FreeBSD configuration File

Continuing in /etc/defaults/rc.conf,

nisdomainname="NO"    # Set to NIS domain if using NIS (or NO).

If you're using Sun's NIS, set this. We don't discuss NIS in this book.

dhcp_program="/sbin/dhclient"  # Path to dhcp client program.
dhcp_flags=" "                 # Additional flags to pass to dhcp client.

The settings for the DHCP client, dhclient. Normally you won't need to change them. We talked about DHCP on page 302.

firewall_enable="NO"                # Set to YES to enable firewall functionality
firewall_script="/etc/rc.firewall"  # Which script to run to set up the firewall
firewall_type="UNKNCWN"             # Firewall type (see /etc/rc.firewall)
firewall_quiet="NO"                 # Set to YES to suppress rule display
firewall_logging="NO"               # Set to YES to enable events logging

Parameters for the ipfw firewall. See page 389, where we set the following flags in the /etc/rc.conf for gw:

firewall_enable="YES"   # Set to YES to enable firewall functionality
firewall_type="client"  # Firewall type (see /etc/rc.firewall)

You don't normally run firewalls on laptops, though there's no technical reason why not. The problem with firewalls on laptops is that the configuration files are dependent on where the system is located, which makes it a pain for systems that frequently change locations. As a result, we won't add any firewall parameters to the /etc/rc.conf for andante.

ip_portrange_first="NO"  # Set first dynamically allocated port
ip_portrange_last="NO"   # Set last dynamically allocated port

These values are used to set the numbers of ports that are dynamically allocated. Normally they won't need changing.

ipsec_enable="NO"             # Set to YES to run setkey on ipsec_file
ipsec_file="/etc/ipsec.conf"  # Name of config file for setkey

Parameters for IPSec. We don't discuss IPSec in this book.

natd_program="/sbin/natd"  # path to natd, if you want a different one.
natd_enable="NO"           # Enable natd (if firewall_enable == YES).
natd_interface=" "         # Public interface or IPaddress to use.
natd_flags=" "             # Additional flags for natd.

Parameters for natd. See page 395 for more details. In the example there, we'll add these lines to gw's /etc/rc.conf:

firewall_enable=YES
gateway_enable="YES"           # Set to YES if this host is a gateway.
natd_enable="YES"
natd_interface="dc0"
firewall_script="/etc/rc.nat"  # script for NAT only
firewall_type="client"         # firewall type if running a firewall

Continuing with /etc/defaults/rc.conf,

ipfilter_enable="NO"             # Set to YES to enable ipfilter functionality
ipfilter_program="/sbin/ipf"     # where the ipfilter program lives
ipfilter_rules="/etc/ipf.rules"  # rules definition file for ipfilter, see 
                                           # /usr/src/contrib/ipfilter/rules for examples
ipfilter_flags=" "               # additional flags for ipfilter
ipnat_enable="NO"                # Set to YES to enable ipnat functionality
ipnat_program="/sbin/ipnat"      # where the ipnat program lives
ipnat_rules="/etc/ipnat.rules"   # rules definition file for ipnat
ipnat_flags=" "                  # additional flags for ipnat
ipfs_enable="NO"                 # Set to YES to enable saving and restoring
ipfs_program="/sbin/ipmon"       # where the ipfilter monitor program lives
ipmon_flags="-Ds"                # typically "-Ds" or "-D /var/log/ipflog"
ipfs_enable="NO"                 # Set to YES to enable saving and restoring
                                           #ofstate tables at shutdown and boot
ipfs_program="/sbin/ipfs"        #where the ipfs program lives
ipfs_flags=" "                   #additional flags for ipfs

These entries define defaults for ipfilter, another firewall package, ipnat, another NAT package, ipmon, an IP monitor package, and ipfs, a utility for saving the state tables of ipfilter, ipnat and ipfilter. We don't discuss any of them in this book.

tcp_extensions="NO"      # Disallow RFC1323 extensions (or YES).
log_in_vain="0"          # >=1 to log connects to ports w/o listeners.
tcp_keepalive="YES"      # Enable stale TCP connection timeout (or NO).
#For the following option you need to have TCP_DROP_SYNFIN set in your
#kernel. Please refer to LINT and NOTES for details.
tcp_drop_synfin="NO"     # Set to YES to drop TCP packets with SYN+FIN
                                   # NOTE: this violates the TCP specification
icnp_drop_redirect="NO"  # Set to YES to ignore ICMP REDIRECT packets
icmp_log_redirect="NO"   # Set to YES to log ICMP REDIRECT packets

These are some of the more obscure IP configuration variables. You can find more about them in tcp(4) and icmp(4).

network_interfaces="auto"            # List of network interfaces (or "auto").
cloned_interfaces=" "                # List of cloned network interfaces to create.
# cloned_interfaces="gif0 gif1 gif2 gif3"  # Pre-cloning GENERIC config.
ifconfig_lo0="inet 127.0.0.1"        #default loopback device configuration.
# ifconfig_lo0_alias0="inet 127.0.0.254 netmask Oxffffffff"  # Sample alias entry.
# ifconfig_ed0_ipx="ipx 0x00010010"  #Sample IPX address family entry

In previous releases of FreeBSD, you had to set network_interfaces to a list of the interfaces on the machine. Nowadays the value auto enables the startup scripts to find them by themselves, so you don't need to change this variable. You still need to set the interface addresses, of course. For gw, we add the following entry to /etc/rc.conf:

If config_ed0="inet 223.147.37.5    netmask 255.255.255.0"

We don't need to do anything here for andante: its Ethernet interface is a PC Card card. We looked at that on page 304.

If you're using DHCP, you don't have an address to specify, of course. You still need to tell the startup scripts to use DHCP, however. Do it like this:

If config_ed0="DHCP" 

Continuing,

#If you have any sppp(4) interfaces above, you might also want to set
#the following parameters. Refer to spppcontrol(8) for their meaning
sppp_interfaces=""           # List of sppp interfaces.
#sppp_interfaces="isp0"      # example: sppp over ISDN
#spppconfig_isp0="authproto=chap myauthname=foo myauthsecret='top secret' hisauthnam
e=some-gw hisauthsecret='another secret'"
gif_interfaces="NO"          # List of GIF tunnels (or "NO").
#gif_interfaces="gif0 gifl"  # Exanples typically for a router.
                                       # Choose correct tunnel addrs.
#gifconfig_gif0="10.1.1.1 10.1.2.1"    #Examples typically for a router.
#gifconfig_gif1="10.1.1.2 10.1.2.2"    #Examples typically for a router.

These are parameters for the sppp implementation for isdn4bsd and the Generic Tunnel Interface, both of which we won't discuss here. See the man pages spp(4) and gif(4) for more details.

#User ppp configuration.
ppp_enable="NO"        # Start user-ppp (or NO).
ppp_mode="auto"        # Choice of "auto", "ddial", "direct" or "dedicated".
                                 # For details see man page for ppp(8). Default is auto.
ppp_nat="YES"          # Use PPP's internal network address translation or NO.
ppp_profile="papchap"  # Which profile to use from /etc/ppp/ppp.conf
ppp_user="root"        # Which user to run ppp as

These parameters relate to running user PPP, which we discussed in Chapter 20, on page 348.

### Network daemon (miscellaneous) ###
syslogd_enable="YES"  # Run syslog daemon (or NO).
syslogd_program="/usr/sbin/syslogd" # path to syslogd, if you want a different one.
syslogd_flags="-s"    # Flags to syslogd (if enabled).
#syslogd_flags="-ss"  # Syslogd flags to not bind an inet socket

You should always run syslogd unless you have a very good reason not to. In previous releases of FreeBSD, syslogd_flags was empty, but security concerns have changed that, and now by default syslogd is started with the -s flag, which stops syslogd from accepting remote messages. If you specify the -ss flag, as suggested in the comment, you will also not be able to log to remote systems.

Sometimes it's very useful to log to a remote system. For example, you might want all systems in example.org to log to gw. That way you get one set of log files for the entire network. To do this, you would add the following line at the beginning of /etc/syslog.conf on each machine:

*.*             @gw

For this to work, add the following to /etc/rc.conf on gw:

syslogd_flags=""

Next come some parameters relating to inetd, the Internet Daemon, sometimes called the super-server. It's responsible for starting services on behalf of remote clients.

inetd_enable="NO"                # Run the network daemon dispatcher (YES/NO).
inetd_program="/usr/sbin/inetd"  # path to inetd, if you want a different one.
inetd_flags=" wW"                # Optional flags to inetd

We looked at inetd on page 448. Normally you will want to have it enabled, but you won't need to change the fags. Add this line to the /etc/rc.conf for both gw and andante:

inetd_enable="YES"

Continuing, we see:

named_enable="NO"                # Run named, the DNS server (or NO).
named_program="/usr/sbin/named"  # path to named, if you want a different one.
#named_flags="-u bind -g bind"   #Flags for named

These parameters specify whether we should run the name server, and what flags we should use if we do. See page 366 for more details. Previous versions of named required a flag to specify the location of the configuration file, but the location FreeBSD uses has now become the standard, so we no longer need to specify any flags. All we put in /etc/rc.conf for gw is:

named_enable="YES"    # Run named, the DNS server (or NO). 

Continuing with /etc/defaults/rc.conf,

kerberos4_server_enable="NO"             # Run a kerberos IV master server (or NO).
kerberos4_server="/usr/sbin/kerberos"    # path to kerberos IV KDC
kadmind4_server_enable="NO"              # Run kadmind (or NO)
kadmind4_server="/usr/sbin/kadmind"      # path to kerberos IV admin daemon
kerberos5_server_enable="NO"             # Run a kerberos 5 master server (or NO).
kerberos5_server="/usr/libexec/kdc"      # path to kerberos 5 KDC
kadmind5_server_enable="NO"              # Run kadmind (or NO)
kadmind5_server="/usr/libexec/k5admind"  # path to kerberos 5 admin daemon
kerberos_stash="NO"                           # Is the kerberos master key stashed?

Set these if you want to run Kerberos. We don't discuss Kerberos in this book.

rwhod_enable="NO"  # Run the rwho daemon (or NO).
rwhod_flags=" "    # Flags for rwhod

Set this if you want to run the rwhod daemon, which broadcasts information about the system load.

rarpd_enable="NO"       # Run rarpd (or NO).
rarpd_flags=" "         # Flags to rarpd.
bootparamd_enable="NO"  # Run bootparamd (or NO).
bootparamd_flags=" "    # Flags to bootparamd
xtend_enable="NO"       # Run the X-10 power controller daemon.
xtend_flags=" "         # Flags to xtend (if enabled).

These entries relate to the rarpd, bootparamd and the X-10 daemons, which we don't discuss in this book. See the respective man pages.

pppoed_enable="NO"                     # Run the PPP over Ethernet daemon.
pppoed_provider="* "                   # Provider and ppp(8) config file entry.
pppoed_flags="-P /var/run/pppoed.pid"  #Flags to pppoed (if enabled).
pppoed_interface="fxp0"                # The interface that pppoed runs on.

pppoed is the PPP Over Ethernet daemon. We discussed it briefly on page 348.

sshd_enable="NO"               # Enable sshd
sshd_program="/usr/sbin/sshd"  # path to sshd, if you want a different one.
sshd_flags=" "                 # Additional flags for sshd.

sshd is the Secure Shell Daemon which we talked about on page 453. You don't need to change anything here to run ssh, but if you want to connect to this system with ssh, you'll need to run sshd. In gw's /etc/rc.conf we put:

sshd_enable="YES"

Next, we see:

amd_enable="NO"       # Run amd service with $amd_flags (or NO).
amd_flags="-a /.amd_mnt -l syslog /host /etc/amd.map /net /etc/amd.map"
amd_map_program="NO"  # Can be set to "ypcat -k amd.master"

These entries relate to the automounter, which we don't discuss in this book. See amd(8) for details.

nfs_client_enable="NO"           # This host is an NFS client (or NO).
nfs_access_cache="2"             # Client cache timeout in seconds
nfs_server_enable="NO"           # This host is an NFS server (or NO).
nfs_server_flags="-u -t -n 4"    #Flags to nfsd (if enabled).
mountd_enable="NO"               # Run mountd (or NO).
mountd_flags="r"                 # Flags to mountd (if NFS server enabled).
weak_mountd_authentication="NO"  # Allow non root mount requests to be served.
nfs_reserved_port_only="NO"      # Provide NFS only on secure port (or NO).
nfs_bufpackets="DEFAULT"         # bufspace (in packets) for client (or DEFAULT)
rpc_lockd_enable="NO"            # Run NFS rpclockd needed for client/server.
rpc_statd_enable="NO"            # Run NFS rpcstatd needed for client/server.
rpcbind_enable="NO"              # Run the portmapper service (YES/NO).
rpcbind_program="/usr/sbin/rpcbind"  # path to rpcbind, if you want a different one.
rpcbind_flags=" "                # Flags to rpcbind (if enabled).
rpc_ypupdated_enable="NO"        # Run if NIS master and SecureRPC (or NO)

These are flags for NFS. Some of them have changed from previous releases of FreeBSD. In particular, single_mountd_enable is now called mountd_enable, and portmap has been replaced by rpcbind, so portmap_enable is now called rpcbind_enable, portmap_program is now called rpcbind_program and portmap_flag is now called rpcbind_flags. See page 441. We set the following values in /etc/rc.conf for gw:

nfs_client_enable="YES"  # This host is an NFS client (or NO).
nfs_server_enable="YES"  # This host is an NFS server (or NO).

For andante, we enable only the client (the first line). Next, we see:

keyserv_enable="NO"  # Run the SecureRPC keyserver (or NO).
keyserv_flags=" "    # Flags to keyserv (if enabled).

These entries refer to the Secure RPC key server, which we don't discuss in this book. See the man pages keyserv(8) for more details.

### Network Time Services options: ###
timed_enable="NO"              # Run the time daemon (or NO).
timed_flags=" "                # Flags to timed (if enabled).
ntpdate_enable="NO"            # Run ntpdate to sync time on boot (or NO).
ntpdate_program="/usr/sbin/ntpdate"  # path to ntpdate, if you want a different one.
ntpdate_flags="-b"             # Flags to ntpdate (if enabled).
ntpd_enable="NO"               # Run ntpd Network Time Protocol (or NO).
ntpd_program="/usr/sbin/ntpd"  # path to ntpd, if you want a different one.
ntpd_flags="-p /var/run/ntpd.pid"    #Flags to ntpd (if enabled).

timed, ntpdate and ntpd are three different ways of synchronizing your machine with the current date and time. As we saw on page 155, we'll use ntpd. We add the following line to /etc/rc.conf for each system:

ntpd_enable="YES"  # Run ntpd Network Time Protocol (or NO).

Continuing with /etc/defaults/rc.conf,

#Network Information Services (NIS) options: All need rpcbind_enable="YES" ###
nis_client_enable="NO"     # We're an NIS client (or NO).
nis_client_flags=" "       # Flags to ypbind (if enabled).
nis_ypset_enable="NO"      # Run ypset at boot time (or NO).
nis_ypset_flags=" "        # Flags to ypset (if enabled).
nis_server_enable="NO"     # We're an NIS server (or NO).
nis_server_flags=" "       # Flags to ypserv (if enabled).
nis_ypxfrd_enable="NO"     # Run rpcypxfrd at boot time (or NO).
nis_ypxfrd_flags=" "       # Flags to rpcypxfrd (if enabled).
nis_yppasswdd_enable="NO"  # Run rpcyppasswdd at boot time (or NO).
nis_yppasswdd_flags=" "    # Flags to rpcyppasswdd (if enabled).

More parameters for confi guring NIS. As mentioned above, this book does not deal with NIS.

### Network routing options: ###
defaultrouter="NO"   # Set to default gateway (or NO).
static_routes=" "    # Set to static route list (or leave empty).
gateway_enable="NO"  # Set to YES if this host will be a gateway.

See page 309 for more information on routing. On gw we add the following line to /etc/rc.conf:

defaultrouter="139.130.136.133"  # Set to default gateway (or NO).
gateway_enable="YES"             # Set to YES if this host will be a gateway.

andante gets its routing information from DHCP, so we don't need to do anything here.

router_enable="NO"   # Set to YES to enable a routing daemon.
router="/sbin/routed"          # Name of routing daemon to use if enabled.
router_flags="-q"    # Flags for routing daemon.
mrouted_enable="NO"  # Do multicast routing (see /etc/mrouted.conf).
mrouted_flags=" "    # Flags for multicast routing daemon

These parameters relate to the routing daemons routed and mrouted. In the configurations we considered, you don't need them.

ipxgateway_enable="NO"  # Set to YES to enable IPX routing.
ipxrouted_enable="NO"   # Set to YES to run the IPX routing daemon.
ipxrouted_flags=" "     # Flags for IPX routing daemon.

IPX is a Novell proprietary networking protocol designed to be similar to IP. FreeBSD supplies the daemon IPXrouted (note the capitalization) which handles IPX routing tables. See the man page IPXrouted(8) for further details.

arpproxy_all="NO"         # replaces obsolete kernel option ARP_PROXYALL.
forward_sourceroute="NO"  # do source routing
accept_sourceroute="NO"   # accept source routed packets to us
### ATM interface options: ###
atm_enable="NO"           # Configure ATM interfaces (or NO).
#atm_netif_hea0="atm 1"   # Network interfaces for physical interface.
#atm_sigmgr_hea0="uni31"  # Signalling manager for physical interface.
#atm_prefix_hea0="ILMI"   # NSAP prefix (UNI interfaces only) (or ILMI).
#atm_macaddr_hea0="NO"    # Override physical MAC address (or NO).
#atm_arpserver_atm0="0x47.0005.80.999999.9999.9999.9999.999999999999.00"
#atm_scsparp_atm0="NO"    # Run SCSP/ATMARP on network interface (or NO).
atm_pvcs=" "              # Set to PVC list (or leave empty).
atm_arps=" "              # Set to permanent ARP list (or leave empty).
### ISDN interface options: (see also: /usr/share/examples/isdn) ###
isdn_enable="NO"          # Enable the ISDN subsystem (or NO).
isdn_fsdev="NO"           # Output device for fullscreen mode
isdn_flags="-dn -d0x1f9"  # Flags for isdnd
isdn_ttype="cons25"       # terminal type for fullscreen mode
isdn_screenflags="NO"     # screenflags for ${isdn_fsdev}
isdn_trace="NO"           # Enable the ISDN trace subsystem (or NO).
isdn_traceflags="-f /var/tmp/isdntrace0" #Flags for isdntrac

A few miscellaneous IP options and parameters for ATM and ISDN. This book doesn't discuss any of them.

### Miscellaneous network options: ###
icmp_bmcastecho="NO"  # respond to broadcast ping packets

This parameter relates to the so-called smurf "denial of service" attack: according to the RFCs, a machine should respond to a ping to its broadcast address. But what happens if somebody pings a remote network's broadcast address across the Internet, as fast as he can? Each system on the remote network will reply, completely overloading the outgoing Internet interface. Yes, this is silly, but there are silly people out there. If you leave this parameter as it is, your system will not be vulnerable. See http://www.cert.org/advi-sories/CA-98.01.smurf.html for more details.

Next come a large number of options for IPv6, the new internet protocol standard. This book doesn't deal with IPv6, and they're liable to change, so they're not printed here. Next, we find:

##############################################################
### System console options ###################################
##############################################################
keymap="NO"      # keymap in /usr/share/syscons/keymaps/*
keyrate="NO"     # keyboard rate to: slow, normal, fast
keybell="NO"     # bell to duration.pitch or normal or visual
keychange="NO"   # function keys default values
cursor="NO"      # cursor type {normal|blink|destructive}
scrnmap="NO"     # screen map in /usr/share/syscons/scrnmaps/*
font8x16="NO"    # font 8x16 from /usr/share/syscons/fonts/*
font8x14="NO"    # font 8x14 from /usr/share/syscons/fonts/*
font8x8="NO"     # font 8x8 from /usr/share/syscons/fonts/*
blanktime="300"  # blank time (in seconds) or "NO" to turn it off.
saver="NO"       # screen saver: Uses /boot/kernel/${saver}_saver.ko

These parameters describe the use of alternate keyboard mappings when using the standard character-based terminals only. See the files in /usr/share/syscons/keymaps for key map files, and /usr/share/syscons/fonts for alternate fonts. These parameters have no effect on the X-based displays that this book assumes. You can enable a screen saver by setting the variable saver to YES.

moused_enable="NO"       # Run the mouse daemon.
moused_type="auto"       # See man page for available settings.
moused_port="/dev/psm0"  # Set to your mouse port.
moused_flags=" "         # Any additional flags to moused.
mousechar_start="NO"     # if 0xd0-0xd3 default range is occuped in your
                                   #language code table, specify alternative range
allscreens_flags=" "     # Set this vidcontrol mode for all virtual screens
allscreens_kbdflags=" "  # Set this kbdcontrol mode for all virtual screens

Parameters for moused, a mouse driver for the character-based terminals, and global flags for virtual screens. If you're using an X server, you should run moused. On andante, we add this line to /etc/rc.conf:

moused_enable="YES"

Next follow some definitions for the alternative console driver pcvt, which we don't look at here, followed by a section describing the mail configuration:

############################################################
### Mail Transfer Agent (MTA) options ######################
############################################################
mta_start_script="/etc/rc.sendmail"
                                           #Script to start your chosen MTA
#Settings for /etc/rc.sendmail:
sendmail_enable="NO"             # Run the sendmail inbound daemon (YES/NO).
sendmail_flags="-L sm-mta -bd -q30m"  # Flags to sendmail (as a server)
sendmail_submit_enable="YES"     # Start a localhost-only MTA for mail submission
sendmail_submit_flags="-L sm-mta -bd -q30m ODaemonPortCptions=Addr=localhost"
                                           #Flags for localhost-only MTA
sendmail_outbound_enable="YES"   # Dequeue stuck mail (YES/NO).
sendmail_outbound_flags="-L sm-queue -q30m"  # Flags to sendmail (outbound only)
sendmail_msp_queue_enable="YES"  # Dequeue stuck clientmqueue mail (YES/NO).
sendmail_msp_queue_flags="-L sm-msp-queue -Ac -q30m"

Since FreeBSD Release 5, the sendmail MTA is no longer enabled by default. If you have been running sendmail on an older release of FreeBSD, add an entry to /etc/rc.conf to keep it running.

##############################################################
### Miscellaneous administrative options #####################
##############################################################
cron_enable="YES"              # Run the periodic job daemon.
cron_program="/usr/sbin/cron"  # Which cron executable to run (if enabled).
cron_flags=" "                 # Which options to pass to the cron daemon.

Run cron, the daemon responsible for running things at specific times. See page 151 for a description of cron. Leave this enabled unless you have a good reason not to.

lpd_enable="NO"              # Run the line printer daemon.
lpd_program="/usr/sbin/lpd"  # path to lpd, if you want a different one.
lpd_flags=" "                # Flags to lpd (if enabled).

See page 263 for a discussion of printing. In older releases of FreeBSD, lpd_enable was set to YES. Now, to run lpd, we need to put the following line in /etc/rc.conf for both gw and adagio:

lpd_enable="YES"  # Run the line printer daemon.

Next, we see:

usbd_enable="NO"  # Run the usbd daemon.
usbd_flags=" "    # Flags to usbd (if enabled).

Run usbd, the Universal Serial Bus or USB daemon. See the man pages usbd(8) and usb(4) for more information.

dumpdev="NO"          # Device name to crashdunp to (if enabled).
dumpdir="/var/crash"  # Directory where crash dumps are to be stored
savecore_flags=" "    # Used if dunpdev is enabled above, and present.

These parameters specify how to take dumps when the system panics. See page 83 for details. As mentioned there, it is preferable to set this value in /boot/loader.conf: that way you can still get a dump if your system panics before reading /etc/rc.conf, sowe don't change anything here.

Continuing with /etc/defaults/rc.conf,

enable_quotas="NO"      # turn on quotas on startup
check_quotas="YES"      # Check quotas on startup
accounting_enable="NO"  # Turn on process accounting
ibcs2_enable="NO"       # Ibcs2 (SCO) emulation loaded at startup
ibcs2_loaders="coff"    # List of additional Ibcs2 loaders
sysvipc_enable="NO"     # Load System V IPC primitives at startup
linux_enable="NO"       # Linux binary compatibility loaded at startup
svr4_enable="NO"        # SysVR4 emulation loaded at startup
osf1_enable="NO"        # Alpha OSF/1 emulation loaded at startup

We don't discuss quotas or accounting in this book. We looked at the parameters ibcs2_enable on page 164 and linux_enable on page 163. We also don't discuss System V and OSF-1 emulation.

Clear_tmp_enable="NO"  # Clear /tmp at startup.

In the old days, the startup sequence automatically deleted everything in the file system /tmp. Sometimes this wasn't desirable, so now it's your choice. Change this value to YES if you want the old behaviour.

Note that if you use a /tmp based on MFS (memory file system), this variable has no effect. The contents of MFS file systems disappear on reboot.

ldconfig_insecure="NO"  # Set to YES to disable ldconfig security checks
ldconfig_paths="/usr/lib/compat /usr/X11R6/lib /usr/local/lib"
                                  #shared library search paths
ldconfig_paths_aout="/usr/lib/compat/aout /usr/X11R6/lib/aout/usr/local/lib/aout"
                                  #a.out shared library search paths

ldconfig maintains the dynamic library cache required for finding libraries when starting most processes. Potentially this can be a security issue, and ldconfig makes a number of security checks before accepting libraries. If you really want to, you can disable these checks by setting ldconfig_insecure. The two other variables are lists of the directories that are searched to find ELF and a.out dynamic libraries, respectively. See page 638 for more details. You would normally not remove anything from these lists, but you might want to add something.

kern_securelevel_enable="NO"  # kernel security level (see init(8)),
kern_securelevel="-1"         # range: -1..3; '-1' is the most insecure
update_motd="YES"             # update version info in /etc/motd (or NO)

The kernel runs with five different levels of security. Any super-user process can raise the security level, but only init can lower it. The security levels are:

To set the secure level to anything except -1, set the variable kern_securelevel to the value you want, and set kern_securelevel_enable to YES.

start_vinum="NO"  # set to YES to start vinum

We looked at Vinum on page 221. There we put the following text into /etc/rc.conf to start it on booting:

start_vinum="YES"  # set to YES to start vinum

Finally we have a few miscellaneous entries:

unaligned_print="YES"          # print unaligned access warnings on the alpha
entropy_file="/entropy"        # Set to NO disables caching entropy through reboots
entropy_dir="/var/db/entropy"  # Set to NO to disable caching entropy via cron.
entropy_save_sz="2048"         # Size of the entropy cache files.
entropy_save_num="8"           # Number of entropy cache files to save.
harvest_interrupt="YES"        # Entropy device harvests interrupt randomness
harvest_ethernet="YES"         # Entropy device harvests ethernet randomness
harvest_p_to_p="YES"           # Entropy device harvests point-to-point randomness
dmesg_enable="YES"             # Save dmesg(8) to /var/run/dmesg.boot

unaligned_print is a diagnostic tool for the Alpha processor; there's a good chance it will go away. dmesg_enable saves the boot messages to the file /var/run/dmesg.boot. Leave it this way; the messages are often useful for reference, and after a certain number of messages, they get flushed from the kernel internal message buffer.

The other messages are used for configuring entropy harvesting for the random number devices, /dev/random and /dev/urandom. See random(4) for further details. Under normal circumstances you shouldn't change them.

Our /etc/rc.con

To summarize the changes from the defaults, /etc/rc.conf for gw should now contain the following entries:

hostname="gw.example.org"
firewall_enable="YES"    # Set to YES to enable firewall functionality
firewall_type="client"   # Firewall type (see /etc/rc.firewall)
natd_enable="YES"        # Enable natd (if firewall_enable == YES).
natd_interface="tun0"    # Public interface or IPaddress to use.
syslogd_flags=" "        # Allow logging from other systems
inetd_enable="YES"       # Run inetd
named_enable="YES"       # Run named, the DNS server (or NO).
sshd_enable="YES"        # Enable sshd
nfs_client_enable="YES"  # This host is an NFS client (or NO).
nfs_server_enable="YES"  # This host is an NFS server (or NO).
ntpd_enable="YES"        # Run ntpd Network Time Protocol (or NO).
defaultrouter="139.130.136.133"  # Set to default gateway (or NO).
gateway_enable="YES"     # Set to YES if this host will be a gateway.
lpd_enable="YES"         # Run the line printer daemon.
start_vinum="YES"        # set to YES to start vinum

The corresponding /etc/rc.conf for andante should now contain the following entries:

hostname="andante.example.org"
inetd_enable="YES"       #Run inetd
nfs_client_enable="YES"  #This host is an NFS client (or NO).
ntpd_enable="YES"        #Run ntpd Network Time Protocol (or NO).
moused_enable="YES"      #Run the mouse daemon
lpd_enable="YES"         #Run the line printer daemon.
start_vinum="YES"        #set to YES to start vinum

Files you need to change

rc.conf is only part of the story, of course. The /etc directory contains a large number of other files, nearly all of them relating to the configuration. Some of them, like /etc/amd.map and /etc/dm.conf, are intended for specific subsystems that we don't discuss here. In general, they have comments in them to explain their purpose, and they have a man page in section 5 of the manual.

Most of the files in /etc are intended to be left the way they are. Some, however, will definitely need changing, and there are others that you may need to change. In this section we'll look at the ones you almost certainly need to change, and on page 569 we'll look at the ones you may have to change. On page 576 we'll look at the some of the more interesting ones you should normally leave alone.

/etc/exports

/etc/exports is a list of file systems that should be NFS exported. We looked at it on page 463. See also the man page exports(5).

/etc/fstab

/etc/fstab contains a list of file systems known to the system. The script /etc/rc starts mount twice during system startup first to mount the local file systems, and later to mount the NFS file system. mount will mount all file systems in /etc/fstab unless they are explicitly excluded.

Here's atypical /etc/fStab, from host freebie.example.org:

#File system  Mount point   fstype  flags
/dev/ad0s1a   /             ufs     rw                  1 1
/dev/ad0s1b   none          swap    sw                  0 0
/dev/ad0s1e   /usr          ufs     rw                  2 2
/dev/da0b     none          swap    sw                  0 0
/dev/da0h     /src          ufs     rw                  2 2
/dev/dalh     /home         ufs     rw                  2 2
/dev/da2b     none          swap    sw                  0 0
/dev/da2e     /S            ufs     rw,noauto           2 2
/dev/da3a     /mod          ufs     rw,noauto           0 0
Proc          /proc         procfs  rw                  0 0
/dev/cd0a     /cdrom/1      cd9660  ro,noauto           0 0
/dev/cd1a     /cdrom/2      cd9660  ro,noauto           0 0
/dev/cd2a     /cdrom/3      cd9660  ro,noauto           0 0
/dev/cd3a     /cdrom/4      cd9660  ro,noauto           0 0
/dev/cd4a     /cdrom/5      cd9660  ro,noauto           0 0
/dev/cd5a     /cdrom/6      cd9660  ro,noauto           0 0
/dev/cd6a     /cdrom/7      cd9660  ro,noauto           0 0
/dev/cd7a     /cdrom/8      cd9660  ro,noauto           0 0
presto:/      /presto       nfs     soft,rw,noauto      0 0
presto:/usr   /presto/usr   nfs     soft,rw,noauto      0 0
presto:/home  /presto/home  nfs     soft,rw,noauto      0 0
bumble:/      /bumble       nfs     soft,rw,noauto      0 0
bumble:/usr   /bumble/usr   nfs     soft,rw,noauto      0 0
wait:/C       /C            nfs     soft,rw,noauto      0 0
wait:/        /wait         nfs     soft,rw,noauto,tcp  0 0

This information has the following meaning:

The flags are worth a closer look. Some of the more common are:

For NFS mount fags, see Chapter 24, page 442.

Why are there so many entries with the noauto keyword? If you don't bother to mount them, why bother to mention them?

If file system has an entry in /etc/fstab, mount is clever enough to get all the information it needs from this file. You just need to specify the name of the mount point or the name of the special device (for ufs and cd9660) or the remote file system (for NFS). This is particularly useful for cd9660, the CD file system type. Without an entry in /etc/fstab, you would have to write something like the following to mount a CD-ROM.

# mount -t cd9660 -o ro /dev/cd0a /cdrom

With the entry, you can simplify this to:

mount /cdrom

/etc/group

/etc/group defines the groups known to the system. You normally update it when adding users, for example with vipw or adduser, though you can also edit it directly. See page 113 for more details.

/etc/namedb/named.conf

/etc/named/named.conf is the main configuration file for named, the Domain Name Service daemon. We looked at it in Chapter 21. Previous versions of named used a different form of configuration file stored in /etc/named.boot.

/etc/mail

The directory /etc/mail contains configuration information for some MTAs, including sendmail.

/etc/master.passwd

/etc/master.passwd is the real password file. Like /etc/group, you update with vipw or adduser. See page 144 for more details.

Files you might need to change

You don't need to customize any of the following files to get the system up and running. You may find it necessary to change them to do specific things, however.

/etc/crontab

/etc/crontab describes the jobs to be performed by cron on behalf of the system. You don't have to use this file at all; you can use each user's crontab files instead. Note that this file has a slightly different format from the other crontab fies. A user's crontab contains entries like this:

0  0  *  *  *  /home/grog/Scripts/rotate-log

This line runs the script /home/grog/Scripts/rotate-log at midnight every day. If you put this entry into /etc/crontab, you need to tell cron which user to run it as. Do this by putting the name of the user before the command:

0  0  *  *  *  grog  /home/grog/Scripts/rotate-log

See page 151 for more details about cron.

/etc/csh.cshrc, /etc/csh.login, /etc/csh.logout

These are default initialization files for csh. See the man page csh(1) for more details.

/etc/dhclient.conf

/etc/dhclient.conf describes the client side of DHCP services. Normally it's empty. We discussed dhcp on 302.

/etc/disktab

/etc/disktab contains descriptions of disk geometries for disklabel. This is almost obsolete.

/etc/ftpusers

/etc/ftpusers is a list of users who are not allowed to connect to this system using ftp. It's a strong contender for the prize for the worst-named file in the system.

/etc/hosts

For a small network, especially if you're not permanently connected to the Internet, you have the option of placing the addresses of the systems you want to talk to in a file called /etc/hosts. This file is simply a list of IP addresses and host names, for example:

#Local network host addresses #
#
#loopback address for all systems
127.1 loopback local localhost
###### domain example.com.
#
223.147.37.1  freebie freebie.example.org  # FreeBSD 3.0
223.147.37.2  presto.example.org presto    # 66 MHz 486 (BSD UNIX)

Before the days of DNS, this was the way to resolve lP addresses. It only works locally, and even there it's a pain to maintain: you need to propagate every update to every machine on the network. As we saw in Chapter 21, it's far preferable to run named, even if you're not connected to the Internet.

/etc/hosts.equiv

/etc/hosts.equiv is a list of hosts whose users may use rsh to access this system without supplying a password. rsh is now obsolete, so it's unlikely you'll need to change this file. See the description of ssh on page 419 for a replacement.

/etc/hosts.lpd

/etc/hosts.lpd is a list of hosts that can use the lpd spooler on this system.

/etc/inetd.conf

/etc/inetd.conf is the configuration file for inetd, the Internet daemon. It dates back to the original implementation of TCP/IP in 4.2BSD, and the format is the same for all versions of UNIX. We have looked at various modifications to this file throughout the network part of the book. See the index (inetd.conf) and the man page inetd.conf(5) for further details. FreeBSD now disables all services by default to limit security exposures, so there's a good chance you'll have to edit this file.

/etc/login.acces

/etc/login.access is a file that limits remote access by individual users. We don't look at it in more detail here.

/etc/login.conf

/etc/login.conf describes user parameters set at login time.

In UNIX tradition, root has been the owner of the universe. This is rather primitive, and the 4.3BSD Net/2 relase introduced login classes, which determine session accounting, resource limits and user environment settings. Many programs use the database described in /etc/login.conf to set up a user's login environment and to enforce policy, accounting and administrative restrictions. The login class database also provides the means to authenticate users to the system and to choose the type of authentication.

When creating a user, you may optionally enter a class name, which should match an entry in /etc/login.conf—see page 146 for more details. If you don't, the system uses the entry default for a non-root user. For the root user, the system uses the entry root if it is present, and default otherwise.

The structure of the login configuration database is relatively extensive. It describes a number of parameters, many of which can have two values: a current value and a maximum value. On login, the system sets the values to the -cur (current) value, but the user may, a this option, increase the value to the -max (maximum) value. We'll look at the default entry for an example.

default:\
    :passwd_format=md5:\
    :copyright=/etc/COPYRIGHT:\
    :welcome=/etc/motd:\
    :setenv=MAIL=/var/mail/$,BDOCKSIZE=K,FTP_PASSIVE_MODE=YES:\
    :path=/sbin /bin /usr/sbin /usr/bin /usr/games /usr/local/sbin /usr/local/bi
n/usr/X11R6/bin ~/bin:\
    :nologin=/var/run/nologin:\
    :cputime=unlimited:\
    :datasize=unlimited:\
    :stacksize=unlimited:\
    :memorylocked=unlimited:\
    :memoryuse=unlimited:\
    :filesize=unlimited:\
    :coredumpsize=unlimited:\
    :openfiles=unlimited:\
    :maxproc=unlimited:\
    :sbsize=unlimited:\
    :vmemoryuse=unlimited:\
    :priority=0:\
    :ignoretime@:\
    :umask=022:

As in the password file, the fields are delimited by colons (:). In this example, though, lines are continued by placing a backslash (\) at the end of each line except the last. This usage is common in UNIX. Unlike Microsoft usage, a backslash is never used to represent a directory.

This entry defines the following parameters:

See the man page login.conf(5) for further details.

/etc/motd

/etc/motd (message ofthe day ) is a file whose contents are printed out at login. You can put any message you like in it. See page 114 for an example.

/etc/newsyslog.conf

/etc/newsyslog.conf contains configuration information for the newsyslog command: which log files to archive, how many copies, and whether to compress. See newsyslog(8) for further details. If you generate a lot of logging information, you may need to modify this file to avoid overflowing the file system with your/var/log directory.

/etc/nsswitch.conf

/etc/nsswitch.conf tells the resolver how to perform name resolution. This file format comes from Solaris and replaces the older /etc/host.conf. It gives you the flexibility to use both /etc/hosts and DNS lookups, for example. You specify the lookup sequence for hostnames with a line like this:

hosts:    files dns

The word hosts here specifies the type of lookup (for host names, not NIS, password entries or something else). The keyword file represents the /etc/hosts file in this case. This file is not installed by default; see the man page nsswitch.conf(8) if you need to use it.

/etc/pccardd.conf

/etc/pccardd.conf and its companion /etc/defaults/pccardd.conf are the configuration files for pccardd. We looked at them in detail in Chapter 17, on page 304.

/etc/periodic.conf

/etc/periodic.conf controls how to perform the maintenance jobs that cron runs during the night:

# Perform  daily/weekly/monthly maintenance.
1       3            *      *      *    root    periodic daily
15      4            *      *      6    root    periodic weekly
30      5            1      *      *    root    periodic monthly

Like /etc/rc.conf, /etc/periodic.conf is an optional file which overrides the default file /etc/defaults/periodic.conf. You don't need to change it at all, but you may find it worthwhile. Read the man page periodic.conf(5) or the file /etc/defaults/periodic.conf for more details.

/etc/printcap

/etc/printcap describes the printers connected to a system. See page 265 for more details.

/etc/profile

/etc/profi le is a default startup file for Bourne-style shells. See page 130 for more details.

/etc/rc.firewall

/etc/rc.firewall is used to initialize the packet filtering firewall ipfw. See page 389 for further details.

/etc/resolv.conf

/etc/resolv.conf is used by the resolver library to locate name servers to perform DNS lookups. See 366 for more details.

/etc/syslog.conf

/etc/syslog.conf is the configuration file for syslogd. See syslogd.conf(5) for further details.

/etc/ttys

/etc/ttys is a file that describes terminals and pseudo-terminals to init. We've looked at it in a number of places: check the index.

Here's an excerpt from the default /etc/ttys:

#This entry needed for asking password when init goes to single-user mode
#If you want to be asked for password, change "secure" to "insecure" here
console none                                   unknown off secure

The system console. This is not a real terminal: it can be moved from one device to another. By default, it corresponds to /dev/ttyv0 (the next entry).

ttyv0  "/usr/libexec/getty Pc"  cons25  on secure

This is the first virtual terminal, the one that you get automatically at boot time. To change to the others, press Alt-Fx, where x is between 1 and 16. This will give you one of the others:

#Virtual terminals
ttyv1  "/usr/libexec/getty Pc"  cons25  on secure
ttyv2  "/usr/libexec/getty Pc"  cons25  on secure
ttyv3  "/usr/libexec/getty Pc"  cons25  on secure
(etc)
ttyv8  "usr /X11R6/bin/xdm -nodaemon"   xterm off secure

Each virtual terminal can support either a login or an X server. The default /etc/ttys enables getty on the first eight virtual terminals and reserves /dev/ttyv8 for X. If you don't enable xdm on this terminal, you start X with startx.

The default kernel supports sixteen virtual terminals, the maximum possible value. The kernel configuration parameter MAXCONS (defined in /usr/src/sys/conf/NOTES) allows you to reduce this number.

#Serial terminals
ttyd0  "/usr/libexec/getty std.9600"  unknown off secure
ttyd1  "/usr/libexec/getty std.9600"  unknown off secure
ttyd2  "/usr/libexec/getty std.9600"  unknown off secure
ttyd3  "/usr/libexec/getty std.9600"  unknown off secure

These are the serial ports on your machine. It doesn't matter if it contains names that correspond to non-existent hardware, such as /dev/ttyd3, as long as you don't try to enable them.

#Pseudo terminals
ttyp0    none    network
ttyp1    none    network

There's a whole list of these. The purpose here is to tell network programs the properties of the terminal: in particular, they're not secure, which means that you're not allowed to log in on them as root.

/boot/device.hints

The file /boot/device.hints contains configuration information that was previously stored in the kernel configuration file, and which could not be changed except by building and running a new kernel. Now it can be set at boot time. For these changes to apply, you may still need to reboot, but you no longer need a new kernel.

The information in /boot/device.hints consists of structured variables. For example, consider a third ISA serial I/O port, called /dev/sio2 in FreeBSD. By default, this port gets IRQ 4, the same as /dev/sio0. This just plain doesn't work, so you will have to find a different IRQ. The hints for this device start with the text hint.sio.2. The default /boot/device.hints contains the following parameters for this device:

hint.sio.2.at="isa"
hint.sio.2.disabled="1"
hint.sio.2.port="0x3E8"
hint.sio.2.irq="5"

In sequence, these "hints" state that the device is connected to the ISA bus, that it is disabled (in other words, the kernel does not probe for it), that its device registers are at address 0x3e8, and that it interrupts at IRQ 5. Modern motherboards configure this device via the BIOS. You may find that on your system it's more appropriate to run at IRQ 11. In this case, in /boot/device.hints, you would remove the "disabled" line and change the irq line:

hint.sio.2.at="isa"
hint.sio.2.port="0x3E8"
hint.sio.2.irq="11"

In some cases, you can change these flags at run time with the kenv command. For example, to change the flags of the first serial port to 0x90 to run a serial debugger, you might enter:

kenv hint.sio.O.flags
0x0
kenv hint.sio.0.flags=0x90
hint.sio.0.flags="0x90"

Wiring down SCSI devices

Another example is so-called wiring down SCSI and ATA devices. We looked at this issue on page 202. By default, FreeBSD assigns SCSI unit numbers in the order in which it finds the devices on the SCSI bus. If you remove or add a disk drive, the numbers change, and you may have to modify your /etc/fstab file. To avoid this problem, you can wire down your SCSI devices so that a given bus, target, and unit (LUN) always come on line as the same device unit.

The unit assignment begins with the first non-wired down unit for a device type. Units that are not specified are treated as if specified as LUN 0. For example, if you wire a disk as sd3, the first non-wired disk is assigned sd4.

The following example shows configuration file entries for a system with three Adaptec 2940 class host adapters, one of them with two buses. The first has a disk on ID 0 that we want to call /dev/da0, the second has a tape on ID 6 that we want to call /dev/sa0, the first bus of the third adapter has a disk on ID 3 that we want to call /dev/da2, and the second bus of the third adapter has a disk on ID 1 that we want to call /dev/dal.

hint.scbus.0.at="ahc0"   scbusO is ahc0
hint.scbus.1.at="ahc1"   scbusl is ahcl bus 0 (only one)
hint.scbus.1.bus="0"
hint.scbus.3.at="ahc2"   scbus3 is ahc2 bus 0
hint.scbus.3.bus="0"
hint.scbus.2.at="ahc2"   scbus2 is ahc2 bus 1
hint.scbus.2.bus="1"
hint.da.0.at="scbus0"    da0 is on scsbus0, target0,unit 0
hint.da.0.target="0"
hint.da.0.unit=" 0"
hint.da.1.at=="scbus3="  dal is on scsbus3, target1
hint.da.1.target="1"
hint.da.2.at="scbus2"    da2 is on scsbus2, target3
hint.da.2.target="3"
hint.sa.1.at="scbus1"    a1 is on scsbus1, target6
hint.sa.1.target="6"

If there are any other devices connected to the host adapters, they are assigned other names in sequence, starting at /dev/da3 and /dev/sa2.

This arrangement corresponds to the earlier syntax in the kernel configuration file:

controller  scbus0 at ahc0        #Single bus device
controller  scbus1 at ahc1 bus 0  #Single bus device
controller  scbus3 at ahc2 bus 0  #Twin bus device
controller  scbus2 at ahc2 bus 1  #Twin bus device
disk        da0 at scbus0 target 0 unit 0
disk        da1 at scbus3 target 1
disk        da2 at scbus2 target 3
tape        sa1 at scbus1 target 6
device  cd0 at scbus?

Files you should not change

The files in the following section are there as a kind of reference information. Normally you should not change them, though there might be exceptional circumstances where it makes sense to change them.

/etc/gettytab

/etc/gettytab describes profiles for getty. You probably don't need it; check the man page if you're interested.

/etc/manpath.config

/etc/manpath.config is a configuration file for man. You don't usually need to change this file.

/etc/netconfig

/etc/netconfig is new in FreeBSD Release 5. It is similar to the file of the same name in UNIX System V, but it's only used for C library RPC code. In general, you don't need to worry about this file unless you're upgrading from an older release of FreeBSD. If it's not here, a number of network functions, including NFS, will not work.

/etc/networks

/etc/networks was once a list of networks in the Internet. Although this sounds like a good idea, it is almost useless: if you connect to the Internet, you should use a name server, which supplants this file.

/etc/passwd

/etc/passwd is the old-style password file. It is now present only for programs that expect to read user information from it, and it no longer contains passwords. Don't change this file; the programs vipw, adduser and pwd_mkdb do it automatically. See page 144 for more details.

/etc/protocols

/etc/protocols is a list of known protocols that run on the IP layer. Consider this file to be read-only.

/etc/pwd.db

/etc/pwd.db is a machine-readable form of the user database with the passwords removed. We looked at it on page 144. Like /etc/passwd, it is generated automatically.

/etc/rc

/etc/rc is the main script that starts up the system. It uses the other files whose names start with /etc/rc to perform specific initialization. See page 528 for more details.

/etc/rc.i386

/etc/rc.i386 is used to initialize features specific to the Intel 386 architecture, such as SCO and Linux emulation. You don't normally need to look at or change this file.

/etc/rc.network and /etc/rc.network6

The main scripts for starting the network are /etc/rc.network, which in earlier FreeBSD releases was called /etc/network, and /etc/rc.network6, which starts IPv6 services. You normally don't change these files: they read all the necessary definitions from /etc/rc.conf, and that's the file you should change.

/etc/rc.pccard

/etc/rc.pccard sets up laptops using the PC Card bus.

/etc/rc.serial

/etc/rc.serial sets default values for serial devices.

/etc/shells

/etc/shells is a list of valid shells, used by ftp and some other programs. ftpd refuses to open a session for a user whose shell is not mentioned in this file. This prevents people from starting an ftp session as a daemon, which frequently have no passwords. chpass will not let you change your shell to a shell not included in this file. See page 452 for more details. It is usually updated when you install a new shell from the Ports Collection.

/etc/services

/etc/services contains a list of the IP services that this system supports.

/etc/spwd.db

/etc/spwd.db is a machine-readable form of the user database with the passwords intact. We looked at it on page 144.

/etc/termcap

/etc/termcap (terminal capabilities) describes terminal control sequences. By default, programs use the value of the TERM environment variable to look up the terminal capabilities in this database. See page 128 for more details.

/etc/periodic

The directory /etc/periodic contains three directories used by cron at regular intervals: daily, weekly and monthly. The directories contain a number of files for performing specific tasks. For example, /etc/periodic/daily contains the following files:

-rwxr-xr-x  5  grog  lemis  1269  Apr  26  2001  100.clean-disks
-rwxr-xr-x  4  grog  lemis  1449  Nov  21  13:55  110.clean-tmps
-rwxr-xr-x  5  grog  lemis  1092  Sep  15  2000  120.clean-preserve
-rwxr-xr-x  5  grog  lemis   695  Sep  15  2000  130.clean-msgs
-rwxr-xr-x  5  grog  lemis  1056  Sep  15  2000  140.clean-rwho
-rwxr-xr-x  1  grog  lemis   595  Jan   9  07:11  150.clean-hoststat
-rwxr-xr-x  5  grog  lemis  1742  Nov  15  2001  200.backup-passwd
-rwxr-xr-x  5  grog  lemis   996  Sep  15  2000  210.backup-aliases
-rwxr-xr-x  5  grog  lemis   679  Sep  15  2000  300.calendar
-rwxr-xr-x  5  grog  lemis  1211  May  31  2001 310.accounting
-rwxr-xr-x  5  grog  lemis   710  Sep  15  2000  330.news
-rwxr-xr-x  5  grog  lemis   516  Jul  26  2002  400.status-disks
-rwxr-xr-x  5  grog  lemis   548  Sep  15  2000  420.status-network
-rwxr-xr-x  5  grog  lemis   687  Sep  15  2000  430.status-rwho
-rwxr-xr-x  3  grog  lemis  1362  Dec   9  07:15  440.status-mailq
-rwxr-xr-x  5  grog  lemis   768  Jul  26  2002  450.status-security
-rwxr-xr-x  3  grog  lemis  1633  Dec   9  07:15  460.status-mail-rejects
-rwxr-xr-x  1  grog  lemis  1489  Jan   7  07:10  470.status-named
-rwxr-xr-x  5  grog  lemis   723  Jul  26  2002  500.queuerun
-rwxr-xr-x  5  grog  lemis   712  Jun   2  2001  999.local

The files are executed in the order of their names, so the names consist of two parts: a number indicating the sequence, and a name indicating the function. This method is new with FreeBSD Release 3. In older releases of FreeBSD, these functions were performed by files with the names /etc/daily, /etc/weekly and /etc/monthly. See page 151 for more details of cron.

Obsolete configuration files

In the course of time, a number of configuration files have come and gone. This can be tricky if you're updating a system: some old configuration files could remain and either confuse you by not working the way you expect, or cause incorrect operation by some side effect of the presence of the file.

/etc/host.conf

/etc/host.conf described the order in which to perform name resolution. It has been replaced by /etc/nsswitch.conf, which has a different syntax.

/etc/named.boot

Previous versions of named, the DNS daemon, used /etc/named.boot as the main configuration file. Newer versions use /etc/namedb/named.conf, and the format is very different.

/etc/netstart

/etc/netstart was a script called by /etc/rc to start up the network. Its name has now been changed to /etc/rc.network. FreeBSD still includes a file /etc/netstart, but its only purpose is to start the network in single-user mode.

/etc/sysconfig

/etc/sysconfig was a file that contained all the site-specific configuration definitions. Its name has been changed to /etc/rc.conf.