Commit Graph

221 Commits

Author SHA1 Message Date
lidl
47674eb3ca Restrict 520.pfdenied to only list rules that blocked traffic.
Before this change, the 520.pfdenied script listed all rules that
matched /^block/ in the rule. Restrict the printed output to only
those rules that result in packets being dropped.

PR:		conf/187224
Approved by:	rpaulo (mentor)
Differential Revision:	https://reviews.freebsd.org/D4068
2015-11-05 17:37:14 +00:00
ngie
329f3219e7 Rename etc/periodic/daily/430.status-rwho to periodic/daily/430.status-uptime
The command was checking local/remote system uptime, so rename the script to
match its function and to avoid confusion

The controlling variable in /etc/periodic.conf has been renamed from
daily_status_rwho_enable to daily_status_uptime_enable.

MFC after: 3 days
Reported by: Peter Jeremy <peter@rulingia.com>
Relnotes: yes
Sponsored by: EMC / Isilon Storage Division
2015-11-02 01:05:34 +00:00
bdrewery
153205e33f Add more SUBDIR_PARALLEL.
MFC after:	3 weeks
Sponsored by:	EMC / Isilon Storage Division
2015-10-15 22:55:08 +00:00
des
3bf524186e Add -n to the ntpq command line so it will show IP addresses instead of
host names, which rarely fit in the available space.

MFC after:	1 week
2015-10-08 08:55:08 +00:00
jhb
86fa361d59 Allow additional flags to be passed to netstat -i in the daily status check.
In particular, this allows an administrator to specify "-h" for human
readable output if that is preferred.

The default setting passes "-d", so that can be excluded by using a custom
setting.

Differential Revision:	https://reviews.freebsd.org/D2034
Submitted by:	Lystopad Aleksandr <laa@laa.zp.ua>
		(patch to add option for -h)
Reviewed by:	bz
MFC after:	1 week
2015-03-27 00:37:41 +00:00
gjb
6449dfa4f9 Evaluate running userland/kernel version in daily
periodic(8) run, taken from uname(1) '-U' and '-K'
flags.

Reviewed by:		allanjude, dvl
Differential Revision:	https://reviews.freebsd.org/D1541
MFC after:		1 week
Sponsored by:		The FreeBSD Foundation
2015-01-15 19:52:19 +00:00
bapt
bfc0f852ba Avoid installing security.functions with executable bits, periodic(8) will
try to execute all files with an executable bit in /etc/periodic/*/ while
this file is supposed only to be sourced by others

MFC after:	1 week
2014-11-05 06:42:07 +00:00
bdrewery
ec56ad408f Don't cross mount boundaries when cleaning tmp files.
Mounting something in /tmp such as a build jail with nullfs mounts for
some directories can result in very surprising results the next day.

MFC after:	2 weeks
Relnotes:	yes
2014-09-09 17:03:58 +00:00
imp
2118f42afd Use src.opts.mk in preference to bsd.own.mk except where we need stuff
from the latter.
2014-05-06 04:22:01 +00:00
brueffer
8e2617b93f Further refine the auth fail regex to catch more auth failures and
reduce false positives.

The committed patch was provided by Christian Marg.

PR:		91732
Submitted by:	Daniel O'Connor <doconnor at gsoft.com.au>
		Skye Poier <spoier at gmail.com>
		Alan Amesbury <amesbury at umn.edu>
		Christian Marg <marg at rz.tu-clausthal.de>
MFC after:	1 month
2014-02-20 23:43:49 +00:00
glebius
e62e567acf Remove remnants of BIND from /etc, since there is no BIND in base now.
Sorry, that would break users running head and BIND from ports, since
ports rely on these scripts. The ports will be fixed soon.

Reviewed by:	erwin
2013-11-05 09:30:06 +00:00
bapt
4d11df94bd After around 20 years of duty it is time for pkg_install to retire 2013-10-31 13:00:35 +00:00
des
122944f492 Odds and ends left over from BIND and unnoticed because they didn't
affect 'make universe'.

Approved by:	re (gjb)
2013-10-01 07:19:23 +00:00
jkim
d0a699d53c Fix a typo introduced in r254975. 2013-08-27 22:37:29 +00:00
jlh
976074d43e Install 450.status-security. 2013-08-27 21:28:12 +00:00
jlh
2194a6603d Make the period of each periodic security script configurable.
There are now six additional variables
  weekly_status_security_enable
  weekly_status_security_inline
  weekly_status_security_output
  monthly_status_security_enable
  monthly_status_security_inline
  monthly_status_security_output
alongside their existing daily counterparts.  They all have the same
default values.

All other "daily_status_security_${scriptname}_${whatever}"
variables have been renamed to "security_status_${name}_${whatever}".
A compatibility shim has been introduced for the old variable names,
which we will be able to remove in 11.0-RELEASE.

"security_status_${name}_enable" is still a boolean but a new
"security_status_${name}_period" allows to define the period of
each script.  The value is one of "daily" (the default for backward
compatibility), "weekly", "monthly" and "NO".

Note that when the security periodic scripts are run directly from
crontab(5) (as opposed to being called by daily or weekly periodic
scripts), they will run unless the test is explicitely disabled with a
"NO", either for in the "_enable" or the "_period" variable.

When the security output is not inlined, the mail subject has been
changed from "$host $arg run output" to "$host $arg $period run output".
For instance:
  myfbsd security run output ->  myfbsd security daily run output
I don't think this is considered as a stable API, but feel free to
correct me if I'm wrong.

Finally, I will rearrange periodic.conf(5) and default/periodic.conf
to put the security options in their own section.  I left them in
place for this commit to make reviewing easier.

Reviewed by:	hackers@
2013-08-27 21:20:28 +00:00
jhb
b29359892a If daily_status_security_inline is set, the rc value needs to be
forced to 3 so that the output of this script is always displayed.
In fact, setting this flag is identical to setting
daily_status_security_output to an empty string.  To make the logic
less confusing, change the behavior of daily_status_security_inline
such that it just forces daily_status_security_output to an empty
string and then applies the normal logic.

PR:		conf/178611
Submitted by:	Jason Unovitch <jason.unovitch@gmail.com>
MFC after:	3 days
2013-06-25 15:45:31 +00:00
eadler
e48cd1a04f Unconditionally install 210.backup-aliases as many MTAs other than
sendmail support the use of /etc/aliases.

PR:		conf/176098
Submitted by:	ak
MFC after:	2 weeks
2013-05-11 23:55:43 +00:00
mav
5d62c483f5 Remove periodic script for ataraid(4) and add instead script for graid(8). 2013-04-04 15:03:12 +00:00
bapt
eb5a928066 make installation of the 220.backup-pkgdb periodic script depend on PKGTOOLS
knob
2012-12-20 11:39:20 +00:00
ume
e2e55abec2 Make a command for pkg_info changeable like pkg_version in
/etc/periodic/weekly/400.status-pkg to be friendly with pkgng.

MFC after:	1 week
2012-10-13 14:45:42 +00:00
jhb
9026ef5736 Only output a list of file systems that need to be dumped if the system
has a non-empty dumpdates file.

Reviewed by:	brooks
MFC after:	1 week
2012-06-20 20:01:51 +00:00
jhb
6837ff0b32 Display dropped transmit packets in the daily network interface output.
PR:		conf/165956
Submitted by:	Jeremy Chadwick
MFC after:	1 week
2012-05-07 15:41:31 +00:00
gjb
3120fac2c9 Add an option to 404.status-zfs (enabled by default) to list all
zfs pools on the system.

While here, document daily_status_zfs_enable in periodic.conf(5).

Discussed on:	-fs [1]
Reviewed by:	netchild [1]
Approved by:	jhb
MFC after:	1 week

[1] - http://lists.freebsd.org/pipermail/freebsd-fs/2011-June/011869.html
2012-02-08 00:08:21 +00:00
dougb
9d00c3ae56 The default setting, daily_accounting_compress="NO", was causing
only 1 old file to be saved, so fix this. Problem raised in the PR,
but actually required a different solution.

While I'm here, fix a very old off-by-one error causing 1 more file
than specified in daily_accounting_save to be saved because acct.0
was not taken into account (pun intended). Change that, and use a more
thorough method of finding old files to delete. Partly just because this
is the right thing to do, but also to silently fix the extra log that
would have been left behind forever with the previous method.

PR:		conf/160848
Submitted by:	Andrey Zonov <andrey@zonov.org>
2011-11-13 03:01:58 +00:00
delphij
cdc2d13873 Increase default scrub threshold from 30 days to 5 weeks. Using
whole weeks makes it easier to predicate when the scrub would
happen.

MFC after:	1 week
2011-10-27 21:25:41 +00:00
se
c5a8163000 Fix error message in case the backup storage directory does not exist and
cannot be created ($daily_backup_pkgdb_dbdir -> $daily_backup_pkgdb_dir).
MFC after:	1 week
2011-10-17 14:33:41 +00:00
ed
e75cd7ae0e Add WITHOUT_UTMPX switch to the build system.
This knob removes the tools that are exclusively used to view and
maintain the databases maintained by utmpx, namely last, users, who,
wtmpcvt, ac, lastlogin and utxrm.

The tool w is not in this list, because it has some other functionality
which is unrelated to utmpx; it is hardlinked to the uptime tool.
2011-06-17 21:30:21 +00:00
ed
61d0bc9ccd Don't omit ac(8) as part of WITHOUT_ACCT.
The WITHOUT_ACCT switch is supposed to omit tools related to process
accounting, namely accton and sa. ac(8) is just a simple tool that
prints statistics based on data in the utx.log database. It has nothing
to do with the former.
2011-06-17 20:47:44 +00:00
jpaetzel
a2524e3ed6 Eliminate extraneous pipelines and tr calls.
Approved by:	kib (mentor)
MFC after:	3 days
2011-06-15 19:33:02 +00:00
jpaetzel
d33a1d3a06 Convert the allowed characters '-', '.', and ':' in a ZFS pool name to _
to avoid causing errors in the shell script.

Submitted by:	William Grzybowski <william88@gmail.com>
Approved by:	kib (mentor)
MFC after:	7 days
Sponsored by:	iXsystems
2011-06-13 19:45:01 +00:00
dougb
11dd08fd53 1. If PKG_DBDIR cannot be determined from make, set the default
2. Add the -H flag to tar in case /var/db/pkg itself is a symlink
3. Direct stderr to /dev/null to suppress the leading slash warning [1]

PR:		ports/156810 [1]
Submitted by:	Jeremy Chadwick <freebsd@jdc.parodius.com> [1]
2011-05-05 02:35:11 +00:00
netchild
fe5d0c873a The security run requests unmaskable output, even if the only output is to
tell that there is a separate email or that the output is logged to a file.

This commit changes the return code for the non-inline case to tell that
this message is not important enough and can be masked if necessary. The
messages from the security checks themself are not affected by this and
show up as before in the periodic security email/file.

The inline case still requests to not mask the output, as with the current
way of handling this there is no easy way to handle this.

PR:			138692
Analysis/patch atch by:	Chris Cowart <ccowart@timesinks.net>
X-MFC after:		on request
2011-05-04 12:48:02 +00:00
netchild
579e9f977b Use proper return codes (valuable output, invalid config, problems).
MFC after:	1 week
2011-05-04 12:37:10 +00:00
dougb
5690821f7a Hook the 220.backup-pkgdb script I added to the build unconditionally
Hook up 610.ipf6denied based on MK_IPFILTER as 510.ipfdenied is now

Poked by:	Andrzej Tobola <ato@iem.pw.edu.pl>
2011-03-27 03:06:58 +00:00
dougb
2f5c17bf80 Add svn:executable property on remaining period scripts without it 2011-03-27 03:03:29 +00:00
dougb
4eab0bcd9d Add a daily period script to back up /var/db/pkg
The final product contains work from the originator, and
Florent Thoumie <florent.thoumie@gmail.com>. The final
product contains considerable re-working by me, so all
responsibility for bugs rests under my pointy hat.

PR:		ports/145957
Submitted by:	Eitan Adler <EitanAdlerList@gmail.com>
2011-03-26 03:01:48 +00:00
dougb
42c73e8a62 Add the svn:executable property to the scripts that are missing it 2011-03-26 01:24:55 +00:00
dougb
7cea22540c Update how accounting log files are rotated.
The old version had a race between the time that the old file was
cp'ed to acct.0 and the time that 'sa -s' was run that prevented
the commands that occurred in the meantime from being backed up.

It's also arguable that the old version was inefficient in using
cp which can be a problem on a space-constrained system.

This version avoids both problems, albeit it's considerably more
complicated. The advantage of putting the log rotation in the rc.d
script is that it can handle the _enable and _file questions without
having to do gymnastics to discover either value in the periodic script.

As a side effect of reviewing the rc.d script I cleaned it up a bit.
2011-02-22 21:13:40 +00:00
jpaetzel
72db8e5686 Fix logic error introduced in previous commit.
Along the way make some efficiency improvements.

Submitted by:	jilles
Approved by:	kib (mentor)
MFC after:	3 days
2011-01-25 13:41:48 +00:00
jpaetzel
8a8469590d This script parses output of userland tools. In the case of a faulted
zpool the output causes the script to bail out with syntax errors.
Since a scrub of a faulted zpool is pointless, just skip over any pools
marked as such.

PR:	conf/150228
Submitted by:	jpaetzel
Approved by:	kib (mentor)
MFC after:	3 days
MFC note:	only for RELENG_8
2011-01-23 17:13:29 +00:00
brooks
479b7f4288 Add an (off by default) check for negative permissions (where the
group on a object has less permissions that everyone).  These
permissions will not work reliably over NFS if you have more than
14 supplemental groups and are usually not what you mean.

MFC after:	1 week
2010-11-13 00:40:43 +00:00
delphij
c98c4f39f2 Hide 460.chkportsum in MK_PKGTOOLS != no case.
Submitted by:	Alex Kozlov <spam rm-rf kiev ua>
MFC after:	2 weeks
2010-11-09 18:46:44 +00:00
netchild
3bcb134559 - Change the threshold from 'running next scrub the <value+1>th day after the
last one' to 'running next scrub the <value>th day after the last one'.
- Improve wording.

Requested by:	jhell <jhell@DataIX.net>
MFC after:	1 week
2010-08-25 08:09:42 +00:00
olli
4ea6822255 Connect the new script 490.status-pkg-changes (see r210863)
to the build, so it gets actually installed.

Approved by:	des (mentor)
MFC after:	17 days
2010-08-10 12:58:44 +00:00
gabor
0caf1f3942 - Fixes to the chkportsum script to handle better some special cases,
like spaces in filename

Submitted by:	Alex Kozlov <spam@rm-rf.kiev.ua>
Approved by:	delphij (mentor)
2010-08-10 11:15:17 +00:00
olli
d1b61616fa Add a daily script to the periodic framework that reports
changes to the package database, i.e. any packages that
have been added, updated or deleted in the past 24 hours.
The format is intentionally simple and concise.

That information is particularly useful on servers that
are maintained by multiple administrators.  When someone
adds, updates or deletes a package, the others will see
it in the daily periodic output.

This script is disabled by default.

PR:		conf/113913
Submitted by:	olli
Approved by:	des (mentor)
MFC after:	3 weeks
2010-08-05 15:53:33 +00:00
gabor
6a3f80a589 - Add a periodic script, which can be used to find installed ports' files with
mismatched checksum

PR:		conf/124641
Submitted by:	Alex Kozlov <spam@rm-rf.kiev.ua>
Approved by:	delphij (mentor)
2010-07-19 20:19:14 +00:00
netchild
881839de98 - add the zfs scrub script
- move the zfs status script into the MK_ZFS conditional to respect
  WITHOUT_ZFS

Noticed by:	Andrzej Tobola <ato@iem.pw.edu.pl>
2010-06-17 12:25:47 +00:00
netchild
4a94306572 Add a periodic zfs scrub script.
Features:
 - configurable amount of days between scrubs (default value or per pool)
 - do not scrub directly after pool creation (respects the configured
   number of days between scrubs)
 - do not scrub if a scrub is in progress
 - tells how to see the status of the scrub
 - tells how many days since the last scrub if it skips the scrubbing
 - warns if a non-existent pool is specified explicitely
   (default: no pools specified -> all currently imported pools are
   handled)
 - runs late in the periodic run to not slow down the other periodic daily
   scripts

Discussed on:	fs@
2010-06-15 08:58:16 +00:00