From owner-svn-doc-head@FreeBSD.ORG Sun Oct 13 03:19:31 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 49F4F66E;
Sun, 13 Oct 2013 03:19:31 +0000 (UTC) (envelope-from gjb@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 37DFE2E85;
Sun, 13 Oct 2013 03:19:31 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9D3JVTW057105;
Sun, 13 Oct 2013 03:19:31 GMT (envelope-from gjb@svn.freebsd.org)
Received: (from gjb@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9D3JVtd057104;
Sun, 13 Oct 2013 03:19:31 GMT (envelope-from gjb@svn.freebsd.org)
Message-Id: <201310130319.r9D3JVtd057104@svn.freebsd.org>
From: Glen Barber
Date: Sun, 13 Oct 2013 03:19:31 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42947 - head/en_US.ISO8859-1/htdocs/releases/10.0R
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Sun, 13 Oct 2013 03:19:31 -0000
Author: gjb
Date: Sun Oct 13 03:19:30 2013
New Revision: 42947
URL: http://svnweb.freebsd.org/changeset/doc/42947
Log:
Update 10.0-BETA1 schedule.
Approved by: re (implicit)
Modified:
head/en_US.ISO8859-1/htdocs/releases/10.0R/schedule.xml
Modified: head/en_US.ISO8859-1/htdocs/releases/10.0R/schedule.xml
==============================================================================
--- head/en_US.ISO8859-1/htdocs/releases/10.0R/schedule.xml Sat Oct 12 14:03:37 2013 (r42946)
+++ head/en_US.ISO8859-1/htdocs/releases/10.0R/schedule.xml Sun Oct 13 03:19:30 2013 (r42947)
@@ -111,7 +111,7 @@
BETA1 builds begin
12 October 2013
-
-
+
12 October 2013
First beta test snapshot.
From owner-svn-doc-head@FreeBSD.ORG Sun Oct 13 11:44:18 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id C15DA68C;
Sun, 13 Oct 2013 11:44:18 +0000 (UTC)
(envelope-from gavin@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id AED502F61;
Sun, 13 Oct 2013 11:44:18 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9DBiIoZ015786;
Sun, 13 Oct 2013 11:44:18 GMT (envelope-from gavin@svn.freebsd.org)
Received: (from gavin@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9DBiIOI015785;
Sun, 13 Oct 2013 11:44:18 GMT (envelope-from gavin@svn.freebsd.org)
Message-Id: <201310131144.r9DBiIOI015785@svn.freebsd.org>
From: Gavin Atkinson
Date: Sun, 13 Oct 2013 11:44:18 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42948 -
head/en_US.ISO8859-1/books/handbook/network-servers
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Sun, 13 Oct 2013 11:44:18 -0000
Author: gavin
Date: Sun Oct 13 11:44:18 2013
New Revision: 42948
URL: http://svnweb.freebsd.org/changeset/doc/42948
Log:
Replace UTF-8 'RIGHT SINGLE QUOTATION MARK' (U+2019), encoded as
0xE2 0x80 0x99, with a standard apostrophe. It's not clear to me why
this was brealing the build on the cluster and seemingly nowhere else, but
this should at least allow the build there to complete.
Modified:
head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Sun Oct 13 03:19:30 2013 (r42947)
+++ head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Sun Oct 13 11:44:18 2013 (r42948)
@@ -6264,7 +6264,7 @@ target iqn.2012-06.com.example:target0 {
allowed.
Second entry defines a single target. Target has two
- meanings - it is a machine serving iSCSI, but it’s also
+ meanings - it is a machine serving iSCSI, but it's also
a named group of LUNs. In this example, we use the latter
meaning. The "iqn.2012-06.com.example:target0" is the
target name. For testing purposes it might be left as it
From owner-svn-doc-head@FreeBSD.ORG Sun Oct 13 14:47:39 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id BE084492;
Sun, 13 Oct 2013 14:47:39 +0000 (UTC)
(envelope-from wblock@wonkity.com)
Received: from wonkity.com (wonkity.com [67.158.26.137])
(using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 580F12669;
Sun, 13 Oct 2013 14:47:39 +0000 (UTC)
Received: from wonkity.com (localhost [127.0.0.1])
by wonkity.com (8.14.7/8.14.7) with ESMTP id r9DElVPH078158;
Sun, 13 Oct 2013 08:47:31 -0600 (MDT)
(envelope-from wblock@wonkity.com)
Received: from localhost (wblock@localhost)
by wonkity.com (8.14.7/8.14.7/Submit) with ESMTP id r9DElVQv078155;
Sun, 13 Oct 2013 08:47:31 -0600 (MDT)
(envelope-from wblock@wonkity.com)
Date: Sun, 13 Oct 2013 08:47:31 -0600 (MDT)
From: Warren Block
To: Gavin Atkinson
Subject: Re: svn commit: r42948 -
head/en_US.ISO8859-1/books/handbook/network-servers
In-Reply-To: <201310131144.r9DBiIOI015785@svn.freebsd.org>
Message-ID:
References: <201310131144.r9DBiIOI015785@svn.freebsd.org>
User-Agent: Alpine 2.00 (BSF 1167 2008-08-23)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII; format=flowed
X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.4.3
(wonkity.com [127.0.0.1]); Sun, 13 Oct 2013 08:47:31 -0600 (MDT)
Cc: svn-doc-head@freebsd.org, svn-doc-all@freebsd.org,
doc-committers@freebsd.org
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Sun, 13 Oct 2013 14:47:39 -0000
On Sun, 13 Oct 2013, Gavin Atkinson wrote:
> Author: gavin
> Date: Sun Oct 13 11:44:18 2013
> New Revision: 42948
> URL: http://svnweb.freebsd.org/changeset/doc/42948
>
> Log:
> Replace UTF-8 'RIGHT SINGLE QUOTATION MARK' (U+2019), encoded as
> 0xE2 0x80 0x99, with a standard apostrophe. It's not clear to me why
> this was brealing the build on the cluster and seemingly nowhere else, but
> this should at least allow the build there to complete.
>
> Modified:
> head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
>
> Modified: head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
> ==============================================================================
> --- head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Sun Oct 13 03:19:30 2013 (r42947)
> +++ head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Sun Oct 13 11:44:18 2013 (r42948)
> @@ -6264,7 +6264,7 @@ target iqn.2012-06.com.example:target0 {
> allowed.
>
> Second entry defines a single target. Target has two
> - meanings - it is a machine serving iSCSI, but it?s also
> + meanings - it is a machine serving iSCSI, but it's also
> a named group of LUNs. In this example, we use the latter
> meaning. The "iqn.2012-06.com.example:target0" is the
> target name. For testing purposes it might be left as it
Contractions are a style guide problem anyway. "it's" should be
expanded or even removed.
Other notes:
"Second entry defines a single target." is missing an article, or
possibly better rearranged as "A single target is defined by the second
entry."
The word "target" in the second sentence could use or
tags to point out that it is talking about the use of the word in the
first sentence.
From owner-svn-doc-head@FreeBSD.ORG Sun Oct 13 15:01:31 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 10B315A2;
Sun, 13 Oct 2013 15:01:31 +0000 (UTC)
(envelope-from gavin@FreeBSD.org)
Received: from mail-gw14.york.ac.uk (mail-gw14.york.ac.uk [144.32.129.164])
(using TLSv1 with cipher AES256-SHA (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id C9CAA2703;
Sun, 13 Oct 2013 15:01:30 +0000 (UTC)
Received: from ury.york.ac.uk ([144.32.64.162]:39461)
by mail-gw14.york.ac.uk with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32)
(Exim 4.76) (envelope-from )
id 1VVNAe-00041O-Ts; Sun, 13 Oct 2013 16:01:28 +0100
Date: Sun, 13 Oct 2013 16:01:28 +0100 (BST)
From: Gavin Atkinson
X-X-Sender: gavin@thunderhorn.york.ac.uk
To: Warren Block
Subject: Re: svn commit: r42948 -
head/en_US.ISO8859-1/books/handbook/network-servers
In-Reply-To:
Message-ID:
References: <201310131144.r9DBiIOI015785@svn.freebsd.org>
User-Agent: Alpine 2.00 (BSF 1167 2008-08-23)
MIME-Version: 1.0
Content-Type: TEXT/PLAIN; charset=US-ASCII
Cc: svn-doc-head@freebsd.org, svn-doc-all@freebsd.org,
doc-committers@freebsd.org
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Sun, 13 Oct 2013 15:01:31 -0000
On Sun, 13 Oct 2013, Warren Block wrote:
> On Sun, 13 Oct 2013, Gavin Atkinson wrote:
>
> > Author: gavin
> > Date: Sun Oct 13 11:44:18 2013
> > New Revision: 42948
> > URL: http://svnweb.freebsd.org/changeset/doc/42948
> >
> > Log:
> > Replace UTF-8 'RIGHT SINGLE QUOTATION MARK' (U+2019), encoded as
> > 0xE2 0x80 0x99, with a standard apostrophe. It's not clear to me why
> > this was brealing the build on the cluster and seemingly nowhere else, but
> > this should at least allow the build there to complete.
> >
> > Modified:
> > head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
> >
> > Modified: head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
> > ==============================================================================
> > --- head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Sun
> > Oct 13 03:19:30 2013 (r42947)
> > +++ head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Sun
> > Oct 13 11:44:18 2013 (r42948)
> > @@ -6264,7 +6264,7 @@ target iqn.2012-06.com.example:target0 {
> > allowed.
> >
> > Second entry defines a single target. Target has two
> > - meanings - it is a machine serving iSCSI, but it?s also
> > + meanings - it is a machine serving iSCSI, but it's also
> > a named group of LUNs. In this example, we use the latter
> > meaning. The "iqn.2012-06.com.example:target0" is the
> > target name. For testing purposes it might be left as it
>
> Contractions are a style guide problem anyway. "it's" should be expanded or
> even removed.
Absolutely - this commit was purely to get the docbuilds on the cluster
working again. I have no time to do more than that today.
Gavin
> "Second entry defines a single target." is missing an article, or possibly
> better rearranged as "A single target is defined by the second entry."
>
> The word "target" in the second sentence could use or tags
> to point out that it is talking about the use of the word in the first
> sentence.
>
From owner-svn-doc-head@FreeBSD.ORG Sun Oct 13 19:40:11 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 2961366B;
Sun, 13 Oct 2013 19:40:11 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 15B6F23B5;
Sun, 13 Oct 2013 19:40:11 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9DJeB1x061140;
Sun, 13 Oct 2013 19:40:11 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9DJeBYq061139;
Sun, 13 Oct 2013 19:40:11 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201310131940.r9DJeBYq061139@svn.freebsd.org>
From: Dru Lavigne
Date: Sun, 13 Oct 2013 19:40:11 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42949 - head/en_US.ISO8859-1/books/handbook/multimedia
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Sun, 13 Oct 2013 19:40:11 -0000
Author: dru
Date: Sun Oct 13 19:40:10 2013
New Revision: 42949
URL: http://svnweb.freebsd.org/changeset/doc/42949
Log:
This patch does the following:
- comments out some authors
- tightens up some headings
- some word-smithing
- changes examples to more modern sound cards
Approved by: bcr (mentor)
Modified:
head/en_US.ISO8859-1/books/handbook/multimedia/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/multimedia/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/multimedia/chapter.xml Sun Oct 13 11:44:18 2013 (r42948)
+++ head/en_US.ISO8859-1/books/handbook/multimedia/chapter.xml Sun Oct 13 19:40:10 2013 (r42949)
@@ -61,7 +61,7 @@
- Playback DVDs, .mpg, and
+ Play DVDs, .mpg, and
.avi files.
@@ -80,52 +80,38 @@
Configure an image scanner.
-
-
- How to configure an image scanner.
- Before reading this chapter, you should:
- Know how to configure and install a new kernel
- ().
-
-
-
- Audio CDs have specialized encodings which differ from the
- usual ISO-filesystem. This means that they should not be
- mounted using &man.mount.8;.
-
-
+ Know how to install applications as described in
+ .
+
+
+ Contributed by in November 2000MarcFonvieille
- Enhanced by
-
+ Enhanced by in September 2004
+ -->
Setting Up the Sound Card
-
- Configuring the System
-
PCIsound cardsBefore beginning the configuration, determine the model of
@@ -140,19 +126,19 @@
configuration
- In order to use the sound device, the proper device driver
- must be loaded. This may be accomplished in one of two ways.
+ In order to use the sound device, its device driver
+ must be loaded.
The easiest way is to load a kernel module for the sound card
with &man.kldload.8;. This example loads the driver for a
- Creative &soundblaster; Live! sound card:
+ built-in audio chipset based on the Intel specification:
- &prompt.root; kldload snd_emu10k1
+ &prompt.root; kldload snd_hdaTo automate the loading of this driver at boot time, add the
driver to /boot/loader.conf. The line for
this driver is:
- snd_emu10k1_load="YES"
+ snd_hda_load="YES"Other available sound modules are listed in
/boot/defaults/loader.conf. When unsure
@@ -171,32 +157,28 @@
after loading the snd_driver metadriver,
type cat /dev/sndstat.
- Users who prefer to statically compile in support for the
- sound card in a custom kernel should refer to the instructions
- in the next section. For more information about recompiling a
- kernel, refer to .
-
-
+ Configuring a Custom Kernel with Sound Support
+ This section is for users who prefer to statically compile in support for the
+ sound card in a custom kernel. For more information about recompiling a
+ kernel, refer to .
+
When using a custom kernel to provide sound support, make
sure that the audio framework driver exists in the custom kernel
configuration file:device sound
- Next, add support for the sound card. Therefore, you need
- to know which driver supports the card. To continue the example
- of the Creative &soundblaster; Live! sound card from the
+ Next, add support for the sound card. To continue the example
+ of the built-in audio chipset based on the Intel specification from the
previous section, use the following line in the custom kernel
configuration file:
- device snd_emu10k1
+ device snd_hdaBe sure to read the manual page of the driver for the
- syntax to use. The explicit syntax for the kernel
- configuration of every supported sound driver can also be
- found in /usr/src/sys/conf/NOTES.
+ device name to use for the driver.Non-PnP ISA sound cards may require the IRQ and I/O port
settings of the card to be added to
@@ -233,57 +215,62 @@ hint.sbc.0.flags="0x15"
cases, the IRQ or other settings may need to be changed to
match the card. Refer to &man.snd.sbc.4; for more information
about this card.
-
- Testing the Sound Card
+ Testing Sound
- After rebooting into the custom kernel, or after loading
- the required module, the sound card should appear in the system
- message buffer. Run &man.dmesg.8; and look for a message
- like:
-
- pcm0: <Intel ICH3 (82801CA)> port 0xdc80-0xdcbf,0xd800-0xd8ff irq 5 at device 31.5 on pci0
-pcm0: [GIANT-LOCKED]
-pcm0: <Cirrus Logic CS4205 AC97 Codec>
+ After loading
+ the required module or rebooting into the custom kernel,
+ the sound card should be detected.
+ To confirm, run dmesg | grep pcm. This
+ example is from a system with a built-in Conexant CX20590 chipset:
+
+ pcm0: <NVIDIA (0x001c) (HDMI/DP 8ch)> at nid 5 on hdaa0
+pcm1: <NVIDIA (0x001c) (HDMI/DP 8ch)> at nid 6 on hdaa0
+pcm2: <Conexant CX20590 (Analog 2.0+HP/2.0)> at nid 31,25 and 35,27 on hdaa1The status of the sound card may also be checked using this
command:&prompt.root; cat /dev/sndstat
-FreeBSD Audio Driver (newpcm)
+FreeBSD Audio Driver (newpcm: 64bit 2009061500/amd64)
Installed devices:
-pcm0: <Intel ICH3 (82801CA)> at io 0xd800, 0xdc80 irq 5 bufsz 16384
-kld snd_ich (1p/2r/0v channels duplex default)
-
- The output may vary between systems. If no
- pcm devices are listed, go back and
- review the kernel configuration file and make sure the correct
- device driver was chosen. Common problems are listed in .
+pcm0: <NVIDIA (0x001c) (HDMI/DP 8ch)> (play)
+pcm1: <NVIDIA (0x001c) (HDMI/DP 8ch)> (play)
+pcm2: <Conexant CX20590 (Analog 2.0+HP/2.0)> (play/rec) default
+
+ The output will vary depending upon the sound card. If no
+ pcm devices are listed, double-check that the correct
+ device driver was loaded or compiled into the kernel. The
+ next section lists some common problems and their solutions.If all goes well, the sound card should now work in os;. If
- the CD-ROM or DVD-ROM drive's audio-out pins are properly
+ the CD or DVD drive is properly
connected to the sound card, one can insert an audio CD in the
drive and play it with &man.cdcontrol.1;:&prompt.user; cdcontrol -f /dev/acd0 play 1
+
+ Audio CDs have specialized encodings which means that they should not be
+ mounted using &man.mount.8;.
+
+
Various applications, such as audio/workman provide a friendlier
+ role="package">audio/workman, provide a friendlier
interface. The audio/mpg123
port can be installed to listen to MP3 audio files.Another quick way to test the card is to send data to
- /dev/dsp:
+ /dev/dsp:&prompt.user; cat filename > /dev/dspwhere
filename can
- be any file. This command should produce some noise, confirming
- that the sound card is actually working.
+ be any type of file. This command should produce some noise, confirming
+ that the sound card is working.
The /dev/dsp* device nodes will
@@ -291,19 +278,21 @@ kld snd_ich (1p/2r/0v channels duplex de
do not exist and will not appear in the output of
&man.ls.1;.
+
- Sound card mixer levels can be changed using &man.mixer.8;.
- More details can be found in &man.mixer.8;.
-
-
- Common Problems
+
+ Troubleshooting Sounddevice nodesI/O portIRQDSP
-
+ Table 8.1 lists some common error messages and their
+ solutions:
+
+
+ Common Error Messages
@@ -337,8 +326,8 @@ kld snd_ich (1p/2r/0v channels duplex de
xxx: can't open
/dev/dsp!
- Check with fstat | grep
- dsp if another application is holding the
+ Type fstat | grep
+ dsp to check if another application is holding the
device open. Noteworthy troublemakers are
esound and
KDE's sound
@@ -346,13 +335,13 @@ kld snd_ich (1p/2r/0v channels duplex de
-
+
- Another issue is that modern graphics cards often come
- with their own sound driver, for use with
- HDMI and similar. This sound device will
- sometimes be enumerated before the sound card and the sound
- card will subsequently not be used as the default playback
+ Modern graphics cards often come
+ with their own sound driver for use with
+ HDMI. This sound device is
+ sometimes enumerated before the sound card meaning that the sound
+ card will not be used as the default playback
device. To check if this is the case, run
dmesg and look for
pcm. The output looks something like
@@ -376,7 +365,7 @@ pcm6: <HDA Realtek ALC889 PCM #2 Digi
pcm7: <HDA Realtek ALC889 PCM #3 Digital> at cad 2 nid 1 on hdac1
...
- Here the graphics card (NVidia) has
+ In this example, the graphics card (NVidia) has
been enumerated before the sound card (Realtek
ALC889). To use the sound card as the default
playback device, change hw.snd.default_unit
@@ -384,17 +373,17 @@ pcm7: <HDA Realtek ALC889 PCM #3 Digi
&prompt.root; sysctl hw.snd.default_unit=n
- Here, n is the number of the sound
+ where n is the number of the sound
device to use. In this example, it should be
4. Make this change permanent by adding
the following line to
/etc/sysctl.conf:hw.snd.default_unit=4
-
+
Utilizing Multiple Sound SourcesIt is often desirable to have multiple sources of sound that
- are able to play simultaneously. &os; uses Virtual
- Sound Channels, which can be enabled using
- &man.sysctl.8;. Virtual channels allow one to multiplex the
+ are able to play simultaneously. &os; uses Virtual
+ Sound Channels to multiplex the
sound card's playback by mixing sound in the kernel.
- To set the number of virtual channels, three
- &man.sysctl.8; knobs are available:
+ Three
+ &man.sysctl.8; knobs are available for configuring virtual channels:&prompt.root; sysctl dev.pcm.0.play.vchans=4
&prompt.root; sysctl dev.pcm.0.rec.vchans=4
&prompt.root; sysctl hw.snd.maxautovchans=4
- The above example allocates four virtual channels, which
+ This example allocates four virtual channels, which
is a practical number for everyday use. Both
dev.pcm.0.play.vchans=4 and
- dev.pcm.0.rec.vchans=4 are the number of
+ dev.pcm.0.rec.vchans=4 are configurable after a device has been
+ attached and represent the number of
virtual channels pcm0 has for playback
- and recording, and are configurable after a device has been
- attached. hw.snd.maxautovchans is the number
- of virtual channels a new audio device is given when it is
- attached using &man.kldload.8;. Since the
+ and recording. Since the
pcm module can be loaded independently
of the hardware drivers, hw.snd.maxautovchans
- indicates how many virtual channels will be given to devices
- when they are attached. Refer to &man.pcm.4; for more
+ indicates how many virtual channels will be given to an audio device
+ when it is attached. Refer to &man.pcm.4; for more
information.
@@ -447,6 +434,7 @@ pcm7: <HDA Realtek ALC889 PCM #3 Digi
+
Setting Default Values for Mixer ChannelsThe default values for the different mixer channels are
- hardcoded in the source code of the &man.pcm.4; driver. There
- are many different applications and daemons that allow values to
- be set for the mixer that are remembered between invocations,
- but this is not a clean solution. It is possible to set default
- mixer values at the driver level. This is accomplished by
- defining the appropriate values in
+ hardcoded in the source code of the &man.pcm.4; driver. While
+ sound card mixer levels can be changed using &man.mixer.8; or
+ third-party applications and daemons, this is not a permanent solution.
+ To instead set default
+ mixer values at the driver level,
+ define the appropriate values in
/boot/device.hints, as seen in this
example:
@@ -478,16 +467,17 @@ pcm7: <HDA Realtek ALC889 PCM #3 Digi
+
+ -->
MP3 Audio
From owner-svn-doc-head@FreeBSD.ORG Sun Oct 13 19:43:34 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 9C63788D;
Sun, 13 Oct 2013 19:43:34 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 88E0423F9;
Sun, 13 Oct 2013 19:43:34 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9DJhYdp062365;
Sun, 13 Oct 2013 19:43:34 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9DJhYf5062364;
Sun, 13 Oct 2013 19:43:34 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201310131943.r9DJhYf5062364@svn.freebsd.org>
From: Dru Lavigne
Date: Sun, 13 Oct 2013 19:43:34 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42950 - head/en_US.ISO8859-1/books/handbook/linuxemu
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Sun, 13 Oct 2013 19:43:34 -0000
Author: dru
Date: Sun Oct 13 19:43:34 2013
New Revision: 42950
URL: http://svnweb.freebsd.org/changeset/doc/42950
Log:
This patch does the following:
- comments out Mathematica chapter
- adds a comment that the installer shell script works but the binaries don't as only 64-bit is available and to revisit if linuxemu adds 64-bit support
- modernizes 11.3.1
- 11.3.2 left untested as binary would not launch
Approved by: bcr (mentor)
Modified:
head/en_US.ISO8859-1/books/handbook/linuxemu/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/linuxemu/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/linuxemu/chapter.xml Sun Oct 13 19:40:10 2013 (r42949)
+++ head/en_US.ISO8859-1/books/handbook/linuxemu/chapter.xml Sun Oct 13 19:43:34 2013 (r42950)
@@ -326,6 +326,11 @@ multi on
+
From owner-svn-doc-head@FreeBSD.ORG Mon Oct 14 13:12:46 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
[IPv6:2001:1900:2254:206a::19:1])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 68EE3A7E;
Mon, 14 Oct 2013 13:12:46 +0000 (UTC) (envelope-from gjb@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 5668D2651;
Mon, 14 Oct 2013 13:12:46 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9EDCkOl007936;
Mon, 14 Oct 2013 13:12:46 GMT (envelope-from gjb@svn.freebsd.org)
Received: (from gjb@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9EDCkdE007935;
Mon, 14 Oct 2013 13:12:46 GMT (envelope-from gjb@svn.freebsd.org)
Message-Id: <201310141312.r9EDCkdE007935@svn.freebsd.org>
From: Glen Barber
Date: Mon, 14 Oct 2013 13:12:46 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42951 - head/share/xml
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Mon, 14 Oct 2013 13:12:46 -0000
Author: gjb
Date: Mon Oct 14 13:12:45 2013
New Revision: 42951
URL: http://svnweb.freebsd.org/changeset/doc/42951
Log:
Swtich 10.0 to BETA1.
Sponsored by: The FreeBSD Foundation
Modified:
head/share/xml/release.ent
Modified: head/share/xml/release.ent
==============================================================================
--- head/share/xml/release.ent Sun Oct 13 19:43:34 2013 (r42950)
+++ head/share/xml/release.ent Mon Oct 14 13:12:45 2013 (r42951)
@@ -32,7 +32,7 @@
-
+
+
+
+ Users and Basic Account Management
+
+ &os; allows multiple users to use the computer at the same
+ time. While only one user can sit in front of the screen and
+ use the keyboard at any one time, any number of users can log
+ in to the system through the network. To use the system, each
+ user should have their own user account.
+
+ This chapter describes:
+
+
+
+ The different types of user accounts on a
+ &os; system.
+
+
+
+ How to add, remove, and modify user accounts.
+
+
+
+ How to set limits to control the
+ resources that users and
+ groups are allowed to access.
+
+
+
+ How to create groups and add users as members of a group.
+
+
+
+
+ Account Types
+
+ Since all access to the &os; system is achieved using accounts
+ and all processes are run by users, user and account management
+ is important.
+
+ There are three main types of accounts:
+ system accounts,
+ user accounts, and the
+ superuser account.
+
+
+ System Accounts
+
+
+ accounts
+ system
+
+
+ System accounts are used to run services such as DNS,
+ mail, and web servers. The reason for this is security; if
+ all services ran as the superuser, they could act without
+ restriction.
+
+
+ accounts
+ daemon
+
+
+ accounts
+ operator
+
+
+ Examples of system accounts are
+ daemon, operator,
+ bind, news, and
+ www.
+
+
+ accounts
+ nobody
+
+
+ nobody is the generic unprivileged
+ system account. However, the more services that use
+ nobody, the more files and processes that
+ user will become associated with, and hence the more
+ privileged that user becomes.
+
+
+
+ User Accounts
+
+
+ accounts
+ user
+
+
+ User accounts are
+ assigned to real people and are used to log in and use the
+ system. Every person accessing the system should have a unique
+ user account. This allows the administrator to find out who
+ is doing what and prevents users from clobbering the
+ settings of other users.
+
+ Each user can set up their own environment to accommodate
+ their use of the system, by configuring their default shell, editor,
+ key bindings, and language settings.
+ Every user account on a &os; system has certain information
+ associated with it:
+
+
+
+ User name
+
+
+ The user name is typed at the login:
+ prompt. User names must be unique on the system as no two
+ users can have the same user name. There are a number of
+ rules for creating valid user names which are documented in
+ &man.passwd.5;. It is recommended to use user names that consist of eight or
+ fewer, all lower case characters in order to maintain
+ backwards compatibility with applications.
+
+
+
+
+ Password
+
+
+ Each user account should have an associated password. While the
+ password can be blank, this is highly discouraged.
+
+
+
+
+ User ID (UID)
+
+
+ The User ID (UID) is a number
+ used to uniquely identify the user to the
+ &os; system. Commands that
+ allow a user name to be specified will first convert it to
+ the UID. It is recommended to use a UID of
+ 65535 or lower as higher UIDs may cause compatibility
+ issues with software that does not support integers larger
+ than 32-bits.
+
+
+
+
+ Group ID (GID)
+
+
+ The Group ID (GID) is a number used to uniquely identify
+ the primary group that the user belongs to. Groups are a
+ mechanism for controlling access to resources based on a
+ user's GID rather than their
+ UID. This can significantly reduce the
+ size of some configuration files and allows users to be
+ members of more than one group. It is recommended to use a GID of
+ 65535 or lower as higher GIDs may break some
+ software.
+
+
+
+
+ Login class
+
+
+ Login classes are an extension to the group mechanism
+ that provide additional flexibility when tailoring the
+ system to different users. Login classes are discussed
+ further in
+
+
+
+
+ Password change time
+
+
+ By default, &os; does not force users to change their
+ passwords periodically. Password expiration can be
+ enforced on a per-user basis using &man.pw.8;, forcing some or all users to
+ change their passwords after a certain amount of time has
+ elapsed.
+
+
+
+
+ Account expiry time
+
+
+ By default, &os; does not expire accounts. When
+ creating accounts that need a limited lifespan, such as
+ student accounts in a school, specify the account expiry
+ date using &man.pw.8;. After the expiry time has elapsed, the account
+ cannot be used to log in to the system, although the
+ account's directories and files will remain.
+
+
+
+
+ User's full name
+
+
+ The user name uniquely identifies the account to &os;,
+ but does not necessarily reflect the user's real name.
+ Similar to a comment, this information
+ can contain a space, uppercase characters, and be more
+ than 8 characters long.
+
+
+
+
+ Home directory
+
+
+ The home directory is the full path to a directory on
+ the system. This is the user's starting directory when
+ the user logs in. A common convention is to put all user
+ home directories under /home/username
+ or /usr/home/username.
+ Each user stores their personal files and subdirectories
+ in their own home directory.
+
+
+
+
+ User shell
+
+
+ The shell provides the user's default environment for
+ interacting with the system. There are many different
+ kinds of shells and experienced users will have their own
+ preferences, which can be reflected in their account
+ settings.
+
+
+
+
+
+
+ The Superuser Account
+
+
+ accounts
+ superuser (root)
+
+
+ The superuser account, usually called
+ root, is used to
+ manage the system with no limitations on privileges. For this
+ reason, it should not be used for day-to-day
+ tasks like sending and receiving mail, general exploration of
+ the system, or programming.
+
+ The superuser, unlike other user
+ accounts, can operate without limits, and misuse of the
+ superuser account may result in spectacular disasters. User
+ accounts are unable to destroy the operating system by mistake, so it is
+ recommended to login as a user account and to only become the superuser
+ when a command requires extra privilege.
+
+ Always double and triple-check any commands issued as the
+ superuser, since an extra space or missing character can mean
+ irreparable data loss.
+
+ There are several ways to become gain superuser privilege. While one
+ can log in as root, this is highly discouraged.
+
+ Instead, use &man.su.1; to become the superuser. If
+ - is specified when running this command, the user will also inherit the root user's environment.
+ The user running this command must
+ be in the wheel group or else the command
+ will fail. The user must also know the password for the
+ root user account.
+
+ In this example, the user only becomes superuser in order to run
+ make install as this step requires superuser privilege.
+ Once the command completes, the user types exit
+ to leave the superuser account and return to the privilege of
+ their user account.
+
+
+ Install a Program As The Superuser
+
+ &prompt.user; configure
+&prompt.user; make
+&prompt.user; su -
+Password:
+&prompt.root; make install
+&prompt.root; exit
+&prompt.user;
+
+
+ The built-in &man.su.1; framework works well for single systems or small
+ networks with just one system administrator. An alternative
+ is to install the
+ security/sudo package or port. This software
+ provides activity logging and allows the administrator to configure which users
+ can run which commands
+ as the superuser.
+
+
+
+
+ Managing Accounts
+
+
+ accounts
+ modifying
+
+
+ &os; provides a variety of different commands to manage
+ user accounts. The most common commands are summarized below,
+ followed by more detailed examples of their usage.
+
+
+
+
+
+
+
+
+ Command
+ Summary
+
+
+
+
+ &man.adduser.8;
+ The recommended command-line application for adding
+ new users.
+
+
+
+ &man.rmuser.8;
+ The recommended command-line application for
+ removing users.
+
+
+
+ &man.chpass.1;
+ A flexible tool for changing user database
+ information.
+
+
+
+ &man.passwd.1;
+ The simple command-line tool to change user
+ passwords.
+
+
+
+ &man.pw.8;
+ A powerful and flexible tool for modifying all
+ aspects of user accounts.
+
+
+
+
+
+
+ adduser
+
+
+ accounts
+ adding
+
+
+ adduser
+
+
+ /usr/share/skel
+
+ skeleton directory
+ &man.adduser.8; is a simple program for adding new users
+ When a new user is added, this program automatically updates
+ /etc/passwd and
+ /etc/group. It also creates a home
+ directory for the new user, copies in the default
+ configuration files from /usr/share/skel, and can
+ optionally mail the new user a welcome message.
+
+
+ Adding a User on &os;
+
+ &prompt.root; adduser
+Username: jru
+Full name: J. Random User
+Uid (Leave empty for default):
+Login group [jru]:
+Login group is jru. Invite jru into other groups? []: wheel
+Login class [default]:
+Shell (sh csh tcsh zsh nologin) [sh]: zsh
+Home directory [/home/jru]:
+Home directory permissions (Leave empty for default):
+Use password-based authentication? [yes]:
+Use an empty password? (yes/no) [no]:
+Use a random password? (yes/no) [no]:
+Enter password:
+Enter password again:
+Lock out the account after creation? [no]:
+Username : jru
+Password : ****
+Full Name : J. Random User
+Uid : 1001
+Class :
+Groups : jru wheel
+Home : /home/jru
+Shell : /usr/local/bin/zsh
+Locked : no
+OK? (yes/no): yes
+adduser: INFO: Successfully added (jru) to the user database.
+Add another user? (yes/no): no
+Goodbye!
+&prompt.root;
+
+
+
+ Since the password is not echoed when typed, be careful
+ to not mistype the password when creating the user
+ account.
+
+
+
+
+ rmuser
+
+ rmuser
+
+ accounts
+ removing
+
+
+ To completely remove a user from the system use
+ &man.rmuser.8;. This command performs the following
+ steps:
+
+
+
+ Removes the user's &man.crontab.1; entry if one
+ exists.
+
+
+
+ Removes any &man.at.1; jobs belonging to the
+ user.
+
+
+
+ Kills all processes owned by the user.
+
+
+
+ Removes the user from the system's local password
+ file.
+
+
+
+ Removes the user's home directory, if it is owned by
+ the user.
+
+
+
+ Removes the incoming mail files belonging to the user
+ from /var/mail.
+
+
+
+ Removes all files owned by the user from temporary
+ file storage areas such as /tmp.
+
+
+
+ Finally, removes the username from all groups to which
+ it belongs in /etc/group.
+
+
+ If a group becomes empty and the group name is the
+ same as the username, the group is removed. This
+ complements the per-user unique groups created by
+ &man.adduser.8;.
+
+
+
+
+ &man.rmuser.8; cannot be used to remove superuser
+ accounts since that is almost always an indication of massive
+ destruction.
+
+ By default, an interactive mode is used, as shown
+ in the following example.
+
+
+ rmuser Interactive Account
+ Removal
+
+ &prompt.root; rmuser jru
+Matching password entry:
+jru:*:1001:1001::0:0:J. Random User:/home/jru:/usr/local/bin/zsh
+Is this the entry you wish to remove? y
+Remove user's home directory (/home/jru)? y
+Updating password file, updating databases, done.
+Updating group file: trusted (removing group jru -- personal group is empty) done.
+Removing user's incoming mail file /var/mail/jru: done.
+Removing files belonging to jru from /tmp: done.
+Removing files belonging to jru from /var/tmp: done.
+Removing files belonging to jru from /var/tmp/vi.recover: done.
+&prompt.root;
+
+
+
+
+ chpass
+
+ chpass
+ &man.chpass.1; can be used to change user database
+ information such as passwords, shells, and personal
+ information.
+
+ Only the superuser can change other users' information and
+ passwords with &man.chpass.1;.
+
+ When passed no options, aside from an optional username,
+ &man.chpass.1; displays an editor containing user information.
+ When the user exists from the editor, the user database is
+ updated with the new information.
+
+
+ You will be asked for your password after exiting the
+ editor if you are not the superuser.
+
+
+
+ Interactive chpass by
+ Superuser
+
+ #Changing user database information for jru.
+Login: jru
+Password: *
+Uid [#]: 1001
+Gid [# or name]: 1001
+Change [month day year]:
+Expire [month day year]:
+Class:
+Home directory: /home/jru
+Shell: /usr/local/bin/zsh
+Full Name: J. Random User
+Office Location:
+Office Phone:
+Home Phone:
+Other information:
+
+
+ A user can change only a small subset of this
+ information, and only for their own user account.
+
+
+ Interactive chpass by Normal
+ User
+
+ #Changing user database information for jru.
+Shell: /usr/local/bin/zsh
+Full Name: J. Random User
+Office Location:
+Office Phone:
+Home Phone:
+Other information:
+
+
+
+ &man.chfn.1; and &man.chsh.1; are links to
+ &man.chpass.1;, as are &man.ypchpass.1;, &man.ypchfn.1;, and
+ &man.ypchsh.1;. NIS support is
+ automatic, so specifying the yp before
+ the command is not necessary. How to configure NIS is
+ covered in .
+
+
+
+ passwd
+
+ passwd
+
+ accounts
+ changing password
+
+ &man.passwd.1; is the usual way to change your own
+ password as a user, or another user's password as the
+ superuser.
+
+
+ To prevent accidental or unauthorized changes, the user
+ must enter their original password before a new password can
+ be set. This is not the case when the superuser changes a
+ user's password.
+
+
+
+ Changing Your Password
+
+ &prompt.user; passwd
+Changing local password for jru.
+Old password:
+New password:
+Retype new password:
+passwd: updating the database...
+passwd: done
+
+
+
+ Changing Another User's Password as the
+ Superuser
+
+ &prompt.root; passwd jru
+Changing local password for jru.
+New password:
+Retype new password:
+passwd: updating the database...
+passwd: done
+
+
+
+ As with &man.chpass.1;, &man.yppasswd.1; is a link to
+ &man.passwd.1;, so NIS works with either command.
+
+
+
+
+
+ pw
+
+ pw
+
+ &man.pw.8; is a command line utility to create, remove,
+ modify, and display users and groups. It functions as a front
+ end to the system user and group files. &man.pw.8; has a very
+ powerful set of command line options that make it suitable for
+ use in shell scripts, but new users may find it more
+ complicated than the other commands presented in this
+ section.
+
+
+
+
+ Limiting Users
+
+ limiting users
+
+ accounts
+ limiting
+
+ &os; provides several methods for an administrator to limit
+ the amount of system resources an individual may use. These
+ limits are discussed in two sections: disk quotas and other
+ resource limits.
+
+ quotas
+
+ limiting users
+ quotas
+
+ disk quotas
+ Disk quotas limit the amount of disk space available to
+ users and provide a way to quickly check that usage without
+ calculating it every time. Quotas are discussed in .
+
+ The other resource limits include ways to limit the amount
+ of CPU, memory, and other resources a user may consume. These
+ are defined using login classes and are discussed here.
+
+
+ /etc/login.conf
+
+ Login classes are defined in
+ /etc/login.conf and are described in detail
+ in &man.login.conf.5;. Each user account is assigned to a login
+ class, default by default, and each login
+ class has a set of login capabilities associated with it. A
+ login capability is a
+ name=value
+ pair, where name is a well-known
+ identifier and value is an arbitrary
+ string which is processed accordingly depending on the
+ name. Setting up login classes and
+ capabilities is rather straightforward and is also described in
+ &man.login.conf.5;.
+
+
+ &os; does not normally read the configuration in
+ /etc/login.conf directly, but instead
+ reads the /etc/login.conf.db database
+ which provides faster lookups. Whenever
+ /etc/login.conf is edited, the
+ /etc/login.conf.db must be updated by
+ executing the following command:
+
+ &prompt.root; cap_mkdb /etc/login.conf
+
+
+ Resource limits differ from the default login capabilities
+ in two ways. First, for every limit, there is a soft (current)
+ and hard limit. A soft limit may be adjusted by the user or
+ application, but may not be set higher than the hard limit. The
+ hard limit may be lowered by the user, but can only be raised
+ by the superuser. Second, most resource limits apply per
+ process to a specific user, not to the user as a whole. These
+ differences are mandated by the specific handling of the limits,
+ not by the implementation of the login capability
+ framework.
+
+ Below are the most commonly used resource limits. The rest
+ of the limits, along with all the other login capabilities, can
+ be found in &man.login.conf.5;.
+
+
+
+ coredumpsize
+
+
+ The limit on the size of a core filecoredumpsize generated by a
+ program is subordinate to other limitslimiting userscoredumpsize on disk usage, such
+ as filesize, or disk quotas.
+ This limit is often used as a less-severe method of
+ controlling disk space consumption. Since users do not
+ generate core files themselves, and often do not delete
+ them, setting this may save them from running out of disk
+ space should a large program crash.
+
+
+
+
+ cputime
+
+
+ The maximum amount of CPUcputimelimiting userscputime time a user's process may
+ consume. Offending processes will be killed by the
+ kernel.
+
+
+ This is a limit on CPU time
+ consumed, not percentage of the CPU as displayed in
+ some fields by &man.top.1; and &man.ps.1;.
+
+
+
+
+
+ filesize
+
+
+ The maximum size of a filefilesizelimiting usersfilesize the user may own. Unlike
+ disk quotas, this limit is
+ enforced on individual files, not the set of all files a
+ user owns.
+
+
+
+
+ maxproc
+
+
+ The maximum number of processesmaxproclimiting usersmaxproc a user can run. This
+ includes foreground and background processes. This limit
+ may not be larger than the system limit specified by the
+ kern.maxproc &man.sysctl.8;. Setting
+ this limit too small may hinder a user's productivity as
+ it is often useful to be logged in multiple times or to
+ execute pipelines. Some tasks, such as compiling a large
+ program, spawn multiple processes and other intermediate
+ preprocessors.
+
+
+
+
+ memorylocked
+
+
+ The maximum amount of memorymemorylockedlimiting usersmemorylocked a process may request
+ to be locked into main memory using &man.mlock.2;. Some
+ system-critical programs, such as &man.amd.8;, lock into
+ main memory so that if the system begins to swap, they do
+ not contribute to disk thrashing.
+
+
+
+
+ memoryuse
+
+
+ The maximum amount of memorymemoryuselimiting usersmemoryuse a process may consume at
+ any given time. It includes both core memory and swap
+ usage. This is not a catch-all limit for restricting
+ memory consumption, but is a good start.
+
+
+
+
+ openfiles
+
+
+ The maximum number of files a process may have openopenfileslimiting usersopenfiles.
+ In &os;, files are used to represent sockets and IPC
+ channels, so be careful not to set this too low. The
+ system-wide limit for this is defined by the
+ kern.maxfiles &man.sysctl.8;.
+
+
+
+
+ sbsize
+
+
+ The limit on the amount of network memory, and
+ thus mbufssbsizelimiting userssbsize, a user may consume in order to limit network
+ communications.
+
+
+
+
+ stacksize
+
+
+ The maximum size of a process stackstacksizelimiting usersstacksize. This alone is
+ not sufficient to limit the amount of memory a program
+ may use so it should be used in conjunction with other
+ limits.
+
+
+
+
+ There are a few other things to remember when setting
+ resource limits. Following are some general tips, suggestions,
+ and miscellaneous comments.
+
+
+
+ Processes started at system startup by
+ /etc/rc are assigned to the
+ daemon login class.
+
+
+
+ Although the /etc/login.conf that
+ comes with the system is a good source of reasonable values
+ for most limits, they may not be appropriate for every
+ system. Setting a limit too high may open the system up to
+ abuse, while setting it too low may put a strain on
+ productivity.
+
+
+
+ Users of &xorg; should
+ probably be granted more resources than other users.
+ &xorg; by itself takes a lot of
+ resources, but it also encourages users to run more programs
+ simultaneously.
+
+
+
+ Many limits apply to individual processes, not the user
+ as a whole. For example, setting
+ openfiles to 50 means that each process
+ the user runs may open up to 50 files. The total amount
+ of files a user may open is the value of
+ openfiles multiplied by the value of
+ maxproc. This also applies to memory
+ consumption.
+
+
+
+ For further information on resource limits and login classes
+ and capabilities in general, refer to &man.cap.mkdb.1;,
+ &man.getrlimit.2;, and &man.login.conf.5;.
+
+
+
+ Managing Groups
+
+ groups
+
+ /etc/groups
+
+
+ accounts
+ groups
+
+ A group is a list of users. A group is identified by its
+ group name and GID. In &os;, the
+ kernel uses the UID of a process, and the
+ list of groups it belongs to, to determine what the process is
+ allowed to do. Most of the time, the GID of
+ a user or process usually means the first group in the
+ list.
+
+ The group name to GID mapping is listed
+ in /etc/group. This is a plain text file
+ with four colon-delimited fields. The first field is the group
+ name, the second is the encrypted password, the third the
+ GID, and the fourth the comma-delimited list
+ of members. For a more complete description of the syntax,
+ refer to &man.group.5;.
+
+ The superuser can modify /etc/group
+ using a text editor. Alternatively, &man.pw.8; can be used to
+ add and edit groups. For example, to add a group called
+ teamtwo and then confirm that it
+ exists:
+
+
+ Adding a Group Using &man.pw.8;
+
+ &prompt.root; pw groupadd teamtwo
+&prompt.root; pw groupshow teamtwo
+teamtwo:*:1100:
+
+
+ In this example, 1100 is the
+ GID of teamtwo. Right
+ now, teamtwo has no members. This
+ command will add jru as a member of
+ teamtwo.
+
+
+ Adding User Accounts to a New Group Using
+ &man.pw.8;
+
+ &prompt.root; pw groupmod teamtwo -M jru
+&prompt.root; pw groupshow teamtwo
+teamtwo:*:1100:jru
+
+
+ The argument to is a comma-delimited
+ list of users to be added to a new (empty) group or to replace
+ the members of an existing group. To the user, this group
+ membership is different from (and in addition to) the user's
+ primary group listed in the password file. This means that
+ the user will not show up as a member when using
+ with &man.pw.8;, but will show up
+ when the information is queried via &man.id.1; or a similar
+ tool. When &man.pw.8; is used to add a user to a group, it only
+ manipulates /etc/group and does not attempt
+ to read additional data from
+ /etc/passwd.
+
+
+ Adding a New Member to a Group Using &man.pw.8;
+
+ &prompt.root; pw groupmod teamtwo -m db
+&prompt.root; pw groupshow teamtwo
+teamtwo:*:1100:jru,db
+
+
+ In this example, the argument to is a
+ comma-delimited list of users who are to be added to the group.
+ Unlike the previous example, these users are appended to the
+ group list and do not replace the list of existing users in the
+ group.
*** DIFF OUTPUT TRUNCATED AT 1000 LINES ***
From owner-svn-doc-head@FreeBSD.ORG Mon Oct 14 17:02:30 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 919119DB;
Mon, 14 Oct 2013 17:02:30 +0000 (UTC) (envelope-from gjb@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 7E58827A9;
Mon, 14 Oct 2013 17:02:30 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9EH2U4l027172;
Mon, 14 Oct 2013 17:02:30 GMT (envelope-from gjb@svn.freebsd.org)
Received: (from gjb@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9EH2Uev027171;
Mon, 14 Oct 2013 17:02:30 GMT (envelope-from gjb@svn.freebsd.org)
Message-Id: <201310141702.r9EH2Uev027171@svn.freebsd.org>
From: Glen Barber
Date: Mon, 14 Oct 2013 17:02:30 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42954 - head/share/xml
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Mon, 14 Oct 2013 17:02:30 -0000
Author: gjb
Date: Mon Oct 14 17:02:29 2013
New Revision: 42954
URL: http://svnweb.freebsd.org/changeset/doc/42954
Log:
Announce 10.0-BETA1.
Sponsored by: The FreeBSD Foundation
Modified:
head/share/xml/news.xml
Modified: head/share/xml/news.xml
==============================================================================
--- head/share/xml/news.xml Mon Oct 14 16:44:15 2013 (r42953)
+++ head/share/xml/news.xml Mon Oct 14 17:02:29 2013 (r42954)
@@ -34,6 +34,22 @@
10
+ 14
+
+
+ &os; 10.0-BETA1 Available
+
+
The first BETA build for the &os;-10.0 release cycle is
+ now available. ISO images for the amd64, i386, ia64,
+ powerpc, powerpc64 and sparc64 architectures are available
+ on most of our &os;
+ mirror sites.
+
+
+
+ 9
New committer:
From owner-svn-doc-head@FreeBSD.ORG Mon Oct 14 17:26:03 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
[IPv6:2001:1900:2254:206a::19:1])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id BCCC3F4;
Mon, 14 Oct 2013 17:26:03 +0000 (UTC)
(envelope-from ryusuke@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id AA30B2931;
Mon, 14 Oct 2013 17:26:03 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9EHQ3h3039107;
Mon, 14 Oct 2013 17:26:03 GMT (envelope-from ryusuke@svn.freebsd.org)
Received: (from ryusuke@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9EHQ3f7039106;
Mon, 14 Oct 2013 17:26:03 GMT (envelope-from ryusuke@svn.freebsd.org)
Message-Id: <201310141726.r9EHQ3f7039106@svn.freebsd.org>
From: Ryusuke SUZUKI
Date: Mon, 14 Oct 2013 17:26:03 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42955 - head/ja_JP.eucJP/share/xml
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Mon, 14 Oct 2013 17:26:03 -0000
Author: ryusuke
Date: Mon Oct 14 17:26:03 2013
New Revision: 42955
URL: http://svnweb.freebsd.org/changeset/doc/42955
Log:
- Merge the following from the English version:
r42929 -> r42954 head/ja_JP.eucJP/share/xml/news.xml
Modified:
head/ja_JP.eucJP/share/xml/news.xml
Modified: head/ja_JP.eucJP/share/xml/news.xml
==============================================================================
--- head/ja_JP.eucJP/share/xml/news.xml Mon Oct 14 17:02:29 2013 (r42954)
+++ head/ja_JP.eucJP/share/xml/news.xml Mon Oct 14 17:26:03 2013 (r42955)
@@ -20,7 +20,7 @@
the contents of will be preferred over
¿·¥³¥ß¥Ă¥¿½¢Ç¤:
From owner-svn-doc-head@FreeBSD.ORG Mon Oct 14 17:45:56 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
[IPv6:2001:1900:2254:206a::19:1])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id ECC1C56A;
Mon, 14 Oct 2013 17:45:55 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id D8F432A54;
Mon, 14 Oct 2013 17:45:55 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9EHjtrh048643;
Mon, 14 Oct 2013 17:45:55 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9EHjt4e048642;
Mon, 14 Oct 2013 17:45:55 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201310141745.r9EHjt4e048642@svn.freebsd.org>
From: Dru Lavigne
Date: Mon, 14 Oct 2013 17:45:55 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42956 - head/en_US.ISO8859-1/books/handbook/basics
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Mon, 14 Oct 2013 17:45:56 -0000
Author: dru
Date: Mon Oct 14 17:45:55 2013
New Revision: 42956
URL: http://svnweb.freebsd.org/changeset/doc/42956
Log:
White space fix only. Translators can ignore.
Modified:
head/en_US.ISO8859-1/books/handbook/basics/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/basics/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/basics/chapter.xml Mon Oct 14 17:26:03 2013 (r42955)
+++ head/en_US.ISO8859-1/books/handbook/basics/chapter.xml Mon Oct 14 17:45:55 2013 (r42956)
@@ -85,46 +85,48 @@
virtual consolesterminals
- console
+ console
- Unless &os; has been configured to automatically start a
- graphical environment during startup, the system will boot
- into a command line login prompt, as seen in this
- example:
+ Unless &os; has been configured to automatically start a
+ graphical environment during startup, the system will boot
+ into a command line login prompt, as seen in this
+ example:
- FreeBSD/amd64 (pc3.example.org) (ttyv0)
+ FreeBSD/amd64 (pc3.example.org) (ttyv0)
login:
- The first line contains some information about the system.
- The amd64 indicates that the system in this
- example is running a 64-bit version of &os;. The hostname is
- pc3.example.org, and
- ttyv0 indicates that this is the
- system console. The second line is the login prompt.
-
- Since &os; is a multiuser system, it needs some way to distinguish
- between different users. This is accomplished by
- requiring every user to log into the
- system before gaining access to the programs on the system. Every user has a
- unique name username and a personal
- password.
-
- To log into the system console, type the username that was configured during system
- installation, as described in
- , and press
- Enter. Then enter the password associated
- with the username and press Enter. The
- password is not echoed for security
- reasons.
-
- Once the correct password is input, the message of the
- day (MOTD) will be displayed followed
- by a command prompt. Depending upon the shell that was selected
- when the user was created, this prompt will be a #,
- $, or % character. The
- prompt indicates that the user is now logged into the &os; system console and ready to try the
- available commands.
+ The first line contains some information about the system.
+ The amd64 indicates that the system in this
+ example is running a 64-bit version of &os;. The hostname is
+ pc3.example.org, and
+ ttyv0 indicates that this is the
+ system console. The second line is the login
+ prompt.
+
+ Since &os; is a multiuser system, it needs some way to
+ distinguish between different users. This is accomplished by
+ requiring every user to log into the system before gaining
+ access to the programs on the system. Every user has a
+ unique name username and a personal
+ password.
+
+ To log into the system console, type the username that
+ was configured during system installation, as described in
+ , and press
+ Enter. Then enter the password associated
+ with the username and press Enter. The
+ password is not echoed for security
+ reasons.
+
+ Once the correct password is input, the message of the
+ day (MOTD) will be displayed followed
+ by a command prompt. Depending upon the shell that was
+ selected when the user was created, this prompt will be a
+ #, $, or
+ % character. The prompt indicates that
+ the user is now logged into the &os; system console and ready
+ to try the available commands.Virtual Consoles
@@ -138,19 +140,22 @@ login:
user is working on, making it difficult to concentrate on
the work at hand.
- By default, &os; is configured to provide several virtual consoles
- for inputting commands. Each virtual console has its own
- login prompt and shell and it is easy to switch between
- virtual consoles. This essentially provides the command line
- equivalent of having several windows open at the same time
- in a graphical environment.
+ By default, &os; is configured to provide several virtual
+ consoles for inputting commands. Each virtual console has
+ its own login prompt and shell and it is easy to switch
+ between virtual consoles. This essentially provides the
+ command line equivalent of having several windows open at the
+ same time in a graphical environment.
- The key combinations AltF1
+ The key combinations
+ AltF1
through
- AltF8 have been reserved by &os; for
- switching between virtual consoles. Use
+ AltF8
+ have been reserved by &os; for switching between virtual
+ consoles. Use
AltF1
- to switch to the system console (ttyv0),
+ to switch to the system console
+ (ttyv0),
AltF2
to access the first virtual console
(ttyv1),
@@ -159,22 +164,19 @@ login:
(ttyv2), and so on.When switching from one console to the next, &os; takes
- manages the screen output. The result is
- an illusion of having multiple
- virtual screens and keyboards that can be used
+ manages the screen output. The result is an illusion of
+ having multiple virtual screens and keyboards that can be used
to type commands for &os; to run. The programs that are
launched in one virtual console do not stop running when
- the user switches to a
- different virtual console.
+ the user switches to a different virtual console.Refer to &man.syscons.4;, &man.atkbd.4;,
&man.vidcontrol.1; and &man.kbdcontrol.1; for a more
technical description of the &os; console and its keyboard
drivers.
- In &os;, the number of available virtual
- consoles is configured in this
- section of
+ In &os;, the number of available virtual consoles is
+ configured in this section of
/etc/ttys:# name getty type status comments
@@ -191,11 +193,12 @@ ttyv7 "/usr/libexec/getty Pc"
ttyv8 "/usr/X11R6/bin/xdm -nodaemon" xterm off secure
- To disable a virtual console, put a comment symbol (#)
- at the beginning of the line representing that virtual console.
- For example, to reduce the number of available virtual consoles
- from eight to four, put a # in front of
- the last four lines representing virtual consoles
+ To disable a virtual console, put a comment symbol
+ (#) at the beginning of the line
+ representing that virtual console. For example, to reduce
+ the number of available virtual consoles from eight to four,
+ put a # in front of the last four lines
+ representing virtual consoles
ttyv5 through
ttyv8. Do not
comment out the line for the system console
@@ -204,7 +207,7 @@ ttyv8 "/usr/X11R6/bin/xdm -nodaemon"
the graphical environment if &xorg;
has been installed and configured as described in .
-
+
For a detailed description of every column in this file
and the available options for the virtual consoles, refer to
&man.ttys.5;.
@@ -216,40 +219,38 @@ ttyv8 "/usr/X11R6/bin/xdm -nodaemon"
The &os; boot menu provides an option labelled as
Boot Single User. If this option is selected,
the system will boot into a special mode known as
- single user mode. This mode is typically used to
- repair a system that will not boot or to reset the
+ single user mode. This mode is typically used
+ to repair a system that will not boot or to reset the
root password when it is not known.
- While in single user mode, networking and other
- virtual consoles are not available. However, full
+ While in single user mode, networking and other virtual
+ consoles are not available. However, full
root access to the system is available,
and by default, the root password is not
needed. For these reasons, physical access to the keyboard
- is needed to boot into this mode and determining who has physical
- access to the keyboard is something to consider when securing
- a &os; system.
+ is needed to boot into this mode and determining who has
+ physical access to the keyboard is something to consider when
+ securing a &os; system.
- The settings which control
- single user mode are found in this section of
- /etc/ttys:
+ The settings which control single user mode are found in
+ this section of /etc/ttys:# name getty type status comments
#
# If console is marked "insecure", then init will ask for the root password
# when going to single-user mode.
console none unknown off secure
-
- By default, the status is set to secure.
- This assumes that who has physical access to the keyboard
- is either not important or it is controlled by a physical
- security policy. If this setting is changed to
- insecure, the assumption is that the
- environment itself is insecure because anyone can access
- the keyboard. When this line is changed to
- insecure, &os; will prompt for the
- root password when a user selects to boot into single
- user mode.
-
-
+
+ By default, the status is set to
+ secure. This assumes that who has
+ physical access to the keyboard is either not important or it
+ is controlled by a physical security policy. If this setting
+ is changed to insecure, the assumption is
+ that the environment itself is insecure because anyone can
+ access the keyboard. When this line is changed to
+ insecure, &os; will prompt for the
+ root password when a user selects to
+ boot into single user mode.
+
Be careful when changing this setting to
insecure! If the
@@ -331,94 +332,95 @@ console none
- How to create groups and add users as members of a group.
+ How to create groups and add users as members of a
+ group.
-
- Account Types
-
- Since all access to the &os; system is achieved using accounts
- and all processes are run by users, user and account management
- is important.
-
- There are three main types of accounts:
- system accounts,
- user accounts, and the
- superuser account.
-
-
- System Accounts
-
-
- accounts
- system
-
-
- System accounts are used to run services such as DNS,
- mail, and web servers. The reason for this is security; if
- all services ran as the superuser, they could act without
- restriction.
-
-
- accounts
- daemon
-
-
- accounts
- operator
-
-
- Examples of system accounts are
- daemon, operator,
- bind, news, and
- www.
+
+ Account Types
-
- accounts
- nobody
-
-
- nobody is the generic unprivileged
- system account. However, the more services that use
- nobody, the more files and processes that
- user will become associated with, and hence the more
- privileged that user becomes.
-
-
-
- User Accounts
-
-
- accounts
- user
-
-
- User accounts are
- assigned to real people and are used to log in and use the
- system. Every person accessing the system should have a unique
- user account. This allows the administrator to find out who
- is doing what and prevents users from clobbering the
- settings of other users.
-
- Each user can set up their own environment to accommodate
- their use of the system, by configuring their default shell, editor,
- key bindings, and language settings.
- Every user account on a &os; system has certain information
- associated with it:
-
-
-
- User name
+ Since all access to the &os; system is achieved using
+ accounts and all processes are run by users, user and account
+ management is important.
+
+ There are three main types of accounts: system accounts,
+ user accounts, and the superuser account.
+
+
+ System Accounts
+
+
+ accounts
+ system
+
+
+ System accounts are used to run services such as DNS,
+ mail, and web servers. The reason for this is security; if
+ all services ran as the superuser, they could act without
+ restriction.
+
+
+ accounts
+ daemon
+
+
+ accounts
+ operator
+
+
+ Examples of system accounts are
+ daemon, operator,
+ bind, news, and
+ www.
+
+
+ accounts
+ nobody
+
+
+ nobody is the generic unprivileged
+ system account. However, the more services that use
+ nobody, the more files and processes
+ that user will become associated with, and hence the more
+ privileged that user becomes.
+
+
+
+ User Accounts
+
+
+ accounts
+ user
+
+
+ User accounts are assigned to real people and are used
+ to log in and use the system. Every person accessing the
+ system should have a unique user account. This allows the
+ administrator to find out who is doing what and prevents
+ users from clobbering the settings of other users.
+
+ Each user can set up their own environment to
+ accommodate their use of the system, by configuring their
+ default shell, editor, key bindings, and language
+ settings.
+
+ Every user account on a &os; system has certain
+ information associated with it:
+
+
+
+ User nameThe user name is typed at the login:
prompt. User names must be unique on the system as no two
users can have the same user name. There are a number of
- rules for creating valid user names which are documented in
- &man.passwd.5;. It is recommended to use user names that consist of eight or
- fewer, all lower case characters in order to maintain
- backwards compatibility with applications.
+ rules for creating valid user names which are documented
+ in &man.passwd.5;. It is recommended to use user names
+ that consist of eight or fewer, all lower case characters
+ in order to maintain backwards compatibility with
+ applications.
@@ -426,8 +428,9 @@ console none
Password
- Each user account should have an associated password. While the
- password can be blank, this is highly discouraged.
+ Each user account should have an associated password.
+ While the password can be blank, this is highly
+ discouraged.
@@ -435,14 +438,13 @@ console none
User ID (UID)
- The User ID (UID) is a number
- used to uniquely identify the user to the
- &os; system. Commands that
- allow a user name to be specified will first convert it to
- the UID. It is recommended to use a UID of
- 65535 or lower as higher UIDs may cause compatibility
- issues with software that does not support integers larger
- than 32-bits.
+ The User ID (UID) is a number used
+ to uniquely identify the user to the &os; system.
+ Commands that allow a user name to be specified will
+ first convert it to the UID. It is
+ recommended to use a UID of 65535 or lower as higher UIDs
+ may cause compatibility issues with software that does
+ not support integers larger than 32-bits.
@@ -450,14 +452,15 @@ console none
Group ID (GID)
- The Group ID (GID) is a number used to uniquely identify
- the primary group that the user belongs to. Groups are a
- mechanism for controlling access to resources based on a
- user's GID rather than their
+ The Group ID (GID) is a number
+ used to uniquely identify the primary group that the user
+ belongs to. Groups are a mechanism for controlling
+ access to resources based on a user's
+ GID rather than their
UID. This can significantly reduce the
size of some configuration files and allows users to be
- members of more than one group. It is recommended to use a GID of
- 65535 or lower as higher GIDs may break some
+ members of more than one group. It is recommended to use
+ a GID of 65535 or lower as higher GIDs may break some
software.
@@ -479,9 +482,9 @@ console none
By default, &os; does not force users to change their
passwords periodically. Password expiration can be
- enforced on a per-user basis using &man.pw.8;, forcing some or all users to
- change their passwords after a certain amount of time has
- elapsed.
+ enforced on a per-user basis using &man.pw.8;, forcing
+ some or all users to change their passwords after a
+ certain amount of time has elapsed.
@@ -492,9 +495,10 @@ console none
By default, &os; does not expire accounts. When
creating accounts that need a limited lifespan, such as
student accounts in a school, specify the account expiry
- date using &man.pw.8;. After the expiry time has elapsed, the account
- cannot be used to log in to the system, although the
- account's directories and files will remain.
+ date using &man.pw.8;. After the expiry time has
+ elapsed, the account cannot be used to log in to the
+ system, although the account's directories and files will
+ remain.
@@ -504,9 +508,9 @@ console none
The user name uniquely identifies the account to &os;,
but does not necessarily reflect the user's real name.
- Similar to a comment, this information
- can contain a space, uppercase characters, and be more
- than 8 characters long.
+ Similar to a comment, this information can contain a
+ space, uppercase characters, and be more than 8
+ characters long.
@@ -538,9 +542,9 @@ console none
-
+
-
+ The Superuser Account
@@ -558,50 +562,53 @@ console none
The superuser, unlike other user
accounts, can operate without limits, and misuse of the
superuser account may result in spectacular disasters. User
- accounts are unable to destroy the operating system by mistake, so it is
- recommended to login as a user account and to only become the superuser
- when a command requires extra privilege.
+ accounts are unable to destroy the operating system by
+ mistake, so it is recommended to login as a user account and
+ to only become the superuser when a command requires extra
+ privilege.
Always double and triple-check any commands issued as the
superuser, since an extra space or missing character can mean
irreparable data loss.
- There are several ways to become gain superuser privilege. While one
- can log in as root, this is highly discouraged.
-
- Instead, use &man.su.1; to become the superuser. If
- - is specified when running this command, the user will also inherit the root user's environment.
- The user running this command must
- be in the wheel group or else the command
- will fail. The user must also know the password for the
- root user account.
-
- In this example, the user only becomes superuser in order to run
- make install as this step requires superuser privilege.
- Once the command completes, the user types exit
- to leave the superuser account and return to the privilege of
- their user account.
+ There are several ways to become gain superuser privilege.
+ While one can log in as root, this is
+ highly discouraged.
+
+ Instead, use &man.su.1; to become the superuser. If
+ - is specified when running this command,
+ the user will also inherit the root user's environment. The
+ user running this command must be in the
+ wheel group or else the command will
+ fail. The user must also know the password for the
+ root user account.
+
+ In this example, the user only becomes superuser in order
+ to run make install as this step requires
+ superuser privilege. Once the command completes, the user
+ types exit to leave the superuser account
+ and return to the privilege of their user account.
-
- Install a Program As The Superuser
+
+ Install a Program As The Superuser
- &prompt.user; configure
+ &prompt.user; configure
&prompt.user; make
&prompt.user; su -
Password:
&prompt.root; make install
&prompt.root; exit
&prompt.user;
-
+
- The built-in &man.su.1; framework works well for single systems or small
- networks with just one system administrator. An alternative
- is to install the
- security/sudo package or port. This software
- provides activity logging and allows the administrator to configure which users
- can run which commands
- as the superuser.
-
+ The built-in &man.su.1; framework works well for single
+ systems or small networks with just one system administrator.
+ An alternative is to install the security/sudo package or port.
+ This software provides activity logging and allows the
+ administrator to configure which users can run which commands
+ as the superuser.
+
@@ -918,7 +925,7 @@ passwd: done
Changing Another User's Password as the
Superuser
- &prompt.root; passwd jru
+ &prompt.root; passwd jru
Changing local password for jru.
New password:
Retype new password:
@@ -1025,14 +1032,17 @@ passwd: donecoredumpsize
- The limit on the size of a core filecoredumpsize generated by a
- program is subordinate to other limitslimiting userscoredumpsize on disk usage, such
- as filesize, or disk quotas.
- This limit is often used as a less-severe method of
- controlling disk space consumption. Since users do not
- generate core files themselves, and often do not delete
- them, setting this may save them from running out of disk
- space should a large program crash.
+ The limit on the size of a core file
+ coredumpsize
+ generated by a program is subordinate to other
+ limits limiting users
+ coredumpsize
+ on disk usage, such as filesize, or
+ disk quotas. This limit is often used as a less-severe
+ method of controlling disk space consumption. Since
+ users do not generate core files themselves, and often do
+ not delete them, setting this may save them from running
+ out of disk space should a large program crash.
@@ -1040,9 +1050,12 @@ passwd: donecputime
- The maximum amount of CPUcputimelimiting userscputime time a user's process may
- consume. Offending processes will be killed by the
- kernel.
+ The maximum amount of CPU
+ cputime
+ limiting users
+ cputime
+ time a user's process may consume. Offending processes
+ will be killed by the kernel.This is a limit on CPU time
@@ -1056,10 +1069,13 @@ passwd: done
filesize
- The maximum size of a filefilesizelimiting usersfilesize the user may own. Unlike
- disk quotas, this limit is
- enforced on individual files, not the set of all files a
- user owns.
+ The maximum size of a file
+ filesize
+ limiting users
+ filesize
+ the user may own. Unlike disk
+ quotas, this limit is enforced on individual
+ files, not the set of all files a user owns.
@@ -1067,9 +1083,13 @@ passwd: done
maxproc
- The maximum number of processesmaxproclimiting usersmaxproc a user can run. This
- includes foreground and background processes. This limit
- may not be larger than the system limit specified by the
+ The maximum number of processes
+ maxproc
+ limiting users
+ maxproc a
+ user can run. This includes foreground and background
+ processes. This limit may not be larger than the system
+ limit specified by the
kern.maxproc &man.sysctl.8;. Setting
this limit too small may hinder a user's productivity as
it is often useful to be logged in multiple times or to
@@ -1083,11 +1103,15 @@ passwd: done
memorylocked
- The maximum amount of memorymemorylockedlimiting usersmemorylocked a process may request
- to be locked into main memory using &man.mlock.2;. Some
- system-critical programs, such as &man.amd.8;, lock into
- main memory so that if the system begins to swap, they do
- not contribute to disk thrashing.
+ The maximum amount of memory
+ memorylocked
+ limiting users
+ memorylocked
+ a process may request to be locked into main memory using
+ &man.mlock.2;. Some system-critical programs, such as
+ &man.amd.8;, lock into main memory so that if the system
+ begins to swap, they do not contribute to disk
+ thrashing.
@@ -1095,10 +1119,14 @@ passwd: done
memoryuse
- The maximum amount of memorymemoryuselimiting usersmemoryuse a process may consume at
- any given time. It includes both core memory and swap
- usage. This is not a catch-all limit for restricting
- memory consumption, but is a good start.
+ The maximum amount of memory
+ memoryuse
+ limiting
+ usersmemoryuse
+ a process may consume at any given time. It includes both
+ core memory and swap usage. This is not a catch-all limit
+ for restricting memory consumption, but is a good
+ start.
@@ -1106,7 +1134,10 @@ passwd: done
openfiles
- The maximum number of files a process may have openopenfileslimiting usersopenfiles.
+ The maximum number of files a process may have open
+ openfiles
+ limiting
+ usersopenfiles.
In &os;, files are used to represent sockets and IPC
channels, so be careful not to set this too low. The
system-wide limit for this is defined by the
@@ -1119,7 +1150,10 @@ passwd: done
The limit on the amount of network memory, and
- thus mbufssbsizelimiting userssbsize, a user may consume in order to limit network
+ thus mbufs
+ sbsizelimiting
+ userssbsize,
+ a user may consume in order to limit network
communications.
@@ -1128,10 +1162,12 @@ passwd: done
stacksize
- The maximum size of a process stackstacksizelimiting usersstacksize. This alone is
- not sufficient to limit the amount of memory a program
- may use so it should be used in conjunction with other
- limits.
+ The maximum size of a process stack
+ stacksizelimiting
+ usersstacksize.
+ This alone is not sufficient to limit the amount of memory
+ a program may use so it should be used in conjunction with
+ other limits.
@@ -1271,13 +1307,13 @@ teamtwo:*:1100:jru,db
uid=1001(jru) gid=1001(jru) groups=1001(jru), 1100(teamtwo)
- In this example, jru is a member of the
- groups jru and
- teamtwo.
-
- For more information about this command and the format of
- /etc/group, refer to &man.pw.8; and
- &man.group.5;.
+ In this example, jru is a member of
+ the groups jru and
+ teamtwo.
+
+ For more information about this command and the format of
+ /etc/group, refer to &man.pw.8; and
+ &man.group.5;.
@@ -1294,15 +1330,14 @@ uid=1001(jru) gid=1001(jru) groups=1001(
the files used by the operating system or owned by other
users.
- This section discusses the traditional &unix;
- permissions used in &os;. For finer grained file system access control,
- refer to
- .
+ This section discusses the traditional &unix; permissions
+ used in &os;. For finer grained file system access control,
+ refer to .In &unix;, basic permissions are assigned using
three types of access: read, write, and execute. These access
types are used to determine file access to the file's owner,
- group, and others (everyone else). The read, write, and execute
+ group, and others (everyone else). The read, write, and execute
permissions can be represented as the letters
r, w, and
x. They can also be represented as binary
@@ -1315,10 +1350,10 @@ uid=1001(jru) gid=1001(jru) groups=1001(
1.Table 4.1 summarizes the possible numeric and alphabetic
- possibilities. When reading the Directory Listing
- column, a - is used to represent a permission
- that is set to off.
-
+ possibilities. When reading the Directory
+ Listing column, a - is used to
+ represent a permission that is set to off.
+
permissionsfile permissions
From owner-svn-doc-head@FreeBSD.ORG Mon Oct 14 18:58:05 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 7F90F206;
Mon, 14 Oct 2013 18:58:05 +0000 (UTC) (envelope-from pgj@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 6D9292F0B;
Mon, 14 Oct 2013 18:58:05 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9EIw5fl089139;
Mon, 14 Oct 2013 18:58:05 GMT (envelope-from pgj@svn.freebsd.org)
Received: (from pgj@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9EIw5gr089138;
Mon, 14 Oct 2013 18:58:05 GMT (envelope-from pgj@svn.freebsd.org)
Message-Id: <201310141858.r9EIw5gr089138@svn.freebsd.org>
From: Gabor Pali
Date: Mon, 14 Oct 2013 18:58:05 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42957 - head/en_US.ISO8859-1/htdocs/news/status
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Mon, 14 Oct 2013 18:58:05 -0000
Author: pgj
Date: Mon Oct 14 18:58:04 2013
New Revision: 42957
URL: http://svnweb.freebsd.org/changeset/doc/42957
Log:
- Set date for the next, 2013Q4 report
Modified:
head/en_US.ISO8859-1/htdocs/news/status/report-2013-07-2013-09.xml
Modified: head/en_US.ISO8859-1/htdocs/news/status/report-2013-07-2013-09.xml
==============================================================================
--- head/en_US.ISO8859-1/htdocs/news/status/report-2013-07-2013-09.xml Mon Oct 14 17:45:55 2013 (r42956)
+++ head/en_US.ISO8859-1/htdocs/news/status/report-2013-07-2013-09.xml Mon Oct 14 18:58:04 2013 (r42957)
@@ -17,13 +17,11 @@
-
Thanks to all the reporters for the excellent work! This report
contains 30 entries and we hope you enjoy reading it.
-
The deadline for submissions covering between October and
- December 2013 is not yet decided.
+ December 2013 is January 14th, 2014.
From owner-svn-doc-head@FreeBSD.ORG Mon Oct 14 19:20:04 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id AB7BF878;
Mon, 14 Oct 2013 19:20:04 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 9931B2097;
Mon, 14 Oct 2013 19:20:04 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9EJK4vF001010;
Mon, 14 Oct 2013 19:20:04 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9EJK4jL001009;
Mon, 14 Oct 2013 19:20:04 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201310141920.r9EJK4jL001009@svn.freebsd.org>
From: Dru Lavigne
Date: Mon, 14 Oct 2013 19:20:04 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42958 - head/en_US.ISO8859-1/books/handbook/linuxemu
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Mon, 14 Oct 2013 19:20:04 -0000
Author: dru
Date: Mon Oct 14 19:20:04 2013
New Revision: 42958
URL: http://svnweb.freebsd.org/changeset/doc/42958
Log:
Comment out Matlab section for now as it is only available as 64-bit binary.
Approved by: bcr (mentor)
Modified:
head/en_US.ISO8859-1/books/handbook/linuxemu/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/linuxemu/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/linuxemu/chapter.xml Mon Oct 14 18:58:04 2013 (r42957)
+++ head/en_US.ISO8859-1/books/handbook/linuxemu/chapter.xml Mon Oct 14 19:20:04 2013 (r42958)
@@ -624,6 +624,8 @@ FEATURE Maple maplelmg 2000.0831 permane
+
Installing &matlab;
@@ -867,6 +868,7 @@ exit 0
use.
+ -->
From owner-svn-doc-head@FreeBSD.ORG Mon Oct 14 19:54:31 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
[IPv6:2001:1900:2254:206a::19:1])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 06AA3350;
Mon, 14 Oct 2013 19:54:31 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id E645E22C4;
Mon, 14 Oct 2013 19:54:30 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9EJsUL2019780;
Mon, 14 Oct 2013 19:54:30 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9EJsUeT019777;
Mon, 14 Oct 2013 19:54:30 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201310141954.r9EJsUeT019777@svn.freebsd.org>
From: Dru Lavigne
Date: Mon, 14 Oct 2013 19:54:30 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42959 - head/en_US.ISO8859-1/books/handbook/linuxemu
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Mon, 14 Oct 2013 19:54:31 -0000
Author: dru
Date: Mon Oct 14 19:54:30 2013
New Revision: 42959
URL: http://svnweb.freebsd.org/changeset/doc/42959
Log:
Comment out the Maple section for now.
Approved by: bcr (mentor)
Modified:
head/en_US.ISO8859-1/books/handbook/linuxemu/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/linuxemu/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/linuxemu/chapter.xml Mon Oct 14 19:20:04 2013 (r42958)
+++ head/en_US.ISO8859-1/books/handbook/linuxemu/chapter.xml Mon Oct 14 19:54:30 2013 (r42959)
@@ -457,13 +457,17 @@ Installation complete.
-->
+
Contributed by
@@ -471,7 +475,6 @@ Installation complete.
RobertGetschmann
-
Thanks to
From owner-svn-doc-head@FreeBSD.ORG Mon Oct 14 20:30:57 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 722392DB;
Mon, 14 Oct 2013 20:30:57 +0000 (UTC) (envelope-from gjb@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 457AB2538;
Mon, 14 Oct 2013 20:30:57 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9EKUvYO040479;
Mon, 14 Oct 2013 20:30:57 GMT (envelope-from gjb@svn.freebsd.org)
Received: (from gjb@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9EKUvXg040478;
Mon, 14 Oct 2013 20:30:57 GMT (envelope-from gjb@svn.freebsd.org)
Message-Id: <201310142030.r9EKUvXg040478@svn.freebsd.org>
From: Glen Barber
Date: Mon, 14 Oct 2013 20:30:57 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42960 - head/en_US.ISO8859-1/books/handbook/linuxemu
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Mon, 14 Oct 2013 20:30:57 -0000
Author: gjb
Date: Mon Oct 14 20:30:56 2013
New Revision: 42960
URL: http://svnweb.freebsd.org/changeset/doc/42960
Log:
s/--/‐‐/ to avoid double-hyphens within commented blocks.
Modified:
head/en_US.ISO8859-1/books/handbook/linuxemu/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/linuxemu/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/linuxemu/chapter.xml Mon Oct 14 19:54:30 2013 (r42959)
+++ head/en_US.ISO8859-1/books/handbook/linuxemu/chapter.xml Mon Oct 14 20:30:56 2013 (r42960)
@@ -521,12 +521,12 @@ Installation complete.
/usr/local/maple/bin/maple.system.type
with the following:
- ----- snip ------------------
+ ‐‐‐‐- snip ‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐‐
*** maple.system.type.orig Sun Jul 8 16:35:33 2001
---- maple.system.type Sun Jul 8 16:35:51 2001
+‐‐- maple.system.type Sun Jul 8 16:35:51 2001
***************
*** 72,77 ****
---- 72,78 ----
+‐‐- 72,78 ‐‐‐‐
# the IBM RS/6000 AIX case
MAPLE_BIN="bin.IBM_RISC_UNIX"
;;
@@ -534,7 +534,7 @@ Installation complete.
"Linux")
# the Linux/x86 case
# We have two Linux implementations, one for Red Hat and
- ----- snip end of patch -----
+ ‐‐‐‐- snip end of patch ‐‐‐‐-
Note that no whitespace should be present after
"FreeBSD"|\.
@@ -553,7 +553,7 @@ Installation complete.
/usr/local/rtc/rc.d/lmgrd is a
convenient way to start up lmgrd:
- ----- snip ------------
+ ‐‐‐‐- snip ‐‐‐‐‐‐‐‐‐‐‐‐
#! /bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
@@ -578,7 +578,7 @@ stop)
esac
exit 0
- ----- snip ------------
+ ‐‐‐‐- snip ‐‐‐‐‐‐‐‐‐‐‐‐Test that
@@ -626,7 +626,7 @@ FEATURE Maple maplelmg 2000.0831 permane
-
+ -->
+ While the Oracle website is unclear, the installation script is: You
+ are attempting to install 64-bit Oracle on a 32-bit operating system.
+ This is not supported and will not work.
@@ -881,7 +884,6 @@ exit 0
MoolenaarContributed by
-
Installing &oracle;
@@ -1084,7 +1086,7 @@ export PATH
! CHOWN=/bin/chown
#
# Define variables to be used in this script
---- 31,37 ----
+ --- 31,37 ----
# This is the default value for CHOWN
# It will redefined later in this script for those ports
# which have it conditionally defined in ss_install.h
@@ -1135,6 +1137,7 @@ export PATH
running on &linux;.
+?>
Advanced Topics
From owner-svn-doc-head@FreeBSD.ORG Tue Oct 15 08:41:47 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
[IPv6:2001:1900:2254:206a::19:1])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 75178D11;
Tue, 15 Oct 2013 08:41:47 +0000 (UTC) (envelope-from pgj@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 62A6E2D1D;
Tue, 15 Oct 2013 08:41:47 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9F8flpQ037799;
Tue, 15 Oct 2013 08:41:47 GMT (envelope-from pgj@svn.freebsd.org)
Received: (from pgj@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9F8flOM037796;
Tue, 15 Oct 2013 08:41:47 GMT (envelope-from pgj@svn.freebsd.org)
Message-Id: <201310150841.r9F8flOM037796@svn.freebsd.org>
From: Gabor Pali
Date: Tue, 15 Oct 2013 08:41:47 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42962 - head/en_US.ISO8859-1/htdocs/news/status
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Tue, 15 Oct 2013 08:41:47 -0000
Author: pgj
Date: Tue Oct 15 08:41:46 2013
New Revision: 42962
URL: http://svnweb.freebsd.org/changeset/doc/42962
Log:
- Update the random(4) 2013Q3 entry
Submitted by: markm
Modified:
head/en_US.ISO8859-1/htdocs/news/status/report-2013-07-2013-09.xml
Modified: head/en_US.ISO8859-1/htdocs/news/status/report-2013-07-2013-09.xml
==============================================================================
--- head/en_US.ISO8859-1/htdocs/news/status/report-2013-07-2013-09.xml Tue Oct 15 00:37:17 2013 (r42961)
+++ head/en_US.ISO8859-1/htdocs/news/status/report-2013-07-2013-09.xml Tue Oct 15 08:41:46 2013 (r42962)
@@ -949,7 +949,7 @@
- Updating random(4)
+ Reworking random(4)
@@ -978,16 +978,55 @@
-
Update of random(4) to account for recent revelations,
- and make more extensible, is in progress.
+
Random numbers require a lot more thought and preparation that
+ would naively appear to be the case. For simulations, number
+ sequences that are repeatable but sufficiently disordered are
+ often what is required to achieve required experimental
+ duplication ability, and many programmers are familiar with
+ these. For cryptography, it is essential that an attacker not
+ be able to predict or guess the output sequence, thus giving a
+ source of security-critical secret material for uses such as
+ passwords or "key material".
+
+
&os;'s random number generator, available as the pseudo-file
+ /dev/random produces unpredictable numbers intended for
+ cryptographic use, and is thus a Cryptograpically-Secured
+ Pseudo-Random Number Generator, or CSPRNG. The security is
+ given by careful design of the output generator (based on a
+ block cipher) and input entropy accumulation queues. The latter
+ uses hashes to accumulate stochastic information harvested from
+ various places in the kernel to provide highly unpredictable
+ input to the generator. The algorithm for doing this, Yarrow,
+ by Schneier et al, may be found by web search.
+
+
&os;'s CSPRNG also allowed for certain stochastic sources,
+ deemed to be "high-quality", to directly supply the
+ random(4) device without going through Yarrow. With
+ recent revelations over possible government surveillance and
+ involvement in the selection of these "high-quality" sources, it
+ is felt that they can no longer be trusted, and must therefore
+ also be processed though Yarrow.
+
+
The matter was discussed at various levels of formality at the
+ Cambridge Developer Summit in August, and at EuroBSDcon 2013 in
+ September.
+
+
This work is now done, and the random(4) CSPRNG is now
+ brought to a more paranoid, modern standard of distrust with
+ regard to its entropy sources. Infrastructure work was also
+ done to facilitate certain entropy-source choices for the
+ convenience of the system administrators.
+
+
Future work is now going ahead with the implementation of the
+ Fortuna algorithm by Ferguson and Schneier as an upgrade or
+ alternative to Yarrow. Initially a choice will be presented,
+ and decisions on the future of the CSPRNG processing algorithms
+ in use will be made in the future as needs arise.
- Fortuna is to be an alternative for Yarrow in FreeBSD 11.x.
- Yarrow may be deprecated in a couple of years.
- FIPS 800-90b support is planned.
- A full, in-depth review of entropy is going to be done with
- external help.
+ Implement FIPS 800-90b support.
+ A full, in-depth review of entropy.
From owner-svn-doc-head@FreeBSD.ORG Tue Oct 15 10:34:26 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 2F1C9539;
Tue, 15 Oct 2013 10:34:26 +0000 (UTC) (envelope-from gjb@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 1C94523A6;
Tue, 15 Oct 2013 10:34:26 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9FAYP1O009331;
Tue, 15 Oct 2013 10:34:25 GMT (envelope-from gjb@svn.freebsd.org)
Received: (from gjb@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9FAYPNd009330;
Tue, 15 Oct 2013 10:34:25 GMT (envelope-from gjb@svn.freebsd.org)
Message-Id: <201310151034.r9FAYPNd009330@svn.freebsd.org>
From: Glen Barber
Date: Tue, 15 Oct 2013 10:34:25 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42963 - head/share/xml
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Tue, 15 Oct 2013 10:34:26 -0000
Author: gjb
Date: Tue Oct 15 10:34:25 2013
New Revision: 42963
URL: http://svnweb.freebsd.org/changeset/doc/42963
Log:
Fix link to 10.0-BETA1 announcement.
Submitted by: ryusuke
Pointyhat: gjb
Modified:
head/share/xml/news.xml
Modified: head/share/xml/news.xml
==============================================================================
--- head/share/xml/news.xml Tue Oct 15 08:41:46 2013 (r42962)
+++ head/share/xml/news.xml Tue Oct 15 10:34:25 2013 (r42963)
@@ -42,7 +42,7 @@
The first BETA build for the &os;-10.0 release cycle is
now available. ISO images for the amd64, i386, ia64,
powerpc, powerpc64 and sparc64 architectures are available
+ href="&lists.stable;/2013-October/075504.html">available
on most of our &os;
mirror sites.
From owner-svn-doc-head@FreeBSD.ORG Tue Oct 15 14:44:56 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 79933D74;
Tue, 15 Oct 2013 14:44:56 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 66A282A85;
Tue, 15 Oct 2013 14:44:56 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9FEiuFp073154;
Tue, 15 Oct 2013 14:44:56 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9FEiuwN073153;
Tue, 15 Oct 2013 14:44:56 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201310151444.r9FEiuwN073153@svn.freebsd.org>
From: Dru Lavigne
Date: Tue, 15 Oct 2013 14:44:56 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42965 -
head/en_US.ISO8859-1/books/handbook/network-servers
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Tue, 15 Oct 2013 14:44:56 -0000
Author: dru
Date: Tue Oct 15 14:44:55 2013
New Revision: 42965
URL: http://svnweb.freebsd.org/changeset/doc/42965
Log:
This is a very large chapter that needs a lot of work, many more patches to come.
This patch does the following to mostly the NIS section:
- comments out authors
- fixes some (not all) acronym tags and &os; entities
- tightens up some headings
- some word-smithing to make things clearer
- adds title to Table
This will be followed by a white-space fix, then more content patches to be followed by a more thorough technical review.
Modified:
head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Tue Oct 15 13:08:26 2013 (r42964)
+++ head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Tue Oct 15 14:44:55 2013 (r42965)
@@ -6,16 +6,17 @@
-->
+
+ -->
Network Servers
@@ -113,6 +114,7 @@
+
The inetdSuper-Server
@@ -539,6 +542,7 @@ server-program-arguments
+
Network File System (NFS)NFS
@@ -595,9 +600,6 @@ server-program-arguments
-
- How NFS Works
-
NFS consists of at least two main
parts: a server and one or more clients. The client remotely
accesses the data that is stored on the server machine. In
@@ -663,7 +665,6 @@ server-program-argumentsRunning &man.nfsiod.8; can improve performance on the
client, but is not required.
- Configuring NFS
@@ -910,6 +911,7 @@ rpc_statd_enable="YES"
+
Automatic Mounts with
amd
@@ -1012,6 +1015,7 @@ Exports list on foobar:
+
Network Information System (NIS/YP)
-
-
- What Is It?
-
NISSolarisHP-UX
@@ -1044,52 +1045,39 @@ Exports list on foobar:
LinuxNetBSDOpenBSD
-
- NIS,
- which stands for Network Information Services, was developed
- by Sun Microsystems to centralize administration of &unix;
- (originally &sunos;) systems. It has now essentially become
- an industry standard; all major &unix; like systems
- (&solaris;, HP-UX, &aix;, Linux, NetBSD, OpenBSD, FreeBSD,
- etc) support NIS.
-
yellow pagesNIS
- NIS
- was formerly known as Yellow Pages, but because of trademark
- issues, Sun changed the name. The old term (and yp) is still
- often seen and used.
+ Network Information System (NIS)
+ is designed
+ to centralize administration of &unix;-like
+ systems such as
+ &solaris;, HP-UX, &aix;, Linux, NetBSD, OpenBSD, and &os;.
+ NIS
+ was originally known as Yellow Pages but the name was changed due to trademark
+ issues. This is the reason why NIS
+ commands begin with yp.NISdomains
- It is a RPC-based client/server system that allows a group
- of machines within an NIS domain to share a common set of
+ NIS is a Remote Procedure Call
+ (RPC)-based client/server system that allows a group
+ of machines within an NIS domain to share a common set of
configuration files. This permits a system administrator to
- set up NIS client systems with only minimal configuration data
+ set up NIS client systems with only minimal configuration data
and add, remove or modify configuration data from a single
location.
- Windows NT
-
- It is similar to the &windowsnt; domain system; although
- the internal implementation of the two are not at all similar,
- the basic functionality can be compared.
-
-
- NISTerms and Processes
+ NIS Terms and Processes
- There are several terms and important user processes that
- will be explained while attempting to implement NIS on
- FreeBSD, regardless if the system is a NIS server or a NIS
- client:
+ Table 28.1 summarizes the terms and important processes used
+ by NIS:rpcbind
@@ -1098,7 +1086,8 @@ Exports list on foobar:
portmap
-
+
+ NIS Terminology
@@ -1112,163 +1101,141 @@ Exports list on foobar:
- NIS domainname
+ NIS domain name
- An NIS master server and all of its clients
- (including its slave servers) have a NIS domainname.
- Similar to an &windowsnt; domain name, the NIS
- domainname does not have anything to do with
+ An NIS master server and all of its clients,
+ including its slave servers, share a NIS domain name
+ which
+ does not have anything to do with
DNS.
- rpcbind
+ &man.rpcbind.8;
- Must be running in order to enable
- RPC (Remote Procedure Call, a
- network protocol used by NIS). If
- rpcbind is not running, it
- will be impossible to run an NIS server, or to act as
- an NIS client.
+ This service enables RPC and
+ must be running
+ in order to run an NIS server or act as
+ an NIS client.
- ypbind
- Binds an NIS client to its NIS
- server. It will take the NIS domainname from the
- system, and using RPC, connect to
- the server. ypbind is the
- core of client-server communication in an NIS
- environment; if ypbind dies
+ &man.ypbind.8;
+ This service binds an NIS client to its NIS
+ server. It will take the NIS domain name
+ and use RPC to connect to
+ the server. It is the
+ core of client/server communication in an NIS
+ environment. If this service is not running
on a client machine, it will not be able to access the
- NIS server.
+ NIS server.
- ypserv
- Should only be running on NIS servers; this is
- the NIS server process itself. If &man.ypserv.8;
- dies, then the server will no longer be able to
- respond to NIS requests (hopefully, there is a slave
- server to take over for it). There are some
- implementations of NIS (but not the FreeBSD one), that
- do not try to reconnect to another server if the
- server it used before dies. Often, the only thing
- that helps in this case is to restart the server
- process (or even the whole server) or the
- ypbind process on the
- client.
+ &man.ypserv.8;
+ This is the process for
+ the NIS server. If this service stops running,
+ the server will no longer be able to
+ respond to NIS requests so hopefully, there is a slave
+ server to take over. Some
+ non-&os; clients
+ will not try to reconnect using a slave server and the
+ ypbind process may need to
+ be restarted on these
+ clients.
- rpc.yppasswdd
- Another process that should only be running on
- NIS master servers; this is a daemon that will allow
- NIS clients to change their NIS passwords. If this
+ &man.rpc.yppasswdd.8;
+ This process only runs on
+ NIS master servers. This daemon allows
+ NIS clients to change their NIS passwords. If this
daemon is not running, users will have to login to the
- NIS master server and change their passwords
+ NIS master server and change their passwords
there.
-
+
- How Does It Work?
-
- There are three types of hosts in an NIS environment:
- master servers, slave servers, and clients. Servers act as a
- central repository for host configuration information. Master
- servers hold the authoritative copy of this information, while
- slave servers mirror this information for redundancy. Clients
- rely on the servers to provide this information to
- them.
-
- Information in many files can be shared in this manner.
- The master.passwd,
- group, and hosts
- files are commonly shared via NIS. Whenever a process on a
- client needs information that would normally be found in these
- files locally, it makes a query to the NIS server that it is
- bound to instead.
+ Machine Types
+ NIS
+ master server
+
+
+ NIS
+ slave server
+
+
+ NIS
+ client
+
-
- Machine Types
+ There are three types of hosts in an NIS environment:
- A NIS master server
- NIS
- master server
- .
- This server, analogous to a &windowsnt; primary domain
- controller, maintains the files used by all of the NIS
+ NIS master server
+
+ This server acts as a
+ central repository for host configuration information and
+ maintains the authoritative copy of the files used by all of the NIS
clients. The passwd,
group, and other various files used
- by the NIS clients live on the master server.
-
-
- It is possible for one machine to be an NIS master
- server for more than one NIS domain. However, this
- will not be covered in this introduction, which
- assumes a relatively small-scale NIS
- environment.
-
+ by NIS clients are stored on the master server. While
+ it is possible for one machine to be an NIS master
+ server for more than one NIS domain, this
+ will not be covered in chapter as it
+ assumes a relatively small-scale NIS
+ environment.
- NIS slave servers
- NIS
- slave server
- . Similar to the &windowsnt; backup domain
- controllers, NIS slave servers maintain copies of the
- NIS master's data files. NIS slave servers provide the
- redundancy, which is needed in important environments.
- They also help to balance the load of the master server:
- NIS Clients always attach to the NIS server whose
- response they get first, and this includes
- slave-server-replies.
+ NIS slave servers
+
+ NIS slave servers maintain copies of the
+ NIS master's data files in order to provide
+ redundancy.
+ Slave servers also help to balance the load of the master server as
+ NIS clients always attach to the NIS server which
+ responds first.
- NIS clients
- NIS
- client
- .
- NIS clients, like most &windowsnt; workstations,
- authenticate against the NIS server (or the &windowsnt;
- domain controller in the &windowsnt; workstations case)
- to log on.
+ NIS clients
+
+ NIS clients
+ authenticate against the NIS server
+ during log on.
-
+
+ Information in many files can be shared using NIS.
+ The master.passwd,
+ group, and hosts
+ files are commonly shared via NIS. Whenever a process on a
+ client needs information that would normally be found in these
+ files locally, it makes a query to the NIS server that it is
+ bound to instead.
- Using NIS/YP
-
- This section will deal with setting up a sample NIS
- environment.
-
-
- Planning
+ Planning Considerations
- Let us assume that an administrator of a small
- university lab, which consists of 15 FreeBSD machines,
+ This section describes a sample NIS
+ environment which consists of 15 &os; machines and which
currently has no centralized point of administration. Each
machine has its own /etc/passwd and
/etc/master.passwd. These files are
kept in sync with each other only through manual
- intervention; currently, a user is added to the lab, the
- process must be ran on all 15 machines. The lab would
- clearly benefit from the addition of two
- NIS servers.
+ intervention. Currently, when a user is added to the lab, the
+ process must be repeated on all 15 machines..
- Therefore, the configuration of the lab now looks
- something like:
+ The configuration of the lab will be as follows:
@@ -1284,13 +1251,13 @@ Exports list on foobar:
ellington10.0.0.2
- NIS master
+ NIS mastercoltrane10.0.0.3
- NIS slave
+ NIS slave
@@ -1321,96 +1288,88 @@ Exports list on foobar:
decisions need to be made as part of the planning
process.
-
- Choosing a NIS Domain Name
+
+ Choosing a NIS Domain NameNIS
- domainname
+ domain name
- This might not be the normal domainname
- for the network. It is more accurately called the
- NIS domainname. When a client broadcasts
- its requests for info, it includes the name of the NIS
+ When a client broadcasts
+ its requests for info, it includes the name of the NIS
domain that it is part of. This is how multiple servers
on one network can tell which server should answer which
- request. Think of the NIS domainname as the name for a
- group of hosts that are related in some way.
+ request. Think of the NIS domain name as the name for a
+ group of hosts.Some organizations choose to use their Internet
- domainname for their NIS domainname. This is not
+ domain name for their NIS domain name. This is not
recommended as it can cause confusion when trying to debug
- network problems. The NIS domainname should be unique
+ network problems. The NIS domain name should be unique
within the network and it is helpful if it describes the
group of machines it represents. For example, the Art
department at Acme Inc. might be in the
- acme-art NIS domain. For this example,
- assume the chosen name will be
+ acme-art NIS domain. This example
+ will use the domain name
test-domain.
- SunOS
- However, some operating systems (notably &sunos;) use
- their NIS domain name as their Internet domain name. If
+ However, some non-&os; operating systems require
+ the NIS domain name to be the same as the Internet domain name. If
one or more machines on the network have this
- restriction, it must be used as the
- Internet domain name for the NIS domain name.
-
+ restriction, the Internet domain name must be used as the
+ NIS domain name.
+
-
+ Physical Server RequirementsThere are several things to keep in mind when choosing
- a machine to use as a NIS server. One of the unfortunate
- things about NIS is the level of dependency the clients
- have on the server. If a client cannot contact the server
- for its NIS domain, very often the machine becomes
- unusable. The lack of user and group information causes
- most systems to temporarily freeze up. With this in mind
- be sure to choose a machine that will not be prone to
- being rebooted frequently, or one that might be used for
- development. The NIS server should ideally be a stand
- alone machine whose sole purpose in life is to be an NIS
- server. If the network is not very heavily used, it is
- acceptable to put the NIS server on a machine running
- other services, however; if the NIS server becomes
+ a machine to use as a NIS server. Since
+ NIS clients depend upon the availability
+ of the server, choose a machine that is
+ not rebooted frequently. The NIS server should ideally be a stand
+ alone machine whose sole purpose is to be an NIS
+ server. If the network is not heavily used, it is
+ acceptable to put the NIS server on a machine running
+ other services. However, if the NIS server becomes
unavailable, it will adversely affect
- all NIS clients.
-
+ all NIS clients.
+
-
- NIS Servers
+
+ Configuring the NIS Servers
- The canonical copies of all NIS information are stored
- on a single machine called the NIS master server. The
- databases used to store the information are called NIS maps.
- In FreeBSD, these maps are stored in
- /var/yp/[domainname] where
- [domainname] is the name of the NIS
- domain being served. A single NIS server can support
- several domains at once, therefore it is possible to have
- several such directories, one for each supported domain.
+ The canonical copies of all NIS files are stored
+ on the master server. The
+ databases used to store the information are called NIS maps.
+ In &os;, these maps are stored in
+ /var/yp/[domain name] where
+ [domain name] is the name of the NIS
+ domain. Since multiple
+ domains are supported, it is possible to have
+ several directories, one for each domain.
Each domain will have its own independent set of
maps.
- NIS master and slave servers handle all NIS requests
- with the ypserv daemon.
- ypserv is responsible for receiving
- incoming requests from NIS clients, translating the
+ NIS master and slave servers handle all NIS requests
+ through &man.ypserv.8;. This daemon
+ is responsible for receiving
+ incoming requests from NIS clients, translating the
requested domain and map name to a path to the corresponding
- database file and transmitting data from the database back
+ database file, and transmitting data from the database back
to the client.
-
- Setting Up a NIS Master Server
+
+ Setting Up a NIS Master ServerNISserver configuration
- Setting up a master NIS server can be relatively
- straight forward, depending on environmental needs. &os;
- comes with support for NIS out-of-the-box. It only needs
+ Setting up a master NIS server can be relatively
+ straight forward, depending on environmental needs. Since &os;
+ provides built-in NIS support, it only needs
to be enabled by adding the following lines to
/etc/rc.conf:
@@ -1418,96 +1377,78 @@ Exports list on foobar:
nisdomainname="test-domain"
- This line will set the NIS domainname to
- test-domain
- upon network setup (e.g., after reboot).
+ This line sets the NIS domain name to
+ test-domain.nis_server_enable="YES"
- This will tell FreeBSD to start up the NIS server
- processes when the networking is next brought
- up.
+ This automates the start up of the NIS server
+ processes when the system
+ boots.nis_yppasswdd_enable="YES"
- This will enable the
- rpc.yppasswdd daemon which, as
- mentioned above, will allow users to change their NIS
+ This enables the
+ &man.rpc.yppasswdd.8; daemon so that
+ users can change their NIS
password from a client machine.
-
- Depending on the NIS setup, additional entries may
- be required. See the
- section
- about NIS servers that are also NIS clients,
- below, for details.
-
-
- After setting up the above entries, run the command
- /etc/netstart as superuser. It will
- set up everything, using the values defined in
- /etc/rc.conf. As a last step, before
- initializing the NIS maps, start the
- ypserv daemon manually:
+ Depending on the NIS setup, additional entries may
+ be required. Refer to
+ if
+ the NIS server is also an NIS clients.
+
+ After saving the edits, type
+ /etc/netstart to restart the network and
+ apply the values defined in
+ /etc/rc.conf. Before
+ initializing the NIS maps, start
+ &man.ypserv.8;:&prompt.root; service ypserv start
-
+
-
- Initializing the NIS Maps
+
+ Initializing the NIS MapsNISmaps
- The NIS maps are database files,
- that are kept in the /var/yp
- directory. They are generated from configuration files in
- the /etc directory of the NIS master,
+ NIS maps are database files
+ stored in /var/yp.
+ They are generated from configuration files in
+ /etc on the NIS master,
with one exception:
- /etc/master.passwd. This is for a
- good reason, never propagate passwords for
- root and other administrative
- accounts to all the servers in the NIS domain. Therefore,
- before the NIS maps are initialized, configure the primary
+ /etc/master.passwd. This is to prevent the
+ propagation passwords to all the servers in the NIS domain. Therefore,
+ before the NIS maps are initialized, configure the primary
password files:&prompt.root; cp /etc/master.passwd /var/yp/master.passwd
&prompt.root; cd /var/yp
&prompt.root; vi master.passwd
- It is advisable to remove all entries regarding system
- accounts (bin,
- tty, kmem,
- games, etc), as well as any accounts
- that do not need to be propagated to the NIS clients
- (for example root and any other UID 0
- (superuser) accounts).
+ It is advisable to remove all entries for system
+ accounts as well as any user accounts
+ that do not need to be propagated to the NIS clients, such as
+ the root accounts.
- Ensure the
+ Ensure that the
/var/yp/master.passwd is neither
- group or world readable (mode 600)! Use the
- chmod command, as
- appropriate.
-
- Tru64 UNIX
+ group or world readable by setting its permissions to 600.When this task has been completed, it is time to
- initialize the NIS maps. FreeBSD includes a script named
- ypinit to do this (see its
- manual page for more information). Note that this script
- is available on most &unix; Operating Systems, but not on
- all. On Digital UNIX/Compaq Tru64 UNIX it is called
- ypsetup. Because we are generating
- maps for an NIS master, we are going to pass the
- option to ypinit.
- To generate the NIS maps run:
+ initialize the NIS maps. &os; includes the
+ &man.ypinit.8; script to do this. When generating
+ maps for the master server, include
+ and specify the NIS domain name:ellington&prompt.root; ypinit -m test-domain
Server Type: MASTER Domain: test-domain
@@ -1537,7 +1478,7 @@ ellington has been setup as an YP master
created /var/yp/Makefile from
/var/yp/Makefile.dist. When created,
this file assumes that the operating environment is a
- single server NIS system with only &os; machines. Since
+ single server NIS system with only &os; machines. Since
test-domain has a slave server as well,
edit /var/yp/Makefile as well:
@@ -1548,22 +1489,22 @@ ellington has been setup as an YP master
NOPUSH = "True"(if it is not commented out already).
-
+
-
- Setting up a NIS Slave Server
+
+ Setting up a NIS Slave ServerNISslave server
- Setting up an NIS slave server is even more simple
+ Setting up an NIS slave server is even more simple
than setting up the master. Log on to the slave server
and edit the file /etc/rc.conf as you
did before. The only difference is that we now must use
the option when running
ypinit. The option
- requires the name of the NIS master be passed to it as
+ requires the name of the NIS master be passed to it as
well, so our command line looks like:coltrane&prompt.root; ypinit -s ellington test-domain
@@ -1625,7 +1566,7 @@ Remember to update map ypservers on elli
There should be a directory called
/var/yp/test-domain. Copies of the
- NIS master server's maps should be in this directory.
+ NIS master server's maps should be in this directory.
These files must always be up to date. The following
/etc/crontab entries on the slave
servers should do the job:
@@ -1646,14 +1587,13 @@ Remember to update map ypservers on elli
Now, run the command /etc/netstart
on the slave server as well, which again starts the NIS
server.
-
- NIS Clients
+ Setting Up a NIS Client
- An NIS client establishes what is called a binding to a
- particular NIS server using the ypbind
+ An NIS client establishes what is called a binding to a
+ particular NIS server using the ypbind
daemon. The ypbind command checks the
system's default domain (as set by the
domainname command), and begins
@@ -1667,7 +1607,7 @@ Remember to update map ypservers on elli
master and several slaves, for example),
ypbind will use the address of the first
one to respond. From that point on, the client system will
- direct all of its NIS requests to that server.
+ direct all of its NIS requests to that server.
ypbind will occasionally
ping the server to make sure it is still up
and running. If it fails to receive a reply to one of its
@@ -1676,20 +1616,17 @@ Remember to update map ypservers on elli
and begin broadcasting again in the hopes of locating
another server.
-
- Setting Up a NIS Client
-
NISclient configuration
- Setting up a FreeBSD machine to be a NIS client is
+ Setting up a FreeBSD machine to be a NIS client is
fairly straightforward.Edit /etc/rc.conf and add the
- following lines in order to set the NIS domainname and
+ following lines in order to set the NIS domain name and
start ypbind during network
startup:
@@ -1699,7 +1636,7 @@ nis_client_enable="YES"
To import all possible password entries from the
- NIS server, remove all user accounts from the
+ NIS server, remove all user accounts from the
/etc/master.passwd file and use
vipw to add the following line to
the end of the file:
@@ -1708,7 +1645,7 @@ nis_client_enable="YES"
This line will afford anyone with a valid
- account in the NIS server's password maps an
+ account in the NIS server's password maps an
account. There are many ways to configure the NIS
client by changing this line. See the
netgroups
@@ -1738,7 +1675,7 @@ nis_client_enable="YES"
- To start the NIS client immediately, execute the
+ To start the NIS client immediately, execute the
following commands as the superuser:&prompt.root; /etc/netstart
@@ -1747,16 +1684,15 @@ nis_client_enable="YES"
After completing these steps, the command,
ypcat passwd, should show the
server's passwd map.
-
- NIS Security
+ NIS SecurityIn general, any remote user may issue an RPC to
- &man.ypserv.8; and retrieve the contents of the NIS maps,
- provided the remote user knows the domainname. To prevent
+ &man.ypserv.8; and retrieve the contents of the NIS maps,
+ provided the remote user knows the domain name. To prevent
such unauthorized transactions, &man.ypserv.8; supports a
feature called securenets which can be used to
restrict access to a given set of hosts. At startup,
@@ -1806,7 +1742,7 @@ nis_client_enable="YES"
firewall.Servers using /var/yp/securenets
- may fail to serve legitimate NIS clients with archaic TCP/IP
+ may fail to serve legitimate NIS clients with archaic TCP/IP
implementations. Some of these implementations set all host
bits to zero when doing broadcasts and/or fail to observe
the subnet mask when calculating the broadcast address.
@@ -1818,17 +1754,17 @@ nis_client_enable="YES"
Using /var/yp/securenets on a
server with such an archaic implementation of TCP/IP is a
- really bad idea and will lead to loss of NIS functionality
+ really bad idea and will lead to loss of NIS functionality
for large parts of the network.TCP WrappersThe use of TCP Wrapper
- increases the latency of the NIS server. The additional
+ increases the latency of the NIS server. The additional
delay may be long enough to cause timeouts in client
programs, especially in busy networks or with slow NIS
servers. If one or more of the client systems suffers from
these symptoms, convert the client systems in question into
- NIS slave servers and force them to bind to
+ NIS slave servers and force them to bind to
themselves.
@@ -1838,13 +1774,13 @@ nis_client_enable="YES"
In our lab, there is a machine basie that
is supposed to be a faculty only workstation. We do not want
- to take this machine out of the NIS domain, yet the
- passwd file on the master NIS server
+ to take this machine out of the NIS domain, yet the
+ passwd file on the master NIS server
contains accounts for both faculty and students. What can we
do?There is a way to bar specific users from logging on to a
- machine, even if they are present in the NIS database. To do
+ machine, even if they are present in the NIS database. To do
this, add
-username with
the correct number of colons like other entries to the end of
@@ -1852,7 +1788,7 @@ nis_client_enable="YES"
machine, where username is the
username of the user to bar from logging in. The line with
the blocked user must be before the + line
- for allowing NIS users. This should preferably be done using
+ for allowing NIS users. This should preferably be done using
vipw, since vipw will
sanity check the changes to
/etc/master.passwd, as well as
@@ -1889,6 +1825,7 @@ basie&prompt.root;
+
Using Netgroups
@@ -1911,7 +1849,7 @@ basie&prompt.root;
each machine separately, thus losing the main benefit of NIS:
centralized administration.
- The NIS developers' solution for this problem is called
+ The NIS developers' solution for this problem is called
netgroups. Their purpose and semantics
can be compared to the normal groups used by &unix; file
systems. The main differences are the lack of a numeric ID
@@ -1925,9 +1863,9 @@ basie&prompt.root;
with really simple examples. The example used in the
remainder of this section demonstrates this problem.
- Let us assume that the successful introduction of NIS in
+ Let us assume that the successful introduction of NIS in
the laboratory caught a superiors' interest. The next task is
- to extend the NIS domain to cover some of the other machines
+ to extend the NIS domain to cover some of the other machines
on campus. The two tables contain the names of the new users
and new machines as well as brief descriptions of them.
@@ -2037,13 +1975,13 @@ basie&prompt.root;
one or more netgroups. Those changes are independent of each
other: no more
for each combination of user and machine do...
- If the NIS setup is planned carefully, only one central
+ If the NIS setup is planned carefully, only one central
configuration file needs modification to grant or deny access
to machines.
- The first step is the initialization of the NIS map
+ The first step is the initialization of the NIS map
netgroup. &os;'s &man.ypinit.8; does not create this map by
- default, but its NIS implementation will support it after
+ default, but its NIS implementation will support it after
creation. To create an empty map, simply typeellington&prompt.root; vi /var/yp/netgroup
@@ -2077,8 +2015,8 @@ INTERNS (,able,test-domain) (,baker,
- The NIS domain for the account. Accounts may be
- imported from other NIS domains into a netgroup.
+ The NIS domain for the account. Accounts may be
+ imported from other NIS domains into a netgroup.
@@ -2089,12 +2027,12 @@ INTERNS (,able,test-domain) (,baker,
*** DIFF OUTPUT TRUNCATED AT 1000 LINES ***
From owner-svn-doc-head@FreeBSD.ORG Tue Oct 15 16:52:16 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
[IPv6:2001:1900:2254:206a::19:1])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 8B665A74;
Tue, 15 Oct 2013 16:52:16 +0000 (UTC)
(envelope-from ryusuke@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 79B9F2672;
Tue, 15 Oct 2013 16:52:16 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9FGqGTN053298;
Tue, 15 Oct 2013 16:52:16 GMT (envelope-from ryusuke@svn.freebsd.org)
Received: (from ryusuke@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9FGqG8Z053297;
Tue, 15 Oct 2013 16:52:16 GMT (envelope-from ryusuke@svn.freebsd.org)
Message-Id: <201310151652.r9FGqG8Z053297@svn.freebsd.org>
From: Ryusuke SUZUKI
Date: Tue, 15 Oct 2013 16:52:16 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42966 - head/ja_JP.eucJP/share/xml
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Tue, 15 Oct 2013 16:52:16 -0000
Author: ryusuke
Date: Tue Oct 15 16:52:15 2013
New Revision: 42966
URL: http://svnweb.freebsd.org/changeset/doc/42966
Log:
- Merge the following from the English version:
r42954 -> r42963 head/ja_JP.eucJP/share/xml/news.xml
Modified:
head/ja_JP.eucJP/share/xml/news.xml
Modified: head/ja_JP.eucJP/share/xml/news.xml
==============================================================================
--- head/ja_JP.eucJP/share/xml/news.xml Tue Oct 15 14:44:55 2013 (r42965)
+++ head/ja_JP.eucJP/share/xml/news.xml Tue Oct 15 16:52:15 2013 (r42966)
@@ -20,7 +20,7 @@
the contents of will be preferred over
.
$FreeBSD$
- Original revision: r42954
+ Original revision: r42963
-->
@@ -40,7 +40,7 @@
&os; 10.0-BETA1 ¸ø³«
&os;-10.0 ¥ê¥ê¡¼¥¹¥µ¥¤¥¯¥ë¤«¤éºÇ½é¤Î¥Ù¡¼¥¿ÈǤ¬¸ø³«¤µ¤́¤̃¤·¤¿ (¥¢¥Ê¥¦¥ó¥¹)¡£
+ href="&lists.stable;/2013-October/075504.html">¥¢¥Ê¥¦¥ó¥¹)¡£
&os;
¥ß¥é¡¼¥µ¥¤¥È ¤«¤é amd64, i386, ia64, powerpc, powerpc64 ¤ª¤è¤Ó
From owner-svn-doc-head@FreeBSD.ORG Tue Oct 15 16:57:04 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
[IPv6:2001:1900:2254:206a::19:1])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 140FEC87;
Tue, 15 Oct 2013 16:57:04 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 00E1426BC;
Tue, 15 Oct 2013 16:57:04 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9FGv3wj054773;
Tue, 15 Oct 2013 16:57:03 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9FGv3UV054772;
Tue, 15 Oct 2013 16:57:03 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201310151657.r9FGv3UV054772@svn.freebsd.org>
From: Dru Lavigne
Date: Tue, 15 Oct 2013 16:57:03 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42967 -
head/en_US.ISO8859-1/books/handbook/network-servers
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Tue, 15 Oct 2013 16:57:04 -0000
Author: dru
Date: Tue Oct 15 16:57:03 2013
New Revision: 42967
URL: http://svnweb.freebsd.org/changeset/doc/42967
Log:
White space fix only. Translators can ignore.
Modified:
head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Tue Oct 15 16:52:15 2013 (r42966)
+++ head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Tue Oct 15 16:57:03 2013 (r42967)
@@ -600,19 +600,19 @@ server-program-arguments
- NFS consists of at least two main
- parts: a server and one or more clients. The client remotely
- accesses the data that is stored on the server machine. In
- order for this to function properly a few processes have to be
- configured and running.
+ NFS consists of at least two main
+ parts: a server and one or more clients. The client
+ remotely accesses the data that is stored on the server
+ machine. In order for this to function properly a few
+ processes have to be configured and running.
- These daemons must be running on the server:
-
- NFS
+ These daemons must be running on the server:
+
+ NFSserver
-
-
- file server
+
+
+ file serverUNIX clients
@@ -666,21 +666,21 @@ server-program-argumentsRunning &man.nfsiod.8; can improve performance on the
client, but is not required.
-
- Configuring NFS
+
+ Configuring NFS
-
- NFS
- configuration
-
+
+ NFS
+ configuration
+
- Enabling the NFS server
- is straightforward. The required processes
- can be set to start at boot time by adding
- these options to
- /etc/rc.conf:
+ Enabling the NFS server
+ is straightforward. The required processes
+ can be set to start at boot time by adding
+ these options to
+ /etc/rc.conf:
- rpcbind_enable="YES"
+ rpcbind_enable="YES"
nfs_server_enable="YES"
mountd_flags="-r"
@@ -1037,7 +1037,8 @@ Exports list on foobar:
-->
- Network Information System (NIS/YP)
+ Network Information System (NIS/YP)
+
NISSolarisHP-UX
@@ -1051,14 +1052,13 @@ Exports list on foobar:
Network Information System (NIS)
- is designed
- to centralize administration of &unix;-like
- systems such as
- &solaris;, HP-UX, &aix;, Linux, NetBSD, OpenBSD, and &os;.
- NIS
- was originally known as Yellow Pages but the name was changed due to trademark
- issues. This is the reason why NIS
- commands begin with yp.
+ is designed to centralize administration of &unix;-like
+ systems such as &solaris;, HP-UX, &aix;, Linux, NetBSD,
+ OpenBSD, and &os;. NIS was originally
+ known as Yellow Pages but the name was changed due to
+ trademark issues. This is the reason why
+ NIS commands begin with
+ yp.NIS
@@ -1066,18 +1066,19 @@ Exports list on foobar:
NIS is a Remote Procedure Call
- (RPC)-based client/server system that allows a group
- of machines within an NIS domain to share a common set of
- configuration files. This permits a system administrator to
- set up NIS client systems with only minimal configuration data
- and add, remove or modify configuration data from a single
- location.
+ (RPC)-based client/server system that
+ allows a group of machines within an NIS
+ domain to share a common set of configuration files. This
+ permits a system administrator to set up
+ NIS client systems with only minimal
+ configuration data and add, remove or modify configuration
+ data from a single location.
NIS Terms and Processes
- Table 28.1 summarizes the terms and important processes used
- by NIS:
+ Table 28.1 summarizes the terms and important processes
+ used by NIS:rpcbind
@@ -1088,6 +1089,7 @@ Exports list on foobar:
NIS Terminology
+
@@ -1103,42 +1105,41 @@ Exports list on foobar:
NIS domain name
- An NIS master server and all of its clients,
- including its slave servers, share a NIS domain name
- which
- does not have anything to do with
- DNS.
+ An NIS master server and all
+ of its clients, including its slave servers, share a
+ NIS domain name which does not have
+ anything to do with DNS.&man.rpcbind.8;This service enables RPC and
- must be running
- in order to run an NIS server or act as
- an NIS client.
+ must be running in order to run an
+ NIS server or act as an
+ NIS client.
&man.ypbind.8;
- This service binds an NIS client to its NIS
- server. It will take the NIS domain name
- and use RPC to connect to
- the server. It is the
- core of client/server communication in an NIS
- environment. If this service is not running
- on a client machine, it will not be able to access the
- NIS server.
+ This service binds an NIS
+ client to its NIS server. It will
+ take the NIS domain name and use
+ RPC to connect to the server. It
+ is the core of client/server communication in an
+ NIS environment. If this service
+ is not running on a client machine, it will not be
+ able to access the NIS
+ server.&man.ypserv.8;
- This is the process for
- the NIS server. If this service stops running,
- the server will no longer be able to
- respond to NIS requests so hopefully, there is a slave
- server to take over. Some
- non-&os; clients
+ This is the process for the
+ NIS server. If this service stops
+ running, the server will no longer be able to respond
+ to NIS requests so hopefully, there
+ is a slave server to take over. Some non-&os; clients
will not try to reconnect using a slave server and the
ypbind process may need to
be restarted on these
@@ -1148,11 +1149,12 @@ Exports list on foobar:
&man.rpc.yppasswdd.8;This process only runs on
- NIS master servers. This daemon allows
- NIS clients to change their NIS passwords. If this
- daemon is not running, users will have to login to the
- NIS master server and change their passwords
- there.
+ NIS master servers. This daemon
+ allows NIS clients to change their
+ NIS passwords. If this daemon is
+ not running, users will have to login to the
+ NIS master server and change their
+ passwords there.
@@ -1163,64 +1165,68 @@ Exports list on foobar:
Machine Types
+
+ NIS
+ master server
+
+ NIS
+ slave server
+ NIS
- master server
-
-
- NIS
- slave server
-
-
- NIS
- client
-
+ client
+
- There are three types of hosts in an NIS environment:
+ There are three types of hosts in an
+ NIS environment:
-
-
- NIS master server
-
- This server acts as a
- central repository for host configuration information and
- maintains the authoritative copy of the files used by all of the NIS
- clients. The passwd,
- group, and other various files used
- by NIS clients are stored on the master server. While
- it is possible for one machine to be an NIS master
- server for more than one NIS domain, this
- will not be covered in chapter as it
- assumes a relatively small-scale NIS
- environment.
-
+
+
+ NIS master server
-
- NIS slave servers
+ This server acts as a central repository for host
+ configuration information and maintains the
+ authoritative copy of the files used by all of the
+ NIS clients. The
+ passwd, group,
+ and other various files used by NIS
+ clients are stored on the master server. While it is
+ possible for one machine to be an NIS
+ master server for more than one NIS
+ domain, this will not be covered in chapter as it
+ assumes a relatively small-scale NIS
+ environment.
+
- NIS slave servers maintain copies of the
- NIS master's data files in order to provide
- redundancy.
- Slave servers also help to balance the load of the master server as
- NIS clients always attach to the NIS server which
- responds first.
-
+
+ NIS slave servers
-
- NIS clients
+ NIS slave servers maintain copies
+ of the NIS master's data files in
+ order to provide redundancy. Slave servers also help to
+ balance the load of the master server as
+ NIS clients always attach to the
+ NIS server which responds
+ first.
+
- NIS clients
- authenticate against the NIS server
- during log on.
-
-
+
+ NIS clients
+
+ NIS clients authenticate
+ against the NIS server during log
+ on.
+
+
- Information in many files can be shared using NIS.
- The master.passwd,
+ Information in many files can be shared using
+ NIS. The
+ master.passwd,
group, and hosts
- files are commonly shared via NIS. Whenever a process on a
- client needs information that would normally be found in these
- files locally, it makes a query to the NIS server that it is
- bound to instead.
+ files are commonly shared via NIS.
+ Whenever a process on a client needs information that would
+ normally be found in these files locally, it makes a query to
+ the NIS server that it is bound to
+ instead.
@@ -1232,8 +1238,8 @@ Exports list on foobar:
machine has its own /etc/passwd and
/etc/master.passwd. These files are
kept in sync with each other only through manual
- intervention. Currently, when a user is added to the lab, the
- process must be repeated on all 15 machines..
+ intervention. Currently, when a user is added to the lab,
+ the process must be repeated on all 15 machines..
The configuration of the lab will be as follows:
@@ -1295,28 +1301,29 @@ Exports list on foobar:
NISdomain name
- When a client broadcasts
- its requests for info, it includes the name of the NIS
- domain that it is part of. This is how multiple servers
- on one network can tell which server should answer which
- request. Think of the NIS domain name as the name for a
- group of hosts.
-
- Some organizations choose to use their Internet
- domain name for their NIS domain name. This is not
- recommended as it can cause confusion when trying to debug
- network problems. The NIS domain name should be unique
- within the network and it is helpful if it describes the
- group of machines it represents. For example, the Art
- department at Acme Inc. might be in the
- acme-art NIS domain. This example
- will use the domain name
- test-domain.
-
- However, some non-&os; operating systems require
- the NIS domain name to be the same as the Internet domain name. If
- one or more machines on the network have this
- restriction, the Internet domain name must be used as the
+ When a client broadcasts its requests for info, it
+ includes the name of the NIS domain
+ that it is part of. This is how multiple servers on one
+ network can tell which server should answer which request.
+ Think of the NIS domain name as the
+ name for a group of hosts.
+
+ Some organizations choose to use their Internet domain
+ name for their NIS domain name. This
+ is not recommended as it can cause confusion when trying
+ to debug network problems. The NIS
+ domain name should be unique within the network and it is
+ helpful if it describes the group of machines it
+ represents. For example, the Art department at Acme Inc.
+ might be in the acme-art
+ NIS domain. This example will use the
+ domain name test-domain.
+
+ However, some non-&os; operating systems require the
+ NIS domain name to be the same as the
+ Internet domain name. If one or more machines on the
+ network have this restriction, the Internet domain name
+ must be used as the
NIS domain name.
@@ -1324,69 +1331,71 @@ Exports list on foobar:
Physical Server RequirementsThere are several things to keep in mind when choosing
- a machine to use as a NIS server. Since
- NIS clients depend upon the availability
- of the server, choose a machine that is
- not rebooted frequently. The NIS server should ideally be a stand
- alone machine whose sole purpose is to be an NIS
- server. If the network is not heavily used, it is
- acceptable to put the NIS server on a machine running
- other services. However, if the NIS server becomes
- unavailable, it will adversely affect
- all NIS clients.
-
-
+ a machine to use as a NIS server.
+ Since NIS clients depend upon the
+ availability of the server, choose a machine that is not
+ rebooted frequently. The NIS server
+ should ideally be a stand alone machine whose sole purpose
+ is to be an NIS server. If the network
+ is not heavily used, it is acceptable to put the
+ NIS server on a machine running other
+ services. However, if the NIS server
+ becomes unavailable, it will adversely affect all
+ NIS clients.
+
+
Configuring the NIS Servers
- The canonical copies of all NIS files are stored
- on the master server. The
- databases used to store the information are called NIS maps.
- In &os;, these maps are stored in
+ The canonical copies of all NIS
+ files are stored on the master server. The databases used
+ to store the information are called NIS
+ maps. In &os;, these maps are stored in
/var/yp/[domain name] where
- [domain name] is the name of the NIS
- domain. Since multiple
- domains are supported, it is possible to have
- several directories, one for each domain.
- Each domain will have its own independent set of
- maps.
-
- NIS master and slave servers handle all NIS requests
- through &man.ypserv.8;. This daemon
- is responsible for receiving
- incoming requests from NIS clients, translating the
+ [domain name] is the name of the
+ NIS domain. Since multiple domains are
+ supported, it is possible to have several directories, one
+ for each domain. Each domain will have its own independent
+ set of maps.
+
+ NIS master and slave servers handle
+ all NIS requests through &man.ypserv.8;.
+ This daemon is responsible for receiving incoming requests
+ from NIS clients, translating the
requested domain and map name to a path to the corresponding
database file, and transmitting data from the database back
to the client.
- Setting Up a NIS Master Server
+ Setting Up a NIS Master
+ ServerNISserver configuration
- Setting up a master NIS server can be relatively
- straight forward, depending on environmental needs. Since &os;
- provides built-in NIS support, it only needs
- to be enabled by adding the following lines to
+ Setting up a master NIS server can
+ be relatively straight forward, depending on environmental
+ needs. Since &os; provides built-in
+ NIS support, it only needs to be
+ enabled by adding the following lines to
/etc/rc.conf:nisdomainname="test-domain"
- This line sets the NIS domain name to
- test-domain.
+ This line sets the NIS domain
+ name to test-domain.nis_server_enable="YES"
- This automates the start up of the NIS server
- processes when the system
- boots.
+ This automates the start up of the
+ NIS server processes when the
+ system boots.
@@ -1399,56 +1408,61 @@ Exports list on foobar:
- Depending on the NIS setup, additional entries may
- be required. Refer to
- if
- the NIS server is also an NIS clients.
+ Depending on the NIS setup,
+ additional entries may be required. Refer to if the
+ NIS server is also an
+ NIS clients.After saving the edits, type
- /etc/netstart to restart the network and
- apply the values defined in
- /etc/rc.conf. Before
- initializing the NIS maps, start
+ /etc/netstart to restart the network
+ and apply the values defined in
+ /etc/rc.conf. Before initializing
+ the NIS maps, start
&man.ypserv.8;:&prompt.root; service ypserv start
- Initializing the NIS Maps
+ Initializing the NIS
+ MapsNISmaps
- NIS maps are database files
- stored in /var/yp.
- They are generated from configuration files in
- /etc on the NIS master,
- with one exception:
- /etc/master.passwd. This is to prevent the
- propagation passwords to all the servers in the NIS domain. Therefore,
- before the NIS maps are initialized, configure the primary
- password files:
+ NIS maps are database files stored
+ in /var/yp. They
+ are generated from configuration files in /etc on the
+ NIS master, with one exception:
+ /etc/master.passwd. This is to
+ prevent the propagation passwords to all the servers in
+ the NIS domain. Therefore, before the
+ NIS maps are initialized, configure the
+ primary password files:&prompt.root; cp /etc/master.passwd /var/yp/master.passwd
&prompt.root; cd /var/yp
&prompt.root; vi master.passwdIt is advisable to remove all entries for system
- accounts as well as any user accounts
- that do not need to be propagated to the NIS clients, such as
- the root accounts.
+ accounts as well as any user accounts that do not need to
+ be propagated to the NIS clients, such
+ as the root accounts.Ensure that the
/var/yp/master.passwd is neither
- group or world readable by setting its permissions to 600.
+ group or world readable by setting its permissions to
+ 600.
When this task has been completed, it is time to
- initialize the NIS maps. &os; includes the
- &man.ypinit.8; script to do this. When generating
+ initialize the NIS maps. &os; includes
+ the &man.ypinit.8; script to do this. When generating
maps for the master server, include
- and specify the NIS domain name:
+ and specify the NIS
+ domain name:
ellington&prompt.root; ypinit -m test-domain
Server Type: MASTER Domain: test-domain
@@ -1478,9 +1492,10 @@ ellington has been setup as an YP master
created /var/yp/Makefile from
/var/yp/Makefile.dist. When created,
this file assumes that the operating environment is a
- single server NIS system with only &os; machines. Since
- test-domain has a slave server as well,
- edit /var/yp/Makefile as well:
+ single server NIS system with only &os;
+ machines. Since test-domain has a
+ slave server as well, edit
+ /var/yp/Makefile as well:
ellington&prompt.root; vi /var/yp/Makefile
@@ -1492,20 +1507,23 @@ ellington has been setup as an YP master
- Setting up a NIS Slave Server
+ Setting up a NIS Slave
+ ServerNISslave server
- Setting up an NIS slave server is even more simple
- than setting up the master. Log on to the slave server
- and edit the file /etc/rc.conf as you
- did before. The only difference is that we now must use
- the option when running
+ Setting up an NIS slave server is
+ even more simple than setting up the master. Log on to
+ the slave server and edit the file
+ /etc/rc.conf as you did before. The
+ only difference is that we now must use the
+ option when running
ypinit. The option
- requires the name of the NIS master be passed to it as
- well, so our command line looks like:
+ requires the name of the NIS master be
+ passed to it as well, so our command line looks
+ like:coltrane&prompt.root; ypinit -s ellington test-domain
@@ -1564,38 +1582,39 @@ ypxfr: Exiting: Map successfully transfe
coltrane has been setup as an YP slave server without any errors.
Remember to update map ypservers on ellington.
- There should be a directory called
- /var/yp/test-domain. Copies of the
- NIS master server's maps should be in this directory.
- These files must always be up to date. The following
- /etc/crontab entries on the slave
- servers should do the job:
+ There should be a directory called
+ /var/yp/test-domain. Copies of the
+ NIS master server's maps should be in
+ this directory. These files must always be up to date.
+ The following /etc/crontab entries on
+ the slave servers should do the job:
- 20 * * * * root /usr/libexec/ypxfr passwd.byname
+ 20 * * * * root /usr/libexec/ypxfr passwd.byname
21 * * * * root /usr/libexec/ypxfr passwd.byuid
- These two lines force the slave to sync its maps with
- the maps on the master server. These entries are not
- mandatory because the master server automatically attempts
- to push any map changes to its slaves; however, due to
- the importance of correct password information on other
- clients depending on the slave server, it is recommended
- to specifically force the password map updates frequently.
- This is especially important on busy networks where map
- updates might not always complete.
+ These two lines force the slave to sync its maps with
+ the maps on the master server. These entries are not
+ mandatory because the master server automatically attempts
+ to push any map changes to its slaves; however, due to
+ the importance of correct password information on other
+ clients depending on the slave server, it is recommended
+ to specifically force the password map updates frequently.
+ This is especially important on busy networks where map
+ updates might not always complete.
- Now, run the command /etc/netstart
- on the slave server as well, which again starts the NIS
- server.
+ Now, run the command /etc/netstart
+ on the slave server as well, which again starts the NIS
+ server.Setting Up a NIS Client
- An NIS client establishes what is called a binding to a
- particular NIS server using the ypbind
- daemon. The ypbind command checks the
- system's default domain (as set by the
+ An NIS client establishes what is
+ called a binding to a particular NIS
+ server using the ypbind daemon. The
+ ypbind command checks the system's
+ default domain (as set by the
domainname command), and begins
broadcasting RPC requests on the local network. These
requests specify the name of the domain for which
@@ -1607,8 +1626,8 @@ Remember to update map ypservers on elli
master and several slaves, for example),
ypbind will use the address of the first
one to respond. From that point on, the client system will
- direct all of its NIS requests to that server.
- ypbind will occasionally
+ direct all of its NIS requests to that
+ server. ypbind will occasionally
ping the server to make sure it is still up
and running. If it fails to receive a reply to one of its
pings within a reasonable amount of time,
@@ -1616,18 +1635,20 @@ Remember to update map ypservers on elli
and begin broadcasting again in the hopes of locating
another server.
-
- NIS
- client configuration
-
- Setting up a FreeBSD machine to be a NIS client is
- fairly straightforward.
+ NIS
+ client configuration
+
+
+ Setting up a FreeBSD machine to be a
+ NIS client is fairly
+ straightforward.Edit /etc/rc.conf and add the
- following lines in order to set the NIS domain name and
- start ypbind during network
+ following lines in order to set the
+ NIS domain name and start
+ ypbind during network
startup:nisdomainname="test-domain"
@@ -1636,7 +1657,8 @@ nis_client_enable="YES"To import all possible password entries from the
- NIS server, remove all user accounts from the
+ NIS server, remove all user
+ accounts from the
/etc/master.passwd file and use
vipw to add the following line to
the end of the file:
@@ -1645,8 +1667,9 @@ nis_client_enable="YES"
This line will afford anyone with a valid
- account in the NIS server's password maps an
- account. There are many ways to configure the NIS
+ account in the NIS server's
+ password maps an account. There are many ways to
+ configure the NIS
client by changing this line. See the
netgroups
section below for more information. For
@@ -1675,15 +1698,16 @@ nis_client_enable="YES"
- To start the NIS client immediately, execute the
- following commands as the superuser:
+ To start the NIS client
+ immediately, execute the following commands as the
+ superuser:&prompt.root; /etc/netstart
&prompt.root; service ypbind start
- After completing these steps, the command,
- ypcat passwd, should show the
- server's passwd map.
+ After completing these steps, the command,
+ ypcat passwd, should show the
+ server's passwd map.
@@ -1691,13 +1715,13 @@ nis_client_enable="YES"
NIS SecurityIn general, any remote user may issue an RPC to
- &man.ypserv.8; and retrieve the contents of the NIS maps,
- provided the remote user knows the domain name. To prevent
- such unauthorized transactions, &man.ypserv.8; supports a
- feature called securenets which can be used to
- restrict access to a given set of hosts. At startup,
- &man.ypserv.8; will attempt to load the securenets information
- from a file called
+ &man.ypserv.8; and retrieve the contents of the
+ NIS maps, provided the remote user knows
+ the domain name. To prevent such unauthorized transactions,
+ &man.ypserv.8; supports a feature called
+ securenets which can be used to restrict access
+ to a given set of hosts. At startup, &man.ypserv.8; will
+ attempt to load the securenets information from a file called
/var/yp/securenets.
@@ -1742,30 +1766,31 @@ nis_client_enable="YES"
firewall.
Servers using /var/yp/securenets
- may fail to serve legitimate NIS clients with archaic TCP/IP
- implementations. Some of these implementations set all host
- bits to zero when doing broadcasts and/or fail to observe
- the subnet mask when calculating the broadcast address.
- While some of these problems can be fixed by changing the
- client configuration, other problems may force
- the retirement of the client systems in question or the
- abandonment of
+ may fail to serve legitimate NIS clients
+ with archaic TCP/IP implementations. Some of these
+ implementations set all host bits to zero when doing
+ broadcasts and/or fail to observe the subnet mask when
+ calculating the broadcast address. While some of these
+ problems can be fixed by changing the client configuration,
+ other problems may force the retirement of the client
+ systems in question or the abandonment of
/var/yp/securenets.Using /var/yp/securenets on a
server with such an archaic implementation of TCP/IP is a
- really bad idea and will lead to loss of NIS functionality
- for large parts of the network.
+ really bad idea and will lead to loss of
+ NIS functionality for large parts of the
+ network.
TCP WrappersThe use of TCP Wrapper
- increases the latency of the NIS server. The additional
- delay may be long enough to cause timeouts in client
- programs, especially in busy networks or with slow NIS
- servers. If one or more of the client systems suffers from
- these symptoms, convert the client systems in question into
- NIS slave servers and force them to bind to
- themselves.
+ increases the latency of the NIS server.
+ The additional delay may be long enough to cause timeouts in
+ client programs, especially in busy networks or with slow
+ NIS servers. If one or more of the client systems suffers
+ from these symptoms, convert the client systems in question
+ into NIS slave servers and force them to
+ bind to themselves.
@@ -1774,21 +1799,23 @@ nis_client_enable="YES"
In our lab, there is a machine basie that
is supposed to be a faculty only workstation. We do not want
- to take this machine out of the NIS domain, yet the
- passwd file on the master NIS server
- contains accounts for both faculty and students. What can we
+ to take this machine out of the NIS domain,
+ yet the passwd file on the master
+ NIS server contains accounts for both
+ faculty and students. What can we
do?There is a way to bar specific users from logging on to a
- machine, even if they are present in the NIS database. To do
- this, add
+ machine, even if they are present in the
+ NIS database. To do this, add
-username with
the correct number of colons like other entries to the end of
the /etc/master.passwd file on the client
machine, where username is the
username of the user to bar from logging in. The line with
the blocked user must be before the + line
- for allowing NIS users. This should preferably be done using
+ for allowing NIS users. This should
+ preferably be done using
vipw, since vipw will
sanity check the changes to
/etc/master.passwd, as well as
@@ -1849,12 +1876,12 @@ basie&prompt.root;
each machine separately, thus losing the main benefit of NIS:
centralized administration.
- The NIS developers' solution for this problem is called
- netgroups. Their purpose and semantics
- can be compared to the normal groups used by &unix; file
- systems. The main differences are the lack of a numeric ID
- and the ability to define a netgroup by including both user
- accounts and other netgroups.
+ The NIS developers' solution for this
+ problem is called netgroups. Their
+ purpose and semantics can be compared to the normal groups
+ used by &unix; file systems. The main differences are the
+ lack of a numeric ID and the ability to define a netgroup by
+ including both user accounts and other netgroups.Netgroups were developed to handle large, complex networks
with hundreds of users and machines. On one hand, this is a
@@ -1863,11 +1890,13 @@ basie&prompt.root;
with really simple examples. The example used in the
remainder of this section demonstrates this problem.
- Let us assume that the successful introduction of NIS in
- the laboratory caught a superiors' interest. The next task is
- to extend the NIS domain to cover some of the other machines
- on campus. The two tables contain the names of the new users
- and new machines as well as brief descriptions of them.
+ Let us assume that the successful introduction of
+ NIS in the laboratory caught a superiors'
+ interest. The next task is to extend the
+ NIS domain to cover some of the other
+ machines on campus. The two tables contain the names of the
+ new users and new machines as well as brief descriptions of
+ them.
@@ -1973,15 +2002,15 @@ basie&prompt.root;
adding a new machine, login restrictions must be defined for
all netgroups. If a new user is added, they must be added to
one or more netgroups. Those changes are independent of each
- other: no more
- for each combination of user and machine do...
- If the NIS setup is planned carefully, only one central
- configuration file needs modification to grant or deny access
- to machines.
-
- The first step is the initialization of the NIS map
- netgroup. &os;'s &man.ypinit.8; does not create this map by
- default, but its NIS implementation will support it after
+ other: no more for each combination of user and machine
+ do... If the NIS setup is
+ planned carefully, only one central configuration file needs
+ modification to grant or deny access to machines.
+
+ The first step is the initialization of the
+ NIS map netgroup. &os;'s &man.ypinit.8;
+ does not create this map by default, but its
+ NIS implementation will support it after
creation. To create an empty map, simply typeellington&prompt.root; vi /var/yp/netgroup
@@ -2015,8 +2044,9 @@ INTERNS (,able,test-domain) (,baker,
- The NIS domain for the account. Accounts may be
- imported from other NIS domains into a netgroup.
+ The NIS domain for the account.
+ Accounts may be imported from other NIS
+ domains into a netgroup.
@@ -2027,18 +2057,19 @@ INTERNS (,able,test-domain) (,baker,
netgroupsNetgroup names longer than 8 characters should not be
used, especially with machines running other operating
- systems within the NIS domain. The names are case
- sensitive; using capital letters for netgroup names is an
- easy way to distinguish between user, machine and netgroup
- names.
-
- Some NIS clients (other than &os;) cannot handle
- netgroups with a large number of entries. For example, some
- older versions of &sunos; start to cause trouble if a
- netgroup contains more than 15 entries.
- This limit may be circumvented by creating several
- sub-netgroups with 15 users or fewer and a real netgroup
- consisting of the sub-netgroups:
+ systems within the NIS domain. The names
+ are case sensitive; using capital letters for netgroup names
+ is an easy way to distinguish between user, machine and
+ netgroup names.
+
+ Some NIS clients (other than &os;)
+ cannot handle netgroups with a large number of entries. For
+ example, some older versions of &sunos; start to cause
+ trouble if a netgroup contains more than 15
+ entries. This limit may be
+ circumvented by creating several sub-netgroups with 15 users
+ or fewer and a real netgroup consisting of the
+ sub-netgroups:BIGGRP1 (,joe1,domain) (,joe2,domain) (,joe3,domain) [...]
BIGGRP2 (,joe16,domain) (,joe17,domain) [...]
@@ -2049,8 +2080,8 @@ BIGGROUP BIGGRP1 BIGGRP2 BIGGRP3
- Activating and distributing the new NIS map is
- easy:
*** DIFF OUTPUT TRUNCATED AT 1000 LINES ***
From owner-svn-doc-head@FreeBSD.ORG Tue Oct 15 18:39:12 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 9EE4AB52;
Tue, 15 Oct 2013 18:39:12 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 7E9D42E7C;
Tue, 15 Oct 2013 18:39:12 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9FIdCsw020799;
Tue, 15 Oct 2013 18:39:12 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9FIdCBu020798;
Tue, 15 Oct 2013 18:39:12 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201310151839.r9FIdCBu020798@svn.freebsd.org>
From: Dru Lavigne
Date: Tue, 15 Oct 2013 18:39:12 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42968 -
head/en_US.ISO8859-1/books/handbook/network-servers
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Tue, 15 Oct 2013 18:39:12 -0000
Author: dru
Date: Tue Oct 15 18:39:12 2013
New Revision: 42968
URL: http://svnweb.freebsd.org/changeset/doc/42968
Log:
Another dent in this very large chapter. This patch does the following:
- fixes &os; and most instances of "you"
- fixes manual page repitition
- some word-smithing
- some heading tightening in the NIS section
- some clarification in the NIS server section
Modified:
head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Tue Oct 15 16:57:03 2013 (r42967)
+++ head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Tue Oct 15 18:39:12 2013 (r42968)
@@ -156,7 +156,7 @@
auth, and
daytime.
- This section will cover the basics in configuring
+ This section covers the basics in configuring
inetd through its command-line
options and its configuration file,
/etc/inetd.conf.
@@ -191,7 +191,7 @@
Like most server daemons, inetd
has a number of options that it can be passed in order to
- modify its behaviour. See the &man.inetd.8; manual page for
+ modify its behaviour. Refer to &man.inetd.8; for
the full list of options.Options can be passed to inetd
@@ -207,8 +207,8 @@
users may be pleased to note that these parameters usually do
not need to be modified. These options may be useful if
an excessive amount of connections are being established.
- A full list of options can be found in the
- &man.inetd.8; manual.
+ A full list of options can be found in
+ &man.inetd.8;.
@@ -264,7 +264,7 @@
inetd.confConfiguration of inetd is
- done via the file /etc/inetd.conf.
+ done by editing /etc/inetd.conf.
When a modification is made to
/etc/inetd.conf,
@@ -515,8 +515,8 @@ server-program-argumentsmax-child-per-ip can be used to limit such
attacks.
- By default, TCP wrapping is turned on. Consult the
- &man.hosts.access.5; manual page for more information on
+ By default, TCP wrapping is turned on. Consult
+ &man.hosts.access.5; for more information on
placing TCP restrictions on various
inetd invoked daemons.
@@ -536,7 +536,7 @@ server-program-arguments
- Consult the &man.inetd.8; manual page for more in-depth
+ Consult &man.inetd.8; for more in-depth
information.
@@ -592,8 +592,7 @@ server-program-arguments
- Removable media storage devices, such as floppy disks
- or CD-ROM drives, can be used by other
+ Removable media storage devices can be used by other
machines on the network. This reduces the number of devices
throughout the network and provides a centralized location
to manage their security.
@@ -840,7 +839,7 @@ mountd_flags="-r"
server:/home /mnt nfs rw 0 0
- The &man.fstab.5; manual page lists all the available
+ Refer to &man.fstab.5; for a description of all available
options.
@@ -870,7 +869,7 @@ rpc_statd_enable="YES"
If locking is not required on the server, the
NFS client can be configured to lock
locally by passing to &man.mount.nfs.8;.
- Refer to the &man.mount.nfs.8; manual page for further
+ Refer to &man.mount.nfs.8; for further
details.
@@ -1009,7 +1008,7 @@ Exports list on foobar:
/etc/amd.conf defines some of the more
advanced features of amd.
- Consult the &man.amd.8; and &man.amd.conf.5; manual pages
+ Consult &man.amd.8; and &man.amd.conf.5;
for more information.
@@ -1037,7 +1036,7 @@ Exports list on foobar:
-->
- Network Information System (NIS/YP)
+ Network Information System (NIS)NISSolaris
@@ -1071,7 +1070,7 @@ Exports list on foobar:
domain to share a common set of configuration files. This
permits a system administrator to set up
NIS client systems with only minimal
- configuration data and add, remove or modify configuration
+ configuration data and to add, remove, or modify configuration
data from a single location.
@@ -1105,9 +1104,9 @@ Exports list on foobar:
NIS domain name
- An NIS master server and all
- of its clients, including its slave servers, share a
- NIS domain name which does not have
+ NIS servers and
+ clients share an
+ NIS domain name. Typically, this name does not have
anything to do with DNS.
@@ -1192,7 +1191,7 @@ Exports list on foobar:
clients are stored on the master server. While it is
possible for one machine to be an NIS
master server for more than one NIS
- domain, this will not be covered in chapter as it
+ domain, this type of configuration will not be covered in this chapter as it
assumes a relatively small-scale NIS
environment.
@@ -1233,13 +1232,13 @@ Exports list on foobar:
Planning ConsiderationsThis section describes a sample NIS
- environment which consists of 15 &os; machines and which
- currently has no centralized point of administration. Each
+ environment which consists of 15 &os; machines with
+ no centralized point of administration. Each
machine has its own /etc/passwd and
/etc/master.passwd. These files are
kept in sync with each other only through manual
intervention. Currently, when a user is added to the lab,
- the process must be repeated on all 15 machines..
+ the process must be repeated on all 15 machines.The configuration of the lab will be as follows:
@@ -1288,7 +1287,7 @@ Exports list on foobar:
- If this is the first time a NIS
+ If this is the first time an NIS
scheme is being developed, it should be thoroughly planned
ahead of time. Regardless of network size, several
decisions need to be made as part of the planning
@@ -1346,14 +1345,14 @@ Exports list on foobar:
- Configuring the NIS Servers
+ Configuring the NIS Master Server The canonical copies of all NIS
files are stored on the master server. The databases used
to store the information are called NIS
maps. In &os;, these maps are stored in
- /var/yp/[domain name] where
- [domain name] is the name of the
+ /var/yp/[domainname] where
+ [domainname] is the name of the
NIS domain. Since multiple domains are
supported, it is possible to have several directories, one
for each domain. Each domain will have its own independent
@@ -1367,10 +1366,6 @@ Exports list on foobar:
database file, and transmitting data from the database back
to the client.
-
- Setting Up a NIS Master
- Server
-
NISserver configuration
@@ -1408,11 +1403,25 @@ Exports list on foobar:
- Depending on the NIS setup,
- additional entries may be required. Refer to if the
- NIS server is also an
- NIS clients.
+ Care must be taken
+ in a multi-server domain
+ where the server machines are also NIS
+ clients. It is generally a good idea to force the servers to
+ bind to themselves rather than allowing them to broadcast bind
+ requests and possibly become bound to each other. Strange
+ failure modes can result if one server goes down and others
+ are dependent upon it. Eventually, all the clients will time
+ out and attempt to bind to other servers, but the delay
+ involved can be considerable and the failure mode is still
+ present since the servers might bind to each other all over
+ again.
+
+ A server that is also a client can be forced to bind to a particular server by
+ adding these additional lines to
+ /etc/rc.conf:
+
+ nis_client_enable="YES" # run client stuff as well
+nis_client_flags="-S NIS domain,server"After saving the edits, type
/etc/netstart to restart the network
@@ -1422,7 +1431,6 @@ Exports list on foobar:
&man.ypserv.8;:&prompt.root; service ypserv start
- Initializing the NIS
@@ -1432,13 +1440,12 @@ Exports list on foobar:
NISmaps
- NIS maps are database files stored
- in /var/yp. They
- are generated from configuration files in NIS maps
+ are generated from the configuration files in /etc on the
NIS master, with one exception:
/etc/master.passwd. This is to
- prevent the propagation passwords to all the servers in
+ prevent the propagation of passwords to all the servers in
the NIS domain. Therefore, before the
NIS maps are initialized, configure the
primary password files:
@@ -1457,7 +1464,7 @@ Exports list on foobar:
group or world readable by setting its permissions to
600.
- When this task has been completed, it is time to
+ After completing this task,
initialize the NIS maps. &os; includes
the &man.ypinit.8; script to do this. When generating
maps for the master server, include
@@ -1488,25 +1495,21 @@ Is this correct? [y/n: y] y<
NIS Map update completed.
ellington has been setup as an YP master server without any errors.
- At this point, ypinit should have
- created /var/yp/Makefile from
- /var/yp/Makefile.dist. When created,
- this file assumes that the operating environment is a
- single server NIS system with only &os;
- machines. Since test-domain has a
- slave server as well, edit
- /var/yp/Makefile as well:
-
- ellington&prompt.root; vi /var/yp/Makefile
-
- You should comment out the line that says
+ This will
+ create /var/yp/Makefile from
+ /var/yp/Makefile.dist. By default,
+ this file assumes that the environment has a
+ single NIS server with only &os;
+ clients. Since test-domain has a
+ slave server, edit this line in
+ /var/yp/Makefile so that it begins with a
+ comment (#):NOPUSH = "True"
-
- (if it is not commented out already).
+
-
+ Setting up a NIS Slave
Server
@@ -1515,15 +1518,14 @@ ellington has been setup as an YP master
slave serverSetting up an NIS slave server is
- even more simple than setting up the master. Log on to
- the slave server and edit the file
- /etc/rc.conf as you did before. The
- only difference is that we now must use the
- option when running
- ypinit. The option
- requires the name of the NIS master be
- passed to it as well, so our command line looks
- like:
+ simpler than setting up the master. Log on to
+ the slave server and edit
+ /etc/rc.conf as before. This
+ time, include
+ when running
+ ypinit. This option
+ requires the name of the NIS master, as
+ seen in this example:coltrane&prompt.root; ypinit -s ellington test-domain
@@ -1605,9 +1607,9 @@ Remember to update map ypservers on elli
Now, run the command /etc/netstart
on the slave server as well, which again starts the NIS
server.
-
+
-
+ Setting Up a NIS ClientAn NIS client establishes what is
@@ -1639,7 +1641,7 @@ Remember to update map ypservers on elli
client configuration
- Setting up a FreeBSD machine to be a
+ Setting up a &os; machine to be a
NIS client is fairly
straightforward.
@@ -1708,7 +1710,6 @@ nis_client_enable="YES"
After completing these steps, the command,
ypcat passwd, should show the
server's passwd map.
-
@@ -2350,35 +2351,6 @@ TWO (,hotel,test-domain)
servers still in use today.
-
- NIS Servers That Are Also
- NIS Clients
-
- Care must be taken when running
- ypserv in a multi-server domain
- where the server machines are also NIS
- clients. It is generally a good idea to force the servers to
- bind to themselves rather than allowing them to broadcast bind
- requests and possibly become bound to each other. Strange
- failure modes can result if one server goes down and others
- are dependent upon it. Eventually all the clients will time
- out and attempt to bind to other servers, but the delay
- involved can be considerable and the failure mode is still
- present since the servers might bind to each other all over
- again.
-
- A host may be forced to bind to a particular server by
- running ypbind with the
- flag. Add the following lines to
- /etc/rc.conf to enable this feature
- during every system boot:
-
- nis_client_enable="YES" # run client stuff as well
-nis_client_flags="-S NIS domain,server"
-
- See &man.ypbind.8; for further information.
-
-
Password Formats
@@ -2663,9 +2635,9 @@ TLS_CIPHER_SUITE HIGH:MEDIUM:+SSLv3There will be a prompt for entering the password and,
if the process does not fail, a password hash will be added
- to the end of slapd.conf. The
+ to the end of slapd.conf.
slappasswd understands several hashing
- formats, refer to the manual page for more information.
+ formats, refer to its manual page for more information.
Edit
/usr/local/etc/openldap/slapd.conf and
@@ -2831,7 +2803,7 @@ result: 0 Success
DHCP, the Dynamic Host Configuration Protocol, describes
the means by which a system can connect to a network and
obtain the necessary information for communication upon that
- network. FreeBSD uses the OpenBSD dhclient
+ network. &os; uses the OpenBSD dhclient
taken from OpenBSD 3.7. All information here regarding
dhclient is for use with either of the ISC
or OpenBSD DHCP clients. The DHCP server is the one included
@@ -2840,12 +2812,12 @@ result: 0 Success
This section describes both the client-side components of
the ISC and OpenBSD DHCP client and server-side components of
the ISC DHCP system. The client-side program,
- dhclient, comes integrated within FreeBSD,
+ dhclient, comes integrated within &os;,
and the server-side portion is available from the net/isc-dhcp42-server port. The
+ role="package">net/isc-dhcp42-server port. Refer to
&man.dhclient.8;, &man.dhcp-options.5;, and
- &man.dhclient.conf.5; manual pages, in addition to the
- references below, are useful resources.
+ &man.dhclient.conf.5;, in addition to the
+ references below, for more information.How It Works
@@ -2869,7 +2841,7 @@ result: 0 Success
- FreeBSD Integration
+ &os; Integration&os; fully integrates the OpenBSD DHCP client,
dhclient. DHCP client support is provided
@@ -2998,24 +2970,23 @@ dhclient_flags=""
dhclient requires a configuration
file, /etc/dhclient.conf. Typically
the file contains only comments, the defaults being
- reasonably sane. This configuration file is described by
- the &man.dhclient.conf.5; manual page.
+ reasonably sane. This configuration file is described in
+ &man.dhclient.conf.5;./sbin/dhclient
- dhclient is statically linked and
- resides in /sbin. The
- &man.dhclient.8; manual page gives more information about
- dhclient.
+ More information
+ about
+ dhclient can be found in &man.dhclient.8;./sbin/dhclient-scriptdhclient-script is the
- FreeBSD-specific DHCP client configuration script. It
+ &os;-specific DHCP client configuration script. It
is described in &man.dhclient-script.8;, but should not
need any user modification to function properly.
@@ -3047,7 +3018,7 @@ dhclient_flags=""
What This Section CoversThis section provides information on how to configure a
- FreeBSD system to act as a DHCP server using the ISC
+ &os; system to act as a DHCP server using the ISC
(Internet Systems Consortium) implementation of the DHCP
server.
@@ -3235,10 +3206,9 @@ dhcpd_ifaces="dc0"
dhcpd is statically
linked and resides in
- /usr/local/sbin. The &man.dhcpd.8;
- manual page installed with the port gives more
+ /usr/local/sbin. More
information about
- dhcpd.
+ dhcpd can be found in &man.dhcpd.8;.
@@ -3251,8 +3221,8 @@ dhcpd_ifaces="dc0"
needs to contain all the information that should be
provided to clients that are being serviced, along with
information regarding the operation of the server. This
- configuration file is described by the
- &man.dhcpd.conf.5; manual page installed by the
+ configuration file is described in
+ &man.dhcpd.conf.5;, which is installed by the
port.
@@ -3260,9 +3230,9 @@ dhcpd_ifaces="dc0"
/var/db/dhcpd.leasesThe DHCP server keeps a database of leases it has
- issued in this file, which is written as a log. The
- manual page &man.dhcpd.leases.5;, installed by the
- port gives a slightly longer description.
+ issued in this file, which is written as a log. The port installs
+ &man.dhcpd.leases.5;, which
+ gives a slightly longer description.
@@ -3274,8 +3244,8 @@ dhcpd_ifaces="dc0"
separate network. If this functionality is required,
then install the
net/isc-dhcp42-relay
- port. The &man.dhcrelay.8; manual page provided with
- the port contains more detail.
+ port. The port installs &man.dhcrelay.8;, which provides
+ more detail.
@@ -3592,13 +3562,13 @@ dhcpd_ifaces="dc0"
named_enable="YES"
- There are obviously many configuration options for
+ There are many configuration options for
/etc/namedb/named.conf that are beyond
- the scope of this document. There are other startup options
- for named on &os;, take a look at
+ the scope of this document. Other startup options
+ for named on &os; can be found in
the named_*
- flags in /etc/defaults/rc.conf and
- consult the &man.rc.conf.5; manual page. The
+ flags in /etc/defaults/rc.conf and in
+ &man.rc.conf.5;. The
section is also a good
read.
@@ -4931,7 +4901,7 @@ DocumentRoot /www/someotherdomain.tld
There are many different Apache
modules available to add functionality to the basic server.
- The FreeBSD Ports Collection provides an easy way to install
+ The &os; Ports Collection provides an easy way to install
Apache together with some of the
more popular add-on modules.
@@ -5220,7 +5190,7 @@ DocumentRoot /www/someotherdomain.tld
software, ftpd, in the base system.
This makes setting up and administering an
FTP server on
- FreeBSD very straightforward.
+ &os; very straightforward.
Configuration
@@ -5239,9 +5209,8 @@ DocumentRoot /www/someotherdomain.tld
of some users without preventing them completely from using
FTP. This can be accomplished with the
/etc/ftpchroot file. This file lists
- users and groups subject to FTP access restrictions. The
- &man.ftpchroot.5; manual page has all of the details so it
- will not be described in detail here.
+ users and groups subject to FTP access restrictions. Refer to
+ &man.ftpchroot.5; for more details.
FTP
@@ -5297,7 +5266,7 @@ DocumentRoot /www/someotherdomain.tld
&prompt.root; service ftpd start
- You can now log on to the FTP server by typing:
+ Log on to the FTP server by typing:&prompt.user; ftp localhost
@@ -5772,8 +5741,8 @@ driftfile /var/db/ntp.driftThis will also prevent access from the server to any
servers listed in the local configuration. If there is a
need to synchronise the NTP server with an external NTP
- server, allow only that specific server. See the
- &man.ntp.conf.5; manual for more information.
+ server, allow only that specific server. Refer to
+ &man.ntp.conf.5; for more information.
To allow machines within the network to synchronize
@@ -5937,8 +5906,8 @@ driftfile /var/db/ntp.drift
More information on various supported and available
- facilities may be found in the
- &man.syslog.conf.5; manual page.
+ facilities may be found in
+ &man.syslog.conf.5;.Once added, all facility messages will
@@ -5962,8 +5931,8 @@ syslogd_flags="-a logclient.example.com
Multiple options may be specified to
allow logging from multiple clients. IP
- addresses and whole netblocks may also be specified, see the
- &man.syslog.3; manual page for a full list of possible
+ addresses and whole netblocks may also be specified. Refer to
+ &man.syslog.3; for a full list of possible
options.Finally, the log file should be created. The method used
@@ -6037,8 +6006,8 @@ syslogd_flags="-s -v -v"warning and
- info. Please refer to the &man.syslog.3;
- manual page for a full list of available facilities and
+ info. Refer to &man.syslog.3;
+ for a full list of available facilities and
priorities.The logging server must be defined in the client's
@@ -6350,9 +6319,9 @@ target iqn.2012-06.com.example:target0 {
The current iSCSI initiator is supported starting with
&os; 10.0-RELEASE. To use iSCSI initiator available in
- older versions, refer to the iscontrol(8)
- manual page. This chapter only applies to the new
+ older versions, refer to iscontrol(8).
+ This chapter only applies to the new
initiator.
@@ -6393,8 +6362,8 @@ target iqn.2012-06.com.example:target0 {
iqn.2012-06.com.example:target0 10.10.10.10 Connected: da0
This means the iSCSI session was successfully
- established, and you have /dev/da0
- representing the attached LUN. Should the target
+ established, where /dev/da0
+ represents the attached LUN. Should the target
("iqn.2012-06.com.example:target0") export more than one
LUN, there will be multiple device nodes in the iscictl(8)
@@ -6452,7 +6421,7 @@ iqn.2012-06.com.example:target0
The first line ("t0") specifies a nickname for the
configuration file section, used at the initiator side to
- specify which configuration you want to use. The following
+ specify which configuration to use. The following
lines specify various parameters used during connection
- target address and name are mandatory; others are
optional; in this case they specify CHAP username and
From owner-svn-doc-head@FreeBSD.ORG Tue Oct 15 21:03:05 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 92418757;
Tue, 15 Oct 2013 21:03:05 +0000 (UTC)
(envelope-from delphij@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 7F87B2879;
Tue, 15 Oct 2013 21:03:05 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9FL3577099097;
Tue, 15 Oct 2013 21:03:05 GMT (envelope-from delphij@svn.freebsd.org)
Received: (from delphij@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9FL35Pr099095;
Tue, 15 Oct 2013 21:03:05 GMT (envelope-from delphij@svn.freebsd.org)
Message-Id: <201310152103.r9FL35Pr099095@svn.freebsd.org>
From: Xin LI
Date: Tue, 15 Oct 2013 21:03:05 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42969 - in head/en_US.ISO8859-1/htdocs/releases: 8.4R
9.2R
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Tue, 15 Oct 2013 21:03:05 -0000
Author: delphij
Date: Tue Oct 15 21:03:04 2013
New Revision: 42969
URL: http://svnweb.freebsd.org/changeset/doc/42969
Log:
Document dates 8.4-RELEASE and 9.2-RELEASE were turned over to secteam.
Modified:
head/en_US.ISO8859-1/htdocs/releases/8.4R/schedule.xml
head/en_US.ISO8859-1/htdocs/releases/9.2R/schedule.xml
Modified: head/en_US.ISO8859-1/htdocs/releases/8.4R/schedule.xml
==============================================================================
--- head/en_US.ISO8859-1/htdocs/releases/8.4R/schedule.xml Tue Oct 15 18:39:12 2013 (r42968)
+++ head/en_US.ISO8859-1/htdocs/releases/8.4R/schedule.xml Tue Oct 15 21:03:04 2013 (r42969)
@@ -134,7 +134,7 @@
Turn over to the secteam
-
-
-
+
16 June 2013
releng/&local.rel; branch is handed over to
the FreeBSD Security Officer Team in one or two weeks after the
announcement.
&local.branch.releng; branch is handed over to the FreeBSD
Security Officer Team in one or two weeks after the
announcement.
From owner-svn-doc-head@FreeBSD.ORG Tue Oct 15 22:03:05 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 79B36CBB;
Tue, 15 Oct 2013 22:03:05 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 59CEF2BAD;
Tue, 15 Oct 2013 22:03:05 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9FM356g046648;
Tue, 15 Oct 2013 22:03:05 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9FM359V046645;
Tue, 15 Oct 2013 22:03:05 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201310152203.r9FM359V046645@svn.freebsd.org>
From: Dru Lavigne
Date: Tue, 15 Oct 2013 22:03:05 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42970 -
head/en_US.ISO8859-1/books/handbook/network-servers
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Tue, 15 Oct 2013 22:03:05 -0000
Author: dru
Date: Tue Oct 15 22:03:04 2013
New Revision: 42970
URL: http://svnweb.freebsd.org/changeset/doc/42970
Log:
This patch provides general tightening and clarification of the sections NIS Slave Servers through NIS Security.
Modified:
head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Tue Oct 15 21:03:04 2013 (r42969)
+++ head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Tue Oct 15 22:03:04 2013 (r42970)
@@ -1517,14 +1517,16 @@ ellington has been setup as an YP master
NISslave server
- Setting up an NIS slave server is
- simpler than setting up the master. Log on to
+ To set up an NIS slave server, log on to
the slave server and edit
- /etc/rc.conf as before. This
- time, include
- when running
- ypinit. This option
- requires the name of the NIS master, as
+ /etc/rc.conf as for the master server.
+ Do not generate any NIS maps, as these
+ already exist on the master server. When running
+ ypinit on the slave server, use
+ (for slave) instead of
+ (for master). This option
+ requires the name of the NIS master in
+ addition to the domain name, as
seen in this example:coltrane&prompt.root; ypinit -s ellington test-domain
@@ -1584,56 +1586,51 @@ ypxfr: Exiting: Map successfully transfe
coltrane has been setup as an YP slave server without any errors.
Remember to update map ypservers on ellington.
- There should be a directory called
- /var/yp/test-domain. Copies of the
- NIS master server's maps should be in
- this directory. These files must always be up to date.
- The following /etc/crontab entries on
- the slave servers should do the job:
+ This will generate a directory on the slave server called
+ /var/yp/test-domain which contains copies of the
+ NIS master server's maps.
+ Adding these /etc/crontab entries on each
+ slave server will force the slaves to sync their maps with
+ the maps on the master server:20 * * * * root /usr/libexec/ypxfr passwd.byname
21 * * * * root /usr/libexec/ypxfr passwd.byuid
- These two lines force the slave to sync its maps with
- the maps on the master server. These entries are not
+ These entries are not
mandatory because the master server automatically attempts
- to push any map changes to its slaves; however, due to
- the importance of correct password information on other
- clients depending on the slave server, it is recommended
- to specifically force the password map updates frequently.
+ to push any map changes to its slaves. However, since clients may
+ depend upon the slave server to provide correct password information,
+ it is recommended
+ to force frequent password map updates.
This is especially important on busy networks where map
updates might not always complete.
- Now, run the command /etc/netstart
- on the slave server as well, which again starts the NIS
- server.
+ To finish the configuration, run /etc/netstart
+ on the slave server in order to start the NIS
+ services.
- Setting Up a NIS Client
+ Setting Up an NIS Client
- An NIS client establishes what is
- called a binding to a particular NIS
- server using the ypbind daemon. The
- ypbind command checks the system's
- default domain (as set by the
- domainname command), and begins
- broadcasting RPC requests on the local network. These
- requests specify the name of the domain for which
- ypbind is attempting to establish a
- binding. If a server that has been configured to serve the
- requested domain receives one of the broadcasts, it will
- respond to ypbind, which will record the
- server's address. If there are several servers available (a
- master and several slaves, for example),
- ypbind will use the address of the first
- one to respond. From that point on, the client system will
+ An NIS client binds
+ to an NIS
+ server using &man.ypbind.8;. This
+ daemon
+ broadcasts RPC requests on the local network. These
+ requests specify the domain name configured on the client.
+ If an NIS server in the same domain
+ receives one of the broadcasts, it will
+ respond to ypbind, which will record the
+ server's address. If there are several servers available,
+ the client will use the address of the first
+ server to respond and will
direct all of its NIS requests to that
- server. ypbind will occasionally
- ping the server to make sure it is still up
- and running. If it fails to receive a reply to one of its
- pings within a reasonable amount of time,
- ypbind will mark the domain as unbound
+ server. The client will automatically
+ ping the server on a regular basis to make sure it is still
+ available. If it fails to receive a reply
+ within a reasonable amount of time,
+ ypbind will mark the domain as unbound
and begin broadcasting again in the hopes of locating
another server.
@@ -1641,16 +1638,15 @@ Remember to update map ypservers on elli
client configuration
- Setting up a &os; machine to be a
- NIS client is fairly
- straightforward.
+ To configure a &os; machine to be an
+ NIS client:Edit /etc/rc.conf and add the
following lines in order to set the
NIS domain name and start
- ypbind during network
+ &man.ypbind.8; during network
startup:nisdomainname="test-domain"
@@ -1659,40 +1655,34 @@ nis_client_enable="YES"To import all possible password entries from the
- NIS server, remove all user
- accounts from the
- /etc/master.passwd file and use
- vipw to add the following line to
+ NIS server, use
+ vipw to remove all user
+ accounts except one from
+ /etc/master.passwd. When removing
+ the accounts, keep in mind that at least one local account
+ should remain and this
+ account should be a member of
+ wheel. If there is a problem
+ with NIS, this local account can be used to log in
+ remotely, become the superuser, and fix
+ the problem. Before saving the edits, add the following line to
the end of the file:+:::::::::
-
- This line will afford anyone with a valid
+ This line configures the client to provide anyone with a valid
account in the NIS server's
- password maps an account. There are many ways to
- configure the NIS
- client by changing this line. See the
- netgroups
- section below for more information. For
- more detailed reading see O'Reilly's book on
- Managing NFS and NIS.
-
-
-
- Keep in mind that at least one local account
- (i.e. not imported via NIS) must exist in
- /etc/master.passwd and this
- account should also be a member of the group
- wheel. If there is something
- wrong with NIS, this account can be used to log in
- remotely, become root, and fix
- things.
-
+ password maps an account on the client. There are many ways to
+ configure the NIS
+ client by modifying this line. One method is described in
+ . For
+ more detailed reading, refer to the book
+ Managing NFS and NIS, published by
+ O'Reilly Media.
- To import all possible group entries from the NIS
+ To import all possible group entries from the NIS
server, add this line to
/etc/group:
@@ -1707,32 +1697,27 @@ nis_client_enable="YES"
&prompt.root; /etc/netstart
&prompt.root; service ypbind start
- After completing these steps, the command,
- ypcat passwd, should show the
- server's passwd map.
+ After completing these steps, running
+ ypcat passwd on the client should show the
+ server's passwd map.NIS Security
- In general, any remote user may issue an RPC to
- &man.ypserv.8; and retrieve the contents of the
- NIS maps, provided the remote user knows
- the domain name. To prevent such unauthorized transactions,
+ Since RPC is a broadcast-based service,
+ any system running ypbind within the same domain
+ can retrieve the contents of the
+ NIS maps. To prevent unauthorized transactions,
&man.ypserv.8; supports a feature called
securenets which can be used to restrict access
- to a given set of hosts. At startup, &man.ypserv.8; will
- attempt to load the securenets information from a file called
- /var/yp/securenets.
-
-
- This path varies depending on the path specified with
- the option. This file contains entries
- that consist of a network specification and a network mask
- separated by white space. Lines starting with
- # are considered to be comments. A sample
- securenets file might look like this:
-
+ to a given set of hosts. By default, this information is stored in
+ /var/yp/securenets, unless &man.ypserv.8; is started with
+ and an alternate path. This file contains entries
+ that consist of a network specification and a network mask
+ separated by white space. Lines starting with
+ # are considered to be comments. A sample
+ securenets might look like this:# allow connections from local host -- mandatory
127.0.0.1 255.255.255.255
@@ -1748,89 +1733,64 @@ nis_client_enable="YES"
matches one of these rules, it will process the request
normally. If the address fails to match a rule, the request
will be ignored and a warning message will be logged. If the
- /var/yp/securenets file does not exist,
+ securenets does not exist,
ypserv will allow connections from any
host.
- The ypserv program also has support for
- Wietse Venema's TCP Wrapper
- package. This allows the administrator to use the
- TCP Wrapper configuration files for
+ is
+ an alternate mechanism for providing
access control instead of
- /var/yp/securenets.
-
-
- While both of these access control mechanisms provide
- some security, they, like the privileged port test, are
+ securenets. While either access control mechanism adds
+ some security, they are both
vulnerable to IP spoofing attacks. All
- NIS-related traffic should be blocked at the
+ NIS-related traffic should be blocked at the
firewall.
- Servers using /var/yp/securenets
+ Servers using securenets
may fail to serve legitimate NIS clients
with archaic TCP/IP implementations. Some of these
implementations set all host bits to zero when doing
- broadcasts and/or fail to observe the subnet mask when
+ broadcasts or fail to observe the subnet mask when
calculating the broadcast address. While some of these
problems can be fixed by changing the client configuration,
- other problems may force the retirement of the client
- systems in question or the abandonment of
- /var/yp/securenets.
-
- Using /var/yp/securenets on a
- server with such an archaic implementation of TCP/IP is a
- really bad idea and will lead to loss of
- NIS functionality for large parts of the
- network.
+ other problems may force the retirement of these client
+ systems or the abandonment of
+ securenets.
- TCP Wrappers
+ TCP WrapperThe use of TCP Wrapper
increases the latency of the NIS server.
The additional delay may be long enough to cause timeouts in
- client programs, especially in busy networks or with slow
- NIS servers. If one or more of the client systems suffers
- from these symptoms, convert the client systems in question
+ client programs, especially in busy networks with slow
+ NIS servers. If one or more clients suffer
+ from latency, convert those clients
into NIS slave servers and force them to
bind to themselves.
-
-
-
- Barring Some Users from Logging On
+
+ Barring Some Users
- In our lab, there is a machine basie that
- is supposed to be a faculty only workstation. We do not want
- to take this machine out of the NIS domain,
- yet the passwd file on the master
+ In this example, the basie system
+ is a faculty workstation within the NIS domain.
+ The passwd map on the master
NIS server contains accounts for both
- faculty and students. What can we
- do?
+ faculty and students. This section demonstrates how to allow
+ faculty logins on this system while refusing student logins.
- There is a way to bar specific users from logging on to a
- machine, even if they are present in the
- NIS database. To do this, add
+ To prevent specified users from logging on to a
+ system, even if they are present in the
+ NIS database, use vipw to add
-username with
- the correct number of colons like other entries to the end of
- the /etc/master.passwd file on the client
- machine, where username is the
- username of the user to bar from logging in. The line with
+ the correct number of colons towards the end of
+ /etc/master.passwd on the client,
+ where username is the
+ username of a user to bar from logging in. The line with
the blocked user must be before the + line
- for allowing NIS users. This should
- preferably be done using
- vipw, since vipw will
- sanity check the changes to
- /etc/master.passwd, as well as
- automatically rebuild the password database after editing.
- For example, to bar user bill from
+ that allows NIS users.
+ In this example, bill is barred from
logging on to basie:
- basie&prompt.root; vipw
-[add -bill::::::::: to the end, exit]
-vipw: rebuilding the database...
-vipw: done
-
-basie&prompt.root; cat /etc/master.passwd
-
+ basie&prompt.root; cat /etc/master.passwd
root:[password]:0:0::0:0:The super-user:/root:/bin/csh
toor:[password]:0:0::0:0:The other super-user:/root:/bin/sh
daemon:*:1:1::0:0:Owner of many system processes:/root:/sbin/nologin
@@ -1850,6 +1810,7 @@ nobody:*:65534:65534::0:0:Unprivileged u
+:::::::::
basie&prompt.root;
+
From owner-svn-doc-head@FreeBSD.ORG Tue Oct 15 22:42:10 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
[IPv6:2001:1900:2254:206a::19:1])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 87464685;
Tue, 15 Oct 2013 22:42:10 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 66ADA2D94;
Tue, 15 Oct 2013 22:42:10 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9FMgAo0066770;
Tue, 15 Oct 2013 22:42:10 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9FMgAQ7066769;
Tue, 15 Oct 2013 22:42:10 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201310152242.r9FMgAQ7066769@svn.freebsd.org>
From: Dru Lavigne
Date: Tue, 15 Oct 2013 22:42:10 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42971 -
head/en_US.ISO8859-1/books/handbook/network-servers
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Tue, 15 Oct 2013 22:42:10 -0000
Author: dru
Date: Tue Oct 15 22:42:10 2013
New Revision: 42971
URL: http://svnweb.freebsd.org/changeset/doc/42971
Log:
White space fix only. Translators can ignore.
Modified:
head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Tue Oct 15 22:03:04 2013 (r42970)
+++ head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Tue Oct 15 22:42:10 2013 (r42971)
@@ -1036,7 +1036,8 @@ Exports list on foobar:
-->
- Network Information System (NIS)
+ Network Information System
+ (NIS)NISSolaris
@@ -1104,10 +1105,10 @@ Exports list on foobar:
NIS domain name
- NIS servers and
- clients share an
- NIS domain name. Typically, this name does not have
- anything to do with DNS.
+ NIS servers and clients share
+ an NIS domain name. Typically,
+ this name does not have anything to do with
+ DNS.
@@ -1191,9 +1192,9 @@ Exports list on foobar:
clients are stored on the master server. While it is
possible for one machine to be an NIS
master server for more than one NIS
- domain, this type of configuration will not be covered in this chapter as it
- assumes a relatively small-scale NIS
- environment.
+ domain, this type of configuration will not be covered in
+ this chapter as it assumes a relatively small-scale
+ NIS environment.
@@ -1345,7 +1346,8 @@ Exports list on foobar:
- Configuring the NIS Master Server
+ Configuring the NIS Master
+ Server The canonical copies of all NIS
files are stored on the master server. The databases used
@@ -1366,61 +1368,58 @@ Exports list on foobar:
database file, and transmitting data from the database back
to the client.
-
- NIS
- server configuration
-
- Setting up a master NIS server can
- be relatively straight forward, depending on environmental
- needs. Since &os; provides built-in
- NIS support, it only needs to be
- enabled by adding the following lines to
- /etc/rc.conf:
-
-
-
- nisdomainname="test-domain"
-
- This line sets the NIS domain
- name to test-domain.
-
-
-
- nis_server_enable="YES"
-
- This automates the start up of the
- NIS server processes when the
- system boots.
-
-
-
- nis_yppasswdd_enable="YES"
-
- This enables the
- &man.rpc.yppasswdd.8; daemon so that
- users can change their NIS
- password from a client machine.
-
-
-
- Care must be taken
- in a multi-server domain
- where the server machines are also NIS
- clients. It is generally a good idea to force the servers to
- bind to themselves rather than allowing them to broadcast bind
- requests and possibly become bound to each other. Strange
- failure modes can result if one server goes down and others
- are dependent upon it. Eventually, all the clients will time
- out and attempt to bind to other servers, but the delay
- involved can be considerable and the failure mode is still
- present since the servers might bind to each other all over
- again.
-
- A server that is also a client can be forced to bind to a particular server by
- adding these additional lines to
- /etc/rc.conf:
+ NIS
+ server configuration
+
+ Setting up a master NIS server can
+ be relatively straight forward, depending on environmental
+ needs. Since &os; provides built-in
+ NIS support, it only needs to be
+ enabled by adding the following lines to
+ /etc/rc.conf:
+
+
+
+ nisdomainname="test-domain"
+
+ This line sets the NIS domain
+ name to test-domain.
+
+
+
+ nis_server_enable="YES"
+
+ This automates the start up of the
+ NIS server processes when the
+ system boots.
+
+
+
+ nis_yppasswdd_enable="YES"
+
+ This enables the &man.rpc.yppasswdd.8; daemon so
+ that users can change their NIS
+ password from a client machine.
+
+
+
+ Care must be taken in a multi-server domain where the
+ server machines are also NIS clients. It
+ is generally a good idea to force the servers to bind to
+ themselves rather than allowing them to broadcast bind
+ requests and possibly become bound to each other. Strange
+ failure modes can result if one server goes down and others
+ are dependent upon it. Eventually, all the clients will
+ time out and attempt to bind to other servers, but the delay
+ involved can be considerable and the failure mode is still
+ present since the servers might bind to each other all over
+ again.
+
+ A server that is also a client can be forced to bind to
+ a particular server by adding these additional lines to
+ /etc/rc.conf:
- nis_client_enable="YES" # run client stuff as well
+ nis_client_enable="YES" # run client stuff as well
nis_client_flags="-S NIS domain,server"After saving the edits, type
@@ -1495,19 +1494,19 @@ Is this correct? [y/n: y] y<
NIS Map update completed.
ellington has been setup as an YP master server without any errors.
- This will
- create /var/yp/Makefile from
- /var/yp/Makefile.dist. By default,
- this file assumes that the environment has a
- single NIS server with only &os;
- clients. Since test-domain has a
- slave server, edit this line in
- /var/yp/Makefile so that it begins with a
- comment (#):
-
- NOPUSH = "True"
-
-
+ This will create
+ /var/yp/Makefile from
+ /var/yp/Makefile.dist. By
+ default, this file assumes that the environment has a
+ single NIS server with only &os;
+ clients. Since test-domain has a
+ slave server, edit this line in
+ /var/yp/Makefile so that it begins
+ with a comment (#):
+
+ NOPUSH = "True"
+
+
Setting up a NIS Slave
@@ -1517,17 +1516,17 @@ ellington has been setup as an YP master
NISslave server
- To set up an NIS slave server, log on to
- the slave server and edit
- /etc/rc.conf as for the master server.
- Do not generate any NIS maps, as these
- already exist on the master server. When running
+ To set up an NIS slave server, log
+ on to the slave server and edit
+ /etc/rc.conf as for the master
+ server. Do not generate any NIS maps,
+ as these already exist on the master server. When running
ypinit on the slave server, use
- (for slave) instead of
- (for master). This option
- requires the name of the NIS master in
- addition to the domain name, as
- seen in this example:
+ (for slave) instead of
+ (for master). This option requires
+ the name of the NIS master in
+ addition to the domain name, as seen in this
+ example:coltrane&prompt.root; ypinit -s ellington test-domain
@@ -1586,53 +1585,52 @@ ypxfr: Exiting: Map successfully transfe
coltrane has been setup as an YP slave server without any errors.
Remember to update map ypservers on ellington.
- This will generate a directory on the slave server called
- /var/yp/test-domain which contains copies of the
- NIS master server's maps.
- Adding these /etc/crontab entries on each
- slave server will force the slaves to sync their maps with
- the maps on the master server:
+ This will generate a directory on the slave server
+ called /var/yp/test-domain which
+ contains copies of the NIS master
+ server's maps. Adding these
+ /etc/crontab entries on each slave
+ server will force the slaves to sync their maps with the
+ maps on the master server:20 * * * * root /usr/libexec/ypxfr passwd.byname
21 * * * * root /usr/libexec/ypxfr passwd.byuidThese entries are not
mandatory because the master server automatically attempts
- to push any map changes to its slaves. However, since clients may
- depend upon the slave server to provide correct password information,
- it is recommended
- to force frequent password map updates.
- This is especially important on busy networks where map
- updates might not always complete.
-
- To finish the configuration, run /etc/netstart
- on the slave server in order to start the NIS
+ to push any map changes to its slaves. However, since
+ clients may depend upon the slave server to provide correct
+ password information, it is recommended to force frequent
+ password map updates. This is especially important on busy
+ networks where map updates might not always complete.
+
+ To finish the configuration, run
+ /etc/netstart on the slave server in
+ order to start the NIS
services.Setting Up an NIS Client
- An NIS client binds
- to an NIS
- server using &man.ypbind.8;. This
- daemon
- broadcasts RPC requests on the local network. These
+ An NIS client binds to an
+ NIS server using &man.ypbind.8;. This
+ daemon broadcasts RPC requests on the local network. These
requests specify the domain name configured on the client.
If an NIS server in the same domain
- receives one of the broadcasts, it will
- respond to ypbind, which will record the
+ receives one of the broadcasts, it will respond to
+ ypbind, which will record the
server's address. If there are several servers available,
- the client will use the address of the first
- server to respond and will
- direct all of its NIS requests to that
- server. The client will automatically
- ping the server on a regular basis to make sure it is still
- available. If it fails to receive a reply
- within a reasonable amount of time,
- ypbind will mark the domain as unbound
- and begin broadcasting again in the hopes of locating
- another server.
+ the client will use the address of the first server to
+ respond and will direct all of its NIS
+ requests to that server. The client will automatically
+ ping the server on a regular
+ basis to make sure it is still available. If it fails to
+ receive a reply within a reasonable amount of time,
+ ypbind will mark the domain as
+ unbound and begin broadcasting again in the hopes of
+ locating another server.NISclient configuration
@@ -1641,49 +1639,50 @@ Remember to update map ypservers on elli
To configure a &os; machine to be an
NIS client:
-
-
- Edit /etc/rc.conf and add the
- following lines in order to set the
- NIS domain name and start
- &man.ypbind.8; during network
- startup:
+
+
+ Edit /etc/rc.conf and add the
+ following lines in order to set the
+ NIS domain name and start
+ &man.ypbind.8; during network
+ startup:
- nisdomainname="test-domain"
+ nisdomainname="test-domain"
nis_client_enable="YES"To import all possible password entries from the
NIS server, use
- vipw to remove all user
- accounts except one from
- /etc/master.passwd. When removing
- the accounts, keep in mind that at least one local account
- should remain and this
- account should be a member of
- wheel. If there is a problem
- with NIS, this local account can be used to log in
- remotely, become the superuser, and fix
- the problem. Before saving the edits, add the following line to
- the end of the file:
+ vipw to remove all user accounts
+ except one from
+ /etc/master.passwd. When
+ removing the accounts, keep in mind that at least one
+ local account should remain and this account should be
+ a member of wheel. If there is
+ a problem with NIS, this local
+ account can be used to log in remotely, become the
+ superuser, and fix the problem. Before saving the
+ edits, add the following line to the end of the
+ file:
+:::::::::
- This line configures the client to provide anyone with a valid
- account in the NIS server's
- password maps an account on the client. There are many ways to
- configure the NIS
- client by modifying this line. One method is described in
- . For
- more detailed reading, refer to the book
- Managing NFS and NIS, published by
- O'Reilly Media.
+ This line configures the client to provide
+ anyone with a valid account in the
+ NIS server's password maps an
+ account on the client. There are many ways to
+ configure the NIS client by
+ modifying this line. One method is described in
+ . For
+ more detailed reading, refer to the book
+ Managing NFS and NIS, published
+ by O'Reilly Media.
- To import all possible group entries from the NIS
- server, add this line to
+ To import all possible group entries from the
+ NIS server, add this line to
/etc/group:+:*::
@@ -1697,26 +1696,27 @@ nis_client_enable="YES"
&prompt.root; /etc/netstart
&prompt.root; service ypbind start
- After completing these steps, running
- ypcat passwd on the client should show the
- server's passwd map.
+ After completing these steps, running
+ ypcat passwd on the client should show
+ the server's passwd map.NIS Security
- Since RPC is a broadcast-based service,
- any system running ypbind within the same domain
- can retrieve the contents of the
- NIS maps. To prevent unauthorized transactions,
- &man.ypserv.8; supports a feature called
+ Since RPC is a broadcast-based service,
+ any system running ypbind within
+ the same domain can retrieve the contents of the
+ NIS maps. To prevent unauthorized
+ transactions, &man.ypserv.8; supports a feature called
securenets which can be used to restrict access
- to a given set of hosts. By default, this information is stored in
- /var/yp/securenets, unless &man.ypserv.8; is started with
- and an alternate path. This file contains entries
- that consist of a network specification and a network mask
- separated by white space. Lines starting with
- # are considered to be comments. A sample
+ to a given set of hosts. By default, this information is
+ stored in /var/yp/securenets, unless
+ &man.ypserv.8; is started with and an
+ alternate path. This file contains entries that consist of a
+ network specification and a network mask separated by white
+ space. Lines starting with # are
+ considered to be comments. A sample
securenets might look like this:# allow connections from local host -- mandatory
@@ -1737,60 +1737,61 @@ nis_client_enable="YES"ypserv will allow connections from any
host.
- is
- an alternate mechanism for providing
- access control instead of
- securenets. While either access control mechanism adds
- some security, they are both
- vulnerable to IP spoofing attacks. All
- NIS-related traffic should be blocked at the
- firewall.
-
- Servers using securenets
- may fail to serve legitimate NIS clients
- with archaic TCP/IP implementations. Some of these
- implementations set all host bits to zero when doing
- broadcasts or fail to observe the subnet mask when
- calculating the broadcast address. While some of these
- problems can be fixed by changing the client configuration,
- other problems may force the retirement of these client
- systems or the abandonment of
- securenets.
-
- TCP Wrapper
- The use of TCP Wrapper
- increases the latency of the NIS server.
- The additional delay may be long enough to cause timeouts in
- client programs, especially in busy networks with slow
- NIS servers. If one or more clients suffer
- from latency, convert those clients
- into NIS slave servers and force them to
- bind to themselves.
-
-
- Barring Some Users
-
- In this example, the basie system
- is a faculty workstation within the NIS domain.
- The passwd map on the master
- NIS server contains accounts for both
- faculty and students. This section demonstrates how to allow
- faculty logins on this system while refusing student logins.
-
- To prevent specified users from logging on to a
- system, even if they are present in the
- NIS database, use vipw to add
- -username with
- the correct number of colons towards the end of
- /etc/master.passwd on the client,
- where username is the
- username of a user to bar from logging in. The line with
- the blocked user must be before the + line
- that allows NIS users.
- In this example, bill is barred from
- logging on to basie:
+ is an alternate mechanism
+ for providing access control instead of
+ securenets. While either access control
+ mechanism adds some security, they are both vulnerable to
+ IP spoofing attacks. All
+ NIS-related traffic should be blocked at
+ the firewall.
+
+ Servers using securenets
+ may fail to serve legitimate NIS clients
+ with archaic TCP/IP implementations. Some of these
+ implementations set all host bits to zero when doing
+ broadcasts or fail to observe the subnet mask when
+ calculating the broadcast address. While some of these
+ problems can be fixed by changing the client configuration,
+ other problems may force the retirement of these client
+ systems or the abandonment of
+ securenets.
+
+ TCP Wrapper
+ The use of TCP Wrapper
+ increases the latency of the NIS server.
+ The additional delay may be long enough to cause timeouts in
+ client programs, especially in busy networks with slow
+ NIS servers. If one or more clients suffer
+ from latency, convert those clients into
+ NIS slave servers and force them to bind to
+ themselves.
+
+
+ Barring Some Users
+
+ In this example, the basie system
+ is a faculty workstation within the NIS
+ domain. The passwd map on the master
+ NIS server contains accounts for both
+ faculty and students. This section demonstrates how to
+ allow faculty logins on this system while refusing student
+ logins.
+
+ To prevent specified users from logging on to a
+ system, even if they are present in the
+ NIS database, use vipw
+ to add
+ -username with
+ the correct number of colons towards the end of
+ /etc/master.passwd on the client,
+ where username is the username of
+ a user to bar from logging in. The line with the blocked
+ user must be before the + line that
+ allows NIS users. In this example,
+ bill is barred from logging on to
+ basie:
- basie&prompt.root; cat /etc/master.passwd
+ basie&prompt.root; cat /etc/master.passwd
root:[password]:0:0::0:0:The super-user:/root:/bin/csh
toor:[password]:0:0::0:0:The other super-user:/root:/bin/sh
daemon:*:1:1::0:0:Owner of many system processes:/root:/sbin/nologin
@@ -2938,9 +2939,8 @@ dhclient_flags=""
/sbin/dhclient
- More information
- about
- dhclient can be found in &man.dhclient.8;.
+ More information about dhclient can
+ be found in &man.dhclient.8;.
@@ -3169,7 +3169,8 @@ dhcpd_ifaces="dc0"
linked and resides in
/usr/local/sbin. More
information about
- dhcpd can be found in &man.dhcpd.8;.
+ dhcpd can be found in
+ &man.dhcpd.8;.
@@ -3191,9 +3192,9 @@ dhcpd_ifaces="dc0"
/var/db/dhcpd.leasesThe DHCP server keeps a database of leases it has
- issued in this file, which is written as a log. The port installs
- &man.dhcpd.leases.5;, which
- gives a slightly longer description.
+ issued in this file, which is written as a log. The
+ port installs &man.dhcpd.leases.5;, which gives a
+ slightly longer description.
@@ -3205,8 +3206,8 @@ dhcpd_ifaces="dc0"
separate network. If this functionality is required,
then install the
net/isc-dhcp42-relay
- port. The port installs &man.dhcrelay.8;, which provides
- more detail.
+ port. The port installs &man.dhcrelay.8;, which
+ provides more detail.
From owner-svn-doc-head@FreeBSD.ORG Wed Oct 16 13:19:44 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
[IPv6:2001:1900:2254:206a::19:1])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id EF406FCC;
Wed, 16 Oct 2013 13:19:44 +0000 (UTC) (envelope-from gjb@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id DCDCA2CB0;
Wed, 16 Oct 2013 13:19:44 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9GDJib3028328;
Wed, 16 Oct 2013 13:19:44 GMT (envelope-from gjb@svn.freebsd.org)
Received: (from gjb@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9GDJiEi028327;
Wed, 16 Oct 2013 13:19:44 GMT (envelope-from gjb@svn.freebsd.org)
Message-Id: <201310161319.r9GDJiEi028327@svn.freebsd.org>
From: Glen Barber
Date: Wed, 16 Oct 2013 13:19:44 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42972 - head/en_US.ISO8859-1/htdocs
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Wed, 16 Oct 2013 13:19:45 -0000
Author: gjb
Date: Wed Oct 16 13:19:44 2013
New Revision: 42972
URL: http://svnweb.freebsd.org/changeset/doc/42972
Log:
Remove gnn entry from secteam.
Modified:
head/en_US.ISO8859-1/htdocs/administration.xml
Modified: head/en_US.ISO8859-1/htdocs/administration.xml
==============================================================================
--- head/en_US.ISO8859-1/htdocs/administration.xml Tue Oct 15 22:42:10 2013 (r42971)
+++ head/en_US.ISO8859-1/htdocs/administration.xml Wed Oct 16 13:19:44 2013 (r42972)
@@ -245,7 +245,6 @@
&a.delphij.email; (Officer Deputy)
&a.des.email; (Officer)
&a.gavin.email; (Core Team Liaison)
-
&a.gnn.email;
&a.jonathan.email;
&a.philip.email;
&a.qingli.email;
From owner-svn-doc-head@FreeBSD.ORG Wed Oct 16 16:32:58 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id CD877DC3;
Wed, 16 Oct 2013 16:32:58 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id B87082A83;
Wed, 16 Oct 2013 16:32:58 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9GGWwt3031216;
Wed, 16 Oct 2013 16:32:58 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9GGWwUX031215;
Wed, 16 Oct 2013 16:32:58 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201310161632.r9GGWwUX031215@svn.freebsd.org>
From: Dru Lavigne
Date: Wed, 16 Oct 2013 16:32:58 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42973 -
head/en_US.ISO8859-1/books/handbook/network-servers
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Wed, 16 Oct 2013 16:32:58 -0000
Author: dru
Date: Wed Oct 16 16:32:58 2013
New Revision: 42973
URL: http://svnweb.freebsd.org/changeset/doc/42973
Log:
This patch finishes up the NIS section of this chapter. It does the following:
- replaces NISv1 Compatibility section with a note that FreeBSD uses v2
- renames Important Things to Remember to Adding New Users and places it as a subsection of Configuring the NIS Master Server
- removes the reference to auth.log which is now obsolete
- general tightening and clarification
A subsequent white-space patch will follow.
Modified:
head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Wed Oct 16 13:19:44 2013 (r42972)
+++ head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Wed Oct 16 16:32:58 2013 (r42973)
@@ -1074,6 +1074,9 @@ Exports list on foobar:
configuration data and to add, remove, or modify configuration
data from a single location.
+ &os; uses version 2 of the NIS
+ protocol.
+
NIS Terms and Processes
@@ -1456,7 +1459,7 @@ nis_client_flags="-S NIS do
It is advisable to remove all entries for system
accounts as well as any user accounts that do not need to
be propagated to the NIS clients, such
- as the root accounts.
+ as the root and any other administrative accounts.
Ensure that the
/var/yp/master.passwd is neither
@@ -1506,6 +1509,28 @@ ellington has been setup as an YP master
NOPUSH = "True"
+
+
+ Adding New Users
+
+ Every time a new user is created, the user account must
+ be added to the master NIS server and
+ the NIS maps rebuilt. Until this occurs,
+ the new user will not be able to
+ login anywhere except on the NIS
+ master. For example, to add the new user
+ jsmith to the
+ test-domain domain, run these commands on the
+ master server:
+
+ &prompt.root; pw useradd jsmith
+&prompt.root; cd /var/yp
+&prompt.root; make test-domain
+
+ The user could also be added using
+ adduser jsmith
+ instead of pw useradd jsmith.
+
@@ -1831,37 +1856,24 @@ basie&prompt.root;
netgroups
- The method shown in the previous section works reasonably
- well for special rules in an environment with small numbers of
- users and/or machines. On larger networks, administrators
- will likely forget to bar some users from
- logging onto sensitive machines, or may even have to modify
- each machine separately, thus losing the main benefit of NIS:
+ Barring specified users from logging on to individual systems
+ becomes unscaleable on
+ larger networks and quickly loses the main benefit of NIS:
centralized administration.
- The NIS developers' solution for this
- problem is called netgroups. Their
- purpose and semantics can be compared to the normal groups
- used by &unix; file systems. The main differences are the
+ Netgroups were developed to handle large, complex networks
+ with hundreds of users and machines. Their use is comparable
+ to &unix; groups, where the main difference is the
lack of a numeric ID and the ability to define a netgroup by
including both user accounts and other netgroups.
- Netgroups were developed to handle large, complex networks
- with hundreds of users and machines. On one hand, this is a
- Good Thing in such a situation. On the other hand, this
- complexity makes it almost impossible to explain netgroups
- with really simple examples. The example used in the
- remainder of this section demonstrates this problem.
-
- Let us assume that the successful introduction of
- NIS in the laboratory caught a superiors'
- interest. The next task is to extend the
- NIS domain to cover some of the other
- machines on campus. The two tables contain the names of the
- new users and new machines as well as brief descriptions of
- them.
+ To expand on the example used in this chapter, the
+ NIS domain will be extended to add the users
+ and systems shown in Tables 28.2 and 28.3:
+
+
+ Additional Users
-
@@ -1874,32 +1886,34 @@ basie&prompt.root;
alpha,
beta
- Normal employees of the IT department
+ IT department employeescharlie,
delta
- The new apprentices of the IT department
+ IT department apprenticesecho,
foxtrott,
golf, ...
- Ordinary employees
+ employeesable,
baker, ...
- The current interns
+ interns
-
+
+
+
+ Additional Systems
-
@@ -1915,9 +1929,8 @@ basie&prompt.root;
war,
death, famine,
pollution
- The most important servers deployed. Only the IT
- employees are allowed to log onto these
- machines.
+ Only IT
+ employees are allowed to log onto these servers.
@@ -1925,62 +1938,47 @@ basie&prompt.root;
pride, greed,
envy, wrath,
lust, sloth
- Less important servers. All members of the IT
+ All members of the IT
department are allowed to login onto these
- machines.
+ servers.one, two,
three, four,
...
- Ordinary workstations. Only the
- real employees are allowed to use
- these machines.
+ Ordinary workstations used by
+ employees.trashcanA very old machine without any critical data.
- Even the intern is allowed to use this box.
+ Even interns are allowed to use this system.
-
+
- An attempt to implement these restrictions by separately
- blocking each user, would require the addition of the
- -user line to
- each system's passwd. One line for each
- user who is not allowed to login onto that system. Forgetting
- just one entry could cause significant trouble. It may be
- feasible to do this correctly during the initial setup;
- however, eventually someone will forget to add these lines for
- new users.
-
- Handling this situation with netgroups offers several
- advantages. Each user need not be handled separately; they
- would be assigned to one or more netgroups and logins would be
- allowed or forbidden for all members of the netgroup. While
+ When using netgroups to configure this scenario,
+ each user is
+ assigned to one or more netgroups and logins are then
+ allowed or forbidden for all members of the netgroup. When
adding a new machine, login restrictions must be defined for
- all netgroups. If a new user is added, they must be added to
- one or more netgroups. Those changes are independent of each
- other: no more for each combination of user and machine
- do... If the NIS setup is
+ all netgroups. When a new user is added, the account must be added to
+ one or more netgroups. If the NIS setup is
planned carefully, only one central configuration file needs
modification to grant or deny access to machines.The first step is the initialization of the
- NIS map netgroup. &os;'s &man.ypinit.8;
- does not create this map by default, but its
- NIS implementation will support it after
- creation. To create an empty map, simply type
-
- ellington&prompt.root; vi /var/yp/netgroup
-
- and begin adding content. For our example, we need at
- least four netgroups: IT employees, IT apprentices, normal
- employees and interns.
+ NIS netgroup map. In &os;,
+ this map is not created by default. On the
+ NIS master server, use an editor to create
+ a map named /var/yp/netgroup.
+
+ This example creates
+ four netgroups to represent IT employees, IT apprentices,
+ employees, and interns:IT_EMP (,alpha,test-domain) (,beta,test-domain)
IT_APP (,charlie,test-domain) (,delta,test-domain)
@@ -1988,17 +1986,17 @@ USERS (,echo,test-domain) (,foxtro
(,golf,test-domain)
INTERNS (,able,test-domain) (,baker,test-domain)
- IT_EMP, IT_APP etc.
- are the names of the netgroups. Each bracketed group adds
- one or more user accounts to it. The three fields inside a
- group are:
+ Each entry configures a netgroup. The first column in an entry
+ is the name of the netgroup. Each set of brackets represents
+ either a group of one or more users or the name of another netgroup.
+ When specifying a user, the three comma-delimited fields inside each
+ group represent:
- The name of the host(s) where the following items are
+ The name of the host(s) where the other fields representing the user are
valid. If a hostname is not specified, the entry is valid
- on all hosts. If a hostname is specified, it will need to
- be micro-managed within this configuration.
+ on all hosts.
@@ -2013,38 +2011,34 @@ INTERNS (,able,test-domain) (,baker,
- Each of these fields may contain wildcards. See
+ If a group contains multiple users, separate each user with
+ whitespace. Additionally, each field may contain wildcards. See
&man.netgroup.5; for details.
- netgroupsNetgroup names longer than 8 characters should not be
- used, especially with machines running other operating
- systems within the NIS domain. The names
- are case sensitive; using capital letters for netgroup names
+ used. The names
+ are case sensitive and using capital letters for netgroup names
is an easy way to distinguish between user, machine and
netgroup names.
- Some NIS clients (other than &os;)
- cannot handle netgroups with a large number of entries. For
- example, some older versions of &sunos; start to cause
- trouble if a netgroup contains more than 15
- entries. This limit may be
+ Some non-&os; NIS clients
+ cannot handle netgroups containing more than 15
+ entries. This limit may be
circumvented by creating several sub-netgroups with 15 users
or fewer and a real netgroup consisting of the
- sub-netgroups:
+ sub-netgroups, as seen in this example:BIGGRP1 (,joe1,domain) (,joe2,domain) (,joe3,domain) [...]
BIGGRP2 (,joe16,domain) (,joe17,domain) [...]
BIGGRP3 (,joe31,domain) (,joe32,domain)
BIGGROUP BIGGRP1 BIGGRP2 BIGGRP3
- Repeat this process if more than 225 users will exist
+ Repeat this process if more than 225 (15 times 15) users exist
within a single netgroup.
-
- Activating and distributing the new
- NIS map is easy:
+ To activate and distribute the new
+ NIS map:ellington&prompt.root; cd /var/yp
ellington&prompt.root; make
@@ -2052,7 +2046,7 @@ ellington&prompt.root; make
This will generate the three NIS maps
netgroup,
netgroup.byhost and
- netgroup.byuser. Use &man.ypcat.1; to
+ netgroup.byuser. Use the map key option of &man.ypcat.1; to
check if the new NIS maps are
available:
@@ -2062,13 +2056,14 @@ ellington&prompt.user; ypcat
The output of the first command should resemble the
contents of /var/yp/netgroup. The second
- command will not produce output without specified
- host-specific netgroups. The third command may be used to get
+ command only produces output if
+ host-specific netgroups were created. The third command is used to get
the list of netgroups for a user.
- The client setup is quite simple. To configure the server
- war, use &man.vipw.8; to replace the
- line
+ To configure a client, use &man.vipw.8; to specify the name
+ of the netgroup. For example, on the server named
+ war, replace this
+ line:+:::::::::
@@ -2076,85 +2071,63 @@ ellington&prompt.user; ypcat
+@IT_EMP:::::::::
- Now, only the data for the users defined in the netgroup
- IT_EMP is imported into
- war's password database and only these users
- are allowed to login.
-
- Unfortunately, this limitation also applies to the
- ~ function of the shell and all routines
- converting between user names and numerical user IDs. In
+ This specifies that only the users defined in the netgroup
+ IT_EMP will be imported into this system's
+ password database and only those users
+ are allowed to login to this system.
+
+ This configuration also applies to the
+ ~ function of the shell and all routines which
+ convert between user names and numerical user IDs. In
other words,
cd ~user will
not work, ls -l will show the numerical ID
- instead of the username and
- find . -user joe -print will fail with
+ instead of the username, and
+ find . -user joe -print will fail with the message
No such user. To fix this, import all
- user entries without allowing them to login into the
- servers.
-
- This can be achieved by adding another line to
- /etc/master.passwd. This line should
- contain:
-
- +:::::::::/sbin/nologin, meaning
- Import all entries but replace the shell with
- /sbin/nologin in the imported
- entries. It is possible to replace any field in the
- passwd entry by placing a default value in
- /etc/master.passwd.
+ user entries without allowing them to login into the
+ servers. This can be achieved by adding an extra line:
+
+ +:::::::::/sbin/nologin
+
+ This line configures the client to
+ import all entries but to replace the shell in those entries with
+ /sbin/nologin.
-
- Make sure that the line
- +:::::::::/sbin/nologin is placed after
+ Make sure that extra line
+ is placed after+@IT_EMP:::::::::. Otherwise, all user
accounts imported from NIS will have
/sbin/nologin as their login
- shell.
-
+ shell and noone will be able to login to the system.
- After this change, the NIS map will
- only need modification when a new employee joins the IT
- department. A similar approach for the less important servers
- may be used by replacing the old +:::::::::
- in their local version of
- /etc/master.passwd with something like
- this:
+ To configure the less important servers,
+ replace the old +:::::::::
+ on the servers with these lines:+@IT_EMP:::::::::
+@IT_APP:::::::::
+:::::::::/sbin/nologin
- The corresponding lines for the normal workstations
- could be:
+ The corresponding lines for the workstations
+ would be:+@IT_EMP:::::::::
+@USERS:::::::::
+:::::::::/sbin/nologin
- And everything would be fine until there is a policy
- change a few weeks later: The IT department starts hiring
- interns. The IT interns are allowed to use the normal
- workstations and the less important servers; and the IT
- apprentices are allowed to login onto the main servers. Add a
- new netgroup IT_INTERN, then add the new IT
- interns to this netgroup and start to change the configuration
- on each and every machine. As the old saying goes:
- Errors in centralized planning lead to global
- mess.
-
- NIS' ability to create netgroups from other netgroups can
- be used to prevent situations like these. One possibility is
+ NIS supports the creation of netgroups from other netgroups which
+ can be useful if the policy regarding user access changes. One possibility is
the creation of role-based netgroups. For example, one might
create a netgroup called BIGSRV to define
the login restrictions for the important servers, another
netgroup called SMALLSRV for the less
- important servers and a third netgroup called
- USERBOX for the normal workstations. Each
+ important servers, and a third netgroup called
+ USERBOX for the workstations. Each
of these netgroups contains the netgroups that are allowed to
login onto these machines. The new entries for the
- NIS map netgroup should look like
+ NIS netgroup map would look like
this:BIGSRV IT_EMP IT_APP
@@ -2168,16 +2141,15 @@ USERBOX IT_EMP ITINTERN USERS
- Machine-specific netgroup definitions are the other
- possibility to deal with the policy change outlined above. In
+ Machine-specific netgroup definitions are another
+ possibility to deal with the policy changes. In
this scenario, the /etc/master.passwd of
- each box contains two lines starting with +.
- The first of them adds a netgroup with the accounts allowed to
- login onto this machine, the second one adds all other
+ each system contains two lines starting with +.
+ The first line adds a netgroup with the accounts allowed to
+ login onto this machine and the second line adds all other
accounts with /sbin/nologin as shell. It
- is a good idea to use the ALL-CAPS version of
- the machine name as the name of the netgroup. In other words,
- the lines should look like this:
+ is recommended to use the ALL-CAPS version of
+ the hostname as the name of the netgroup:+@BOXNAME:::::::::
+:::::::::/sbin/nologin
@@ -2187,8 +2159,7 @@ USERBOX IT_EMP ITINTERN USERS/etc/master.passwd ever again. All
further changes can be handled by modifying the
NIS map. Here is an example of a possible
- netgroup map for this scenario with some additional
- goodies:
+ netgroup map for this scenario:# Define groups of users first
IT_EMP (,alpha,test-domain) (,beta,test-domain)
@@ -2226,159 +2197,55 @@ ONE SECURITY
TWO (,hotel,test-domain)
# [...more groups to follow]
- If some kind of database is used to manage the user
- accounts, it may be possible to create the first part of the
- map using the database's reporting tools. This way, new users
- will automatically have access to the boxes.
-
- One last word of caution: It may not always be advisable
+ It may not always be advisable
to use machine-based netgroups. When deploying a couple of
- dozen or even hundreds of identical machines for student labs,
+ dozen or hundreds of systems,
role-based netgroups instead of machine-based netgroups may be
used to keep the size of the NIS map within
reasonable limits.
- Important Things to Remember
-
- There are still a couple of things administrators need to
- do differently now that machines are in an NIS
- environment.
-
-
-
- Every time a new user is added to the lab, they must
- be added to the master NIS server and
- the NIS maps will need rebuilt. If
- this step is omitted, the new user will not be able to
- login anywhere except on the NIS
- master. For example, if we needed to add a new user
- jsmith to the lab, we would:
-
- &prompt.root; pw useradd jsmith
-&prompt.root; cd /var/yp
-&prompt.root; make test-domain
-
- The user may also be added using
- adduser jsmith
- instead of pw useradd jsmith.
-
-
-
- Keep the administration accounts out of the
- NIS maps. This is
- undesirable as it will create a security risk. These
- users and passwords should not be propagated to all
- machines. Especially if these machines will have users
- whom should not have access to those accounts.
-
-
-
- Keep the NIS master and
- slave secure, and minimize their downtime.
- If somebody either hacks or simply turns off these
- machines, they have effectively rendered many people
- without the ability to login to the lab.
-
- This is the chief weakness of any centralized
- administration system. If the NIS
- servers are not protected, there will be a lot of angry
- users and unhappy management!
-
-
-
-
-
- NIS v1 Compatibility
-
- &os;'s ypserv has some support
- for serving NIS v1 clients. &os;'s
- NIS implementation only uses the
- NIS v2 protocol; however, other
- implementations include support for the v1 protocol for
- backwards compatibility with older systems. The
- ypbind daemons supplied with these
- systems will attempt to establish a binding to an
- NISv1 server even though they may never
- actually need it (and they may persist in broadcasting in
- search of one even after they receive a response from a v2
- server). Note that while support for normal client calls is
- provided, this version of
- ypserv does not handle v1 map
- transfer requests. Additionally, it cannot be used as a
- master or slave in conjunction with older
- NIS servers that only support the v1
- protocol. Fortunately, there probably are not any such
- servers still in use today.
-
-
- Password FormatsNISpassword formats
- One of the most common issues that people run into when
- trying to implement NIS is password format
- compatibility. If the NIS server is using
- DES encrypted passwords, it will only support clients that are
- also using DES. For example, if any &solaris;
- NIS clients exist on the network, there is
- a highly likelihood DES must be used for encrypted
- passwords.
-
- To check which format the servers and clients are using,
- look at /etc/login.conf. If the host is
- configured to use DES encrypted passwords, then the
- default class will contain an entry like
- this:
+ NIS requires that all hosts within an
+ NIS domain use the same format for encrypting passwords.
+ If users have trouble authenticating on an
+ NIS client, it may be due to a differing password format.
+ In a heterogeneous network, the format must be supported by all operating systems, where
+ DES
+ is the lowest common standard.
+
+ To check which format a server or client is using,
+ look at this section of /etc/login.conf:default:\
:passwd_format=des:\
:copyright=/etc/COPYRIGHT:\
[Further entries elided]
- Other possible values for the
- passwd_format capability include
- blf and md5 (for
- Blowfish and MD5 encrypted passwords, respectively).
-
- If any changes were made to
- /etc/login.conf, the login capability
- database must be rebuilt by running the following command as
- root:
+ In this example, the system is using the DES
+ format. Other possible values are
+ blf for Blowfish and md5 for
+ MD5 encrypted passwords.
+
+ If the format on a host needs to be edited to match the one
+ being used in the NIS domain,
+ the login capability
+ database must be rebuilt after saving the change:&prompt.root; cap_mkdb /etc/login.conf
- The format of passwords already in
- /etc/master.passwd will not be updated
- until a user changes his password for the first time
+ The format of passwords for existing user accounts will not be updated
+ until each user changes their password
after the login capability database is
rebuilt.
-
- Next, in order to ensure that passwords are encrypted with
- the chosen format, check that the
- crypt_default in
- /etc/auth.conf gives precedence to the
- chosen password format. To do this, place the chosen format
- first in the list. For example, when using DES encrypted
- passwords, the entry would be:
-
- crypt_default = des blf md5
-
- Having followed the above steps on each of the &os; based
- NIS servers and clients, verify that they
- all agree on which password format is used within the network.
- If users have trouble authenticating on an
- NIS client, this is a pretty good place to
- start looking for possible problems. Remember: to deploy an
- NIS server for a heterogeneous network,
- they will probably have to use DES on all systems because it
- is the lowest common standard.
From owner-svn-doc-head@FreeBSD.ORG Wed Oct 16 16:57:39 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 7070DA06;
Wed, 16 Oct 2013 16:57:39 +0000 (UTC) (envelope-from gjb@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 5E0BF2BFB;
Wed, 16 Oct 2013 16:57:39 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9GGvdr6043111;
Wed, 16 Oct 2013 16:57:39 GMT (envelope-from gjb@svn.freebsd.org)
Received: (from gjb@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9GGvdKh043110;
Wed, 16 Oct 2013 16:57:39 GMT (envelope-from gjb@svn.freebsd.org)
Message-Id: <201310161657.r9GGvdKh043110@svn.freebsd.org>
From: Glen Barber
Date: Wed, 16 Oct 2013 16:57:39 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42974 - head/share/xml
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Wed, 16 Oct 2013 16:57:39 -0000
Author: gjb
Date: Wed Oct 16 16:57:38 2013
New Revision: 42974
URL: http://svnweb.freebsd.org/changeset/doc/42974
Log:
It's not 10, it's 1 louder.
Submitted by: ryusuke
Modified:
head/share/xml/release.ent
Modified: head/share/xml/release.ent
==============================================================================
--- head/share/xml/release.ent Wed Oct 16 16:32:58 2013 (r42973)
+++ head/share/xml/release.ent Wed Oct 16 16:57:38 2013 (r42974)
@@ -22,7 +22,7 @@
rel2.* and u.rel2.* for the "conservative users" version.
-->
-
+
- Make sure that extra line
- is placed after
- +@IT_EMP:::::::::. Otherwise, all user
- accounts imported from NIS will have
- /sbin/nologin as their login
- shell and noone will be able to login to the system.
-
- To configure the less important servers,
- replace the old +:::::::::
- on the servers with these lines:
+ Make sure that extra line is placed
+ after
+ +@IT_EMP:::::::::. Otherwise, all user
+ accounts imported from NIS will have
+ /sbin/nologin as their login
+ shell and noone will be able to login to the system.
+
+ To configure the less important servers, replace the old
+ +::::::::: on the servers with these
+ lines:+@IT_EMP:::::::::
+@IT_APP:::::::::
@@ -2117,18 +2114,18 @@ ellington&prompt.user; ypcat
+@USERS:::::::::
+:::::::::/sbin/nologin
- NIS supports the creation of netgroups from other netgroups which
- can be useful if the policy regarding user access changes. One possibility is
- the creation of role-based netgroups. For example, one might
- create a netgroup called BIGSRV to define
- the login restrictions for the important servers, another
- netgroup called SMALLSRV for the less
- important servers, and a third netgroup called
- USERBOX for the workstations. Each
- of these netgroups contains the netgroups that are allowed to
- login onto these machines. The new entries for the
- NIS netgroup map would look like
- this:
+ NIS supports the creation of netgroups from other
+ netgroups which can be useful if the policy regarding user
+ access changes. One possibility is the creation of role-based
+ netgroups. For example, one might create a netgroup called
+ BIGSRV to define the login restrictions for
+ the important servers, another netgroup called
+ SMALLSRV for the less important servers,
+ and a third netgroup called USERBOX for the
+ workstations. Each of these netgroups contains the netgroups
+ that are allowed to login onto these machines. The new
+ entries for the NIS
+ netgroup map would look like this:BIGSRV IT_EMP IT_APP
SMALLSRV IT_EMP IT_APP ITINTERN
@@ -2142,9 +2139,9 @@ USERBOX IT_EMP ITINTERN USERS
Machine-specific netgroup definitions are another
- possibility to deal with the policy changes. In
- this scenario, the /etc/master.passwd of
- each system contains two lines starting with +.
+ possibility to deal with the policy changes. In this
+ scenario, the /etc/master.passwd of each
+ system contains two lines starting with +.
The first line adds a netgroup with the accounts allowed to
login onto this machine and the second line adds all other
accounts with /sbin/nologin as shell. It
@@ -2210,39 +2207,40 @@ TWO (,hotel,test-domain)
NIS
- password formats
+ password formatsNIS requires that all hosts within an
- NIS domain use the same format for encrypting passwords.
- If users have trouble authenticating on an
- NIS client, it may be due to a differing password format.
- In a heterogeneous network, the format must be supported by all operating systems, where
- DES
- is the lowest common standard.
-
- To check which format a server or client is using,
- look at this section of /etc/login.conf:
+ NIS domain use the same format for
+ encrypting passwords. If users have trouble authenticating on
+ an NIS client, it may be due to a differing
+ password format. In a heterogeneous network, the format must
+ be supported by all operating systems, where
+ DES is the lowest common standard.
+
+ To check which format a server or client is using, look
+ at this section of
+ /etc/login.conf:default:\
:passwd_format=des:\
:copyright=/etc/COPYRIGHT:\
[Further entries elided]
- In this example, the system is using the DES
- format. Other possible values are
- blf for Blowfish and md5 for
- MD5 encrypted passwords.
-
- If the format on a host needs to be edited to match the one
- being used in the NIS domain,
- the login capability
- database must be rebuilt after saving the change:
+ In this example, the system is using the
+ DES format. Other possible values are
+ blf for Blowfish and md5
+ for MD5 encrypted passwords.
+
+ If the format on a host needs to be edited to match the
+ one being used in the NIS domain, the
+ login capability database must be rebuilt after saving the
+ change:&prompt.root; cap_mkdb /etc/login.conf
- The format of passwords for existing user accounts will not be updated
- until each user changes their password
+ The format of passwords for existing user accounts will
+ not be updated until each user changes their password
after the login capability database is
rebuilt.
@@ -3073,7 +3071,7 @@ dhcpd_ifaces="dc0"
separate network. If this functionality is required,
then install the
net/isc-dhcp42-relay
- port. The port installs &man.dhcrelay.8;, which
+ port. The port installs &man.dhcrelay.8;, which
provides more detail.
From owner-svn-doc-head@FreeBSD.ORG Wed Oct 16 19:40:27 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id CEA277EC;
Wed, 16 Oct 2013 19:40:27 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id BAFBE25E8;
Wed, 16 Oct 2013 19:40:27 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9GJeR30028424;
Wed, 16 Oct 2013 19:40:27 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9GJeRNv028423;
Wed, 16 Oct 2013 19:40:27 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201310161940.r9GJeRNv028423@svn.freebsd.org>
From: Dru Lavigne
Date: Wed, 16 Oct 2013 19:40:27 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42976 -
head/en_US.ISO8859-1/books/handbook/network-servers
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Wed, 16 Oct 2013 19:40:27 -0000
Author: dru
Date: Wed Oct 16 19:40:27 2013
New Revision: 42976
URL: http://svnweb.freebsd.org/changeset/doc/42976
Log:
Initial shuffle of the DHCP section. This patch does the following:
- fixes acronym tags for DHCP, IP, and UDP
- removes superfluous headings
- shuffles existing content to organize it into a client section and a server section
- replaces deprecated dhcp.org address
Subsequent patches will clean up the white space and then move on to review and clarify the content in this section.
Modified:
head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Wed Oct 16 18:17:33 2013 (r42975)
+++ head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Wed Oct 16 19:40:27 2013 (r42976)
@@ -200,7 +200,7 @@
inetd_flags is set to
-wW -C 60, which turns on TCP wrapping for
inetd's services, and prevents any
- single IP address from requesting any service more than 60
+ single IP address from requesting any service more than 60
times in any given minute.
Although we mention rate-limiting options below, novice
@@ -227,7 +227,7 @@
Specify the default maximum number of times a
- service can be invoked from a single IP address in one
+ service can be invoked from a single IP address in one
minute; the default is unlimited. May be overridden on
a per-service basis with the
@@ -250,7 +250,7 @@
Specify the maximum number of times a service can be
- invoked from a single IP address at any one time; the
+ invoked from a single IP address at any one time; the
default is unlimited. May be overridden on a
per-service basis with the
parameter.
@@ -347,7 +347,7 @@ server-program-arguments
udp, udp4
- UDP IPv4
+ UDP IPv4
@@ -357,7 +357,7 @@ server-program-arguments
udp6
- UDP IPv6
+ UDP IPv6
@@ -367,7 +367,7 @@ server-program-arguments
udp46
- Both UDP IPv4 and v6
+ Both UDP IPv4 and v6
@@ -403,12 +403,12 @@ server-program-argumentsmax-connections-per-ip-per-minute
- limits the number of connections from any particular IP
+ limits the number of connections from any particular IP
address per minutes, e.g., a value of ten would limit
- any particular IP address connecting to a particular
+ any particular IP address connecting to a particular
service to ten attempts per minute.
limits the number of
- children that can be started on behalf on any single IP
+ children that can be started on behalf on any single IP
address at any moment. These options are useful to
prevent intentional or unintentional excessive resource
consumption and Denial of Service (DoS) attacks to a
@@ -430,7 +430,7 @@ server-program-argumentsnowait/10.The same setup with a limit of twenty connections
- per IP address per minute and a maximum total limit of
+ per IP address per minute and a maximum total limit of
ten child daemons would read:
nowait/10/20.
@@ -442,7 +442,7 @@ server-program-argumentsFinally, an example of this field with a maximum of
100 children in total, with a maximum of 5 for any one
- IP address would read:
+ IP address would read:
nowait/100/0/5.
@@ -723,7 +723,7 @@ mountd_flags="-r"
The next example exports
/home to three clients
- by IP address. This can be useful for networks without
+ by IP address. This can be useful for networks without
DNS. Optionally,
/etc/hosts could be configured for
internal hostnames; please review &man.hosts.5; for more
@@ -953,7 +953,7 @@ rpc_statd_enable="YES"
amd looks up the corresponding
remote mount and automatically mounts it.
/net is used to mount
- an exported file system from an IP address, while
+ an exported file system from an IP address, while
/host is used to mount
an export from a remote hostname.
@@ -1251,7 +1251,7 @@ Exports list on foobar:
Machine name
- IP address
+ IP addressMachine role
@@ -1768,7 +1768,7 @@ nis_client_enable="YES"
for providing access control instead of
securenets. While either access control
mechanism adds some security, they are both vulnerable to
- IP spoofing attacks. All
+ IP spoofing attacks. All
NIS-related traffic should be blocked at
the firewall.
@@ -2617,92 +2617,55 @@ result: 0 Success
-->
- Automatic Network Configuration (DHCP)
+ Dynamic Host Configuration Protocol (DHCP)Dynamic Host Configuration Protocol
- DHCP
+ DHCPInternet Systems Consortium (ISC)
- DHCP, the Dynamic Host Configuration Protocol, describes
- the means by which a system can connect to a network and
- obtain the necessary information for communication upon that
- network. &os; uses the OpenBSD dhclient
- taken from OpenBSD 3.7. All information here regarding
- dhclient is for use with either of the ISC
- or OpenBSD DHCP clients. The DHCP server is the one included
- in the ISC distribution.
-
- This section describes both the client-side components of
- the ISC and OpenBSD DHCP client and server-side components of
- the ISC DHCP system. The client-side program,
- dhclient, comes integrated within &os;,
- and the server-side portion is available from the net/isc-dhcp42-server port. Refer to
- &man.dhclient.8;, &man.dhcp-options.5;, and
- &man.dhclient.conf.5;, in addition to the
- references below, for more information.
-
-
- How It Works
-
- UDP
- When dhclient, the DHCP client, is
- executed on the client machine, it begins broadcasting
- requests for configuration information. By default, these
- requests are on UDP port 68. The server replies on UDP 67,
- giving the client an IP address and other relevant network
- information such as netmask, router, and DNS servers. All of
- this information comes in the form of a DHCP
- lease and is only valid for a certain time
- (configured by the DHCP server maintainer). In this manner,
- stale IP addresses for clients no longer connected to the
- network can be automatically reclaimed.
-
- DHCP clients can obtain a great deal of information from
- the server. An exhaustive list may be found in
- &man.dhcp-options.5;.
-
-
-
- &os; Integration
-
- &os; fully integrates the OpenBSD DHCP client,
- dhclient. DHCP client support is provided
- within both the installer and the base system, obviating the
- need for detailed knowledge of network configurations on any
- network that runs a DHCP server.
-
-
- sysinstall
-
+ The Dynamic Host Configuration Protocol (DHCP) allows
+ a system to connect to a network in order to be assigned
+ the necessary addressing information for communication on that
+ network. &os; includes the OpenBSD version of dhclient
+ which is used by the client to obtain the addressing information.
+ &os; does not install a DHCP server, but several
+ servers are available in the &os; Ports Collection.
+ The DHCP protocol is fully described in
+ RFC
+ 2131. Informational resources are also available at
+ isc.org/downloads/dhcp/.
+
+ This section describes how to use the built-in DHCP client.
+ It then describes how to install and configure a
+ DHCP server.
- DHCP is supported by
- sysinstall. When configuring a
- network interface within
- sysinstall, the second question
- asked is: Do you want to try DHCP configuration of the
- interface?. Answering affirmatively will execute
- dhclient, and if successful, will fill in
- the network configuration information automatically.
+
+ Configuring a DHCP Client
- There are two things required to have the system use
- DHCP upon startup:
-
- DHCP
- requirements
-
-
-
- Make sure that the bpf device
- is compiled into the kernel. To do this, add
- device bpf to the kernel configuration
- file, and rebuild the kernel. For more information about
- building kernels, see
- .
+ DHCP client support is included in the &os;
+ installer, making it easy to configure a system to automatically
+ receive its networking addressing information from an existing
+ DHCP server.
+
+ UDP
+ When dhclient is
+ executed on the client machine, it begins broadcasting
+ requests for configuration information. By default, these
+ requests use UDP port 68. The server replies on UDP port 67,
+ giving the client an IP address and other relevant network
+ information such as a subnet mask, default gateway, and DNS server addresses.
+ This information is in the form of a DHCP
+ lease and is valid for a configurable time. This allows
+ stale IP addresses for clients no longer connected to the
+ network to automatically be reused.
+
+ DHCP clients can obtain a great deal of information from
+ the server. An exhaustive list may be found in
+ &man.dhcp-options.5;.The bpf device is already
part of the GENERIC kernel that is
@@ -2719,37 +2682,35 @@ result: 0 Success
(although they still have to be run as
root).
bpfis
- required to use DHCP; however, the security sensitive
+ required to use DHCP; however, the security sensitive
types should probably not add
bpf to the kernel in the
expectation that at some point in the future the system
- will be using DHCP.
+ will be using DHCP.
-
-
- By default, DHCP configuration on &os; runs in the
+ By default, DHCP configuration on &os; runs in the
background, or asynchronously.
- Other startup scripts continue to run while DHCP
+ Other startup scripts continue to run while DHCP
completes, speeding up system startup.
- Background DHCP works well when the DHCP server
- responds quickly to requests and the DHCP configuration
- process goes quickly. However, DHCP may take a long time
+ Background DHCP works well when the DHCP server
+ responds quickly to requests and the DHCP configuration
+ process goes quickly. However, DHCP may take a long time
to complete on some systems. If network services attempt
- to run before DHCP has completed, they will fail. Using
- DHCP in synchronous mode prevents
- the problem, pausing startup until DHCP configuration has
+ to run before DHCP has completed, they will fail. Using
+ DHCP in synchronous mode prevents
+ the problem, pausing startup until DHCP configuration has
completed.
- To connect to a DHCP server in the background while
+ To connect to a DHCP server in the background while
other startup continues (asynchronous mode), use the
DHCP value in
/etc/rc.conf:ifconfig_fxp0="DHCP"
- To pause startup while DHCP completes, use
+ To pause startup while DHCP completes, use
synchronous mode with the
SYNCDHCP value:
@@ -2769,27 +2730,14 @@ result: 0 Success
dhclient_program="/sbin/dhclient"
dhclient_flags=""
-
-
- DHCP
- server
+ DHCP
+ configuration files
- The DHCP server, dhcpd, is
- included as part of the
- net/isc-dhcp42-server port
- in the ports collection. This port contains the ISC DHCP
- server and documentation.
-
-
- Files
+ The DHCP client uses the following files:
-
- DHCP
- configuration files
- /etc/dhclient.conf
@@ -2812,7 +2760,7 @@ dhclient_flags=""
/sbin/dhclient-scriptdhclient-script is the
- &os;-specific DHCP client configuration script. It
+ &os;-specific DHCP client configuration script. It
is described in &man.dhclient-script.8;, but should not
need any user modification to function properly.
@@ -2820,50 +2768,47 @@ dhclient_flags=""
/var/db/dhclient.leases.interface
- The DHCP client keeps a database of valid leases in
+ The DHCP client keeps a database of valid leases in
this file, which is written as a log.
&man.dhclient.leases.5; gives a slightly longer
- description.
+ description. Refer to
+ &man.dhclient.8;, &man.dhcp-options.5;, and
+ &man.dhclient.conf.5;, in addition to the
+ references below, for more information.
-
- Further Reading
-
- The DHCP protocol is fully described in
- RFC
- 2131. An informational resource has also been set
- up at .
-
-
- Installing and Configuring a DHCP Server
-
-
- What This Section Covers
+ Installing and Configuring a DHCP ServerThis section provides information on how to configure a
- &os; system to act as a DHCP server using the ISC
- (Internet Systems Consortium) implementation of the DHCP
+ &os; system to act as a DHCP server using the ISC
+ (Internet Systems Consortium) implementation of the DHCP
server.
+
+ DHCP
+ server
+
+
+ The DHCP server, dhcpd, is
+ included as part of the
+ net/isc-dhcp42-server port
+ in the ports collection. This port contains the ISC DHCP
+ server and documentation.The server is not provided as part of &os;, and so the
net/isc-dhcp42-server
port must be installed to provide this service. See
for more information on using the
Ports Collection.
-
-
-
- DHCP Server Installation
- DHCP
+ DHCPinstallation
- In order to configure the &os; system as a DHCP server,
+ In order to configure the &os; system as a DHCP server,
first ensure that the &man.bpf.4; device is compiled into
the kernel. To do this, add device bpf
to the kernel configuration file, and rebuild the kernel.
@@ -2881,7 +2826,7 @@ dhclient_flags=""
that allows packet sniffers to function correctly
(although such programs still need privileged access).
The bpf device
- is required to use DHCP, but if the
+ is required to use DHCP, but if the
sensitivity of the system's security is high, this device
should not be included in the kernel purely because the
use of DHCP may, at some point in the
@@ -2895,13 +2840,12 @@ dhclient_flags=""
to the actual configuration file,
/usr/local/etc/dhcpd.conf. Edits
will be made to this new file.
-
- Configuring the DHCP Server
+ Configuring the DHCP Server
- DHCP
+ DHCPdhcpd.confdhcpd.conf is comprised of
@@ -2936,7 +2880,7 @@ host mailhost {
This option specifies a comma separated list of
- DNS servers that the client should use.
+ DNS servers that the client should use.
@@ -2960,15 +2904,15 @@ host mailhost {
- This option specifies whether the DHCP server
- should attempt to update DNS when a lease is accepted
+ This option specifies whether the DHCP server
+ should attempt to update DNS when a lease is accepted
or released. In the ISC implementation, this option
is required.
- This denotes which IP addresses should be used in
- the pool reserved for allocating to clients. IP
+ This denotes which IP addresses should be used in
+ the pool reserved for allocating to clients. IP
addresses between, and including, the ones stated are
handed out to clients.
@@ -2980,14 +2924,14 @@ host mailhost {
The hardware MAC address of a host (so that the
- DHCP server can recognize a host when it makes a
+ DHCP server can recognize a host when it makes a
request).Specifies that the host should always be given the
- same IP address. Note that using a hostname is
- correct here, since the DHCP server will resolve the
+ same IP address. Note that using a hostname is
+ correct here, since the DHCP server will resolve the
hostname itself before returning the lease
information.
@@ -2995,7 +2939,7 @@ host mailhost {
Once the configuration of
dhcpd.conf has been completed,
- enable the DHCP server in
+ enable the DHCP server in
/etc/rc.conf, i.e., by adding:dhcpd_enable="YES"
@@ -3003,7 +2947,7 @@ dhcpd_ifaces="dc0"Replace the dc0 interface name with
the interface (or interfaces, separated by whitespace)
- that the DHCP server should listen on for DHCP client
+ that the DHCP server should listen on for DHCP client
requests.Proceed to start the server by issuing
@@ -3023,7 +2967,7 @@ dhcpd_ifaces="dc0"
Files
- DHCP
+ DHCPconfiguration files
@@ -3056,7 +3000,7 @@ dhcpd_ifaces="dc0"
/var/db/dhcpd.leases
- The DHCP server keeps a database of leases it has
+ The DHCP server keeps a database of leases it has
issued in this file, which is written as a log. The
port installs &man.dhcpd.leases.5;, which gives a
slightly longer description.
@@ -3066,8 +3010,8 @@ dhcpd_ifaces="dc0"
/usr/local/sbin/dhcrelaydhcrelay is used in
- advanced environments where one DHCP server forwards a
- request from a client to another DHCP server on a
+ advanced environments where one DHCP server forwards a
+ request from a client to another DHCP server on a
separate network. If this functionality is required,
then install the
net/isc-dhcp42-relay
@@ -3150,7 +3094,7 @@ dhcpd_ifaces="dc0"
DNS must be understood.resolver
- reverse DNS
+ reverse DNSroot zone
@@ -3168,7 +3112,7 @@ dhcpd_ifaces="dc0"
Forward DNS
- Mapping of hostnames to IP addresses.
+ Mapping of hostnames to IP addresses.
@@ -3492,7 +3436,7 @@ options {
/*
- Modern versions of BIND use a random UDP port for each outgoing
+ Modern versions of BIND use a random UDP port for each outgoing
query by default in order to dramatically reduce the possibility
of cache poisoning. All users are strongly encouraged to utilize
this feature, and to configure their firewalls to accommodate it.
@@ -3817,11 +3761,11 @@ www IN CNAME example.
recordname IN recordtype value
- DNS
+ DNSrecords
- The most commonly used DNS records:
+ The most commonly used DNS records:
@@ -3861,7 +3805,7 @@ www IN CNAME example.
a domain name pointer (used in reverse
- DNS)
+ DNS)
@@ -3940,7 +3884,7 @@ mail IN A 192.168.
IN A 192.168.1.1
- This line assigns IP address
+ This line assigns IP address
192.168.1.1 to the current
origin, in this case
example.org.
@@ -3975,7 +3919,7 @@ mail IN A 192.168.
priority number), then the second highest, etc, until the
mail can be properly delivered.
- For in-addr.arpa zone files (reverse DNS), the same
+ For in-addr.arpa zone files (reverse DNS), the same
format is used, except with PTR entries instead of A or
CNAME.
@@ -3997,7 +3941,7 @@ mail IN A 192.168.
4 IN PTR mx.example.org.
5 IN PTR mail.example.org.
- This file gives the proper IP address to hostname
+ This file gives the proper IP address to hostname
mappings for the above fictitious domain.It is worth noting that all names on the right side
@@ -4026,7 +3970,7 @@ mail IN A 192.168.
BIND
- DNS security extensions
+ DNS security extensionsDomain Name System Security Extensions, or
Security
- Although BIND is the most common implementation of DNS,
+ Although BIND is the most common implementation of DNS,
there is always the issue of security. Possible and
exploitable security holes are sometimes found.
@@ -4437,7 +4381,7 @@ $include Kexample.com.+005+nnnnn.ZSK.key
O'Reilly
- DNS and BIND 5th Edition
+ DNS and BIND 5th Edition
@@ -4469,21 +4413,21 @@ $include Kexample.com.+005+nnnnn.ZSK.key
RFC4033
- - DNS Security Introduction and
+ - DNS Security Introduction and
RequirementsRFC4034
- - Resource Records for the DNS Security
+ - Resource Records for the DNS Security
ExtensionsRFC4035
- - Protocol Modifications for the DNS Security
+ - Protocol Modifications for the DNS Security
Extensions
@@ -4496,7 +4440,7 @@ $include Kexample.com.+005+nnnnn.ZSK.key
RFC 5011
- - Automated Updates of DNS Security
+ - Automated Updates of DNS Security
(DNSSEC
Trust Anchors
@@ -4686,7 +4630,7 @@ $include Kexample.com.+005+nnnnn.ZSK.key
types of Virtual Hosting. The first method is Name-based
Virtual Hosting. Name-based virtual hosting uses the clients
HTTP/1.1 headers to figure out the hostname. This allows many
- different domains to share the same IP address.
+ different domains to share the same IP address.To setup Apache to use
Name-based Virtual Hosting add an entry like the following to
@@ -5252,7 +5196,7 @@ DocumentRoot /www/someotherdomain.tld
This sets the NetBIOS name by which a
Samba server is known.
By default it is the same as the first component of
- the host's DNS name.
+ the host's DNS name.
@@ -5580,7 +5524,7 @@ driftfile /var/db/ntp.driftrestrict 192.168.1.0 mask 255.255.255.0 nomodify notrap
instead, where
- 192.168.1.0 is an IP address
+ 192.168.1.0 is an IP address
on the network and
255.255.255.0 is the
network's netmask.
@@ -6207,7 +6151,7 @@ iqn.2012-06.com.example:target0
iqn.2012-06.com.example:target0 10.10.10.10 Waiting for iscsid(8)
The following suggests network-level problem, such as
- wrong IP address or port:
+ wrong IP address or port:Target name Target addr State
iqn.2012-06.com.example:target0 10.10.10.11 Connection refused
From owner-svn-doc-head@FreeBSD.ORG Wed Oct 16 20:19:56 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id E409D8F5;
Wed, 16 Oct 2013 20:19:56 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id CD8B22824;
Wed, 16 Oct 2013 20:19:56 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9GKJu24049617;
Wed, 16 Oct 2013 20:19:56 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9GKJuMq049616;
Wed, 16 Oct 2013 20:19:56 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201310162019.r9GKJuMq049616@svn.freebsd.org>
From: Dru Lavigne
Date: Wed, 16 Oct 2013 20:19:56 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42977 -
head/en_US.ISO8859-1/books/handbook/network-servers
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Wed, 16 Oct 2013 20:19:57 -0000
Author: dru
Date: Wed Oct 16 20:19:56 2013
New Revision: 42977
URL: http://svnweb.freebsd.org/changeset/doc/42977
Log:
White space fix only. Translators can ignore.
Modified:
head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Wed Oct 16 19:40:27 2013 (r42976)
+++ head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Wed Oct 16 20:19:56 2013 (r42977)
@@ -200,8 +200,8 @@
inetd_flags is set to
-wW -C 60, which turns on TCP wrapping for
inetd's services, and prevents any
- single IP address from requesting any service more than 60
- times in any given minute.
+ single IP address from requesting any
+ service more than 60 times in any given minute.
Although we mention rate-limiting options below, novice
users may be pleased to note that these parameters usually do
@@ -227,9 +227,10 @@
Specify the default maximum number of times a
- service can be invoked from a single IP address in one
- minute; the default is unlimited. May be overridden on
- a per-service basis with the
+ service can be invoked from a single
+ IP address in one minute; the default
+ is unlimited. May be overridden on a per-service basis
+ with the
parameter.
@@ -250,9 +251,9 @@
Specify the maximum number of times a service can be
- invoked from a single IP address at any one time; the
- default is unlimited. May be overridden on a
- per-service basis with the
+ invoked from a single IP address at
+ any one time; the default is unlimited. May be
+ overridden on a per-service basis with the
parameter.
@@ -403,14 +404,15 @@ server-program-argumentsmax-connections-per-ip-per-minute
- limits the number of connections from any particular IP
- address per minutes, e.g., a value of ten would limit
- any particular IP address connecting to a particular
- service to ten attempts per minute.
- limits the number of
- children that can be started on behalf on any single IP
- address at any moment. These options are useful to
- prevent intentional or unintentional excessive resource
+ limits the number of connections from any particular
+ IP address per minutes, e.g., a value
+ of ten would limit any particular IP
+ address connecting to a particular service to ten
+ attempts per minute.
+ limits the number of children that can be started on
+ behalf on any single IP address at
+ any moment. These options are useful to prevent
+ intentional or unintentional excessive resource
consumption and Denial of Service (DoS) attacks to a
machine.
@@ -430,8 +432,8 @@ server-program-argumentsnowait/10.
The same setup with a limit of twenty connections
- per IP address per minute and a maximum total limit of
- ten child daemons would read:
+ per IP address per minute and a
+ maximum total limit of ten child daemons would read:
nowait/10/20.These options are utilized by the default
@@ -723,8 +725,8 @@ mountd_flags="-r"
The next example exports
/home to three clients
- by IP address. This can be useful for networks without
- DNS. Optionally,
+ by IP address. This can be useful for
+ networks without DNS. Optionally,
/etc/hosts could be configured for
internal hostnames; please review &man.hosts.5; for more
information. The -alldirs flag allows
@@ -951,11 +953,11 @@ rpc_statd_enable="YES"
/net directories. When
a file is accessed within one of these directories,
amd looks up the corresponding
- remote mount and automatically mounts it.
- /net is used to mount
- an exported file system from an IP address, while
- /host is used to mount
- an export from a remote hostname.
+ remote mount and automatically mounts it. /net is used to mount an
+ exported file system from an IP address,
+ while /host is used to
+ mount an export from a remote hostname.For instance, an attempt to access a file within
/host/foobar/usr would
@@ -2617,7 +2619,8 @@ result: 0 Success
-->
- Dynamic Host Configuration Protocol (DHCP)
+ Dynamic Host Configuration Protocol
+ (DHCP)Dynamic Host Configuration Protocol
@@ -2627,108 +2630,115 @@ result: 0 Success
Internet Systems Consortium (ISC)
- The Dynamic Host Configuration Protocol (DHCP) allows
- a system to connect to a network in order to be assigned
- the necessary addressing information for communication on that
- network. &os; includes the OpenBSD version of dhclient
- which is used by the client to obtain the addressing information.
- &os; does not install a DHCP server, but several
- servers are available in the &os; Ports Collection.
- The DHCP protocol is fully described in
- RFC
- 2131. Informational resources are also available at
- isc.org/downloads/dhcp/.
-
- This section describes how to use the built-in DHCP client.
- It then describes how to install and configure a
- DHCP server.
+ The Dynamic Host Configuration Protocol
+ (DHCP) allows a system to connect to a
+ network in order to be assigned the necessary addressing
+ information for communication on that network. &os; includes
+ the OpenBSD version of dhclient which is used
+ by the client to obtain the addressing information. &os; does
+ not install a DHCP server, but several
+ servers are available in the &os; Ports Collection. The
+ DHCP protocol is fully described in RFC 2131.
+ Informational resources are also available at isc.org/downloads/dhcp/.
+
+ This section describes how to use the built-in
+ DHCP client. It then describes how to
+ install and configure a DHCP server.
-
- Configuring a DHCP Client
+
+ Configuring a DHCP Client
- DHCP client support is included in the &os;
- installer, making it easy to configure a system to automatically
- receive its networking addressing information from an existing
- DHCP server.
-
- UDP
- When dhclient is
- executed on the client machine, it begins broadcasting
- requests for configuration information. By default, these
- requests use UDP port 68. The server replies on UDP port 67,
- giving the client an IP address and other relevant network
- information such as a subnet mask, default gateway, and DNS server addresses.
- This information is in the form of a DHCP
- lease and is valid for a configurable time. This allows
- stale IP addresses for clients no longer connected to the
- network to automatically be reused.
-
- DHCP clients can obtain a great deal of information from
- the server. An exhaustive list may be found in
- &man.dhcp-options.5;.
-
- The bpf device is already
- part of the GENERIC kernel that is
- supplied with &os;, thus there is no need to build a
- custom kernel for DHCP. In the case of
- a custom kernel configuration file, this device must be
- present for DHCP to function
- properly.
+ DHCP client support is included in the
+ &os; installer, making it easy to configure a system to
+ automatically receive its networking addressing information
+ from an existing DHCP server.
+
+ UDP
+ When dhclient is executed on the client
+ machine, it begins broadcasting requests for configuration
+ information. By default, these requests use
+ UDP port 68. The server replies on
+ UDP port 67, giving the client an
+ IP address and other relevant network
+ information such as a subnet mask, default gateway, and
+ DNS server addresses. This information is
+ in the form of a DHCP
+ lease and is valid for a configurable time.
+ This allows stale IP addresses for clients
+ no longer connected to the network to automatically be
+ reused.
+
+ DHCP clients can obtain a great deal of
+ information from the server. An exhaustive list may be found
+ in &man.dhcp-options.5;.
+
+ The bpf device is already
+ part of the GENERIC kernel that is
+ supplied with &os;, thus there is no need to build a
+ custom kernel for DHCP. In the case of
+ a custom kernel configuration file, this device must be
+ present for DHCP to function
+ properly.
-
- For those who are particularly security conscious,
- take note that bpf is also the
- device that allows packet sniffers to work correctly
- (although they still have to be run as
- root).
- bpfis
- required to use DHCP; however, the security sensitive
- types should probably not add
- bpf to the kernel in the
- expectation that at some point in the future the system
- will be using DHCP.
-
+
+ For those who are particularly security conscious,
+ take note that bpf is also the
+ device that allows packet sniffers to work correctly
+ (although they still have to be run as
+ root).
+ bpfis
+ required to use DHCP; however, the
+ security sensitive types should probably not add
+ bpf to the kernel in the
+ expectation that at some point in the future the system
+ will be using DHCP.
+
- By default, DHCP configuration on &os; runs in the
- background, or asynchronously.
- Other startup scripts continue to run while DHCP
- completes, speeding up system startup.
-
- Background DHCP works well when the DHCP server
- responds quickly to requests and the DHCP configuration
- process goes quickly. However, DHCP may take a long time
- to complete on some systems. If network services attempt
- to run before DHCP has completed, they will fail. Using
- DHCP in synchronous mode prevents
- the problem, pausing startup until DHCP configuration has
- completed.
-
- To connect to a DHCP server in the background while
- other startup continues (asynchronous mode), use the
- DHCP value in
- /etc/rc.conf:
-
- ifconfig_fxp0="DHCP"
-
- To pause startup while DHCP completes, use
- synchronous mode with the
- SYNCDHCP value:
-
- ifconfig_fxp0="SYNCDHCP"
-
-
- Replace the fxp0 shown
- in these examples with the name of the interface to be
- dynamically configured, as described in
- .
-
+ By default, DHCP configuration on &os;
+ runs in the background, or
+ asynchronously. Other startup scripts
+ continue to run while DHCP completes,
+ speeding up system startup.
+
+ Background DHCP works well when the
+ DHCP server responds quickly to requests
+ and the DHCP configuration process goes
+ quickly. However, DHCP may take a long
+ time to complete on some systems. If network services attempt
+ to run before DHCP has completed, they will
+ fail. Using DHCP in
+ synchronous mode prevents the problem,
+ pausing startup until DHCP configuration
+ has completed.
+
+ To connect to a DHCP server in the
+ background while other startup continues (asynchronous mode),
+ use the DHCP value in
+ /etc/rc.conf:
+
+ ifconfig_fxp0="DHCP"
+
+ To pause startup while DHCP completes,
+ use synchronous mode with the
+ SYNCDHCP value:
+
+ ifconfig_fxp0="SYNCDHCP"
+
+
+ Replace the fxp0 shown
+ in these examples with the name of the interface to be
+ dynamically configured, as described in
+ .
+
- When using a different file system location for
- dhclient, or if additional flags must
- be passed to dhclient, include (editing
- as necessary):
+ When using a different file system location for
+ dhclient, or if additional flags must
+ be passed to dhclient, include (editing
+ as necessary):
- dhclient_program="/sbin/dhclient"
+ dhclient_program="/sbin/dhclient"
dhclient_flags=""
@@ -2736,7 +2746,8 @@ dhclient_flags=""configuration files
- The DHCP client uses the following files:
+ The DHCP client uses the following
+ files:
@@ -2760,86 +2771,90 @@ dhclient_flags=""
/sbin/dhclient-scriptdhclient-script is the
- &os;-specific DHCP client configuration script. It
- is described in &man.dhclient-script.8;, but should not
- need any user modification to function properly.
+ &os;-specific DHCP client configuration
+ script. It is described in &man.dhclient-script.8;, but
+ should not need any user modification to function
+ properly./var/db/dhclient.leases.interface
- The DHCP client keeps a database of valid leases in
- this file, which is written as a log.
+ The DHCP client keeps a database of
+ valid leases in this file, which is written as a log.
&man.dhclient.leases.5; gives a slightly longer
- description. Refer to
- &man.dhclient.8;, &man.dhcp-options.5;, and
- &man.dhclient.conf.5;, in addition to the
- references below, for more information.
+ description. Refer to &man.dhclient.8;,
+ &man.dhcp-options.5;, and &man.dhclient.conf.5;, in
+ addition to the references below, for more
+ information.
- Installing and Configuring a DHCP Server
+ Installing and Configuring a DHCP
+ Server
- This section provides information on how to configure a
- &os; system to act as a DHCP server using the ISC
- (Internet Systems Consortium) implementation of the DHCP
- server.
+ This section provides information on how to configure a
+ &os; system to act as a DHCP server using
+ the ISC (Internet Systems Consortium) implementation of the
+ DHCP server.DHCPserver
- The DHCP server, dhcpd, is
- included as part of the
+ The DHCP server,
+ dhcpd, is included as part of the
net/isc-dhcp42-server port
- in the ports collection. This port contains the ISC DHCP
- server and documentation.
- The server is not provided as part of &os;, and so the
- net/isc-dhcp42-server
- port must be installed to provide this service. See
- for more information on using the
- Ports Collection.
+ in the ports collection. This port contains the ISC
+ DHCP server and documentation.
-
- DHCP
+ The server is not provided as part of &os;, and so the
+ net/isc-dhcp42-server
+ port must be installed to provide this service. See
+ for more information on using the
+ Ports Collection.
+
+
+ DHCPinstallation
-
+
- In order to configure the &os; system as a DHCP server,
- first ensure that the &man.bpf.4; device is compiled into
- the kernel. To do this, add device bpf
- to the kernel configuration file, and rebuild the kernel.
- For more information about building kernels, see
- .
-
- The bpf device is already part
- of the GENERIC kernel that is supplied
- with &os;, so there is no need to create a custom kernel in
- order to get DHCP working.
+ In order to configure the &os; system as a
+ DHCP server, first ensure that the
+ &man.bpf.4; device is compiled into the kernel. To do this,
+ add device bpf to the kernel configuration
+ file, and rebuild the kernel. For more information about
+ building kernels, see .
+
+ The bpf device is already part
+ of the GENERIC kernel that is supplied
+ with &os;, so there is no need to create a custom kernel in
+ order to get DHCP working.
-
- Those who are particularly security conscious should
- note that bpf is also the device
- that allows packet sniffers to function correctly
- (although such programs still need privileged access).
- The bpf device
- is required to use DHCP, but if the
- sensitivity of the system's security is high, this device
- should not be included in the kernel purely because the
- use of DHCP may, at some point in the
- future, be desired.
-
+
+ Those who are particularly security conscious should
+ note that bpf is also the device
+ that allows packet sniffers to function correctly
+ (although such programs still need privileged access).
+ The bpf device
+ is required to use
+ DHCP, but if the sensitivity of the
+ system's security is high, this device should not be
+ included in the kernel purely because the use of
+ DHCP may, at some point in the future, be
+ desired.
+
- An example configuration file is installed by the
- net/isc-dhcp42-server
- port. Copy the example
- /usr/local/etc/dhcpd.conf.example
- to the actual configuration file,
- /usr/local/etc/dhcpd.conf. Edits
- will be made to this new file.
+ An example configuration file is installed by the
+ net/isc-dhcp42-server
+ port. Copy the example
+ /usr/local/etc/dhcpd.conf.example
+ to the actual configuration file,
+ /usr/local/etc/dhcpd.conf. Edits
+ will be made to this new file.Configuring the DHCP Server
@@ -2880,7 +2895,8 @@ host mailhost {
This option specifies a comma separated list of
- DNS servers that the client should use.
+ DNS servers that the client should
+ use.
@@ -2904,17 +2920,19 @@ host mailhost {
- This option specifies whether the DHCP server
- should attempt to update DNS when a lease is accepted
- or released. In the ISC implementation, this option
- is required.
+ This option specifies whether the
+ DHCP server should attempt to update
+ DNS when a lease is accepted or
+ released. In the ISC implementation, this option is
+ required.
- This denotes which IP addresses should be used in
- the pool reserved for allocating to clients. IP
- addresses between, and including, the ones stated are
- handed out to clients.
+ This denotes which IP addresses
+ should be used in the pool reserved for allocating to
+ clients. IP addresses between, and
+ including, the ones stated are handed out to
+ clients.
@@ -2924,14 +2942,15 @@ host mailhost {
The hardware MAC address of a host (so that the
- DHCP server can recognize a host when it makes a
- request).
+ DHCP server can recognize a host when
+ it makes a request).
Specifies that the host should always be given the
- same IP address. Note that using a hostname is
- correct here, since the DHCP server will resolve the
+ same IP address. Note that using a
+ hostname is correct here, since the
+ DHCP server will resolve the
hostname itself before returning the lease
information.
@@ -2947,8 +2966,8 @@ dhcpd_ifaces="dc0"
Replace the dc0 interface name with
the interface (or interfaces, separated by whitespace)
- that the DHCP server should listen on for DHCP client
- requests.
+ that the DHCP server should listen on for
+ DHCP client requests.
Proceed to start the server by issuing
the following command:
@@ -3000,20 +3019,20 @@ dhcpd_ifaces="dc0"
/var/db/dhcpd.leases
- The DHCP server keeps a database of leases it has
- issued in this file, which is written as a log. The
- port installs &man.dhcpd.leases.5;, which gives a
- slightly longer description.
+ The DHCP server keeps a database
+ of leases it has issued in this file, which is written
+ as a log. The port installs &man.dhcpd.leases.5;, which
+ gives a slightly longer description./usr/local/sbin/dhcrelaydhcrelay is used in
- advanced environments where one DHCP server forwards a
- request from a client to another DHCP server on a
- separate network. If this functionality is required,
- then install the
+ advanced environments where one DHCP
+ server forwards a request from a client to another
+ DHCP server on a separate network.
+ If this functionality is required, then install the
net/isc-dhcp42-relay
port. The port installs &man.dhcrelay.8;, which
provides more detail.
@@ -3094,7 +3113,8 @@ dhcpd_ifaces="dc0"
DNS must be understood.
resolver
- reverse DNS
+ reverse
+ DNSroot zone
@@ -3112,7 +3132,8 @@ dhcpd_ifaces="dc0"
Forward DNS
- Mapping of hostnames to IP addresses.
+ Mapping of hostnames to IP
+ addresses.
@@ -3765,7 +3786,8 @@ www IN CNAME example.
records
- The most commonly used DNS records:
+ The most commonly used DNS
+ records:
@@ -3919,9 +3941,9 @@ mail IN A 192.168.
priority number), then the second highest, etc, until the
mail can be properly delivered.
- For in-addr.arpa zone files (reverse DNS), the same
- format is used, except with PTR entries instead of A or
- CNAME.
+ For in-addr.arpa zone files (reverse
+ DNS), the same format is used, except
+ with PTR entries instead of A or CNAME.$TTL 3600
@@ -3941,8 +3963,8 @@ mail IN A 192.168.
4 IN PTR mx.example.org.
5 IN PTR mail.example.org.
- This file gives the proper IP address to hostname
- mappings for the above fictitious domain.
+ This file gives the proper IP address
+ to hostname mappings for the above fictitious domain.It is worth noting that all names on the right side
of a PTR record need to be fully qualified (i.e., end in
@@ -3970,7 +3992,8 @@ mail IN A 192.168.
BIND
- DNS security extensions
+ DNS security
+ extensionsDomain Name System Security Extensions, or
Security
- Although BIND is the most common implementation of DNS,
- there is always the issue of security. Possible and
- exploitable security holes are sometimes found.
+ Although BIND is the most common implementation of
+ DNS, there is always the issue of security.
+ Possible and exploitable security holes are sometimes
+ found.While &os; automatically drops
named into a &man.chroot.8;
@@ -4381,7 +4405,8 @@ $include Kexample.com.+005+nnnnn.ZSK.key
O'Reilly
- DNS and BIND 5th Edition
+ DNS and BIND 5th
+ Edition
@@ -4420,15 +4445,15 @@ $include Kexample.com.+005+nnnnn.ZSK.key
RFC4034
- - Resource Records for the DNS Security
- Extensions
+ - Resource Records for the DNS
+ Security ExtensionsRFC4035
- - Protocol Modifications for the DNS Security
- Extensions
+ - Protocol Modifications for the DNS
+ Security Extensions
@@ -4630,7 +4655,8 @@ $include Kexample.com.+005+nnnnn.ZSK.key
types of Virtual Hosting. The first method is Name-based
Virtual Hosting. Name-based virtual hosting uses the clients
HTTP/1.1 headers to figure out the hostname. This allows many
- different domains to share the same IP address.
+ different domains to share the same IP
+ address.
To setup Apache to use
Name-based Virtual Hosting add an entry like the following to
@@ -5524,8 +5550,8 @@ driftfile /var/db/ntp.driftrestrict 192.168.1.0 mask 255.255.255.0 nomodify notrap
instead, where
- 192.168.1.0 is an IP address
- on the network and
+ 192.168.1.0 is an
+ IP address on the network and
255.255.255.0 is the
network's netmask.
From owner-svn-doc-head@FreeBSD.ORG Wed Oct 16 23:41:27 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
[IPv6:2001:1900:2254:206a::19:1])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 4F44F845;
Wed, 16 Oct 2013 23:41:27 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 2DE2D22EA;
Wed, 16 Oct 2013 23:41:27 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9GNfR1U059458;
Wed, 16 Oct 2013 23:41:27 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9GNfREq059457;
Wed, 16 Oct 2013 23:41:27 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201310162341.r9GNfREq059457@svn.freebsd.org>
From: Dru Lavigne
Date: Wed, 16 Oct 2013 23:41:27 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42978 -
head/en_US.ISO8859-1/books/handbook/network-servers
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Wed, 16 Oct 2013 23:41:27 -0000
Author: dru
Date: Wed Oct 16 23:41:26 2013
New Revision: 42978
URL: http://svnweb.freebsd.org/changeset/doc/42978
Log:
This chapter finishes up the DHCP section. It does the following:
- moves the bpf warning higher as it applies to both
- reduces some headings
- removes redundancy and does general tightening
- clarifies some sections
- modernizes the server config file and expands on the descriptions
This chapter would benefit from extra callouts describing declarations and multiple subnets.
A subsequent patch will fix the white space.
Modified:
head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Wed Oct 16 20:19:56 2013 (r42977)
+++ head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Wed Oct 16 23:41:26 2013 (r42978)
@@ -2646,14 +2646,29 @@ result: 0 Success
This section describes how to use the built-in
DHCP client. It then describes how to
install and configure a DHCP server.
+
+
+ In &os;, the &man.bpf.4; device is needed by both the
+ DHCP server and DHCP client.
+ This device is included in the GENERIC
+ kernel that is installed with &os;. Users who prefer to create
+ a custom kernel need to keep this device if
+ DHCP is used.
+
+ Those who are security conscious should
+ note that bpf also
+ allows packet sniffers to function correctly.
+ Configuring a DHCP ClientDHCP client support is included in the
- &os; installer, making it easy to configure a system to
+ &os; installer, making it easy to configure a newly installed system to
automatically receive its networking addressing information
- from an existing DHCP server.
+ from an existing DHCP server. Refer to
+ for examples of network
+ configuration.UDPWhen dhclient is executed on the client
@@ -2668,78 +2683,48 @@ result: 0 Success
lease and is valid for a configurable time.
This allows stale IP addresses for clients
no longer connected to the network to automatically be
- reused.
-
- DHCP clients can obtain a great deal of
+ reused. DHCP clients can obtain a great deal of
information from the server. An exhaustive list may be found
in &man.dhcp-options.5;.
- The bpf device is already
- part of the GENERIC kernel that is
- supplied with &os;, thus there is no need to build a
- custom kernel for DHCP. In the case of
- a custom kernel configuration file, this device must be
- present for DHCP to function
- properly.
-
-
- For those who are particularly security conscious,
- take note that bpf is also the
- device that allows packet sniffers to work correctly
- (although they still have to be run as
- root).
- bpfis
- required to use DHCP; however, the
- security sensitive types should probably not add
- bpf to the kernel in the
- expectation that at some point in the future the system
- will be using DHCP.
-
-
- By default, DHCP configuration on &os;
+ By default, when a &os; system boots, its DHCP client
runs in the background, or
asynchronously. Other startup scripts
- continue to run while DHCP completes,
- speeding up system startup.
+ continue to run while the DHCP process completes,
+ which speeds up system startup.Background DHCP works well when the
- DHCP server responds quickly to requests
- and the DHCP configuration process goes
- quickly. However, DHCP may take a long
+ DHCP server responds quickly to the client's requests.
+ However, DHCP may take a long
time to complete on some systems. If network services attempt
- to run before DHCP has completed, they will
+ to run before DHCP has assigned the network addressing information, they will
fail. Using DHCP in
- synchronous mode prevents the problem,
- pausing startup until DHCP configuration
+ synchronous mode prevents this problem as it
+ pauses startup until the DHCP configuration
has completed.
- To connect to a DHCP server in the
- background while other startup continues (asynchronous mode),
- use the DHCP value in
- /etc/rc.conf:
+ This line in /etc/rc.conf is used to
+ configure
+ background or asynchronous mode:ifconfig_fxp0="DHCP"
- To pause startup while DHCP completes,
- use synchronous mode with the
- SYNCDHCP value:
+ This line may already exist if the system was configured
+ to use DHCP during installation. Replace
+ the fxp0 shown
+ in these examples with the name of the interface to be
+ dynamically configured, as described in
+ .
+
+ To instead configure the system to use synchronous mode,
+ and to pause during startup while DHCP completes,
+ use
+ SYNCDHCP:ifconfig_fxp0="SYNCDHCP"
-
- Replace the fxp0 shown
- in these examples with the name of the interface to be
- dynamically configured, as described in
- .
-
-
- When using a different file system location for
- dhclient, or if additional flags must
- be passed to dhclient, include (editing
- as necessary):
-
- dhclient_program="/sbin/dhclient"
-dhclient_flags=""
+ Additional client options are available. Search for
+ dhclient in &man.rc.conf.5; for details.DHCP
@@ -2753,24 +2738,23 @@ dhclient_flags=""
/etc/dhclient.conf
- dhclient requires a configuration
- file, /etc/dhclient.conf. Typically
- the file contains only comments, the defaults being
- reasonably sane. This configuration file is described in
+ The configuration file used by dhclient. Typically,
+ this file contains only comments as the defaults are suitable for most clients.
+ This configuration file is described in
&man.dhclient.conf.5;./sbin/dhclient
- More information about dhclient can
+ More information about the command itself can
be found in &man.dhclient.8;./sbin/dhclient-script
- dhclient-script is the
+ The
&os;-specific DHCP client configuration
script. It is described in &man.dhclient-script.8;, but
should not need any user modification to function
@@ -2781,12 +2765,8 @@ dhclient_flags=""
/var/db/dhclient.leases.interfaceThe DHCP client keeps a database of
- valid leases in this file, which is written as a log.
- &man.dhclient.leases.5; gives a slightly longer
- description. Refer to &man.dhclient.8;,
- &man.dhcp-options.5;, and &man.dhclient.conf.5;, in
- addition to the references below, for more
- information.
+ valid leases in this file, which is written as a log and is described in
+ &man.dhclient.leases.5;.
@@ -2795,195 +2775,166 @@ dhclient_flags=""
Installing and Configuring a DHCP
Server
- This section provides information on how to configure a
+ This section demonstrates how to configure a
&os; system to act as a DHCP server using
- the ISC (Internet Systems Consortium) implementation of the
- DHCP server.
+ the Internet Systems Consortium (ISC) implementation of the
+ DHCP server. This implementation and its documentation can be
+ installed using the net/isc-dhcp42-server package or
+ port.DHCPserver
- The DHCP server,
- dhcpd, is included as part of the
- net/isc-dhcp42-server port
- in the ports collection. This port contains the ISC
- DHCP server and documentation.
-
- The server is not provided as part of &os;, and so the
- net/isc-dhcp42-server
- port must be installed to provide this service. See
- for more information on using the
- Ports Collection.
-
DHCPinstallation
- In order to configure the &os; system as a
- DHCP server, first ensure that the
- &man.bpf.4; device is compiled into the kernel. To do this,
- add device bpf to the kernel configuration
- file, and rebuild the kernel. For more information about
- building kernels, see .
-
- The bpf device is already part
- of the GENERIC kernel that is supplied
- with &os;, so there is no need to create a custom kernel in
- order to get DHCP working.
-
-
- Those who are particularly security conscious should
- note that bpf is also the device
- that allows packet sniffers to function correctly
- (although such programs still need privileged access).
- The bpf device
- is required to use
- DHCP, but if the sensitivity of the
- system's security is high, this device should not be
- included in the kernel purely because the use of
- DHCP may, at some point in the future, be
- desired.
-
-
- An example configuration file is installed by the
+ The installation of
net/isc-dhcp42-server
- port. Copy the example
+ installs a sample configuration file. Copy
/usr/local/etc/dhcpd.conf.example
- to the actual configuration file,
- /usr/local/etc/dhcpd.conf. Edits
- will be made to this new file.
-
-
- Configuring the DHCP Server
+ to
+ /usr/local/etc/dhcpd.conf and make any edits
+ to this new file.DHCPdhcpd.conf
- dhcpd.conf is comprised of
- declarations regarding subnets and hosts, and is perhaps
- most easily explained using an example :
+ The configuration file is comprised of
+ declarations for subnets and hosts which define the
+ information that is provided to DHCP
+ clients. For example, these
+ lines configure the following:
- option domain-name "example.com";
-option domain-name-servers 192.168.4.100;
+ option domain-name "example.org";
+option domain-name-servers ns1.example.org;
option subnet-mask 255.255.255.0;
-default-lease-time 3600;
-max-lease-time 86400;
+default-lease-time 600;
+max-lease-time 72400;
ddns-update-style none;
-subnet 192.168.4.0 netmask 255.255.255.0 {
- range 192.168.4.129 192.168.4.254;
- option routers 192.168.4.1;
+subnet 10.254.239.0 netmask 255.255.255.224 {
+ range 10.254.239.10 10.254.239.20;
+ option routers rtr-239-0-1.example.org, rtr-239-0-2.example.org;
}
-host mailhost {
- hardware ethernet 02:03:04:05:06:07;
- fixed-address mailhost.example.com;
+host fantasia {
+ hardware ethernet 08:00:07:26:c0:a5;
+ fixed-address fantasia.fugue.com;
}
- This option specifies the domain that will be
- provided to clients as the default search domain. See
- &man.resolv.conf.5; for more information on what this
- means.
+ This option specifies the default search domain that will be
+ provided to clients. Refer to
+ &man.resolv.conf.5; for more information.This option specifies a comma separated list of
DNS servers that the client should
- use.
+ use. They can be listed by their Fully Qualified Domain
+ Names (FQDN), as seen in the example,
+ or by their IP addresses.
- The netmask that will be provided to
+ The subnet mask that will be provided to
clients.
- A client may request a specific length of time
- that a lease will be valid. Otherwise the server will
- assign a lease with this expiry value (in
- seconds).
+ The default
+ lease expiry time in
+ seconds. A client can be configured to override this
+ value.
- This is the maximum length of time that the server
- will lease for. Should a client request a longer
- lease, a lease will be issued, although it will only
- be valid for max-lease-time
- seconds.
+ The maximum allowed length of time, in seconds, for a
+ lease. Should a client request a longer
+ lease, a lease will still be issued, but it will only
+ be valid for max-lease-time.
- This option specifies whether the
- DHCP server should attempt to update
- DNS when a lease is accepted or
- released. In the ISC implementation, this option is
- required.
+ The default of disables dynamic DNS updates.
+ Changing this to configures the
+ DHCP server to update a
+ DNS server whenever it hands out a
+ lease so that the DNS server knows
+ which IP addresses are associated
+ with which computers in the network. Do not change the default
+ setting unless the DNS server has
+ been configured to support dynamic
+ DNS.
- This denotes which IP addresses
- should be used in the pool reserved for allocating to
- clients. IP addresses between, and
- including, the ones stated are handed out to
- clients.
+ This line creates a pool of available IP addresses
+ which are reserved for allocation to DHCP
+ clients. The range of addresses must be valid for the
+ network or subnet specified in the previous line.
- Declares the default gateway that will be provided
- to clients.
+ Declares the default gateway that is valid for the
+ network or subnet specified before the opening
+ { bracket.
- The hardware MAC address of a host (so that the
- DHCP server can recognize a host when
- it makes a request).
+ Specifies the hardware MAC address of a client so that the
+ DHCP server can recognize the client when
+ it makes a request.
- Specifies that the host should always be given the
- same IP address. Note that using a
- hostname is correct here, since the
+ Specifies that this host should always be given the
+ same IP address. Using the
+ hostname is correct, since the
DHCP server will resolve the
- hostname itself before returning the lease
+ hostname before returning the lease
information.
+ This configuration file supports many more options. Refer
+ to dhcpd.conf(5), installed with the server, for details and
+ examples.
+
Once the configuration of
- dhcpd.conf has been completed,
+ dhcpd.conf is complete,
enable the DHCP server in
- /etc/rc.conf, i.e., by adding:
+ /etc/rc.conf:
dhcpd_enable="YES"
dhcpd_ifaces="dc0"
- Replace the dc0 interface name with
+ Replace the dc0 with
the interface (or interfaces, separated by whitespace)
that the DHCP server should listen on for
DHCP client requests.
- Proceed to start the server by issuing
+ Start the server by issuing
the following command:&prompt.root; service isc-dhcpd startAny future changes to the configuration of the server
- will require the sending of a SIGTERM
- signal to dhcpd rather than a
- SIGHUP. It is definitely more simple to
- use &man.service.8; to completely restart the
- service.
-
-
-
- Files
+ will require the
+ dhcpd service to be stopped and then started using
+ &man.service.8;.
+
+ The DHCP server uses the following
+ files. Note that the manual pages are installed with the
+ server software.DHCP
@@ -2993,27 +2944,21 @@ dhcpd_ifaces="dc0"/usr/local/sbin/dhcpd
- dhcpd is statically
- linked and resides in
- /usr/local/sbin. More
- information about
- dhcpd can be found in
- &man.dhcpd.8;.
+ More
+ information about the
+ dhcpd server can be found in
+ dhcpd(8)./usr/local/etc/dhcpd.conf
- dhcpd requires a
- configuration file,
- /usr/local/etc/dhcpd.conf before it
- will start providing service to clients. This file
+ The server configuration file
needs to contain all the information that should be
- provided to clients that are being serviced, along with
+ provided to clients, along with
information regarding the operation of the server. This
configuration file is described in
- &man.dhcpd.conf.5;, which is installed by the
- port.
+ dhcpd.conf(5).
@@ -3021,24 +2966,23 @@ dhcpd_ifaces="dc0"
The DHCP server keeps a database
of leases it has issued in this file, which is written
- as a log. The port installs &man.dhcpd.leases.5;, which
+ as a log. Refer to dhcpd.leases(5), which
gives a slightly longer description./usr/local/sbin/dhcrelay
- dhcrelay is used in
+ This daemon is used in
advanced environments where one DHCP
server forwards a request from a client to another
DHCP server on a separate network.
- If this functionality is required, then install the
+ If this functionality is required, install the
net/isc-dhcp42-relay
- port. The port installs &man.dhcrelay.8;, which
+ package or port. The installation includes dhcrelay(8) which
provides more detail.
-
From owner-svn-doc-head@FreeBSD.ORG Thu Oct 17 01:53:44 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 1CC2FDD7;
Thu, 17 Oct 2013 01:53:44 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 09A8F2910;
Thu, 17 Oct 2013 01:53:44 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9H1rhY9031577;
Thu, 17 Oct 2013 01:53:43 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9H1rhT3031576;
Thu, 17 Oct 2013 01:53:43 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201310170153.r9H1rhT3031576@svn.freebsd.org>
From: Dru Lavigne
Date: Thu, 17 Oct 2013 01:53:43 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42979 -
head/en_US.ISO8859-1/books/handbook/network-servers
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Thu, 17 Oct 2013 01:53:44 -0000
Author: dru
Date: Thu Oct 17 01:53:43 2013
New Revision: 42979
URL: http://svnweb.freebsd.org/changeset/doc/42979
Log:
White space fix only. Translators can ignore.
Modified:
head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Wed Oct 16 23:41:26 2013 (r42978)
+++ head/en_US.ISO8859-1/books/handbook/network-servers/chapter.xml Thu Oct 17 01:53:43 2013 (r42979)
@@ -2646,29 +2646,29 @@ result: 0 Success
This section describes how to use the built-in
DHCP client. It then describes how to
install and configure a DHCP server.
-
-
- In &os;, the &man.bpf.4; device is needed by both the
- DHCP server and DHCP client.
- This device is included in the GENERIC
- kernel that is installed with &os;. Users who prefer to create
- a custom kernel need to keep this device if
- DHCP is used.
-
- Those who are security conscious should
- note that bpf also
- allows packet sniffers to function correctly.
-
+
+
+ In &os;, the &man.bpf.4; device is needed by both the
+ DHCP server and DHCP
+ client. This device is included in the
+ GENERIC kernel that is installed with
+ &os;. Users who prefer to create a custom kernel need to keep
+ this device if DHCP is used.
+
+ Those who are security conscious should note that
+ bpf also allows packet sniffers to
+ function correctly.
+ Configuring a DHCP ClientDHCP client support is included in the
- &os; installer, making it easy to configure a newly installed system to
- automatically receive its networking addressing information
- from an existing DHCP server. Refer to
- for examples of network
- configuration.
+ &os; installer, making it easy to configure a newly installed
+ system to automatically receive its networking addressing
+ information from an existing DHCP server.
+ Refer to for examples of
+ network configuration.
UDPWhen dhclient is executed on the client
@@ -2682,49 +2682,48 @@ result: 0 Success
in the form of a DHCP
lease and is valid for a configurable time.
This allows stale IP addresses for clients
- no longer connected to the network to automatically be
- reused. DHCP clients can obtain a great deal of
+ no longer connected to the network to automatically be reused.
+ DHCP clients can obtain a great deal of
information from the server. An exhaustive list may be found
in &man.dhcp-options.5;.
- By default, when a &os; system boots, its DHCP client
- runs in the background, or
+ By default, when a &os; system boots, its
+ DHCP client runs in the background, or
asynchronously. Other startup scripts
- continue to run while the DHCP process completes,
- which speeds up system startup.
+ continue to run while the DHCP process
+ completes, which speeds up system startup.Background DHCP works well when the
- DHCP server responds quickly to the client's requests.
- However, DHCP may take a long
- time to complete on some systems. If network services attempt
- to run before DHCP has assigned the network addressing information, they will
- fail. Using DHCP in
- synchronous mode prevents this problem as it
- pauses startup until the DHCP configuration
- has completed.
+ DHCP server responds quickly to the
+ client's requests. However, DHCP may take
+ a long time to complete on some systems. If network services
+ attempt to run before DHCP has assigned the
+ network addressing information, they will fail. Using
+ DHCP in synchronous
+ mode prevents this problem as it pauses startup until the
+ DHCP configuration has completed.
This line in /etc/rc.conf is used to
- configure
- background or asynchronous mode:
+ configure background or asynchronous mode:
ifconfig_fxp0="DHCP"
- This line may already exist if the system was configured
- to use DHCP during installation. Replace
- the fxp0 shown
- in these examples with the name of the interface to be
- dynamically configured, as described in
- .
-
- To instead configure the system to use synchronous mode,
- and to pause during startup while DHCP completes,
- use
+ This line may already exist if the system was configured
+ to use DHCP during installation. Replace
+ the fxp0 shown in these examples
+ with the name of the interface to be dynamically configured,
+ as described in .
+
+ To instead configure the system to use synchronous mode,
+ and to pause during startup while DHCP
+ completes, use
SYNCDHCP:ifconfig_fxp0="SYNCDHCP"Additional client options are available. Search for
- dhclient in &man.rc.conf.5; for details.
+ dhclient in &man.rc.conf.5; for
+ details.DHCP
@@ -2738,9 +2737,10 @@ result: 0 Success
/etc/dhclient.conf
- The configuration file used by dhclient. Typically,
- this file contains only comments as the defaults are suitable for most clients.
- This configuration file is described in
+ The configuration file used by
+ dhclient. Typically, this file
+ contains only comments as the defaults are suitable for
+ most clients. This configuration file is described in
&man.dhclient.conf.5;.
@@ -2765,8 +2765,8 @@ result: 0 Success
/var/db/dhclient.leases.interfaceThe DHCP client keeps a database of
- valid leases in this file, which is written as a log and is described in
- &man.dhclient.leases.5;.
+ valid leases in this file, which is written as a log and
+ is described in &man.dhclient.leases.5;.
@@ -2775,12 +2775,12 @@ result: 0 Success
Installing and Configuring a DHCP
Server
- This section demonstrates how to configure a
- &os; system to act as a DHCP server using
- the Internet Systems Consortium (ISC) implementation of the
- DHCP server. This implementation and its documentation can be
- installed using the net/isc-dhcp42-server package or
+ This section demonstrates how to configure a &os; system
+ to act as a DHCP server using the Internet
+ Systems Consortium (ISC) implementation of
+ the DHCP server. This implementation and
+ its documentation can be installed using the net/isc-dhcp42-server package or
port.
@@ -2793,25 +2793,23 @@ result: 0 Success
installation
- The installation of
- net/isc-dhcp42-server
- installs a sample configuration file. Copy
- /usr/local/etc/dhcpd.conf.example
- to
- /usr/local/etc/dhcpd.conf and make any edits
- to this new file.
+ The installation of net/isc-dhcp42-server installs a
+ sample configuration file. Copy
+ /usr/local/etc/dhcpd.conf.example to
+ /usr/local/etc/dhcpd.conf and make any
+ edits to this new file.
-
- DHCP
+
+ DHCPdhcpd.conf
-
- The configuration file is comprised of
- declarations for subnets and hosts which define the
- information that is provided to DHCP
- clients. For example, these
- lines configure the following:
+
+ The configuration file is comprised of declarations for
+ subnets and hosts which define the information that is
+ provided to DHCP clients. For example,
+ these lines configure the following:
- option domain-name "example.org";
+ option domain-name "example.org";
option domain-name-servers ns1.example.org;
option subnet-mask 255.255.255.0;
@@ -2831,16 +2829,16 @@ host fantasia {
- This option specifies the default search domain that will be
- provided to clients. Refer to
+ This option specifies the default search domain that
+ will be provided to clients. Refer to
&man.resolv.conf.5; for more information.This option specifies a comma separated list of
DNS servers that the client should
- use. They can be listed by their Fully Qualified Domain
- Names (FQDN), as seen in the example,
+ use. They can be listed by their Fully Qualified Domain
+ Names (FQDN), as seen in the example,
or by their IP addresses.
@@ -2850,68 +2848,68 @@ host fantasia {
- The default
- lease expiry time in
- seconds. A client can be configured to override this
- value.
+ The default lease expiry time in seconds. A client
+ can be configured to override this value.
- The maximum allowed length of time, in seconds, for a
- lease. Should a client request a longer
- lease, a lease will still be issued, but it will only
- be valid for max-lease-time.
+ The maximum allowed length of time, in seconds, for
+ a lease. Should a client request a longer lease, a
+ lease will still be issued, but it will only be valid
+ for max-lease-time.
- The default of disables dynamic DNS updates.
- Changing this to configures the
- DHCP server to update a
- DNS server whenever it hands out a
- lease so that the DNS server knows
- which IP addresses are associated
- with which computers in the network. Do not change the default
- setting unless the DNS server has
- been configured to support dynamic
+ The default of disables
+ dynamic DNS updates. Changing this to
+ configures the
+ DHCP server to update a
+ DNS server whenever it hands out a
+ lease so that the DNS server knows
+ which IP addresses are associated
+ with which computers in the network. Do not change the
+ default setting unless the DNS server
+ has been configured to support dynamic
DNS.
- This line creates a pool of available IP addresses
- which are reserved for allocation to DHCP
- clients. The range of addresses must be valid for the
- network or subnet specified in the previous line.
+ This line creates a pool of available
+ IP addresses which are reserved for
+ allocation to DHCP clients. The
+ range of addresses must be valid for the network or
+ subnet specified in the previous line.Declares the default gateway that is valid for the
- network or subnet specified before the opening
+ network or subnet specified before the opening
{ bracket.
- Specifies the hardware MAC address of a client so that the
- DHCP server can recognize the client when
- it makes a request.
+ Specifies the hardware MAC
+ address of a client so that the
+ DHCP server can recognize the client
+ when it makes a request.Specifies that this host should always be given the
- same IP address. Using the
- hostname is correct, since the
- DHCP server will resolve the
- hostname before returning the lease
+ same IP address. Using the hostname
+ is correct, since the DHCP server
+ will resolve the hostname before returning the lease
information.
- This configuration file supports many more options. Refer
- to dhcpd.conf(5), installed with the server, for details and
- examples.
+ This configuration file supports many more options.
+ Refer to dhcpd.conf(5), installed with the server, for
+ details and examples.Once the configuration of
- dhcpd.conf is complete,
- enable the DHCP server in
+ dhcpd.conf is complete, enable the
+ DHCP server in
/etc/rc.conf:dhcpd_enable="YES"
@@ -2928,13 +2926,12 @@ dhcpd_ifaces="dc0"&prompt.root; service isc-dhcpd startAny future changes to the configuration of the server
- will require the
- dhcpd service to be stopped and then started using
- &man.service.8;.
-
- The DHCP server uses the following
- files. Note that the manual pages are installed with the
- server software.
+ will require the dhcpd service to
+ be stopped and then started using &man.service.8;.
+
+ The DHCP server uses the following
+ files. Note that the manual pages are installed with the
+ server software.DHCP
@@ -2953,11 +2950,10 @@ dhcpd_ifaces="dc0"
/usr/local/etc/dhcpd.conf
- The server configuration file
- needs to contain all the information that should be
- provided to clients, along with
- information regarding the operation of the server. This
- configuration file is described in
+ The server configuration file needs to contain all
+ the information that should be provided to clients,
+ along with information regarding the operation of the
+ server. This configuration file is described in
dhcpd.conf(5).
@@ -2966,21 +2962,21 @@ dhcpd_ifaces="dc0"
The DHCP server keeps a database
of leases it has issued in this file, which is written
- as a log. Refer to dhcpd.leases(5), which
- gives a slightly longer description.
+ as a log. Refer to dhcpd.leases(5), which gives a
+ slightly longer description.
/usr/local/sbin/dhcrelay
- This daemon is used in
- advanced environments where one DHCP
- server forwards a request from a client to another
- DHCP server on a separate network.
- If this functionality is required, install the
- net/isc-dhcp42-relay
- package or port. The installation includes dhcrelay(8) which
- provides more detail.
+ This daemon is used in advanced environments where
+ one DHCP server forwards a request
+ from a client to another DHCP server
+ on a separate network. If this functionality is
+ required, install the net/isc-dhcp42-relay
+ package or port. The installation includes dhcrelay(8)
+ which provides more detail.
From owner-svn-doc-head@FreeBSD.ORG Thu Oct 17 04:33:23 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 2B61AB7D;
Thu, 17 Oct 2013 04:33:23 +0000 (UTC)
(envelope-from eadler@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 1714E2082;
Thu, 17 Oct 2013 04:33:23 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9H4XMQE015890;
Thu, 17 Oct 2013 04:33:22 GMT (envelope-from eadler@svn.freebsd.org)
Received: (from eadler@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9H4XMNi015887;
Thu, 17 Oct 2013 04:33:22 GMT (envelope-from eadler@svn.freebsd.org)
Message-Id: <201310170433.r9H4XMNi015887@svn.freebsd.org>
From: Eitan Adler
Date: Thu, 17 Oct 2013 04:33:22 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42980 - in head: en_US.ISO8859-1/htdocs
en_US.ISO8859-1/htdocs/community share/xml
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Thu, 17 Oct 2013 04:33:23 -0000
Author: eadler
Date: Thu Oct 17 04:33:22 2013
New Revision: 42980
URL: http://svnweb.freebsd.org/changeset/doc/42980
Log:
- The "social" page was kind of lonely so combine it with the "community" page.
- While here remove an old (circa 2009) twitter account.
Further work needs to be done on the community, support, and events pages.
Discussed with: bjk
Reviewed by: Allan Jude
Deleted:
head/en_US.ISO8859-1/htdocs/community/social.xml
Modified:
head/en_US.ISO8859-1/htdocs/community.xsl
head/en_US.ISO8859-1/htdocs/community/Makefile
head/share/xml/navibar.ent
Modified: head/en_US.ISO8859-1/htdocs/community.xsl
==============================================================================
--- head/en_US.ISO8859-1/htdocs/community.xsl Thu Oct 17 01:53:43 2013 (r42979)
+++ head/en_US.ISO8859-1/htdocs/community.xsl Thu Oct 17 04:33:22 2013 (r42980)
@@ -27,9 +27,6 @@
-
&os; is well supported by its active
- community.
-
There are more than one hundred mailing
lists, dozens of web-based
+
There are thousands of photos from user group
+ meetings, conferences, and hackathons tagged as 'freebsd'
+ on flickr.
+
+
There are hundreds of videos from conferences,
+ screencasts, and demonstrations relating to FreeBSD
+ on YouTube. In particular, there is a new BSD Conferences channel with full length 1 hour taped presentations from FreeBSD technical conferences.
>
> Some of these lines seem a bit long, and indentation with lines 137-139
> should replace spaces with tabs.
The whitespace on all of these pages are a bit messed up. This was a
copy & paste from social.xml. Once I've edited these pages a bit more
I will also fix up the whitespace.
--=20
Eitan Adler
Source, Ports, Doc committer
Bugmeister, Ports Security teams
From owner-svn-doc-head@FreeBSD.ORG Thu Oct 17 12:03:38 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id EF4439A9;
Thu, 17 Oct 2013 12:03:38 +0000 (UTC)
(envelope-from jkois@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id DCEA629C3;
Thu, 17 Oct 2013 12:03:38 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9HC3cJl054197;
Thu, 17 Oct 2013 12:03:38 GMT (envelope-from jkois@svn.freebsd.org)
Received: (from jkois@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9HC3cVl054196;
Thu, 17 Oct 2013 12:03:38 GMT (envelope-from jkois@svn.freebsd.org)
Message-Id: <201310171203.r9HC3cVl054196@svn.freebsd.org>
From: Johann Kois
Date: Thu, 17 Oct 2013 12:03:38 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42981 - head/share/xml
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Thu, 17 Oct 2013 12:03:39 -0000
Author: jkois
Date: Thu Oct 17 12:03:38 2013
New Revision: 42981
URL: http://svnweb.freebsd.org/changeset/doc/42981
Log:
PR: www/180622
Add HermeTek Network Solutions to the list of consultants with FreeBSD support.
Requested by: James Shupe
Modified:
head/share/xml/commercial.consult.xml
Modified: head/share/xml/commercial.consult.xml
==============================================================================
--- head/share/xml/commercial.consult.xml Thu Oct 17 04:33:22 2013 (r42980)
+++ head/share/xml/commercial.consult.xml Thu Oct 17 12:03:38 2013 (r42981)
@@ -517,6 +517,18 @@
+
+ HermeTek Network Solutions
+ https://www.hermetek.com/
+
+ HermeTek Network Solutions is a comprehensive network solutions
+ provider with a strong focus on FreeBSD. HermeTek also offers
+ support for other BSD and Linux operating systems, as well as
+ fully managed hosting packages. Please visit our web site for more information.
+
+
+
Herrin Software Developmenthttp://www.hsdi.com/
From owner-svn-doc-head@FreeBSD.ORG Thu Oct 17 12:28:08 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
[IPv6:2001:1900:2254:206a::19:1])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id CDC6854F;
Thu, 17 Oct 2013 12:28:08 +0000 (UTC)
(envelope-from jkois@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id BB14C2B33;
Thu, 17 Oct 2013 12:28:08 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9HCS8W5066431;
Thu, 17 Oct 2013 12:28:08 GMT (envelope-from jkois@svn.freebsd.org)
Received: (from jkois@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9HCS8nc066430;
Thu, 17 Oct 2013 12:28:08 GMT (envelope-from jkois@svn.freebsd.org)
Message-Id: <201310171228.r9HCS8nc066430@svn.freebsd.org>
From: Johann Kois
Date: Thu, 17 Oct 2013 12:28:08 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42982 - head/de_DE.ISO8859-1/share/xml
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Thu, 17 Oct 2013 12:28:08 -0000
Author: jkois
Date: Thu Oct 17 12:28:08 2013
New Revision: 42982
URL: http://svnweb.freebsd.org/changeset/doc/42982
Log:
r42929 -> r42963
MFde: Resync the project news
Obtained from: The FreeBSD German Documentation Project
Modified:
head/de_DE.ISO8859-1/share/xml/news.xml
Modified: head/de_DE.ISO8859-1/share/xml/news.xml
==============================================================================
--- head/de_DE.ISO8859-1/share/xml/news.xml Thu Oct 17 12:03:38 2013 (r42981)
+++ head/de_DE.ISO8859-1/share/xml/news.xml Thu Oct 17 12:28:08 2013 (r42982)
@@ -4,7 +4,7 @@
-
-
- Terminology
+ Serial Terminology and Hardware
+ The following terms are often used in serial commnications:bps
@@ -76,16 +72,18 @@
DTE
- An example of a Data Terminal EquipmentDTE
- (DTE) is a computer.
+ Data Terminal EquipmentDTE
+ (DTE) is one of two endpoints in a
+ serial communication. An example would be a computer.DCE
- An example of a Data Communications EquipmentDCE
- (DTE) is a modem.
+ Data Communications EquipmentDCE
+ (DTE) is the other endpoint in a
+ serial communication. Typically, it is a modem.
@@ -93,8 +91,8 @@
RS-232
- The original standard for hardware serial
- communications. It is now usually referred to as
+ The original standard which defined hardware serial
+ communications. It has since been renamed to
TIA-232RS-232C cables.
@@ -105,10 +103,7 @@
number of electrical state transitions that may be made in a
period of time, while bps is the
correct term to use.
-
-
- Cables and PortsTo connect a modem or serial terminal to a &os; system, a
serial port on the computer and the proper cable to connect to
@@ -116,17 +111,14 @@
with serial hardware and cabling can safely skip this
section.
-
- Cables
+
+ Serial Cables and PortsThere are several different kinds of serial cables. The
two most common types are null-modem cables and standard
RS-232 cables. The documentation for the hardware should
describe the type of cable required.
-
- Null-modem Cables
-
null-modem cable
@@ -431,10 +423,6 @@
another variation, SG connects to SG, TD connects to RD,
RTS and CTS connect to DCD, DTR connects to DSR, and
vice-versa.
-
-
-
- Standard RS-232C CablesRS-232C cables
@@ -445,20 +433,12 @@
This is the type of cable used to connect a modem to
the &os; system, and is also appropriate for some
terminals.
-
-
-
-
- PortsSerial ports are the devices through which data is
transferred between the &os; host computer and the
terminal. This section describes the kinds of ports that
exist and how they are addressed in &os;.
-
- Kinds of Ports
-
Several kinds of serial ports exist. Before
purchasing or constructing a cable, make sure it will
fit the ports on the terminal and on the &os;
@@ -471,10 +451,6 @@
See the documentation that accompanied the hardware
for specifications on the kind of port or visually verify
the type of port.
-
-
-
- Port NamesIn &os;, each serial port is accessed through an
entry in /dev.
@@ -508,9 +484,6 @@
terminal. If the terminal is on the second serial port
(COM2), use
/dev/ttyu1, and so forth.
-
-
-
@@ -642,16 +615,17 @@
+
+ -->
Terminalsterminals
@@ -661,9 +635,6 @@
connected network. This section describes how to use terminals
with &os;.
-
- Uses and Types of Terminals
-
The original &unix; systems did not have consoles.
Instead, users logged in and ran programs through terminals
that were connected to the computer's serial ports.
@@ -681,13 +652,12 @@
otherwise be a single-user computer into a powerful multiple
user system.
- This section describes three kinds of terminals supported
- by &os;: dumb terminals, computers acting as terminals, and X
- terminals.
-
-
- Dumb Terminals
+ &os; supports three types of terminals:
+
+
+ Dumb terminals
+ Dumb terminals are specialized hardware that connect to
computers over serial lines. They are called
dumb because they have only enough
@@ -704,12 +674,13 @@
Dumb terminals are popular in work environments where
workers do not need access to graphical applications.
-
+
+
-
- Computers Acting as Terminals
-
- If a dumb terminal has
+
+ Computers Acting as Terminals
+
+ If a dumb terminal has
just enough ability to display, send, and receive text,
any spare computer can be a dumb terminal. All that is
needed is the proper cable and some terminal
@@ -750,11 +721,12 @@
through the Ports Collection, such as comms/minicom.
-
-
-
- X Terminals
+
+
+
+ X Terminals
+ X terminals are the most sophisticated kind of terminal
available. Instead of connecting to a serial port, they
usually connect to a network like Ethernet. Instead of
@@ -763,8 +735,9 @@
This chapter does not cover the
setup, configuration, or use of X terminals.
-
-
+
+
+ Configuration
@@ -995,10 +968,7 @@ ttyu5 "/usr/libexec/getty std.19200"
Here is a list of common symptoms and some suggested
fixes.
-
- No Login Prompt Appears
-
- Make sure the terminal is plugged in and powered up. If
+ If no login prompt appears, make sure the terminal is plugged in and powered up. If
it is a personal computer acting as a terminal, make sure it
is running terminal emulation software on the correct serial
port.
@@ -1050,33 +1020,22 @@ ttyu5 "/usr/libexec/getty std.19200"
software flow control enabled when using
3wire to prevent buffer overflows.
-
-
-
- If Garbage Appears Instead of a Login Prompt
-
- Make sure the terminal and &os; agree on the
+ If garbage appears instead of a login prompt, make sure the terminal and &os; agree on the
bps rate and parity settings. Check the
getty processes to make sure the correct
getty type is in use. If not,
edit /etc/ttys and run kill
-HUP 1.
-
-
-
- Characters Appear Doubled and the Password Appears When
- Typed
-
- Switch the terminal, or the terminal emulation software,
+ If characters appear doubled and the password appears when
+ typed, switch the terminal, or the terminal emulation software,
from half duplex or local echo
to full duplex.
-
-
+
Dial-in Servicedial-in serviceConfiguring a &os; system for dial-in service is similar
to connecting terminals except that modems are used instead of
- terminal devices.
-
-
- External Versus Internal Modems
+ terminal devices. &os; supports both external and internal modems.
External modems are more convenient for dial-up because
they often can be semi-permanently configured via parameters
@@ -1115,9 +1072,6 @@ ttyu5 "/usr/libexec/getty std.19200"
internal modem has any signal indicator lights, they are
difficult to view when the system's cover is in place.
-
- Modems and Cables
-
modemWhen using an external modem, a proper cable is needed.
@@ -1196,8 +1150,6 @@ ttyu5 "/usr/libexec/getty std.19200"
the modem after a call. &os; avoids sending commands to
the modem or watching for status reports from the
modem.
-
- Serial Interface Considerations
@@ -1316,19 +1268,12 @@ ttyu5 "/usr/libexec/getty std.19200"
information on the format of the file and the list of
capabilities.
-
- Locked-speed Config
-
When locking a modem's data communications rate at a
particular speed, no changes to
/etc/gettytab should be
needed.
-
-
- Matching-speed Config
-
- Set up an entry in
+ However, a change is needed to create a matching-speed configuration. Create an entry in
/etc/gettytab to give
getty information about the speeds to
use for the modem. For a 2400 bps modem, use the
@@ -1402,7 +1347,6 @@ vq|VH57600|Very High Speed Modem at 5760
16550A-based serial ports, there may be
siosilo errors at 57.6 Kbps.
-
@@ -1456,9 +1400,6 @@ vq|VH57600|Very High Speed Modem at 5760
Wait until the modem is properly configured and
connected before signaling init.
-
- Locked-speed Config
-
For a locked-speed configuration, the
ttys entry needs to have a
fixed-speed entry provided to getty.
@@ -1474,10 +1415,6 @@ vq|VH57600|Very High Speed Modem at 5760
instead of std.19200. Make sure to use
a valid type listed in
/etc/gettytab.
-
-
-
- Matching-speed ConfigIn a matching-speed configuration, the
ttys entry needs to reference the
@@ -1489,7 +1426,6 @@ vq|VH57600|Very High Speed Modem at 5760
this:ttyu0 "/usr/libexec/getty V19200" dialup on
-
@@ -1627,9 +1563,6 @@ AT&C1&D2&H1&I0&R2&am
conversation between getty and the
modem.
-
- Locked-speed Config
-
For a locked-speed configuration, configure the modem to
maintain a constant modem-to-computer data rate independent
of the communications rate. On a &usrobotics; &sportster;
@@ -1639,10 +1572,6 @@ AT&C1&D2&H1&I0&R2&am
ATZ
AT&B1&W
-
-
-
- Matching-speed ConfigFor a variable-speed configuration, configure the modem
to adjust its serial port data rate to match the incoming
@@ -1654,7 +1583,6 @@ AT&B1&W
ATZ
AT&B2&W
- Checking the Modem's Configuration
@@ -1680,9 +1608,6 @@ AT&B2&W
Here are a few steps for troubleshooting a dial-up modem
on a &os; system.
-
- Checking Out the &os; System
-
Hook up the modem to the &os; system, boot the
system, and, if the modem has status indication lights,
watch to see whether the modem's DTR
@@ -1728,12 +1653,8 @@ AT&B2&W
appropriate device special files,
/dev/ttyuN, for any mistakes, missing
entries, or missing device special files.
-
-
-
- Try Dialing In
- Try dialing into the system. Be sure to use 8 bits, no
+ Next, try dialing into the system. Be sure to use 8 bits, no
parity, and 1 stop bit on the remote system. If a prompt
does not appear right away, or the prompt shows garbage, try
pressing Enter about once per second. If
@@ -1776,9 +1697,7 @@ AT&B2&W
it later. If it still does not work, try sending an
email message to the &a.questions; describing the modem
and the problem.
-
-
@@ -2066,6 +1985,7 @@ raisechar=^^
+
Setting Up the Serial Consoleserial console
-
- Introduction
-
&os; has the ability to boot a system with a dumb
terminal on a serial port as a console. This configuration is
useful for system administrators who wish to install &os; on
@@ -2106,8 +2024,6 @@ raisechar=^^
boot block code, the boot loader code, and the kernel need to
be configured.
-
-
Quick Serial Console Configuration
@@ -2160,7 +2076,7 @@ raisechar=^^
Use either a null-modem cable or a standard serial
cable and a null-modem adapter. See for a discussion
+ linkend="term-cables-null"/> for a discussion
on serial cables.
@@ -2482,16 +2398,12 @@ boot:
Summary
- Here is the summary of the various settings discussed in
- this section:
+ The following tables provide a summary of the various settings discussed in
+ this section.
-
- Case 1: Set the Flags to 0x10 for
+
+ Case 1: Set the Flags to 0x10 for
sio0
-
- device sio0 flags 0x10
-
-
@@ -2546,16 +2458,11 @@ boot:
-
-
+
-
- Case 2: Set the Flags to 0x30 for
+
+ Case 2: Set the Flags to 0x30 for
sio0
-
- device sio0 flags 0x30
-
-
@@ -2610,8 +2517,7 @@ boot:
-
-
+
From owner-svn-doc-head@FreeBSD.ORG Thu Oct 17 17:08:29 2013
Return-Path:
Delivered-To: svn-doc-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115])
(using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
(No client certificate requested)
by hub.freebsd.org (Postfix) with ESMTP id 908AC4EA;
Thu, 17 Oct 2013 17:08:29 +0000 (UTC) (envelope-from dru@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
[IPv6:2001:1900:2254:2068::e6a:0])
(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))
(No client certificate requested)
by mx1.freebsd.org (Postfix) with ESMTPS id 7CBE121F6;
Thu, 17 Oct 2013 17:08:29 +0000 (UTC)
Received: from svn.freebsd.org ([127.0.1.70])
by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id r9HH8TBM015224;
Thu, 17 Oct 2013 17:08:29 GMT (envelope-from dru@svn.freebsd.org)
Received: (from dru@localhost)
by svn.freebsd.org (8.14.7/8.14.5/Submit) id r9HH8TWk015223;
Thu, 17 Oct 2013 17:08:29 GMT (envelope-from dru@svn.freebsd.org)
Message-Id: <201310171708.r9HH8TWk015223@svn.freebsd.org>
From: Dru Lavigne
Date: Thu, 17 Oct 2013 17:08:29 +0000 (UTC)
To: doc-committers@freebsd.org, svn-doc-all@freebsd.org,
svn-doc-head@freebsd.org
Subject: svn commit: r42985 - head/en_US.ISO8859-1/books/handbook/serialcomms
X-SVN-Group: doc-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-doc-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the doc tree for head
List-Unsubscribe: ,
List-Archive:
List-Post:
List-Help:
List-Subscribe: ,
X-List-Received-Date: Thu, 17 Oct 2013 17:08:29 -0000
Author: dru
Date: Thu Oct 17 17:08:29 2013
New Revision: 42985
URL: http://svnweb.freebsd.org/changeset/doc/42985
Log:
White space fix only. Translators can ignore.
To be followed by a quick typo fix.
Modified:
head/en_US.ISO8859-1/books/handbook/serialcomms/chapter.xml
Modified: head/en_US.ISO8859-1/books/handbook/serialcomms/chapter.xml
==============================================================================
--- head/en_US.ISO8859-1/books/handbook/serialcomms/chapter.xml Thu Oct 17 15:42:25 2013 (r42984)
+++ head/en_US.ISO8859-1/books/handbook/serialcomms/chapter.xml Thu Oct 17 17:08:29 2013 (r42985)
@@ -59,30 +59,36 @@
Serial Terminology and Hardware
- The following terms are often used in serial commnications:
-
-
- bps
+ The following terms are often used in serial
+ commnications:
+
+
+ bps
- Bits per Secondbits-per-second (bps) is the rate
- at which data is transmitted.
+ Bits per
+ Secondbits-per-second
+ (bps) is the rate at which data is
+ transmitted.DTE
- Data Terminal EquipmentDTE
- (DTE) is one of two endpoints in a
- serial communication. An example would be a computer.
+ Data Terminal
+ EquipmentDTE
+ (DTE) is one of two endpoints in a
+ serial communication. An example would be a
+ computer.DCE
- Data Communications EquipmentDCE
- (DTE) is the other endpoint in a
+ Data Communications
+ EquipmentDCE
+ (DTE) is the other endpoint in a
serial communication. Typically, it is a modem.
@@ -92,8 +98,9 @@
The original standard which defined hardware serial
- communications. It has since been renamed to
- TIA-232RS-232C cables.
+ communications. It has since been renamed to
+ TIA-232RS-232C
+ cables.
@@ -104,7 +111,6 @@
period of time, while bps is the
correct term to use.
-
To connect a modem or serial terminal to a &os; system, a
serial port on the computer and the proper cable to connect to
the serial device are needed. Users who are already familiar
@@ -119,372 +125,372 @@
RS-232 cables. The documentation for the hardware should
describe the type of cable required.
-
- null-modem cable
-
-
- A null-modem cable passes some signals, such as
- Signal Ground, straight through, but
- switches other signals. For example, the
- Transmitted Data pin on one end goes to the
- Received Data pin on the other end.
-
- A null-modem cable can be constructed for use with
- terminals. The following table shows the RS-232C signal names
- and the pin numbers on a DB-25 connector. While the
- standard calls for a straight-through pin 1 to pin 1
- Protective Ground line, it is often
- omitted. Some terminals work using only pins 2, 3, and
- 7, while others require different configurations than
- the examples shown below.
+
+ null-modem cable
+
-
- DB-25 to DB-25 Null-Modem Cable
+ A null-modem cable passes some signals, such as
+ Signal Ground, straight through, but
+ switches other signals. For example, the
+ Transmitted Data pin on one end goes to the
+ Received Data pin on the other end.
+
+ A null-modem cable can be constructed for use with
+ terminals. The following table shows the RS-232C signal names
+ and the pin numbers on a DB-25 connector. While the
+ standard calls for a straight-through pin 1 to pin 1
+ Protective Ground line, it is often
+ omitted. Some terminals work using only pins 2, 3, and
+ 7, while others require different configurations than
+ the examples shown below.
-
-
-
- Signal
- Pin #
-
- Pin #
- Signal
-
-
+
+
+ RTS
+ 7
+ connects to
+ 5
+ CTS
+
-
- When one pin at one end connects to a pair of pins
- at the other end, it is usually implemented with one
- short wire between the pair of pins in their connector
- and a long wire to the other single pin.
-
+
+ CTS
+ 8
+ connects to
+ 4
+ RTS
+
+
+
+
STABLE - The applications and libraries in the stable
branch are considered "release quality," and are the versions that
- appear in the FreeBSD ports tree. The current stable version is
+ appear in the &os; ports tree. The current stable version is
GNOME &gnomever;.
DEVELOPMENT - In between stable releases are development
releases. Traditionally, GNOME development releases have odd minor
- numbers (e.g. 2.3, &gnomedevelver;, 2.(n*2)-1). Development releases will
+ numbers (e.g. 2.3, &gnomedevelver;, 3.(n*2)-1). Development releases will
become stable releases, and move from alpha to beta quality during
- their lifecycle. The development releases need testing by FreeBSD
+ their lifecycle. The development releases need testing by &os;
users to minimize the number of surprises when the new stable
- versions are committed to the FreeBSD CVS tree. This document is
- about the development branch. The current development branch
- is GNOME &gnomedevelver;.
+ versions are committed to the &os; SVN tree. This document is
+ about the development branch. At any time the development branch for &os;
+ might be based of a stable GNOME release. However it will be tagged
+ "development" here if it is the version that is work in progress by the &os;
+ GNOME team. The current development branch for &os; is GNOME &gnomedevelver;.
GIT - Often newer-than-new, the GIT master versions of GNOME
applications and libraries are alpha quality, or often completely
- unbuildable. The FreeBSD GNOME project pays attention to, but
+ unbuildable. The &os; GNOME project pays attention to, but
does not track the alpha quality code.
@@ -62,7 +64,7 @@
If you are looking for a stable environment, absolutely not. Please
only track the GNOME &gnomedevelver; branch if you wish to help identify bugs
- and improve the FreeBSD GNOME project. You will find little
+ and improve the &os; GNOME project. You will find little
sympathy if a development-quality GNOME application eats your
homework.
@@ -72,12 +74,12 @@
How do I obtain the development versions of GNOME stuff?
Marcus maintains a
- CVS repository where all the development versions of
- the GNOME components for FreeBSD are housed. Instructions for
+ SVN repository where all the development versions of
+ the GNOME components for &os; are housed. Instructions for
how to check out the development ports module and how to merge it
- into the FreeBSD ports tree reside on the entrance page to his
+ into the &os; ports tree reside on the entrance page to his SVN
repository. Please read carefully the instructions at
- http://www.marcuscom.com:8080/cgi-bin/cvsweb.cgi.
+ http://www.marcuscom.com:8080/viewvc/viewvc.cgi/marcuscom/.
During the development cycle, FreeBSD-specific caveats and
@@ -97,7 +99,7 @@
The short answer is that you need to use the marcusmerge
- script to merge the development tree with the FreeBSD ports tree.
+ script to merge the development tree with the &os; ports tree.
The marcusmerge script is available
here, and a man page on using the script is available
@@ -127,7 +129,8 @@ WITH_DEBUG="yes"
(irc.freenode.net).
If all of this sounds scary, or you need a desktop that
- "Just Works," you should stick with the stable GNOME branch.
+ "Just Works," you should stick with the &gnomever; version that
+ is available in the &os; ports tree.
@@ -137,7 +140,7 @@ WITH_DEBUG="yes"
It depends. If you think the problem is truly a bug with the
GNOME component, you can report a bug using bug-buddy or
the GNOME Bugzilla
- interface. If you think the problem lies in a FreeBSD port, or
+ interface. If you think the problem lies in a &os; port, or
is FreeBSD-specific, send email to
&email;@FreeBSD.org,
or report the problem on the #freebsd-gnome IRC
@@ -161,11 +164,10 @@ WITH_DEBUG="yes"
-
What is the current state of development GNOME on FreeBSD?
+
What is the current state of development GNOME on &os;?
-
We have just cleared out the MarcusCom ports tree after
- merging &gnomever; into the FreeBSD ports tree. Stay tuned
- for the start of &gnomedevelver; work.
+
&gnomever; is the latest version that was merged into the &os; ports tree.
+ Work is currently underway to make &gnomedevelver; stable.