and would be FreeBSD every time, in the world we find ourselves today.

It just works. At least, it does for me. But knowing it’s got a clear future, and one supported by a LOT more people, I think that factors in, as it tends to mean better long term support, better hardware support, more folks who can answer questions and help, and so on. This will also be important for jumping on security issues and so on. But both can isolate workloads well - and there’s heaps of options for that on FreeBSD.

So my very general advice - go FreeBSD if your choice is SmartOS or FreeBSD. It will probably work out better for you long term, would be my guess, not knowing you or knowing much about your situation, or exactly what is going on with SmartOS today, being my disclaimer :)
 
You’re very welcome. I was a bit tired when I wrote it so a few errors but, you get the gist :)

Let us know if you have any further questions. I know the underpinnings relatively well on both sides, at least as a sysadmin. I did work in parts of engineering for a while there, but, know virtually nothing compared to the gods who made both of these beautiful operating systems and VM infrastructure.
 
You must log in or register to reply here.
Back
Top