Commit Graph

223 Commits

Author SHA1 Message Date
Kurt Lidl
1c34f9114e Skip unavailable pools when running zfs pool scrubs
Approved by:	rpaulo (mentor)
Differential Revision:	https://reviews.freebsd.org/D4588
2015-12-16 04:32:33 +00:00
Dag-Erling Smørgrav
9ae8f20c14 Allow admins to specify a regex which is applied (in the negative) to the
output from df, similar to what security/200.chkmounts does.  This can be
useful to avoid listing automounted ZFS snapshots, for instance.

MFC after:	1 week
2015-11-13 06:20:27 +00:00
Kurt Lidl
962942b5d6 Restrict 520.pfdenied to only list rules that blocked traffic.
Before this change, the 520.pfdenied script listed all rules that
matched /^block/ in the rule. Restrict the printed output to only
those rules that result in packets being dropped.

PR:		conf/187224
Approved by:	rpaulo (mentor)
Differential Revision:	https://reviews.freebsd.org/D4068
2015-11-05 17:37:14 +00:00
Enji Cooper
2a923f8f3c Rename etc/periodic/daily/430.status-rwho to periodic/daily/430.status-uptime
The command was checking local/remote system uptime, so rename the script to
match its function and to avoid confusion

The controlling variable in /etc/periodic.conf has been renamed from
daily_status_rwho_enable to daily_status_uptime_enable.

MFC after: 3 days
Reported by: Peter Jeremy <peter@rulingia.com>
Relnotes: yes
Sponsored by: EMC / Isilon Storage Division
2015-11-02 01:05:34 +00:00
Bryan Drewery
aa92269e46 Add more SUBDIR_PARALLEL.
MFC after:	3 weeks
Sponsored by:	EMC / Isilon Storage Division
2015-10-15 22:55:08 +00:00
Dag-Erling Smørgrav
2663942208 Add -n to the ntpq command line so it will show IP addresses instead of
host names, which rarely fit in the available space.

MFC after:	1 week
2015-10-08 08:55:08 +00:00
John Baldwin
d2077b4e57 Allow additional flags to be passed to netstat -i in the daily status check.
In particular, this allows an administrator to specify "-h" for human
readable output if that is preferred.

The default setting passes "-d", so that can be excluded by using a custom
setting.

Differential Revision:	https://reviews.freebsd.org/D2034
Submitted by:	Lystopad Aleksandr <laa@laa.zp.ua>
		(patch to add option for -h)
Reviewed by:	bz
MFC after:	1 week
2015-03-27 00:37:41 +00:00
Glen Barber
f7e6516a1f Evaluate running userland/kernel version in daily
periodic(8) run, taken from uname(1) '-U' and '-K'
flags.

Reviewed by:		allanjude, dvl
Differential Revision:	https://reviews.freebsd.org/D1541
MFC after:		1 week
Sponsored by:		The FreeBSD Foundation
2015-01-15 19:52:19 +00:00
Baptiste Daroussin
81e6fb172f Avoid installing security.functions with executable bits, periodic(8) will
try to execute all files with an executable bit in /etc/periodic/*/ while
this file is supposed only to be sourced by others

MFC after:	1 week
2014-11-05 06:42:07 +00:00
Bryan Drewery
07509279d3 Don't cross mount boundaries when cleaning tmp files.
Mounting something in /tmp such as a build jail with nullfs mounts for
some directories can result in very surprising results the next day.

MFC after:	2 weeks
Relnotes:	yes
2014-09-09 17:03:58 +00:00
Warner Losh
c6063d0da8 Use src.opts.mk in preference to bsd.own.mk except where we need stuff
from the latter.
2014-05-06 04:22:01 +00:00
Christian Brueffer
84beb433c0 Further refine the auth fail regex to catch more auth failures and
reduce false positives.

The committed patch was provided by Christian Marg.

PR:		91732
Submitted by:	Daniel O'Connor <doconnor at gsoft.com.au>
		Skye Poier <spoier at gmail.com>
		Alan Amesbury <amesbury at umn.edu>
		Christian Marg <marg at rz.tu-clausthal.de>
MFC after:	1 month
2014-02-20 23:43:49 +00:00
Gleb Smirnoff
3e0f3c1e42 Remove remnants of BIND from /etc, since there is no BIND in base now.
Sorry, that would break users running head and BIND from ports, since
ports rely on these scripts. The ports will be fixed soon.

Reviewed by:	erwin
2013-11-05 09:30:06 +00:00
Baptiste Daroussin
c92d635ad3 After around 20 years of duty it is time for pkg_install to retire 2013-10-31 13:00:35 +00:00
Dag-Erling Smørgrav
e9f6fa6e61 Odds and ends left over from BIND and unnoticed because they didn't
affect 'make universe'.

Approved by:	re (gjb)
2013-10-01 07:19:23 +00:00
Jung-uk Kim
b81c4e6563 Fix a typo introduced in r254975. 2013-08-27 22:37:29 +00:00
Jeremie Le Hen
622ceeb3fb Install 450.status-security. 2013-08-27 21:28:12 +00:00
Jeremie Le Hen
69b55c23cb Make the period of each periodic security script configurable.
There are now six additional variables
  weekly_status_security_enable
  weekly_status_security_inline
  weekly_status_security_output
  monthly_status_security_enable
  monthly_status_security_inline
  monthly_status_security_output
alongside their existing daily counterparts.  They all have the same
default values.

All other "daily_status_security_${scriptname}_${whatever}"
variables have been renamed to "security_status_${name}_${whatever}".
A compatibility shim has been introduced for the old variable names,
which we will be able to remove in 11.0-RELEASE.

"security_status_${name}_enable" is still a boolean but a new
"security_status_${name}_period" allows to define the period of
each script.  The value is one of "daily" (the default for backward
compatibility), "weekly", "monthly" and "NO".

Note that when the security periodic scripts are run directly from
crontab(5) (as opposed to being called by daily or weekly periodic
scripts), they will run unless the test is explicitely disabled with a
"NO", either for in the "_enable" or the "_period" variable.

When the security output is not inlined, the mail subject has been
changed from "$host $arg run output" to "$host $arg $period run output".
For instance:
  myfbsd security run output ->  myfbsd security daily run output
I don't think this is considered as a stable API, but feel free to
correct me if I'm wrong.

Finally, I will rearrange periodic.conf(5) and default/periodic.conf
to put the security options in their own section.  I left them in
place for this commit to make reviewing easier.

Reviewed by:	hackers@
2013-08-27 21:20:28 +00:00
John Baldwin
d58802817b If daily_status_security_inline is set, the rc value needs to be
forced to 3 so that the output of this script is always displayed.
In fact, setting this flag is identical to setting
daily_status_security_output to an empty string.  To make the logic
less confusing, change the behavior of daily_status_security_inline
such that it just forces daily_status_security_output to an empty
string and then applies the normal logic.

PR:		conf/178611
Submitted by:	Jason Unovitch <jason.unovitch@gmail.com>
MFC after:	3 days
2013-06-25 15:45:31 +00:00
Eitan Adler
2b3b363780 Unconditionally install 210.backup-aliases as many MTAs other than
sendmail support the use of /etc/aliases.

PR:		conf/176098
Submitted by:	ak
MFC after:	2 weeks
2013-05-11 23:55:43 +00:00
Alexander Motin
401f21aece Remove periodic script for ataraid(4) and add instead script for graid(8). 2013-04-04 15:03:12 +00:00
Baptiste Daroussin
203d428e21 make installation of the 220.backup-pkgdb periodic script depend on PKGTOOLS
knob
2012-12-20 11:39:20 +00:00
Hajimu UMEMOTO
72d27857dc Make a command for pkg_info changeable like pkg_version in
/etc/periodic/weekly/400.status-pkg to be friendly with pkgng.

MFC after:	1 week
2012-10-13 14:45:42 +00:00
John Baldwin
f0e130f7b7 Only output a list of file systems that need to be dumped if the system
has a non-empty dumpdates file.

Reviewed by:	brooks
MFC after:	1 week
2012-06-20 20:01:51 +00:00
John Baldwin
25d56d8dcc Display dropped transmit packets in the daily network interface output.
PR:		conf/165956
Submitted by:	Jeremy Chadwick
MFC after:	1 week
2012-05-07 15:41:31 +00:00
Glen Barber
2f1602a7d1 Add an option to 404.status-zfs (enabled by default) to list all
zfs pools on the system.

While here, document daily_status_zfs_enable in periodic.conf(5).

Discussed on:	-fs [1]
Reviewed by:	netchild [1]
Approved by:	jhb
MFC after:	1 week

[1] - http://lists.freebsd.org/pipermail/freebsd-fs/2011-June/011869.html
2012-02-08 00:08:21 +00:00
Doug Barton
398955cd68 The default setting, daily_accounting_compress="NO", was causing
only 1 old file to be saved, so fix this. Problem raised in the PR,
but actually required a different solution.

While I'm here, fix a very old off-by-one error causing 1 more file
than specified in daily_accounting_save to be saved because acct.0
was not taken into account (pun intended). Change that, and use a more
thorough method of finding old files to delete. Partly just because this
is the right thing to do, but also to silently fix the extra log that
would have been left behind forever with the previous method.

PR:		conf/160848
Submitted by:	Andrey Zonov <andrey@zonov.org>
2011-11-13 03:01:58 +00:00
Xin LI
8017fd8eb9 Increase default scrub threshold from 30 days to 5 weeks. Using
whole weeks makes it easier to predicate when the scrub would
happen.

MFC after:	1 week
2011-10-27 21:25:41 +00:00
Stefan Eßer
3efd8ccdb5 Fix error message in case the backup storage directory does not exist and
cannot be created ($daily_backup_pkgdb_dbdir -> $daily_backup_pkgdb_dir).
MFC after:	1 week
2011-10-17 14:33:41 +00:00
Ed Schouten
9f0c9022c2 Add WITHOUT_UTMPX switch to the build system.
This knob removes the tools that are exclusively used to view and
maintain the databases maintained by utmpx, namely last, users, who,
wtmpcvt, ac, lastlogin and utxrm.

The tool w is not in this list, because it has some other functionality
which is unrelated to utmpx; it is hardlinked to the uptime tool.
2011-06-17 21:30:21 +00:00
Ed Schouten
f1c344b293 Don't omit ac(8) as part of WITHOUT_ACCT.
The WITHOUT_ACCT switch is supposed to omit tools related to process
accounting, namely accton and sa. ac(8) is just a simple tool that
prints statistics based on data in the utx.log database. It has nothing
to do with the former.
2011-06-17 20:47:44 +00:00
Josh Paetzel
00a3d0dae2 Eliminate extraneous pipelines and tr calls.
Approved by:	kib (mentor)
MFC after:	3 days
2011-06-15 19:33:02 +00:00
Josh Paetzel
eb52d12531 Convert the allowed characters '-', '.', and ':' in a ZFS pool name to _
to avoid causing errors in the shell script.

Submitted by:	William Grzybowski <william88@gmail.com>
Approved by:	kib (mentor)
MFC after:	7 days
Sponsored by:	iXsystems
2011-06-13 19:45:01 +00:00
Doug Barton
f7e2bd0458 1. If PKG_DBDIR cannot be determined from make, set the default
2. Add the -H flag to tar in case /var/db/pkg itself is a symlink
3. Direct stderr to /dev/null to suppress the leading slash warning [1]

PR:		ports/156810 [1]
Submitted by:	Jeremy Chadwick <freebsd@jdc.parodius.com> [1]
2011-05-05 02:35:11 +00:00
Alexander Leidinger
6edc5d5ab4 The security run requests unmaskable output, even if the only output is to
tell that there is a separate email or that the output is logged to a file.

This commit changes the return code for the non-inline case to tell that
this message is not important enough and can be masked if necessary. The
messages from the security checks themself are not affected by this and
show up as before in the periodic security email/file.

The inline case still requests to not mask the output, as with the current
way of handling this there is no easy way to handle this.

PR:			138692
Analysis/patch atch by:	Chris Cowart <ccowart@timesinks.net>
X-MFC after:		on request
2011-05-04 12:48:02 +00:00
Alexander Leidinger
df2f88d356 Use proper return codes (valuable output, invalid config, problems).
MFC after:	1 week
2011-05-04 12:37:10 +00:00
Doug Barton
f09b508c66 Hook the 220.backup-pkgdb script I added to the build unconditionally
Hook up 610.ipf6denied based on MK_IPFILTER as 510.ipfdenied is now

Poked by:	Andrzej Tobola <ato@iem.pw.edu.pl>
2011-03-27 03:06:58 +00:00
Doug Barton
baaa9dad0c Add svn:executable property on remaining period scripts without it 2011-03-27 03:03:29 +00:00
Doug Barton
22933fac2f Add a daily period script to back up /var/db/pkg
The final product contains work from the originator, and
Florent Thoumie <florent.thoumie@gmail.com>. The final
product contains considerable re-working by me, so all
responsibility for bugs rests under my pointy hat.

PR:		ports/145957
Submitted by:	Eitan Adler <EitanAdlerList@gmail.com>
2011-03-26 03:01:48 +00:00
Doug Barton
1533889cf7 Add the svn:executable property to the scripts that are missing it 2011-03-26 01:24:55 +00:00
Doug Barton
0a6cd3ac6d Update how accounting log files are rotated.
The old version had a race between the time that the old file was
cp'ed to acct.0 and the time that 'sa -s' was run that prevented
the commands that occurred in the meantime from being backed up.

It's also arguable that the old version was inefficient in using
cp which can be a problem on a space-constrained system.

This version avoids both problems, albeit it's considerably more
complicated. The advantage of putting the log rotation in the rc.d
script is that it can handle the _enable and _file questions without
having to do gymnastics to discover either value in the periodic script.

As a side effect of reviewing the rc.d script I cleaned it up a bit.
2011-02-22 21:13:40 +00:00
Josh Paetzel
9283f726be Fix logic error introduced in previous commit.
Along the way make some efficiency improvements.

Submitted by:	jilles
Approved by:	kib (mentor)
MFC after:	3 days
2011-01-25 13:41:48 +00:00
Josh Paetzel
16c4413fa6 This script parses output of userland tools. In the case of a faulted
zpool the output causes the script to bail out with syntax errors.
Since a scrub of a faulted zpool is pointless, just skip over any pools
marked as such.

PR:	conf/150228
Submitted by:	jpaetzel
Approved by:	kib (mentor)
MFC after:	3 days
MFC note:	only for RELENG_8
2011-01-23 17:13:29 +00:00
Brooks Davis
7cdc1c0007 Add an (off by default) check for negative permissions (where the
group on a object has less permissions that everyone).  These
permissions will not work reliably over NFS if you have more than
14 supplemental groups and are usually not what you mean.

MFC after:	1 week
2010-11-13 00:40:43 +00:00
Xin LI
65a1c46588 Hide 460.chkportsum in MK_PKGTOOLS != no case.
Submitted by:	Alex Kozlov <spam rm-rf kiev ua>
MFC after:	2 weeks
2010-11-09 18:46:44 +00:00
Alexander Leidinger
3dd9aad270 - Change the threshold from 'running next scrub the <value+1>th day after the
last one' to 'running next scrub the <value>th day after the last one'.
- Improve wording.

Requested by:	jhell <jhell@DataIX.net>
MFC after:	1 week
2010-08-25 08:09:42 +00:00
Oliver Fromme
686fdc1fc1 Connect the new script 490.status-pkg-changes (see r210863)
to the build, so it gets actually installed.

Approved by:	des (mentor)
MFC after:	17 days
2010-08-10 12:58:44 +00:00
Gabor Kovesdan
c2f40dcd3f - Fixes to the chkportsum script to handle better some special cases,
like spaces in filename

Submitted by:	Alex Kozlov <spam@rm-rf.kiev.ua>
Approved by:	delphij (mentor)
2010-08-10 11:15:17 +00:00
Oliver Fromme
6ece019fcf Add a daily script to the periodic framework that reports
changes to the package database, i.e. any packages that
have been added, updated or deleted in the past 24 hours.
The format is intentionally simple and concise.

That information is particularly useful on servers that
are maintained by multiple administrators.  When someone
adds, updates or deletes a package, the others will see
it in the daily periodic output.

This script is disabled by default.

PR:		conf/113913
Submitted by:	olli
Approved by:	des (mentor)
MFC after:	3 weeks
2010-08-05 15:53:33 +00:00
Gabor Kovesdan
d8456aa881 - Add a periodic script, which can be used to find installed ports' files with
mismatched checksum

PR:		conf/124641
Submitted by:	Alex Kozlov <spam@rm-rf.kiev.ua>
Approved by:	delphij (mentor)
2010-07-19 20:19:14 +00:00