d/freebsd-skq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
7cdc285a81
freebsd-skq/etc/defaults/rc.conf

531 lines
28 KiB
Plaintext
Raw Normal View History

Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
#!/bin/sh
Whitespace police. Submitted by: cjc, ru
2001-11-28 08:52:35 +00:00
# This is rc.conf - a file full of useful variables that you can set
Move rc.conf into defaults/ directory. This is part of a larger series of commits to deal with the rc.conf.site confusion.
1999-02-09 22:15:18 +00:00
# to change the default startup behavior of your system. You should
# not edit this file! Put any overrides into one of the ${rc_conf_files}
# instead and you will be able to update these defaults later without
# spamming your local configuration information.
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
#
Add to defaults/rc.conf a new function source_rc_confs which rc scripts may use to source safely overrides in ${rc_conf_files} files. This protects users who insist on the bad practice of copying /etc/defaults/rc.conf to /etc/rc.conf from a recursive loop that exhausts available file descriptors. Several people have expressed interest in breaking this function out into its own shell script. Anyone who wants to embark on such an undertaking would do well to study the attributed PR. PR: 17595 Reported by: adrian Submitted by: Doug Barton <Doug@gorean.org>
2000-04-27 08:43:49 +00:00
# The ${rc_conf_files} files should only contain values which override
# values set in this file. This eases the upgrade path when defaults
# are changed and new features are added.
Add an explicit warning against copying this file into /etc/, since work-arounds for the ".: Out of file descriptors" problem (see PR 13724) are taking longer than expected to come to fruition.
1999-12-21 10:46:41 +00:00
#
YAMF22
1997-04-28 10:14:45 +00:00
# All arguments must be in double or single quotes.
#
Add a reference to rc.conf(5). PR: docs/35648 Submitted by: Gary W. Swearingen
2005-01-24 21:52:32 +00:00
# For a more detailed explanation of all the rc.conf variables, please
# refer to the rc.conf(5) manual page.
#
$Id$ -> $FreeBSD$
1999-08-27 23:37:10 +00:00
# $FreeBSD$
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
##############################################################
Standardize appearance of subsection headers (two spaces for section name)
1999-06-27 22:12:35 +00:00
### Important initial Boot-time options ####################
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
##############################################################
Add rc_debug knob to rc.conf. The code for it has been in rc.subr for some time now. Document all knobs introduced by rc.d Approved by: markm (mentor) Reviewd by: gordon (earlier revision)
2003-01-14 15:50:17 +00:00
rc_debug="NO" # Set to YES to enable debugging output from rc.d
o Reduce rc(8) startup clutter by turning the informational messages off by default. o Apparently the routine displaying the informational messages wasn't checking its knob in rc.conf, so fix that as well. Requested by: obrien
2003-08-20 06:50:34 +00:00
rc_info="NO" # Enables display of informational messages at boot.
Add a couple of variables for rc.d Submitted by: Mike Makonnen
2002-06-13 22:27:31 +00:00
rcshutdown_timeout="30" # Seconds to wait before terminating rc.shutdown
YAMF22
1997-04-28 10:14:45 +00:00
swapfile="NO" # Set to name of swapfile if aux swapfile desired.
Refine on explanation for apm stuff. Make it clear that apmd depends on apmconf -e. Reviewed by: obrien, my friend :-)
1999-07-12 17:20:29 +00:00
apm_enable="NO" # Set to YES to enable APM BIOS functions (or NO).
apmd_enable="NO" # Run apmd to handle APM event from userland.
apmd_flags="" # Flags to apmd (if enabled).
devd is now on by default Reviewed by: dfr,njr (not nate!)
2004-06-30 15:58:46 +00:00
devd_enable="YES" # Run devd, to trigger programs on device tree changes.
A new rc-ng script to build linker.hints files with kldxref(8) automatically at boot time. Associated rc.conf(5) knobs and documentation are included.
2003-03-17 23:15:53 +00:00
kldxref_enable="NO" # Build linker.hints files with kldxref(8).
kldxref_clobber="NO" # Overwrite old linker.hints at boot.
kldxref_module_path="" # Override kern.module_path. A ';'-delimited list.
YAMF22
1997-04-28 10:14:45 +00:00
pccard_enable="NO" # Set to YES if you want to configure PCCARD devices.
pccard_mem="DEFAULT" # If pccard_enable=YES, this is card memory address.
add PC-Card melody beep(PC Card bus, kludge version) Original idea from: PAO3
2000-10-28 13:35:34 +00:00
pccard_beep="2" # pccard beep type.
YAMF22
1997-04-28 10:14:45 +00:00
pccard_ifconfig="NO" # Specialized pccard ethernet configuration (or NO).
Make pccardd have -z by default. This fixes a few startup problems where people want to have the cards configured. Lack of -z is a speed optimization. Submitted by: many voices on mobile@ Approved by: re@ (rwatson) MFC after: 3 days
2002-12-06 05:23:37 +00:00
pccardd_flags="-z" # Additional flags for pccardd.
Enable etc/defaults/pccard.conf which is default configuration file for pccardd. Please install /etc/defaults/pccard.conf and update /etc/defaults/rc.conf as well. Note that old pccard.conf.sample still remains for while but no longer to be maintained. Reviewed by: imp, -mobile ML and nomads ML in Japan.
2000-04-03 19:24:25 +00:00
pccard_conf="/etc/defaults/pccard.conf" # pccardd(8) config file
Quote the value of pccard_ether_delay, the only unquoted value in the entire file.
2001-10-05 09:01:42 +00:00
pccard_ether_delay="5" # Delay before trying to start dhclient in pccard_ether
Add removable_interfaces to /etc/defaults/rc.conf. It is used (undocumented until now) by /etc/pccard_ether. MFC candidate. Pointed out by: Dave Crane <dave@trig.net> Reviewed by: -mobile
2001-04-04 16:48:57 +00:00
removable_interfaces="" # Removable network interfaces for /etc/pccard_ether.
Overhaul the /etc/rc.d/diskless script by splitting it out into hostname, resolve, tmp, and var scripts. The latter three are new and were repo copied. These scripts no longer depend on being booted with and NFS root instead attempt to automaticly create mfs /tmp and /var volumes if the they are not writable. This behavior can be overridden in /etc/rc.conf. Reviewed by: luigi, pjd
2004-03-23 23:22:35 +00:00
tmpmfs="AUTO" # Set to YES to always create an mfs /tmp, NO to never
tmpsize="20m" # Size of mfs /tmp if created
Revert the noexec,nosuid,nodev options for md /tmp file systems, since the change in the default behavior may break existing, working setups. Requested by: brooks
2004-11-09 21:33:19 +00:00
tmpmfs_flags="-S" # Extra mdmfs options for the mfs /tmp
Overhaul the /etc/rc.d/diskless script by splitting it out into hostname, resolve, tmp, and var scripts. The latter three are new and were repo copied. These scripts no longer depend on being booted with and NFS root instead attempt to automaticly create mfs /tmp and /var volumes if the they are not writable. This behavior can be overridden in /etc/rc.conf. Reviewed by: luigi, pjd
2004-03-23 23:22:35 +00:00
varmfs="AUTO" # Set to YES to always create an mfs /var, NO to never
varsize="32m" # Size of mfs /var if created
Add two new rc.conf options: tmpmfs_flags and varmfs_flags. These can be used to pass extra options to the mdmfs(8) utility, to customize the finer details of the md file system creation (i.e. to turn on/off softupdates, to specify a default owner for md filesystem, etc). Use these two new flags to mount tmpmfs and varmfs without softupdates, since it doesn't make much sense to use SU on malloc-backed file systems. Reviewed by: mtm Inspired by: J. D. Bronson, jbronson at wixb dot com
2004-11-09 10:03:17 +00:00
varmfs_flags="-S" # Extra mount options for the mfs /var
Overhaul the /etc/rc.d/diskless script by splitting it out into hostname, resolve, tmp, and var scripts. The latter three are new and were repo copied. These scripts no longer depend on being booted with and NFS root instead attempt to automaticly create mfs /tmp and /var volumes if the they are not writable. This behavior can be overridden in /etc/rc.conf. Reviewed by: luigi, pjd
2004-03-23 23:22:35 +00:00
populate_var="AUTO" # Set to YES to always (re)populate /var, NO to never
Back out /etc/rc.d addition. I'd like to see something come of what has already been imported. It would have been nice to get it out there in DP1, but that is too late now.
2002-04-11 08:48:52 +00:00
local_startup="/usr/local/etc/rc.d /usr/X11R6/etc/rc.d" # startup script dirs.
Add a script_name_sep rc.conf knob to specify the IFS character for separating the startup scripts' list into individual filenames. Run the shutdown scripts in reverse alphabetical order, so dependent services are stopped before the services they depend upon. Reviewed by: -arch, -audit MFC after: 3 weeks
2001-07-17 14:33:52 +00:00
script_name_sep=" " # Change if your startup scripts' names contain spaces
Move rc.conf into defaults/ directory. This is part of a larger series of commits to deal with the rc.conf.site confusion.
1999-02-09 22:15:18 +00:00
rc_conf_files="/etc/rc.conf /etc/rc.conf.local"
Add a default setting of NO for the gbde auto attach script, and document the options.
2003-09-18 09:59:37 +00:00
# Experimental - test before enabling
gbde_autoattach_all="NO" # YES automatically mounts gbde devices from fstab
gbde_devices="NO" # Devices to automatically attach (list, or AUTO)
For the gbde attach script: - Ask the user up to X times (3 by default) for the pass-phrase, if it is incorrect the first time. - Add support for storing the lockfiles in another other directory than /etc. - Document that it is possible to override the location of each single lockfile. Approved by: pjd
2004-07-18 18:01:48 +00:00
gbde_attach_attempts="3" # Number of times to attempt attaching gbde devices
gbde_lockdir="/etc" # Where to look for gbde lockfiles
Add support for initializing swap devices with random one-shot keys. Note that the keys are currently generated by computing the MD5 checksum of 512 bytes read from /dev/random, and are passed to gbde on the command line. Sponsored by: Teleplan AS
2004-02-03 11:26:08 +00:00
gbde_swap_enable="NO" # Set to YES to automatically initialize gbde swap
# devices listed in fstab with a random one-shot key
Add a default setting of NO for the gbde auto attach script, and document the options.
2003-09-18 09:59:37 +00:00
Introduce root_rw_mount as a new variable in defaults/rc.conf to unbreak /etc/rc.d/root for diskless systems that get their root filesystem from a read-only NFS mount. PR: conf/72927 Submitted by: Ralf Wenk <RZ-FreeBSD1004@fh-karlsruhe.de> Reviewed by: brooks
2004-10-20 16:58:28 +00:00
root_rw_mount="YES" # Set to NO to inhibit remounting root read-write.
Whitespace police. Submitted by: cjc, ru
2001-11-28 08:52:35 +00:00
fsck_y_enable="NO" # Set to YES to do fsck -y if the initial preen fails.
Introduce a background_fsck rc.conf option which allows the user to enable or disable background fsck'ing all in one shot. Default is currently 'YES'. Reviewed by: jkh
2001-05-22 00:05:48 +00:00
background_fsck="YES" # Attempt to run fsck in the background where possible.
Delay an optional amount of time after booting before starting a background fsck. The delay defaults to sixty seconds to allow large applications such as the X server to start before disk I/O bandwidth is monopolized by fsck. Submitted by: Brooks Davis <brooks@one-eyed-alien.net> Sponsored by: DARPA & NAI Labs.
2002-12-18 07:21:31 +00:00
background_fsck_delay="60" # Time to wait (seconds) before starting the fsck.
Add nfs4 to list of net filesystems. Approved by: alfred
2004-12-01 22:05:50 +00:00
netfs_types="nfs:NFS nfs4:NFS4 smbfs:SMB portalfs:PORTAL nwfs:NWFS" # Net filesystems.
Don't require operators to override the list of network filesystem types (networkfs_types) with a version that includes the original list. This increases the scope for user error and also means that systems with networkfs_types set in /etc/rc.conf will not benefit from changes to the list in /etc/defaults/rc.conf on upgrade. Instead, store the default list in /etc/rc itself and allow the operator to append to that list by specifying her own list in networkfs_types. Rename networkfs_types to extra_netfs_types accordingly, as the new name better describes the purpose of the variable. Default the value to 'NO'.
2001-12-29 19:42:55 +00:00
extra_netfs_types="NO" # List of network extra filesystem types for delayed
# mount at startup (or NO).
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
##############################################################
### Network configuration sub-section ######################
##############################################################
Mention that basic network options now include firewall/security options as well.
2000-08-17 06:04:13 +00:00
### Basic network and firewall/security options: ###
Use a less annoying default hostname.
1999-07-18 09:58:01 +00:00
hostname="" # Set this!
YAMF22
1997-04-28 10:14:45 +00:00
nisdomainname="NO" # Set to NIS domain if using NIS (or NO).
The dhcp_program and dhcp_flags variables have to be renamed to take advantage of the rc.subr(8) glue. They are renamed dhclient_program and dhclient_flags. o Rename them in rc.conf(5) o Rename them in /etc/defaults/rc.conf o Add the deprecated variables to /etc/rc.subr o Isolate the use of the 'command' variable to the NetBSD specific parts in /etc/rc.d/dhclient. o Now that dhcp_flags has also been renamed it will be applied properly by rc.subr(8) glue code. Reported by: John Nielsen <john@jnielsen.net>
2003-06-07 10:31:17 +00:00
dhclient_program="/sbin/dhclient" # Path to dhcp client program.
dhclient_flags="" # Additional flags to pass to dhcp client.
Change the default for background_dhclient back to NO. It can cause to much troubles with applications.
2003-07-28 13:09:00 +00:00
background_dhclient="NO" # Start dhcp client in the background.
Reviewed by: msmith, alex Cosmetic changes to the loading of firewall rules and lkm.
1997-09-11 10:59:02 +00:00
firewall_enable="NO" # Set to YES to enable firewall functionality
Allow the user to specify a different firewall script than /etc/rc.firewall.
1999-04-10 10:56:58 +00:00
firewall_script="/etc/rc.firewall" # Which script to run to set up the firewall
Reviewed by: msmith, alex Cosmetic changes to the loading of firewall rules and lkm.
1997-09-11 10:59:02 +00:00
firewall_type="UNKNOWN" # Firewall type (see /etc/rc.firewall)
firewall_quiet="NO" # Set to YES to suppress rule display
Whitespace police. Submitted by: cjc, ru
2001-11-28 08:52:35 +00:00
firewall_logging="NO" # Set to YES to enable events logging
Add a firewall_flags option that is used when ipfw processes a file. It allows you to run a preprocessor, such as m4, so that you can use macros in your rules file. Approved by: jkh
2000-02-06 19:25:00 +00:00
firewall_flags="" # Flags passed to ipfw when type is a file
Add ip_portrange_first and ip_portrange_last rc.conf/rc.network options. This allows you to set the standard dynamic port assignment range prior to any network daemons (like named) starting up, necessary if you are also using a firewall to restrict lower ports. will be MFC'd in a few days
2000-06-22 17:40:53 +00:00
ip_portrange_first="NO" # Set first dynamically allocated port
ip_portrange_last="NO" # Set last dynamically allocated port
Add a means of starting an IKE daemon from the rc system at an appropriate time during the boot process. This is needed in the case where NFS mounts from servers reachable only via IPSEC are in /etc/fstab. PR: conf/42497 Submitted by: Volker Stolz Approved by: re (rwatson)
2003-11-28 17:28:42 +00:00
ike_enable="NO" # Enable IKE daemon (usually racoon or isakmpd)
ike_program="/usr/local/sbin/isakmpd" # Path to IKE daemon
ike_flags="" # Additional flags for IKE daemon
Add ip_portrange_first and ip_portrange_last rc.conf/rc.network options. This allows you to set the standard dynamic port assignment range prior to any network daemons (like named) starting up, necessary if you are also using a firewall to restrict lower ports. will be MFC'd in a few days
2000-06-22 17:40:53 +00:00
ipsec_enable="NO" # Set to YES to run setkey on ipsec_file
ipsec_file="/etc/ipsec.conf" # Name of config file for setkey
Add natd_program and change a comment.
1999-03-24 10:27:46 +00:00
natd_program="/sbin/natd" # path to natd, if you want a different one.
Whitespace police. Submitted by: cjc, ru
2001-11-28 08:52:35 +00:00
natd_enable="NO" # Enable natd (if firewall_enable == YES).
There is no reason to demand the administrator set 'natd_interface' when running natd(8) out of the rc-files. It is perfectly valid for the interface or alias address to be set in a natd(8) configuration file, not on the command line. Also, loosen up the restrictions on identifying an IP address argument in 'natd_interface.' Fix the documentation, rc.conf(5), to reflect this change. Take the bogus default for 'natd_interface' out of /etc/defaults/rc.conf. MFC after: 3 days
2002-02-20 10:31:01 +00:00
natd_interface="" # Public interface or IPaddress to use.
Whitespace police. Submitted by: cjc, ru
2001-11-28 08:52:35 +00:00
natd_flags="" # Additional flags for natd.
This brings support for IP Filter into rc.network and rc.conf with the appropriate documentation added to rc.conf(5). If all goes well with this over the next few weeks, the PR will be closed with the pullup of patches back to 4-STABLE. PR: 20202 Submitted by: Gerhard Sittig <Gerhard.Sittig@gmx.net> Reviewed by: Darren Reed <darrenr@freebsd.org> Approved by: Darren Reed <darrenr@freebsd.org> Obtained from: Gerhard Sittig <Gerhard.Sittig@gmx.net>
2000-10-06 12:24:45 +00:00
ipfilter_enable="NO" # Set to YES to enable ipfilter functionality
second part of the patches to complete ipf changes to rc PR: multiple Submitted by: Arjan de Vet <devet@devet.org>
2001-11-24 15:36:30 +00:00
ipfilter_program="/sbin/ipf" # where the ipfilter program lives
This brings support for IP Filter into rc.network and rc.conf with the appropriate documentation added to rc.conf(5). If all goes well with this over the next few weeks, the PR will be closed with the pullup of patches back to 4-STABLE. PR: 20202 Submitted by: Gerhard Sittig <Gerhard.Sittig@gmx.net> Reviewed by: Darren Reed <darrenr@freebsd.org> Approved by: Darren Reed <darrenr@freebsd.org> Obtained from: Gerhard Sittig <Gerhard.Sittig@gmx.net>
2000-10-06 12:24:45 +00:00
ipfilter_rules="/etc/ipf.rules" # rules definition file for ipfilter, see
# /usr/src/contrib/ipfilter/rules for examples
second part of the patches to complete ipf changes to rc PR: multiple Submitted by: Arjan de Vet <devet@devet.org>
2001-11-24 15:36:30 +00:00
ipfilter_flags="" # additional flags for ipfilter
ipnat_enable="NO" # Set to YES to enable ipnat functionality
ipnat_program="/sbin/ipnat" # where the ipnat program lives
This brings support for IP Filter into rc.network and rc.conf with the appropriate documentation added to rc.conf(5). If all goes well with this over the next few weeks, the PR will be closed with the pullup of patches back to 4-STABLE. PR: 20202 Submitted by: Gerhard Sittig <Gerhard.Sittig@gmx.net> Reviewed by: Darren Reed <darrenr@freebsd.org> Approved by: Darren Reed <darrenr@freebsd.org> Obtained from: Gerhard Sittig <Gerhard.Sittig@gmx.net>
2000-10-06 12:24:45 +00:00
ipnat_rules="/etc/ipnat.rules" # rules definition file for ipnat
ipnat_flags="" # additional flags for ipnat
second part of the patches to complete ipf changes to rc PR: multiple Submitted by: Arjan de Vet <devet@devet.org>
2001-11-24 15:36:30 +00:00
ipmon_enable="NO" # Set to YES for ipmon; needs ipfilter or ipnat
ipmon_program="/sbin/ipmon" # where the ipfilter monitor program lives
ipmon_flags="-Ds" # typically "-Ds" or "-D /var/log/ipflog"
Whitespace police. Submitted by: cjc, ru
2001-11-28 08:52:35 +00:00
ipfs_enable="NO" # Set to YES to enable saving and restoring
Put in place for using ipfs use on shutdown and startup. PR: 27070
2001-10-20 04:33:02 +00:00
# of state tables at shutdown and boot
ipfs_program="/sbin/ipfs" # where the ipfs program lives
second part of the patches to complete ipf changes to rc PR: multiple Submitted by: Arjan de Vet <devet@devet.org>
2001-11-24 15:36:30 +00:00
ipfs_flags="" # additional flags for ipfs
Add rc.d script for pf(4) (more to come once pflogd(8) works as well). Update defaults and write some lines for rc.conf(5) also. Mostly dup'ed from ipf Reviewed by: -current Approved by: bms(mentor)
2004-03-23 22:30:15 +00:00
pf_enable="NO" # Set to YES to enable packet filter (pf)
pf_rules="/etc/pf.conf" # rules definition file for pf
pf_program="/sbin/pfctl" # where the pfctl program lives
pf_flags="" # additional flags for pfctl
Add rc.d script to start pflogd and add rcvars etc. Also document vars in rc.conf(5) and put a sample entry to newsyslog.conf Reviewed by: -current Approved by: bms(mentor)
2004-04-02 19:25:27 +00:00
pflog_enable="NO" # Set to YES to enable packet filter logging
Fix typo in description of pflog_logfile. Submitted by: Mike Jakubik
2004-07-27 00:28:16 +00:00
pflog_logfile="/var/log/pflog" # where pflogd should store the logfile
Add rc.d script to start pflogd and add rcvars etc. Also document vars in rc.conf(5) and put a sample entry to newsyslog.conf Reviewed by: -current Approved by: bms(mentor)
2004-04-02 19:25:27 +00:00
pflog_program="/sbin/pflogd" # where the pflogd program lives
pflog_flags="" # additional flags for pflogd
I didn't fix the comment in rev 1.107.
2001-05-25 01:46:39 +00:00
tcp_extensions="YES" # Set to NO to turn off RFC1323 extensions.
Make the rc.conf(5) 'log_in_vain' knob an integer. Try this out in -CURRENT, MFC, and then consider dropping the 'log_in_vain' knob all together. It really is something for sysctl.conf(5). PR: bin/32953 Reviewed by: -bugs discussion MFC after: 1 week
2002-01-26 09:05:13 +00:00
log_in_vain="0" # >=1 to log connects to ports w/o listeners.
Use proper capitalization.
1999-08-14 03:42:27 +00:00
tcp_keepalive="YES" # Enable stale TCP connection timeout (or NO).
Remove reference to the TCP_RESTRICT_RST option, which was removed over a year ago. Small ws twiddle while I'm here.
2002-04-27 06:24:58 +00:00
# For the following option you need to have TCP_DROP_SYNFIN set in your
# kernel. Please refer to LINT and NOTES for details.
Add the net.inet.tcp.restrict_rst and net.inet.tcp.drop_synfin sysctl variables, conditional on the TCP_RESTRICT_RST and TCP_DROP_SYNFIN kernel options, respectively. See the comments in LINT for details.
1999-09-12 17:22:08 +00:00
tcp_drop_synfin="NO" # Set to YES to drop TCP packets with SYN+FIN
Fix misleading comment.
2000-05-18 19:02:47 +00:00
# NOTE: this violates the TCP specification
Remove reference to the TCP_RESTRICT_RST option, which was removed over a year ago. Small ws twiddle while I'm here.
2002-04-27 06:24:58 +00:00
icmp_drop_redirect="NO" # Set to YES to ignore ICMP REDIRECT packets
Add net.inet.icmp.log_redirect and net.inet.icmp.drop_redirect, for respectively logging and dropping ICMP REDIRECT packets. Note that there is no rate limiting on the log messages, so log_redirect should be used with caution (preferrably only for debugging purposes).
1999-08-10 09:45:33 +00:00
icmp_log_redirect="NO" # Set to YES to log ICMP REDIRECT packets
Tweak previous commit. Only sense the configuration if network_interfaces is set to "auto". Any network_interfaces settings will be treated as before.
1999-07-08 18:56:04 +00:00
network_interfaces="auto" # List of network interfaces (or "auto").
Add a new rc.conf variable, cloned_interfaces, to create cloned interfaces at boot.
2001-09-19 21:27:27 +00:00
cloned_interfaces="" # List of cloned network interfaces to create.
#cloned_interfaces="gif0 gif1 gif2 gif3" # Pre-cloning GENERIC config.
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
ifconfig_lo0="inet 127.0.0.1" # default loopback device configuration.
Neaten up some things which were inconsistent, add a few more flags to things which need them, general cleanup. Submitted by: Brian Somers <brian@awfulhak.org>
1997-05-19 07:46:51 +00:00
#ifconfig_lo0_alias0="inet 127.0.0.254 netmask 0xffffffff" # Sample alias entry.
Add a sample ifconfig entry for an IPX address family address, to give IPX folks a fighting chance of figuring this out themselves. I can't work out how to document this carefully in rc.conf(5), but this ought to close the PR. PR: 17904 Reported by: John Gelnaw <jeg@hawk.circa.ufl.edu>
2000-08-15 15:09:34 +00:00
#ifconfig_ed0_ipx="ipx 0x00010010" # Sample IPX address family entry.
Allow to change interfaces name on boot time. Now, one should be able to put something like this into /etc/rc.conf: ifconfig_fxp0_name="net0" ifconfig_net0="inet 10.0.0.1/16" Reviewed by: green
2004-10-30 13:44:06 +00:00
#ifconfig_fxp0_name="net0" # Change interface name from fxp0 to net0.
Add some special hooks for sppp(4) interfaces. In addition to the normal ifconfig stuff, one might need to pass down authentication parameters for them. This is closely tied to Hellmuth's impending rc patches for ISDN, but sppp can also be used separately (thus it doesn't go directly into the planned ISDN section of rc.conf). Reviewed by: hm
1999-01-13 17:32:37 +00:00
#
# If you have any sppp(4) interfaces above, you might also want to set
# the following parameters. Refer to spppcontrol(8) for their meaning.
sppp_interfaces="" # List of sppp interfaces.
#sppp_interfaces="isp0" # example: sppp over ISDN
#spppconfig_isp0="authproto=chap myauthname=foo myauthsecret='top secret' hisauthname=some-gw hisauthsecret='another secret'"
Move gif_interfaces from an IP6 option to a regular IP option. PR: 26543 Submitted by: Brooks Davis <brooks@one-eyed-alien.net> MFC after: 3 weeks
2001-06-03 12:26:56 +00:00
gif_interfaces="NO" # List of GIF tunnels (or "NO").
#gif_interfaces="gif0 gif1" # Examples typically for a router.
# Choose correct tunnel addrs.
#gifconfig_gif0="10.1.1.1 10.1.2.1" # Examples typically for a router.
#gifconfig_gif1="10.1.1.2 10.1.2.2" # Examples typically for a router.
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
we all like to 'Use' ppp, but this should be 'User' Pointed out by: dcs
1999-11-24 10:44:47 +00:00
# User ppp configuration.
Add a default ppp.conf (mode 600). Originally submitted by: Wayne Self <wself@cdrom.com> Allow a ppp startup option in rc.conf. Adjust sysinstall so that it appends to the end of ppp.conf and uses the generated profile to start ppp in auto mode on boot. Submitted by: Josef L. Karthauser <joe@uk.FreeBSD.org>
1999-07-26 10:49:37 +00:00
ppp_enable="NO" # Start user-ppp (or NO).
Use rc.subr PR: 72505 Submitted by: Amir Shalem <amir@active.ath.cx>
2004-12-15 12:39:28 +00:00
ppp_program="/usr/sbin/ppp" # Path to user-ppp program.
Add a default ppp.conf (mode 600). Originally submitted by: Wayne Self <wself@cdrom.com> Allow a ppp startup option in rc.conf. Adjust sysinstall so that it appends to the end of ppp.conf and uses the generated profile to start ppp in auto mode on boot. Submitted by: Josef L. Karthauser <joe@uk.FreeBSD.org>
1999-07-26 10:49:37 +00:00
ppp_mode="auto" # Choice of "auto", "ddial", "direct" or "dedicated".
# For details see man page for ppp(8). Default is auto.
ppp_alias -> ppp_nat Submitted by: Josef L. Karthauser <joe@FreeBSD.org.uk>
1999-08-22 23:26:05 +00:00
ppp_nat="YES" # Use PPP's internal network address translation or NO.
Add a default ppp.conf (mode 600). Originally submitted by: Wayne Self <wself@cdrom.com> Allow a ppp startup option in rc.conf. Adjust sysinstall so that it appends to the end of ppp.conf and uses the generated profile to start ppp in auto mode on boot. Submitted by: Josef L. Karthauser <joe@uk.FreeBSD.org>
1999-07-26 10:49:37 +00:00
ppp_profile="papchap" # Which profile to use from /etc/ppp/ppp.conf.
Allow a ppp_user specification to run ppp at startup PR: 20258
2000-08-10 00:13:02 +00:00
ppp_user="root" # Which user to run ppp as
Add a default ppp.conf (mode 600). Originally submitted by: Wayne Self <wself@cdrom.com> Allow a ppp startup option in rc.conf. Adjust sysinstall so that it appends to the end of ppp.conf and uses the generated profile to start ppp in auto mode on boot. Submitted by: Josef L. Karthauser <joe@uk.FreeBSD.org>
1999-07-26 10:49:37 +00:00
Bring in a hybrid of SunSoft's transport-independent RPC (TI-RPC) and associated changes that had to happen to make this possible as well as bugs fixed along the way. Bring in required TLI library routines to support this. Since we don't support TLI we've essentially copied what NetBSD has done, adding a thin layer to emulate direct the TLI calls into BSD socket calls. This is mostly from Sun's tirpc release that was made in 1994, however some fixes were backported from the 1999 release (supposedly only made available after this porting effort was underway). The submitter has agreed to continue on and bring us up to the 1999 release. Several key features are introduced with this update: Client calls are thread safe. (1999 code has server side thread safe) Updated, a more modern interface. Many userland updates were done to bring the code up to par with the recent RPC API. There is an update to the pthreads library, a function pthread_main_np() was added to emulate a function of Sun's threads library. While we're at it, bring in NetBSD's lockd, it's been far too long of a wait. New rpcbind(8) replaces portmap(8) (supporting communication over an authenticated Unix-domain socket, and by default only allowing set and unset requests over that channel). It's much more secure than the old portmapper. Umount(8), mountd(8), mount_nfs(8), nfsd(8) have also been upgraded to support TI-RPC and to support IPV6. Umount(8) is also fixed to unmount pathnames longer than 80 chars, which are currently truncated by the Kernel statfs structure. Submitted by: Martin Blapp <mb@imp.ch> Manpage review: ru Secure RPC implemented by: wpaul
2001-03-19 12:50:13 +00:00
### Network daemon (miscellaneous) ###
YAMF22
1997-04-28 10:14:45 +00:00
syslogd_enable="YES" # Run syslog daemon (or NO).
Introduce syslogd_program and inetd_program variables in case somebody wants to replace one of those programs. PR: 13609 Submitted by: Goran Lowkrantz <goran.lowkrantz@infologigruppen.se>
2001-06-28 03:32:10 +00:00
syslogd_program="/usr/sbin/syslogd" # path to syslogd, if you want a different one.
Make syslogd boot -s by default, which prevents Bad People from filling up your diskspace. PR: conf/15737 Submitted by: Kevin Day <toasty@dragondata.com> (PR) Nick Johnson <freebsd@spatula.net> (on -current)
2000-03-20 19:53:56 +00:00
syslogd_flags="-s" # Flags to syslogd (if enabled).
Change the defaults for portmap, sendmail and inetd to be not running them. Make sysinstall override this on install, so the effective behavioural change for a newly installed system is null. Overall, this makes a system with an empty /etc/rc.conf not run any network services, and makes the FreeBSD-provided network services that are running visible in /etc/rc.conf (instead of making people look through /etc/defaults/rc.conf to find the things they need to disable to secure the system.) Reviewed by: jhb Discussed with: The usual cabal
2000-07-28 22:45:36 +00:00
inetd_enable="NO" # Run the network daemon dispatcher (YES/NO).
Introduce syslogd_program and inetd_program variables in case somebody wants to replace one of those programs. PR: 13609 Submitted by: Goran Lowkrantz <goran.lowkrantz@infologigruppen.se>
2001-06-28 03:32:10 +00:00
inetd_program="/usr/sbin/inetd" # path to inetd, if you want a different one.
Add `-C 60' to the default flags for inetd, so that it is less vulnerable to run-of-the-mill DoS attacks in the default installation.
2003-09-15 16:44:24 +00:00
inetd_flags="-wW -C 60" # Optional flags to inetd
Take bind out of sandbox and run it as root again, but leave support mechanisms ('bind' user and group) in place so the feature can be easily turned on. There were too many complaints. The security(1) man page will be created/updated to include the appropriate info.
1998-12-19 07:25:56 +00:00
#
# named. It may be possible to run named in a sandbox, man security for
# details.
#
YAMF22
1997-04-28 10:14:45 +00:00
named_enable="NO" # Run named, the DNS server (or NO).
Consistently use full pathnames for files, especially executables. PR: conf/37292 Submitted by: Helge Oldach <send-pr@oldach.net> MFC after: 3 days
2002-04-21 08:32:35 +00:00
named_program="/usr/sbin/named" # path to named, if you want a different one.
1. Remove the named_rcng variable. Mike's caution in this area was a good thing, but we're ready to move on. 2. Remove the -g default argument in named_flags. It doesn't actually do what most users think it does, and what most users want it to do is already accomplished with a proper default group for the bind user, which we have. Also, the -g knob does something entirely different in BIND 9, which leads to a lot of needless confusion/aggravation. 3. In the rc.d script, don't bogusly override $command, or $rc_flags. Both are adequately handled in rc.conf[.local]. 4. DO properly override $rc_flags if user has named_chrootdir set. This may need to be revisited, but should be ok for now. 5. Protect all chrootdir-related bits under that variable, instead of named_rcng. There is more work to be done here, especially in the area of BIND 9 compatibility, but this is a start at least. Prompted in part by (legitmate) grousing from: kuriyama, Randy Bush
2004-03-14 19:10:06 +00:00
named_flags="-u bind" # Flags for named
For the default FreeBSD install, the file path actually is /var/run/named/pid. This is done so that named can start with -u bind and still dump a pid file in that directory, which is chowned to user bind.
2004-09-24 22:47:10 +00:00
named_pidfile="/var/run/named/pid" # Must set this in named.conf as well
Create a named chroot directory structure in /var/named, and use it by default when named is enabled. Also, improve our default directory layout by creating /var/named/etc/namedb/{master|slave} directories, and use the former for the generated localhost* files. Rather than using pax to copy device entries, mount devfs in the chroot directory. There may be some corner cases where things need to be adjusted, but overall this structure has been well tested on a production network, and should serve the needs of the vast majority of users. UPDATING has instructions on how to do the conversion for those with existing configurations.
2004-09-28 09:46:00 +00:00
named_chrootdir="/var/named" # Chroot directory (or "" not to auto-chroot it)
Add a couple of variables for rc.d Submitted by: Mike Makonnen
2002-06-13 22:27:31 +00:00
named_chroot_autoupdate="YES" # Automatically install/update chrooted
# components of named. See /etc/rc.d/named.
Add a note to indicate that the path set in named_pidfile must also be set in named.conf. Our default named.conf has this already. Update the note for named_symlink_enable to indicate that ndc is gone.
2004-09-24 04:45:16 +00:00
named_symlink_enable="YES" # Symlink the chrooted pid file
Take bind out of sandbox and run it as root again, but leave support mechanisms ('bind' user and group) in place so the feature can be easily turned on. There were too many complaints. The security(1) man page will be created/updated to include the appropriate info.
1998-12-19 07:25:56 +00:00
Upgraded launchpad for kerberos. Noe kerberos IV OR kerberos 5 may be started at boot for kerberos servers.
2001-07-28 19:57:57 +00:00
#
# kerberos. Do not run the admin daemons on slave servers
#
kerberos5_server_enable="NO" # Run a kerberos 5 master server (or NO).
kerberos5_server="/usr/libexec/kdc" # path to kerberos 5 KDC
kadmind5_server_enable="NO" # Run kadmind (or NO)
Change the name of the kadmind binary to match reality, now that KerberosIV is no longer an issue.
2003-04-30 20:42:41 +00:00
kadmind5_server="/usr/libexec/kadmind" # path to kerberos 5 admin daemon
Make the defaults for Kerberos 5 a little more up-to-date.
2003-04-30 20:58:49 +00:00
kpasswdd_server_enable="NO" # Run kpasswdd (or NO)
kpasswdd_server="/usr/libexec/kpasswdd" # path to kerberos 5 passwd daemon
Upgraded launchpad for kerberos. Noe kerberos IV OR kerberos 5 may be started at boot for kerberos servers.
2001-07-28 19:57:57 +00:00
YAMF22
1997-04-28 10:14:45 +00:00
rwhod_enable="NO" # Run the rwho daemon (or NO).
Allow rwhod to take flags. PR: 7705 Submitted by: Johan Karlsson <k@numeri.campus.luth.se>
1999-01-03 22:19:23 +00:00
rwhod_flags="" # Flags for rwhod
Bring in a hybrid of SunSoft's transport-independent RPC (TI-RPC) and associated changes that had to happen to make this possible as well as bugs fixed along the way. Bring in required TLI library routines to support this. Since we don't support TLI we've essentially copied what NetBSD has done, adding a thin layer to emulate direct the TLI calls into BSD socket calls. This is mostly from Sun's tirpc release that was made in 1994, however some fixes were backported from the 1999 release (supposedly only made available after this porting effort was underway). The submitter has agreed to continue on and bring us up to the 1999 release. Several key features are introduced with this update: Client calls are thread safe. (1999 code has server side thread safe) Updated, a more modern interface. Many userland updates were done to bring the code up to par with the recent RPC API. There is an update to the pthreads library, a function pthread_main_np() was added to emulate a function of Sun's threads library. While we're at it, bring in NetBSD's lockd, it's been far too long of a wait. New rpcbind(8) replaces portmap(8) (supporting communication over an authenticated Unix-domain socket, and by default only allowing set and unset requests over that channel). It's much more secure than the old portmapper. Umount(8), mountd(8), mount_nfs(8), nfsd(8) have also been upgraded to support TI-RPC and to support IPV6. Umount(8) is also fixed to unmount pathnames longer than 80 chars, which are currently truncated by the Kernel statfs structure. Submitted by: Martin Blapp <mb@imp.ch> Manpage review: ru Secure RPC implemented by: wpaul
2001-03-19 12:50:13 +00:00
rarpd_enable="NO" # Run rarpd (or NO).
rarpd_flags="" # Flags to rarpd.
Introduce bootparamd into the boot scripts. Add a bootparamd_enable and _flags to rc.conf Submitted by: John Hay <jhay@zibbi.icomtek.csir.co.za>
2002-09-05 20:14:46 +00:00
bootparamd_enable="NO" # Run bootparamd (or NO).
bootparamd_flags="" # Flags to bootparamd
Bring in a hybrid of SunSoft's transport-independent RPC (TI-RPC) and associated changes that had to happen to make this possible as well as bugs fixed along the way. Bring in required TLI library routines to support this. Since we don't support TLI we've essentially copied what NetBSD has done, adding a thin layer to emulate direct the TLI calls into BSD socket calls. This is mostly from Sun's tirpc release that was made in 1994, however some fixes were backported from the 1999 release (supposedly only made available after this porting effort was underway). The submitter has agreed to continue on and bring us up to the 1999 release. Several key features are introduced with this update: Client calls are thread safe. (1999 code has server side thread safe) Updated, a more modern interface. Many userland updates were done to bring the code up to par with the recent RPC API. There is an update to the pthreads library, a function pthread_main_np() was added to emulate a function of Sun's threads library. While we're at it, bring in NetBSD's lockd, it's been far too long of a wait. New rpcbind(8) replaces portmap(8) (supporting communication over an authenticated Unix-domain socket, and by default only allowing set and unset requests over that channel). It's much more secure than the old portmapper. Umount(8), mountd(8), mount_nfs(8), nfsd(8) have also been upgraded to support TI-RPC and to support IPV6. Umount(8) is also fixed to unmount pathnames longer than 80 chars, which are currently truncated by the Kernel statfs structure. Submitted by: Martin Blapp <mb@imp.ch> Manpage review: ru Secure RPC implemented by: wpaul
2001-03-19 12:50:13 +00:00
pppoed_enable="NO" # Run the PPP over Ethernet daemon.
pppoed_provider="*" # Provider and ppp(8) config file entry.
pppoed_flags="-P /var/run/pppoed.pid" # Flags to pppoed (if enabled).
pppoed_interface="fxp0" # The interface that pppoed runs on.
Whitespace police. Submitted by: cjc, ru
2001-11-28 08:52:35 +00:00
sshd_enable="NO" # Enable sshd
Bring in a hybrid of SunSoft's transport-independent RPC (TI-RPC) and associated changes that had to happen to make this possible as well as bugs fixed along the way. Bring in required TLI library routines to support this. Since we don't support TLI we've essentially copied what NetBSD has done, adding a thin layer to emulate direct the TLI calls into BSD socket calls. This is mostly from Sun's tirpc release that was made in 1994, however some fixes were backported from the 1999 release (supposedly only made available after this porting effort was underway). The submitter has agreed to continue on and bring us up to the 1999 release. Several key features are introduced with this update: Client calls are thread safe. (1999 code has server side thread safe) Updated, a more modern interface. Many userland updates were done to bring the code up to par with the recent RPC API. There is an update to the pthreads library, a function pthread_main_np() was added to emulate a function of Sun's threads library. While we're at it, bring in NetBSD's lockd, it's been far too long of a wait. New rpcbind(8) replaces portmap(8) (supporting communication over an authenticated Unix-domain socket, and by default only allowing set and unset requests over that channel). It's much more secure than the old portmapper. Umount(8), mountd(8), mount_nfs(8), nfsd(8) have also been upgraded to support TI-RPC and to support IPV6. Umount(8) is also fixed to unmount pathnames longer than 80 chars, which are currently truncated by the Kernel statfs structure. Submitted by: Martin Blapp <mb@imp.ch> Manpage review: ru Secure RPC implemented by: wpaul
2001-03-19 12:50:13 +00:00
sshd_program="/usr/sbin/sshd" # path to sshd, if you want a different one.
Whitespace police. Submitted by: cjc, ru
2001-11-28 08:52:35 +00:00
sshd_flags="" # Additional flags for sshd.
Bring in a hybrid of SunSoft's transport-independent RPC (TI-RPC) and associated changes that had to happen to make this possible as well as bugs fixed along the way. Bring in required TLI library routines to support this. Since we don't support TLI we've essentially copied what NetBSD has done, adding a thin layer to emulate direct the TLI calls into BSD socket calls. This is mostly from Sun's tirpc release that was made in 1994, however some fixes were backported from the 1999 release (supposedly only made available after this porting effort was underway). The submitter has agreed to continue on and bring us up to the 1999 release. Several key features are introduced with this update: Client calls are thread safe. (1999 code has server side thread safe) Updated, a more modern interface. Many userland updates were done to bring the code up to par with the recent RPC API. There is an update to the pthreads library, a function pthread_main_np() was added to emulate a function of Sun's threads library. While we're at it, bring in NetBSD's lockd, it's been far too long of a wait. New rpcbind(8) replaces portmap(8) (supporting communication over an authenticated Unix-domain socket, and by default only allowing set and unset requests over that channel). It's much more secure than the old portmapper. Umount(8), mountd(8), mount_nfs(8), nfsd(8) have also been upgraded to support TI-RPC and to support IPV6. Umount(8) is also fixed to unmount pathnames longer than 80 chars, which are currently truncated by the Kernel statfs structure. Submitted by: Martin Blapp <mb@imp.ch> Manpage review: ru Secure RPC implemented by: wpaul
2001-03-19 12:50:13 +00:00
Clean up some variables that should have been done before: xntpd_* -> ntpd_* portmap_* -> rpcbind_* Also change single_mountd_enable to mountd_enable. We also include shims for all the old variable names. Submitted by: Mike Makonnen <makonnen@pacbell.net>
2002-08-14 05:37:15 +00:00
### Network daemon (NFS): All need rpcbind_enable="YES" ###
YAMF22
1997-04-28 10:14:45 +00:00
amd_enable="NO" # Run amd service with $amd_flags (or NO).
Remove our override on the default time that a looked up name remains cached when not in use. This changes the FreeBSD default from 30 minutes to 5 minutes. JKH was the one that added the override to amd_flags, but there was no reason given other to serve as an example of what could be done.
2000-09-01 01:08:52 +00:00
amd_flags="-a /.amd_mnt -l syslog /host /etc/amd.map /net /etc/amd.map"
Jean-Simon Pendry's paper on amd refers to the use of "ypcat -k" against the "master map" to get the list of mount point/amd map correspondences, and using that list as command-line arguments to start amd. When I tried to do this with the existing /etc/rc* scripts, I found that I couldn't do this by modifying only /etc/rc.conf: that file gets sourced very early by /etc/rc, well before any networking functionality is present, let alone NIS. Further, I wasn't able to figure out a way to use various levels & types of quoting to defer evaluation of the string to a point subsequent to NIS initialization. As a result, I resorted to hacking /etc/rc.network -- but I did it in a way that ought to be reasonably general, and avoid breakage for anyone else. PR: 6387 Reviewed by: phk Submitted by: David Wolfskill <dhw@whistle.com>
1998-04-26 06:32:13 +00:00
amd_map_program="NO" # Can be set to "ypcat -k amd.master"
YAMF22
1997-04-28 10:14:45 +00:00
nfs_client_enable="NO" # This host is an NFS client (or NO).
Don't suggest that NO is allowed here; you use "0" or "" to turn the cache off. Submitted by: jdp
1998-11-25 21:16:43 +00:00
nfs_access_cache="2" # Client cache timeout in seconds
YAMF22
1997-04-28 10:14:45 +00:00
nfs_server_enable="NO" # This host is an NFS server (or NO).
Don't give examples or use the depreciated usage to nfsd PR: 5635
1998-05-01 13:45:04 +00:00
nfs_server_flags="-u -t -n 4" # Flags to nfsd (if enabled).
Clean up some variables that should have been done before: xntpd_* -> ntpd_* portmap_* -> rpcbind_* Also change single_mountd_enable to mountd_enable. We also include shims for all the old variable names. Submitted by: Mike Makonnen <makonnen@pacbell.net>
2002-08-14 05:37:15 +00:00
mountd_enable="NO" # Run mountd (or NO).
Make mountd use -r by default. Hopefully this will cut down the number of complaints that FreeBSD's mountd doesn't allow mounting of swap files for OSes like SunOS, NetBSD and OpenBSD. Submitted by: Joerg Wunsch
1997-10-12 20:37:20 +00:00
mountd_flags="-r" # Flags to mountd (if NFS server enabled).
Add weak_mountd_authentication, which is examined in /etc/rc.network. Setting this to YES instead of its default NO, causes mountd to be passed the -n flag, which allow non-root users mount requests to be served.
2000-07-23 11:31:09 +00:00
weak_mountd_authentication="NO" # Allow non-root mount requests to be served.
YAMF22
1997-04-28 10:14:45 +00:00
nfs_reserved_port_only="NO" # Provide NFS only on secure port (or NO).
/etc/rc.network isn't built to handle a value of "DEFAULT" (nor should it be). Using that string leads rc.network to execute: # sysctl -w vfs.nfs.bufpackets=DEFAULT vfs.nfs.bufpackets: 4 -> 0 Which isn't what was intended. PR: conf/31280 MFC after: 3 days
2003-02-08 20:55:56 +00:00
nfs_bufpackets="" # bufspace (in packets) for client
Update to note that rpc.statd and rpc.lockd are now needed for client side NFS mounts. Stumbled upon by: rwatson
2001-10-18 19:37:57 +00:00
rpc_lockd_enable="NO" # Run NFS rpc.lockd needed for client/server.
rpc_statd_enable="NO" # Run NFS rpc.statd needed for client/server.
Clean up some variables that should have been done before: xntpd_* -> ntpd_* portmap_* -> rpcbind_* Also change single_mountd_enable to mountd_enable. We also include shims for all the old variable names. Submitted by: Mike Makonnen <makonnen@pacbell.net>
2002-08-14 05:37:15 +00:00
rpcbind_enable="NO" # Run the portmapper service (YES/NO).
rpcbind_program="/usr/sbin/rpcbind" # path to rpcbind, if you want a different one.
rpcbind_flags="" # Flags to rpcbind (if enabled).
Enable the SecureRPC bits in rc.conf, if the Administrator wants them.
1998-04-12 09:47:43 +00:00
rpc_ypupdated_enable="NO" # Run if NIS master and SecureRPC (or NO).
keyserv_enable="NO" # Run the SecureRPC keyserver (or NO).
keyserv_flags="" # Flags to keyserv (if enabled).
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
### Network Time Services options: ###
timed_enabled -> timed_enable Submitted by: "James D. Stewart" <jds@c4systm.com>
1997-06-02 02:58:08 +00:00
timed_enable="NO" # Run the time daemon (or NO).
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
timed_flags="" # Flags to timed (if enabled).
Bring back etc/rc.d/ntpdate as requested by scads of people. This isn't a complete backout as the ntpd_sync_on_start etc/rc.conf tunable is still present, though the default is now NO (was YES). Since we're no longer syncing time at startup by default when ntpd is enabled (as was the case 24hrs ago), remove UPDATING entry pointing out that ntpd(1) -g is slower than ntpdate(1). Hopefully ntpd_sync_on_start="YES" can be made the default for -CURRENT after 5.3 is cut. At the very least, this should be set to YES when a user requests to have ntpd enabled via sysinstall(1). Requested by: many
2004-09-15 01:08:33 +00:00
ntpdate_enable="NO" # Run ntpdate to sync time on boot (or NO).
ntpdate_program="/usr/sbin/ntpdate" # path to ntpdate, if you want a different one.
ntpdate_flags="-b" # Flags to ntpdate (if enabled).
Clean up some variables that should have been done before: xntpd_* -> ntpd_* portmap_* -> rpcbind_* Also change single_mountd_enable to mountd_enable. We also include shims for all the old variable names. Submitted by: Mike Makonnen <makonnen@pacbell.net>
2002-08-14 05:37:15 +00:00
ntpd_enable="NO" # Run ntpd Network Time Protocol (or NO).
ntpd_program="/usr/sbin/ntpd" # path to ntpd, if you want a different one.
Bring back etc/rc.d/ntpdate as requested by scads of people. This isn't a complete backout as the ntpd_sync_on_start etc/rc.conf tunable is still present, though the default is now NO (was YES). Since we're no longer syncing time at startup by default when ntpd is enabled (as was the case 24hrs ago), remove UPDATING entry pointing out that ntpd(1) -g is slower than ntpdate(1). Hopefully ntpd_sync_on_start="YES" can be made the default for -CURRENT after 5.3 is cut. At the very least, this should be set to YES when a user requests to have ntpd enabled via sysinstall(1). Requested by: many
2004-09-15 01:08:33 +00:00
ntpd_sync_on_start="NO" # Sync time on ntpd startup, even if offset is high
Default ntpd to write a "driftfile" in /var/db/ntpd.drift. A "driftfile" caches the oscillator offset estimate from boot to boot, having this means faster and less bumpy time synchronization. Will be overridden by any value in the config file.
2003-10-03 21:33:40 +00:00
ntpd_flags="-p /var/run/ntpd.pid -f /var/db/ntpd.drift"
# Flags to ntpd (if enabled).
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
Clean up some variables that should have been done before: xntpd_* -> ntpd_* portmap_* -> rpcbind_* Also change single_mountd_enable to mountd_enable. We also include shims for all the old variable names. Submitted by: Mike Makonnen <makonnen@pacbell.net>
2002-08-14 05:37:15 +00:00
# Network Information Services (NIS) options: All need rpcbind_enable="YES" ###
Add missing '.'
1997-06-24 22:36:42 +00:00
nis_client_enable="NO" # We're an NIS client (or NO).
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
nis_client_flags="" # Flags to ypbind (if enabled).
YAMF22
1997-04-28 10:14:45 +00:00
nis_ypset_enable="NO" # Run ypset at boot time (or NO).
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
nis_ypset_flags="" # Flags to ypset (if enabled).
Add missing '.'
1997-06-24 22:36:42 +00:00
nis_server_enable="NO" # We're an NIS server (or NO).
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
nis_server_flags="" # Flags to ypserv (if enabled).
YAMF22
1997-04-28 10:14:45 +00:00
nis_ypxfrd_enable="NO" # Run rpc.ypxfrd at boot time (or NO).
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
nis_ypxfrd_flags="" # Flags to rpc.ypxfrd (if enabled).
Correct typo in NIS flags. PR: 3503 Submitted by: Christoph Kukulies <kuku@blues.physik.rwth-aachen.de>
1997-05-05 09:32:34 +00:00
nis_yppasswdd_enable="NO" # Run rpc.yppasswdd at boot time (or NO).
nis_yppasswdd_flags="" # Flags to rpc.yppasswdd (if enabled).
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
### Network routing options: ###
YAMF22
1997-04-28 10:14:45 +00:00
defaultrouter="NO" # Set to default gateway (or NO).
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
static_routes="" # Set to static route list (or leave empty).
Now that routes for IP over ATM may look much more complex than before, use the atmconfig(8) utility instead of route(8) to install those routes. For this we need a new rc.conf variable natm_static_routes that works just like static_routes except that the referenced routes use the syntax of atmconfig(8). Okay'ed by: mtm
2003-08-14 15:27:32 +00:00
natm_static_routes="" # Set to static route list for NATM (or leave empty).
YAMF22
1997-04-28 10:14:45 +00:00
gateway_enable="NO" # Set to YES if this host will be a gateway.
I'm not sure how/when router_enable got set to YES, but it doesn't seem right to me. Noticed by: jkb
1998-09-23 04:42:02 +00:00
router_enable="NO" # Set to YES to enable a routing daemon.
Consistently use full pathnames for files, especially executables. PR: conf/37292 Submitted by: Helge Oldach <send-pr@oldach.net> MFC after: 3 days
2002-04-21 08:32:35 +00:00
router="/sbin/routed" # Name of routing daemon to use if enabled.
YAMF22
1997-04-28 10:14:45 +00:00
router_flags="-q" # Flags for routing daemon.
Add missing '.'
1997-06-24 22:36:42 +00:00
mrouted_enable="NO" # Do multicast routing (see /etc/mrouted.conf).
Add "mrouted_flags". It has been referenced by rc.network for a long time.
1997-10-31 01:58:53 +00:00
mrouted_flags="" # Flags for multicast routing daemon.
YAMF22
1997-04-28 10:14:45 +00:00
ipxgateway_enable="NO" # Set to YES to enable IPX routing.
ipxrouted_enable="NO" # Set to YES to run the IPX routing daemon.
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
ipxrouted_flags="" # Flags for IPX routing daemon.
Whitespace police. Submitted by: cjc, ru
2001-11-28 08:52:35 +00:00
arpproxy_all="NO" # replaces obsolete kernel option ARP_PROXYALL.
Cosmetic MF2.2: Add a missing (commented) parenthesis.
1998-08-10 19:53:22 +00:00
forward_sourceroute="NO" # do source routing (only if gateway_enable is set to "YES")
Add 2 new rc.conf variables: forward_sourceroute : controls setting of existing net.inet.ip.sourceroute accept_sourceroute : control setting of new net.inet.ip.accept_sourceroute
1998-02-16 19:21:32 +00:00
accept_sourceroute="NO" # accept source routed packets to us
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
Here are some scripts and man pages for configuring HARP ATM interfaces. Reviewed by: phk Submitted by: Mike Spengler <mks@networkcs.com>
1998-10-06 19:24:31 +00:00
### ATM interface options: ###
atm_enable="NO" # Configure ATM interfaces (or NO).
#atm_netif_hea0="atm 1" # Network interfaces for physical interface.
#atm_sigmgr_hea0="uni31" # Signalling manager for physical interface.
#atm_prefix_hea0="ILMI" # NSAP prefix (UNI interfaces only) (or ILMI).
#atm_macaddr_hea0="NO" # Override physical MAC address (or NO).
#atm_arpserver_atm0="0x47.0005.80.999999.9999.9999.9999.999999999999.00" # ATMARP server address (or local).
#atm_scsparp_atm0="NO" # Run SCSP/ATMARP on network interface (or NO).
atm_pvcs="" # Set to PVC list (or leave empty).
atm_arps="" # Set to permanent ARP list (or leave empty).
change the default for isdn_fsdev to NO. specifying a device here results in a potential conflict with a getty running on that device. PR: 26818 Submitted by: Clement Ballabriga <clement@asso.ups-tlse.fr>
2001-07-23 14:24:31 +00:00
### ISDN interface options: (see also: /usr/share/examples/isdn) ###
Integrate the ISDN subsystem into the /etc/rc framework Reviewed by: Joerg Wunsch
1999-01-13 08:20:55 +00:00
isdn_enable="NO" # Enable the ISDN subsystem (or NO).
change the default for isdn_fsdev to NO. specifying a device here results in a potential conflict with a getty running on that device. PR: 26818 Submitted by: Clement Ballabriga <clement@asso.ups-tlse.fr>
2001-07-23 14:24:31 +00:00
isdn_fsdev="NO" # Output device for fullscreen mode (or NO for daemon mode).
Integrate the ISDN subsystem into the /etc/rc framework Reviewed by: Joerg Wunsch
1999-01-13 08:20:55 +00:00
isdn_flags="-dn -d0x1f9" # Flags for isdnd
Add isdn_ttype (moved to rc.conf from rc.isdn) PR: conf/24865 Submitted by: schweikh Reviewed by: hm
2001-04-24 20:02:31 +00:00
isdn_ttype="cons25" # terminal type for fullscreen mode
New option isdn_screenflags to set the syscons screen params for isdnd, plus documentation. Submitted by: Alexander Leidinger <Alexander@Leidinger.net> Not objected to by: hm MFC after: 1 week
2001-05-14 20:51:10 +00:00
isdn_screenflags="NO" # screenflags for ${isdn_fsdev}
Integrate the ISDN subsystem into the /etc/rc framework Reviewed by: Joerg Wunsch
1999-01-13 08:20:55 +00:00
isdn_trace="NO" # Enable the ISDN trace subsystem (or NO).
isdn_traceflags="-f /var/tmp/isdntrace0" # Flags for isdntrace
Turn off replies to ICMP echo requests for broadcast and multicast addresses by default. Add a knob "icmp_bmcastecho" to "rc.network" to allow this behaviour to be controlled from "rc.conf". Document the controlling sysctl variable "net.inet.icmp.bmcastecho" in sysctl(3). Reviewed by: dg, jkh Reminded on -hackers by: Steinar Haug <sthaug@nethelp.no>
1998-09-15 10:49:03 +00:00
### Miscellaneous network options: ###
icmp_bmcastecho="NO" # respond to broadcast ping packets
Add IPv6 configuration scripts. Initial version created by, and kindly much tested by: bmah@CA.Sandia.GOV (Bruce A. Mah) Approved by: jkh Reviewed by: bmah@CA.Sandia.GOV (Bruce A. Mah), Ollivier Robert <roberto@keltia.freenix.fr> Obtained from: KAME project
2000-02-23 18:05:58 +00:00
### IPv6 options: ###
ipv6_enable="NO" # Set to YES to set up for IPv6.
ipv6_network_interfaces="auto" # List of network interfaces (or "auto").
- ipv6_prefix_* and ipv6_ifconfig_* work for end node - rtsol should be work for only one interface - new variable ipv6_defaultrouter is added - option name of rtadvd in comment are corrected - ipv6_firewall_enable, ipv6_firewall_type, ipv6_firewall_script, ipv6_firewall_logging are added to introduce rc.firewall6. IPv6 firewall rule is just starting point and should be brushed up. This commit includes PR18621, PR21694, PR22051. PR: conf/18621, conf/21694, conf/22051 Reviewed by: asmodai
2000-10-29 19:59:05 +00:00
ipv6_defaultrouter="NO" # Set to IPv6 default gateway (or NO).
Add a commented-out defaultrouter entry for 6to4 users. See RFC-3068
2001-12-06 20:44:14 +00:00
#ipv6_defaultrouter="2002:c058:6301::" # Use this for 6to4 (RFC 3068)
IPv6 related configuration updates. - 6to4(stf) interface configuration. - Static route configuration. - Comment additions. - Replaced a still existed '@' to '%' in IPv6 scoped addr format. (This became necessary as previous IPv6 scoped addr format change.) Much thanks to ume, who helped me reviewing, testing, and finding problems with these changes. Approved by: jkh Reviewed by: ume
2000-03-12 20:35:54 +00:00
ipv6_static_routes="" # Set to static route list (or leave empty).
#ipv6_static_routes="xxx" # An example to set fec0:0000:0000:0006::/64
# route toward loopback interface.
#ipv6_route_xxx="fec0:0000:0000:0006:: -prefixlen 64 ::1"
Add IPv6 configuration scripts. Initial version created by, and kindly much tested by: bmah@CA.Sandia.GOV (Bruce A. Mah) Approved by: jkh Reviewed by: bmah@CA.Sandia.GOV (Bruce A. Mah), Ollivier Robert <roberto@keltia.freenix.fr> Obtained from: KAME project
2000-02-23 18:05:58 +00:00
ipv6_gateway_enable="NO" # Set to YES if this host will be a gateway.
ipv6_router_enable="NO" # Set to YES to enable an IPv6 routing daemon.
ipv6_router="/usr/sbin/route6d" # Name of IPv6 routing daemon.
ipv6_router_flags="" # Flags to IPv6 routing daemon.
#ipv6_router_flags="-l" # Example for route6d with only IPv6 site local
# addrs.
be able to configure to run an IPv6 routing daemon even on an end node. Requested by: Masachika ISHIZUKA <ishizuka@ish.org> MFC after: 1 week
2002-07-18 05:00:16 +00:00
#ipv6_router_flags="-q" # If you want to run a routing daemon on an end
# node, you should stop advertisement.
- ipv6_prefix_* and ipv6_ifconfig_* work for end node - rtsol should be work for only one interface - new variable ipv6_defaultrouter is added - option name of rtadvd in comment are corrected - ipv6_firewall_enable, ipv6_firewall_type, ipv6_firewall_script, ipv6_firewall_logging are added to introduce rc.firewall6. IPv6 firewall rule is just starting point and should be brushed up. This commit includes PR18621, PR21694, PR22051. PR: conf/18621, conf/21694, conf/22051 Reviewed by: asmodai
2000-10-29 19:59:05 +00:00
#ipv6_network_interfaces="ed0 ep0" # Examples for router
# or static configuration for end node.
Add IPv6 configuration scripts. Initial version created by, and kindly much tested by: bmah@CA.Sandia.GOV (Bruce A. Mah) Approved by: jkh Reviewed by: bmah@CA.Sandia.GOV (Bruce A. Mah), Ollivier Robert <roberto@keltia.freenix.fr> Obtained from: KAME project
2000-02-23 18:05:58 +00:00
# Choose correct prefix value.
#ipv6_prefix_ed0="fec0:0000:0000:0001 fec0:0000:0000:0002" # Examples for rtr.
#ipv6_prefix_ep0="fec0:0000:0000:0003 fec0:0000:0000:0004" # Examples for rtr.
Add `ipv6_ifconfig_IFN_aliasN' directive to allow multiple aliases. PR: conf/24239
2001-03-18 16:07:21 +00:00
#ipv6_ifconfig_ed0="fec0:0:0:5::1 prefixlen 64" # Sample manual assign entry
#ipv6_ifconfig_ed0_alias0="fec0:0:0:5::2 prefixlen 64" # Sample alias entry.
Change default of ipv6_default_interface to NO. This is meaningless in most cases and rather harmful. Reported by: Kevin Oberman <oberman@es.net> MFC after: 1 week
2001-06-28 21:45:47 +00:00
ipv6_default_interface="NO" # Default output interface for scoped addrs.
Add IPv6 configuration scripts. Initial version created by, and kindly much tested by: bmah@CA.Sandia.GOV (Bruce A. Mah) Approved by: jkh Reviewed by: bmah@CA.Sandia.GOV (Bruce A. Mah), Ollivier Robert <roberto@keltia.freenix.fr> Obtained from: KAME project
2000-02-23 18:05:58 +00:00
# Now this works only for IPv6 link local
# multicast addrs.
add rtsol_flags. MFC after: 1 week
2003-08-08 17:43:58 +00:00
rtsol_flags="" # Flags to IPv6 router solicitation.
Change default value of rtadvd_enable to NO to be compatible with the following description in RFC2461: AdvSendAdvertisements A flag indicating whether or not the router sends periodic Router Advertisements and responds to Router Solicitations. Default: FALSE Note that AdvSendAdvertisements MUST be FALSE by default so that a node will not accidentally start acting as a router unless it is explicitly configured by system management to send Router Advertisements. Submitted by: JINMEI Tatuya <jinmei@isl.rdc.toshiba.co.jp> MFC after: 1 week
2001-06-20 13:17:07 +00:00
rtadvd_enable="NO" # Set to YES to enable an IPv6 router
IPv6 related configuration updates. - 6to4(stf) interface configuration. - Static route configuration. - Comment additions. - Replaced a still existed '@' to '%' in IPv6 scoped addr format. (This became necessary as previous IPv6 scoped addr format change.) Much thanks to ume, who helped me reviewing, testing, and finding problems with these changes. Approved by: jkh Reviewed by: ume
2000-03-12 20:35:54 +00:00
# advertisement daemon. If set to YES,
# this router becomes a possible candidate
# IPv6 default router for local subnets.
Mention about rtadvd_interfaces. It should be specified if you want use rtadvd.
2001-01-25 13:05:50 +00:00
rtadvd_interfaces="" # Interfaces rtadvd sends RA packets.
Add IPv6 configuration scripts. Initial version created by, and kindly much tested by: bmah@CA.Sandia.GOV (Bruce A. Mah) Approved by: jkh Reviewed by: bmah@CA.Sandia.GOV (Bruce A. Mah), Ollivier Robert <roberto@keltia.freenix.fr> Obtained from: KAME project
2000-02-23 18:05:58 +00:00
mroute6d_enable="NO" # Do IPv6 multicast routing.
We don't ship pim6dd/pim6sd any more. MFC after: 1 week
2001-10-03 16:15:59 +00:00
mroute6d_program="/usr/local/sbin/pim6dd" # Name of IPv6 multicast
# routing daemon. You need to
# install it from package or
# port.
Add IPv6 configuration scripts. Initial version created by, and kindly much tested by: bmah@CA.Sandia.GOV (Bruce A. Mah) Approved by: jkh Reviewed by: bmah@CA.Sandia.GOV (Bruce A. Mah), Ollivier Robert <roberto@keltia.freenix.fr> Obtained from: KAME project
2000-02-23 18:05:58 +00:00
mroute6d_flags="" # Flags to IPv6 multicast routing daemon.
IPv6 related configuration updates. - 6to4(stf) interface configuration. - Static route configuration. - Comment additions. - Replaced a still existed '@' to '%' in IPv6 scoped addr format. (This became necessary as previous IPv6 scoped addr format change.) Much thanks to ume, who helped me reviewing, testing, and finding problems with these changes. Approved by: jkh Reviewed by: ume
2000-03-12 20:35:54 +00:00
stf_interface_ipv4addr="" # Local IPv4 addr for 6to4 IPv6 over IPv4
# tunneling interface. Specify this entry
# to enable 6to4 interface.
stf_interface_ipv4plen="0" # Prefix length for 6to4 IPv4 addr,
# to limit peer addr range. Effective value
# is 0-31.
stf_interface_ipv6_ifid="0:0:0:1" # IPv6 interface id for stf0.
# If you like, you can set "AUTO" for this.
stf_interface_ipv6_slaid="0000" # IPv6 Site Level Aggregator for stf0
Add configuration for a FAITH IPv6-to-IPv4 TCP translator. To use a FAITH actually, you also need faithd(8) setup. Please consult faithd(8) manpage.
2001-06-19 19:27:51 +00:00
ipv6_faith_prefix="NO" # Set faith prefix to enable a FAITH
# IPv6-to-IPv4 TCP translator. You also need
# faithd(8) setup.
Change the default setting of an IPv4-mapped IPv6 address to off. Requested by: many people
2002-07-25 15:44:01 +00:00
ipv6_ipv4mapping="NO" # Set to "YES" to enable IPv4 mapped IPv6 addr
Add a configuration options which enable/disable IPv4 mapped IPv6 addr support. Suggested and Reviewed by: ume
2000-03-28 17:39:53 +00:00
# communication. (like ::ffff:a.b.c.d)
- ipv6_prefix_* and ipv6_ifconfig_* work for end node - rtsol should be work for only one interface - new variable ipv6_defaultrouter is added - option name of rtadvd in comment are corrected - ipv6_firewall_enable, ipv6_firewall_type, ipv6_firewall_script, ipv6_firewall_logging are added to introduce rc.firewall6. IPv6 firewall rule is just starting point and should be brushed up. This commit includes PR18621, PR21694, PR22051. PR: conf/18621, conf/21694, conf/22051 Reviewed by: asmodai
2000-10-29 19:59:05 +00:00
ipv6_firewall_enable="NO" # Set to YES to enable IPv6 firewall
# functionality
ipv6_firewall_script="/etc/rc.firewall6" # Which script to run to set up the IPv6 firewall
ipv6_firewall_type="UNKNOWN" # IPv6 Firewall type (see /etc/rc.firewall6)
ipv6_firewall_quiet="NO" # Set to YES to suppress rule display
ipv6_firewall_logging="NO" # Set to YES to enable events logging
ipv6_firewall_flags="" # Flags passed to ip6fw when type is a file
Add IPv6 setup for ipfilter. `ipv6_ipfilter_rules' was added to specify rules definition file for ipfilter. The default is /etc/ipf6.rules. If there is a file which is specified by 'ipv6_ipfilter_rules', IPv6 rule is installed. Reviewed by: Ronald van der Pol <Ronald.vanderPol@rvdp.org> MFC after: 1 week
2002-11-02 08:21:26 +00:00
ipv6_ipfilter_rules="/etc/ipf6.rules" # rules definition file for ipfilter,
# see /usr/src/contrib/ipfilter/rules
# for examples
fix typo in comment in my previous commit.
2004-06-02 09:58:18 +00:00
ip6addrctl_enable="NO" # Set to YES to enable default address selection
Add ip6addrctl_enable and ip6_addrctl_verbose option. If ip6addrctl_enable is set to YES, address selection policy is installed into kernel. If there is /etc/ip6addrctl.conf, it is used for address selection policy. Even if there is no /etc/ip6addrctl.conf, we install default policy. In this case, if ipv6_enable is set to YES, we use address selection policy described in RFC 3484 as default. Otherwise, we install priority policy for IPv4 address. The default of ip6addrctl_enable is NO for now. However, it may better to enable it by default.
2004-06-02 09:39:49 +00:00
ip6addrctl_verbose="NO" # Set to YES to enable verbose configuration messages
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
##############################################################
### System console options #################################
##############################################################
Allow setting the system console keyboard via the ${keyboard} rc.conf directive.
2004-06-18 20:09:30 +00:00
keyboard="" # keyboard device to use (default /dev/kbd0).
YAMF22
1997-04-28 10:14:45 +00:00
keymap="NO" # keymap in /usr/share/syscons/keymaps/* (or NO).
keyrate="NO" # keyboard rate to: slow, normal, fast (or NO).
Make it more clear how to disable keybell, and where its options are found. PR: conf/41772
2003-03-15 08:14:42 +00:00
keybell="NO" # See kbdcontrol(1) for options. Use "off" to disable.
YAMF22
1997-04-28 10:14:45 +00:00
keychange="NO" # function keys default values (or NO).
cursor="NO" # cursor type {normal|blink|destructive} (or NO).
scrnmap="NO" # screen map in /usr/share/syscons/scrnmaps/* (or NO).
font8x16="NO" # font 8x16 from /usr/share/syscons/fonts/* (or NO).
font8x14="NO" # font 8x14 from /usr/share/syscons/fonts/* (or NO).
font8x8="NO" # font 8x8 from /usr/share/syscons/fonts/* (or NO).
Use a default blanktime (otherwise it shows up as "NO" in sysinstall's menus).
1998-06-23 03:09:26 +00:00
blanktime="300" # blank time (in seconds) or "NO" to turn it off.
Correct path for saver to reflect reality. Submitted by: Martin Faxer <gmh003532@brfmasthugget.se>
2002-04-06 18:02:52 +00:00
saver="NO" # screen saver: Uses /boot/kernel/${saver}_saver.ko
Do a better job of supporting more than one mouse device on the system. To start/stop/check on a specific device give the device name as the second argument to the script: # /etc/rc.d/moused start ums0 To use different rc.conf(5) knobs with different mice use the device name as part of the knob. For example, if the mouse device is ums0, then: moused_ums0_enable=yes moused_ums0_flags="-z 4" moused_ums0_port="/dev/ums0" Starting rc.d/moused without the device argument will use the standard moused_* flags. So, this commit should not disrupt or change current usage. To preserve current behaviour with respect to usb mice, which appear automatically when inserted, there is a new knob, moused_nondefault_enable, which will treat any devices without rc.conf knobs as enabled. To minimize knobs in /etc/rc.conf, the device file and pid file are auto-computed, so that in the typical case for a usb mouse you don't need to add anything extra in /etc/rc.conf to get it working. Additionally, this updates /etc/usbd.conf to use the rc.d/moused script so people don't have to modify it to configure their usb mouse anymore. MFC after: 1 month
2004-11-01 18:05:41 +00:00
moused_nondefault_enable="YES" # Treat non-default mice as enabled unless
# specifically overriden in rc.conf(5).
New moused flag. Submitted by: Kazutaka YOKOTA <yokota@zodiac.mech.utsunomiya-u.ac.jp>
1998-03-07 09:02:08 +00:00
moused_enable="NO" # Run the mouse daemon.
moused_type="auto" # See man page for rc.conf(5) for available settings.
Whitespace police. Submitted by: cjc, ru
2001-11-28 08:52:35 +00:00
moused_port="/dev/psm0" # Set to your mouse port.
Neaten up some things which were inconsistent, add a few more flags to things which need them, general cleanup. Submitted by: Brian Somers <brian@awfulhak.org>
1997-05-19 07:46:51 +00:00
moused_flags="" # Any additional flags to moused.
Fixed two typos in comments.
2002-11-15 08:26:36 +00:00
mousechar_start="NO" # if 0xd0-0xd3 default range is occupied in your
Add mousechar_start hook Reviewed by: Nick Hibma <n_hibma@qubesoft.com>
2001-04-19 14:53:47 +00:00
# language code table, specify alternative range
# start like mousechar_start=3, see vidcontrol(1)
Cosmetique changes in vidcontrol all screens knob
1998-04-02 15:33:49 +00:00
allscreens_flags="" # Set this vidcontrol mode for all virtual screens
Add an allscreens_kbdflags option. Same thing as allscreens_flags, but runs kbdcontrol instead of vidcontrol. Reviewed by: ru
2001-04-28 20:56:53 +00:00
allscreens_kbdflags="" # Set this kbdcontrol mode for all virtual screens
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
establish default values for /etc/rc.d/pcvt script
2002-08-30 13:01:42 +00:00
##############################################################
### pcvt console driver options ############################
##############################################################
pcvt_verbose="NO" # set to YES to enable verbose configuration messages
pcvt_keymap="NO" # keyboard map in /usr/share/misc/keycap.pcvt (or NO).
pcvt_keydel="NO" # key repeat delay, 0-3 (250,500,750,1000 msec) (or NO).
pcvt_keyrate="NO" # keyboard repetition rate 31-0 (2-30 char/sec) (or NO).
pcvt_keyrepeat="NO" # keyboard repeat ON or OFF (or NO).
pcvt_force24="NO" # force a 24 line display (when 25 possible) (or NO).
pcvt_hpext="NO" # use HP extensions (function keys labels) (or NO).
pcvt_lines="NO" # lines (25, 28, 40, 50 or NO).
pcvt_blanktime="NO" # blank time (in seconds) (or NO).
pcvt_cursorh="NO" # cursor top scanline (topmost line is 0) (or NO).
pcvt_cursorl="NO" # cursor low scanline (bottom line is 16) (or NO).
pcvt_monohigh="NO" # set intensity to high on monochrome monitors (or NO).
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
##############################################################
Quoting Peter Wemm, "At great personal risk, touch the sendmail startup again." As an alternative to sendmail_enable=NONE, solve the boot time problem for non-sendmail users completely by moving all of the sendmail startup code from /etc/rc to /etc/rc.sendmail. The source for that script will be kept in src/etc/sendmail/rc.sendmail so make.conf's NO_SENDMAIL will prevent it from being installed. A new rc.conf variable, mta_start_script specifies the script to run to start the user's preferred MTA. For backward compatibility, it will default to /etc/rc.sendmail. The specified script is called out of /etc/rc after checking to make sure it exists. A new rc.sendmail.8 man page has also been added which now houses the sendmail_* variable descriptions formerly in rc.conf.5. Use /etc/rc.sendmail in /etc/mail/Makefile to reduce code duplication. Reviewed by: -current, -stable, obrien, peter, ru MFC after: 1 week
2002-04-05 02:30:49 +00:00
### Mail Transfer Agent (MTA) options ######################
Bring in rc file changes from -current.
1997-04-27 03:59:19 +00:00
##############################################################
Quoting Peter Wemm, "At great personal risk, touch the sendmail startup again." As an alternative to sendmail_enable=NONE, solve the boot time problem for non-sendmail users completely by moving all of the sendmail startup code from /etc/rc to /etc/rc.sendmail. The source for that script will be kept in src/etc/sendmail/rc.sendmail so make.conf's NO_SENDMAIL will prevent it from being installed. A new rc.conf variable, mta_start_script specifies the script to run to start the user's preferred MTA. For backward compatibility, it will default to /etc/rc.sendmail. The specified script is called out of /etc/rc after checking to make sure it exists. A new rc.sendmail.8 man page has also been added which now houses the sendmail_* variable descriptions formerly in rc.conf.5. Use /etc/rc.sendmail in /etc/mail/Makefile to reduce code duplication. Reviewed by: -current, -stable, obrien, peter, ru MFC after: 1 week
2002-04-05 02:30:49 +00:00
mta_start_script="/etc/rc.sendmail"
# Script to start your chosen MTA, called by /etc/rc.
Document sendmail_pidfile variable. Add sendmail_procname variable.
2004-04-05 16:22:14 +00:00
# Settings for /etc/rc.sendmail and /etc/rc.d/sendmail:
Deprecate the use of sendmail_enable="NONE" as it adversely affects the new rcNG effort. Submitted by: Mike Makonnen <makonnen@pacbell.net>
2002-09-03 22:15:57 +00:00
sendmail_enable="NO" # Run the sendmail inbound daemon (YES/NO).
Document sendmail_pidfile variable. Add sendmail_procname variable.
2004-04-05 16:22:14 +00:00
sendmail_pidfile="/var/run/sendmail.pid" # sendmail pid file
sendmail_procname="/usr/sbin/sendmail" # sendmail process name
Add infrastructure for sendmail 8.12. If users are not starting a daemon at boot (sendmail_enable=NO), a localhost-only daemon may started (sendmail_submit_enable) as it is needed to accept mail from command line submissions. If this isn't desired, see etc/mail/README for more hints. Optionally (sendmail_msp_queue_enable) start a queue runner for the submission queue in case a daemon isn't available to accept command line submitted mail at submission time. Note that the syslog labels for all of these sendmail processes have been uniquified for easier log parsing.
2002-02-17 22:19:14 +00:00
sendmail_flags="-L sm-mta -bd -q30m" # Flags to sendmail (as a server)
Provide a way for users to completely prevent sendmail from trying to start at boot time. Instead of rc.conf's sendmail_enable only accepting YES or NO, it can now also accept NONE. If set to NONE, none of the other sendmail related startup items will be done. Remove an extra queue running daemon might be started that wasn't necessary (it didn't hurt anything but it wasn't needed). The new logic is: # MTA if ${sendmail_enable} == NONE # Do nothing else if ${sendmail_enable} == YES start sendmail with ${sendmail_flags} else if ${sendmail_submit_enable} == YES start sendmail with ${sendmail_submit_flags} else if ${sendmail_outbound_enable} == YES start sendmail with ${sendmail_outbound_flags} endif # MSP Queue Runner if ${sendmail_enable} != NONE && [ -r /etc/mail/submit.cf] && ${sendmail_msp_queue_enable} == YES start sendmail with ${sendmail_msp_queue_flags} endif Discussed with: Thomas Quinot <Thomas.Quinot@Cuivre.FR.EU.ORG>, Christopher Schulte <schulte+freebsd@nospam.schulte.org> MFC after: 1 week
2002-03-28 03:29:22 +00:00
sendmail_submit_enable="YES" # Start a localhost-only MTA for mail submission
sendmail_submit_flags="-L sm-mta -bd -q30m -ODaemonPortOptions=Addr=localhost"
# Flags for localhost-only MTA
At great personal risk, touch the sendmail startup again. This adds easy seperate knobs for inbound (accepting SMTP connections) and outbound (just occasionally dequeueing) sendmail daemon startup.
2001-03-13 05:53:16 +00:00
sendmail_outbound_enable="YES" # Dequeue stuck mail (YES/NO).
Add infrastructure for sendmail 8.12. If users are not starting a daemon at boot (sendmail_enable=NO), a localhost-only daemon may started (sendmail_submit_enable) as it is needed to accept mail from command line submissions. If this isn't desired, see etc/mail/README for more hints. Optionally (sendmail_msp_queue_enable) start a queue runner for the submission queue in case a daemon isn't available to accept command line submitted mail at submission time. Note that the syslog labels for all of these sendmail processes have been uniquified for easier log parsing.
2002-02-17 22:19:14 +00:00
sendmail_outbound_flags="-L sm-queue -q30m" # Flags to sendmail (outbound only)
sendmail_msp_queue_enable="YES" # Dequeue stuck clientmqueue mail (YES/NO).
sendmail_msp_queue_flags="-L sm-msp-queue -Ac -q30m"
Provide a way for users to completely prevent sendmail from trying to start at boot time. Instead of rc.conf's sendmail_enable only accepting YES or NO, it can now also accept NONE. If set to NONE, none of the other sendmail related startup items will be done. Remove an extra queue running daemon might be started that wasn't necessary (it didn't hurt anything but it wasn't needed). The new logic is: # MTA if ${sendmail_enable} == NONE # Do nothing else if ${sendmail_enable} == YES start sendmail with ${sendmail_flags} else if ${sendmail_submit_enable} == YES start sendmail with ${sendmail_submit_flags} else if ${sendmail_outbound_enable} == YES start sendmail with ${sendmail_outbound_flags} endif # MSP Queue Runner if ${sendmail_enable} != NONE && [ -r /etc/mail/submit.cf] && ${sendmail_msp_queue_enable} == YES start sendmail with ${sendmail_msp_queue_flags} endif Discussed with: Thomas Quinot <Thomas.Quinot@Cuivre.FR.EU.ORG>, Christopher Schulte <schulte+freebsd@nospam.schulte.org> MFC after: 1 week
2002-03-28 03:29:22 +00:00
# Flags for sendmail_msp_queue daemon.
Quoting Peter Wemm, "At great personal risk, touch the sendmail startup again." As an alternative to sendmail_enable=NONE, solve the boot time problem for non-sendmail users completely by moving all of the sendmail startup code from /etc/rc to /etc/rc.sendmail. The source for that script will be kept in src/etc/sendmail/rc.sendmail so make.conf's NO_SENDMAIL will prevent it from being installed. A new rc.conf variable, mta_start_script specifies the script to run to start the user's preferred MTA. For backward compatibility, it will default to /etc/rc.sendmail. The specified script is called out of /etc/rc after checking to make sure it exists. A new rc.sendmail.8 man page has also been added which now houses the sendmail_* variable descriptions formerly in rc.conf.5. Use /etc/rc.sendmail in /etc/mail/Makefile to reduce code duplication. Reviewed by: -current, -stable, obrien, peter, ru MFC after: 1 week
2002-04-05 02:30:49 +00:00
##############################################################
### Miscellaneous administrative options ###################
##############################################################
cron_enable="YES" # Run the periodic job daemon.
cron_program="/usr/sbin/cron" # Which cron executable to run (if enabled).
Added support for intelligent handling of DST transitions in cron. reviewed by: imp
2003-12-25 23:29:19 +00:00
cron_dst="YES" # Handle DST transitions intelligently (YES/NO)
Quoting Peter Wemm, "At great personal risk, touch the sendmail startup again." As an alternative to sendmail_enable=NONE, solve the boot time problem for non-sendmail users completely by moving all of the sendmail startup code from /etc/rc to /etc/rc.sendmail. The source for that script will be kept in src/etc/sendmail/rc.sendmail so make.conf's NO_SENDMAIL will prevent it from being installed. A new rc.conf variable, mta_start_script specifies the script to run to start the user's preferred MTA. For backward compatibility, it will default to /etc/rc.sendmail. The specified script is called out of /etc/rc after checking to make sure it exists. A new rc.sendmail.8 man page has also been added which now houses the sendmail_* variable descriptions formerly in rc.conf.5. Use /etc/rc.sendmail in /etc/mail/Makefile to reduce code duplication. Reviewed by: -current, -stable, obrien, peter, ru MFC after: 1 week
2002-04-05 02:30:49 +00:00
cron_flags="" # Which options to pass to the cron daemon.
lpd_enable="NO" # Run the line printer daemon.
lpd_program="/usr/sbin/lpd" # path to lpd, if you want a different one.
lpd_flags="" # Flags to lpd (if enabled).
usbd_enable="NO" # Run the usbd daemon.
usbd_flags="" # Flags to usbd (if enabled).
If dumpdev exists, it's automatically enabled. Change comment to reflect.
1999-10-01 00:13:44 +00:00
dumpdev="NO" # Device name to crashdump to (or NO).
Add a dumpdir variable that determines where savecore stores crash dumps. I've had this on my development box for ages...
2001-10-09 18:40:00 +00:00
dumpdir="/var/crash" # Directory where crash dumps are to be stored
Whitespace police. Submitted by: cjc, ru
2001-11-28 08:52:35 +00:00
savecore_flags="" # Used if dumpdev is enabled above, and present.
enable_quotas="NO" # turn on quotas on startup (or NO).
set check_quotas="YES" as the default. PR: 13603 Submitted by: Alex Perel <veers@distributed.net> Reviewed by: billf
1999-09-06 20:22:40 +00:00
check_quotas="YES" # Check quotas on startup (or NO).
accounting -> accounting_enable Submitted by: Jian-Da Li <jdli@csie.nctu.edu.tw>
1997-05-19 03:20:22 +00:00
accounting_enable="NO" # Turn on process accounting (or NO).
YAMF22
1997-04-28 10:14:45 +00:00
ibcs2_enable="NO" # Ibcs2 (SCO) emulation loaded at startup (or NO).
Have coff be a default ibcs2 loader if we have ibcs2 support enabled.
2001-02-28 22:28:00 +00:00
ibcs2_loaders="coff" # List of additional Ibcs2 loaders (or NO).
Add a sysvipc_enable variable that causes the SysV IPC modules to be loaded. Reviewed by: dougb
2001-01-16 20:05:05 +00:00
sysvipc_enable="NO" # Load System V IPC primitives at startup (or NO).
/emulation/binary compatibility/
1999-09-15 02:25:13 +00:00
linux_enable="NO" # Linux binary compatibility loaded at startup (or NO).
Added a knob for svr4 to rc.conf (and associated support in rc.i386) Suggested by: jkh
1999-01-30 07:22:29 +00:00
svr4_enable="NO" # SysVR4 emulation loaded at startup (or NO).
Add an enable_osf1 knob to the alpha startup code
1999-12-15 14:27:59 +00:00
osf1_enable="NO" # Alpha OSF/1 emulation loaded at startup (or NO).
Resurrect a modified version of the /tmp clearing code from rev 1.119. Enable this by setting clear_tmp_enable in rc.conf to YES. Beware there can be serious side-effects of enabling this, so use at you own risk. PR: misc/4982, misc/5054
1997-11-16 12:52:17 +00:00
clear_tmp_enable="NO" # Clear /tmp at startup.
Add an rc.conf knob "ldconfig_insecure" to disable ldconfig's security checks. Set the default to NO, i.e., secure. Submitted by: Maxime Henrion <mhenrion@cybercable.fr>
2000-08-11 03:26:30 +00:00
ldconfig_insecure="NO" # Set to YES to disable ldconfig security checks
Accidentally removed the last component of the pathname when committing.
2004-10-13 07:12:14 +00:00
ldconfig_paths="/usr/lib/compat /usr/X11R6/lib /usr/local/lib /usr/local/lib/compat/pkg"
Added starting of usbd
1999-01-10 22:06:22 +00:00
# shared library search paths
ldconfig_paths_aout="/usr/lib/compat/aout /usr/X11R6/lib/aout /usr/local/lib/aout"
# a.out shared library search paths
Whitespace police. Submitted by: cjc, ru
2001-11-28 08:52:35 +00:00
kern_securelevel_enable="NO" # kernel security level (see init(8)),
Document securelevel 3. PR: docs/8674
1998-12-16 17:14:16 +00:00
kern_securelevel="-1" # range: -1..3 ; `-1' is the most insecure
Allow LOMAC to be loaded as part of the boot scripts using "lomac_enable" setting in rc.conf. Extracted from the still clammy hands of: green Sponsored by: DARPA, NAI Labs
2002-03-12 21:47:31 +00:00
lomac_enable="NO" # start lomac(4) security module at boot
Reviewed by: cvs-current Commit changes to rc and rc.local, removing the remaining minimal functionality of rc.local into rc and commenting it out of rc.local prior to the deletion of rc.local from the CVS tree.
1998-12-12 23:04:21 +00:00
update_motd="YES" # update version info in /etc/motd (or NO)
Add a unaligned_print option (alpha only) Document osf1_enable Submitted by: Eric D. Futch <efutch@nyct.net> PR: 21649
2000-10-04 18:58:46 +00:00
unaligned_print="YES" # print unaligned access warnings on the alpha (or NO).
Whitespace police. Submitted by: cjc, ru
2001-11-28 08:52:35 +00:00
entropy_file="/entropy" # Set to NO to disable caching entropy through reboots.
Set new default: entropy_file="/entropy" with /var/db/entropy being a hardcoded backup. Submitted by: Doug Barton <DougB@gorean.org> Approved by: markm
2000-10-16 04:45:47 +00:00
# /var/db/entropy is preferred if / is not available.
Move the process of storing entropy from /dev/random and reseeding with it at boot time closer to the way we want it to be in the final version. * Move the default directory to /var/db/entropy * Run the entropy saving cron job every 11 minutes. This seems to be a better default, although still bikeshed material. * Feed /dev/random some cheesy "entropy" from various commands and files before the disks are mounted. This gives /dev/random a better chance of running without blocking early. * Move the reseeding with previously stored entropy to the point immediately after the disks are mounted. * Make the harvesting script a little safer in regards to the possibility of accidentally overwriting something other than a regular file.
2001-01-14 07:18:31 +00:00
entropy_dir="/var/db/entropy" # Set to NO to disable caching entropy via cron.
Whitespace police. Submitted by: cjc, ru
2001-11-28 08:52:35 +00:00
entropy_save_sz="2048" # Size of the entropy cache files.
entropy_save_num="8" # Number of entropy cache files to save.
harvest_interrupt="YES" # Entropy device harvests interrupt randomness
harvest_ethernet="YES" # Entropy device harvests ethernet randomness
harvest_p_to_p="YES" # Entropy device harvests point-to-point randomness
Add a couple of variables for rc.d Submitted by: Mike Makonnen
2002-06-13 22:27:31 +00:00
dmesg_enable="YES" # Save dmesg(8) to /var/run/dmesg.boot
- Add a software watchdog facility. This commit has two pieces. One half is the watchdog kernel code which lives primarily in hardclock() in sys/kern/kern_clock.c. The other half is a userland daemon which, when run, will keep the watchdog from firing while the userland is intact and functioning. Approved by: jeff (mentor)
2003-06-26 09:50:52 +00:00
watchdogd_enable="NO" # Start the software watchdog daemon
Add a general mechanism for creating and applying devfs(8) rules in rc(8). It is most useful for applying rules to devfs(5) mount points in /dev or inside jails. The following line of script is sufficient to mount a relatively useful+secure devfs(5) in a jail: devfs_mount_jail /some/jail/dev Some new shell routines available to scripts that source rc.subr(5): o devfs_link - Makes it a little easier to create symlinks o devfs_init_rulesets - Create devfs(8) rulesets from devfs.rules o devfs_set_ruleset - Set a ruleset to a devfs(5) mount o devfs_apply_ruleset - Apply a ruleset to a devfs(5) mount o devfs_domount - Mount devfs(5) and apply some ruleset o devfs_mount_jail - Mount devfs(5) and apply a ruleset appropriate to jails. Additional rulesets can be specified in /etc/devfs.rules. If the devfs_system_ruleset variable is defined in rc.conf and it contains the name of a ruleset defined in /etc/defaults/devfs.rules or user supplied rulesets in /etc/devfs.rules then that ruleset will be applied to /dev at startup by the /etc/rc.d/devfs script. It can also be applied post-startup: /etc/rc.d/devfs start This is a more flexible mechanism than the previous method of using /etc/devfs.conf. However, that method is still available. Note: since devfs(8) doesn't provide any way for creating symlinks as part of a ruleset, anyone wishing to create symlinks in a devfs(5) as part of the bootup sequence will still have to rely on /etc/devfs.conf.
2003-08-20 06:15:18 +00:00
devfs_rulesets="/etc/defaults/devfs.rules /etc/devfs.rules" # Files containing
# devfs(8) rules.
devfs_system_ruleset="" # The name of a ruleset to apply to /dev
Document devfs_set_rulesets a little.
2004-04-10 22:13:27 +00:00
devfs_set_rulesets="" # A list of /mount/dev=ruleset_name settings to
# apply (must be mounted already, i.e. fstab(5))
Throw the switch and enable use of the lowest idle states while online in addition to offline. This can be overridden in /etc/rc.conf if it causes trouble although this has been stable since 2003/12.
2004-05-29 04:52:37 +00:00
performance_cx_lowest="LOW" # Online CPU idle state
Make power_profile not touch cpufreq by default.
2005-02-26 21:01:22 +00:00
performance_cpu_freq="NONE" # Online CPU frequency
Add power_profile, a script that changes the ACPI CPU Cx idle state and/or the throttling state in response to line transitions. Future plans include adding support for CPU frequency changes. Add a devd.conf entry for calling this script. The default values for this are: performance_cx_lowest="HIGH" # Use HLT (C0) online performance_throttle_state="HIGH" # 100% (no throttling) economy_cx_lowest="LOW" # Use the lowest Cx state possible economy_throttle_state="HIGH" # 100% (no throttling)
2003-12-18 04:39:57 +00:00
economy_cx_lowest="LOW" # Offline CPU idle state
Make power_profile not touch cpufreq by default.
2005-02-26 21:01:22 +00:00
economy_cpu_freq="NONE" # Offline CPU frequency
From the PR: Certain MTA configurations mean that the notifications from virecover keep bouncing; so here's a patch to allow administrators to turn them off. PR: conf/54910 Submitted by: bms (with a minor cleanup)
2004-03-03 15:21:01 +00:00
virecover_enable="YES" # Perform housekeeping for the vi(1) editor
Correct a trivial typo.
2004-09-29 07:07:43 +00:00
ugidfw_enable="NO" # Load mac_bsdextended(4) rules on boot
Give users the ability to load a mac_bsdextended(4) ruleset on boot (defaults to NO of course). Provide a basic ruleset file, rc.bsdextended, but allow the filename to be overridden through rc.conf. Discussed with: rwatson (awhile ago)
2004-09-29 00:12:28 +00:00
bsdextended_script="/etc/rc.bsdextended" # Default mac_bsdextended(4)
# ruleset file.
Add a general mechanism for creating and applying devfs(8) rules in rc(8). It is most useful for applying rules to devfs(5) mount points in /dev or inside jails. The following line of script is sufficient to mount a relatively useful+secure devfs(5) in a jail: devfs_mount_jail /some/jail/dev Some new shell routines available to scripts that source rc.subr(5): o devfs_link - Makes it a little easier to create symlinks o devfs_init_rulesets - Create devfs(8) rulesets from devfs.rules o devfs_set_ruleset - Set a ruleset to a devfs(5) mount o devfs_apply_ruleset - Apply a ruleset to a devfs(5) mount o devfs_domount - Mount devfs(5) and apply some ruleset o devfs_mount_jail - Mount devfs(5) and apply a ruleset appropriate to jails. Additional rulesets can be specified in /etc/devfs.rules. If the devfs_system_ruleset variable is defined in rc.conf and it contains the name of a ruleset defined in /etc/defaults/devfs.rules or user supplied rulesets in /etc/devfs.rules then that ruleset will be applied to /dev at startup by the /etc/rc.d/devfs script. It can also be applied post-startup: /etc/rc.d/devfs start This is a more flexible mechanism than the previous method of using /etc/devfs.conf. However, that method is still available. Note: since devfs(8) doesn't provide any way for creating symlinks as part of a ruleset, anyone wishing to create symlinks in a devfs(5) as part of the bootup sequence will still have to rely on /etc/devfs.conf.
2003-08-20 06:15:18 +00:00
Enhance the jail start/stop script. o The following additional configuration attributes of a jail can be controlled from rc.conf: - mounting devfs(5) - mounting fdescfs(5) - mounting procfs(5) - custom devfs(8) ruleset If no ruleset is specified, the default jail ruleset is used. o The output of executing /etc/rc in the jail is now redirected to /dev/null. Instead, the hostname of the jail is echoed if the jail(8) command exited successfully. If the output is wanted it can probably be redirected to a file (/var/run/$jail maybe) instead of /dev/null. Submitted by: Scot W. Hetzel <hetzels@westbend.net> with modifications by Jens Rehsack <rehsack@liwing.de> and me.
2003-08-24 06:29:32 +00:00
##############################################################
### Jail Configuration #######################################
##############################################################
jail_enable="NO" # Set to NO to disable starting of any jails
jail_list="" # Space separated list of names of jails
jail_set_hostname_allow="YES" # Allow root user in a jail to change its hostname
jail_socket_unixiproute_only="YES" # Route only TCP/IP within a jail
jail_sysvipc_allow="NO" # Allow SystemV IPC use from within a jail
#
# To use rc's built-in jail infrastructure create entries for
# each jail, specified in jail_list, with the following variables.
# NOTE: replace 'example' with the jail's name.
#
#jail_example_rootdir="/usr/jail/default" # Jail's root directory
#jail_example_hostname="default.domain.com" # Jail's hostname
#jail_example_ip="192.168.0.10" # Jail's IP number
Improve the RC framework for the clean booting/shutdown of Jails: 1. Feature: for flexibility reasons and as a prerequisite to clean shutdowns, allow the configuration of a stop/shutdown command via rc.conf variable "jail_<name>_exec_stop" in addition to the start/boot command (rc.conf variable "jail_<name>_exec_start"). For backward compatibility reasons, rc.conf variable "jail_<name>_exec" is still supported, too. 2. Debug: Add the used boot/shutdown commands to the debug output of the /etc/rc.d/jail script, too. 3. Security: Run the Jail start/boot command in a cleaned environment to not leak information from the host to the Jail during startup. 4. Feature: Run the Jail stop/shutdown command "jail_<name>_exec_stop" on "/etc/rc.d/jail stop <name>" to allow a graceful shutdown of the Jail before its processes are just killed. 5. Bugfix: When killing the remaining Jail processes give the processes time to actually perform their termination sequence. Without this the subsequent umount(8) operations usually fail because the resources are still in use. Additionally, if after trying to TERM-inate the processes there are still processes hanging around, finally just KILL them. 6. Bugfix: In rc.shutdown, if running inside a Jail, skip the /etc/rc.d/* scripts which are flagged with the KEYWORD "nojail" to allow the correct operation of rc.shutdown under jail_<name>_exec_stop="/bin/sh /etc/rc.shutdown". This is analogous to what /etc/rc does inside a Jail. Now the following typical host-configuration for two Jails works as expected and correctly boots and shutdowns the Jails: ----------------------------------------------------------- # /etc/rc.conf: jail_enable="YES" jail_list="foo bar" jail_foo_rootdir="/j/foo" jail_foo_hostname="foo.example.com" jail_foo_ip="192.168.0.1" jail_foo_devfs_enable="YES" jail_foo_mount_enable="YES" jail_foo_exec_start="/bin/sh /etc/rc" jail_foo_exec_stop="/bin/sh /etc/rc.shutdown" jail_bar_rootdir="/j/bar" jail_bar_hostname="bar.example.com" jail_bar_ip="192.168.0.2" jail_bar_devfs_enable="YES" jail_bar_mount_enable="YES" jail_bar_exec_start="/path/to/kjailer -v" jail_bar_exec_stop="/bin/sh -c 'killall kjailer && sleep 60'" ----------------------------------------------------------- # /etc/fstab.foo /v/foo /j/foo/v/foo nullfs rw 0 0 ----------------------------------------------------------- # /etc/fstab.bar /v/bar /j/bar/v/bar nullfs rw 0 0 ----------------------------------------------------------- Reviewed by: freebsd-hackers MFC after: 2 weeks
2004-12-14 14:36:35 +00:00
#jail_example_exec_start="/bin/sh /etc/rc" # command to execute in jail for starting
#jail_example_exec_stop="/bin/sh /etc/rc.shutdown" # command to execute in jail for stopping
Enhance the jail start/stop script. o The following additional configuration attributes of a jail can be controlled from rc.conf: - mounting devfs(5) - mounting fdescfs(5) - mounting procfs(5) - custom devfs(8) ruleset If no ruleset is specified, the default jail ruleset is used. o The output of executing /etc/rc in the jail is now redirected to /dev/null. Instead, the hostname of the jail is echoed if the jail(8) command exited successfully. If the output is wanted it can probably be redirected to a file (/var/run/$jail maybe) instead of /dev/null. Submitted by: Scot W. Hetzel <hetzels@westbend.net> with modifications by Jens Rehsack <rehsack@liwing.de> and me.
2003-08-24 06:29:32 +00:00
#jail_example_devfs_enable="NO" # mount devfs in the jail
#jail_example_fdescfs_enable="NO" # mount fdescfs in the jail
#jail_example_procfs_enable="NO" # mount procfs in jail
Implement per-jail fstab(5) files. Here's a rc.conf sample using this feature for a jail named foo : jail_foo_mount_enable="YES" jail_foo_fstab="/etc/fstab.foo" The second line is actually useless, since the code defaults to using "/etc/fstab.$jailname" as the fstab file if none is specified. MFC after: 3 days Submitted by: Jeremie Le Hen <jeremie@le-hen.org>
2004-11-23 20:09:58 +00:00
#jail_example_mount_enable="NO" # mount/umount jail's fs
Ruleset numbers are not allowed in devfs_* knobs. Noticed by someone on -current.
2004-02-02 13:27:41 +00:00
#jail_example_devfs_ruleset="ruleset_name" # devfs ruleset to apply to jail
Implement per-jail fstab(5) files. Here's a rc.conf sample using this feature for a jail named foo : jail_foo_mount_enable="YES" jail_foo_fstab="/etc/fstab.foo" The second line is actually useless, since the code defaults to using "/etc/fstab.$jailname" as the fstab file if none is specified. MFC after: 3 days Submitted by: Jeremie Le Hen <jeremie@le-hen.org>
2004-11-23 20:09:58 +00:00
#jail_example_fstab="" # fstab(5) for mount/umount
Allow local configuration to override this file. Submitted by: Russell Vincent <rv@groa.uct.ac.za>
1997-05-24 11:29:59 +00:00
##############################################################
Add to defaults/rc.conf a new function source_rc_confs which rc scripts may use to source safely overrides in ${rc_conf_files} files. This protects users who insist on the bad practice of copying /etc/defaults/rc.conf to /etc/rc.conf from a recursive loop that exhausts available file descriptors. Several people have expressed interest in breaking this function out into its own shell script. Anyone who wants to embark on such an undertaking would do well to study the attributed PR. PR: 17595 Reported by: adrian Submitted by: Doug Barton <Doug@gorean.org>
2000-04-27 08:43:49 +00:00
### Define source_rc_confs, the mechanism used by /etc/rc.* ##
### scripts to source rc_conf_files overrides safely. ##
Allow local configuration to override this file. Submitted by: Russell Vincent <rv@groa.uct.ac.za>
1997-05-24 11:29:59 +00:00
##############################################################
Commit first rc.diskless startup plus modifications to rc.conf and Makefile to make it work. NOTE! Uses new kern.conf_dir sysctl.
1999-01-25 18:24:46 +00:00
Add to defaults/rc.conf a new function source_rc_confs which rc scripts may use to source safely overrides in ${rc_conf_files} files. This protects users who insist on the bad practice of copying /etc/defaults/rc.conf to /etc/rc.conf from a recursive loop that exhausts available file descriptors. Several people have expressed interest in breaking this function out into its own shell script. Anyone who wants to embark on such an undertaking would do well to study the attributed PR. PR: 17595 Reported by: adrian Submitted by: Doug Barton <Doug@gorean.org>
2000-04-27 08:43:49 +00:00
if [ -z "${source_rc_confs_defined}" ]; then
Whitespace police. Submitted by: cjc, ru
2001-11-28 08:52:35 +00:00
source_rc_confs_defined=yes
source_rc_confs () {
local i sourced_files
for i in ${rc_conf_files}; do
case ${sourced_files} in
*:$i:*)
;;
*)
sourced_files="${sourced_files}:$i:"
if [ -r $i ]; then
. $i
fi
;;
esac
done
}
Add to defaults/rc.conf a new function source_rc_confs which rc scripts may use to source safely overrides in ${rc_conf_files} files. This protects users who insist on the bad practice of copying /etc/defaults/rc.conf to /etc/rc.conf from a recursive loop that exhausts available file descriptors. Several people have expressed interest in breaking this function out into its own shell script. Anyone who wants to embark on such an undertaking would do well to study the attributed PR. PR: 17595 Reported by: adrian Submitted by: Doug Barton <Doug@gorean.org>
2000-04-27 08:43:49 +00:00
fi
Reference in New Issue Copy Permalink