summaryrefslogtreecommitdiffstats
path: root/etc
Commit message (Collapse)AuthorAgeFilesLines
* Add defaults for /etc/rc.d/gssdkeramida2008-11-051-0/+3
| | | | Approved by: dfr
* Correct a typo that prevented my laptop from startingdelphij2008-11-041-1/+1
| | | | devd.
* Add support for Asus A8Sr notebooks.rpaulo2008-11-041-0/+22
| | | | | | | PR: 128553 Submitted by: Eygene Ryabinkin <rea-fbsd at codelabs.ru> Reviewed by: philip MFC after: 2 months
* Implement support for RPCSEC_GSS authentication to both the NFS clientdfr2008-11-034-3/+21
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | and server. This replaces the RPC implementation of the NFS client and server with the newer RPC implementation originally developed (actually ported from the userland sunrpc code) to support the NFS Lock Manager. I have tested this code extensively and I believe it is stable and that performance is at least equal to the legacy RPC implementation. The NFS code currently contains support for both the new RPC implementation and the older legacy implementation inherited from the original NFS codebase. The default is to use the new implementation - add the NFS_LEGACYRPC option to fall back to the old code. When I merge this support back to RELENG_7, I will probably change this so that users have to 'opt in' to get the new code. To use RPCSEC_GSS on either client or server, you must build a kernel which includes the KGSSAPI option and the crypto device. On the userland side, you must build at least a new libc, mountd, mount_nfs and gssd. You must install new versions of /etc/rc.d/gssd and /etc/rc.d/nfsd and add 'gssd_enable=YES' to /etc/rc.conf. As long as gssd is running, you should be able to mount an NFS filesystem from a server that requires RPCSEC_GSS authentication. The mount itself can happen without any kerberos credentials but all access to the filesystem will be denied unless the accessing user has a valid ticket file in the standard place (/tmp/krb5cc_<uid>). There is currently no support for situations where the ticket file is in a different place, such as when the user logged in via SSH and has delegated credentials from that login. This restriction is also present in Solaris and Linux. In theory, we could improve this in future, possibly using Brooks Davis' implementation of variant symlinks. Supporting RPCSEC_GSS on a server is nearly as simple. You must create service creds for the server in the form 'nfs/<fqdn>@<REALM>' and install them in /etc/krb5.keytab. The standard heimdal utility ktutil makes this fairly easy. After the service creds have been created, you can add a '-sec=krb5' option to /etc/exports and restart both mountd and nfsd. The only other difference an administrator should notice is that nfsd doesn't fork to create service threads any more. In normal operation, there will be two nfsd processes, one in userland waiting for TCP connections and one in the kernel handling requests. The latter process will create as many kthreads as required - these should be visible via 'top -H'. The code has some support for varying the number of service threads according to load but initially at least, nfsd uses a fixed number of threads according to the value supplied to its '-n' option. Sponsored by: Isilon Systems MFC after: 1 month
* ifconfig(8) can take only one interface at a time.pjd2008-10-301-1/+3
|
* Explicitly set the shell to /bin/sh when MK_TCSH == no.mp2008-10-291-1/+1
| | | | Not objected to by: sam
* Add ucomX shortcuts just like its uart sibling.thompsa2008-10-271-0/+8
|
* Make a note about the notify codes for the four special function keys above thethompsa2008-10-271-0/+1
| | | | keyboard on the EeePC.
* o fix MK_TCSH == no: the default master.passwd sets up root to use /bin/cshsam2008-10-271-9/+20
| | | | | | | but there won't be one so root won't be able to login; edit the installed file to use /bin/sh in this case. o while here split csh-related files apart from sh and only install them when requested
* Show which rc script is running since the default ^T just shows 'sh' as thethompsa2008-10-271-0/+1
| | | | process.
* Sort `mount -p' output by name before checking for any differences.ed2008-10-251-1/+1
| | | | | | | | | | | | I noticed on a system at home that restarting named(8) causes the /var/named/dev mount to be moved to the bottom of the mount list, because it gets remounted. When I received the daily security email this morning, I was quite amazed to see that the security report listed the differences, while it was nothing out of the ordinary. If we just throw the `mount -p' output through sort(1), we'll only receive notifications about changes to mounts if something has really changed.
* Add entries for uart based serial ports. All the serial ports on mipsimp2008-10-121-4/+4
| | | | so far are uart subclasses. Also, turn uart0 on by default.
* Create separate cat directories for en.UTF-8. This, together with r183697,des2008-10-082-0/+41
| | | | | | allows users in en.UTF-8 locales to see non-ascii characters in man pages. MFC after: 1 week
* Remove compat support for vaps_<ifn> and vap_create_<ifn> variables asbrooks2008-10-011-7/+1
| | | | | | promised in r178527. These variables were never in a release version. Reminded by: sam
* Allow a jail's IP alias to be created with an arbitrary netmask.ru2008-09-241-1/+3
| | | | MFC after: 3 days
* add back regdomain.xmlsam2008-09-221-0/+4
| | | | Noticed by: jhay
* add new build knobs and jigger some existing controls to improvesam2008-09-215-36/+134
| | | | | | | | control over the result of buildworld and installworld; this especially helps packaging systems such as nanobsd Reviewed by: various (posted to arch) MFC after: 1 month
* Allow a jail to be started with a specific route fib.thompsa2008-09-162-1/+9
| | | | | Reviewed by: secteam (simon) Reviewed by: brooks, bz
* Add support to rc.initdiskless for /conf/T/M/remount_subdir.bms2008-09-091-4/+37
| | | | | | | | This allows the location of the configuration data to be relocated within the filesystem containing it. A nullfs mount is used in order to achieve this. Obtained from: XORP, Inc.
* A no-op commit to simulate the effect of a forced commit so the filegshapiro2008-08-311-1/+0
| | | | | has a new timestamp as needed for mergemaster. A more long term solution to this is needed since svn doesn't support forced commits.
* Add the ability to run /usr/sbin/crashinfo on a new core dump automaticallyjhb2008-08-292-0/+5
| | | | | | | during boot. Right now this is disabled by default, but it can be enabled by setting 'crashinfo_enable=YES' in rc.conf. MFC after: 2 weeks
* Google changed the location of the blacklists again.gshapiro2008-08-281-1/+1
| | | | Submitted by: Tim Pozar
* Make obrien happy #2des2008-08-251-1/+0
|
* Make obrien happydes2008-08-252-29/+1
|
* Restore 256 pty(4) entries.ed2008-08-247-0/+1792
| | | | | | | | | | | | As discussed with Robert Watson on the src-committers list, it is safer to keep at least some pty(4) entries in /etc/ttys, for applications that roll their own PTY allocation routine and only search for BSD-style PTY's. This means we've now just toggled the amount of entries for pts(4) and pty(4). Requested by: rwatson
* Remove old BSD-style entries from /etc/ttys and increase pts(4) to 512.ed2008-08-237-3584/+1792
| | | | | | | | | Because we now use pts(4)-style PTY's exclusively, there is no use for these entries in /etc/ttys. Right now the pts(4) entries only go from 0 to 255. Because we're going to touch these files anyway, increase the number to 511. Discussed with: philip (ex-mentor)
* Cope with the file rename by changing rc variables.rpaulo2008-08-211-4/+4
|
* Integrate the new MPSAFE TTY layer to the FreeBSD operating system.ed2008-08-202-1/+3
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | The last half year I've been working on a replacement TTY layer for the FreeBSD kernel. The new TTY layer was designed to improve the following: - Improved driver model: The old TTY layer has a driver model that is not abstract enough to make it friendly to use. A good example is the output path, where the device drivers directly access the output buffers. This means that an in-kernel PPP implementation must always convert network buffers into TTY buffers. If a PPP implementation would be built on top of the new TTY layer (still needs a hooks layer, though), it would allow the PPP implementation to directly hand the data to the TTY driver. - Improved hotplugging: With the old TTY layer, it isn't entirely safe to destroy TTY's from the system. This implementation has a two-step destructing design, where the driver first abandons the TTY. After all threads have left the TTY, the TTY layer calls a routine in the driver, which can be used to free resources (unit numbers, etc). The pts(4) driver also implements this feature, which means posix_openpt() will now return PTY's that are created on the fly. - Improved performance: One of the major improvements is the per-TTY mutex, which is expected to improve scalability when compared to the old Giant locking. Another change is the unbuffered copying to userspace, which is both used on TTY device nodes and PTY masters. Upgrading should be quite straightforward. Unlike previous versions, existing kernel configuration files do not need to be changed, except when they reference device drivers that are listed in UPDATING. Obtained from: //depot/projects/mpsafetty/... Approved by: philip (ex-mentor) Discussed: on the lists, at BSDCan, at the DevSummit Sponsored by: Snow B.V., the Netherlands dcons(4) fixed by: kan
* Rename the RCng 'kernel' script to 'kernel_symlink'.obrien2008-08-201-1/+1
|
* Rename the RCng 'kernel' script to 'kernel_symlink'.obrien2008-08-192-2/+1
| | | | Requested by: many
* Allow the network addresses and interface names for the "client" andjhb2008-08-152-6/+24
| | | | | | | | | | | | "workstation" firewall types to be set from rc.conf so that rc.firewall no longer needs local patching to be usable for those types. For now I've set the variables in /etc/defaults/rc.conf to the previous defaults in /etc/rc.firewall. PR: bin/65258 Submitted by: Valentin Nechayev netch of netch.kiev.ua Silence from: net MFC after: 2 weeks
* For the "client" and "simple" network types, collapse the separate "net"jhb2008-08-151-14/+11
| | | | | | | | and "mask" variables into a single "net" variable that contains a full network address (including either a netmask or prefix length at the user's choice). Update the example settings to match. MFC after: 2 weeks
* Use 'me' rather than explicit IP addresses for the "simple" and "client"jhb2008-08-151-12/+9
| | | | | | | | firewall configurations. PR: bin/65258 Silence on: net@ MFC after: 1 week
* For the firewall_* variables that are specific to the "workstation"jhb2008-08-151-7/+9
| | | | | | firewall type, note that property in their description. MFC after: 1 week
* Improve periodic/security/550.ipfwlimit a bit:antoine2008-08-101-6/+3
| | | | | | | | | - don't run it if net.inet.ip.fw.verbose = 0 as it is pointless - handle rules without logging limit correctly [1] (those rules show up without logamount in "ipfw -a list") PR: conf/126060 [1] MFC after: 1 month
* Only symlink booted kernel directory to /boot/kernel if user has explicitlyobrien2008-08-092-0/+2
| | | | requested it. This is too dangerous to just do behind the admin's back.
* Add /usr/share/man/whatis, /var/db/locate.database, and /var/log to thecperciva2008-08-081-0/+3
| | | | list of paths which `freebsd-update IDS` should ignore by default.
* - back out my last commit as it seems to be wrong.danger2008-08-031-2/+0
| | | | Spotted by: das
* Make `freebsd-update IDS` not complain about /usr/share/man/cat* bycperciva2008-08-021-0/+4
| | | | default.
* When using SRV records the protocols and services files need to be in thedougb2008-08-011-5/+9
| | | | | | | chroot /etc directory. PR: conf/121101 Submitted by: Stefan `Sec` Zehl <sec@42.org>
* Add the -c option for named_flags (still commented out) that isdougb2008-08-011-2/+2
| | | | | | relevant for ports users, and change the comment to match. While I'm here fix the capitalization of the named_program comment.
* Oops, restore the recent changes to make startup messages quieter.jhb2008-07-311-1/+3
|
* Parse sysctl settings from /etc/sysctl.conf.local after /etc/sysctl.confjhb2008-07-311-10/+15
| | | | | | | | if it exists. This mirrors similar behavior for /boot/loader.conf and /etc/rc.conf. Obtained from: Yahoo! MFC after: 1 week
* Remove an empty directory that is already in ObsoleteFiles.inc fromantoine2008-07-281-2/+0
| | | | mtree/BSD.usr.dist
* Change the module example to kldload since this is the resume side.thompsa2008-07-211-1/+1
|
* Remove sioX as an alias for uartX. It is believed to bemarcel2008-07-211-8/+8
| | | | | | more confusing than helpful. Suggested by: jhb
* With uart(4) default, change sio# to uart# so thatmarcel2008-07-191-1/+1
| | | | out-of-the-box FreeBSD is consistent.
* With uart(4) default, change /dev/cuad# to /dev/cuau# andmarcel2008-07-191-6/+6
| | | | sio# to uart# so that out-of-the-box FreeBSD is consistent.
* With uart(4) default, change /dev/cuad# to /dev/cuau# andmarcel2008-07-191-7/+7
| | | | sio# to uart# so that out-of-the-box FreeBSD is consistent.
* With uart(4) default, change /dev/cuad# to /dev/cuau# so thatmarcel2008-07-191-2/+2
| | | | out-of-the-box FreeBSD is consistent.
OpenPOWER on IntegriCloud