FreeBSD Base Install (revisited)

27 Aug, 2026

Over 2025 (and now 2026) I've done quite a lot of FreeBSD installs. Since I frequently change desktop environment or window manager I like to start out with a solid base install.

I recommend anyone to first do an install by following the FreeBSD handbook!

Either way you'll end up with an updated FreeBSD install, with yourself and root as users. That's the base to start anything from. Let's go!

ISO Image

At the time of writing this (August 2026) we are at version 15.1. Download the iso:

https://download.freebsd.org/releases/amd64/amd64/ISO-IMAGES/15.1/FreeBSD-15.1-RELEASE-amd64-disc1.iso

Put it on a USB stick and boot from it:

sudo dd if=FreeBSD-15.1-RELEASE-amd64-memstick.img of=/dev/sdX bs=1M conv=sync

Installation steps

• Keymap

  Select your keymap or proceed with the default selection (US English).

• Packages

  Since we're on 15 now we'll obviously be using the package sets, at least I did.

• Partitioning

  Choose Auto (ZFS)
  ZFS Configuration
  Encrypt disks: YES
  Pool Type/Disks: Choose stripe - No Redundancy
  Partition Scheme: Choose GPT (UEFI)
  Swap Size: Choose 2G (or any size you prefer)

• Distribution Select

  [x] base

  Usually I de-check all others, but obviously you make your own choices here.
  When asked about it remove all old EFI boot manager entries and add a new one (if you previously had some FreeBSD install it will).

• Root password
  Set the root password for your system.

• Time zone selection
  Search, select and set your time zone.

• System Configuration
  [x] sshd
  [x] ntpd
  [x] powerd

• System Hardening [x] random_pid
  [x] clear_tmp
  [x] secure_console

For the configuration and hardening I've selected some options that I find practical for generic system maintenance.

• Firmware installer

If applicable the installer will give an overview of the detected hardware and thus firmware to install. Accept the choices, but do check to see whether certain hardware hasn't been recognized.

• Add Users

Go through the motions; they are pretty self-explanatory. W/r to 'Invite user into other groups?:' I'd add myself to the wheel,operator and video groups (the last one might be useful if you'd ever be using a display manager, like ly or sddm).

• Final configuration

Basically your install is done, but if you want to you can still adjust something in this screen, before rebooting and logging in as root again.

Adjust repo's and first update

Let's use the latest versions of software:

• mkdir -p /usr/local/etc/pkg/repos
• cp /etc/pkg/FreeBSD.conf /usr/local/etc/pkg/repos/FreeBSD.conf
• ee /usr/local/etc/pkg/repos/FreeBSD.conf

Change the FreeBSD url's to:

• url: "pkg+https://pkg.FreeBSD.org/${ABI}/latest"
• url: "pkg+https://pkg.FreeBSD.org/${ABI}/kmods_latest"

Edit the entry for FreeBSD Base and change:

• enabled: yes

This way you'll continue to receive security and base pkg updates. Then:

• pkg update -f & pkg upgrade

Graphics drivers

Enter in the console:

• pciconf -lv|grep -B4 VGA

This will tell you your graphics driver, mine was an AMD one. Install all drivers:

• pkg install drm-kmod

Add to /etc/rc.conf to load the AMD GPU driver at startup:

• sysrc kld_list+=amdgpu

Or with Intel:

• sysrc kld_list+=i915kms

Nvidia

Let's follow the handbook for the proprietary Nvidia driver, which can be installed by running the following command:

• pkg install nvidia-drm-kmod
• sysrc kld_list+=nvidia-drm

This is the direct rendering KMS driver. Kernel modesetting is the option to set the graphics mode in the kernel. Enable it for subsequent boots with the following /boot/loader.conf entry:

• hw.nvidiadrm.modeset="1"

Both PRIME and Wayland require kernel modesetting.

Reboot the system when finished and login as root again

Basic tooling

• pkg install dbus doas git mc seatd

Doas config

• ee /usr/local/etc/doas.conf

• add: permit nopass keepenv {USER)

Logout and login as {USER}

Next steps

Enable a limited number of core services:

• doas sysrc dbus_enable="YES"
• doas sysrc seatd_enable="YES"
• doas sysrc -v kld_list+="cpuctl coretemp"
• doas sysrc -v kld_list+="cc_htcp"

QoL

Some useful additions for a well functioning system:

• doas ee /boot/loader.conf and add:

  autoboot_delay=5
  security.bsd.allow_destructive_dtrace="0"
  kern.ipc.shmseg="1024"
  kern.ipc.shmmni="1024"
  kern.maxproc="100000"
  hw.pci.do_power_nodriver="3"
  net.inet.tcp.soreceive_stream="1"
  net.isr.defaultqlimit="2048"
  net.link.ifqmaxlen="2048"
  loader_logo="beastie"

• doas ee /etc/sysctl.conf and add:

  hw.kbd.keymap_restrict_change=4
  kern.coredump=0
  kern.elf32.aslr.pie_enable=1
  kern.random.fortuna.minpoolsize=128
  kern.randompid=1
  net.inet.icmp.drop_redirect=1
  net.inet.ip.process_options=0
  net.inet.ip.random_id=1
  net.inet.ip.redirect=0
  net.inet.ip.rfc1122_strong_es=1
  net.inet.tcp.always_keepalive=0
  net.inet.tcp.drop_synfin=1
  net.inet.tcp.icmp_may_rst=0
  net.inet.tcp.syncookies=0
  net.inet6.ip6.redirect=0
  security.bsd.unprivileged_read_msgbuf=0
  kern.ipc.maxsockbuf=2097152
  kern.ipc.soacceptqueue=1024
  kern.ipc.somaxconn=1024
  net.inet.tcp.abc_l_var=44
  net.inet.tcp.cc.abe=1
  net.inet.tcp.cc.algorithm=htcp
  net.inet.tcp.cc.htcp.adaptive_backoff=1
  net.inet.tcp.cc.htcp.rtt_scaling=1
  net.inet.tcp.ecn.enable=1
  net.inet.tcp.fast_finwait2_recycle=1
  net.inet.tcp.fastopen.server_enable=1
  net.inet.tcp.finwait2_timeout=5000
  net.inet.tcp.initcwnd_segments=44
  net.inet.tcp.keepcnt=2
  net.inet.tcp.keepidle=62000
  net.inet.tcp.keepinit=5000
  net.inet.tcp.minmss=536
  net.inet.tcp.msl=2500
  net.inet.tcp.mssdflt=1448
  net.inet.tcp.nolocaltimewait=1
  net.inet.tcp.recvbuf_max=2097152
  net.inet.tcp.recvspace=65536
  net.inet.tcp.sendbuf_inc=65536
  net.inet.tcp.sendbuf_max=2097152
  net.inet.tcp.sendspace=65536
  net.local.stream.recvspace=65536
  net.local.stream.sendspace=65536
  kern.ipc.shm_use_phys=1
  kern.sched.preempt_thresh=224
  vfs.usermount=1

First backup

Create a snapshot of this system:

• doas zfs snapshot -r zroot@minimal

'minimal' can be renamed to anything you like (i.e doas zfs snapshot -r zroot@base07012026). The '-r' switch means recursively all sub-directories are included in this snapshot.
You can automate all this, but be aware they can take up quite a lot of diskspace. The one I did straight after a KDE install was already 3Gb.

Now you're ready to install any DE or WM on top of FreeBSD.

Many thanks to Cullum Smith (@cullum@bsd.cafe) for providing a lot of useful tips.
There's more of that over here:
https://www.sacredheartsc.com/blog/freebsd-15-on-a-laptop/, including some handy laptop specific tips.
And to Graham Perrin (@grahamperrin@bsd.cafe) for useful feedback and proofreading.