自宅サーバーに関する設定やTips置き場。

2008年11月18日火曜日

FTP Server / proftpd.conf (SSL/TLS + MySQL)

# cat /usr/local/etc/proftpd.conf


ServerName "ProFTPD Default Installation"
ServerType standalone
DefaultServer on
ScoreboardFile /var/run/proftpd/proftpd.scoreboard
Port 21
IdentLookups off
UseReverseDNS off
ListOptions "-a"
Umask 022
MaxInstances 30
CommandBufferSize 512
User nobody
Group nogroup
AllowOverwrite on

DenyAll


TLSEngine on
TLSLog /var/log/proftpd/tls.log
TLSProtocol SSLv23 TLSv1
TLSRequired off
TLSRSACertificateFile /usr/local/etc/ssl/server.crt
TLSRSACertificateKeyFile /usr/local/etc/ssl/server.key
TLSVerifyClient off
TLSRenegotiate required off


SQLAuthenticate users
SQLConnectInfo proftpd@localhost:3306 proftpd
SQLAuthTypes Plaintext
SQLUserInfo users userid passwd uid gid homedir shell
SQLGroupInfo groups groupname gid members
AuthOrder mod_sql.c



ProFTPD mini-HOWTO Index
On SQL configurations
http://www.proftpd.org/docs/howto/SQL.html
On SSL/TLS configurations
http://www.proftpd.org/docs/howto/TLS.html

2008年11月16日日曜日

DNS Server / .zone

# cat /etc/namedb/master/rishiri.info.zone

$TTL 86400
@ IN SOA ps1.rishiri.info. root.ps1.rishiri.info. (
2008110601; Serial
3600 ; Refresh
900 ; Retry
1209600 ; Expire
3600) ; Minimum
IN A 219.117.217.101
IN NS ps1.rishiri.info.
IN NS ddns1.interlink.or.jp.
IN MX 10 mx.rishiri.info.
IN TXT "v=spf1 a mx ptr ip4:219.117.217.101 mx:mx.rishiri.info mx:rishiri.info -all"
_policy._domainkey.rishiri.info. IN TXT "t=y; o=~;"
selector._domainkey.rishiri.info. IN TXT "k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvq5/6nE1kA9MiZZ0lu2ixS/i976+RY+Da51oIE4gcdGiuS/8ORBOTDpyaX6NQodfeZe9RM7gfutL8YgN5htZHhCV9wJTgA+evV3kiZ10zfgpsExoEhKESN5EVm5lIuZ8CwKRBUK/qLEN/NupF3EZXczR/YUymvPmFTfBOFk06KwIDAQAB"

ps1 IN A 219.117.217.101
mx IN A 219.117.217.101
www IN A 219.117.217.101
mail IN A 219.117.217.101
ftp IN A 219.117.217.101
server IN A 219.117.217.101
ldap IN A 219.117.217.101


# cat /etc/namedb/master/rishiri.info_dmz.zone

$TTL 86400
@ IN SOA ps1.rishiri.info. root.ps1.rishiri.info. (
2008110601; Serial
3600 ; Refresh
900 ; Retry
1209600 ; Expire
3600) ; Minimum

IN NS ps1.rishiri.info.
IN MX 10 rishiri.info.

IN A 192.168.0.3
server IN A 192.168.0.3
ps1 IN A 192.168.1.10
www IN A 192.168.0.3
ftp IN A 192.168.0.3
mail IN A 192.168.0.3
mx IN A 192.168.0.3
ldap IN A 192.168.0.3


# cat /etc/namedb/master/rishiri.info_private.zone

$TTL 86400
@ IN SOA ps1.rishiri.info. root.ps1.rishiri.info. (
2008110601; Serial
3600 ; Refresh
900 ; Retry
1209600 ; Expire
3600) ; Minimum

IN NS ps1.rishiri.info.
IN NS ddns1.interlink.or.jp.
IN MX 10 mx.rishiri.info.

IN A 192.168.1.3
server IN A 192.168.1.3
mx IN A 192.168.1.3
www IN A 192.168.1.3
mail IN A 192.168.1.3
ftp IN A 192.168.1.3
client1 IN A 192.168.1.4
client2 IN A 192.168.1.5
ps1 IN A 192.168.1.10
ldap IN A 192.168.1.3


# cat /etc/namedb/master/127.0.0.zone

$TTL 86400
@ IN SOA ps1.rishiri.info. root.ps1.rishiri.info. (
2008110601; Serial
3600 ; Refresh
900 ; Retry
1209600 ; Expire
3600) ; Minimum

IN NS ps1.rishiri.info.
1 IN PTR localhost.


# cat /etc/namedb/master/192.168.0.zone

$TTL 86400
@ IN SOA ps1.rishiri.info. root.ps1.rishiri.info. (
2008110601; Serial
3600 ; Refresh
900 ; Retry
1209600 ; Expire
3600) ; Minimum

IN NS ps1.rishiri.info.

3 IN PTR rishiri.info.
10 IN PTR ps1.rishiri.info.


# cat /etc/namedb/master/192.168.1.zone

$TTL 86400
@ IN SOA ps1.rishiri.info. root.ps1.rishiri.info. (
2008110601; Serial
3600 ; Refresh
900 ; Retry
1209600 ; Expire
3600) ; Minimum

IN NS ps1.rishiri.info.

IN PTR rishiri.info.
3 IN PTR ps1.rishiri.info.
4 IN PTR client1.rishiri.info.
5 IN PTR client2.rishiri.info.
6 IN PTR backup.rishiri.info.
10 IN PTR ps1.rishiri.info.


# cat /etc/namedb/master/192.168.10.zone

$TTL 86400
@ IN SOA ps1.rishiri.info. root.ps1.rishiri.info. (
2008110601; Serial
3600 ; Refresh
900 ; Retry
1209600 ; Expire
3600) ; Minimum

IN NS ps1.rishiri.info.

1 IN PTR setup.netvorante.jp.
2 IN PTR ps1.rishiri.info.


# cat /etc/namedb/master/219.117.217.101.zone

$TTL 86400
@ IN SOA ps1.rishiri.info. root.ps1.rishiri.info. (
2008102906; Serial
3600 ; Refresh
900 ; Retry
1209600 ; Expire
3600) ; Minimum

IN NS ps1.rishiri.info.
IN NS ddns1.interlink.or.jp.
IN MX 10 mx.rishiri.info.

IN PTR ps1.rishiri.info.

DNS Server / rndc.conf

# cat /etc/namedb/rndc.conf


include "/etc/namedb/rndc.key";

options {
default-server 127.0.0.1;
default-key RNDC;
};

DNS Server / named.conf

# cat /etc/namedb/named.conf


acl privatenet {
192.168.1.0/24;
127.0.0.1/32;
};
acl dmznet {
192.168.0.0/24;
};
acl external {
};
options {
directory "/etc/namedb";
pid-file "/var/run/named/pid";
dump-file "/var/dump/named_dump.db";
statistics-file "/var/stats/named.stats";
listen-on { 127.0.0.1; 192.168.10.0/24; 192.168.1.0/24; 192.168.0.0/24; };
allow-transfer { none; };
allow-query { none; };
recursion no;
version "(^0^)";
};
logging {
category lame-servers { null; };
channel security_log {
file "/var/log/security.log" versions 7 size 1m;
severity info;
print-time yes;
print-category yes;
};
category security { "security_log"; };
};
include "rndc.key";
controls {
inet 127.0.0.1 allow { 127.0.0.1; } keys { RNDC; };
};
view internal {
match-clients { privatenet; };
allow-transfer { privatenet; };
allow-query { privatenet; };
recursion yes;
zone "0.0.127.in-addr.arpa" {
type master;
file "master/127.0.0.zone";
allow-update { none; };
};
zone "rishiri.info" {
type master;
file "master/rishiri.info_private.zone";
};
zone "1.168.192.in-addr.arpa" {
type master;
file "master/192.168.1.zone";
};
};
view dmz {
match-clients { dmznet; };
allow-query { dmznet; };
recursion no;
zone "0.168.192.in-addr.arpa" {
type master;
file "master/192.168.0.zone";
};
zone "rishiri.info" {
type master;
file "master/rishiri.info_dmz.zone";
};
};
view external {
match-clients { any; };
allow-query { any; };
recursion no;
zone "." {
type hint;
file "named.root";
};
zone "10.168.192.in-addr.arpa" {
type master;
file "master/192.168.10.zone";
allow-update { none; };
};
zone "rishiri.info" {
type master;
file "master/rishiri.info.zone";
allow-transfer {
external;
};
};
zone "101.217.117.219.in-addr.arpa" {
type master;
file "master/219.117.217.101.zone";
allow-transfer {
external;
};
};
};

Proxy Server / squid.conf

# cat /usr/local/etc/squid/squid.conf


auth_param basic program /usr/local/libexec/squid/ncsa_auth /usr/local/etc/squid/passwd.squid
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off
acl authen proxy_auth REQUIRED
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443
acl Safe_ports port 80 # http
acl Safe_ports port 21 # ftp
acl Safe_ports port 443 # https
acl Safe_ports port 70 # gopher
acl Safe_ports port 210 # wais
acl Safe_ports port 1025-65535 # unregistered ports
acl Safe_ports port 280 # http-mgmt
acl Safe_ports port 488 # gss-http
acl Safe_ports port 591 # filemaker
acl Safe_ports port 777 # multiling http
acl CONNECT method CONNECT
acl localnet src 192.168.1.0/255.255.255.0
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access deny all
icp_access allow all
http_port 18080 transparent
hierarchy_stoplist cgi-bin ?
cache_mem 32 MB
cache_dir ufs /usr/local/squid/cache 1024 16 256
access_log /usr/local/squid/logs/access.log squid
ftp_user mail@rishiri.info
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
refresh_pattern ^ftp: 1440 20% 10080
refresh_pattern ^gopher: 1440 0% 1440
refresh_pattern . 0 20% 4320
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
header_access X-Forwarded-For deny all
header_access Via deny all
header_access Cache-Control deny all
header_replace User-Agent Nutscrape/1.0 (CP/M; 8-bit)
shutdown_lifetime 0 seconds
cache_effective_group squid
visible_hostname unknown
icp_port 0
error_directory /usr/local/etc/squid/errors/Japanese
forwarded_for off
coredump_dir /usr/local/squid/cache

Proxy Server / hosts

# cat hosts


::1 localhost.rishiri.info localhost
127.0.0.1 localhost.rishiri.info localhost
192.168.10.1 setup.netvolante.jp
192.168.0.2 server.rishiri.info server
192.168.10.2 ps1.rishiri.info ps1
192.168.10.2 ps1.rishiri.info.
192.168.0.10 ps1.rishiri.info ps1
192.168.1.10 ps1.rishiri.info ps1

Proxy Server / resolv.conf

# cat resolv.conf


domain rishiri.info
nameserver 127.0.0.1
nameserver 192.168.10.2
nameserver 192.168.1.3
nameserver 219.117.217.101
nameserver 203.141.128.39

Proxy Server / rc.conf

# cat rc.conf.orig


defaultrouter="192.168.10.1"
hostname="rishiri.info"
static_route="sr1 sr2"
route_sr1="-net 192.168.0.10 192.168.10.2"
route_sr2="-net 192.168.1.10 192.168.10.2"
ifconfig_fxp0="inet 192.168.10.2 netmask 255.255.255.0"
ifconfig_dc0="inet 192.168.1.10 netmask 255.255.255.0"
ifconfig_fxp1="inet 192.168.0.10 netmask 255.255.255.0"
gateway_enable="YES"
router_enable="NO"
network_interface="fxp0 dc0 fxp1 lo0"
keymap="jp.106"
sshd_enable="YES"
usbd_enable="YES"
pf_enable="YES"
pf_rules="/etc/pf.rules"
pflog_enable="YES"
syslogd_flags="-c -a 192.168.10.1/24:*"
named_enable="YES"
named_program="/usr/sbin/named"
named_flags=" -4 -u bind"
inetd_enable="YES"
squid_enable="YES"
powerd_enable="YES"
sendmail_enable="NONE"

2008年11月15日土曜日

Server / OpenSSH

# cat /etc/ssh/sshd_config


Port 22
Protocol 2
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no
ClientAliveInterval 0
UseDNS yes
DenyUsers mysql apache telneted test testuser administrator admin ftp
MaxStartups 2:90:4
Subsystem sftp /usr/libexec/sftp-server

2008年11月14日金曜日

Firewall Server / PF

# cat /etc/pf.conf


ext_if = "fxp0"
ext_addr = "192.168.0.2"
table { 192.168.0.0/24 }
int_if = "fxp1"
int_addr = "192.168.1.3"
table { 192.168.1.0/24 }
lo_if = "lo0"
lo_addr = "127.0.0.1"
rt_sv = "192.168.0.10"
tcp_sv = "{ 20, 25, 53, 80, 110, 123, 443, 465, 587, 993, 995, 22 }"
udp_sv = "{ 53, 123 }"
proxy_sv = "8080"
table { 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }
set timeout { interval 10, frag 30 }
set timeout { tcp.first 120, tcp.opening 30, tcp.established 86400 }
set timeout { tcp.closing 900, tcp.finwait 45, tcp.closed 90 }
set timeout { udp.first 60, udp.single 30, udp.multiple 60 }
set timeout { icmp.first 20, icmp.error 10 }
set timeout { other.first 60, other.single 30, other.multiple 60 }
set timeout { adaptive.start 0, adaptive.end 0 }
set limit { states 10000, frags 5000 }
set loginterface $ext_if
set optimization normal
set block-policy return
scrub in all
nat on $ext_if from $rt_sv to any -> ($ext_if)
nat on $ext_if from to any -> ($ext_if)
block log all
pass in on $ext_if inet proto tcp from any to any port www keep state
pass out on $ext_if inet proto tcp from any to any port www keep state
pass in quick on $lo_if all
pass out quick on $lo_if all
pass in quick on $int_if all
pass out quick on $int_if all
block out quick on $ext_if proto {tcp udp} from any to any port 135
block out quick on $ext_if proto {tcp udp} from any to any port 137:139
block out quick on $ext_if proto {tcp udp} from any to any port 445
pass out quick on $ext_if proto tcp all keep state
pass out quick on $ext_if proto udp all keep state
pass out quick on $ext_if inet proto icmp all keep state
pass in quick on $ext_if inet proto tcp from to $ext_if \
port 10022 keep state
block in log quick proto tcp from to any port 22
pass in on $ext_if proto tcp from any to $ext_if \
port $tcp_sv flags S/SA keep state
pass in on $ext_if proto udp from any to $ext_if \
port $udp_sv keep state

2008年11月13日木曜日

Server / rc.conf

# cat /etc/rc.conf


keymap="jp.106"
usbd_enable="YES"
defaultrouter="192.168.0.10"
hostname="rishiri.info"
static_route="sv1 sv2"
route_sv1="-net 192.168.1.3 192.168.0.2"
route_sv2="-net 192.168.0.2 192.168.0.10"
ifconfig_fxp0="inet 192.168.0.2 netmask 255.255.255.0"
ifconfig_fxp1="inet 192.168.1.3 netmask 255.255.255.0"
gateway_enable="YES"
router_enable="NO"
network_interface="fxp1 fxp0 lo0"
pf_enable="YES"
pf_rules="/etc/pf.conf"
pf_flags=""
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
pflog_flags=""
syslogd_flags="-c"
keymap="jp.106"
swapfile="/tmp/swapfile"
linux_enable="YES"
sshd_enable="YES"
usbd_enable="YES"
ntpd_enable="YES"
svscan_enable="YES"
svscan_servicedir="/var/service"
sendmail_enable="NONE"
sendmail_submit_enable="NO"
sendmail_outbound_enable="NO"
sendmail_msp_queue_enable="NO"
postfix_enable="YES"
milterdk_enable="YES"
milterdk_uid="postfix"
milterdk_socket="/var/run/milterdk/filter"
milterdk_domain="rishiri.info"
milterdk_key="/etc/mail/selector.private"
milterdk_selector="selector"
milterdk_flags="-i /etc/mail/dkim/ilist"
milterdkim_enable="YES"
milterdkim_uid="postfix"
milterdkim_socket="inet:8891"
milterdkim_domain="rishiri.info"
milterdkim_key="/etc/mail/selector.private"
milterdkim_selector="selector"
milterdkim_flags="-i /etc/mail/dkim/ilist"
saslauthd_enable="YES"
saslauthd_flags="-a pam"
dovecot_enable="YES"
inetd_enable="YES"
spamd_enable="YES"
proftpd_enable="YES"
mysql_enable="YES"
mysql_args="--log=mysql.log"
apache22_enable="YES"
apache22ssl_enable="YES"
powerd_enable="YES"

2008年11月12日水曜日

Server / resolv.conf

# cat /etc/resolv.conf


domain rishiri.info
nameserver 192.168.1.10
nameserver 192.168.0.10
nameserver 219.117.217.101
nameserver 203.141.128.39

2008年11月11日火曜日

Server / hosts

# cat /etc/hosts


::1 localhost.rishiri.info localhost
127.0.0.1 localhost.rishiri.info localhost
192.168.1.10 setup.netvolante.jp
192.168.0.2 mail.rishiri.info
192.168.1.4 client1.rishiri.info client1

2008年11月10日月曜日

Server / make.conf

# cat /etc/make.conf


PERL_VER=5.8.8
PERL_VERSION=5.8.8
WITH_OPENSSL_PORT=yes
WITH_APACHE2=yes
DEFAULT_PHP_VER=5
DEFAULT_MYSQL_VER=41
PORT_REPLACES_BASE_BIND9=yes
USE_NONDEFAULT_X11BASE=true
WITHOUT_X11=yes
NO_MAILWRAPPER=YES
NO_SENDMAIL=YES

2008年11月9日日曜日

DB Server / MySQL

# cat /var/db/mysql/my.cnf


[client]
port = 3306
socket = /tmp/mysql.sock
sl-ca=/usr/local/etc/ssl/server.csr
ssl-cert=/usr/local/etc/ssl/server.crt
ssl-key=/usr/local/etc/ssl/server.key
default-character-set = utf8
[mysqld]
port = 3306
socket = /tmp/mysql.sock
skip-locking
key_buffer = 256M
max_allowed_packet = 1M
table_cache = 256
sort_buffer_size = 1M
read_buffer_size = 1M
read_rnd_buffer_size = 4M
myisam_sort_buffer_size = 64M
thread_cache_size = 8
query_cache_size= 16M
thread_concurrency = 8
ssl-ca=/usr/local/etc/ssl/server.csr
ssl-cert=/usr/local/etc/ssl/server.crt
ssl-key=/usr/local/etc/ssl/server.key
default-character-set = utf8
log-bin
expire_logs_days=7
server-id = 1
[mysqldump]
quick
max_allowed_packet = 16M
[mysql]
no-auto-rehash
default-character-set = utf8
[isamchk]
key_buffer = 128M
sort_buffer_size = 128M
read_buffer = 2M
write_buffer = 2M
[myisamchk]
key_buffer = 128M
sort_buffer_size = 128M
read_buffer = 2M
write_buffer = 2M
[mysqlhotcopy]
interactive-timeout

2008年11月8日土曜日

Server / pkgtools.conf

# cat /usr/local/etc/pkgtools.conf


module PkgConfig
ENV['PORTSDIR'] ||= '/usr/ports'
ENV['PACKAGES'] ||= ENV['PORTSDIR'] + '/packages'
ENV['PKG_PATH'] ||= ENV['PACKAGES'] + '/All'
ENV['PKG_BACKUP_DIR'] ||= ENV['PKG_PATH']
SANITY_CHECK = true
IGNORE_CATEGORIES = [
]
EXTRA_CATEGORIES = [
]
ALT_INDEX = [
]
ALT_MOVED = [
]
HOLD_PKGS = [
'bsdpan-*',
]
IGNORE_MOVED = [
'devel/bison',
]
USE_PKGS = [
]
USE_PKGS_ONLY = [
]
ALT_PKGDEP = {
}
MAKE_ARGS = {
'*' => [
],
'converters/libiconv' => [
'WITH_EXTRA_PATCHES=yes',
],
'mail/postfix*' => [
'WITH_PCRE=yes',
'WITH_SASL2=yes',
'WITH_DOVECOT=yes',
'WITH_TLS=yes',
'WITH_BDB=yes',
'WITH_MYSQL=yes',
'WITH_OPENLDAP=yes',
'WITH_TEST=yes',
],
'mail/cyrus-sasl-saslauthd' => [
'WITH_BDB=yes',
],
'mail/cyrus-sasl2' => [
'WITH_AUTHDAEMOND=yes',
'WITH_LOGIN=yes',
'WITH_PLAIN=yes',
'WITH_CRAM=yes',
'WITH_DIGEST=yes',
],
'databases/mysql41-server' => [
'WITH_OPENSSL=yes',
],
'net/openldap24' => [
'WITH_SASL=yes',
'WITH_PERL=yes',
'WITH_SHELL=yes',
'WITH_SLP=yes',
'WITH_TCP_WRAPPERS=yes',
'WITH_BDB=yes',
'WITH_PPOLICY=yes',
'WITH_PROXYCACHE=yes',
'WITH_SEQMOD=yes',
'WITH_SYNCPROV=yes',
'WITH_DYNAMIC_BACKENDS=yes',
],
'mail/dovecot' => [
'WITH_SSL=yes',
'WITH_POP3=yes',
'WITH_MYSQL=yes',
'WITH_SQLITE=yes',
],
'mail/dkim-milter' => [
'WITH_POSTFIX_MILTER=yes',
'WITH_POSTFIX=yes',
],
}
MAKE_ENV = {
}
BEFOREBUILD = {
}
BEFOREDEINSTALL = {
}
AFTERINSTALL = {
'x11-servers/XFree86-4-Server' => sprintf(
'cd %s/bin && if [ -x Xwrapper-4 ]; then ln -sf Xwrapper-4 X; fi',
x11base()),
}
PKG_SITES = [
pkg_site_mirror(),
]
PORTUPGRADE_ARGS = ENV['PORTUPGRADE']
end

2008年11月7日金曜日

Ftp Server / ProFTPD

# cat /usr/local/etc/proftpd.conf


ServerName "ProFTPD Default Installation"
ServerType standalone
DefaultServer on
ScoreboardFile /var/run/proftpd/proftpd.scoreboard
Port 21
Umask 022
MaxInstances 30
CommandBufferSize 512
User nobody
Group nogroup
AllowOverwrite on

DenyAll

2008年11月6日木曜日

Mail Server / dovecot-sql.conf

# cat /usr/local/etc/dovecot-sql.conf


driver = mysql
connect = host=/tmp/mysql.sock dbname=mails user=xxxx password=xxxxxxxx
default_pass_scheme = PLAIN
password_query = SELECT userid as user, password, home as userdb_home, uid as userdb_uid, gid as userdb_gid FROM users WHERE userid = '%u'
user_query = SELECT home, uid, gid FROM users WHERE userid = '%u'

2008年11月5日水曜日

Mail Server / dovecot.conf

# cat /usr/local/etc/dovecot.conf


protocols = imap imaps pop3 pop3s
disable_plaintext_auth = no
ssl_disable = no
ssl_cert_file = /usr/local/etc/ssl/server.crt
ssl_key_file = /usr/local/etc/ssl/server.key
mail_location = maildir:~/Maildir
mail_privileged_group = mail
dotlock_use_excl = yes
verbose_proctitle = yes
first_valid_uid = 1000
first_valid_gid = 0
maildir_copy_with_hardlinks = yes
maildir_copy_preserve_filename = yes
protocol imap {
login_greeting_capability = yes
imap_client_workarounds = delay-newmail netscape-eoh tb-extra-mailbox-sep
}

protocol pop3 {
pop3_enable_last = yes
pop3_uidl_format = %08Xu%08Xv
pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
}
protocol lda {
postmaster_address = postmaster@example.com
quota_full_tempfail = yes
sendmail_path = /usr/sbin/sendmail
}
auth_username_format = %Ln
auth default {
mechanisms = plain login digest-md5 cram-md5
passdb sql {
args = /usr/local/etc/dovecot-sql.conf
}
userdb sql {
args = /usr/local/etc/dovecot-sql.conf
}
userdb passwd {
args = blocking=yes
}
user = root
socket listen {
master {
path = /var/run/dovecot/auth-master
mode = 0600
}
client {
path = /var/run/dovecot/auth-client
mode = 0660
}
}
}
dict {
}
dict_db_config = /usr/local/etc/dovecot-db.conf
plugin {
}

2008年11月4日火曜日

Mail Server / main.cf

# cat /usr/local/etc/postfix/main.cf


queue_directory = /var/spool/postfix
command_directory = /usr/local/sbin
daemon_directory = /usr/local/libexec/postfix
data_directory = /var/db/postfix
mail_owner = postfix
myhostname = mail.rishiri.info
mydomain = rishiri.info
myorigin = $mydomain
inet_interfaces = all
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
unknown_local_recipient_reject_code = 550
mynetworks = 192.168.0.0/24, 192.168.1.0/24, 192.168.10.0/24, 127.0.0.0/8
relay_domains = $mydestination
alias_maps = hash:/etc/mail/aliases
alias_database = hash:/etc/mail/aliases
recipient_delimiter = +
home_mailbox = Maildir/

mail_spool_directory = /var/spool/mail

header_checks = regexp:/usr/local/etc/postfix/header_checks
debug_peer_level = 2
debugger_command =
PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
ddd $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/local/sbin/sendmail
newaliases_path = /usr/local/bin/newaliases
mailq_path = /usr/local/bin/mailq
setgid_group = maildrop
html_directory = no
manpage_directory = /usr/local/man
sample_directory = /usr/local/etc/postfix
readme_directory = no
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = $mydomain
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = cyrus
smtpd_sasl_path = smtpd
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
broken_sasl_auth_clients = yes
smtpd_tls_cert_file = /usr/local/etc/ssl/server.crt
smtpd_tls_key_file = /usr/local/etc/ssl/server.key
smtpd_tls_loglevel = 1
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:/usr/local/etc/postfix/smtpd_scache
smtpd_tls_mandatory_ciphers = export
smtpd_tls_dh1024_param_file = /usr/local/etc/ssl/dh_1024.pem
smtpd_tls_dh512_param_file = /usr/local/etc/ssl/dh_512.pem
smtpd_tls_always_issue_session_ids = no
tls_random_source = /dev/random
smtpd_milters = inet:8891
non_smtpd_milters = $smtpd_milters

2008年11月3日月曜日

Mail Server / master.cf

# cat /usr/local/etc/postfix/master.cf


smtp inet n - n - - smtpd
smtps inet n - n - - smtpd
-o smtpd_tls_wrappermode=yes
-o smtpd_sasl_auth_enable=yes
-o smtpd_client_restrictions=permit_sasl_authenticated,reject
-o milter_macro_daemon_name=ORIGINATING
pickup fifo n - n 60 1 pickup
cleanup unix n - n - 0 cleanup
qmgr fifo n - n 300 1 qmgr
tlsmgr unix - - n 1000? 1 tlsmgr
rewrite unix - - n - - trivial-rewrite
bounce unix - - n - 0 bounce
defer unix - - n - 0 bounce
trace unix - - n - 0 bounce
verify unix - - n - 1 verify
flush unix n - n 1000? 0 flush
proxymap unix - - n - - proxymap
proxywrite unix - - n - 1 proxymap
smtp unix - - n - - smtp
relay unix - - n - - smtp
-o smtp_fallback_relay=
showq unix n - n - - showq
error unix - - n - - error
retry unix - - n - - error
discard unix - - n - - discard
local unix - n n - - local
virtual unix - n n - - virtual
lmtp unix - - n - - lmtp
anvil unix - - n - 1 anvil
scache unix - - n - 1 scache

2008年11月2日日曜日

Web Server / httpd.conf

# cat /usr/local/etc/apache22/httpd.conf


ServerRoot "/usr/local"
Listen 80
LoadModule authn_file_module libexec/apache22/mod_authn_file.so
LoadModule authn_dbm_module libexec/apache22/mod_authn_dbm.so
LoadModule authn_anon_module libexec/apache22/mod_authn_anon.so
LoadModule authn_default_module libexec/apache22/mod_authn_default.so
LoadModule authn_alias_module libexec/apache22/mod_authn_alias.so
LoadModule authz_host_module libexec/apache22/mod_authz_host.so
LoadModule authz_groupfile_module libexec/apache22/mod_authz_groupfile.so
LoadModule authz_user_module libexec/apache22/mod_authz_user.so
LoadModule authz_dbm_module libexec/apache22/mod_authz_dbm.so
LoadModule authz_owner_module libexec/apache22/mod_authz_owner.so
LoadModule authz_default_module libexec/apache22/mod_authz_default.so
LoadModule auth_basic_module libexec/apache22/mod_auth_basic.so
LoadModule auth_digest_module libexec/apache22/mod_auth_digest.so
LoadModule file_cache_module libexec/apache22/mod_file_cache.so
LoadModule cache_module libexec/apache22/mod_cache.so
LoadModule disk_cache_module libexec/apache22/mod_disk_cache.so
LoadModule dumpio_module libexec/apache22/mod_dumpio.so
LoadModule include_module libexec/apache22/mod_include.so
LoadModule filter_module libexec/apache22/mod_filter.so
LoadModule charset_lite_module libexec/apache22/mod_charset_lite.so
LoadModule deflate_module libexec/apache22/mod_deflate.so
LoadModule log_config_module libexec/apache22/mod_log_config.so
LoadModule logio_module libexec/apache22/mod_logio.so
LoadModule env_module libexec/apache22/mod_env.so
LoadModule mime_magic_module libexec/apache22/mod_mime_magic.so
LoadModule cern_meta_module libexec/apache22/mod_cern_meta.so
LoadModule expires_module libexec/apache22/mod_expires.so
LoadModule headers_module libexec/apache22/mod_headers.so
LoadModule usertrack_module libexec/apache22/mod_usertrack.so
LoadModule unique_id_module libexec/apache22/mod_unique_id.so
LoadModule setenvif_module libexec/apache22/mod_setenvif.so
LoadModule version_module libexec/apache22/mod_version.so
LoadModule ssl_module libexec/apache22/mod_ssl.so
LoadModule mime_module libexec/apache22/mod_mime.so
LoadModule dav_module libexec/apache22/mod_dav.so
LoadModule status_module libexec/apache22/mod_status.so
LoadModule autoindex_module libexec/apache22/mod_autoindex.so
LoadModule asis_module libexec/apache22/mod_asis.so
LoadModule info_module libexec/apache22/mod_info.so
LoadModule cgi_module libexec/apache22/mod_cgi.so
LoadModule dav_fs_module libexec/apache22/mod_dav_fs.so
LoadModule vhost_alias_module libexec/apache22/mod_vhost_alias.so
LoadModule negotiation_module libexec/apache22/mod_negotiation.so
LoadModule dir_module libexec/apache22/mod_dir.so
LoadModule imagemap_module libexec/apache22/mod_imagemap.so
LoadModule actions_module libexec/apache22/mod_actions.so
LoadModule speling_module libexec/apache22/mod_speling.so
LoadModule userdir_module libexec/apache22/mod_userdir.so
LoadModule alias_module libexec/apache22/mod_alias.so
LoadModule rewrite_module libexec/apache22/mod_rewrite.so
LoadModule php5_module libexec/apache22/libphp5.so


User www
Group www


ServerAdmin mail@rishiri.info
ServerName rishiri.info
DocumentRoot "/usr/local/www/apache22/data"

AllowOverride All
Order deny,allow
Deny from all


Options FollowSymLinks
AllowOverride All
Order allow,deny
Allow from all


DirectoryIndex index.php index.html


Order allow,deny
Deny from all
Satisfy All

ErrorLog "/var/log/httpd-error.log"
LogLevel warn

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%h %l %u %t \"%r\" %>s %b" common

LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio

CustomLog "/var/log/httpd-access.log" combined


Alias /phpMyAdmin/ /usr/local/www/phpMyAdmin/
Alias /wp/ /usr/local/www/apache22/data/wp/
Alias /weblog/ /usr/local/www/apache22/data/wp/
ScriptAlias /cgi-bin/ "/usr/local/www/apache22/cgi-bin/"




AllowOverride None
Options None
Order allow,deny
Allow from all


Options none
AllowOverride Limit
Order Deny,Allow
Deny from all
Allow from 127.0.0.1 219.117.217.101 .rishiri.info

DefaultType text/plain

TypesConfig etc/apache22/mime.types
AddType application/x-compress .Z
AddType application/x-gzip .gz .tgz
AddHandler cgi-script .cgi
AddType application/x-httpd-php .php
AddType application/x-httpd-php-source .phps


SSLRandomSeed startup builtin
SSLRandomSeed connect builtin

AddType application/x-httpd-php .php
AddHandler php5-script .php
AddType text/html .php
AddType application/x-httpd-php-source .phps
Include etc/apache22/Includes/*.conf

2008年11月1日土曜日

コメント行を削除

httpd.confやsquid.conf等コメントの多い設定ファイルから
コメント行を除く方法

/* 一応、バックアップをとってから行う */
# cd /usr/local/etc/apache22
# cp httpd.conf httpd.conf.bak
# grep -v -e "^[ ^t]*#" -e ^$ ./httpd.conf.bak > httpd.conf.orig

マイブログ リスト

フォロワー

Blogger Syntax Highliter