o Introduce /var/log/authentication.log, which will be the target for
auth.info and authpriv.info by default. Rotate on the same schedule
as most other logs. Create at installation.
o Remove logging of auth.info from /var/log/security.log, which will
return to being only for security feature subsystems (such as ipfw,
and so on).
This creates a special authentication log, which can now be searched
by scripts for authentication events.
/usr/share/examples/pppd.
Update pppd(8) documentation to reflect this, usr.sbin/pppd/pppd.8.
Remove the out-of-place pppd(8) configuration files in etc/ppp,
ppp.shells.sample and ppp.deny.
Make the appropriate changes to the build process, etc/Makefile and
etc/mtree/BSD.usr.mtree, so it all works.
The files from etc/ppp, ppp.shells.sample and ppp.deny, were moved
with a repo copy. Note it in the logs with a forced commit to these
two.
Submitted by: Maxim Konovalov <maxim@macomnet.ru> provided the new samples.
to have backward compatibility symbolic links.
This code should check existence of deprecated locales and
fix them using following scheme:
. if new locale directory exisists and is a symlink -- remove it
. if old locale directory exists and not a symlink -- rename it to
its new name
This should allow to mtree(1) and existing locale aliases make(1)
rules to setup locale dirs correctly (avoid self-referenced symlinks)
BTW, this commit brings in backward compatibility support for ru_SU
locales (aliased to appropriate ru_RU ones).
LC_MESSAGES related data was installed to <locale>/LC_MESSAGES file.
Now it go to <locale>/LC_MESSAGES/SYS_LC_MESSAGES file. LC_MESSAGES
directory is supposed to be storage of message catalogs of userland tools.
This should allow us to avoid many potential problems with future
libintl related functionality introduction.
Thanks for useful suggestions about correct way how to replace plain
files with directories at installworld stage to: Ruslan Ermilov <ru>
of /etc/daily. Some time later, /etc/daily became a set of periodic(8)
scripts. Now, this evolution continues, and /etc/security has been
broken into periodic(8) scripts to make local customization easier and
more maintainable.
Reviewed by: ru
Approved by: ru
installed instead of pam.conf. This is for testing; the conditionals will
be removed once we are confident that pam.d works as intended.
Sponsored by: DARPA, NAI Labs
discussed on the arch@ mailinglist (after repo-copy).
sys.mk will .error if it finds /etc/defaults/make.conf but include
it anyways (this is the same behaviour as with the make.conf.local
removal).
/usr/share/examples/etc/make.conf has BDEFLAGS commented out now,
since it's only an example file.
Adjust all textes that talk about make.conf or defaults/make.conf to
match the new situation.
NO_MAKEDEV_INSTALL and NO_MAKEDEV_RUN. The former implying the latter.
The names imply what they do. The last commit by DES based on a PR defeated
the original idea behind NO_MAKEDEV, which was not to run MAKEDEV, but to do
the installation of MAKEDEV. This should satisfy both parties on the MAKEDEV
challenge.
associated changes that had to happen to make this possible as well as
bugs fixed along the way.
Bring in required TLI library routines to support this.
Since we don't support TLI we've essentially copied what NetBSD
has done, adding a thin layer to emulate direct the TLI calls
into BSD socket calls.
This is mostly from Sun's tirpc release that was made in 1994,
however some fixes were backported from the 1999 release (supposedly
only made available after this porting effort was underway).
The submitter has agreed to continue on and bring us up to the
1999 release.
Several key features are introduced with this update:
Client calls are thread safe. (1999 code has server side thread
safe)
Updated, a more modern interface.
Many userland updates were done to bring the code up to par with
the recent RPC API.
There is an update to the pthreads library, a function
pthread_main_np() was added to emulate a function of Sun's threads
library.
While we're at it, bring in NetBSD's lockd, it's been far too
long of a wait.
New rpcbind(8) replaces portmap(8) (supporting communication over
an authenticated Unix-domain socket, and by default only allowing
set and unset requests over that channel). It's much more secure
than the old portmapper.
Umount(8), mountd(8), mount_nfs(8), nfsd(8) have also been upgraded
to support TI-RPC and to support IPV6.
Umount(8) is also fixed to unmount pathnames longer than 80 chars,
which are currently truncated by the Kernel statfs structure.
Submitted by: Martin Blapp <mb@imp.ch>
Manpage review: ru
Secure RPC implemented by: wpaul
Makefile to the etc/sendmail Makefile to be consistent with all of the
other /var file creations. In doing so, change the Makefile target from
etc-sendmail.cf to distribution as it installs more than just the sendmail.cf.
configure FreeBSD so that various databases such as passwd and group can be
looked up using flat files, NIS, or Hesiod.
= Hesiod has been added to libc (see hesiod(3)).
= A library routine for parsing nsswitch.conf and invoking callback
functions as specified has been added to libc (see nsdispatch(3)).
= The following C library functions have been modified to use nsdispatch:
. getgrent, getgrnam, getgrgid
. getpwent, getpwnam, getpwuid
. getusershell
. getaddrinfo
. gethostbyname, gethostbyname2, gethostbyaddr
. getnetbyname, getnetbyaddr
. getipnodebyname, getipnodebyaddr, getnodebyname, getnodebyaddr
= host.conf has been removed from src/etc. rc.network has been modified
to warn that host.conf is no longer used at boot time. In addition, if
there is a host.conf but no nsswitch.conf, the latter is created at boot
time from the former.
Obtained from: NetBSD
build process in too many cases. Adding mtree to bootstrap-tools
to solve this breaks the upgrade path because mtree needs a
libc that has strtofflags and fflagstostr.
wheel to trash logfiles is not exactly good security policy. There have
been several gid wheel holes in ports. Various other files were changed
as well (eg: the locate database were set to more restrictive modes (444)
by their generation scripts) so this should be safe for them. utmp and
wtmp are mode 644 already on all the systems we checked.
Submitted by: jkb
Reviewed by: kris
The only change in the default functionality should be that
the output reports are slightly more verbose WRT files deleted.
Not objected to by: freebsd-arch
for pccardd.
Please install /etc/defaults/pccard.conf and update /etc/defaults/rc.conf
as well.
Note that old pccard.conf.sample still remains for while but
no longer to be maintained.
Reviewed by: imp, -mobile ML and nomads ML in Japan.
new sample database files, so that they will be installed with make
distribution. NOSPAM probably ought to be renamed to MAIL.
Reviewed by: peter
Approved by: jkh
/etc/Makefile so that if it is defined, MAKEDEV all is not called
during a make distribution. This helps clean up the messy userland
in jail(), by reducing the number of devices exposed in jail.
Modifications to jail(2) to follow.
Approved by: jkh-arius
should be used from now on for anything security but not auth-related.
Included are updates for all relevant manpages and also to /etc files,
creating a new /var/log/security. Nothing in the system logs to
/var/log/security yet as of the time of this commit.
Reviewed by: rgrimes, imp, chris
Originally submitted by: Wayne Self <wself@cdrom.com>
Allow a ppp startup option in rc.conf.
Adjust sysinstall so that it appends to the end of ppp.conf
and uses the generated profile to start ppp in auto mode on
boot.
Submitted by: Josef L. Karthauser <joe@uk.FreeBSD.org>
he moved rc.conf. Then he deleted rc.diskless when it ( of course ) didn't
work. Now I'm putting the originally accidently removed rc.diskless{1,2}
back in.
(3?) people will make an effort to help those who would have benefitted from
this change. And just telling them that they should read and understand
the significance of each message posted to -current is not really good
enough IMHO.
${DESTDIR}/etc and an install target to install the missing ones. This
allows new files like pam.conf to be installed by the first installworld
after the file is added, but avoid clobbering files that might be
customized. This should save some support questions.
methods used by login. Changes to "/usr/bin/login" to use it will
be committed later today. The format of the file is described in
pam(8).
This sample file makes login behave in the traditional way. To
wit, it enables authentication via S/Key and passwd/NIS lookups.
KerberosIV authentication is present in the sample file but commented
out.
As a safety net and a transition aid, login will fall back on
built-in passwd/NIS authentication if this configuration file is
missing or if some other fatal PAM error occurs.
This file will eventually replace "/etc/auth.conf", but not until
I've finished converting the other utilities, such as passwd and su.
This will make a number of things easier in the future, as well as (finally!)
avoiding the Id-smashing problem which has plagued developers for so long.
Boy, I'm glad we're not using sup anymore. This update would have been
insane otherwise.
"make distrib-dirs" target.
Neither of Andrey's two attempts have worked for me with the [ -h ..]
test both with && and ||.
I've changed it to a full
if [ -h ...]; then \
rm ... ; \
fi ; \
construct. It's much clearer what's meant to happen, and it works! :-)
patches to merge the two IPX packages to work with each other and to
not break make-world :)
IPXrouted should be working now, (or at least compiling) :)
specified in the top level Makefiles.
Previously I missed dozens of Makefiles that skip the install after
using `cmp -s' to decide that the install isn't necessary.
changes to it based upon other outstanding bug reports and commits made
after his work.
Comments:
(a) sysconfig is still used to do all configuration. I was not going to
change that out from under you.... a user never need edit netstart
or rc* unless they're being very weird.
(b) rc.maint has been folded back into rc. It is just unworkable as
a separate chunk because of ordering bogosities
(c) netstart does what it says... it starts up enough of the network to
get up, it doesn't start every bloody daemon that might talk to a
socket... netstart ifconfig's the devices and sets up routing if
configured to do so.
(d) nfs disks are mounted immediately after netstart completes
(e) syslog is started as early as possible (right after nfs) so that error
messages can get logged to remote syslog servers properly
(f) named is started (there is an argument that says that named should be
started before syslogd because if you are the dns server for your domain,
you'd like named to resolve remote hosts in syslog.conf, but this is
a minority case and the trivial workarround is to put the syslog host
in /etc/hosts or use an /etc/resolv.conf -- why? because you want syslog
to catch named errors, which is a MUCH more important and likely occurance)
(g) NOW all of the rest of the network daemons such as the time stuff, RPC,
NIS, NFS, Kerberos and inetd are started
(h) the rest of the generic stuff is done (cron/printer/sendmail)
(i) shared libraries are set
(j) /etc/rc.i386 is run (this does FreeBSD/386 specific stuff like ibcs2,
xtend, and all of the syscons stuff
(this is actually started as /etc/rc.`uname -m`
(k) the syscons stuff has gotten a serious cleaning to make it consistent
with rc conventions
(l) rc.local has had the comments about syscons removed (they are not relevant
to this file now) and the full name of the kernel has been restored to
/etc/motd
Submitted by: pts
2. Update the COPYRIGHT= to be just the COPYRIGHT file for now.
3. Fully parameterize the floppy device being used. This is needed right
now so I can at least build these on 1.44 until it all is working, then
I will have to find a way to get them back down to size.
4. Remove mount_pcfs from the filesystem floppy, we don't have that yet.
5. Update the shared libraries t obe copied. This should now work for
this and all future releases.
6. Reduce the CRYPT_SRCS down to the few static binaries that have crypt
in them.
7. Change all references for the kernel from /386bsd to /kernel.
8. For some reason umount is returning 1, use a - until I can find out why.
9. Update the disklabel commands to be 4.4 syntax.
10. Remove the ugly elvis wart, we don't have elvis anymore.
11. Use the -d (directories only) option on the mtree commands. This
greatly reduces the noise from distrib-dirs:.
12. Note the fact that the mtree commands need a wrapper around them as they
return a status of 2 if the tree was modified and the make should not
exit on that condition.
13. Add a trailing slash on the chflags command as ${RELEASEDIR} may be
a symbolic link.
some file names.
2. Add MAKEDEVS= that does all the /dev population so that this is not
duplicated in 2 or 3 places. Helps to keep it in sync too. Cleaned
up and fixed to not overflow inode tables.
3. Fix paths to the 2 crypt versions.
4. Init is sbin/init now instead of sbin/init.bsdi.
5. bdes is now in secure/usr.bin, will need to do something about telnet.
6. Incorporate 1.1.5.1 patches for EXTRACT.sh files.
7. Correct calls to make kcopy-flooppy to work with or without obj/.
8. Reorder src-clean: target so that it does not destroy the real obj
tree, but does rip out junk and obj links.
9. Incorporate 1.1.5.1 patche for srcbin tarball name.
10. Add chflags command to release-dirs target so the rm -rf can have a
chance to work.
With this and a few more commits I will have 2.0 bin tarballs.
the choice of building with the password scrambler or the DES
libraries. Folks outside the US can simply drop in the other
DES libraries. (stupid laws...)
Everything still keys off of the old NOCRYPT variable so building
a portable distribution remains the same.
Submitted by: pst
1. Use ${MAKE} everywhere again. Whoops.
2. Replace multiple invocations of gzip ... split ... with one variable.
3. Add src-clean target for making the src tree presentable before
making a src tarball out of it.
2. Get kcopy and filesystem images from current directory since we
now build them here; a clean rule is now all that's needed to make
the crunch stuff complete.
1. Properly use ${.CURDIR} now instead of hardcoded relative dirs.
2. Use ${BINOWN} and ${BINGRP} everywhere instead of root/wheel
3. Add target for copying over EXTRACT scripts (and add them here).
4. Start thinking about crunched floppy target (not in yet, next commit).
2 Added optional excessive login logging.
3) Added login acces control on a per host/tty base.
4) See skey(1) for skey descriptions and src/usr.bin/login/README
for the logging and access control features.
-Guido
----------------------------
revision 1.53.2.3
date: 1994/04/10 20:19:37; author: rgrimes; state: Exp; lines: +12 -3
Must have etc and usr directories on the cdinstall floppies.
Need to have device files for mcd1.
Create links for usr/libexec and usr/lib on cdinstall floppies so that
shared library code is loaded from cdrom.
pair of crunched binaries that are not built by this, but other than
that it is back to an automated procedure. So many changes it is
hard to describe.
Use freefall.cf as sendmail prototype file, it is more realistic than the
tcpproto.cf file for a FreBSD system. Fix so that obj dir is created in
sendmail/cf/cf as to not polute the source tree and to have the Makefile
in there do the right things.
Remove all the extra /dev/fd0?* entries on the floppies, they where using
up all the inodes and are not needed at this time.
Temporarily remove the floppy target from release: untilit is
fixed.
This file has lots more work coming, but to get the 1.1 BETA out I am
going to hand craft the floppies :-(.
Subject: Bug & Fix for etc/Makefile cpio-floppy: re /tmp creation.
Date: Fri, 26 Nov 1993 11:35:04 +0100
Editors Note: tmp was listed in the CPIO_FILES section and thus the
entire contents of ${DESTDIR}/tmp would end up on the cpio floppy. This fix
moves tmp to CPIO_DIRS so that no longer happens.
with a Makefile override. The default is floppy5 since all distribution
floppies must be <= 1.2Mb so that every one can use them.
If you want to make 1.44MB floppies with more space on them do a
setenv FLOPPY floppy3
before running make.
>From: "Jordan K. Hubbard" <jkh%whisker.lotus.ie@dec4ie.ieunet.ie>
Date: Sun, 10 Oct 1993 05:11:51 -0700
I went to make myself some boot floppies straight off the dist
today and ran into the fact that I'm using a 3.5" floppy as my drive A,
so I did the following (you can still use floppy5 as your default -
I just have it set to floppy3 for my machine).
after all. Removed it from DOS floppy.
Added COPYRIGHT to DOS floppy since it does have *BSD binaries on it!
Fixed missing ; \ when creating dev entries on filesystem floppy
Fixed rm in wrong directory, please don't rm in the DESTDIR area!!
and miscellaneous programs which get installed into /usr/distbin.
Install now recognizes existing DOS partitions and attempts to install
after them. Theoretically, it also remaps badblocks.
N.B.: The fourth install floppy must have a clean DOS FAT.
Building the new distribution floppies is untested
TODO: Build a disktab entry for existing DOS partitions (except extended
partitions). This would allow loading and/or extracting the distribution
files directly from the DOS hard disk partition.
these are not part of the standard distribution and do not belong
in here, this was carry over from earlier work.
Added src-tarball: ssrc-tarball: targets to build the 2 source tar balls,
still have to manually copy/chmod/chown the src tree into the destination
directory and clean out all the obj, and CVS files/dirs, plus run a
make cleandist in it before running these targets, but atleast things are
getting easier to do!
release: now uses fixed floppies target.
is not really needed until we can go multiuser.
Changed name of list from CRYPT_FILES to CRYPT_SRCS, since that is
really what they point to. Added list CRYPT_DIRS, that is the directories
that are in the des distribution.
Fixed kc-xx-floppy dependencies on kc-floppy since it would not do
the right thing with the new target floppies:
Now user ${RELEASEDIR} for dd'ing the floppy images and other stuff having
to do with building the release.
Added new target bin-tarball that builds the bin.tar.gz.?? split archives for
release.
Added new target des-tarball that builds the des.tar.gz.?? split archives for
release.
Added building of /usr/local directories for the CDROMDIST.
New target floppies: that builds all 4 floppies.
New target release: that should completely populate a release tree, except
that the src-tarball target is not yet written.
that now takes a directory argument. These files are now built from the
master.passwd file.
Fixed typo on NOOBJ=, was oobj, now noobj.
Rename of targes and variables. INST1 -> FILESYSTEM, INST2 -> CPIO,
kc -> kcopy.
Floppy targets now dd and gzip the image back onto the hard disk so
that less manual work is required when building a release.
Removed reboot from FILESYSTEM floppy and put df back on, and added
mount_isofs. Changed scripts to use halt instead of reboot.
distributions.
Now only populates $DESTDIR/dev if we are building the cdrom distribution,
since this directory is populated by the install tools it was a conflict
to have the dev entries in the full distribution as well.
share/zoneinfo and was just duplicated here.
Fixed the directory owner ships on the inst1 floppy by adding all of the
directories that get created on the floppy to INST1_DIR, since cpio was
not picking up the source dir protections, but instead using the current
process uid, gid, and umask values.
Removed /bin/df from inst1 to make room for mount_pcfs. Also removed
/etc/disktab since it just got overwritten by the install tools.
Removed zcat from INST2_CPIO since it is now installed from the
INST2_FILES files on the floppy. This fixes things so that all
of the gzip tools get linked to the same image.
Much of the .if machine i386 stuff moved to be system independent
since it really was.
Added sd1 support to the inst1 and kc floppies. No room for wd1 support,
oh well.
Fix permissions on top level of floppy, it was not getting set.
Added kc-floppy that does the common part of building the kc floppies.
Added kc-bt-floppy to build GENERICBT kernel floppy.
Fixed kc-ah-floppy to use kc-floppy.
The problem with having it enable is that lastlog grows big, none
of the current scripts deal with rotation of /var/log/lastlog,
so it shouldn't necessary be installed at first. This has traditionally
been something the sysadmin has had to touch after system installations.
Nate:
(Besides, you're forced to learn more about the system by reading the man
pages if it doesn't exist. :-)
3 of the 4 needed floppies for FreeBSD.
Still need to do kc-bt-floppy for the Bustek/Ultrastore controllers.
Fixed installation of boot blocks in distribution:, now use a variable
(${MDEC}) instead of a find so that my zzz files don't end up in
the distribution!
Made it clean up in /sys/i386/boot after building and installing the
boot blocks.
Moved the cd ..; make install to be after the special case stuff for
sendmail.
Added the installation of tcpproto.cf as /etc/sendmail.cf
spwd.db that are created from the template master.passwd to src/etc so
that a build distribution can populate /etc correctly. This is a work
around until a better solution can be found.
