Host OS baseline

A barracuda pass does more than build the BOA stack. It also maintains parts of the base operating system underneath it: the syslog daemon (always rsyslog), what an interactive root login prints, when the cron service is started or reloaded, and which OpenSSL series BOA's own SSL toolchain tracks. The defaults are right for a normal host, and most operators never need this page.

Two optional presence markers in /root/ override the cron and login-banner defaults. Both are operator-created — BOA has no writer for either anywhere in the tree, and the hosted normalisation passes that create or erase a number of other /root markers leave both alone — so each one persists until you delete it. Neither is read for content; only presence matters. Each also has a supported /root/.barracuda.cnf variable now, and that variable is the switch to reach for; the marker files stay honoured for one release. And neither changes anything the moment you set it: the next barracuda up-<tier> system pass is what enacts the choice. (A third marker, the old syslog-daemon choice, is retired — see below.)

The two markers at a glance

Turning either on is the same two steps. First set the ONE switch you want in /root/.barracuda.cnf — both keys ship there, defaulting to NO:

_NO_CRON_AUTOSTART=YES
# the other switch follows the same pattern:
#   _DONT_USE_FANCY_BASH_LOGIN=YES

Then run the pass that applies it:

barracuda up-lts system

The marker files stay honoured for one release, and while one exists it wins and is re-asserted on every upgrade pass. Turning a switch off during the transition therefore means setting the variable to NO and deleting the marker file, then running another pass.

The syslog daemon is rsyslog — no longer a choice

BOA installs and keeps rsyslog, unconditionally, and never removes it.

There used to be a syslog choice here: an OpenVZ-container arm selecting inetutils-syslogd and a /root/.use.sysklogd.cnf marker (briefly converted to _USE_SYSKLOGD=YES) selecting the classic sysklogd. Both arms purged rsyslog first — and because sysklogd no longer has an install candidate on current Devuan or Debian at all, an opted-in host ended up with no syslog daemon at all. That is why the choice was retired: rsyslog is now the only supported daemon, no arm of any pass removes it, and the OpenVZ arm went with the rest (no OpenVZ hosts remain).

If your host still carries the old marker or a _USE_SYSKLOGD line in /root/.barracuda.cnf, both are inert and safe to leave in place — nothing reads them any more. A host that lost its syslog daemon to the old arm gets rsyslog back on the next barracuda pass — every run now ensures the package is present, outside the FULL-mode-only package section; to close the gap immediately, apt-get install rsyslog by hand. If a legacy sysklogd install is still present from years past, installing rsyslog replaces it — the packages conflict, so apt swaps the legacy daemon out on its own.

The syslog_legacy process guard that watched those legacy daemons is retired with them. A conflict-swap removes the old package but leaves its orphaned /etc/init.d script behind (package state rc), so every barracuda pass now also purges rc-state sysklogd/inetutils-syslogd leftovers — nothing on the box references the old daemons any more. See process guards for the remaining service watchdogs.

Whether BOA touches the cron service

Setting _NO_CRON_AUTOSTART=YES in /root/.barracuda.cnf suppresses the three places where BOA starts or reloads cron. /root/.upstart.cnf is the legacy form of the same switch and stays honoured for one release. The three sites are:

• the tail of the BOA.sh.txt bootstrap, immediately before it reports that the system is ready for a BOA installation (service cron reload)
• _finale, the last stage of every barracuda pass (service cron start)
• the end of each per-account Octopus setup run (service cron start)

All three tests are negated — [ ! -e … ] for the marker file, and either [ "${_NO_CRON_AUTOSTART}" != "YES" ] or a negated anchored grep of the cnf for the variable — so setting either form is the "leave it alone" state, and clearing both is the default behaviour.

Two limits are worth stating plainly, because the marker's name and the folklore around it both overpromise:

• It never stops cron. The only service cron stop in a barracuda pass sits inside the interactive major OS upgrade prompt, and that call consults neither the variable nor the marker.
• It is only partially honoured. Several other paths start or reload cron without checking it: the abnormal-exit cleanup, both in the barracuda, octopus, boa and cluster wrappers and in the staged BARRACUDA and OCTOPUS installers; the Nginx configuration stage on a fresh install; the duplicate-cron detector in the system monitor; the master-cron enable and disable helpers in runner.sh, which reload cron on every toggle; the reload the BOA self-update runs after it appends the migration_proxy_certs line to the root crontab; and the migration tools. Read the switch as "BOA will not start cron at the end of a pass", not as a guarantee that cron stays down.

The marker's name is historical, from the Upstart era. It neither detects nor selects an init system, and BOA never creates or removes it — which is why the variable is named _NO_CRON_AUTOSTART, after what the switch actually does, rather than after the file.

The root login banner

By default /root/.bashrc calls fancynow and screenfetch for interactive root shells, and BOA keeps the toilet and figlet packages installed to draw them. fancynow also fetches a short weather line from a third-party service on each interactive login (with a two-second timeout), and prints nothing on hosts where BOA has not cached a city name.

Creating /root/.dont.use.fancy.bash.login.cnf does two separate things on the next pass:

1. The login lines. Any fancynow and screenfetch lines in /root/.bashrc are rewritten to /bin/true. They stay in the file in neutered form rather than being deleted, and the rewrite only runs when the file currently contains a fancynow line.
2. The packages. toilet, figlet and screenfetch are purged — but only when /usr/bin/screenfetch exists at the time of the pass.

That second condition is a real co-guard and it inverts the outcome when it is not met: with the marker set on a host that has no /usr/bin/screenfetch, the else arm runs instead and installs toilet and figlet. This marker is therefore not cosmetic-only — it moves the installed package set, in both directions.

Removing the marker re-arms the banner on the next pass, and that moves the package set back as well. The .bashrc arm purges the distro screenfetch package whenever /usr/bin/screenfetch is present, then symlinks BOA's own /opt/local/bin/screenfetch into /usr/bin/ in its place and appends a fresh interactive-shell block to /root/.bashrc; the package arm reinstalls toilet and figlet. The lines neutered earlier are left behind as harmless /bin/true calls; tidy them by hand if you care about a clean .bashrc.

Which OpenSSL series the box builds — marker-selected, mostly automatic

BOA maintains its own SSL toolchain — installed from its own prebuilt packages where available, compiled from source otherwise — and can hold two series side by side: the EOL 1.1.x line in /usr/local/ssl and the modern OpenSSL 3 line in /usr/local/ssl3. When the ssl3 binary exists, everything that resolves _SSL_BINARY prefers it, and the Nginx build check forces an Nginx rebuild until nginx -V shows it linked against the selected series — so this choice is visible in every TLS handshake the box serves.

The selector is a pair of BOA-managed marker files, not settings:

• /root/.install.modern.openssl.cnf (kept immutable with chattr +i) — present means "build and track the OpenSSL 3 series". BOA creates it itself: on a fresh install, on an upgrade pass once no legacy PHP interpreter (/opt/php56 … /opt/php73) remains on the box, and unconditionally once both series' binaries exist. It is honoured on buster/bullseye/bookworm and beowulf/chimaera/daedalus/excalibur; on stretch and older, every pass deletes it and stays on the EOL series.
• /root/.install.legacy.openssl.cnf — a breadcrumb meaning "the legacy /usr/local/ssl build is still needed"; BOA touches it while that binary is missing and removes it once it exists. While present it also blocks the modern auto-opt-in.

So a current box opts into modern OpenSSL on its own — no operator action needed. The markers matter in two exceptional cases:

• Force modern early: a box still carrying legacy PHP interpreters never auto-opts in. touch /root/.install.modern.openssl.cnf forces the 3.x build alongside the legacy one on the next pass.
• Hold on legacy: chattr -i /root/.install.modern.openssl.cnf && rm -f it, and touch /root/.install.legacy.openssl.cnf — the box stays on the EOL series.

The heavy rebuild itself — prebuilt package or source compile — only runs when _ALLOW_HEAVY_REBUILDS=YES or the ssl3 binary is missing, so flipping a marker takes effect on the next pass that is allowed to rebuild. Neither marker has a .barracuda.cnf variable form — this is install-state machinery, not a settings toggle.

cURL follows the same BOA-built pattern — with its own escape hatch. BOA installs its own cURL alongside the SSL toolchain (prebuilt package or source build, the same rule). If BOA's own curl ever ends up broken on a box, touch /root/.use.curl.from.packages.cnf and run the upgrade: the pass moves BOA's own libcurl aside (backed up under a dated /var/backups/legacy-libcurl-pre-* directory), retires /usr/local/bin/curl, and installs the distro-packaged curl instead. boa info reports the state as CRL_From_Packages YES/NO. The marker is effectively one-shot — the daily autoupboa pass deletes it — so touch it right before the upgrade run you want it to affect.

Related

• Manual BOA upgrade reference — the barracuda up-* pass that applies both markers.
• Process guards — the _proc_control service watchdogs (the legacy-syslog guard is retired).
• Control files overview — how presence markers sit beside the INI-style variables.
• barracuda.cnf reference — the variables set in /root/.barracuda.cnf.