自宅サーバー備忘録

FTP Server / proftpd.conf (SSL/TLS + MySQL)

2008-11-18T23:39:00.005+09:00

# cat /usr/local/etc/proftpd.conf


ServerName                      "ProFTPD Default Installation"
ServerType                      standalone
DefaultServer                   on
ScoreboardFile          /var/run/proftpd/proftpd.scoreboard
Port                            21
IdentLookups off
UseReverseDNS off
ListOptions "-a"
Umask                           022
MaxInstances                    30
CommandBufferSize       512
User                            nobody
Group                           nogroup
AllowOverwrite          on

  DenyAll


    TLSEngine on
    TLSLog /var/log/proftpd/tls.log
    TLSProtocol SSLv23 TLSv1
    TLSRequired off
    TLSRSACertificateFile /usr/local/etc/ssl/server.crt
    TLSRSACertificateKeyFile /usr/local/etc/ssl/server.key
    TLSVerifyClient off
    TLSRenegotiate required off


    SQLAuthenticate     users
    SQLConnectInfo      proftpd@localhost:3306 proftpd 
    SQLAuthTypes        Plaintext
    SQLUserInfo         users userid passwd uid gid homedir shell
    SQLGroupInfo        groups groupname gid members
    AuthOrder           mod_sql.c

ProFTPD mini-HOWTO Index
On SQL configurations
http://www.proftpd.org/docs/howto/SQL.html
On SSL/TLS configurations
http://www.proftpd.org/docs/howto/TLS.html

DNS Server / .zone

2008-11-16T11:55:00.013+09:00

# cat /etc/namedb/master/rishiri.info.zone


$TTL    86400
@       IN      SOA     ps1.rishiri.info. root.ps1.rishiri.info. (
                        2008110601;     Serial
                        3600    ;       Refresh
                        900     ;       Retry
                        1209600 ;       Expire
                        3600)   ;       Minimum
        IN      A       219.117.217.101
        IN      NS      ps1.rishiri.info.
        IN      NS      ddns1.interlink.or.jp.
        IN      MX      10      mx.rishiri.info.
        IN TXT "v=spf1 a mx ptr ip4:219.117.217.101 mx:mx.rishiri.info mx:rishiri.info -all"
_policy._domainkey.rishiri.info. IN TXT "t=y; o=~;"
selector._domainkey.rishiri.info. IN TXT "k=rsa; t=y; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCvq5/6nE1kA9MiZZ0lu2ixS/i976+RY+Da51oIE4gcdGiuS/8ORBOTDpyaX6NQodfeZe9RM7gfutL8YgN5htZHhCV9wJTgA+evV3kiZ10zfgpsExoEhKESN5EVm5lIuZ8CwKRBUK/qLEN/NupF3EZXczR/YUymvPmFTfBOFk06KwIDAQAB"

ps1     IN      A       219.117.217.101
mx      IN      A       219.117.217.101
www     IN      A       219.117.217.101
mail    IN      A       219.117.217.101
ftp     IN      A       219.117.217.101
server  IN      A       219.117.217.101
ldap    IN      A       219.117.217.101

# cat /etc/namedb/master/rishiri.info_dmz.zone


$TTL    86400
@       IN      SOA     ps1.rishiri.info. root.ps1.rishiri.info. (
                        2008110601;     Serial
                        3600    ;       Refresh
                        900     ;       Retry
                        1209600 ;       Expire
                        3600)   ;       Minimum

        IN      NS      ps1.rishiri.info.
        IN      MX      10      rishiri.info.

        IN      A       192.168.0.3
server  IN      A       192.168.0.3
ps1     IN      A       192.168.1.10
www     IN      A       192.168.0.3
ftp     IN      A       192.168.0.3
mail    IN      A       192.168.0.3
mx      IN      A       192.168.0.3
ldap    IN      A       192.168.0.3

# cat /etc/namedb/master/rishiri.info_private.zone


$TTL    86400
@       IN      SOA     ps1.rishiri.info. root.ps1.rishiri.info. (
                        2008110601;     Serial
                        3600    ;       Refresh
                        900     ;       Retry
                        1209600 ;       Expire
                        3600)   ;       Minimum

        IN      NS      ps1.rishiri.info.
        IN      NS      ddns1.interlink.or.jp.
        IN      MX      10      mx.rishiri.info.

        IN      A       192.168.1.3
server  IN      A       192.168.1.3
mx      IN      A       192.168.1.3
www     IN      A       192.168.1.3
mail    IN      A       192.168.1.3
ftp     IN      A       192.168.1.3
client1 IN      A       192.168.1.4
client2 IN      A       192.168.1.5
ps1     IN      A       192.168.1.10
ldap    IN      A       192.168.1.3

# cat /etc/namedb/master/127.0.0.zone


$TTL    86400
@       IN      SOA     ps1.rishiri.info. root.ps1.rishiri.info. (
                        2008110601;     Serial
                        3600    ;       Refresh
                        900     ;       Retry
                        1209600 ;       Expire
                        3600)   ;       Minimum

        IN      NS      ps1.rishiri.info.
1       IN      PTR     localhost.

# cat /etc/namedb/master/192.168.0.zone


$TTL    86400
@       IN      SOA     ps1.rishiri.info. root.ps1.rishiri.info. (
                        2008110601;     Serial
                        3600    ;       Refresh
                        900     ;       Retry
                        1209600 ;       Expire
                        3600)   ;       Minimum

        IN      NS      ps1.rishiri.info.

3       IN      PTR     rishiri.info.
10      IN      PTR     ps1.rishiri.info.

# cat /etc/namedb/master/192.168.1.zone


$TTL    86400
@       IN      SOA     ps1.rishiri.info. root.ps1.rishiri.info. (
                        2008110601;     Serial
                        3600    ;       Refresh
                        900     ;       Retry
                        1209600 ;       Expire
                        3600)   ;       Minimum

        IN      NS      ps1.rishiri.info.

        IN      PTR     rishiri.info.
3       IN      PTR     ps1.rishiri.info.
4       IN      PTR     client1.rishiri.info.
5       IN      PTR     client2.rishiri.info.
6       IN      PTR     backup.rishiri.info.
10      IN      PTR     ps1.rishiri.info.

# cat /etc/namedb/master/192.168.10.zone


$TTL    86400
@       IN      SOA     ps1.rishiri.info. root.ps1.rishiri.info. (
                        2008110601;     Serial
                        3600    ;       Refresh
                        900     ;       Retry
                        1209600 ;       Expire
                        3600)   ;       Minimum

        IN      NS      ps1.rishiri.info.

1       IN      PTR     setup.netvorante.jp.
2       IN      PTR     ps1.rishiri.info.

# cat /etc/namedb/master/219.117.217.101.zone


$TTL 86400
@       IN      SOA     ps1.rishiri.info. root.ps1.rishiri.info. (
                        2008102906;     Serial
                        3600    ;       Refresh
                        900     ;       Retry
                        1209600 ;       Expire
                        3600)   ;       Minimum

        IN      NS      ps1.rishiri.info.
        IN      NS      ddns1.interlink.or.jp.
        IN      MX      10      mx.rishiri.info.

        IN      PTR     ps1.rishiri.info.

DNS Server / rndc.conf

2008-11-16T11:52:00.001+09:00

# cat /etc/namedb/rndc.conf


include "/etc/namedb/rndc.key";

options {
        default-server 127.0.0.1;
        default-key RNDC;
};

DNS Server / named.conf

2008-11-16T11:48:00.002+09:00

# cat /etc/namedb/named.conf


acl privatenet {
        192.168.1.0/24;
        127.0.0.1/32;
        };
acl dmznet {
        192.168.0.0/24;
        };
acl external {
        };
options {
        directory       "/etc/namedb";
        pid-file        "/var/run/named/pid";
        dump-file       "/var/dump/named_dump.db";
        statistics-file "/var/stats/named.stats";
        listen-on       { 127.0.0.1; 192.168.10.0/24; 192.168.1.0/24; 192.168.0.0/24; };
        allow-transfer  { none; };
        allow-query     { none; };
        recursion       no;
        version         "(^0^)";
        };
logging {
        category lame-servers { null; };
        channel security_log {
        file "/var/log/security.log" versions 7 size 1m;
        severity info;
        print-time yes;
        print-category yes;
        };
category security { "security_log"; };
        };
include "rndc.key";
controls {
        inet 127.0.0.1 allow { 127.0.0.1; } keys { RNDC; };
        };
view internal {
        match-clients   { privatenet; };
        allow-transfer  { privatenet; };
        allow-query     { privatenet; };
        recursion       yes;
zone "0.0.127.in-addr.arpa" {
        type master;
        file "master/127.0.0.zone";
        allow-update { none; };
                };
zone "rishiri.info" {
        type master;
        file "master/rishiri.info_private.zone";
                };
zone "1.168.192.in-addr.arpa" {
        type master;
        file "master/192.168.1.zone";
                };
        };
view dmz {
        match-clients { dmznet; };
        allow-query   { dmznet; };
        recursion no;
zone "0.168.192.in-addr.arpa" {
        type master;
        file "master/192.168.0.zone";
                };
zone "rishiri.info" {
        type master;
        file "master/rishiri.info_dmz.zone";
                };
        };
view external {
        match-clients { any; };
        allow-query     { any; };
        recursion no;
zone "." {
        type hint;
        file "named.root";
                };
zone "10.168.192.in-addr.arpa" {
        type master;
        file "master/192.168.10.zone";
        allow-update { none; };
                };
zone "rishiri.info" {
        type master;
        file "master/rishiri.info.zone";
        allow-transfer  {
        external;
                };
        };
zone "101.217.117.219.in-addr.arpa" {
        type master;
        file "master/219.117.217.101.zone";
        allow-transfer  {
        external;
                };
        };
};

Proxy Server / squid.conf

2008-11-16T11:18:00.002+09:00

# cat /usr/local/etc/squid/squid.conf


auth_param basic program /usr/local/libexec/squid/ncsa_auth /usr/local/etc/squid/passwd.squid
auth_param basic children 5
auth_param basic realm Squid proxy-caching web server
auth_param basic credentialsttl 2 hours
auth_param basic casesensitive off
acl authen proxy_auth REQUIRED
acl all src 0.0.0.0/0.0.0.0
acl manager proto cache_object
acl localhost src 127.0.0.1/255.255.255.255
acl to_localhost dst 127.0.0.0/8
acl SSL_ports port 443
acl Safe_ports port 80          # http
acl Safe_ports port 21          # ftp
acl Safe_ports port 443         # https
acl Safe_ports port 70          # gopher
acl Safe_ports port 210         # wais
acl Safe_ports port 1025-65535  # unregistered ports
acl Safe_ports port 280         # http-mgmt
acl Safe_ports port 488         # gss-http
acl Safe_ports port 591         # filemaker
acl Safe_ports port 777         # multiling http
acl CONNECT method CONNECT
acl localnet src 192.168.1.0/255.255.255.0
http_access allow manager localhost
http_access deny manager
http_access deny !Safe_ports
http_access deny CONNECT !SSL_ports
http_access allow localnet
http_access deny all
icp_access allow all
http_port 18080 transparent
hierarchy_stoplist cgi-bin ?
cache_mem 32 MB
cache_dir ufs /usr/local/squid/cache 1024 16 256
access_log /usr/local/squid/logs/access.log squid
ftp_user mail@rishiri.info
acl QUERY urlpath_regex cgi-bin \?
cache deny QUERY
refresh_pattern ^ftp:           1440    20%     10080
refresh_pattern ^gopher:        1440    0%      1440
refresh_pattern .               0       20%     4320
acl apache rep_header Server ^Apache
broken_vary_encoding allow apache
header_access X-Forwarded-For deny all
header_access Via deny all
header_access Cache-Control deny all
header_replace User-Agent Nutscrape/1.0 (CP/M; 8-bit)
shutdown_lifetime 0 seconds
cache_effective_group squid
visible_hostname unknown
icp_port 0
error_directory /usr/local/etc/squid/errors/Japanese
forwarded_for off
coredump_dir /usr/local/squid/cache

Proxy Server / hosts

2008-11-16T11:07:00.001+09:00

# cat hosts


::1                     localhost.rishiri.info localhost
127.0.0.1               localhost.rishiri.info localhost
192.168.10.1            setup.netvolante.jp
192.168.0.2             server.rishiri.info     server
192.168.10.2            ps1.rishiri.info ps1
192.168.10.2            ps1.rishiri.info.
192.168.0.10            ps1.rishiri.info        ps1
192.168.1.10            ps1.rishiri.info        ps1

Proxy Server / resolv.conf

2008-11-16T11:05:00.001+09:00

# cat resolv.conf


domain  rishiri.info
nameserver      127.0.0.1
nameserver      192.168.10.2
nameserver      192.168.1.3
nameserver      219.117.217.101
nameserver      203.141.128.39

Proxy Server / rc.conf

2008-11-16T00:00:00.000+09:00

# cat rc.conf.orig


defaultrouter="192.168.10.1"
hostname="rishiri.info"
static_route="sr1 sr2"
route_sr1="-net 192.168.0.10 192.168.10.2"
route_sr2="-net 192.168.1.10 192.168.10.2"
ifconfig_fxp0="inet 192.168.10.2 netmask 255.255.255.0"
ifconfig_dc0="inet 192.168.1.10 netmask 255.255.255.0"
ifconfig_fxp1="inet 192.168.0.10 netmask 255.255.255.0"
gateway_enable="YES"
router_enable="NO"
network_interface="fxp0 dc0 fxp1 lo0"
keymap="jp.106"
sshd_enable="YES"
usbd_enable="YES"
pf_enable="YES"
pf_rules="/etc/pf.rules"
pflog_enable="YES"
syslogd_flags="-c -a 192.168.10.1/24:*"
named_enable="YES"
named_program="/usr/sbin/named"
named_flags=" -4 -u bind"
inetd_enable="YES"
squid_enable="YES"
powerd_enable="YES"
sendmail_enable="NONE"

Server / OpenSSH

2008-11-15T00:00:00.003+09:00

# cat /etc/ssh/sshd_config


Port 22
Protocol 2
PermitRootLogin no
PasswordAuthentication no
ChallengeResponseAuthentication no 
ClientAliveInterval 0
UseDNS yes
DenyUsers mysql apache telneted test testuser administrator admin ftp
MaxStartups 2:90:4
Subsystem sftp /usr/libexec/sftp-server

Firewall Server / PF

2008-11-14T00:00:00.004+09:00

# cat /etc/pf.conf


ext_if = "fxp0"
ext_addr = "192.168.0.2"
table  { 192.168.0.0/24 }
int_if = "fxp1"
int_addr = "192.168.1.3"
table  { 192.168.1.0/24 }
lo_if = "lo0"
lo_addr = "127.0.0.1"
rt_sv = "192.168.0.10"
tcp_sv = "{ 20, 25, 53, 80, 110, 123, 443, 465, 587, 993, 995, 22 }"
udp_sv = "{ 53, 123 }"
proxy_sv = "8080"
table  { 127.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12, 10.0.0.0/8 }
set timeout { interval 10, frag 30 }
set timeout { tcp.first 120, tcp.opening 30, tcp.established 86400 }
set timeout { tcp.closing 900, tcp.finwait 45, tcp.closed 90 }
set timeout { udp.first 60, udp.single 30, udp.multiple 60 }
set timeout { icmp.first 20, icmp.error 10 }
set timeout { other.first 60, other.single 30, other.multiple 60 }
set timeout { adaptive.start 0, adaptive.end 0 }
set limit { states 10000, frags 5000 }
set loginterface $ext_if
set optimization normal
set block-policy return
scrub in all
nat on $ext_if from $rt_sv to any -> ($ext_if)
nat on $ext_if from  to any -> ($ext_if)
block log all
pass in on $ext_if inet proto tcp from any to any port www keep state
pass out on $ext_if inet proto tcp from any to any port www keep state
pass in quick on $lo_if all
pass out quick on $lo_if all
pass in quick on $int_if all
pass out quick on $int_if all
block out quick on $ext_if proto {tcp udp} from any to any port 135
block out quick on $ext_if proto {tcp udp} from any to any port 137:139
block out quick on $ext_if proto {tcp udp} from any to any port 445
pass out quick on $ext_if proto tcp all keep state
pass out quick on $ext_if proto udp all keep state
pass out quick on $ext_if inet proto icmp all keep state
pass in quick on $ext_if inet proto tcp from  to $ext_if \
        port 10022 keep state
block in log quick proto tcp from  to any port 22
pass in on $ext_if proto tcp from any to $ext_if \
        port $tcp_sv flags S/SA keep state
pass in on $ext_if proto udp from any to $ext_if \
        port $udp_sv keep state

Server / rc.conf

2008-11-13T00:00:00.003+09:00

# cat /etc/rc.conf


keymap="jp.106"
usbd_enable="YES"
defaultrouter="192.168.0.10"
hostname="rishiri.info"
static_route="sv1 sv2"
route_sv1="-net 192.168.1.3 192.168.0.2"
route_sv2="-net 192.168.0.2 192.168.0.10"
ifconfig_fxp0="inet 192.168.0.2 netmask 255.255.255.0"
ifconfig_fxp1="inet 192.168.1.3 netmask 255.255.255.0"
gateway_enable="YES"
router_enable="NO"
network_interface="fxp1 fxp0 lo0"
pf_enable="YES"
pf_rules="/etc/pf.conf"
pf_flags=""
pflog_enable="YES"
pflog_logfile="/var/log/pflog"
pflog_flags=""
syslogd_flags="-c"
keymap="jp.106"
swapfile="/tmp/swapfile"
linux_enable="YES"
sshd_enable="YES"
usbd_enable="YES"
ntpd_enable="YES"
svscan_enable="YES"
svscan_servicedir="/var/service"
sendmail_enable="NONE"
sendmail_submit_enable="NO"
sendmail_outbound_enable="NO"
sendmail_msp_queue_enable="NO"
postfix_enable="YES"
milterdk_enable="YES"
milterdk_uid="postfix"
milterdk_socket="/var/run/milterdk/filter"
milterdk_domain="rishiri.info"
milterdk_key="/etc/mail/selector.private"
milterdk_selector="selector"
milterdk_flags="-i /etc/mail/dkim/ilist"
milterdkim_enable="YES"
milterdkim_uid="postfix"
milterdkim_socket="inet:8891"
milterdkim_domain="rishiri.info"
milterdkim_key="/etc/mail/selector.private"
milterdkim_selector="selector"
milterdkim_flags="-i /etc/mail/dkim/ilist"
saslauthd_enable="YES"
saslauthd_flags="-a pam"
dovecot_enable="YES"
inetd_enable="YES"
spamd_enable="YES"
proftpd_enable="YES"
mysql_enable="YES"
mysql_args="--log=mysql.log" 
apache22_enable="YES"
apache22ssl_enable="YES"
powerd_enable="YES"

Server / resolv.conf

2008-11-12T00:00:00.005+09:00

# cat /etc/resolv.conf


domain  rishiri.info
nameserver      192.168.1.10
nameserver      192.168.0.10
nameserver      219.117.217.101
nameserver      203.141.128.39

Server / hosts

2008-11-11T00:00:00.002+09:00

# cat /etc/hosts


::1                     localhost.rishiri.info  localhost
127.0.0.1               localhost.rishiri.info  localhost
192.168.1.10            setup.netvolante.jp
192.168.0.2             mail.rishiri.info
192.168.1.4             client1.rishiri.info    client1

Server / make.conf

2008-11-10T00:00:00.004+09:00

# cat /etc/make.conf


PERL_VER=5.8.8
PERL_VERSION=5.8.8
WITH_OPENSSL_PORT=yes
WITH_APACHE2=yes
DEFAULT_PHP_VER=5
DEFAULT_MYSQL_VER=41
PORT_REPLACES_BASE_BIND9=yes
USE_NONDEFAULT_X11BASE=true
WITHOUT_X11=yes
NO_MAILWRAPPER=YES
NO_SENDMAIL=YES

DB Server / MySQL

2008-11-09T00:00:00.002+09:00

# cat /var/db/mysql/my.cnf


[client]
port  = 3306
socket  = /tmp/mysql.sock
sl-ca=/usr/local/etc/ssl/server.csr
ssl-cert=/usr/local/etc/ssl/server.crt
ssl-key=/usr/local/etc/ssl/server.key
default-character-set = utf8
[mysqld]
port  = 3306
socket  = /tmp/mysql.sock
skip-locking
key_buffer = 256M
max_allowed_packet = 1M
table_cache = 256
sort_buffer_size = 1M
read_buffer_size = 1M
read_rnd_buffer_size = 4M
myisam_sort_buffer_size = 64M
thread_cache_size = 8
query_cache_size= 16M
thread_concurrency = 8
ssl-ca=/usr/local/etc/ssl/server.csr
ssl-cert=/usr/local/etc/ssl/server.crt
ssl-key=/usr/local/etc/ssl/server.key
default-character-set = utf8
log-bin
expire_logs_days=7
server-id = 1
[mysqldump]
quick
max_allowed_packet = 16M
[mysql]
no-auto-rehash
default-character-set = utf8
[isamchk]
key_buffer = 128M
sort_buffer_size = 128M
read_buffer = 2M
write_buffer = 2M
[myisamchk]
key_buffer = 128M
sort_buffer_size = 128M
read_buffer = 2M
write_buffer = 2M
[mysqlhotcopy]
interactive-timeout

Server / pkgtools.conf

2008-11-08T00:00:00.002+09:00

# cat /usr/local/etc/pkgtools.conf


module PkgConfig
  ENV['PORTSDIR'] ||= '/usr/ports'
  ENV['PACKAGES'] ||= ENV['PORTSDIR'] + '/packages'
  ENV['PKG_PATH'] ||= ENV['PACKAGES'] + '/All'
  ENV['PKG_BACKUP_DIR'] ||= ENV['PKG_PATH']
  SANITY_CHECK = true
  IGNORE_CATEGORIES = [
  ]
  EXTRA_CATEGORIES = [
  ]
  ALT_INDEX = [
  ]
  ALT_MOVED = [
  ]
  HOLD_PKGS = [
    'bsdpan-*',
  ]
  IGNORE_MOVED = [
    'devel/bison',
  ]
  USE_PKGS = [
  ]
  USE_PKGS_ONLY = [
  ]
  ALT_PKGDEP = {
  }
  MAKE_ARGS = {
 '*' => [
 ],
 'converters/libiconv' => [
  'WITH_EXTRA_PATCHES=yes',
 ],
 'mail/postfix*' => [
  'WITH_PCRE=yes',
  'WITH_SASL2=yes',
  'WITH_DOVECOT=yes',
  'WITH_TLS=yes', 
  'WITH_BDB=yes',
  'WITH_MYSQL=yes',
  'WITH_OPENLDAP=yes',
  'WITH_TEST=yes',
 ],
 'mail/cyrus-sasl-saslauthd' => [
  'WITH_BDB=yes',
 ],
 'mail/cyrus-sasl2' => [
  'WITH_AUTHDAEMOND=yes',
  'WITH_LOGIN=yes',
  'WITH_PLAIN=yes',
  'WITH_CRAM=yes',
  'WITH_DIGEST=yes',
 ],
        'databases/mysql41-server' => [
  'WITH_OPENSSL=yes',
 ],
 'net/openldap24' => [
  'WITH_SASL=yes',
  'WITH_PERL=yes',
  'WITH_SHELL=yes',
  'WITH_SLP=yes',
  'WITH_TCP_WRAPPERS=yes',
  'WITH_BDB=yes',
                'WITH_PPOLICY=yes',
                'WITH_PROXYCACHE=yes',
  'WITH_SEQMOD=yes',
  'WITH_SYNCPROV=yes',
  'WITH_DYNAMIC_BACKENDS=yes',
 ],
 'mail/dovecot' => [
  'WITH_SSL=yes',
  'WITH_POP3=yes',
  'WITH_MYSQL=yes',
  'WITH_SQLITE=yes',
 ], 
 'mail/dkim-milter' => [
  'WITH_POSTFIX_MILTER=yes',
  'WITH_POSTFIX=yes',
 ], 
  }
  MAKE_ENV = {
  }
  BEFOREBUILD = {
  }
  BEFOREDEINSTALL = {
  }
  AFTERINSTALL = {
    'x11-servers/XFree86-4-Server' => sprintf(
     'cd %s/bin && if [ -x Xwrapper-4 ]; then ln -sf Xwrapper-4 X; fi',
     x11base()),
  }
  PKG_SITES = [
    pkg_site_mirror(),
  ]
  PORTUPGRADE_ARGS = ENV['PORTUPGRADE']
end

Ftp Server / ProFTPD

2008-11-07T00:00:00.002+09:00

# cat /usr/local/etc/proftpd.conf


ServerName   "ProFTPD Default Installation"
ServerType   standalone
DefaultServer   on
ScoreboardFile  /var/run/proftpd/proftpd.scoreboard
Port    21
Umask    022
MaxInstances   30
CommandBufferSize 512
User    nobody
Group    nogroup
AllowOverwrite  on

  DenyAll

Mail Server / dovecot-sql.conf

2008-11-06T00:00:00.002+09:00

# cat /usr/local/etc/dovecot-sql.conf


driver = mysql
connect = host=/tmp/mysql.sock dbname=mails user=xxxx password=xxxxxxxx
default_pass_scheme = PLAIN
password_query = SELECT userid as user, password, home as userdb_home, uid as userdb_uid, gid as userdb_gid FROM users WHERE userid = '%u'
user_query = SELECT home, uid, gid FROM users WHERE userid = '%u'

Mail Server / dovecot.conf

2008-11-05T00:00:00.002+09:00

# cat /usr/local/etc/dovecot.conf


protocols = imap imaps pop3 pop3s
disable_plaintext_auth = no
ssl_disable = no
ssl_cert_file = /usr/local/etc/ssl/server.crt
ssl_key_file = /usr/local/etc/ssl/server.key
mail_location = maildir:~/Maildir
mail_privileged_group = mail
dotlock_use_excl = yes
verbose_proctitle = yes
first_valid_uid = 1000
first_valid_gid = 0
maildir_copy_with_hardlinks = yes
maildir_copy_preserve_filename = yes
protocol imap {
  login_greeting_capability = yes
  imap_client_workarounds = delay-newmail netscape-eoh tb-extra-mailbox-sep
}
  
protocol pop3 {
  pop3_enable_last = yes
  pop3_uidl_format = %08Xu%08Xv
  pop3_client_workarounds = outlook-no-nuls oe-ns-eoh
}
protocol lda {
  postmaster_address = postmaster@example.com
  quota_full_tempfail = yes
  sendmail_path = /usr/sbin/sendmail
}
auth_username_format = %Ln
auth default {
  mechanisms = plain login digest-md5 cram-md5
  passdb sql {
    args = /usr/local/etc/dovecot-sql.conf
  }
    userdb sql {
    args = /usr/local/etc/dovecot-sql.conf
  }
  userdb passwd {
    args = blocking=yes
  }
  user = root
  socket listen {
    master {
      path = /var/run/dovecot/auth-master
      mode = 0600
    }
    client {
      path = /var/run/dovecot/auth-client
      mode = 0660
    }
  }
}
dict {
}
dict_db_config = /usr/local/etc/dovecot-db.conf
plugin {
}

Mail Server / main.cf

2008-11-04T00:00:00.002+09:00

# cat /usr/local/etc/postfix/main.cf


queue_directory = /var/spool/postfix
command_directory = /usr/local/sbin
daemon_directory = /usr/local/libexec/postfix
data_directory = /var/db/postfix
mail_owner = postfix
myhostname = mail.rishiri.info
mydomain = rishiri.info
myorigin = $mydomain
inet_interfaces = all
mydestination = $myhostname, localhost.$mydomain, localhost, $mydomain
unknown_local_recipient_reject_code = 550
mynetworks = 192.168.0.0/24, 192.168.1.0/24, 192.168.10.0/24, 127.0.0.0/8
relay_domains = $mydestination
alias_maps = hash:/etc/mail/aliases
alias_database = hash:/etc/mail/aliases
recipient_delimiter = +
home_mailbox = Maildir/
 
mail_spool_directory = /var/spool/mail
  
header_checks = regexp:/usr/local/etc/postfix/header_checks
debug_peer_level = 2
debugger_command =
  PATH=/bin:/usr/bin:/usr/local/bin:/usr/X11R6/bin
  ddd $daemon_directory/$process_name $process_id & sleep 5
sendmail_path = /usr/local/sbin/sendmail
newaliases_path = /usr/local/bin/newaliases
mailq_path = /usr/local/bin/mailq
setgid_group = maildrop
html_directory = no
manpage_directory = /usr/local/man
sample_directory = /usr/local/etc/postfix
readme_directory = no
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain = $mydomain
smtpd_sasl_security_options = noanonymous
smtpd_sasl_type = cyrus
smtpd_sasl_path = smtpd 
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination
broken_sasl_auth_clients = yes
smtpd_tls_cert_file = /usr/local/etc/ssl/server.crt
smtpd_tls_key_file = /usr/local/etc/ssl/server.key
smtpd_tls_loglevel = 1
smtpd_tls_security_level = may
smtpd_tls_session_cache_database = btree:/usr/local/etc/postfix/smtpd_scache
smtpd_tls_mandatory_ciphers = export
smtpd_tls_dh1024_param_file = /usr/local/etc/ssl/dh_1024.pem
smtpd_tls_dh512_param_file = /usr/local/etc/ssl/dh_512.pem
smtpd_tls_always_issue_session_ids = no
tls_random_source = /dev/random
smtpd_milters = inet:8891
non_smtpd_milters = $smtpd_milters

Mail Server / master.cf

2008-11-03T00:00:00.002+09:00

# cat /usr/local/etc/postfix/master.cf


smtp      inet  n       -       n       -       -       smtpd
smtps     inet  n       -       n       -       -       smtpd
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING
pickup    fifo  n       -       n       60      1       pickup
cleanup   unix  n       -       n       -       0       cleanup
qmgr      fifo  n       -       n       300     1       qmgr
tlsmgr    unix  -       -       n       1000?   1       tlsmgr
rewrite   unix  -       -       n       -       -       trivial-rewrite
bounce    unix  -       -       n       -       0       bounce
defer     unix  -       -       n       -       0       bounce
trace     unix  -       -       n       -       0       bounce
verify    unix  -       -       n       -       1       verify
flush     unix  n       -       n       1000?   0       flush
proxymap  unix  -       -       n       -       -       proxymap
proxywrite unix -       -       n       -       1       proxymap
smtp      unix  -       -       n       -       -       smtp
relay     unix  -       -       n       -       -       smtp
 -o smtp_fallback_relay=
showq     unix  n       -       n       -       -       showq
error     unix  -       -       n       -       -       error
retry     unix  -       -       n       -       -       error
discard   unix  -       -       n       -       -       discard
local     unix  -       n       n       -       -       local
virtual   unix  -       n       n       -       -       virtual
lmtp      unix  -       -       n       -       -       lmtp
anvil     unix  -       -       n       -       1       anvil
scache    unix  -       -       n       -       1       scache

Web Server / httpd.conf

2008-11-02T00:00:00.002+09:00

# cat /usr/local/etc/apache22/httpd.conf


ServerRoot "/usr/local"
Listen 80
LoadModule authn_file_module libexec/apache22/mod_authn_file.so
LoadModule authn_dbm_module libexec/apache22/mod_authn_dbm.so
LoadModule authn_anon_module libexec/apache22/mod_authn_anon.so
LoadModule authn_default_module libexec/apache22/mod_authn_default.so
LoadModule authn_alias_module libexec/apache22/mod_authn_alias.so
LoadModule authz_host_module libexec/apache22/mod_authz_host.so
LoadModule authz_groupfile_module libexec/apache22/mod_authz_groupfile.so
LoadModule authz_user_module libexec/apache22/mod_authz_user.so
LoadModule authz_dbm_module libexec/apache22/mod_authz_dbm.so
LoadModule authz_owner_module libexec/apache22/mod_authz_owner.so
LoadModule authz_default_module libexec/apache22/mod_authz_default.so
LoadModule auth_basic_module libexec/apache22/mod_auth_basic.so
LoadModule auth_digest_module libexec/apache22/mod_auth_digest.so
LoadModule file_cache_module libexec/apache22/mod_file_cache.so
LoadModule cache_module libexec/apache22/mod_cache.so
LoadModule disk_cache_module libexec/apache22/mod_disk_cache.so
LoadModule dumpio_module libexec/apache22/mod_dumpio.so
LoadModule include_module libexec/apache22/mod_include.so
LoadModule filter_module libexec/apache22/mod_filter.so
LoadModule charset_lite_module libexec/apache22/mod_charset_lite.so
LoadModule deflate_module libexec/apache22/mod_deflate.so
LoadModule log_config_module libexec/apache22/mod_log_config.so
LoadModule logio_module libexec/apache22/mod_logio.so
LoadModule env_module libexec/apache22/mod_env.so
LoadModule mime_magic_module libexec/apache22/mod_mime_magic.so
LoadModule cern_meta_module libexec/apache22/mod_cern_meta.so
LoadModule expires_module libexec/apache22/mod_expires.so
LoadModule headers_module libexec/apache22/mod_headers.so
LoadModule usertrack_module libexec/apache22/mod_usertrack.so
LoadModule unique_id_module libexec/apache22/mod_unique_id.so
LoadModule setenvif_module libexec/apache22/mod_setenvif.so
LoadModule version_module libexec/apache22/mod_version.so
LoadModule ssl_module libexec/apache22/mod_ssl.so
LoadModule mime_module libexec/apache22/mod_mime.so
LoadModule dav_module libexec/apache22/mod_dav.so
LoadModule status_module libexec/apache22/mod_status.so
LoadModule autoindex_module libexec/apache22/mod_autoindex.so
LoadModule asis_module libexec/apache22/mod_asis.so
LoadModule info_module libexec/apache22/mod_info.so
LoadModule cgi_module libexec/apache22/mod_cgi.so
LoadModule dav_fs_module libexec/apache22/mod_dav_fs.so
LoadModule vhost_alias_module libexec/apache22/mod_vhost_alias.so
LoadModule negotiation_module libexec/apache22/mod_negotiation.so
LoadModule dir_module libexec/apache22/mod_dir.so
LoadModule imagemap_module libexec/apache22/mod_imagemap.so
LoadModule actions_module libexec/apache22/mod_actions.so
LoadModule speling_module libexec/apache22/mod_speling.so
LoadModule userdir_module libexec/apache22/mod_userdir.so
LoadModule alias_module libexec/apache22/mod_alias.so
LoadModule rewrite_module libexec/apache22/mod_rewrite.so
LoadModule php5_module        libexec/apache22/libphp5.so


User www
Group www


ServerAdmin mail@rishiri.info
ServerName rishiri.info
DocumentRoot "/usr/local/www/apache22/data"

    AllowOverride All 
    Order deny,allow
    Deny from all


    Options FollowSymLinks
    AllowOverride All 
    Order allow,deny
    Allow from all


    DirectoryIndex index.php index.html


    Order allow,deny
    Deny from all
    Satisfy All

ErrorLog "/var/log/httpd-error.log"
LogLevel warn

    LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined
    LogFormat "%h %l %u %t \"%r\" %>s %b" common
    
      LogFormat "%h %l %u %t \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\" %I %O" combinedio
    
    CustomLog "/var/log/httpd-access.log" combined


    Alias /phpMyAdmin/ /usr/local/www/phpMyAdmin/
    Alias /wp/ /usr/local/www/apache22/data/wp/
    Alias /weblog/ /usr/local/www/apache22/data/wp/
    ScriptAlias /cgi-bin/ "/usr/local/www/apache22/cgi-bin/"




    AllowOverride None
    Options None
    Order allow,deny
    Allow from all


    Options none
    AllowOverride Limit
    Order Deny,Allow
    Deny from all
    Allow from 127.0.0.1 219.117.217.101 .rishiri.info

DefaultType text/plain

    TypesConfig etc/apache22/mime.types
    AddType application/x-compress .Z
    AddType application/x-gzip .gz .tgz
    AddHandler cgi-script .cgi
    AddType application/x-httpd-php .php
    AddType application/x-httpd-php-source .phps


SSLRandomSeed startup builtin
SSLRandomSeed connect builtin

AddType application/x-httpd-php .php
AddHandler php5-script .php
AddType text/html .php
AddType application/x-httpd-php-source .phps
Include etc/apache22/Includes/*.conf

コメント行を削除

2008-11-01T00:00:00.000+09:00

httpd.confやsquid.conf等コメントの多い設定ファイルから
コメント行を除く方法


/* 一応、バックアップをとってから行う */
# cd /usr/local/etc/apache22
# cp httpd.conf httpd.conf.bak
# grep -v -e "^[ ^t]*#" -e ^$ ./httpd.conf.bak > httpd.conf.orig