Compile Kernel With KDB_UNATTENDED

Please add options KDB_UNATTENDED to the kernel for OPNsense so production systems do not hang indefinitely on panic until someone can phsycially access the console.

In a default OPNsense build options DDB and options KDB are set, but options KDB_UNATTENDED is not:

user@opnsense:~ $ sysctl kern.conftxt | grep DB
options	DDB
options	NETGDB
options	KDB_TRACE
options	KDB
options	DDB_CTF

This means the kernel will drop to debugger in the event of a kernel panic and sit there until someone can access the console to reboot the machine.

This is not desirable in a production system, especially for remote branch office firewalls where it can be difficult and expensive to get an engineer on site to get the machine back online.

The Handbook says:

[...] any panic condition will branch to DDB if the kernel is configured to use it. For this reason, it is not wise to configure a kernel with DDB for a machine running unattended.

To obtain the unattended functionality, add:

options KDB_UNATTENDED

to the kernel configuration file and rebuild/reinstall.

This advice is repeated in the Glossary:

options KDB_UNATTENDED: change the default value of the debug.debugger_on_panic sysctl to 0, which controls whether the debugger is entered on panic. When options KDB is not compiled into the kernel, the behavior is to automatically reboot on panic; when it is compiled into the kernel, the default behavior is to drop into the debugger unless options KDB_UNATTENDED is compiled in. If you want to leave the kernel debugger compiled into the kernel but want the system to come back up unless you’re on-hand to use the debugger for diagnostics, use this option.

Thank you.

Locate the OPNsense kernel configuration that currently defines options DDB and KDB, then read the referenced FreeBSD kernel-debugging guidance. Add KDB_UNATTENDED to that configuration and rebuild or reinstall the kernel; done means the generated configuration includes the option and unattended panic behavior is enabled.