Commit Graph

356 Commits

Author SHA1 Message Date
peter 9c1da17e90 pf needs to be started after the network is up, because some pf rules
derive IP address(es) from the interface (e.g "... from any to fxp0").
This however, creates window for possible attacks from the network.

Implement the solution proposed by YAMAMOTO Takashi:
Add /etc/defaults/pf.boot.conf and load it with the /etc/rc.d/pf_boot
script before starting the network. People who don't like the default
rules can override it with their own /etc/pf.boot.conf.
The default rules have been obtained from OpenBSD.

No objections on: tech-security
2005-08-23 12:12:56 +00:00
peter ad9c34ce5c Changes suggested by lukem:
1. Order pf to start before the network is configured.

2. If the pf_rules cannot be found at boot time, abort the boot (from the
   ipfilter script).
2005-08-10 13:52:05 +00:00
peter c9c458f33c Add command_args="-D" to the ftpd rc.d script. This flag is always needed
when running ftpd as daemon and it will now automatically be appended to the
command line, even if ftpd_flags doesn't have it.

Suggested by Alan Barrett and Luke Mewburn, thanks.
2005-08-09 14:59:33 +00:00
peter 9cfba4bb75 Add a note telling that ftpd_flags should always contain "-D".
Suggested by lukem@.
2005-08-08 00:19:37 +00:00
peter d0b18db569 Allow to change the location of the pf ruleset with the variable $pf_rules. 2005-08-07 01:03:39 +00:00
peter f74a86ef4f Add the new ftpd rc.d script. 2005-08-04 22:32:44 +00:00
peter 7eb092e6c3 Add rc.d support for standalone ftpd, suggested by perry@. 2005-08-04 22:28:17 +00:00
christos 0e7146df89 Improve on the migration bit. Check if files are different, and if not,
remove the source and leave a symlink behind. Otherwise, let the user know.
2005-07-17 21:28:45 +00:00
christos a2663103c5 Copy and link files to allow a chrooted named to start-up automatically. 2005-07-17 16:30:57 +00:00
symka 87283c876e PR/29317: ifconfig.if does not allow parameters with spaces
OKeyd by christos@
2005-06-28 13:36:40 +00:00
elad faffb35d60 Run veriexec before securelevel and sysctl scripts. Suggested by Nino Dehne. 2005-06-15 18:49:40 +00:00
cjs 2dc0814b72 Make ifaliases_lo0 in rc.conf work just like other interfaces (instead of
being ignored). Also, when configuring aliases set as ifaliases_xxN,
print out the interface name and the alias address.
2005-04-26 10:28:29 +00:00
blymn 8387760ed1 Rototill of the verified exec functionality.
* We now use hash tables instead of a list to store the in kernel
    fingerprints.
  * Fingerprint methods handling has been made more flexible, it is now
    even simpler to add new methods.
  * the loader no longer passes in magic numbers representing the
    fingerprint method so veriexecctl is not longer kernel specific.
  * fingerprint methods can be tailored out using options in the kernel
    config file.
  * more fingerprint methods added - rmd160, sha256/384/512
  * veriexecctl can now report the fingerprint methods supported by the
    running kernel.
  * regularised the naming of some portions of veriexec.
2005-04-20 13:44:45 +00:00
lukem 8232ca0162 Tweaks for the move of postinstall from /etc to /usr/sbin 2005-04-17 23:12:40 +00:00
lukem c0372ca1ef ypserv(8) doesn't need the domainname(1) set -- it will serve any maps
present under /var/yp/<somedomain>/<map> -- so don't require it.
Thanks to Chuck Cranor for the suggestion.
2005-04-01 23:25:29 +00:00
tron 878fa2f707 Replace hardcoded "/var/run/named.pid" with ${pidfile}. 2005-03-17 18:44:09 +00:00
peter 80f533ce07 Do a "flush all" when disabling pf. This also changes the restart case
to do a "flush all", while the reload case will only reload the rules without
flushing anything.

Suggested by Miles Nordin.
2005-03-15 18:22:03 +00:00
lukem f198807ca5 Explicitly REQUIRE mountcritremote, since this uses awk. 2005-03-15 12:06:12 +00:00
tv 0a66272c73 Revert previous, for now. We don't umount filesystems in the shutdown
process (we're -- probably inappropriately -- waiting for the kernel to do
that at the end), so cgdconfig -U won't do much until that situation changes.
2005-03-02 19:09:22 +00:00
tv e32d4e2d39 Unconfigure cgd devices on shutdown, so that underlying layers (i.e.,
RAIDframe) are happier.
2005-03-02 12:14:47 +00:00
dsainty 7e7f191f7d Add a missing space in a comment 2004-12-30 09:32:13 +00:00
lukem eca6f3c39f * Conditionalize flushing of IPv4 vs IPv6 rules based on the existance
of the appropriate configuration file.
  Based on PR 28757 from Jason White.

* Add comments explaining why we flush separately from the reload
  (backwards compat with older ipf(8) binaries).
2004-12-23 03:31:54 +00:00
kleink c17d5db72f Add the `shutdown' keyword, giving racoon a chance to flush the SAD
upon termination.
2004-12-07 17:37:15 +00:00
christos 573e338f96 Don't try to chmod ptys if we have none. 2004-11-10 05:04:51 +00:00
lukem 4ffd3a5be3 Redo previous (rev 1.12) in a manner that allows this rc.d script to operate
correctly on ipf(8) from prior to 4.1.3 (where -Fa flushes both protocols)
and 4.1.3 (where -Fa only flushes the current protocol).
Fix from Kimmo Suominen, per private discussion.
2004-11-08 02:09:01 +00:00
lukem 1ecb0d140f Use 'load_rc_config_var CMD VAR' to set VAR for "foreign" rc.conf(5)
variables that may be set in /etc/rc.conf.d/CMD instead of /etc/rc.conf.
Fixes PR 20768 from Pavel Cahyna.
2004-10-12 14:51:03 +00:00
lukem 573992ef57 Implement reload, using "amq -f".
Suggested by Hauke Fath in PR 26589.
2004-10-12 13:44:45 +00:00
lukem d65dca170c Fix for /bin/ksh, from Jukka Salmi in PR 27232. 2004-10-12 13:23:44 +00:00
christos 6e9a790e1f Use new style command substitution. 2004-10-11 15:00:51 +00:00
lukem c73be7a88d Explicitly REQUIRE: rpcbind since these services directly use RPC... 2004-10-11 14:11:43 +00:00
lukem 6ede50a341 Use load_rc_config `basename chrootdirscript` in a subshell to determine
the rc.conf(5) setting for chrootdirscript, incase the configuration
for that is in /etc/rc.conf.d/chrootdirscript.
Fixes PR 26478 from Jukka Salmi.
2004-10-11 13:29:52 +00:00
lukem ac418f52f5 Explicitly flush (-Fa) rules when loading or reloading IPv4 and IPv6 rules,
rather than relying upon running "ipf -Fa" beforehand (which only flushes IPv4)
Should fix PR 26885 and PR 26857.
2004-09-09 00:33:03 +00:00
atatat c41b76304f Quieten stat(1) with the -q flag.
Addresses PR bin/26711.
2004-08-19 04:44:10 +00:00
mycroft 7d2e1537c5 Add an _rc_subr_loaded variable, set to ":" by rc.subr. Scripts can use this
for a speedup by doing:
$_rc_subr_loaded . /etc/rc.subr
2004-08-13 18:08:03 +00:00
atatat 8fb0a9f1ca Switch the check to see if the corresponding db file needs to be
rebuilt from "newer than" to "not older than".  The latter check also
manages to take into account cases where the db file doesn't yet exist
because the source is "not older than" something that doesn't yet
exist.
2004-08-08 17:41:15 +00:00
atatat e0fb433b4f Add one more check to the sendmail auto-start heuristic: check the
value of MTAHost in the submit.cf.  If it doesn't indicate localhost,
we probably don't need the sendmail listener.

Addresses PR bin/26391.
2004-07-22 03:36:29 +00:00
atatat 89fc8be761 Change the default settings for sendmail.
(1) The stock sendmail.cf will only listen on the loopback interface.
(2) The stock submit.cf specifally connects to "localhost." which
    should be less susceptible to being confused or looking confused.
(3) The smtp listener starts by default, if needed.  The setting in
    /etc/default/rc.conf is still "no", but rc.d/sendmail detects the
    default setting and will change it to yes if need is determined.

Need is defined as "nothing else seems to have been changed about the
mail configuration but we'd like locally originated and locally
destined mail to be delivered".  If you change, eg, mailer.conf to
point to postfix or some other MTA, sendmail will not start.
2004-07-15 03:47:18 +00:00
atatat 5f89bdd921 Make the directory into which crash dumps are saved into something
that can be controlled via rc.conf.  The default is, of course,
/var/crash.
2004-07-15 03:29:55 +00:00
lukem 20fd132b8d * Add BEFORE: SERVERS, so state is restored much earlier in the boot sequence.
* REQUIRE: isdnd, so this will be shutdown before that, to prevent
  future problem if isdnd eve gets an explicit "shutdown" keyword.

Per discussion with Martin Husemann.
2004-07-05 08:21:15 +00:00
martin ebdc55a49e Make sure "downinterfaces" comes first - this means on shutdown this
script will run before downinterfaces destroys all state we try to
save here.
2004-07-05 07:53:03 +00:00
tron 313b9c84ab Install "pf" and "pflogd". 2004-06-30 09:22:41 +00:00
itojun de1993c88e rc.d fragment for PF. Peter Postma 2004-06-29 04:48:28 +00:00
abs eb24f87047 add rcvar 2004-06-03 16:29:15 +00:00
abs d5fc55fa51 Add rcvar="quota" 2004-06-03 16:27:44 +00:00
christos 367e1200da create /dev/random when chrooted. 2004-05-21 15:40:22 +00:00
lukem b997a4053a Update the paths to the required_files configuration files for the
move from /usr/X11R6/lib/X11/<app> -> /etc/X11/<app>.
Resolves PR [misc/25613] from Jukka Salmi.
2004-05-17 23:41:27 +00:00
lukem ee04d88971 Consistently use CONFIGFILES & CONFIGLINKS (which enable the 'configinstall'
target) instead of using home-grown 'distribution' targets or using
FILES with the 'install' target.
Add some etc/ subdir Makefiles where appropriate.

XXX: some of etc/Makefile install-etc-files could be converted to CONFIGFILES.
2004-05-16 09:53:09 +00:00
schmonz c8dd377ead Add RCS Id. 2004-04-25 16:52:19 +00:00
keihan f672be074d s/netbsd.org/NetBSD.org/ 2004-04-23 10:59:47 +00:00
christos 1d0fe2e424 Whitespace fixes, some code re-factoring, and a bit more verbose messages. 2004-04-21 19:35:13 +00:00