К. А. Корниенко - FreeBSD 9. Корпоративный Интернет-сервер

FreeBSD 9.
2
004.45
32.973-018.2
60
60
..
FreeBSD 9. -.
.: .., 2013 176 .
ISBN 966-8637-57-7
,

FreeBSD 9.
,
, ,
, , -, - ..
.
.
004.45
32.973-018.2
ISBN 966-8637-57-7
.., 2013
.., 2013
FreeBSD 9. -
........................................................................... 7
FreeBSD .......................................................................... 7
FreeBSD ............................................................................ 9
..................................................................... 13
( ) ................................................................ 14
1 FreeBSD 9 ...................................... 15
............................................... 16
.......................................................... 17
........................................................ 18
................................................ 22
2 ................... 25
.................................................... 26
, ................................................ 31
(ee, vi) ................................................. 34
FreeBSD (man) ....................................................... 39
3 ............. 41
(adduser) ...................................... 42
, ................................. 43
(ifconfig, route, resolv.conf) .......................................... 46
ADSL (ppp) ................................................ 47
(rc.conf) ................................... 49
(portsnap, cron) .................................. 50
(sudo, bash) ..................................... 51
............................................. 54
FreeBSD 9. -
4 - ................ 57
DNS (named) ................................... 58
(natd) ..................................... 60
- (squid) ................................ 61
SQUID (squid) .................................... 64
(squid, ipfw) ........................................ 65
SQUID (squidguard).................................... 66
FTP (proftpd) ....................................... 68
DHCP (dhcpd) ...................................... 70
(ipfw) .............................................. 71
(ipa) .............................................. 76
5 ............. 79
- ................................. 80
(sendmail) ............................. 81
(sendmail) .......................... 83
(mail, cucipop) ............................... 84
MTA (postfix) ............................................ 87
C POSTFIX (postfix + mysql).................................... 92
POP3/IMAP4 (dovecot) ............................................ 94
C DOVECOT (dovecot + mysql) ............................... 96
(mb2md) ............................... 98
(cyrus-sasl) .............................. 100
(dovecot-sasl + mysql)........................ 101
SSL/TLS (openssl) ............................ 102
(clamav)............................................. 103
-. POSTFIX (postfix) ............................... 104
-. (postgrey) .............................. 108
-. - (dnsbl) ...................... 109
-. - (dspam) ..................................... 110
IMAP (antispam, pigeonhole) .......................... 114
FreeBSD 9. -
6 - ......... 117
- (apache, php) ............................. 118
(postfixadmin).................................. 121
(roundcube) .................................. 124
- SQUID (lightsquid) ......................................... 126
(mrtg).............................. 128
- (httpd.conf) ..................................... 130
7 .......................... 131
(natd, socket) ......................... 132
VPN (mpd) ............................. 133
(ipsec) ............................ 134
(synonym).................... 136
(ssh, scp) ............................ 137
(named) ........................... 139
Midnight Commander (mc-light)....................... 140
8 .......................... 141
..................................................................................... 143
1. backup.sh ............................. 156
2. ............................. 158
3. VPN IPSEC.............................. 160
4. (ipa) ............................ 163
............................. 169
....................................................... 173
................................................ 175
.............................................................. 175
FreeBSD 9. -
FreeBSD 9. -
FreeBSD
UNIX,
, Bell Labs
AT&T. (Ken Thompson)
(Dennis Ritchie)
UNIX, . 60-
AT&T Bell Labs

Multics.
,
.
,
, .

DEC PDP-7 , ,
. 1969 Bell Labs ,
, ,

,
UNIX. UNIX ,
1973 UNIX
, .
UNIX
.
,
, ,
FreeBSD 9. -
UNIX .
,
UNIX .
AT&T
, . AT&T UNIX
. UNIX 80%
, .
, UNIX,

Computer Systems Research Group.
, 1975 Bell Labs
.
-
(Bill Joy).
UNIX Berkley
Software Distribution, BSD. 70-
: ,
Advanced Research Project Agency
UNIX
. ,
,
. , , UNIX
.

Sun Microsystems. Sun
, BSD
SunOS. BSD
1991 BSD
Intel x86, ,
BSD 86.
FreeBSD 9. -
1993
, UNIX .
.
NetBSD.
.
,
NetBSD.
FreeBSD.
, . ,

Intel x86. FreeBSD UNIX BSD.
FreeBSD
FreeBSD , ,
. Netcraft (netcraft.com),

, 50
47 FreeBSD.
- 1 10 !
, , FreeBSD.
, FreeBSD
,
. FreeBSD
, .
,
,
.
10
FreeBSD 9. -

!

,
FreeBSD.
.
.
FreeBSD, ,
.. ,
, FreeBSD
-.
FreeBSD Windows Linux. Microsoft ,
,
. Windows ,

. ,
Windows ,
,
. , Windows

. , Windows
.
FreeBSD .
,

.
Windows, FreeBSD .
,
. FreeBSD
FreeBSD 9. -
11
,

,
. Windows
,
,
Windows, ,
Windows-
Windows. ,
, .
,
, ,
,
.
Windows
. , . FreeBSD
,
.
.
Windows ,

.
Linux, ,
, Windows.
. Linux UNIX. FreeBSD,
, . FreeBSD Linux ,
, Linux , FreeBSD,
, ,
, Linux. , FreeBSD
.
12
FreeBSD 9. -
, FreeBSD , Linux
300. FreeBSD .
Linux .
, ,
Linux . FreeBSD
,
. Linux ,
( Linux). , Linux,
, Linux ,
,
, .
, FreeBSD
, Linux.
,
,
. FreeBSD , Linux
.
FreeBSD, ,
, ,
Linux. :
,
,
.
FreeBSD 9. -
13

,

-,
-,
FreeBSD 9. ,
, , , , -,
- .
,
.

.
.
.
.

, ..
.
, , - ,

.
, , -.
,
, UNIX,
.
FreeBSD -,
-, , -,
,
FreeBSD 9. -
14
.
-,
FreeBSD
.
.

,
FreeBSD.
FreeBSD:
http://www.freebsd.org/doc/ru/books/handbook/
, , , Postfix
Apache, ,
, . ,
.
, . , ,

.
:
, . ;
, 12
FreeBSD , , , .
FreeBSD 9. -
15
1
FreeBSD 9
, :
.

, .
-
-, . ,
, . ,
:
, . , ,
.
16
FreeBSD 9. -

,
. ,
,
. :
1. 10.0.0.0/24;
2. 22.22.22.20/30, :
- IP-address:
22.22.22.22;
- Gateway:
22.22.22.21;
- DNS:
22.22.0.1, 22.22.0.2;
3. - example.com;
4. .
, IP- 22.22.22.22,
,
. ,
IP- ,
.
-,
,
. ,
,
.

, ,
ISO,
, :)
.
FreeBSD 9. -
17

FreeBSD:
ftp://ftp.freebsd.org/pub/FreeBSD/releases/ISO-IMAGES/
.
9.1 .

, ,
FreeBSD. ,
: i386 amd64.
. AMD
, ,
,
, Intel AMD
. amd64 , AMD
. ,
Intel 64 ia64,

.
, i386 32- amd64

64-, (AMD Intel).
amd64.
,
(CD, DVD, flash) .
,
( ), .
18
FreeBSD 9. -

(. 1).
.
[Enter] 10 .
bsdinstall,
9.0 (. 2).
sysinstall,
, .. .
FreeBSD 9. -
19
[Install], ,
,
[No] ,
. ,
, (. 3).
, ,
FreeBSD , ,
, ().
gateway.example.com.
(. 4)
, ,
(. 5).
20
FreeBSD 9. -

[Guided]
[Entire Disk].
(. 6).
, [Finish],

[Commit].

FreeBSD (. 7).
FreeBSD 9. -
21
,
, 8 .
, ,
,
,
, ,
, .
,
root.
,
, ,
:)
22
FreeBSD 9. -

bsdinstall (. 8),
.
de0 de1. ,
, ,
[Cancel].
, .
, .. ,
, . ,
CMOS UTC
( ) [No],
, ,
[Yes].
,
: sshd , moused
, ntpd
powerd .
sshd ntpd. [OK] (. 9).
FreeBSD 9. -
23

[No],
,
.

[No]. .
, ,
(. 10).
24
FreeBSD 9. -
,
[Exit] [OK].
-
[No],

[Reboot]. ,
.
(. 11).
root, ,
, (. 12).
!
FreeBSD
!
FreeBSD 9. -
25
2

. ,
FreeBSD
, , :
,
,
FreeBSD. ,

?.
.
26
FreeBSD 9. -

,
, .
, .
,
FreeBSD
.
Windows. ,
Windows
, FreeBSD .
Windows DOS , ,
. FreeBSD .

,
. :
ls [][] .
ls -a ( );
ls -l ( , );
ls -G ( ).
cd
[] (
). (
/ ) ( ).
pwd ( ).
mkdir [] .
rmdir [] .
FreeBSD 9. -
27
cp [][] .
cp -r .
mv [][] .
mv -r .
rm [][] .
rm -r ;
rm -f , ;
rm -P (
);
rm -W , rm.
df [] .
du [] .
du h d 1 , 1 .
, UNIX
,
, ,
. UNIX ,
Windows. UNIX , , . ,
, -i.
,
.

- :
? ;
* ;
[ ] ;
[! ] .
28
FreeBSD 9. -
.
UNIX (
,
,
), - ,
, , .
, UNIX ,
, ,
() . .
,
,
.
:
.
.
. ,
escape-
\. ,
, .
:
find [] -name [ ]
locate [ ]
, locate
,
,
,
, locate
, .
,
.
FreeBSD 9. -
29
, - , ,
- :
/etc/periodic/weekly/310.locate
:
tar czvf backup.tar.gz /etc/* ;
tar xzvf backup.tar.gz C /bkp.etc/ .

. UNIX FreeBSD
.
:
wc [] , .
cat [] .
cut [][] .
cut -f[] -d[]
sort [] .
grep [][] .
grep -i ;
grep -c ;
grep -v , .
less [] .
more [] .
FreeBSD 9. -
30
,

. ,
UNIX ,
. ,
-:
> ;
< ;
| .
:
ls > listing.txt
.
locate filename | grep v ports ,
, ports.
grep word file1.txt > file2.txt ,
word ,
.
cat file1.txt | grep word > file2.txt word
( , ).
cut -f1 d file1.txt | sort | uniq - > file2.txt
, .
. ,

, ,
.
FreeBSD 9. -
31
,
,
FreeBSD ( UNIX), .
: root
,
; wheel ,
root (
); ,
.

, , ( bin, operator, daemon, nobody).
, .
/etc/passwd,
/etc/group.
.
UNIX :
, .
,
.
-rwxr-xr-x.
(, , )
.
, , ,
: (read), (write)
(execute). :
r ;
w , , ;
.
32
FreeBSD 9. -
, -rwxrxr-x. ,
, rwx
( ), r-x
, ,
r-x .
, ,
, ,
.
,
. ,
d. , .
,
, :
r ( ls);
w ;
.
, , drwxr-xr-x ,
,
,
.
, :
chown [:][] ;
chmod [][] .
. .
,
FreeBSD 9. -
33

. : ,
. , ,
, .
:
4 (r).
2 (w);
1 (x);
0 (-);
, " " 6,
" " 5, ",
" 7.
, . :
0755 ,
(-rwxr-xr-x);
0644 ,
(-r-xr--r--);
0600 ,
(-r-x------).

:
0 ;
1 ( ):

, ,
;
34
FreeBSD 9. -
2 . , ,
, , ;
4 .
, , , , .
.
(ee, vi)
FreeBSD

. ,
ee (easy editor).
,
. , :
ee []
, vi
,
UNIX.

UNIX. ,
vi ,
. ,

. ,
FreeBSD 9. -
35
. ? ,
, .
-, UNIX,
, .
, vi

-, ,
. vi
,
. .
vi
.
, ,
.
, :
a append (). , .
i insert ().
, .
open (). , ,
, ,
vi
insert, .
, Esc.

Page Up / Page
Down. ,
:
36
FreeBSD 9. -
h ;
j ;
k ;
l ;
w ;
b ;
;
0 ;
$ ;
) ;
( ;
} ;
{ ;
G ;
^ , ;
;
L .
,
1. j
, k
, w
. ,
. , , 5j
, . 75G 75-
, . 5L
.
, ^,
,
.
FreeBSD 9. -
37
vi Backspace Delete
, .

.
:
D ;
dd ;
R , ;
S ;
;
X ;
~ ;
J ;
yw , ;
$ ;
;
;
.
vi
:
/ ;
/
;
? ;
?
;
38
FreeBSD 9. -
%
( );
:s/1 /2 1 2;
:%s/1 /2 1 2;
, ,
:
:w ;
:w! ;
:q ;
:q! ;
: ;
:! ;
:wq ;
,
vi.

, ,
.
FreeBSD 9. -
39
FreeBSD (man)
FreeBSD
, , ,
, .

, ,
UNIX.
. ,
- ,
, man. :
man mkdir
.

, :
man man :)
40
FreeBSD 9. -
FreeBSD 9. -
41
3

, FreeBSD
, . ,
:
# date 201301010900
2013 , , 01, 09:00 ( #

root).
!
.
:
, ..
. ,
, .
42
FreeBSD 9. -
(adduser)
,
,
, .
, root,
,
.
:
# adduser
,
( ), (
wheel), . wheel ,
root. raph (. 13).
FreeBSD 9. -
43
raph ,
, root. .
, ,
admin. ,
.

exit CTRL-D,
, ( su
) :
% su
Password:
# _
. #, root.
, % $,

.
,
, ,
.
FreeBSD
,

.
- ,
.
44
FreeBSD 9. -
. FreeBSD . 8, ALT-F1
ALT-F8 . , ,

, , ,
.
ALT-F2, ,
, , :
# cd /usr/src/sys/amd64/conf/
# cp GENERIC GATEWAY
# vi GATEWAY
# options
INET6
options
IPFIREWALL
options
IPFIREWALL_FORWARD
options
IPDIVERT
options
DUMMYNET

IPv6,
( #
, ,
, ,
, , , ).
.
! , ,
, IPV6
, .
. ,
IPV6 .
FreeBSD 9. -
45
, ,
:
# config GATEWAY
# cd ../compile/GATEWAY/
# make cleandepend && make depend && make && make install
,

. .. , :
#
#
#
#
make cleandepend
make depend
make
make install
,
,
.
,
, 32 . ,
, ALT-F3 . -
, ,
/etc/rc.conf,
:
# vi /etc/rc.conf
firewall_enable="YES"
firewall_type="open"
# reboot
46
FreeBSD 9. -
(ifconfig, route, resolv.conf)

, ,
(
):
# ifconfig
de0: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
ether bc:30:5b:ed:f2:53
media: Ethernet autoselect
de1: flags=8802<BROADCAST,SIMPLEX,MULTICAST> metric 0 mtu 1500
ether 00:15:5d:00:0c:07
media: Ethernet autoselect
,
ifconfig, . de0 , de1 .
:
# ifconfig de0 inet 22.22.22.22 netmask 255.255.255.252
# ifconfig de1 inet 10.0.0.1 netmask 255.255.255.0

, :
# route add default 22.22.22.21
DNS
:
# vi /etc/resolv.conf
search 127.0.0.1
nameserver 22.22.0.1
nameserver 22.22.0.2

. ,
ifconfig,
ping:
FreeBSD 9. -
47
# ping freebsd.org
PING freebsd.org (8.8.178.135): 56 data bytes
64 bytes from 8.8.178.135: icmp_seq=0 ttl=57 time=211.055 ms
64 bytes from 8.8.178.135: icmp_seq=1 ttl=57 time=211.115 ms
, , DNS
, .

. ,
. .
.
, ,
SSH 22.
,
sshd. :

.
ADSL (ppp)
,
(ADSL).

. , , ,
.
IP-,
Bridge. , IP-
, ADSL-. :
48
FreeBSD 9. -
# vi /etc/ppp/ppp.conf
default:
set log Phase Chat LCP IPCP CCP tun command
enable dns
provider_name:
set device PPPoE:ed0
set authname ppp_login
set authkey ppp_password
set dial
set login
add default HISADDR
, provider_name, ppp_login
ppp_password,
( , ppp-
ppp- -). ppp
:
# /usr/sbin/ppp -ddial provider_name

tun0,
, de0.
, ..
de0
de1. , ADSL,
de0 tun0.
FreeBSD 9. -
49
(rc.conf)
, ,
/etc/rc.conf . ,
.
:
# vi /etc/rc.conf
dumpdev="NO"
hostname="gateway.example.com"
ifconfig_de0="inet 22.22.22.22 netmask 255.255.255.252
defaultrouter="22.22.22.21"
sshd_enable="YES"
ntpd_enable="YES"
de0 de1,
,
. ADSL,
de0 ,
ppp .
ppp:
# vi /etc/rc.conf
dumpdev="NO"
hostname="gateway.example.com"
ppp_enable="YES"
ppp_mode="ddial"
ppp_profile="provider_name"
sshd_enable="YES"
ntpd_enable="YES"
50
FreeBSD 9. -
(portsnap, cron)

FreeBSD. ,

, : ,
.
:
# portsnap fetch extract
8 .
,
FreeBSD
, :
# portsnap fetch update
-
,
6:00 . /etc/crontab.
, ,
cron:
# vi /etc/crontab
#minute hour mday month wday who command
...
0
6
*
*
1
root
portsnap fetch update
# killall HUP cron

, FreeBSD.
FreeBSD 9. -
51
(sudo, bash)
, ,
sudo,
root, .
,
-, , .
.
, , ,
:
# cd /usr/ports/security/sudo/
# make install clean
make install,
, (. 14) .
, , [OK].
52
FreeBSD 9. -
. make
config. , ,
, - ,
.
.

sudo :
# vi /usr/local/etc/sudoers
%wheel ALL=(ALL) NOPASSWD: ALL
,
wheel,
.
bash, , ,
, sh csh.

.
12 :
# cd /usr/ports/shells/bash/
UTF-8
. /etc/login.conf :
# vi /etc/login.conf
russian|Russian Users Accounts:\
:charset=UTF-8:\
:lang=ru_RU.UTF-8:\
:tc=default:
FreeBSD 9. -
53
,
russian ,
bash :
# cap_mkdb /etc/login.conf
# chsh raph
#Changing user information for raph.
Login: raph
...
Class: russian
...
Shell: /usr/local/bin/bash
...
, , ,
UTF-8
bash, ,
.
. chsh vi. ,
vipw
, visudo
sudo. ,
, 2.
.
, ,
wheel:
$ sudo -s
# _
FreeBSD 9. -
54

/etc/hosts. :
# vi /etc/hosts
127.0.0.1
22.22.22.22
localhost localhost.example.com
gateway.example.com mail.example.com

, , , .
:
# reboot
# shutdown r now
, FreeBSD
,
. , ,
. :
# halt
# shutdown h now
,
, ,
( , ):
#
#
#
#
#
uname -a
ifconfig
ipfw show
ps -ax
top
.
, less.
FreeBSD 9. -
55
-
grep:
# ps -ax | less
# ps -ax | grep natd
- ,
/etc/rc.d stop restart.
:
kill [] ;
killall [] ;
killall HUP [] .

,
:
# man ipfw
.
SSH,
, PuTTY Windows.
.
.
. ,
,
,
, -.
, ,
,

;)
56
FreeBSD 9. -
FreeBSD 9. -
57
4

-
.

. , ,
.
,
, DNS, DHCP, FTP
, .
58
FreeBSD 9. -
DNS (named)

DNS IP-
.
,
. named ( ,
,
):
# vi /etc/namedb/named.conf
acl ACCESS { 127.0.0.1; 10.0.0.0/24; };
options {
...
listen-on { 127.0.0.1; 10.0.0.1; };
allow-recursion { ACCESS; };
...
forwarders {
22.22.0.1;
22.22.0.2;
};
};

DNS-, , ,
DNS .
,
acl (acess list).
. /etc/rc.conf
named :
# vi /etc/rc.conf
named_enable="YES"
# /etc/rc.d/named start
FreeBSD 9. -
59
, named ,
DNS-:
# ps ax | grep named
649 ?? Is 0:00,41 /usr/sbin/syslogd -l /var/run/log ...
735 ?? Is 0:00,09 /usr/sbin/named -t /var/named -u bind
# dig @127.0.0.1 freebsd.org A
; <<>> DiG 9.8.3-P4 <<>> @127.0.0.1 freebsd.org A
...
;; QUESTION SECTION:
;freebsd.org.
IN
A
;; ANSWER SECTION:
freebsd.org.
3600
IN
8.8.178.135
;; AUTHORITY SECTION:
freebsd.org.
3600
freebsd.org.
3600
freebsd.org.
3600
IN
IN
IN
NS
NS
NS
ns3.isc-sns.info.
ns2.isc-sns.com.
ns1.isc-sns.net.
;;
;;
;;
;;
Query time: 99 msec

SERVER: 127.0.0.1#53(127.0.0.1)
WHEN: Tue Jan 01 10:00:00 2013
MSG SIZE rcvd: 133
named ,
DNS- - -.
-
7.
60
FreeBSD 9. -
(natd)

natd,
ipfw
. :
# vi /etc/rc.conf
gateway_enable="YES"
natd_enable="YES"
natd_interface="de0"
firewall_type="/etc/firewall.conf"
# vi /etc/firewall.conf
add 4000 divert natd ip from any to any via de0
add 65500 allow ip from any to any
# natd n de0
# /etc/rc.d/ipfw restart
gateway_enable (
) natd
( ). ,
open /etc/firewall.conf
.
natd,
open, .. .
, .
, .
Windows
IP- 10.0.0.1, DNS
.
FreeBSD 9. -
61
- (squid)
.
HTTP FTP ,
, , squid,
.
10 :
# cd /usr/ports/www/squid/
# vi /usr/local/etc/squid/squid.conf
acl localnet src 10.0.0.0/24
...
http_access allow localnet
http_access deny all
# squid -z
# echo squid_enable=\"YES\" >> /etc/rc.conf
# /usr/local/etc/rc.d/squid start
acl (access list)

, -
, . squid -z
,
.
. , /etc/rc.d/
,
, /usr/local/etc/rc.d/
, .
, /etc/rc.conf,
,
.
62
FreeBSD 9. -
. , -,
-
: 10.0.0.1, : 3128.
. ,
.
acl users, ,
, squid:
# vi /usr/local/etc/squid/users.txt
10.0.0.14/32
10.0.0.28/32
acl users src "/usr/local/etc/squid/users.txt"
...
http_access allow users
# squid k reconfigure
, squid
IP-.
squid . -
, :
acl users src "/usr/local/etc/squid/users.txt"
...
http_access allow localnet !users
http_access
, .
FreeBSD 9. -
63

-. acl
: dstdomain ( ), dstdom_regex
( ), url_regex (
) urlpath_regex ( ,
). :
acl dom_deny dstdomain baddomain1.com baddomain2.com
acl url_deny url_regex "/usr/local/etc/squid/url.txt"
...
http_access allow localnet !dom_deny !url_deny
# vi /usr/local/etc/squid/url.txt
audio
video
...
,
, ,
.
, , squid - ,
- :
error_directory /usr/local/etc/squid/errors/Russian-1251

, ,
error_directory.
64
FreeBSD 9. -
SQUID (squid)
-
:
auth_param basic program /usr/local/libexec/squid/ncs
a_auth /usr/local/etc/squid/squid.passwd
auth_param basic children 4
...
acl auth_users proxy_auth REQUIRED
...
http_access allow localnet auth_users
,
.

,
htpasswd, -
Apache. .
, ,

/etc/master.passwd :
# grep raph /etc/master.passwd >> /usr/local/etc/squid/s
quid.passwd
.
- ,
squid.passwd squid
. -
squid:
FreeBSD 9. -
65
(squid, ipfw)

squid .
HTTP ( 80),
- ( 3128). ,
:
http_port 3128 transparent
add fwd 127.0.0.1,3128 tcp from any to any 80 via de1
add 65500 allow ip from any to any
, ,
HTTP squid.
, .
, : 3128 TCP- 80 ,
de1.
,
. , , ,
, ,
.
66
FreeBSD 9. -
SQUID (squidguard)

,
, squidguard:
# cd /usr/ports/www/squidguard/
# vi /usr/local/etc/squid/squidGuard.conf
#
dbhome /var/db/squidGuard
logdir /var/log
# (- 8 20)
time workhours { weekly mtwhfa 08:00 - 20:00 }
#
source admins { ip 10.0.0.10 }
source users { ip 10.0.0.0/24 }
#
rewrite media {
s@.*\.mp3$@http://10.0.0.1/replace/my.mp3@r
s@.*\.avi$@http://10.0.0.1/replace/my.avi@r
}
#
dest badsites {
domainlist badsites/domains
urllist badsites/urls
}
#
acl {
admins { pass any }
users within workhours {
pass !badsites any
redirect http://www.example.com
rewrite media
} else { pass none }
default { pass none }
}
FreeBSD 9. -
67
url_rewrite_program /usr/local/bin/squidGuard
url_rewrite_children 4
squidGuard.conf
, , .
, :
admins users. rewrite media
mp3 avi .
dest badsites,
:
# mkdir /var/db/squidGuard/badsites
# touch /var/db/squidGuard/badsites/urls
# vi /var/db/squidGuard/badsites/domains
baddomain1.com
baddomain2.com
# chown R squid:squid /var/db/squidGuard/badsites
# squidGuard -C all
, acl,
: ;
, (
)

. ,
(
-, ).
.
68
FreeBSD 9. -
FTP (proftpd)

FTP.
, ,
.
inetd,
.
. , ftp :
# vi /etc/inetd.conf
ftp stream tcp nowait root /usr/libexec/ftpd ftpd -l
# /etc/rc.d/inetd start
:
/etc/ftpusers , FTP ;
/etc/ftpchroot , , .
, FTP ,
, .

FTP :
ftp://raph@gateway.example.com/
:
ftp://raph:password@gateway.example.com/
, FTP
.
FTP
, ,
FreeBSD 9. -
69
proftpd (
ftp /etc/inetd.conf):
#ftp stream tcp nowait root /usr/libexec/ftpd ftpd -l
# /etc/rc.d/inetd restart
# cd /usr/ports/ftp/proftpd/
# vi /usr/local/etc/proftpd.conf
<Anonymous ~ftp>
User
ftp
Group
ftp
UserAlias
anonymous ftp
MaxClients
10
<Limit WRITE>
DenyAll
</Limit>
</Anonymous>
#
#
#
#
pw useradd ftp -s sh
mkdir /home/ftp
echo proftpd_enable=\"YES\" >> /etc/rc.conf
/usr/local/etc/rc.d/proftpd start

ftp://raph@gateway.example.com/
, , ,

/home/ftp:
ftp://gateway.example.com/
! ,
. ,
FTP, ftp
/etc/ftpusers. FTP
ftp .
70
FreeBSD 9. -
DHCP (dhcpd)
,
,
. DHCP
isc-dhcp42-server:
# cd /usr/ports/net/isc-dhcp42-server/
# vi /usr/local/etc/dhcpd.conf
#
option domain-name "local.example.com";
# DNS
option domain-name-servers 10.0.0.1;
#
default-lease-time 3600;
max-lease-time 86400;
#
subnet 10.0.0.0 netmask 255.255.255.0 {
#
range 10.0.0.10 10.0.0.200;
#
option routers 10.0.0.1;
}
# vi /etc/rc.conf
dhcpd_enable="YES"
dhcpd_ifaces="de1"
# /usr/local/etc/rc.d/isc-dhcpd start
DHCP de1,
.. ,
,
: IP- 10.0.0.10 - 10.0.0.200
, 10.0.0.1 DNS
10.0.0.1.
FreeBSD 9. -
71
(ipfw)

.
.
() IPFW
. :
# vi /usr/src/sys/amd64/conf/GATEWAY
# IPFW
options
IPFIREWALL
# FWD
options
IPFIREWALL_FORWARD
# IP- NAT
options
IPDIVERT
# PIPE
options
DUMMYNET
/etc/rc.conf:
# vi /etc/rc.conf
firewall_type
(
):
open ( );
client ();
simple ( );
closed , loopback;
[filename] , .
,
.
,
72
FreeBSD 9. -
, open,
. , ,
.
.
1 65535.
, , ,
, .
, .
65535 , .
.
IPFW ():
cmd number action proto from src to dst options
( ): ( add, delete, flush
..), ( 1 65535), (allow,
deny, count ..), (ip, tcp, udp, icmp .., .
/etc/protocols), (from any, me, IP-
), (to any, me, IP- ),
(in, out via ..). :
add 500 deny tcp from 10.0.0.10 to any 110
IPFW 500,
tcp 10.0.0.10
110 . .. 10.0.0.10
POP3
.

. :
FreeBSD 9. -
73
,
tcp 80 ,
de1 ( ) 3128.
, 100
( 65535).
:
# IP- NAT
# HTTP SQUID
#
add allow ip from any to any via lo0
# .
add allow udp from any to any
# udp
add allow icmp from any to any
# icmp
add allow ip from any to any frag
# .
add allow tcp from any to any established # .
#
add allow tcp from any 20 to any setup
# ftp data
add allow tcp from any to any 21 setup
# ftp cmd
# ssh
# smtp
# named
# pop3
# imap
# smtps
# imaps
# pop3s
add allow tcp from any to me 80 setup
# http in
add allow tcp from me to any 80 setup
# http out
add allow tcp from me to any 443 setup
# https out
add allow tcp from any to me 3128 setup
# squid in
#
add allow tcp from any to any 1025-65535 setup
74
FreeBSD 9. -
,
/etc/services.
, ,
90% .
,
,
.
,
,
: 100,
200 300 65535:
# ipfw show
00100
0
0
allow ip from any to any via lo0
00200
0
0
deny ip from any to 127.0.0.0/8
00300
0
0
deny ip from 127.0.0.0/8 to any
... ...
65535 123 456
deny ip from any to any
, ..
: , ,
. , .
,
.
.
,
,
. ,
, .
, ..,
, .
-
,
,
FreeBSD 9. -
75
/etc/firewall.conf, .
:
ipfw
ipfw
ipfw
ipfw
add [][] ;
delete [] ;
show ;
zero .
,
,
tcpdump,
. ,
, trafshow:
# tcpdump i de0
...
# cd /usr/ports/net/trafshow/
# trafshow i de0
...
,
IPFW
. :
# ipfw add pipe 1008 tcp from any to 10.0.0.8 out via de1
# ipfw pipe 1008 config bw 256Kbit/s
, 10.0.0.8,
256
.
,
,
.
8.
76
FreeBSD 9. -
(ipa)
,

. ,
.
ipa ipfw. ,
ipa:
#
#
#
#
#
#
cd /usr/ports/sysutils/ipa
make install clean
cd /usr/ports/net/ipa_ipfw
make install clean
cd /usr/ports/databases/ipa_sdb
make install clean
# vi /usr/local/etc/ipa.conf
#
ac_mod "ipa_ipfw.so";
db_mod "ipa_db_sdb.so";
global {
update_time = 1m;
append_time = 1h;
ac_list = ipfw;
db_list = sdb;
ipfw:maxchunk = 1G;
sdb:db_group = wheel;
}
# IPA IPFW
rule IN { ipfw:rules = 800; info = "IP INCOMING"; }
rule OUT { ipfw:rules = 900; info = "IP OUTGOING"; }
# vi /usr/local/etc/ipastat.conf
#
st_mod "ipa_st_sdb.so";
dynamic_rules = yes;
global { st_list = sdb; }
FreeBSD 9. -
77

- ( ,
) , ipa .
count

:
# vi /usr/local/etc/firewall.conf
add 800 count ip from any to me in via de0
add 900 count ip from me to any out via de0
. ipa
:
# echo ipa_enable=\"YES\" >> /etc/rc.conf
# /usr/local/etc/rc.d/ipa start
# ipastat -q -r IN r OUT
,
, -
, . ,

, ..
. 8.
. -
, , ,
, :
/usr/local/share/doc/ /

- , ,
: /var/log/
78
FreeBSD 9. -
FreeBSD 9. -
79
5

.
sendmail,
postfix.

,
.
FreeBSD 9. -
80
-
,
, MX .
, MX, (A ).
, ,
( -
):
@
gateway
MX
A
10 gateway.example.com.
22.22.22.22

mail, ,
:
@
@
gateway
mail
www
MX
A
A
A
CNAME
10 mail.example.com.
22.22.22.22
22.22.22.22
22.22.22.22
gateway
!
, , IP, , IP 22.22.22.22
, ,
MX .
PTR , ..
mail.example.com.

. ,
DNS
. TTL
( ) ,
.
FreeBSD 9. -
81
(sendmail)
sendmail.
:
# echo sendmail_enable=\"YES\" >> /etc/rc.conf
/etc/mail .
( , ):
# cd /etc/mail/
# cp access.sample access
# vi access
10.0.0
RELAY
local-host-names, example.com, sendmail

:
# vi local-host-names
example.com

sendmail:
# make maps
# make restart
,
.
adduser, ,
, POP3,

vipw. ,
.
.
82
FreeBSD 9. -
, .
:
login:passwd:uid:gid:class:0:0:fullname:homedir:shell

: (), , ,
, , ,
( ).
test@example.com,
.. test ,
(raph):
# vipw
root:*:0:0::0:0:Charlie &:/root:/bin/csh
...
raph:*:1001:0::0:0:Usr&:/home/raph:/usr/local/bin/bash
test:*:2001:6::0:0:Usr&:/nonexistent:/sbin/nologin

raph () test ( ).
, 2001,
6 mail.
/etc/group.

test ,
,
. ,
( ),
, . :
# passwd test
Changing local password for test
New Password:
Retype New Password:
# _
FreeBSD 9. -
83
, ,

.
test :
# pw useradd -n test -g mail -d /nonexistent -s /sbin/nologin
# passwd test
(sendmail)

, /etc/mail/aliases.
:
# vi /etc/mail/aliases
info:
user1, user2
user3: user3, username@anotherdomain.com
# newaliases
info@example.com
user1 user2 ( info
), user3@example.com

.

, local-host-names:
# vi local-host-names
example.com
example2.com
example3.com
FreeBSD 9. -
84
,
, .

, /etc/mail/virtusertable.
:
# vi /etc/mail/virtusertable
user1@example.com
user1
user2@example2.com
user2
@example3.com
user3
# make maps && make restart
user1
example.com, user2 example2.com,
example3.com user3.
!
sendmail, sendmail (
/etc/mail):
# newaliases
# make maps
# make restart
(mail, cucipop)

/var/mail ,
.
mail.
FreeBSD 9. -
85
.
:
mail test@example.com ;
mail -u test /var/mail/test.
-
POP3.
,
cucipop. :
# cd /usr/ports/mail/cucipop/
cucipop ,
, ,
POP3 (TCP 110).
inetd. ,
,
pop3:
pop3 stream tcp nowait root /usr/local/libexec/cucipop cucipop
# echo inetd_enable=\"YES\" >> /etc/rc.conf
# /etc/rc.d/inetd restart
, , pop3 110 ,
/etc/services
,
.

, ..

/var/mail,
POP3,
86
FreeBSD 9. -
. - ,
SMTP , ,
sendmail . :
# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 mail.example.com ESMTP Sendmail
helo me
250 mail.example.com Hello localhost, pleased to meet you
mail from: admin@freebsd.org
250 2.1.0 admin@freebsd.org... Sender ok
rcpt to: test
250 2.1.5 test... Recipient ok
data
354 Enter mail, end with "." on a line by itself
This is a TEST MESSAGE!!!
.
250 2.0.0 r099qYxS001511 Message accepted for delivery
^]
telnet> Connection closed.
. , ,
POP3
SMTP : 10.0.0.1,
.
, ,
- .
. , ,
,
.
.
FreeBSD 9. -
87
MTA (postfix)
,
, .
sendmail
postfix. ,

, .
.

,
( sendmail).
.
, , .
,
-.
. ,
.
,
-.
.
,
, .. , ,
, .
, ,
,
. :
# cd /usr/ports/mail/postfix/
FreeBSD 9. -
88

MySQL () :
[*] PCRE
[*] SASL2
[*] TLS
Perl Compatible Regular Expressions

Cyrus SASLv2 (Simple Auth.and Sec.Layer)
Enable SSL and TLS support
MySQL ( ), :
[*]
[*]
[*]
[*]
PCRE
DOVECOT2
TLS
MYSQL
Perl Compatible Regular Expressions

Dovecot 2.x SASL authentication method
Enable SSL and TLS support
MySQL maps (uses WITH_MYSQL_VER)
SASL MySQL.
, ,
Postfix :
Would you like to activate Postfix in
/etc/mail/mailer.conf [n]? y
. ,
postfix sendmail, .
rc.conf, periodic.conf
, .. :
# vi /etc/rc.conf
postfix_enable="YES"
sendmail_enable="NO"
sendmail_submit_enable="NO"
sendmail_outbound_enable="NO"
sendmail_msp_queue_enable="NO"
# vi /etc/periodic.conf
daily_clean_hoststat_enable="NO"
daily_status_mail_rejects_enable="NO"
daily_status_include_submit_mailq="NO"
daily_submit_queuerun="NO"
FreeBSD 9. -
89
postfix:
# vi /usr/local/etc/postfix/main.cf
# SMTP
# PTR
myhostname = mail.example.com
mydomain = example.com
#
myorigin = $mydomain
#
mydestination = $mydomain
#
inet_interfaces = all
mynetworks_style = subnet
mynetworks = 10.0.0.0/24, 127.0.0.1/32
#
message_size_limit = 10485760
mailbox_size_limit = 1073741824
#
smtpd_recipient_restrictions =
#
permit_mynetworks,
#
reject_unauth_destination
smtpd_recipient_restrictions .

.
sendmail postfix.
newaliases,
postfix ,
, :
#
#
#
#
/etc/rc.d/sendmail stop
postfix check
/usr/local/etc/rc.d/postfix start
newaliases
90
FreeBSD 9. -

. , /var/mail,
POP3
cucipop, .. .
postfix ,
sendmail. ,
sendmail:
# telnet localhost 25
Trying 127.0.0.1...
Connected to localhost.
Escape character is '^]'.
220 mail.example.com ESMTP Postfix
helo me
250 mail.example.com
mail from: admin@freebsd.org
250 2.1.0 Ok
rcpt to: test
250 2.1.5 Ok
data
354 End data with <CR><LF>.<CR><LF>
This is a TEST MESSAGE!!!
.
250 2.0.0 Ok: queued as 7D37CA2F153
^]
telnet> Connection closed.

, postfix:
#
mydestination = $mydomain, example2.com, example3.com
,
, .

, :
FreeBSD 9. -
91
#
mydestination = $myhostname
#
virtual_alias_domains = hash:/usr/local/etc/postfix/v
irtual_alias_domains
#
virtual_alias_maps = hash:/usr/local/etc/postfix/virt
ual_alias_maps
# vi /usr/local/etc/postfix/virtual_alias_domains
example.com
20130101
example2.com 20130101
example3.com 20130101
# vi /usr/local/etc/postfix/virtual_alias_maps
user1@example.com
user1
user2@example2.com
user2
@example3.com
user3
# postmap hash:/usr/local/etc/postfix/virtual_alias_domains
# postmap hash:/usr/local/etc/postfix/virtual_alias_maps
# /usr/local/etc/rc.d/postfix restart
! ,
mydestination, ..
, :

, , .

mydestination
. ,
, .. .
mydestination,
example.com .
.
92
FreeBSD 9. -
C POSTFIX (postfix + mysql)

postfix
postfixadmin mysql,

.
( ):
myhostname = mail.example.com
mydomain = example.com
myorigin = $mydomain
#
mydestination = $myhostname
# MySQL
virtual_alias_maps = proxy:mysql:/usr/local/etc/postfi
x/mysql_virtual_alias_maps.cf
# MySQL
virtual_mailbox_maps = proxy:mysql:/usr/local/etc/post
fix/mysql_virtual_mailbox_maps.cf
# MySQL
virtual_mailbox_domains = proxy:mysql:/usr/local/etc/p
ostfix/mysql_virtual_domains_maps.cf
#
virtual_mailbox_base = /usr/mail
#
virtual_minimum_uid = 65534
virtual_uid_maps = static:65534
virtual_gid_maps = static:65534
inet_interfaces = all
mynetworks_style = subnet
mynetworks = 10.0.0.0/24, 127.0.0.1/32
message_size_limit = 10485760
mailbox_size_limit = 1073741824
permit_mynetworks,
FreeBSD 9. -
93
( virtual_mailbox_base) ,
,
, postfixadmin:
# mkdir /usr/mail
# chown 65534:65534 /usr/mail
# vi /usr/local/etc/postfix/mysql_virtual_alias_maps.cf
user = postfix
password = pass
hosts = localhost
dbname = postfix
query = SELECT goto FROM alias WHERE address='%s' AND
active = '1'
# vi /usr/local/etc/postfix/mysql_virtual_mailbox_maps.cf
user = postfix
password = pass
hosts = localhost
dbname = postfix
query = SELECT maildir FROM mailbox WHERE username='%s'
AND active = '1'
# vi /usr/local/etc/postfix/mysql_virtual_domains_maps.cf
user = postfix
password = pass
hosts = localhost
dbname = postfix
query = SELECT domain FROM domain WHERE domain='%s' AND
active = '1'
! ,
postfix .

- apache, mysql, php
postfixadmin.
postfix .
94
FreeBSD 9. -
POP3/IMAP4 (dovecot)
cucipop
dovecot. POP3, IMAP4
, :
# cd /usr/ports/mail/dovecot2/

MySQL () .
MySQL ( ),
[*] MYSQL.
-
/usr/local/etc/dovecot,
,
:
# cp -r /usr/local/share/doc/dovecot/example-config/* /u
sr/local/etc/dovecot/
# vi /usr/local/etc/dovecot/dovecot.conf
#
listen = *
# vi /usr/local/etc/dovecot/conf.d/10-auth.conf
#
disable_plaintext_auth = no
#
!include auth-system.conf.ext
# vi /usr/local/etc/dovecot/conf.d/10-ssl.conf
# SSL/TLS
ssl = no
#ssl_cert = </etc/ssl/certs/dovecot.pem
#ssl_key = </etc/ssl/private/dovecot.pem
FreeBSD 9. -
95
# vi /usr/local/etc/dovecot/conf.d/10-mail.conf
#
mail_location = mbox:~/mail:INBOX=/var/mail/%u
#
first_valid_uid = 500
last_valid_uid = 0
first_valid_gid = 1
last_valid_gid = 0
# echo dovecot_enable=\"YES\" >> /etc/rc.conf
# /usr/local/etc/rc.d/dovecot start
dovecot
pop3 /etc/inetd.conf
inetd, .
, wheel
dovecot, .. 0.
.
.
IMAP.
,
, , , . ,
mail_location , ,
( ,
/nonexistent),
.
vipw adduser
, .

,
man . adduser
,
96
FreeBSD 9. -
( , /etc/passwd, ):
# vi /usr/local/etc/postfix/newmails.txt
user1:2001:6:::::/home/user1:/usr/sbin/nologin:pass123
user2:2002:6:::::/home/user2:/usr/sbin/nologin:pass456
# adduser f /usr/local/etc/postfix/newmails.txt
,
IMAP4. , (IMAP POP3).
C DOVECOT (dovecot + mysql)

2
mysql, dovecot
(
):
# vi /usr/local/etc/dovecot/conf.d/10-auth.conf
#
disable_plaintext_auth = no
# SQL
#!include auth-system.conf.ext
!include auth-sql.conf.ext
# vi /usr/local/etc/dovecot/conf.d/10-mail.conf
#
mail_location = maildir:/usr/mail/%d/%n
#
#first_valid_uid = 500
#last_valid_uid = 0
first_valid_gid = 65534
#last_valid_gid = 0
FreeBSD 9. -
97
# vi /usr/local/etc/dovecot/conf.d/auth-sql.conf.ext
# MySQL
passdb {
driver = sql
args = /usr/local/etc/dovecot/dovecot-sql.conf.ext
}
# MySQL
userdb {
driver = sql
args = /usr/local/etc/dovecot/dovecot-sql.conf.ext
}
postfix,
:
# vi /usr/local/etc/dovecot/dovecot-sql.conf.ext
driver = mysql
connect = host=localhost dbname=postfix user=postfix pa
ssword=pass
default_pass_scheme = MD5-CRYPT
password_query = SELECT username AS user,password FROM
mailbox WHERE username = '%u' AND active='1'
user_query = SELECT maildir, 65534 AS uid, 65534 AS gid
FROM mailbox WHERE username = '%u' AND active='1'
! , ,
postfix, dovecot.
,
-
apache, mysql, php postfixadmin.
dovecot .
98
FreeBSD 9. -
(mb2md)
,
,
postfix dovecot
MySQL.
. , postfix:
# /usr/local/etc/rc.d/postfix stop
# cd /usr/ports/mail/postfix/
# make config reinstall clean

. config ,
. ,
, ..
/var/db/ports/postfix/options. ,
config make.

. dovecot
:
# /usr/local/etc/rc.d/dovecot stop
# cd /usr/ports/mail/dovecot2/
# make config reinstall clean

. :
1. .
mysql.
;
FreeBSD 9. -
99
2. ,
: /usr/mail/[]/[]
maildir;
3.
, ..
;
4. / , - postfixadmin.
.
,

dsync,
dovecot, mb2md,
, :
# cd /usr/ports/mail/mb2md/
# mb2md -s /home/test/mail/ -R -d /usr/mail/example.com/test/
test
mailbox maildir test@example.com. ,
, ..
100% ,
.
100
FreeBSD 9. -
(cyrus-sasl)
,
( MySQL). ,

, , ,
SMTP
:
# cd /usr/ports/security/cyrus-sasl2-saslauthd/
# vi /usr/local/lib/sasl2/smtpd.conf
pwcheck_method: saslauthd
mech_list: PLAIN LOGIN
permit_mynetworks,
#
permit_sasl_authenticated,
#
smtpd_sasl_auth_enable = yes
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
# echo saslauthd_enable=\"YES\" >> /etc/rc.conf
# /usr/local/etc/rc.d/saslauthd start
,
, postfix
, .. (

, .. POP3,
IMAP SMTP ).
FreeBSD 9. -
101
(dovecot-sasl + mysql)
,
( MySQL),
.
Cyrus SASL,
, postfixadmin,
Dovecot SASL.
:
permit_mynetworks,
#
#
smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous
broken_sasl_auth_clients = yes
# vi /usr/local/etc/dovecot/conf.d/10-master.conf
service auth {
unix_listener /var/spool/postfix/private/auth {
mode = 0666
user = postfix
group = postfix
}
}
# /usr/local/etc/rc.d/dovecot restart
102
FreeBSD 9. -
SSL/TLS (openssl)
,
,
. SSL
, postfix dovecot:
# cd /etc/ssl
# openssl req -new -x509 -nodes -out cert.pem -keyout
key .pem -days 365
Country Name (2 letter code) []:UA
State or Province Name (full name) []:Ukraine
Locality Name (eg, city) []:Kiev
Organization Name (eg, company) []:EXAMPLE LTD
Organizational Unit Name (eg, section) []:MAIL SERVER
Common Name (e.g. server FQDN) []:mail.example.com
Email Address []:postmaster@example.com
# SSL/TLS
smtpd_use_tls = yes
smtpd_tls_received_header = yes
smtpd_tls_cert_file = /etc/ssl/cert.pem
smtpd_tls_key_file = /etc/ssl/key.pem
# vi /usr/local/etc/postfix/master.cf
smtps
inet
n
n
smtpd
-o smtpd_tls_wrappermode=yes
# vi /usr/local/etc/dovecot/conf.d/10-ssl.conf
# SSL/TLS
ssl = yes
ssl_cert = </etc/ssl/cert.pem
ssl_key = </etc/ssl/key.pem
FreeBSD 9. -
103
!
postfix master.cf.

,

, postfix.
SSL/TLS : 465 (smtps), 993

(imaps) 995 (pop3s)

.
(clamav)

.
,
clamav. 12 :
# cd /usr/ports/security/clamav-milter/
# vi /etc/rc.conf
clamav_clamd_enable="YES"
clamav_milter_enable="YES"
clamav_freshclam_enable="YES"
# vi /usr/local/etc/clamav-milter.conf
#
OnInfected Reject
#
RejectMsg "VIRUS DETECTED: %v"
#
AddHeader Replace
104
FreeBSD 9. -
# vi /usr/local/etc/freshclam.conf
#
DatabaseMirror db.ua.clamav.net
# ,
smtpd_milters = unix:/var/run/clamav/clmilter.sock
milter_default_action = accept
#
#
#
#
/usr/local/etc/rc.d/clamav-freshclam start
/usr/local/etc/rc.d/clamav-clamd start
/usr/local/etc/rc.d/clamav-milter start
/usr/local/etc/rc.d/postfix restart
. ,
, :
X-Virus-Scanned: clamav-milter 0.97.6 at mail.example.com
X-Virus-Status: Clean
-. POSTFIX (postfix)
, -
,
, .
:
?.
.
.
, ,
- -.

.
FreeBSD 9. -
105
, ,
postfix , SMTP
,
.

smtpd_recipient_restrictions :
#
address_verify_sender = <>
#
smtpd_delay_reject = yes
# HELO/EHLO
smtpd_helo_required = yes
#
disable_vrfy_command = yes
#
permit_mynetworks,
reject_unauth_destination,
#
reject_unauth_pipelining,
# , ,
#
check_helo_access hash:/usr/local/etc/postfix/acc
ess_helo,
check_client_access hash:/usr/local/etc/postfix/a
ccess_client,
check_sender_access hash:/usr/local/etc/postfix/a
ccess_sender,
check_recipient_access hash:/usr/local/etc/postfi
x/access_recipient,
# , DNS
reject_unknown_client_hostname,
# ,
reject_non_fqdn_helo_hostname,
reject_invalid_helo_hostname,
reject_unknown_helo_hostname,
FreeBSD 9. -
106
# ,
reject_non_fqdn_sender,
reject_unknown_sender_domain,
reject_unverified_sender,
# ,
reject_non_fqdn_recipient,
reject_unknown_recipient_domain,
reject_unverified_recipient
# vi /usr/local/etc/postfix/access_helo
10
REJECT Incorrect config.
172.16
192.168
127.0.0.1
localhost
localhost.localdomain
22.22.22.22
REJECT You are not me.
example.com
gateway.example.com
localhost.example.com
# cd /usr/local/etc/postfix
# touch access_client access_sender access_recipient
#
#
#
#
postmap
postmap
postmap
postmap
hash:/usr/local/etc/postfix/access_helo
hash:/usr/local/etc/postfix/access_client
hash:/usr/local/etc/postfix/access_sender
hash:/usr/local/etc/postfix/access_recipient

postfix. ,
,
, PTR ,
DNS , .. ,
, ,

.
FreeBSD 9. -
107
access_helo
, .
. - ,
REJECT OK.
(access_client),
(access_sender)
(access_recipient). ,

, , -

. :
# vi /usr/local/etc/postfix/access_sender
user@remotedomain.com
OK
# postmap hash:/usr/local/etc/postfix/access_sender

, ..
smtpd_recipient_restrictions .
! postfix
- ,
,
, , postfix
.
.
,
30% .
,
, , .
108
FreeBSD 9. -
-. (postgrey)

. - ,
,
-

. , -
,
.

.
postgrey:
# cd /usr/ports/mail/postgrey/
#
...
reject_unverified_recipient,
# POSTGREY
check_policy_service inet:127.0.0.1:10023
# echo postgrey_enable=\"YES\" >> /etc/rc.conf
# /usr/local/etc/rc.d/postgrey start
, - , -

,
X-Greylist, , , , ..
postgrey ,
.
:
FreeBSD 9. -
109
# vi /usr/local/etc/rc.d/postgrey
--x-greylist-header='X-Greylist: delayed %t seconds
by postgrey-%v at %h; %d'"}
# /usr/local/etc/rc.d/postgrey restart
:
X-Greylist: delayed 308 seconds by postgrey-1.3
4 at mail.example.com; Tue, 1 Jan 2013 09:00:00
, ,
, 30% . ,
postfix postgrey, ,
60%. 40%,
.
-. - (dnsbl)
- ,
? DNS BlackList
, , , ,
. ,
dnsbl
, - , -?
,
, - ,
,
postfix. ,
.
DNSBL
, .
110
FreeBSD 9. -

smtpd_recipient_restrictions:
#
...
reject_unverified_recipient,
# DNSBL
reject_rbl_client bl.spamcop.net,
reject_rbl_client dnsbl.sorbs.net,
reject_rbl_client zen.spamhaus.org,
# POSTGREY
check_policy_service inet:127.0.0.1:10023
70% .
,
.
dnsbl, ,
.
-. - (dspam)
,
, ,
,
. 99% .
99,9%.
, dspam:
# cd /usr/ports/mail/dspam
FreeBSD 9. -
111
:
[*]
[*]
[*]
[*]
[*]
SYSLOG
DEBUG
DAEMON
HASH
POSTFIX_MBC
Logs via syslog

Enable debugging logging
Daemonize dspam; speaks LMTP
Use hash driver
Dspam as mailbox_command Postfix
:
# vi /usr/local/etc/dspam.conf
# ( )
StorageDriver /usr/local/lib/dspam/libhash_drv.so
# MTA
DeliveryHost
127.0.0.1
DeliveryPort
24
DeliveryIdent
localhost
DeliveryProto
SMTP
# ()
Trust nobody
Trust dovecot
#
Preference "trainingMode=TEFT"
# -
Preference "spamAction=tag"
# -
Preference "spamSubject=[SPAM]"
#
Preference "signatureLocation=headers"
#
TrainPristine off
ParseToHeaders off
ChangeModeOnParse off
ChangeUserOnParse off
#
ServerPID
/var/run/dspam.pid
ServerMode
auto
ServerParameters
"--deliver=innocent,spam -d %u"
ServerIdent
"mail.example.com"
ServerDomainSocketPath "/var/run/dspam.sock"
112
FreeBSD 9. -
# vi /var/db/dspam/group
#
globalgroup:shared:*
# echo dspam_enable=\"YES\" >> /etc/rc.conf
# /usr/local/etc/rc.d/dspam start
postfix. ,
master.cf
:
# vi /usr/local/etc/postfix/master.cf
smtp inet
n
n
smtpd
-o content_filter=lmtp:unix:/var/run/dspam.sock
...
localhost:24
inet
n
n
smtpd
-o content_filter=
-o receive_override_options=no_unknown_recipient_ch
ecks,no_header_body_checks
-o smtpd_helo_restrictions=
-o smtpd_client_restrictions=
-o smtpd_sender_restrictions=
-o smtpd_recipient_restrictions=permit_mynetworks,reject
-o mynetworks=127.0.0.0/8
-o smtpd_authorized_xforward_hosts=127.0.0.0/8
. dspam ,
, ,
. ,
dspam ,
.
, .
, .. - .
FreeBSD 9. -
113

dspam, :
X-DSPAM-Result:
X-DSPAM-Processed:
X-DSPAM-Confidence:
X-DSPAM-Probability:
X-DSPAM-Signature:
Innocent
Tue Jan 1 09:00:00 2013
0.9899
0.0000
50eff5ca583321172312311
X-DSPAM-Result : Innocent
, Spam , . ,
[SPAM]
. , ..
. :
spam:
"|/usr/local/bin/dspam --user root --class=s
pam --source=error"
notspam: "|/usr/local/bin/dspam --user root --class=i
nnocent --source=error"
# newaliases
, - ,

spam@example.com.
, ,
,
notspam@example.com. 50-100 .

,
. :
# dspam_stats -H globalgroup
114
FreeBSD 9. -
,
,
,
, :
local_recipient_maps =
luser_relay = test
test
, .
,
99,8% . , ,

.
IMAP (antispam, pigeonhole)

IMAP4
,
.
SPAM,
. ,
, -
. ,
IMAP , ..
SPAM ,
, , ..
spam notspam
.
dovecot:
FreeBSD 9. -
#
#
#
#
115
cd /usr/ports/mail/dovecot2-pigeonhole/
make install clean
cd /usr/ports/mail/dovecot2-antispam-plugin/
make install clean
# vi /usr/local/etc/dovecot/conf.d/15-lda.conf
protocol lda {
#
mail_plugins = $mail_plugins sieve
}
# vi /usr/local/etc/dovecot/conf.d/20-imap.conf
protocol imap {
#
mail_plugins = $mail_plugins antispam autocreate
}
# vi /usr/local/etc/dovecot/conf.d/90-plugin.conf
plugin {
#
autocreate = SPAM
autocreate2 = Sent
autocreate3 = Trash
#
autosubscribe = SPAM
autosubscribe2 = Sent
autosubscribe3 = Trash
#
sieve_default = /usr/local/etc/dovecot/spam.sieve
sieve_global_dir = /usr/local/etc/dovecot
#
antispam_backend = dspam
antispam_signature = X-DSPAM-Signature
antispam_signature_missing = error
antispam_spam = SPAM
antispam_trash = Trash
antispam_dspam_binary = /usr/local/bin/dspam
antispam_dspam_args = --source=error;--signature=%%s
}
116
FreeBSD 9. -
# vi /usr/local/etc/dovecot/spam.sieve
require ["fileinto","imap4flags"];
#
if header :contains "X-DSPAM-Result" "Spam"
{
# , ,
setflag "\\seen";
# SPAM
fileinto "SPAM";
stop;
}
# sievec /usr/local/etc/dovecot/spam.sieve
, ,
dovecot, ,
:
mailbox_command = /usr/local/libexec/dovecot/dovecotlda -f "$SENDER" -a "$RECIPIENT"

. , SPAM, , ,
,
.
-
FreeBSD 9. -
117
6
-

,
, , , , ,
- .
. - Apache
-,
,
, , ,
.
118
FreeBSD 9. -
- (apache)
, -
, , ,
-. Apache
PHP
MySQL -
:
#
#
#
#
cd /usr/ports/www/apache22/
make install clean
cd /usr/ports/lang/php5/
make install clean
, ,
-:
[*] APACHE
Build Apache module
# cd /usr/ports/lang/php5-extensions/
,
, , , :
[*] IMAP
[*] MYSQL
IMAP support
MySQL database support
# cd /usr/ports/databases/mysql55-server/
# vi /usr/local/etc/apache22/httpd.conf
# PHP
LoadModule php5_module libexec/apache22/libphp5.so
AddType application/x-httpd-php .php
AddType application/x-httpd-php-source .phps
#
<IfModule dir_module>
DirectoryIndex index.html index.php
</IfModule>
FreeBSD 9. -
119
# vi /usr/local/etc/php.ini
date.timezone = Europe/Kiev
# vi /etc/rc.conf
mysql_enable="YES"
apache22_enable="YES"
# /usr/local/etc/rc.d/mysql-server start
# /usr/local/etc/rc.d/apache22 start
php.ini
. ,
, . HTTP- 80
, PHP
MySQL. http://example.com
, :
It Works!
,
IP- DNS .
, , ,
.
, PHP.
index.php :
# vi /usr/local/www/apache22/data/index.php
<? phpinfo(); ?>

http://example.com/index.php.
PHP, .
, ,
FreeBSD 9. -
120
,
. , :
#
DocumentRoot "/usr/local/www"
#
<Directory "/usr/local/www">
Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from all
</Directory>
#
<Directory "/usr/local/share/doc">
Options Indexes FollowSymLinks
AllowOverride None
Order allow,deny
Allow from 10.0.0.0/24
</Directory>
#
Alias /doc "/usr/local/share/doc"
# apachectl restart

,
,
. :
http://example.com
http://example.com/doc
FreeBSD 9. -
121
(postfixadmin)
postfix
. postfixadmin:
# cd /usr/ports/mail/postfixadmin/
# cd /usr/local/www/postfixadmin/
# vi config.inc.php
#
$CONF['configured'] = true;
#
$CONF['default_language'] = 'ru';
# : , ,
# ,
$CONF['database_type'] = 'mysql';
$CONF['database_host'] = 'localhost';
$CONF['database_user'] = 'postfix';
$CONF['database_password'] = 'pass';
$CONF['database_name'] = 'postfix';
#
$CONF['encrypt'] = 'md5crypt';
# :
# /usr/mail//
$CONF['domain_path'] = 'YES';
$CONF['domain_in_mailbox'] = 'NO';
mysql postfix,
,
:
# mysql
mysql> create database postfix;
mysql> grant all on postfix.* to postfix@localhost ident
ified by 'pass';
mysql> quit
122
FreeBSD 9. -

postfix
pass.
postfixadmin .
: http://example.com/postfixadmin/setup.php setup- (. 15).
.
[Generate password hash],
-
(. 16).
FreeBSD 9. -
123

postfixadmin,
, :
# vi config.inc.php
# setup-
$CONF['setup_password'] = '1d1a401e0d93e73f95b340...';
setup-
.
: http://example.com/postfixadmin.

. postfix dovecot
mysql, .
mysql.
mysql
( ):
show databases; ;
use postfix; postfix;
show tables; ;
select * from domain; domain
(.. );
select username from mailbox;
username mailbox (.. );
select password from mailbox where username =
'test@example.com'; password
mailbox, username = test@example.com (..
test@example.com);
quit .
124
FreeBSD 9. -
(roundcube)
,
,
-
.
, , roundcube. :
# cd /usr/ports/mail/roundcube/
# mysql
mysql> create database roundcubemail;
mysql> grant all on roundcubemail.* to roundcube@localho
st identified by 'pass';
mysql> quit
#
#
#
#
#
cd /usr/local/www/roundcube/
mysql roundcubemail < SQL/mysql.initial.sql
cp config/main.inc.php.dist config/main.inc.php
cp config/db.inc.php.dist config/db.inc.php
vi config/db.inc.php
#
$rcmail_config['db_dsnw'] = 'mysql://roundcube:pass@l
ocalhost/roundcubemail';
mysql roundcubemail,
roundcube pass.
, :
http://example.com/roundcube -
, (. 17).
, localhost.
(. 18).
FreeBSD 9. -
125
126
FreeBSD 9. -
- SQUID (lightsquid)
, , ,
,
, .
- :
# cd /usr/ports/www/lightsquid/
# vi /usr/local/etc/lightsquid/lightsquid.cfg
# SQUID
$logpath
="/var/squid/logs";
# SQUID
$squidlogtype = 0;
#
$lang
="ru";
# CGI LIGHTSQUID
<Directory "/usr/local/www/lightsquid">
AddHandler cgi-script .cgi
AllowOverride All
</Directory>
# apachectl restart
# /usr/local/www/lightsquid/check-setup.pl
all check passed, now try access to cgi part in browser
# /usr/local/www/lightsquid/lightparser.pl
-,
.
: http://example.com/lightsquid
, (. 19).
FreeBSD 9. -
127

cron:
# vi /etc/crontab
0
2
*
*
*
root
lightparser.pl yesterday
/usr/local/www/lightsquid/
# killall HUP cron
/usr/local/etc/lightsquid
,
:
group.cfg
( , , ..);
realname.cfg IP- (
, ..);
skipuser.cfg IP-
.
128
FreeBSD 9. -
(mrtg)
mrtg
,
. snmp
-:
#
#
#
#
cd /usr/ports/net-mgmt/net-snmp/
make install clean
cd /usr/ports/net-mgmt/mrtg/
make install clean
# vi /usr/local/share/snmp/snmpd.conf
rwuser root noauth
rouser root noauth
rwcommunity public 22.22.22.22
rocommunity public 22.22.22.22
# vi /usr/local/etc/mrtg/mrtg.cfg
#
WorkDir: /usr/local/www/mrtg
# SNMP
Target[gateway]: 1:public@22.22.22.22
#
MaxBytes[gateway]: 1024000
# HTML
Title[gateway]: Traffic Analysis for Gateway
PageTop[gateway]: <H1>Stats for our GATEWAY Server</H1>
#
#
#
#
mkdir /usr/local/www/mrtg
echo snmpd_enable=\"YES\" >> /etc/rc.conf
/usr/local/etc/rc.d/snmpd start
/usr/local/bin/mrtg /usr/local/etc/mrtg/mrtg.cfg
# vi /etc/crontab
*/5
*
*
*
*
root
/local/etc/mrtg/mrtg.cfg
# killall HUP cron
/usr/local/bin/mrtg /usr
FreeBSD 9. -
129

mrtg 5 .
, -:
http://example.com/mrtg/gateway.html (. 20).
, SNMP
.
Target -1:
# vi /usr/local/etc/mrtg/mrtg.cfg
...
Target[gateway]: -1:public@22.22.22.22
130
FreeBSD 9. -
- (httpd.conf)
,
apache , , ,
- . :
Include etc/apache22/extra/httpd-vhosts.conf
# vi /usr/local/etc/apache22/extra/httpd-vhosts.conf
NameVirtualHost *:80
<VirtualHost *:80>
ServerName
default
</VirtualHost>
<VirtualHost *:80>
ServerAdmin
postmaster@example.com
DocumentRoot /usr/local/www/roundcube
ServerName
mail.example.com
ErrorLog
/var/log/mail.example.com-error.log
</VirtualHost>
# apachectl restart
- IP-
http://10.0.0.1 http://22.22.22.22,
http://gateway.example.com ,
/usr/local/www (
,
, )
http://mail.example.com
, /usr/local/www/roundcube.
,
,
VirtualHost .
FreeBSD 9. -
131
7

-
. , ,
, , ..
132
FreeBSD 9. -
(natd, socket)
, , ,
- . ,
Windows,
( ),
. socket:
# cd /usr/ports/sysutils/socket
# vi /etc/services
rdp 3389/tcp
rdp stream tcp nowait root /usr/local/bin/socket -v 10.0.
0.20 3389
, inetd,
(mstsc)
IP- 22.22.22.22, 3389
10.0.0.20,
3389,
.
,
natd.
:
# vi /etc/rc.conf
natd_enable="YES"
natd_interface="de0"
natd_flags="-f /etc/natd.conf"
# vi /etc/natd.conf
redirect_port tcp 10.0.0.20:3389 3389
FreeBSD 9. -
133
VPN (mpd)

Windows ,
, VPN mpd5:
# cd /usr/ports/net/mpd5/
# cd /usr/local/etc/mpd5/
# cp mpd.conf.sample mpd.conf
# vi mpd.conf
startup:
#
set user admin pass admin
default:
# pptp_server
load pptp_server
pptp_server:
# IP-
set ippool add pool1 10.0.0.210 10.0.0.220
# IP-
set ipcp ranges 10.0.0.8/32 ippool pool1
# DNS
set ipcp dns 10.0.0.1
# WINS
set ipcp nbns 10.0.0.1
# de0
set pptp self de0
# vi mpd.secret
ruser1 "pass1"
ruser2 "pass2"
10.0.0.201
*
# echo mpd_enable=\"YES\" >> /etc/rc.conf

# /usr/local/etc/rc.d/mpd5 start
Windows
- ,
134
FreeBSD 9. -
IP- 22.22.22.22,
mpd.secret . ruser1
IP- 10.0.0.201, ruser2 10.0.0.210 10.0.0.220,
10.0.0.8.
(ipsec)
,
, .. , ,
, ..
.

VPN ( )
ipsec.
192.168.0.0/24
66.66.66.66.
VPN FreeBSD , ,
,
ipsec:
# vi /usr/src/sys/amd64/conf/GATEWAY
...
options IPSEC
device
crypto
...
device
gif
gif ,
.
.
:
FreeBSD 9. -
#
#
#
#
#
135
ifconfig gif0 create

ifconfig gif0 10.0.0.1 192.168.0.1 netmask 255.255.255.0
ifconfig gif0 tunnel 22.22.22.22 66.66.66.66
route add 192.168.0.0/24 192.168.0.1
ipfw add 3000 allow ip from any to any via gif0
,
IP- . ,
gif0 -
:
# ifconfig gif0
gif0: flags=8011<UP,POINTOPOINT,MULTICAST> mtu 1280
tunnel inet 22.22.22.22 --> 66.66.66.66
inet 10.0.0.1 --> 192.168.0.1 netmask 0xffffff00
# ping 192.168.0.10
,
:
# vi /etc/rc.conf
gif_interfaces="gif0"
gifconfig_gif0="22.22.22.22 66.66.66.66"
ifconfig_gif0="10.0.0.1 192.168.0.1 netmask 255.255.255.0"
# vi /etc/rc.local
route add 192.168.0.0/24 192.168.0.1
# vi /usr/local/etc/firewall.conf
...
add 3000 allow ip from any to any via gif0
, ,
,
- (
, gif1, gif2 ..).
136
FreeBSD 9. -
(synonym)

.
,
.
sendmail
synonym:
# cd /usr/ports/mail/synonym/
# echo synonym_enable=\"YES\" >> /etc/rc.conf
, admin@example.com:
# vi /usr/local/etc/synonym.conf
<Rules>
<Rule>
<Condition>
<Header>From</Header>
<Match>.*</Match>
</Condition>
<Action>
<ActionType>Copy</ActionType>
<Address>admin@example.com</Address>
</Action>
</Rule>
</Rules>
,
. ,
sendmail, :
# vi /etc/mail/sendmail.cf
# Input mail filters
O InputMailFilters=synonym
Xsynonym, S=local:/var/run/synonym/synonym.sock, T=C:
10m;S:1s;R:1s;E:5m
FreeBSD 9. -
137
postfix,
:
smtpd_milters = unix:/var/run/synonym/synonym.sock
milter_default_action = accept
,
postfix:
recipient_bcc_maps = hash:/usr/local/etc/postfix/bcc_recipient
sender_bcc_maps = hash:/usr/local/etc/postfix/bcc_sender

postmap. , postfix
, synonym,
, ,
.
(ssh, scp)
SSH
, . :
ssh []@[]
;
scp []@[]:[ 1] [ 2] 1 , 2.
scp [ 1] []@[]:[ 2] 1 , 2.
138
FreeBSD 9. -
. ,

,
. SSH ( 66.66.66.66) ( 22.22.22.22).
,
(.. 66.66.66.66). SSH :
# ssh-keygen -t dsa

mkdir .ssh
,
:
# ssh raph@22.22.22.22 'mkdir /home/raph/.ssh'
SSH ,

authorized_keys .ssh,
:
# cat /root/.ssh/id_dsa.pub | ssh raph@22.22.22.22 'cat
>> /home/raph/.ssh/authorized_keys'
, . ssh scp -
. :
# scp /etc/rc.conf raph@22.22.22.22:/home/raph/rc.conf
,
sshd -:
# vi /etc/ssh/sshd_config
PubkeyAuthentication yes
AuthorizedKeysFile
.ssh/authorized_keys
FreeBSD 9. -
139
(named)
- , . (
, ),
. , ..
DNS .
- ,
secondary.net.ua. ,
- -:
# vi /etc/namedb/named.conf
zone "example2.com" {
type master;
file "/etc/namedb/example2.com";
};
# vi /etc/namedb/example2.com
$TTL
10800
@
IN
SOA
ns.example2.com. root.example2.com. (
2013010101 ; Serial
10800
; Refresh
3600
; Retry
604800
; Expire
86400 )
; Minimum
@
IN
NS
ns.example2.com.
@
IN
NS
ns.secondary.net.ua.
@
IN
MX
10 gw.example2.com.
@
IN
A
66.66.66.66
gw IN
A
66.66.66.66
www IN
CNAME ns
# /etc/rc.d/named restart
,
FreeBSD. ,
- .
140
FreeBSD 9. -
Midnight Commander (mc-light)

:
(. 21)
Norton, Volcov, Far, ,
. FreeBSD Midnight
Commander. , ,
, , 20 .
mc-light
:
# cd /usr/ports/misc/mc-light/
, ,
. - .
FreeBSD 9. -
141
, ,
. ,
. FreeBSD, .
142
FreeBSD 9. -
,

FreeBSD:
1. .
FreeBSD, , ,
, ;
2. . ,
, 5-10
;
3. . ,
100 ,
;
4.
. ,
,
.
FreeBSD , ;
5. .
.
FreeBSD
-;
6. . , ,
, ,
,
.
FreeBSD 9. -
143

shell , , ,
. ,
FreeBSD.
,
Hello, World!.
scrpts,
:
# mkdir /home/raph/scrpts
# cd /home/raph/scrpts
# vi hello.sh
#!/bin/sh
# "Hello, World!"
echo "Hello, World!"
exit 0
# chmod 0755 hello.sh
# ./hello.sh
Hello, World!

#!, ,
.
. echo,
Hello, World! (
).
. ,
0, , , ,
0, .
144
FreeBSD 9. -
.
.
, . . ,
.
,
.
:
myvar=5

$:
echo ${myvar}
,
, .
:
newvar=$myvar

. :
MYVAR=5 export
MYVAR ,
,
.

, read.
( ,
):
FreeBSD 9. -
145
# vi hello2.sh
#!/bin/sh
echo -n "Please enter your name: "
read name
echo "Hello, $name!"
exit 0
read . - :
# ./hello2.sh
Please enter your name: Ivan
Hello, Ivan!
# _

.
$1 - $9. $0
, $@ , $#
:
# vi yourname.sh
#!/bin/sh
echo "The name of the program is: $0"
echo "The total number of arguments: $#"
echo "The complete argument string is: #@"
echo "Your first name is: $1"
echo "Your last name is: $2"
exit 0
:
# ./yourname.sh Ivan Petrov
The name of the program is: ./yourname.sh
The total number of arguments: 2
The complete argument string is: Ivan Petrov
Your first name is: Ivan
Your last name is: Petrov
# _
FreeBSD 9. -
146
.

.
`. .
` ( ,
, ~). , :
TodayDate=`date`
date
TodayDate. .
.

expr :
var3=èxpr
var3=èxpr
var3=èxpr
var3=èxpr
var3=èxpr
var1
var1
var1
var1
var1
+ var2` ;
- var2` ;
\* var2` ;
/ var2` ;
% var2` .

. ,
. ,
, (\*).
r , (r
1) (r 0):
FreeBSD 9. -
expr
expr
expr
expr
expr
expr
var1
var1
var1
var1
var1
var1
147
= var2 ;
!= var2 ;
\> var2 ;
\< var2 ;
\>= var2 ;
\<= var2 .
< >.
r .
. r
,
. ,
, ,
bc.
,
. :
var3=ècho $var1+$var2 | bc -l`
var3=ècho (100-$var1)/(100+$var2) | bc -l`
bc. ,
, .
.

, .
. : while,
until for.
148
FreeBSD 9. -
while , ,
, :
i=1
while [ $i le 10 ]
do
echo $i
i=èxpr $i + 1`
done
while ,
. ,
test. . test , :
-eq , ;
-n , ;
-gt , ;
-g , ;
-lt , ;
-le , .
until while.
,
:
i=1
until [ $i -gt 10 ]
do
echo $i
i=èxpr $i + 1`
done
FreeBSD 9. -
149
while until
AND OR. AND
, ,
OR
:
while [ $var1 -gt 10 ] && [ $var1 -lt 20 ] ,
10 < var1 < 20;
while [ $var1 -lt 10 ] || [ $var1 -gt 20 ] ,
var1 < 10 var1 > 20.
for while until.

for
. for
,
. for
, :
for num in `jot 10 10 20`
do
sq_root=ècho scale=3; sqrt($num) | bc l
echo $sq_root
done
10 20.

true false.
(1) (0),
.
.
150
FreeBSD 9. -

,
: break continue. break
, ,
. continue
.
.
,

.
: if case. ,
AND OR.
if .
, if.
, else,
:
#!/bin/sh
if [ $# -ge 1 ]
then
echo "You supplied $# arguments."
else
echo "Usage: $0 filel file2..."
fi
exit 0
then if , else
. then ,
.
FreeBSD 9. -
151
, .
:
if [ $# -ge 1 ]
then
:
else
echo "Usage: $0 filel file2..."
fi

.
elif.
elif, if.
, ,
(.. , fi). ,
elif. ,
, if.
, elif ..
, ,
. ,
,
else ( ).
case,
, ,
.
, ..
, :
152
FreeBSD 9. -
#!/bin/sh
echo "Do you really want to shutdown? (yes, no)"
read ans
case "$ans" in
[Yy]|[Yy][Ee][Ss])
echo "OK. Good bye."
shutdown h now
;;
[Nn]|[Nn][Oo])
echo "OK. Go on."
;;
*)
echo "Error. Please, type yes or no."
;;
esac
exit 0
AND OR (&& ||)
if.
.
. :
# tar czvf backup.tar.gz ./scripts && rm -r ./scripts
, .
, . :
" .
, ". :
# tar czvf backup.tar.gz ./scripts || echo "Operation failed."
,
. , . : "
, . ,
".
FreeBSD 9. -
153
.
,
.
. ,
.
" ".
, .. , .
,
,
. -,
, ,
:
on_exit() {
echo "Good bye."
mail admin@example.com < ./report.txt
rm ./report.txt
}
...
on_exit
...

.
,
. ,
,
, . ,
, .
154
FreeBSD 9. -
.

,
.
:
F.D. 0 STDIN. .
,
- ;
F.D. 1 STDOUT. .
, , ,
;
F.D. 2 STDERR. .
, .

exec:
#!/bin/sh
exec > ./testfile.txt
echo "Line 1 of the file"
exit 0
exec
STDOUT testfile.txt. , echo
testfile.txt, ,
.
,
,
.
STDIN read:
FreeBSD 9. -
155
#!/bin/sh
exec < ./testfile.txt
while read string do
echo $string
done
exit 0
testfile.txt, ,
,
.
read. read , read
. , read
.
.

, .
,

.
:
#!/bin/sh xv
, ,
, .
156
FreeBSD 9. -
1. backup.sh
.
backup
,
:
# mkdir /home/raph/backup
# vi /home/raph/scrpts/backup.sh
#!/bin/sh
#
date=`date "+%Y%m%d"`
#
path="/home/raph/backup"
#
mkdir ${path}/temp
# temp ,
echo " /etc"
cp -r /etc ${path}/temp/
echo " /usr/local/etc"
cp -r /usr/local/etc ${path}/temp/usr_local_etc
echo " /usr/local/www"
cp -r /usr/local/www ${path}/temp/usr_local_www
echo " /usr/src/sys/amd64/conf"
cp -r /usr/src/sys/amd64/conf ${path}/temp/kernel
echo " /home/raph/scrpts"
cp -r /home/raph/scrpts ${path}/temp/
# ,
chown -R raph:wheel ${path}/*
# temp
echo " ..."
cd ${path}/temp/
tar czf ${path}/backup_${date}.tar.gz ./*
rm -r ${path}/temp
echo ". : backup_${date}.tar.gz"
#
exit 0
FreeBSD 9. -
157

.
, .
backup_[ ].tar.gz
.
:
# chmod ugo+x /home/raph/scrpts/backup.sh
# /home/raph/scrpts/backup.sh
/etc
/usr/local/etc
/usr/local/www
/usr/src/sys/amd64/conf
/home/raph/scrpts
...
. : backup_20130101.tar.gz
# _
, -, ,
FTP,
1 ,
/etc/crontab mail.
158
FreeBSD 9. -
2.
-, ,
,
, ,
.

. :
# vi /home/raph/scrpts/sms.sh
#!/bin/sh
# CMD (),
oper1=`grep CMD: /tmp/sms.txt`
# RBT (reboot),
oper2=`grep RBT: /tmp/sms.txt`
# , 1
if [ $oper1 ]
then
# ,
cmd=ècho $oper1 | cut -d: -f2`
#
ans=`$cmd`
#
echo $ans | mail 380671234567@sms.kyivstar.net
fi
# , 2
if [ $oper2 ]
then
# ,
time=ècho $oper2 | cut -d: -f2`
#
shutdown -r $time
fi
rm /tmp/sms.txt
#
exit 0
# chmod ugo+x /home/raph/scrpts/sms.sh
FreeBSD 9. -
159
, ,
, sms.txt, .

, , ,
:
sms: raph, /tmp/sms.txt, "|/home/raph/scrpts/sms.sh"
# newaliases
.

.
sms@example.com.
:
sms@example.com CMD:ipfw add 500 allow ip from
any to any
sms@example.com RBT:now
555 (
), , .
,

CMD () RBT (). , ,
CMD, ,
, .
RBT, ,
.
, .
160
FreeBSD 9. -
3. VPN IPSEC

VPN ipsec. ,
.
? ,

. , :
# vi /home/raph/scrpts/vpn.conf
66.66.66.66:192.168.0:1
77.77.77.77:10.77.77:10
88.88.88.88:10.0.88:100
, .
1 IP- 66.66.66.66,
192.168.0.0/24 192.168.0.1;
2 IP 77.77.77.77,
10.77.77.0/24 10.77.77.10; 3
IP 88.88.88.88, 10.0.88.0/24
10.0.88.100. :
# vi /home/raph/scrpts/vpn.sh
#!/bin/sh
#
i=0
#
# o=, e=, i=, n=, a=.
oea="22.22.22.22"
oin="10.0.0"
oia="1"
#
ifconfig | grep tunnel | cut -f5 d' ' > /tmp/ifcfg.txt
#
exec < $1
#
while read str
do
FreeBSD 9. -
161
#
# r=, e=, i=, n=, a=.
rea=ècho $str | cut f1 -d':'`
rin=ècho $str | cut f2 -d':'`
ria=ècho $str | cut f3 -d':'`
#
s1=`grep $rea /tmp/ifcfg.txt`
# (3010, 3020..)
nn=èxpr $i \* 10 + 3000`
#
if [ $2 eq "up" ]
then
# up,
if [ -z $s1 ]
then
# , gif, route, ipfw
ifconfig gif$i create
ifconfig gif$i tunnel $oea $rea
ifconfig gif$i inet $oin.$oia $rin.$ria netmask
255.255.255.0
route add $rin.0/24 $rin.$ria
ipfw add $nn allow ip from any to any via gif$i
fi
#
elif [ $2 eq "down" ]
then
# down, gif, route, ipfw
ifconfig gif$i destroy
route delete $rin.0/24 $rin.$ria
ipfw delete $nn
else
# up down,
echo 'Use "up" or "down" parameter...'
fi
i=èxpr $i + 1`
done
rm /tmp/ifcfg.txt
#
exit 0
162
FreeBSD 9. -
# chmod ugo+x /home/raph/scrpts/vpn.sh

:
# /home/raph/scrpts/vpn.sh /home/raph/scrpts/vpn.conf up
, i
, ifconfig

. vpn.conf
.
up, ,
, .
down, .

/usr/local/etc/rc.d/ ( ),
VPN ,
,
vpn.conf .
FreeBSD 9. -
163
4. (ipa)
4
ipa.
, ..
, , ipfw.
,
squid, ipa
. ,
( IP- DHCP
10.0.0.10 10.0.0.99):
# vi /home/raph/scrpts/ipa_ipfw.sh
#!/bin/sh
#
ip=10
#
nt="10.0.0"
# , 99
while [ $ip -le 99 ]
do
# (1010, 1011..)
nn=èxpr $i + 1000`
# -
ipfw add $nn count tcp from me 3128 to $nt.$ip
# 1
ip=èxpr $ip + 1`
done
exit 0
90 1010 1099,
squid
.
-:
164
FreeBSD 9. -
# vi ipa_access.sh
#!/bin/sh
# -
ip=èxpr $1 - 1000`
nt="10.0.0"
# (2010, 2011..)
nn=èxpr $1 + 1000`
#
if [ $2 = deny ]
then
# deny,
ipfw add $nn deny tcp from $nt.$ip to me 3128
#
elif [ $2 = allow ]
then
# up,
ipfw delete $nn
fi
exit 0
# vi ipa_speed.sh
#!/bin/sh
# -
ip=èxpr $1 - 1000`
nt="10.0.0"
# (2010, 2011..)
nn=èxpr $1 + 2000`
#
if [ $2 = down ]
then
# down,
ipfw add $nn pipe $ip tcp from me to $nt.$ip out
ipfw pipe $ip config bw 256Kbit/s
#
elif [ $2 = up ]
then
# up,
ipfw delete $nn
fi
exit 0
FreeBSD 9. -
165
.
ipa,
.
ipa.conf ipastat.conf :
# vi /usr/local/etc/ipa.conf
#
ac_mod "ipa_ipfw.so";
db_mod "ipa_db_sdb.so";
#
only_abs_paths = no;
global {
#
update_time = 5m;
append_time = 3h;
ac_list = ipfw;
db_list = sdb;
ipfw:maxchunk = 1G;
sdb:db_group = wheel;
}
# ipa_ipfw.sh
startup { exec root "/home/raph/scrpts/ipa_ipfw.sh"; }
# IN, OUT ( )
rulepat "[A-Z]" {
#
limit LIM {
# = 50
limit = 50G;
# = 1
restart { restart = +M; }
# =
reach { exec root "echo \"OUR %rule% TRAFFIC IS OVE
R 50G!!!\" | mail raph@example.com"; }
# = 1
expire { expire = +M; }
}
}
166
FreeBSD 9. -
# 1010, 1011..1099 ()
rulepat "[0-9]" {
#
limit LIM {
# = 1
limit = 1G;
# = 1
restart { restart = +W; }
# = ipa_access.sh deny,
reach { exec root "/home/raph/scrpts/ipa_access.s
h %rule% deny"; exec root "echo \"LIMIT %rule% WAS ACTIV
ATE D!\" | mail admin"; }
# .. = 1 , ipa_access.sh allow,
expire { expire = +W; exec root "/home/raph/scrpt
s/ipa_access.sh %rule% allow"; exec root "echo \"LIMIT
%rule% WAS DEACTIVATED!\" | mail admin"; }
}
#
threshold THR {
# = 100 +/- 1
threshold = 100M;
threshold_balance = 1:-:1;
threshold_deviation = 1M;
# = 1
threshold_time_width = 1h;
# = 10
threshold_time_slice = 10m;
# = ipa _speed.sh up,
below_threshold { exec root "/home/raph/scrpts/ip
a_speed.sh %rule% up"; exec root "echo \"SPEED %rule% WA
S UP!\" | mail admin"; }
# = ipa _speed.sh down,
above_threshold { exec root "/home/raph/scrpts/ip
a_speed.sh %rule% down"; exec root "echo \"SPEED %rule%
WAS DOWN!\" | mail admin"; }
}
}
FreeBSD 9. -
167
# -
rule IN { ipfw:rules = 800; }
rule OUT { ipfw:rules = 900; }
# -
rule 1010 { ipfw:rules = 1010; }
...
# vi /usr/local/etc/ipastat.conf
st_mod "ipa_st_sdb.so";
dynamic_rules = yes;
dynamic_limits = yes;
dynamic_thresholds = yes;
global { st_list = sdb; }
, . ,
ipa
( ipa_ipfw.sh).
. 1 50 ,
.
.
1, , ,
-
( ipa_access.sh deny allow).
-
100,
- ,
( ipa_speed.sh down up).
/ /
.
ipa:
168
FreeBSD 9. -
# chmod ugo+x /home/raph/scrpts/ipa*

# /usr/local/etc/rc.d/ipa restart
,
90 , (
ipa_ipfw.sh ):
# cd /home/raph/scrpts/
# cp ipa_ipfw.sh ipa_conf.sh
# vi ipa_conf.sh
#!/bin/sh
ip=10
nt="10.0.0"
while [ $ip -le 99 ]
do
nn=èxpr $i + 1000`
# ipa.conf
echo "rule $nn { ipfw:rules = $nn; }" >> /usr/local
/etc/ipa.conf
ip=èxpr $ip + 1`
done
exit 0
# chmod ugo+x ipa_conf.sh
# ./ipa_conf.sh
# /usr/local/etc/rc.d/ipa restart

,
-. :
# ipastat -q -r 1010 l LIM
# ipastat -q -r 1010 t THR
, ipa , .
FreeBSD 9. -
169

ls
cd
pwd
cp
mv
touch
mkdir
rm
rmdir
ln
find
locate
mount
umount
tar

adduser
rmuser
passwd
vipw
sudo
visudo
chmod
chown
chgrp

/etc/passwd

/etc/sudoers

FreeBSD 9. -
170

more
less
grep
cat
wc
diff
fmt
cut
head
tail
sort
vi

,

.

vi

man

date

cal

ps
,
top

kill

killall

shutdown
halt

reboot

uptime

pkg_info ,
pkg_add

pkg_delete
FreeBSD 9. -
make
make
make
make
make
171

install

deinstall
clean

distclean

ifconfig
route

ping

traseroute
netstat

nslookup dns-
dig
dns-
ipfw
ipfw
trafshow
tcpdump
ipfw
ssh

scp
ssh
172
FreeBSD 9. -

/etc/motd

/etc/rc.conf

/etc/rc.local

/etc/rc.firewall

/etc/passwd

/etc/master.passwd
/etc/group

/etc/services

/etc/ppp/ppp.conf
ppp
/etc/adduser.conf
adduser
/etc/sudoers
sudo
/etc/resolv.conf
dns-
/etc/hosts

/etc/inetd.conf
inetd
/etc/crontab
cron
/etc/ftpusers
ftp
/etc/ftpchroot
ftp
/etc/namedb/named.conf
named
/etc/mail/sendmail.cf
sendmail
/etc/mail/freebsd.mc
sendmail
/usr/src/sys/i386/conf/ 32-
/usr/src/sys/amd64/conf/ 64-
FreeBSD 9. -
173

,
.

.
, .
,
, :
-

, -, ;
HTTP ,
;

FTP;
SSL ;

POP3, IMAP4 SSL ;
;
- PHP MySQL,
;

- ;
, .
FreeBSD 9. -
174

-
. ?
,
, ,
, , -.

.
, ,
FreeBSD ,
. ,
. .
,
:
# vi /etc/motd
===================================
GATEWAY.EXAMPLE.COM
WellCome to Example FreeBSD Server!
===================================
Admin: Korney A. Kornienko
E-mail: raph@example.com
Mobile: +380671234567
Skype:
ICQ:
. , , - .
:)
FreeBSD 9. -
175

:
-
: ,
FreeBSD. ;
: ,
Postfix. ;
man /usr/local/share/doc;
FreeBSD: http://www.freebsd.org;
Google
, ,

, , , ,
-: http://freebsdbook.com.ua
, :
author@freebsdbook.com.ua.
.
176
FreeBSD 9. -

..
FREEBSD 9. -.
( )
06.03.2013.
. .
. 6490/16.
. . . 11.0. 500 .
.., .: (044) 592-06-85, 592-06-86, delia_print@i.ua.
1791 25.05.2004.

К. А. Корниенко - FreeBSD 9. Корпоративный Интернет-сервер

Загружено:

Сведения о документе

Авторское право

Доступные форматы

Поделиться этим документом

Поделиться или встроить документ

Параметры публикации

Этот документ был вам полезен?

Это неприемлемый материал?

Авторское право:

Доступные форматы

К. А. Корниенко - FreeBSD 9. Корпоративный Интернет-сервер

Загружено:

Авторское право:

Доступные форматы

FreeBSD 9.

, i386 32- amd64

2013 , , 01, 09:00 ( #

(ifconfig, route, resolv.conf)

Query time: 99 msec

acl (access list)

local-host-names, example.com, sendmail

Perl Compatible Regular Expressions

Perl Compatible Regular Expressions

C POSTFIX (postfix + mysql)

C DOVECOT (dovecot + mysql)

SSL/TLS : 465 (smtps), 993

Logs via syslog

IMAP (antispam, pigeonhole)

Build Apache module

# killall HUP cron

# echo mpd_enable=\"YES\" >> /etc/rc.conf

ifconfig gif0 create

Midnight Commander (mc-light)

for while until.

# chmod ugo+x /home/raph/scrpts/vpn.sh

# chmod ugo+x /home/raph/scrpts/ipa*

Вам также может понравиться