FreeBSD7-服务器构建指南-全- - 绝不原创的飞龙

**注意：**

# id
uid=1001(john) gid=1001(john) groups=1001(john), 0(wheel)

# su

# whoami
root

# pw user mod `*uname*` -G wheel

^[ (escape) menu ^y search prompt ^k delete line   ^p prev li  ^g prev page
^o ascii code    ^x search        ^l undelete line ^n next li  ^v next page
^u end of file   ^a begin of line ^w delete word   ^b back 1 char
^t top of text   ^e end of line   ^r restore word  ^f forward 1 char
^c command       ^d delete char   ^j undelete char ^z next word
============================================================================

search for:

+---------------------+
| main menu           |
|                     |
| a) leave editor     |
| b) help             |
| c) file operations  |
| d) redraw screen    |
| e) settings         |
| f) search           |
| g) miscellaneous    |
|                     |
| press Esc to cancel |
+---------------------+

# cd /root
# ee .cshrc

#set path = (/sbin /bin /usr/sbin /usr/bin /usr/games
 /usr/local/sbin /usr/local/bin /usr/X11R6/bin)

set path = (/usr/local/sbin /usr/local/bin /usr/sbin
 /usr/bin /sbin /bin $HOME/bin)

# echo $path

# ee /etc/ssh/sshd_config

AllowUsers *curly larry moe*

# /usr/rc.d/sshd restart

# shutdown -p now

# reboot

# ee /etc/rc.conf

hostname="*host.example.com*"
ifconfig_*xl0*="DHCP"

hostname="*host.example.com*"
ifconfig_xl0="inet 192.168.1.11 netmask 255.255.255.0"
defaultrouter="192.168.1.1"

# ee /etc/rc.conf

hostname="*host.example.com*"

# ee /etc/hosts

::1               localhost localhost.*example.com*
127.0.0.1         localhost localhost.*example.com*
*192.168.1.11* *host.example.com*

# ee /etc/resolv.conf

domain *example.com*
nameserver *206.12.29.11*
nameserver *192.168.1.11*

# freebsd-update fetch
# freebsd-update install
# reboot

# uname -r

# mount /cdrom
 # cd /cdrom/7.0-RELEASE/ports
 # ./install.sh

# cp /usr/share/examples/cvsup/ports-supfile /root

# ping -c 5 cvsup2.freebsd.org
PING cvsup2.us.freebsd.org (130.94.149.166): 56 data bytes
64 bytes from 130.94.149.166: icmp_seq=0 ttl=48 time=85.607 ms

# ee /root/ports-supfile

*default host=*cvsup4*.FreeBSD.org

# csup -g -L 2 /root/ports-supfile

# cd /usr/ports/lang/perl5.8
 # make install clean
 # rehash

# cd /usr/ports
 # make readmes && make index

# cd /usr/ports
# make search name=portname

# lynx /usr/ports/README.html

# cd /usr/ports/ports-mgmt/portmaster
# make install clean
 # rehash

# portmaster -L | grep -B1 "New version"
===>>> expat-1.95.8
        ===>>> New version available: expat-2.0.0

# portmaster -b expat-1.95.8

# pkg_delete -f expat-2.0.0
# pkg_add /root/expat-1.95.8.tbz

# cd /usr/ports/ports-mgmt/portaudit
# make install clean
 # rehash

# portaudit -Fda

# make -D DISABLE_VULNERABILITIES install clean

-a

-r

# pkg_info

# pkg_info -r perl-5.8.8

# pkg_info -a -r

-f

-r

# pkg_delete perl-5.8.8

# pkg_delete -f perl-5.8.8

# pkg_delete -r perl-5.8.8

# ee /etc/hosts

::1               localhost localhost.*example.com*
127.0.0.1         localhost localhost.*example.com*
*192.168.1.11      host.example.com*

# cd /usr/ports/www/apache22
 # make config ; make install clean
 # rehash

# ee /usr/local/etc/apache22/httpd.conf

ServerAdmin *you@example.com*

ServerName *host.example.com*:80

Include etc/apache22/extra/httpd-ssl.conf

# ee /usr/local/etc/apache22/extra/httpd-ssl.conf

ServerName *host.example.com*:443
ServerAdmin *you@example.com*

SSLCertificateFile */usr/local/openssl/certs/host.example.com-cert.pem*

SSLCertificateKeyFile */usr/local/openssl/certs/host.example.com-unencrypted-key.pem*

# apachectl configtest

# ee /etc/rc.conf

apache22_enable="YES"
apache22_http_accept_enable="YES"

# /usr/local/etc/rc.d/apache22 start

# telnet localhost 80
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.

GET / HTTP/1.0
HTTP/1.1 200 OK
Date: Sat, 01 Mar 2008 02:00:30 GMT
Server: Apache/2.2.8 (FreeBSD) mod_ssl/2.2.8 OpenSSL/0.9.8g DAV/2
Last-Modified: Sat, 20 Nov 2004 20:16:24 GMT
ETag: "cf597-2c-4c23b600"
Accept-Ranges: bytes
Content-Length: 44
Connection: close
Content-Type: text/html
<html><body><h1>It works!</h1></body></html>Connection closed by foreign host.

# openssl s_client -connect localhost:443

GET / HTTP/1.0

start

stop

configtest

restart

# /usr/local/etc/rc.d/apache22 start

# cd /usr/ports/security/courier-authlib
 # make config ; make install clean
 # rehash

# ee /usr/local/etc/authlib/authdaemonrc

authmodulelist="authpam"

# ee /etc/rc.conf

courier_authdaemond_enable="YES"

# /usr/local/etc/rc.d/courier-authdaemond start
# /usr/local/etc/rc.d/courier-authdaemond status

courier_authdaemond is running as pid *12073*.

# cd /usr/ports/mail/courier-imap
 # make config ; make install clean

# cd /usr/local/openssl/certs
# cp host.example.com-unencrypted-key.pem\
? host.example.com-key-cert.pem
# chmod 400 host.example.com-key-cert.pem
# cat host.example.com-cert.pem >> host.example.com-key-cert.pem

# ee /usr/local/etc/courier-imap/imapd-ssl

TLS_CERTFILE=/usr/local/openssl/certs/host.example.com-key-cert.pem

# ee /usr/local/etc/courier-imap/pop3d-ssl

TLS_CERTFILE=/usr/local/openssl/certs/host.example.com-key-cert.pem

# ee /etc/rc.conf

courier_imap_imapd_enable="YES"
courier_imap_imapd_ssl_enable="YES"

# /usr/local/etc/rc.d/courier-imap-imapd.sh start
 # /usr/local/etc/rc.d/courier-imap-imapd-ssl.sh start

# telnet localhost 143

Connected to localhost.
Escape character is '^]'.
* OK [CAPABILITY IMAP4rev1 UIDPLUS CHILDREN NAMESPACE THREAD=ORDEREDSUBJECT
THREAD=REFERENCES SORT QUOTA IDLE ACL ACL2=UNION STARTTLS] Courier-IMAP ready.
Copyright 1998-2005 Double Precision, Inc. See COPYING for distribution information.

aa login username password
aa OK LOGIN Ok.

ab select inbox

* FLAGS (\Draft \Answered \Flagged \Deleted \Seen \Recent)
* OK [PERMANENTFLAGS (\* \Draft \Answered \Flagged \Deleted \Seen)] Limited
* 2 EXISTS
* 0 RECENT
* OK [UIDVALIDITY 1129543635] Ok
* OK [MYRIGHTS "acdilrsw"] ACL
ab OK [READ-WRITE] Ok

ac logout

* BYE Courier-IMAP server shutting down
ac OK LOGOUT completed
Connection closed by foreign host.

# openssl s_client -connect localhost:993

# ee /etc/rc.conf

courier_imap_pop3d_enable="YES"
courier_imap_pop3d_ssl_enable="YES"

# /usr/local/etc/rc.d/courier-imap-pop3d.sh start
 # /usr/local/etc/rc.d/courier-imap-pop3d-ssl.sh start

# telnet localhost 110

Connected to localhost.
Escape character is '^]'.
+OK Hello there.

user username

+OK Password required.

pass password

+OK logged in.

stat

+OK 7 19775

quit

# openssl s_client -connect localhost:995

-f

# su user
 # maildirmake Maildir
 # exit

# su user
# maildirmake -f Junk Maildir
# exit

# /usr/local/etc/rc.d/courier-imap-imapd.sh stop

# /usr/local/etc/rc.d/courier-imap-pop3d.sh stop

# setenv XORG_UPGRADE yes
# cd /usr/ports/print/cups
# make config ; make install clean
# rehash

# cp /etc/make.conf /etc/make.conf.old
# echo "NO_LPR = YES" >> /etc/make.conf

# ee /usr/local/etc/cups/mime.convs

application/octet-stream   application/vnd.cups-raw     0     -

# ee /usr/local/etc/cups/cupsd.conf

Listen *:631

# Restrict access to the server...
<Location />
  Order allow,deny
  Allow @LOCAL
</Location>

# Restrict access to the admin pages...
<Location /admin>
  Encryption Required
  Require user @SYSTEM
  Order allow,deny
  Allow @LOCAL
</Location>

# ee /etc/rc.conf

cupsd_enable="YES"

# /usr/local/etc/rc.d/cupsd start

```
# cd /usr/ports/print/gutenprint
# make install clean
```

将出现一个包含 Gutenprint 选项的菜单；高亮显示“Gutenprint Cups 驱动程序”并按[空格键]在其框中打勾。保留其他选项的默认设置：按[tab]键高亮显示“确定”，然后按[enter]键。安装完成后，继续下面的第 8 步。如果你愿意，也可以安装 HPLIP 驱动程序。

```
# cd /usr/ports/print/hplip
# make config ; make install clean
```

将出现一个包含 HPLIP 选项的菜单。保留它们的默认设置：按[tab]键高亮显示“确定”，然后按[enter]键继续安装。

# lp -d printername filename

# ee /usr/local/etc/cups/cupsd.conf

<Location /printers>
AuthType Basic
AuthClass User
</Location>

# ee /usr/local/etc/cups/cupsd.conf

<Location /printers>
Order Deny,Allow
Deny From All
Allow From 192.168.0.1
Allow From 192.168.0.2
</Location>

ServerCertificate /usr/local/openssl/certs/ host.example.com-cert.pem
ServerKey /usr/local/openssl/certs/ host.example.com-unencrypted-key.pem
*host.example.com-cert.pem * is the server's public SSL Certificate file.
*host.example.com-unencrypted-key.pem * is the server's private unencrypted key file.

# lptcontrol -p -d /dev/lpt0

# cd /usr/ports/security/cyrus-sasl2-saslauthd
 # make config ; make install clean
 # rehash

# ee /usr/local/lib/sasl2/smtpd.conf

pwcheck_method: saslauthd
mech_list: plain login

# ee /etc/rc.conf

saslauthd_enable="YES"
saslauthd_flags="-a pam"

# /usr/local/etc/rc.d/saslauthd start
# /usr/local/etc/rc.d/saslauthd status

saslauthd is running as pid *1234*.

# cd /usr/ports/dns/ddclient
# make install clean
# rehash

# cd /usr/local/etc
 # cp ddclient.conf.sample ddclient.conf
 # ee ddclient.conf

use=web, web=checkip.dyndns.org/, web-skip='IP Address' # ...

##
## dyndns.org custom addresses
##
## (supports variables: wildcard,mx,backupmx)
##
custom=yes,                           \
server=members.dyndns.org,            \
protocol=dyndns2                      \
login=username                        \
password=password                     \
example.com

# chmod 600 /usr/local/etc/ddclient.conf

# ee /etc/rc.conf

ddclient_enable="YES"
ddclient_flags="-daemon 600"

# /usr/local/etc/rc.d/ddclient.sh start

# ps -ax | grep ddclient

p0  S      0:00.05 ddclient - sleeping for 300 seconds (perl)

# mysql -u root -p
mysql> create database drupal;
mysql> grant all on drupal.* to
    -> drupal@localhost identified by 'password';
mysql> quit

# cd /usr/ports/www/drupal5
# make config ; make install clean

# ee /usr/local/etc/apache22/Includes/drupal.conf

Alias /*drupal* "/usr/local/www/drupal5/"

<Directory "/usr/local/www/drupal5/">
Options Indexes FollowSymLinks
AllowOverride All
Order allow,deny
Allow from all
</Directory>

# /usr/local/etc/rc.d/apache22 restart

# ee /etc/crontab

45 */4 * * * root /usr/local/bin/lynx http:*//host.example.com/drupal/*cron.php

# cat /usr/ports/dns/bind94/Makefile | grep PORTVERSION

# cd /usr/ports/dns/bind94
# make config ; make install clean

# cp /etc/make.conf /etc/make.conf.old
# echo "NO_BIND = YES" >> /etc/make.conf

# ee /var/named/etc/namedb/named.conf

//      listen-on       { 127.0.0.1; };

forwarders {
        202.13.68.62;68.103.31.52;
};

zone "*example.com*" {
    type master;
    file "*master*/example.com";
    allow-transfer { localhost; };
    allow-update { key rndc-key; };
};

zone "1.168.192.in-addr.arpa" {
    type master;
    file "*master*/example.com.rev";
    allow-transfer { localhost; };
    allow-update { key rndc-key; };
};

# rndc-confgen -a
# cd /var/named/etc/namedb
# cp named.conf named.conf.old
# cat rndc.key >> named.conf

# cd /var/named/etc/namedb/master
# ee example.com

$TTL    3600

*example.com*.   IN    SOA   *host.example.com*.    *root*.*example.com*. (

                                1       ;       Serial
                                10800   ;       Refresh
                                3600    ;       Retry
                                604800  ;       Expire
                                86400 ) ;       Minimum TTL
;DNS Servers
*example.com*.         IN      NS              *host.example.com*.

;Machine Names
*host.example.com*.    IN      A               *192.168.1.11*

;Aliases
www                  IN      CNAME           *host.example.com*.

;MX Record
*example.com*.         IN      MX      10      *host.example.com*.

$TTL    3600

*example.com.*   IN    SOA     *host.example.com.* *root.example.com.* (

1       ;       Serial

10800   ;       Refresh

3600    ;       Retry

604800  ;       Expire

86400 ) ;       Minimum TTL

;DNS Servers
*example.com.*    IN      NS              *host.example.com.*

;Machine Names
*host.example.com.*    IN      A               *192.168.1.11*

;Aliases
www                  IN      CNAME           *host.example.com.*

;MX Record
*example.com.*         IN      MX      10      *host.example.com.*

# ee example.com.rev

$TTL    3600

*1.168.192.in-addr.arpa*. IN  SOA *host.example.com*.  *root.example.com*.   (

                                1       ;       Serial
                                10800   ;       Refresh
                                3600    ;       Retry
                                604800  ;       Expire
                                86400 ) ;       Minimum TTL
;DNS Servers
*1.168.192.in-addr.arpa*.   IN      NS              *host.example.com*.

;Machine IPs
*11*                        IN      PTR             *host.example.com*.
*11*                        IN      PTR             www.*example.com*.

*1.168.192.in-addr.arpa*. IN  SOA *host.example.com*.  *root.example.com*.

;DNS Servers
*1.168.192.in-addr.arpa*.   IN      NS              *host.example.com*.

;Machine IPs
*11*              IN      PTR             *host.example.com*.

# cd /var/named/etc/namedb/master
# cp example.com ../dynamic
# cp example.com.rev ../dynamic
# chown -R bind /var/named/etc/namedb/dynamic

# ee /etc/resolv.conf

domain example.comnameserver 127.0.0.1
nameserver 61.32.24.84
nameserver 206.13.22.96

# ee /etc/rc.conf

named_enable="YES"

# /etc/rc.d/named start

# dig google.com

; <<>> DiG 9.4.1 <<>> google.com.
;; global options:  printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 31313
;; flags: qr rd ra; QUERY: 1, ANSWER: 3, AUTHORITY: 4, ADDITIONAL: 4

;; QUESTION SECTION:
;google.com.                    IN      A

;; ANSWER SECTION:
google.com.             246     IN      A       72.14.207.99
google.com.             246     IN      A       64.233.167.99
google.com.             246     IN      A       64.233.187.99

;; AUTHORITY SECTION:
google.com.             339294  IN      NS      ns2.google.com.
google.com.             339294  IN      NS      ns3.google.com.
google.com.             339294  IN      NS      ns1.google.com.
google.com.             339294  IN      NS      ns4.google.com.

;; ADDITIONAL SECTION:
ns4.google.com.         87732   IN      A       216.239.38.10
ns1.google.com.         86787   IN      A       216.239.32.10
ns2.google.com.         88494   IN      A       216.239.34.10
ns3.google.com.         344254  IN      A       216.239.36.10

;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Jun  7 01:43:03 2008
;; MSG SIZE  rcvd: 212

# dig example.com axfr

; <<>> DiG 9.4.1 <<>> example.com axfr
;; global options:  printcmd
example.com.          3600    IN      SOA     host.example.com.
example.com.          3600    IN      MX      10 host.example.com.
example.com.          3600    IN      NS      host.example.com.
host.example.com.     3600    IN      A       192.168.1.11
www.example.com.      3600    IN      CNAME   host.example.com.
example.com.          3600    IN      SOA     host.example.com.
;; Query time: 1 msec
;; SERVER: 127.0.0.1#53(127.0.0.1)
;; WHEN: Sat Jun  7 09:58:01 2008
;; XFR size: 6 records (messages 1, bytes 189)

flush

reload

stop

status

# rndc flush

# netstat -rn | grep default

# cd /usr/ports/net/isc-dhcp3-server
# make config ; make install clean
# rehash

# cd /usr/local/etc
# cp dhcpd.conf.sample dhcpd.conf
# ee dhcpd.conf

option domain-name "*example.com*";
option domain-name-servers *192.168.1.11*, *61.32.24.84*;

authoritative;

ddns-update-style *interim*;

subnet 10.254.239.0 netmask 255.255.255.224 {
range 10.254.239.10 10.254.239.20;
option routers rtr-239-0-1.example.org, rtr-239-0-2.example.org;
}

subnet *192.168.1.0* netmask *255.255.255.0* {
range *192.168.1.12* *192.168.1.62*;
option routers *192.168.1.1*;
}

host *desktop01.example.com* {
  hardware ethernet *08:00:07:26:c0:a5*;
  fixed-address *192.168.1.10*;}

# cd /usr/local/etc
# cp dhcpd.conf dhcpd.conf.old
# cat /var/named/etc/namedb/rndc.key >> dhcpd.conf

# ee /usr/local/etc/dhcpd.conf

zone *example.com*. {
     primary *192.168.1.11*;
     key rndc-key;
}
zone 1.168.192.in-addr.arpa. {
     primary *192.168.1.11*;
     key rndc-key;
}

update-static-leases on;

# dhcpd -f -d

# host desktop01.example.com

desktop01.example.com has address 192.168.1.13

# ee /etc/rc.conf

dhcpd_enable="YES"

# /usr/local/etc/rc.d/isc-dhcpd start

# cd /usr/ports/www/lynx
# make install clean
# rehash

# lynx

# cd /usr/local/openssl/certs
# openssl pkcs7 -inform DER -in cert.p7b -print_certs -text -out cert.pem

# lynx

# lynx /usr/local/share/lynx_help/Lynx_users_guide.html

# lynx http://www.google.com

# lynx ftp://ftp.freebsd.org

# mysql -u root -p
mysql> create database mediawiki;
mysql> grant all on mediawiki.* to
    -> mediawiki@localhost identified by 'password';
mysql> quit

# cd /usr/ports/www/mediawiki
# make config ; make install clean

# ee /usr/local/etc/apache22/Includes/mediawiki.conf

Alias /*mediawiki* "/usr/local/www/mediawiki/"

<Directory "/usr/local/www/mediawiki/">
Options Indexes FollowSymLinks
AllowOverride None

Order allow,deny
Allow from all
</Directory>

# /usr/local/etc/rc.d/apache22 restart

# cd /usr/local/www/mediawiki
# mv config/LocalSettings.php .
# chmod 640 LocalSettings.php
# rm -r config

$wgLogo = "http://host.example.com/logo.gif";

# ee /etc/hosts

::1             localhost localhost.*example.com*
127.0.0.1       localhost localhost.*example.com*
*192.168.1.11* *host.example.com*

# cd /usr/ports/databases/mysql50-server
# make -D BUILD_OPTIMIZED install clean
# rehash

# mysql_install_db --user=mysql

# mysqld_safe &
# mysqladmin -u root password 'localpassword'
# mysqladmin -u root -h host.example.com password 'remotepassword'

*my-small.cnf*

*my-medium.cnf*

*my-large.cnf*

*my-huge.cnf*

# cp /usr/local/share/mysql/my-medium.cnf /var/db/mysql/my.cnf

# ee /var/db/mysql/my.cnf

skip-networking

# ee /etc/rc.conf

mysql_enable="YES"

# /usr/local/etc/rc.d/mysql-server restart

# mysqlshow -p

+--------------------+
|     Databases      |
+--------------------+
| information_schema |
| mysql              |
| test               |
+--------------------+

# ls -ld /tmp 
*drwxrwxrwt *   7 root  wheel      512 Feb 17 12:00 /tmp

# chown root:wheel /tmp
# chmod 777 /tmp
# chmod =t /tmp

# mysql -u root -p

mysql> exit;

mysql> show databases;

mysql> create database testing;

mysql> grant all on database.* to user@localhost identified by
    -> 'password';

mysql> grant select on database.* to user@localhost identified
    -> by 'password';

mysql> grant options on database.* to user@localhost identified
    -> by 'password';

mysql> revoke all privileges on database.* from user@localhost;

mysql> revoke all privileges, grant option from user@localhost;
mysql> drop user user@localhost;

mysql> drop database testing;

mysql> show grants for user@localhost;

# mysqldump -u root -p --all-databases > /path/filename.sql

# mysqldump -u root -p --databases dbname > /path/filename.sql

# mysql -u root -p dbname < /path/filename.sql

# cd /usr/ports/net/ntp
# make config ; make install clean
# rehash

# touch /etc/ntp/drift

# ee /etc/ntp.conf

server *time.example1.com* iburst
server *time.example2.com* iburst
server *time.example3.com* iburst
driftfile /etc/ntp/drift
logfile /var/log/ntp.log

# ee /etc/rc.conf

ntpd_enable="YES"
ntpd_program="/usr/local/bin/ntpd"

# /etc/rc.d/ntpd start

# ntpq -p localhost

remote           refid      st t when poll reach   delay   offset  jitter
=========================================================================
+gabe.kjsl.com   209.81.9.7  2 u   30   64  377   13.267  1282.65 405.902
+reva.xtremeunix 204.123.2.5 2 u   50   64  377   25.863  1228.18 421.589
*zorac.sf-bay.or 204.123.2.5 2 u   20   64  377   25.283  1017.32 345.212
-time.nist.gov   .INIT.     16 u 159m 1024    0    0.000    0.000 4000.00

remote

refid

st

t

when

poll

reach

delay

offset

jitter

# ntpdate -q localhost

server 127.0.0.1, stratum 3, offset 0.000004, delay 0.02579
server ::1, stratum 3, offset 0.000010, delay 0.02583
 6 Jun 20:15:12 ntpdate[2710]: adjust time server 127.0.0.1 offset 0.0004 sec

restrict default ignore
restrict *time.example1.com*
restrict *time.example2.com*
restrict *time.example3.com*

restrict *192.168.1.0* mask *255.255.255.0* nomodify notrap

-DOMAIN COMPONENT (.com)
  -DOMAIN COMPONENT (example)
    -ORGANIZATIONAL UNIT (People)
      -USER ID (jdoe)
        -TELEPHONENUMBER (phone number)
        -GIVENNAME (doe)

-DOMAIN COMPONENT (.com)
  -DOMAIN COMPONENT (example)
    -ORGANIZATIONAL UNIT (People)
      -USER ID (jdoe)
        -TELEPHONENUMBER (phone number)
        -GIVENNAME (doe)

# cd /usr/ports/net/openldap23-server
# make config ; make install clean
# rehash

# cd /usr/local/etc/openldap
# sed -I .old 's/rootpw/# rootpw/' slapd.conf
# echo -n "rootpw " >> slapd.conf
# slappasswd >> slapd.conf

# ee /usr/local/etc/openldap/slapd.conf

suffix          "dc=example,dc=com"
rootdn          "cn=Manager,dc=example,dc=com"

include       /usr/local/etc/openldap/schema/cosine.schema
include       /usr/local/etc/openldap/schema/inetorgperson.schema

access to attrs=userPassword
        by self write
        by anonymous auth
        by * none

access to *
        by self write
        by users read
        by peername.ip=127.0.0.1 read
        by anonymous auth

TLSCACertificateFile */usr/local/openssl/certs/example.com-CAcert.pem*
TLSCertificateFile */usr/local/openssl/certs/host.example.com-cert.pem*
TLSCertificateKeyFile */usr/local/openssl/certs/host.example.com-unencrypted-key.pem*

# cd /usr/local/etc/openldap
# cp DB_CONFIG.example /var/db/openldap-data/DB_CONFIG

# ee /etc/rc.conf

slapd_enable="YES"
slapd_flags='-h "ldapi://%2fvar%2frun%2fopenldap%2fldapi/ ldap:///"'
slapd_sockets="/var/run/openldap/ldapi"

slapd_enable="YES"
slapd_flags='-h "ldapi://%2fvar%2frun%2fopenldap%2fldapi/\
 ldap:/// ldaps:///"'
slapd_sockets="/var/run/openldap/ldapi"
slapd_owner="root:ldap"

# /usr/local/etc/rc.d/slapd start

# ee domainmgr.ldif

# Create Domain entry
dn: dc=example,dc=com
objectclass: dcObjectobjectclass:
organization
o: example.com
dc: example

# Create Manager entry
dn: cn=Manager,dc=
example,dc=com
objectclass: organizationalRole
cn: Manager

dn

dc

cn

o

# ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f domainmgr.ldif -c

# ee people.ldif

# Create Organizational Unit (People)
dn: ou=People,dc=example,dc=com
objectclass: top
objectclass: organizationalUnit
ou: People

# ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f people.ldif

# ee user.ldif

# Create User Entry
dn: cn=John Doe,ou=People,dc=example,dc=com
objectclass: inetOrgPerson
cn: John Doe
givenname: John
sn: Doe
mail: jdoe@example.com

# echo -n "userPassword: " >> user.ldif
# slappasswd >> user.ldif

# ldapadd -x -D "cn=Manager,dc=example,dc=com" -W -f user.ldif

# ldapsearch -W -H ldap://localhost/ -D\
? cn=Manager,dc=example,dc=com -b 'dc=example,dc=com' '
(objectclass=*)'

# extended LDIF
#
# LDAPv3
# base <dc=turbojets,dc=net> with scope subtree
# filter: (objectclass=*)
# requesting: ALL
#

# example.com
dn: dc=example,dc=com
objectClass: dcObject

objectClass: organization
o: example.com
dc: example

# Manager, example.com
dn: cn=Manager,dc=example,dc=com
objectClass: organizationalRole
cn: Manager

# People, example.com
dn: ou=People,dc=example,dc=com
objectClass: top
objectClass: organizationalUnit
ou: People

# John Doe, People, example.com
dn: cn=John Doe,ou=People,dc=example,dc=com
objectClass: inetOrgPerson
cn: John Doe
givenName: John
sn: Doe
mail: jdoe@example.com
userPassword:: e1NTSEF9MTJTZkh1YkRQelI0ZG4wV3hlZUxqRkJFZ200UzQ0YnQ=

Base DN: dc=example,dc=com
Bind DN: cn=John Doe,ou=People,dc=example,dc=com

# cd /usr/ports/security/openssh-portable
# make config ; make -D WITH_OVERWRITE_BASE install clean

# cp /etc/make.conf /etc/make.conf.old
# echo "NO_OPENSSH = YES" >> /etc/make.conf

# cd /etc/ssh
# cp sshd_config sshd_config.old
# cp sshd_config-dist sshd_config
# /etc/rc.d/sshd restart

# ee /etc/rc.conf

sshd_enable="YES"

# telnet localhost 22

Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
*SSH-2.0-OpenSSH_4.7p1 FreeBSD-openssh-portable-overwrite-base-4.7.p1,1*

-p

-L

-N

-f

# ssh johnny@host.example.com

# ssh -p 23 cat@fluffy.net

# ssh -L 1234:host.example.com:110 -f -N aeron@host.example.com

# killall -TERM ssh

-C

-P

-p

-r

# scp example.doc author@example.com:/usr/home

# scp -p -C /usr/samba author@example.com:/usr/home

# scp -P 23 author@server1.example.com:/usr/example.doc /usr

-o Port=xx

-C

# sftp test@server.example.com

# sftp -o Port=23 -C wilson@example.com

# ee /etc/ssh/sshd_config

AllowUsers *username*

# /etc/rc.d/sshd restart

# cd /etc/ssh
# mkdir old_keys
# mv ssh_host* old_keys
# /etc/rc.d/sshd restart

# pw user mod lucky -G wheel

# cd /usr/ports/security/openssl
# cp Makefile Makefile.old
# echo EXTRACONFIGURE+=no-idea >> Makefile
# make install clean
# rehash

# cp /etc/make.conf /etc/make.conf.old
# echo "WITH_OPENSSL_PORT=YES" >> /etc/make.conf

# mv /etc/ssl/openssl.cnf /etc/ssl/openssl.cnf.old
# cd /usr/local/openssl
# cp openssl.cnf.sample openssl.cnf

# openssl version
OpenSSL 0.9.8g 19 Oct 2007

# cd /usr/local/openssl
# cp misc/CA.pl certs

# cd /usr/local/openssl/certs
# setenv OPENSSL /usr/local/bin/openssl
# ./CA.pl -newreq

# cp newkey.pem host.example.com-encrypted-key.pem

# cp newreq.pem host.example.com-req.pem

# openssl rsa -in host.example.com-encrypted-key.pem\
? -out host.example.com-unencrypted-key.pem
# chmod 400 host.example.com-unencrypted-key.pem

# cd /usr/local/openssl
# cp misc/CA.pl certs
# sed -I .old 's/365/1095/' openssl.cnf

# cd /usr/local/openssl/certs
# setenv OPENSSL /usr/local/bin/openssl
# ./CA.pl -newca

# ./CA.pl -newreq

# ./CA.pl -signreq

# cp newcert.pem host.example.com-cert.pem
# cp newkey.pem host.example.com-encrypted-key.pem
# cp demoCA/cacert.pem ./example.com-CAcert.pem
# cp demoCA/private/cakey.pem ./example.com-encrypted-CAkey.pem

# openssl rsa -in host.example.com-encrypted-key.pem\
? -out host.example.com-unencrypted-key.pem
# chmod 400 host.example.com-unencrypted-key.pem

# openssl x509 -in example.com-CAcert.pem -inform PEM\
? -out example.com-CAcert.cer -outform DER

# uuencode example.com-CAcert.cer example.com-CAcert.cer\ ? | mail -s "
Subject" user@example.com

# netstat -rn | grep default

default          192.168.1.1      UGS       0   2144  ed0

# grep nameserver /etc/resolv.conf

# cd /usr/ports/security/openvpn
# make config ; make install clean
# rehash

# mkdir /usr/local/etc/openvpn
# cd /usr/local/share/doc/openvpn/sample-config-files
# cp server.conf /usr/local/etc/openvpn/openvpn.conf

# mkdir /usr/local/etc/openvpn/keys
# cd /usr/local/etc/openvpn/keys
# cp /usr/local/openssl/misc/CA.pl .

# ./CA.pl -newca

# ./CA.pl -newreq

# ./CA.pl -signreq

# cp newcert.pem openvpn-cert.pem
# cp newkey.pem openvpn-encrypted-key.pem
# cp demoCA/cacert.pem ./openvpn-CAcert.pem
# cp demoCA/private/cakey.pem ./openvpn-encrypted-CAkey.pem

# openssl rsa -in openvpn-encrypted-key.pem -out openvpn-unencrypted-key.pem
# chmod 400 openvpn-unencrypted-key.pem

# openssl req -days 1095 -nodes -new -keyout client01-key.pem\
? -out client01-req.pem
# chmod 400 client01-key.pem

# openssl ca -days 1095 -out client01-cert.pem -in client01-req.pem

# openssl dhparam -out dh2048.pem 2048

# ee /usr/local/etc/openvpn/openvpn.conf

dev tap
;dev tun

ca keys/openvpn-CAcert.pem
cert keys/openvpn-cert.pem
key keys/openvpn-unencrypted-key.pem # This file should be kept secret

dh keys/dh2048.pem

;server 10.8.0.0 255.255.255.0

push "redirect-gateway"

push "dhcp-option DNS *192.168.1.11*"

client-to-client

user nobody
group nobody

# kldload if_bridge
# kldload if_tap

# ifconfig bridge0 create
# ifconfig tap0 create
# ifconfig tap0 up
# ifconfig bridge0 addm ed0 addm tap0

# cd /usr/local/etc/openvpn
# openvpn openvpn.conf

Sun Jun 15 17:04:20 2008 OpenVPN 2.0.6 i386-portbld-freebsd7.0 [SSL] [LZO]
Sun Jun 15 17:04:20 2008 Diffie-Hellman initialized with 2048 bit key
Sun Jun 15 17:04:20 2008 TLS-Auth MTU parms [ L:1574 D:138 EF:38 EB:0 ET:0
Sun Jun 15 17:04:20 2008 TUN/TAP device /dev/tap0 opened
Sun Jun 15 17:04:20 2008 Data Channel MTU parms [ L:1574 D:1450 EF:42 EB:135

Sun Jun 15 17:04:20 2008 GID set to nobody
Sun Jun 15 17:04:20 2008 UID set to nobody
Sun Jun 15 17:04:20 2008 UDPv4 link local (bound): [undef]:1194
Sun Jun 15 17:04:20 2008 UDPv4 link remote: [undef]
Sun Jun 15 17:04:20 2008 MULTI: multi_init called, r=256 v=256
Sun Jun 15 17:04:20 2008 IFCONFIG POOL: base=192.168.0.200 size=11
Sun Jun 15 17:04:20 2008 IFCONFIG POOL LIST
Sun Jun 15 17:04:20 2008 client01,192.168.1.61
Sun Jun 15 17:04:20 2008 Initialization Sequence Completed

# ee /boot/loader.conf

if_bridge_load="YES"
bridgestp_load="YES"
if_tap_load="YES"

# ee /etc/sysctl.conf

net.link.tap.up_on_open=1

# ee /etc/rc.conf

openvpn_enable="YES"
cloned_interfaces="bridge0 tap0"
ifconfig_bridge0="addm ed0 addm tap0"

client
dev tap
proto udp
remote *host.example.com* 1194
resolv-retry infinite
persist-key
persist-tun
ca *openvpn-CAcert.pem*
cert *client01-cert.pem*
key *client01-key.pem*
comp-lzo
verb 3

# cd /usr/ports/lang/php5
# make config ; make install clean
# rehash

# ee /usr/local/etc/apache22/httpd.conf

<IfModule dir_module>
    DirectoryIndex index.php index.html
</IfModule>

AddType application/x-httpd-php .php
AddType application/x-httpd-php-source .phps

# cd /usr/local/etc
# cp php.ini-recommended php.ini

# ee /usr/local/etc/php.ini

session.save_path = "/tmp"

# /usr/local/etc/rc.d/apache22 restart

# ee /usr/local/www/apache22/data/phpinfo.php

<?php phpinfo(); ?>

# lynx http://host.example.com/phpinfo.php

# rm /usr/local/www/apache22/data/phpinfo.php

-a

-f

-c

-v

-l

# php -a

# php -c php-test.ini -f test.php

# php -l -f example.php

# mysql -u root -p
mysql> create database phpbb;
mysql> grant all on phpbb.* to
    -> phpbb@localhost identified by 'password';
mysql> quit

# cd /usr/ports/www/phpbb3
# make config ; make install clean

# ee /usr/local/etc/apache22/Includes/phpbb.conf

Alias /*phpbb* "/usr/local/www/phpBB3/"

<Directory "/usr/local/www/phpBB3/">
Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Directory>

# /usr/local/etc/rc.d/apache22 restart

# rm -rf /usr/local/www/phpBB3/install
# chmod 640 /usr/local/www/phpBB3/config.php

# cd /usr/ports/net/phpldapadmin
# make config ; make install clean

# ee /usr/local/www/phpldapadmin/config/config.php

$config->custom->session['blowfish'] = '*aSD453PAsldiflDSAPOSD*';

$ldapservers->SetValue($i,'appearance','password_hash','ssha');

# ee /usr/local/etc/apache22/Includes/phpldapadmin.conf

Alias /*phpldapadmin* "/usr/local/www/phpldapadmin/htdocs/"

<Directory "/usr/local/www/phpldapadmin/htdocs/">
Options none
AllowOverride none
Order Deny,Allow
Deny from all
Allow from 127.0.0.1 *192.168.1*
</Directory>

# /usr/local/etc/rc.d/apache22 restart

http://host.example.com/phpldapadmin

Login DN:
cn=John Doe,ou=People,dc=example,dc=com

Login DN:
cn=Manager,dc=example,dc=com

# ee /usr/local/etc/apache22/Includes/phpldapadmin.conf

Alias /*phpldapadmin * "/usr/local/www/phpldapadmin/htdocs/"

<Directory "/usr/local/www/phpldapadmin/htdocs/">
Options none
AllowOverride None
Order Allow,Deny 
Allow from All 
</Directory>

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} /*phpldapadmin* 
RewriteRule (.*) https://*host.example.com* /*phpldapadmin* / [R]
</IfModule>

# /usr/local/etc/rc.d/apache22 restart

# cd /usr/ports/databases/phpmyadmin
# make config ; make install clean

# cd /usr/local/www/phpMyAdmin
# ee config.inc.php

<?php
cfg['blowfish_secret']               = '*4fj8Rv15ZFls16Lei23qrn42*';
$i                                   = 1;
$cfg['Servers'][$i]['connect_type']  = '*socket*';

$cfg['Servers'][$i]['auth_type']     = 'cookie';
$cfg['Servers'][$i]['extension']     = 'mysqli';
?>

# mysql -u root -p
 mysql> grant select, insert, update, delete on phpmyadmin.* to
     -> pma@localhost identified by 'password';
 mysql> quit;

# cd /usr/local/www/phpMyAdmin/scripts
# mysql -u root -p < create_tables_mysql_4_1_2+.sql

# ee /usr/local/www/phpMyAdmin/config.inc.php

<?php
$cfg['Servers'][$i]['pmadb']         = 'phpmyadmin';
$cfg['Servers'][$i]['controluser']   = 'pma';
$cfg['Servers'][$i]['controlpass']   = '*password*';
$cfg['Servers'][$i]['table_info']    = 'pma_table_info';
$cfg['Servers'][$i]['pdf_pages']     = 'pma_pdf_pages';
$cfg['Servers'][$i]['history']       = 'pma_history';
$cfg['Servers'][$i]['column_info']   = 'pma_column_info';
$cfg['Servers'][$i]['table_coords']  = 'pma_table_coords';
$cfg['Servers'][$i]['relation']      = 'pma_relation';
$cfg['Servers'][$i]['bookmarktable'] = 'pma_bookmark';
?>

# ee /usr/local/etc/apache22/Includes/phpmyadmin.conf

Alias /*phpmyadmin* "/usr/local/www/phpMyAdmin/"

<Directory "/usr/local/www/phpMyAdmin/">
Options none
AllowOverride All
Order Deny,Allow
Deny from all
Allow from 127.0.0.1 *192.168.1*
</Directory>

# /usr/local/etc/rc.d/apache22 restart

# ee /usr/local/etc/apache22/Includes/phpmyadmin.conf

Alias /*phpmyadmin * "/usr/local/www/phpMyAdmin/"

<Directory "/usr/local/www/phpMyAdmin/">
Options none
AllowOverride All
Order Allow,Deny 
Allow from All 
</Directory>

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} /*phpmyadmin* 
RewriteRule (.*) https://*host.example.com* /*phpmyadmin* / [R]
</IfModule>

# /usr/local/etc/rc.d/apache22 restart

# cd /usr/ports/mail/postfix
# make config ; make install clean
# rehash

# ee /usr/local/etc/postfix/main.cf

mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain

#mynetworks_style = host

relayhost = [*mailserver.isp.tld*]

home_mailbox = Maildir/

```
smtp_sasl_auth_enable = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
smtpd_sasl_local_domain = $mydomain
broken_sasl_auth_clients = yes
smtp_sasl_password_maps = hash:/usr/local/etc/sasldb2
smtpd_recipient_restrictions =
   permit_sasl_authenticated
   permit_mynetworks
   reject_unauth_destination
```

* * *

***注意：*** Postfix 配置语句跨越多行时，需要像上面最后三行所示的前导空白。

* * *

* * *

***注意：*** 这里使用的命名约定与本书中的 OpenSSL 指南一致。根据您的系统适当替换斜体中的项。

* * *

```
smtp_tls_CAfile = */usr/local/openssl/certs/example.com-CAcert.pem*
smtp_tls_cert_file = */usr/local/openssl/certs/host.example.com-cert.pem*
smtp_tls_key_file =
  */usr/local/openssl/certs/host.example.com-unencrypted-key.pem*
smtp_tls_session_cache_database = btree:/var/run/smtp_tls_session_cache
smtp_tls_security_level = may
smtpd_tls_CAfile = */usr/local/openssl/certs/example.com-CAcert.pem*
smtpd_tls_cert_file = */usr/local/openssl/certs/host.example.com-cert.pem*
smtpd_tls_key_file =
  */usr/local/openssl/certs/host.example.com-unencrypted-key.pem*
smtpd_tls_session_cache_database = btree:/var/run/smtpd_tls_session_cache
smtpd_tls_received_header = yes
smtpd_tls_security_level = may
tls_random_source = dev:/dev/urandom
smtpd_tls_auth_only = yes
```

上述使用的文件是：

[example.com-CAcert.pem](http://example.com-CAcert.pem) 证书颁发机构根证书

[host.example.com-cert.pem](http://host.example.com-cert.pem) 服务器证书

[host.example.com-unencrypted-key.pem](http://host.example.com-unencrypted-key.pem) 服务器私钥

假设一切顺利，您现在已通过启用带有 SSL 的 SASL 创建了一种安全的方式远程中继电子邮件。话虽如此，如果您的用户将从远程位置发送电子邮件，他们可能会受到 ISP 强制的 SMTP 端口 25 封锁（见 "注意事项"），这阻止他们通过默认端口发送出站邮件。为了解决这个问题，我们将启用 SMTP 提交端口 587，用户可以通过此端口安全地向您的服务器提交电子邮件。

```
# ee /usr/local/etc/postfix/master.cf
```

and uncomment the following four lines (~12):

```
submission inet n       -       n       -       -       smtpd
  -o smtpd_enforce_tls=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
```

```
# ee /etc/mail/aliases
```

滚动到 (~19)，取消注释此行，并输入系统管理员的电子邮件地址。根账户的电子邮件将被转发到这个电子邮件地址。此行应如下所示，用正确的电子邮件地址替换 username@example.com：

```
root: *username@example.com*
```

```
# newaliases
```

# ee /etc/rc.conf

postfix_enable="YES"
sendmail_enable="NO"
sendmail_submit_enable="NO"
sendmail_outbound_enable="NO"
sendmail_msp_queue_enable="NO"

# ee /etc/periodic.conf

daily_clean_hoststat_enable="NO"
daily_status_mail_rejects_enable="NO"
daily_status_include_submit_mailq="NO"
daily_submit_queuerun="NO"

# killall sendmail
# /usr/local/etc/rc.d/postfix start

```
# telnet localhost 25 

Connected to localhost.
Escape character is '^]'.
220 *host.example.com * ESMTP Postfix
```

您的主机名应显示在 host.example.com 的位置。

```
mail from: test@example.com

250 Ok
```

```
rcpt to: user@example.com

250 Ok
data

354 End data with <CR><LF>.<CR><LF>

Subject: test messageThis is a test message
.
```

您应该看到类似以下内容的输出（斜体化的 ID 标签在您的输出中将是不同的）：

```
250 Ok: queued as *1242EC119*
```

```
quit
```

```
# perl -MMIME::Base64 -e 'print encode_base64("\0 username\0 password")' 
*AHVzZXJuYW1lAHBhc3N3b3Jk* 
```

请确保将此字符串准确地记录下来，您稍后需要输入它。

```
# openssl s_client -starttls smtp -crlf -connect localhost:25

CONNECTED(00000003)...
...SSL-Session:
    Protocol  : TLSv1
    Cipher    : DHE-RSA-AES256-SHA
    Session-ID: 3886C410C971913F87CA439B92FA7ED67CFFEE7D3...
    Session-ID-ctx:
    Master-Key: B9F96FB08D2E7C86B2454C7553F0F84D1C2DD3B3...
    Key-Arg   : None
    Start Time: 1196074152
    Timeout   : 300 (sec)
    Verify return code: 19 (self signed certificate in certificate chain)
---
250 DSN
```

```
AUTH PLAIN AHVzZXJuYW1lAHBhc3N3b3Jk
```

如果身份验证成功，您应该看到以下内容：

```
235 2.0.0 Authentication successful
```

在此阶段，您可以按照 "发送邮件" 中的说明发送测试邮件。

```
# cd /usr/home/username/Maildir/new
# more *
```

您应该看到测试电子邮件的内容。

start

stop

reload

# /usr/local/etc/rc.d/postfix stop

-f

-p

# postqueue -p

# telnet smtp.stanford.edu 25

Trying 171.67.22.28...
Connected to smtp1.stanford.edu.
Escape character is '^]'.
220 smtp1.stanford.edu ESMTP Postfix
# quit

Trying *xx*.*xx*.*xx*.*xx*...

# cd /usr/local/etc/postfix
# cp main.cf main.cf.old
# echo "message_size_limit = xxx" >> main.cf
# /usr/local/etc/rc.d/postfix reload

mailbox_size_limit = 101000000
message_size_limit = 100000000

# cd /usr/ports/mail/procmail
# make config ; make install clean
# rehash

# ee /usr/local/etc/procmailrc

# Environment Variables
MAILDIR=$HOME/Maildir/
DEFAULT=$HOME/Maildir/
DROPPRIVS = yes
LOGFILE=$HOME/proc.log
# Spam to Junk Recipe
:0
*^X-Spam-Status: Yes
.Junk/

# ee /usr/local/etc/postfix/main.cf

mailbox_command = /usr/local/bin/procmail

# postfix reload

# telnet localhost 25 

Connected to localhost.
Escape character is '^]'.
220 *host.example.com * ESMTP Postfix

mail from: test@example.com
250 Ok

rcpt to: spamd@example.com
250 Ok

data 
354 End data with <CR><LF>.<CR><LF>
Subject: This is Spam 
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X 
. 
250 Ok: queued as *1242EC120* 

quit

# cat /var/spool/spamd/proc.log

From test@example.com Mon Nov 17 13:40:00 2008
  Folder: .Junk/new/1195508418.1125_0.host.example.com     2606

# man procmailex

# cd /usr/ports/ftp/pure-ftpd
# make config ; make install clean
# rehash

# cd /usr/local/etc
# cp pure-ftpd.conf.sample pure-ftpd.conf
# ee pure-ftpd.conf

PureDB               /usr/local/etc/pureftpd.pdb

CreateHomeDir        yes

```
TLS                 1
```

```
# cd /usr/local/openssl/certs
# cp host.example.com-unencrypted-key.pem pure-ftpd.pem
# chmod 400 pure-ftpd.pem
# cat host.example.com-cert.pem >> pure-ftpd.pem
# mkdir /etc/ssl/private
# mv pure-ftpd.pem /etc/ssl/private
```

* * *

***注意：*** 将上述文件名替换为您使用 OpenSSL 创建服务器密钥和证书文件时使用的命名约定（请参阅 "OpenSSL 0.9.8g"）。

* * *

[host.example.com-unencrypted-key.pem](http://host.example.com-unencrypted-key.pem) 您服务器的未加密私钥文件

[host.example.com-cert.pem](http://host.example.com-cert.pem) 您服务器的公共证书文件

[/etc/ssl/private/pure-ftpd.pem](http:///etc/ssl/private/pure-ftpd.pem) Pure-FTPd 在此处查找 SSL 证书

```
# pure-pwconvert >> /usr/local/etc/pureftpd.passwd
# chmod 600 /usr/local/etc/pureftpd.passwd
# pure-pw mkdb
```

* * *

***注意：*** 此实用程序只会导入具有 shell 访问权限的账户。如果账户的 shell 设置为`*nologin*`，则需要手动添加。

* * *

```
# pw user add vftp -s /sbin/nologin -w no -d /usr/home/vftp\
? -c "Virtual FTP User" -m
```

现在我们可以使用以下命令将用户添加到虚拟用户数据库。将`*user*`替换为您想要创建的用户名。

```
# pure-pw useradd user -u vftp -g vftp -d /usr/home/vftp/user
# pure-pw mkdb
```

要添加更多用户，只需使用不同的用户重复上述命令即可。

```
# pw user add ftp -s /sbin/nologin -w no -d /usr/home/ftp\
? -c "Anonymous FTP User" -m
# rm /usr/home/ftp/.??*
```

您可以在/usr/home/ftp 中创建您选择的目录结构。要创建匿名用户可以上传到的目录，请在目录上使用 777 权限。对于文件的只读访问，使用 444 权限。对于目录的只读访问，使用 555 权限。

例如，您可以为目录/usr/home/ftp/upload 允许上传访问。以下命令将使主目录只读，创建上传目录，并授予匿名用户在该目录的写权限：

```
# chmod 555 /usr/home/ftp
# mkdir /usr/home/ftp/upload
# chmod 777 /usr/home/ftp/upload
```

* * *

***注意：*** 请务必监控/usr/home/ftp/upload 目录中的文件，因为如果用户在该目录放置非法内容，您可能会承担责任。请查阅/usr/local/etc 中的 pure-ftpd.conf 文件以获取匿名登录相关选项。有关设置文件所有权和权限的详细信息，请参阅"chown"和"chmod"。

* * *

# /usr/local/etc/rc.d/pure-ftpd onestart

# ftp localhost

Connected to host.example.com.
220---------- Welcome to Pure-FTPd [TLS] ----------
220-You are user number 1 of 50 allowed.
220-Local time is now 15:16\. Server port: 21.
220-IPv6 connections are also welcome on this server.
220 You will be disconnected after 15 minutes of inactivity.
Name (host.example.com:user):

# ee /etc/rc.conf

pureftpd_enable="YES"

# /usr/local/etc/rc.d/pure-ftpd restart
# /usr/local/etc/rc.d/pure-ftpd status

useradd

usermod

userdel

passwd

show

list

mkdb

-u

-g

-d

# pure-pw userdel jill
# pure-pw mkdb

# pure-pw passwd jack
# pure-pw mkdb

-v

# pure-ftpwho -v

# cd /usr/home/vftp/michelle
# ln -s /usr/local/www/data-dist www

# man pure-ftpd

# cd /usr/ports/net/samba3
# make config ; make install clean
# rehash

# ee /usr/local/etc/smb.conf

workgroup = EXAMPLE

server string = *Example FileServer*

hosts allow = 192.168.1\. 127.

[*public*]                       /* name of the share */
comment = Public Files         /* a short description of the share */
path = */usr/home/samba/*public  /* path of shared directory */
public = yes                   /* password is not required to connect */
read only = no                 /* users may create, modify, and delete files */

[*private*]                       /* name of the share */
comment = Private Files         /* a short description of the share */
path = */usr/home/samba/*private  /* path of shared directory */
valid users = *john jane*         /* users allowed to access this share */
public = no                     /* password required to access this share */
writable = yes                  /* users may create, modify, and delete */
                                /* files they own */

[*readonly*]                        /* name of share */
comment = *Read Only Shares*        /* a short description of the share */
path = */usr/home/samba/*readonly   /* path of shared directory */
public = yes                      /* password is not required to connect */
write list = *bert ernie*           /* users allowed write access */
writable = yes                    /* write list users may create, modify, */
                                  /* and delete files they own */

# testparm

# chmod 777 /usr/home/samba/public

# pw groupadd smbprivate -M john,jane
# chgrp smbprivate /usr/home/samba/private
# chmod 770 /usr/home/samba/private

# pw groupadd smbreadonly -M bert,ernie
# chgrp smbreadonly /usr/home/samba/readonly
# chmod 770 /usr/home/samba/readonly

# smbpasswd -a username

Added user *username*

# /usr/local/etc/rc.d/samba onestart

# smbclient -U username -L localhost

# smbclient -U username //localhost/sharename

# ee /etc/rc.conf

samba_enable="YES"

# /usr/local/etc/rc.d/samba restart
# /usr/local/etc/rc.d/samba status

-a

-x

-d

-e

# smbpasswd -a jake

# smbpasswd -d webster

-a

-u

-f

-v

-L

-x

-P

-C

# pdbedit -a -u john -f "John Doe"

# pdbedit -L -v

# pdbedit -P "min password length"

# pdbedit -P "min password length" -C 8

# man pdbedit

# ee /etc/inetd.conf

swat  stream  tcp  nowait/400  root  /usr/local/sbin/swat  swat

# /etc/rc.d/inetd onestart

# /etc/rc.d/inetd stop

inetd_enable="YES"

# ee /usr/local/etc/smb.conf

[printers] valid users = username

# /usr/local/etc/rc.d/samba restart

# ee /usr/local/etc/cups/cupsd.conf

<Location /printers>
Order Deny,Allow
Deny From All
Allow From 127.0.0.1
</Location>

# /usr/local/etc/rc.d/cupsd restart

# cd /usr/ports/mail/p5-Mail-SpamAssassin
# make config ; make -D WITH_DCC install clean
# rehash

# cd /usr/ports/mail/dcc-dccd
# make config ; make -D WITHOUT_SENDMAIL install clean
# rehash

# razor-admin -home=/var/spool/spamd/.razor -create
# razor-admin -home=/var/spool/spamd/.razor\
? -register -user=postmaster@example.com
# chown -R spamd /var/spool/spamd/.razor

# cd /usr/local/etc/mail/spamassassin
# ee local.cf

trusted_networks *192.168.1\. 209.85.146.176/29 204.13.250.97*
internal_networks *192.168.1.11 204.13.250.97*
bayes_file_mode 0770
dns_available yes
razor_config /var/spool/spamd/.razor/razor-agent.conf
add_header all DCC _DCCB_ _DCCR_
add_header ham SCL 1
add_header spam SCL 9

# spamassassin --lint

# perldoc Mail::SpamAssassin::Conf

# cd /usr/local/bin
# touch spamd.sh
# chmod 555 spamd.sh
# ee spamd.sh

#! /bin/sh
/usr/local/bin/spamc | /usr/sbin/sendmail -i "$@"

# ee /usr/local/etc/postfix/master.cf

smtp      inet  n       -       n       -       -       smtpd
 -o content_filter=spamd:

spamd      unix    -       n       n       -       -       pipe
  flags=Rq user=spamd argv=/usr/local/bin/spamd.sh
  -f ${sender} -- ${recipient}

# postfix reload

# ee /etc/rc.conf

spamd_enable="YES"
spamd_flags="-u spamd -H /var/spool/spamd"

# /usr/local/etc/rc.d/sa-spamd start

# telnet localhost 25 

Connected to localhost.
Escape character is '^]'.
220 *host.example.com * ESMTP Postfix

mail from: test@example.com
250 Ok
rcpt to: spamd@example.com
250 Ok

data 
354 End data with <CR><LF>.<CR><LF>
Subject: This is Spam 
XJS*C4JDBQADN1.NSBN3*2IDNEN*GTUBE-STANDARD-ANTI-UBE-TEST-EMAIL*C.34X 
. 
250 Ok: queued as *1242EC119* 

quit

# cd /var/spool/spamd/Maildir/new
# cat * | more

Return-Path: <test@example.com>
X-Original-To: spamd@example.com
Delivered-To: spamd@example.com
Received: by host.example.com (Postfix, from userid 58)
        id 590631171D; Sat, 01 Mar 2008 12:00:04 -0700 (PDT)
Received: from localhost by host.example.com
        with SpamAssassin (version 3.2.4);
        Sat, 01 Mar 2008 12:00:04 -0700
From: test@example.com
To: undisclosed-recipients:;
Subject: This is Spam
Date: Sat, 01 Mar 2008 11:59:37 -0700 (PDT)
Message-Id: <20070630185947.811351171B@host.example.com>
*X-Spam-DCC:  host.example.com 1049; Body=many Fuz1=many*
*X-Spam-Flag: YES*
*X-Spam-Checker-Version: SpamAssassin 3.2.4 (2008-03-01) on host.example.com*
*X-Spam-Level: ***************************************************
*X-Spam-Status: Yes, score=1007.0 required=5.0
tests=ALL_TRUSTED,AWL,DCC_CHECK,
DIGEST_MULTIPLE,DKIM_POLICY_SIGNSOME,DNS_FROM_AHBL_RHSBL,DNS_FROM_RFC_DSN,
DNS_FROM_SECURITYSAGE,GTUBE,RAZOR2_CF_RANGE_51_100,RAZOR2_CF_RANGE_E4_51_100,*
*RAZOR2_CHECK autolearn=no version=3.2.4*
MIME-Version: 1.0

--channel

--nogpg

# sa-update
# /usr/local/etc/rc.d/sa-spamd restart

# sa-update
# sa-update --channel 70_sare_adult.cf.sare.sa-update.dostech.net --nogpg
# /usr/local/etc/rc.d/sa-spamd restart

--ham

--spam

--dbpath

--progress

--dump

# sa-learn --spam * --progress --dbpath /var/spool/spamd/.spamassassin

# sa-learn --ham /usr/home/john/Maildir/cur --progress \?
--dbpath /var/spool/spamd/.spamassassin

# sa-learn --dump magic --dbpath /var/spool/spamd/.spamassassin

# cd /var/spool/spamd/.spamassassin
# touch user_prefs
# chown spamd:spamd user_prefs
# chmod 440 user_prefs
# ee user_prefs

whitelist_from vip@example.com
whitelist_auth *@gmail.com

# cat /usr/home/john/Maildir/.Junk/cur/*
| razor-report \
? -home=/var/spool/spamd/.razor

# cd /usr/ports/mail/squirrelmail
# make config ; make install clean

# ee /usr/local/etc/php.ini

upload_max_filesize = 8M

# cd /usr/local/www/squirrelmail
# ./configure

[2] Server Settings
    [1] Domain

[2] Server Settings
    [A] Update IMAP Settings
        [8] Server Software

# ee /usr/local/etc/apache22/Includes/squirrelmail.conf

Alias /*squirrelmail* "/usr/local/www/squirrelmail/"

<Directory "/usr/local/www/squirrelmail/">
Options None
AllowOverride None
Order allow,deny
Allow from all
</Directory>

# /usr/local/etc/rc.d/apache22 restart

# ee /usr/local/etc/apache22/Includes/squirrelmail.conf

Alias /*squirrelmail* "/usr/local/www/squirrelmail/"

<Directory "/usr/local/www/squirrelmail/">
Options None
AllowOverride None
Order Allow,Deny
Allow from All
</Directory>

<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteCond %{REQUEST_URI} /*squirrelmail*
RewriteRule (.*) https://*host.example.com*/*squirrelmail*/ [R]
</IfModule>

# /usr/local/etc/rc.d/apache22 restart

# pkg_info | grep php5-ldap

# cd /usr/ports/mail/squirrelmail
# make deinstall
# make -D WITH_LDAP install clean

# cd /usr/local/www/squirrelmail
# ./configure

[6] Address Books
    [1] Change LDAP Servers

[ldap] command (?=help) > +
hostname: localhost
base: ou=People,dc=example,dc=com
port: press [enter]
charset: press [enter]
name: LDAP: example.com
maxrows: press [enter]
binddn: press [enter]
protocol: 3
[ldap] command (?=help) > d

# mysql -u root -p
mysql> create database wordpress;
mysql> grant all on wordpress.* to
    -> wordpress@localhost identified by 'password';
mysql> quit

# cd /usr/ports/www/wordpress

# make config ; make install clean

# cd /usr/local/www/data/wordpress
# cp wp-config-sample.php wp-config.php
# chmod 640 wp-config.php
# ee wp-config.php

define('DB_NAME', '*wordpress*');     // The name of the database
define('DB_USER', '*wordpress*');     // Your MySQL username
define('DB_PASSWORD', '*password*');  // ...and password

# ee /usr/local/etc/apache22/Includes/wordpress.conf

Alias /*wordpress* "/usr/local/www/data/wordpress/"

<Directory "/usr/local/www/data/wordpress/">
Options Indexes FollowSymLinks
AllowOverride All
Order allow,deny
Allow from all
</Directory>

# /usr/local/etc/rc.d/apache22 restart

-a

-l

-d

-h

-F

-rw-rw-r--    2 root   wheel      45463 Sep  26 03:20 example.doc
drwxr-xr-x    1 john   user         512 May  20 18:06 Maildir
  ^|_||_||_|    ^   ^    |____|     |___| |_____| |___| |________|
  | |  |  |     |   |      |          |      |      |      |
  | |  |  |     | owner  group       size   date  time    name
  | |  |  |     # of links to file or directory
  | |  |  world permissions
  | |  group permissions
  | owner permissions [r = read] [w = write] [x = execute] [- no permission]
  type of file [- = normal file] [d = directory] [l = symbolic link]

# ls -al

# ls -d /u*

# ls -ald *.txt

# cd test

# cd /

# cd /usr/local/www

-i

-R

-p

# cp example.doc newexample.doc

# cp example.doc /usr/local/www

# cp -R -p logs archive

# mkdir documents

# mkdir /usr/home

-i

-r

# rm -r tmp

# rm example.doc

# rm -i /usr/local/www/*.doc

-i

# mv -i /usr/local/www/example.doc ~

# mv foobar.conf apache.conf

# mv www cgi-bin

# ee filename

-name

-user

-group

# find /usr -name "*.doc"

# find / -name example.doc

# find . -name example.doc

# find /usr -user john

# file example.mov

# file *

-N

-M

# less example.txt

# less -NM /etc/services
1 #
2 # Network services, Internet style
3 #
4 # Note that it is presently the policy of IANA to assign a single...
5 # port number for both TCP and UDP; hence, most entries here have...
6 # even if the protocol doesn't support UDP operations.
7 #
8 # The latest IANA port assignments can be gotten from
9 #
10 #       http://www.iana.org/assignments/port-numbers
/etc/services lines 1-10/2114 0%

# ls -l /usr/lib | less

# grep server apache.conf

# ls -l / | grep usr

# cat /COPYRIGHT | grep "All rights reserved"

# su

# chown john example.doc

# chown :user Maildir

# chown root:wheel apache.conf

# chown -R john www

-rwxr-xr--    2 root   wheel      45463 Sep  26 03:20 example.doc
 |_||_||_|
  |  |  |
  |  |  r-- [r=4] = 4 = third digit (world/anybody permission)
  |  r-x [r=4]+[x=1] = 5 = second digit (group permission)
  rwx [r=4]+[w=2]+[x=1] = 7 = first digit (owner permission)

# chmod 777 example.doc

# chmod 740 www

# df -h

-d

-c

-h

-a

# du -d 1 -h /usr

# du -ca

-t

# mount -t cd9660 /dev/acd0 /mnt

# mount /dev/ad0s1a /mnt

# umount /mnt

-a

-l

-d

-h

-F

-rw-rw-r--    2 root   wheel      45463 Sep  26 03:20 example.doc
drwxr-xr-x    1 john   user         512 May  20 18:06 Maildir
  ^|_||_||_|    ^   ^    |____|     |___| |_____| |___| |________|
  | |  |  |     |   |      |          |      |      |      |
  | |  |  |     | owner  group       size   date  time    name
  | |  |  |     # of links to file or directory
  | |  |  world permissions
  | |  group permissions
  | owner permissions [r = read] [w = write] [x = execute] [- no permission]
  type of file [- = normal file] [d = directory] [l = symbolic link]

# ls -al

# ls -d /u*

# ls -ald *.txt

# cd test

# cd /

# cd /usr/local/www

-i

-R

-p

# cp example.doc newexample.doc

# cp example.doc /usr/local/www

# cp -R -p logs archive

# mkdir documents

# mkdir /usr/home

-i

-r

# rm -r tmp

# rm example.doc

# rm -i /usr/local/www/*.doc

-i

# mv -i /usr/local/www/example.doc ~

# mv foobar.conf apache.conf

# mv www cgi-bin

# ee filename

-name

-user

-group

# find /usr -name "*.doc"

# find / -name example.doc

# find . -name example.doc

# find /usr -user john

# file example.mov

# file *

-N

-M

# less example.txt

# less -NM /etc/services
1 #
2 # Network services, Internet style
3 #
4 # Note that it is presently the policy of IANA to assign a single...
5 # port number for both TCP and UDP; hence, most entries here have...
6 # even if the protocol doesn't support UDP operations.
7 #
8 # The latest IANA port assignments can be gotten from
9 #
10 #       http://www.iana.org/assignments/port-numbers
/etc/services lines 1-10/2114 0%

# ls -l /usr/lib | less

# grep server apache.conf

# ls -l / | grep usr

# cat /COPYRIGHT | grep "All rights reserved"

# su

# chown john example.doc

# chown :user Maildir

# chown root:wheel apache.conf

# chown -R john www

-rwxr-xr--    2 root   wheel      45463 Sep  26 03:20 example.doc
 |_||_||_|
  |  |  |
  |  |  r-- [r=4] = 4 = third digit (world/anybody permission)
  |  r-x [r=4]+[x=1] = 5 = second digit (group permission)
  rwx [r=4]+[w=2]+[x=1] = 7 = first digit (owner permission)

# chmod 777 example.doc

# chmod 740 www

# df -h

-d

-c

-h

-a

# du -d 1 -h /usr

# du -ca

-t

# mount -t cd9660 /dev/acd0 /mnt

# mount /dev/ad0s1a /mnt

# umount /mnt

-0

-a

-L

-f

# dump -0 -a -L -f usr.dump /usr

# dump -0 -a -L -f root.dump /

-c

-x

-t

-z

-r

-f

# tar -c -z -f usr.tgz /usr

# tar -x -z -f usr.tgz

# tar -r -f archive.tar example.xxx

-i

-r

-f

# restore -i -f usr.dump

restore > add filename

-l

-c

-4

-6

# sockstat -l

# sockstat | grep httpd

# sockstat | grep 443

inet

netmask

# ifconfig xl0 inet 192.168.0.12 netmask 255.255.255.0

-c

# ping -c5 example.com

-f

-r

-rs

# netstat -r

# netstat -f inet

# dig @ns2.foo.com example.com

# dig @69.72.158.226 example.com mx

-n

# traceroute www.example.com

# whatis ftp

ftp(1)        - Internet file transfer program
ftp-proxy(8)  - Internet File Transfer Protocol proxy server
smbclient(1)  - ftp-like client to access SMB/CIFS resources on servers
Net::Cmd(3)   - Network Command class (as used by FTP, SMTP etc)
Net::FTP(3)   - FTP Client class

# df
Filesystem  1K-blocks    Used    Avail Capacity  Mounted on
/dev/ad0s1a    253678  119942   113442    51%    /
devfs               1       1        0   100%    /dev
/dev/ad0s1e   2026030      12  1863936     0%    /tmp
/dev/ad0s1f  24767644 1572648 21213586     7%    /usr
/dev/ad0s1d   1012974   60350   871588     6%    /var
/dev/ad1s1d  37846636 1914068 32904838     5%    /backup

# dump -0 -a -L -f /backup/root.ad0s1a.dump /
# dump -0 -a -L -f /backup/var.ad0s1d.dump /var
# dump -0 -a -L -f /backup/usr.ad0s1f.dump /usr

# df
Filesystem  1K-blocks    Used    Avail Capacity  Mounted on
/dev/ad0s1a    253678  119942   113442    51%    /
devfs               1       1        0   100%    /dev
/dev/ad0s1e   2026030      12  1863936     0%    /tmp
/dev/ad0s1f  24767644 1572648 21213586     7%    /usr
/dev/ad0s1d   1012974   60350   871588     6%    /var
/dev/ad1s1d  37846636 1914068 32904838     5%    /backup

# dump -0 -a -L -f /backup/root.ad0s1a.dump /
# dump -0 -a -L -f /backup/var.ad0s1d.dump /var
# dump -0 -a -L -f /backup/usr.ad0s1f.dump /usr

# mount /dev/ad1s1d /tmp
# cd /mnt
# restore -r -f /tmp/backup/root.ad0s1a.dump
# cd /mnt/var
# restore -r -f /tmp/backup/var.ad0s1d.dump
# cd /mnt/usr
# restore -r -f /tmp/backup/usr.ad0s1f.dump

# ee /etc/fstab

# Device        Mountpoint    FStype  Options      Dump    Pass#
/dev/ad0s1b     none          swap    sw           0       0
/dev/ad0s1a     /             ufs     rw           1       1
/dev/ad0s1e     /tmp          ufs     rw           2       2
/dev/ad0s1f     /usr          ufs     rw           2       2
/dev/ad0s1d     /var          ufs     rw           2       2
/dev/acd0       /cdrom        cd9660  ro,noauto    0       0
/dev/ad1s1d     /backup       ufs     rw           2       2

# adduser
Username: john

Full name: John Doe

Uid (Leave empty for default):

Login group [john]:

Login group is john. Invite john into other groups? []:

Login class [default]:

Shell (sh csh tcsh nologin) [sh]:

Home directory [/home/john]:

Use password-based authentication? [yes]:

Use an empty password? (yes/no) [no]:

Use a random password? (yes/no) [no]:

Enter password:
Enter password again:

Lock out the account after creation? [no]:

Username   : john
Password   : *****
Full Name  : John Doe
Uid        : 1002
Class      :
Groups     : john
Home       : /home/john
Shell      : /bin/sh
Locked     : no
OK? (yes/no): yes

# adduser
Username: john

Full name: John Doe

Uid (Leave empty for default):

Login group [john]:

Login group is john. Invite john into other groups? []:

Login class [default]:

Shell (sh csh tcsh nologin) [sh]:

Home directory [/home/john]:

Use password-based authentication? [yes]:

Use an empty password? (yes/no) [no]:

Use a random password? (yes/no) [no]:

Enter password:
Enter password again:

Lock out the account after creation? [no]:

Username   : john
Password   : *****
Full Name  : John Doe
Uid        : 1002
Class      :
Groups     : john
Home       : /home/john
Shell      : /bin/sh
Locked     : no
OK? (yes/no): yes

# ps | grep sh

# setenv EDITOR ee

# EDITOR=ee ; export EDITOR

# chpass john

#Changing user information for john.
Login: john
Password: $1$/q2SQ1Aa$vxTRAUvI0yvdhPryn7r/L/
Uid [#]: 1002
Gid [# or name]: 1002
Change [month day year]:
Expire [month day year]:
Class:
Home directory: /home/john
Shell: /bin/sh
Full Name: John Doe
Office Location:
Office Phone:
Home Phone:
Other information:

# passwd john

Changing local password for john
New Password:
Retype New Password:

# rmuser john

Matching password entry:

john:*:1002:1002::0:0:John Doe User:/home/john:/bin/sh

Is this the entry you wish to remove?

Remove john's home directory (/home/john)? y
Removing user (john): mailspool home passwd.

# ee /usr/share/skel/dot.profile

EDITOR=ee;      export EDITOR

TCP/IP LAYER            PROTOCOLS
 (4) Application Layer       DHCP, DNS, FTP, HTTP, IMAP, POP3, SMTP
 (3) Host-to-Host Layer      TCP, UDP
 (2) Internetwork Layer      ARP, IP, ICMP
 (1) Network Access Layer    ETHERNET, WIFI

FTP Server (port 21) <----control----- FTP Client (port 21)
FTP Server (port 20) ------data------> FTP Client (random port >1023)

FTP Server (port 21) <----control----- FTP Client (port 21)
FTP Server (random port >1023) <--data-- FTP Client (random port >1023)

TCP/IP LAYER            PROTOCOLS
 (4) Application Layer       DHCP, DNS, FTP, HTTP, IMAP, POP3, SMTP
 (3) Host-to-Host Layer      TCP, UDP
 (2) Internetwork Layer      ARP, IP, ICMP
 (1) Network Access Layer    ETHERNET, WIFI

FTP Server (port 21) <----control----- FTP Client (port 21)
FTP Server (port 20) ------data------> FTP Client (random port >1023)

FTP Server (port 21) <----control----- FTP Client (port 21)
FTP Server (random port >1023) <--data-- FTP Client (random port >1023)

`最小密码年龄`	`不良锁定尝试`
`最大密码年龄`	`重置计数分钟`
---	---
`最小密码长度`	`断开连接时间`
---	---
`密码历史`	`用户必须登录才能更改密码`
---	---
`锁定持续时间`	`拒绝机器密码更改`
---	---

掠夺·扩张·投机·博弈

FreeBSD7 服务器构建指南（全）

如何使用本书

格式

WHERE TO START

BECOMING THE SUPERUSER

EASY EDITOR

第一部分：基础系统

第一章. FREEBSD 7.0

1.1. 摘要

1.1.1. 许可证

1.1.2. 端口集合

1.1.3. FreeBSD 的根源，简要介绍

第一部分：基础系统

第一章. FREEBSD 7.0

1.1. 摘要

1.1.1. 许可证

1.1.2. 端口集合

1.1.3. FreeBSD 的根源，简要介绍

第一部分：基础系统

第一章. FREEBSD 7.0

1.1. 总结

1.1.1. 许可证

1.1.2. Ports 收集

1.1.3. FreeBSD 的根源，简要概述

1.2. 资源

1.3. 必需项

1.4. 可选项

1.5. 准备

1.6. 安装

1.7. 配置

1.7.1. 登录

1.7.2. 默认搜索路径

1.7.3. 限制 SSH 访问

1.7.4. 关闭系统

1.7.5. 重新启动

1.8. 配置静态 IP

1.8.1. A. 位于 NAT 路由器后的 FreeBSD 服务器

1.8.2. B. 直接连接到互联网的 FreeBSD 服务器

1.8.3. 动态 DNS

1.9. 主机文件和 resolv.conf

1.9.1. hosts

1.9.2. resolv.conf

1.10. 配置文件

1.11. 注意事项

第二章. FREEBSD 端口集合

FreeBSD 端口

2.1. 概述

第二章. FREEBSD 端口集合

2.1. 摘要

2.2. 资源

2.3. 需要的

2.4. 准备

2.5. 安装

2.6. 配置

2.6.1. portmaster

2.6.2. 端口审计

2.7. 工具

2.7.1. pkg_info

2.7.2. pkg_delete

2.8. CONFIG 文件

2.8.1. ports-supfile

2.9. 备注

第二部分：第三方应用

第三章. APACHE HTTP SERVER 2.2.8

3.1. 摘要

第二部分：第三方应用

第三章. APACHE HTTP SERVER 2.2.8

3.1. 摘要

第二部分：第三方应用

第三章. APACHE HTTP SERVER 2.2.8

3.1. 摘要

3.2. 资源

3.3. 必需的

3.4. 可选

3.5. 准备

3.6. 安装

3.7. 配置

3.8. 测试

3.9. 工具