summaryrefslogtreecommitdiffstats
path: root/etc
Commit message (Collapse)AuthorAgeFilesLines
* Merge head@256284sjg2013-10-1325-874/+774
|\
| * Turn it all the way up to 11:gjb2013-10-101-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | - Update FreeBSD version in: - UPDATING - sys/conf/newvers.sh - Add 11.0 FreeBSD version for manual pages - Bump __FreeBSD_version to 1100000 Approved by: re (implicit) Sponsored by: The FreeBSD Foundation
| * - Update rc.d/jail to use a jail(8) configuration file instead ofhrs2013-10-103-626/+300
| | | | | | | | | | | | | | | | | | | | | | | | command line options. The "jail_<jname>_*" rc.conf(5) variables for per-jail configuration are automatically converted to /var/run/jail.<jname>.conf before the jail(8) utility is invoked. This is transparently backward compatible. - Fix a minor bug in jail(8) which prevented it from returning false when jail -r failed. Approved by: re (glebius)
| * Add support for "vnet jname" argument in ifconfig_IF. The vnet keywordhrs2013-10-102-14/+100
| | | | | | | | | | | | | | | | | | | | | | is ignored except for "rc.d/netif vnet{up,down} ifn" because a jail is usually created after interface initialization on boot time. "rc.d/netif vnetup ifn" moves ifn into the specified jail. It is designed to be used in other scripts like rc.d/jail, not automatically invoked during the interface initialization. Approved by: re (kib)
| * Reduce priority of host key exists message in sshd startupdelphij2013-10-071-1/+1
| | | | | | | | | | | | script to info. Approved by: re (gjb)
| * Add _atf and unbound and move smmsp and mailnull to where they belong.des2013-10-071-2/+4
| | | | | | | | Approved by: re (kib)
| * Do not attempt to do AF-specific configurations on a interface whenhrs2013-10-041-7/+12
| | | | | | | | | | | | | | | | | | | | noafif() is true. The following warning message was displayed when pflog0 interface existed, for example: ifconfig: ioctl(SIOCGIFINFO_IN6): Protocol family not supported Reported by: bz Approved by: re (gjb)
| * Add epair(4) support in $cloned_interfaces. One should be specifiedhrs2013-10-042-47/+118
| | | | | | | | | | | | | | | | | | | | | | | | | | | | as "epair0" in $cloned_interfaces and "epair0[ab]" in the others in rc.conf like the following: cloned_interfaces="epair0" ifconfig_epair0a="inet 192.168.1.1/24" ifconfig_epair0b="inet 192.168.2.1/24" /etc/rc.d/netif now accepts both "netif start epair0" and "netif start epair0a". Approved by: re (kib)
| * Do not install bluetooth rc(8) scripts if MK_BLUETOOTH = no.gjb2013-10-031-3/+6
| | | | | | | | | | | | Approved by: re (glebius) MFC after: 3 days Sponsored by: The FreeBSD Foundation
| * Fix up typos from r255963 in mtree Makefile. BSD.debug.dist should bemdf2013-10-031-2/+2
| | | | | | | | | | | | iterated if present, and remove a stray .endif. Approved by: re (gjb)
| * Odds and ends left over from BIND and unnoticed because they didn'tdes2013-10-012-13/+1
| | | | | | | | | | | | affect 'make universe'. Approved by: re (gjb)
| * Remove /usr/include/lwresdes2013-09-301-2/+0
| | | | | | | | Approved by: re (gjb)
| * Remove BIND.des2013-09-304-81/+0
| | | | | | | | Approved by: re (gjb)
| * Now that the portsnap buildbox is generating the raw bits for INDEX-10,cperciva2013-09-261-0/+1
| | | | | | | | | | | | | | add it to the set of INDEX files built by portsnap. Approved by: re (marius), portmgr (erwin) MFC after: 3 days
| * Forgotten in r255825: NETWORKING requires local_unbound.des2013-09-241-1/+1
| | | | | | | | Approved by: re (blanket)
| * Replace the unused /etc/unbound directory with a symlink to /var/unbound.des2013-09-242-2/+5
| | | | | | | | Approved by: re (blanket)
| * Move local_unbound up in the rc order.des2013-09-231-1/+1
| | | | | | | | Approved by: re (blanket)
| * Add a setup script for unbound(8) called local-unbound-setup. Itdes2013-09-234-1/+105
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | generates a configuration suitable for running unbound as a caching forwarding resolver, and configures resolvconf(8) to update unbound's list of forwarders in addition to /etc/resolv.conf. The initial list is taken from the existing resolv.conf, which is rewritten to point to localhost. Alternatively, a list of forwarders can be provided on the command line. To assist this script, add an rc.subr command called "enabled" which does nothing except return 0 if the service is enabled and 1 if it is not, without going through the usual checks. We should consider doing the same for "status", which is currently pointless. Add an rc script for unbound, called local_unbound. If there is no configuration file, the rc script runs local-unbound-setup to generate one. Note that these scripts place the unbound configuration files in /var/unbound rather than /etc/unbound. This is necessary so that unbound can reload its configuration while chrooted. We should probably provide symlinks in /etc. Approved by: re (blanket)
| * Fix indentation.des2013-09-221-1/+1
| | | | | | | | Approved by: re (blanket)
| * Ditch the random seeding code, which never really worked as intended.des2013-09-211-66/+39
| | | | | | | | | | | | | | | | Add config variables to enable / disable individual host key algorithms. Clean up the host key generation code. Approved by: re (gjb) MFC after: 3 weeks
| * - Fix pidfile handling in sendmail_msp_queue. The pidfile was ignoredhrs2013-09-171-5/+2
| | | | | | | | | | | | | | | | | | and multiple instances were invoked by start/stop cycles. - Remove redundant start_cmd rewrite. Approved by: re (gjb) Tested by: jmg
| * Fix parsing lines of ifconfig output which include \t in the case ofhrs2013-09-171-7/+8
| | | | | | | | | | | | inet and inet6. Approved by: re (delphij)
| * Build and install the Unbound caching DNS resolver daemon.des2013-09-154-0/+6
| | | | | | | | Approved by: re (blanket)
| * Bring in the new iSCSI target and initiator.trasz2013-09-145-0/+69
| | | | | | | | | | | | Reviewed by: ken (parts) Approved by: re (delphij) Sponsored by: FreeBSD Foundation
* | Merge headsjg2013-09-116-6/+14
|\ \ | |/
| * ipfilter 5.1.2 no longer supports sysctl. Use ipf -V to determine ifcy2013-09-103-6/+4
| | | | | | | | | | | | | | available (the kernel module is loaded or compiled into the kernel). Approved by: glebius (mentor) Approved by: re (blanket)
| * The correct variable is apparently MACHINE_ARCH, not TARGET_ARCH.des2013-09-091-1/+1
| | | | | | | | Approved by: re (blanket)
| * Remove unneeded mappings from libmap32.conf. Move it up one level anddes2013-09-092-4/+2
| | | | | | | | | | | | | | install it on powerpc64 in addition to amd64. Reviewed by: kib Approved by: re (blanket)
| * Add a stock libmap32.conf for amd64. The first two lines have no effectdes2013-09-082-0/+8
| | | | | | | | | | | | | | | | | | | | | | except to document the hardcoded standard library search path for 32-bit binaries. The third line performs the equivalent substitution for the private library directory. Ironically, these entries rely on functionality which is only available in the COMPAT_32BIT version of rtld-elf. Approved by: re (blanket)
| * Create a private library directory (LIBPRIVATEDIR) for libraries whichdes2013-09-081-0/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | we don't want to expose but which can't or shouldn't be static. To mark a library as private, define PRIVATELIB in its Makefile. It will be installed in LIBPRIVATEDIR, which is normally /usr/lib/private (or /usr/lib32/private for 32-bit libraries on 64-bit platforms). To indicate that a program or library depends on a private library, define USEPRIVATELIB in its Makefile. The correct version of LIBPRIVATEDIR will be added to its run-time library search path. Approved by: re (blanket)
* | Merge from headsjg2013-09-0563-737/+2004
|\ \ | |/
| * authpf needs /var/authpf to exist and be writable by group authpf.des2013-09-051-0/+2
| |
| * Add a c++/v1/tr1 include directory containing symlinks to all of the standardtheraven2013-09-041-0/+2
| | | | | | | | | | | | | | | | | | headrs. Lots of third-party code expects to find C++03 headers under tr1 because that's where GNU decided to hide them. This should fix ports that expect them there. MFC after: 1 week
| * Since r254974, periodic scripts' period can be configuredjlh2013-09-031-66/+70
| | | | | | | | | | | | independently. There is no reason to leave their options with the daily ones, so move them to their own section. Move periodic scripts' options into their own section. Since r254974,
| * Create the default router last. This allows using an staticdelphij2013-09-021-2/+2
| | | | | | | | | | | | | | | | interface route for default routes, which seems to be common among many dedicated hosting providers. Reviewed by: hrs MFC after: 2 weeks
| * Regenerate after recent addition of FTDI and bluetooth device IDs.ian2013-09-011-4/+96
| |
| * Add directories that is installed as part of bsdconfig.delphij2013-08-291-0/+74
| | | | | | | | | | | | | | | | | | | | These are included unconditionally for now because bsdconfig is currently installed unconditionally. This fixes 'make -j 17 installworld' caused by a race condition. MFC candidate.
| * Add a few missing language directories for /usr.delphij2013-08-291-0/+8
| |
| * After writing a kernel core dump into /var/crash, call sync(8).gavin2013-08-281-0/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | If we panic again shortly after boot (say, within 30 seconds), any core dump we wrote out may be lost on reboot. In this situation, we really want to keep that core file, as it may be the only way to have the issue resolved. Call sync(8) after writing out the core file and running crashinfo(8), in the hope that these will not be lost if we panic again. sync(8) is only called in the case where there is a core dump to be written out, so won't be called during normal boots. Discovered by: Trying to debug an IPSEC panic MFC after: 1 week
| * Fix a typo introduced in r254975.jkim2013-08-271-1/+1
| |
| * Install 450.status-security.jlh2013-08-271-1/+2
| |
| * Make the period of each periodic security script configurable.jlh2013-08-2720-107/+322
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | There are now six additional variables weekly_status_security_enable weekly_status_security_inline weekly_status_security_output monthly_status_security_enable monthly_status_security_inline monthly_status_security_output alongside their existing daily counterparts. They all have the same default values. All other "daily_status_security_${scriptname}_${whatever}" variables have been renamed to "security_status_${name}_${whatever}". A compatibility shim has been introduced for the old variable names, which we will be able to remove in 11.0-RELEASE. "security_status_${name}_enable" is still a boolean but a new "security_status_${name}_period" allows to define the period of each script. The value is one of "daily" (the default for backward compatibility), "weekly", "monthly" and "NO". Note that when the security periodic scripts are run directly from crontab(5) (as opposed to being called by daily or weekly periodic scripts), they will run unless the test is explicitely disabled with a "NO", either for in the "_enable" or the "_period" variable. When the security output is not inlined, the mail subject has been changed from "$host $arg run output" to "$host $arg $period run output". For instance: myfbsd security run output -> myfbsd security daily run output I don't think this is considered as a stable API, but feel free to correct me if I'm wrong. Finally, I will rearrange periodic.conf(5) and default/periodic.conf to put the security options in their own section. I left them in place for this commit to make reviewing easier. Reviewed by: hackers@
| * Move daily_status_security_noamd next to 200.chkmounts's variables.jlh2013-08-251-1/+1
| |
| * Correctly remove an interface's ipv4 address when the user callsasomers2013-08-231-3/+3
| | | | | | | | | | | | | | | | | | | | "/etc/rc.d/netif stop XXX". The old globbing pattern failed to account for the possibility of a tab occuring before "inet". Reviewed by: will Approved by: ken (mentor, implicit) MFC after: Never (bug affects head only) Sponsored by: Spectra Logic
| * Pass pidfile to bsnmpd if it's been changed (parts cut/pasted frompeter2013-08-191-1/+2
| | | | | | | | rc.d/rarpd and rc.d/wpa_supplicant)
| * Revert r254508.peter2013-08-191-11/+1
| |
| * Add the optional ability to run as a different user.peter2013-08-191-1/+11
| | | | | | | | Obtained from: Antique freebsd.org cluster archive images
| * Add empty zones for Shared Address Space (RFC 6598)erwin2013-08-091-0/+66
| | | | | | | | | | | | Approved by: delphij (mentor) MFC after: 3 days Sponsored by: DK Hostmaster A/S
| * Regen for if_rsu.rpaulo2013-08-041-7/+239
| |
| * - Reimplement $gif_interfaces as a variant of $cloned_interfaces.hrs2013-08-042-41/+114
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Newly-configured systems should use $cloned_interfaces. - Call clone_{up,down}() and ifnet_rename() in rc.d/netif {start,stop}. ifnet_rename() now accepts an interface name list as its argument. - Add rc.d/netif clear. The "clear" subcommand is basically equivalent to "stop" but it does not call clone_down(). - Add "ifname:sticky" keyword into $cloned_interfaces. If :sticky is specified, the interface will not be destroyed in rc.d/netif stop. - Add cloned_interfaces_sticky={YES,NO}. This variable globally sets :sticky keyword above for all interfaces. The default value is NO. When cloned_interfaces_sticky=YES, :nosticky keyword can be used to override it on per interface basis.
OpenPOWER on IntegriCloud