@stefano thank you for this post I was waiting for that, because I was not sure how mfsBSD works in details and what is iths extra value

@napierge mfsBSD is great - it helped and saved me thousands of times. I'm glad this post can be useful for you!

@stefano That's so on time! Just got forced to do that. Though, I think I managed to improve slightly upon the method by eliminating the small window where anyone who happens to know the (well-known) root password may ssh into the box. Instead of dd(1)ing the installation image onto the disk, I ran it in qemu:

qemu-system-x86_64 \
\
-cdrom mfsbsd-14.2-RELEASE-amd64.iso \
-drive format=raw,file=/dev/nvme0n1,if=virtio \
-drive format=raw,file=/dev/nvme1n1,if=virtio \
\
-display curses \
-m 8G

And after the installation entered shell, and changed rc.conf like so:

ifconfig_DEFAULT="DHCP"
#ifconfig_em0="DHCP"
#ifconfig_em0_ipv6="inet6 accept_rtadv"

@aa yes, this is a good approach, too. Another one is to build a custom mfsbsd image with your own root password and ssh keys - that's what I'm usually doing