- Copy stable/10 (r259064) to releng/10.0 as part of the
10.0-RELEASE cycle.
- Update __FreeBSD_version [1]
- Set branch name to -RC1

[1] 10.0-CURRENT __FreeBSD_version value ended at '55', so
start releng/10.0 at '100' so the branch is started with
a value ending in zero.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Merge r257694 from head:

Remove remnants of BIND from /etc, since there is no BIND in base now.

Sorry, that would break users running head and BIND from ports, since
ports rely on these scripts. The ports will be fixed soon.

Approved by: re (kib)

Copy head (r256279) to stable/10 as part of the 10.0-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Odds and ends left over from BIND and unnoticed because they didn't
affect 'make universe'.

Approved by: re (gjb)

Fix a typo introduced in r254975.

Install 450.status-security.

Make the period of each periodic security script configurable.

There are now six additional variables
weekly_status_security_enable
weekly_status_security_inline
weekly_status_security_output
monthly_status_security_enable
monthly_status_security_inline
monthly_status_security_output
alongside their existing daily counterparts. They all have the same
default values.

All other "daily_status_security_${scriptname}_${whatever}"
variables have been renamed to "security_status_${name}_${whatever}".
A compatibility shim has been introduced for the old variable names,
which we will be able to remove in 11.0-RELEASE.

"security_status_${name}_enable" is still a boolean but a new
"security_status_${name}_period" allows to define the period of
each script. The value is one of "daily" (the default for backward
compatibility), "weekly", "monthly" and "NO".

Note that when the security periodic scripts are run directly from
crontab(5) (as opposed to being called by daily or weekly periodic
scripts), they will run unless the test is explicitely disabled with a
"NO", either for in the "_enable" or the "_period" variable.

When the security output is not inlined, the mail subject has been
changed from "$host $arg run output" to "$host $arg $period run output".
For instance:
myfbsd security run output -> myfbsd security daily run output
I don't think this is considered as a stable API, but feel free to
correct me if I'm wrong.

Finally, I will rearrange periodic.conf(5) and default/periodic.conf
to put the security options in their own section. I left them in
place for this commit to make reviewing easier.

Reviewed by: hackers@

If daily_status_security_inline is set, the rc value needs to be
forced to 3 so that the output of this script is always displayed.
In fact, setting this flag is identical to setting
daily_status_security_output to an empty string. To make the logic
less confusing, change the behavior of daily_status_security_inline
such that it just forces daily_status_security_output to an empty
string and then applies the normal logic.

PR: conf/178611
Submitted by: Jason Unovitch <jason.unovitch@gmail.com>
MFC after: 3 days

Unconditionally install 210.backup-aliases as many MTAs other than
sendmail support the use of /etc/aliases.

PR: conf/176098
Submitted by: ak
MFC after: 2 weeks

Remove periodic script for ataraid(4) and add instead script for graid(8).

make installation of the 220.backup-pkgdb periodic script depend on PKGTOOLS
knob

Make a command for pkg_info changeable like pkg_version in
/etc/periodic/weekly/400.status-pkg to be friendly with pkgng.

MFC after: 1 week

Only output a list of file systems that need to be dumped if the system
has a non-empty dumpdates file.

Reviewed by: brooks
MFC after: 1 week

Display dropped transmit packets in the daily network interface output.

PR: conf/165956
Submitted by: Jeremy Chadwick
MFC after: 1 week

Add an option to 404.status-zfs (enabled by default) to list all
zfs pools on the system.

While here, document daily_status_zfs_enable in periodic.conf(5).

Discussed on: -fs [1]
Reviewed by: netchild [1]
Approved by: jhb
MFC after: 1 week

[1] - http://lists.freebsd.org/pipermail/freebsd-fs/2011-June/011869.html

The default setting, daily_accounting_compress="NO", was causing
only 1 old file to be saved, so fix this. Problem raised in the PR,
but actually required a different solution.

While I'm here, fix a very old off-by-one error causing 1 more file
than specified in daily_accounting_save to be saved because acct.0
was not taken into account (pun intended). Change that, and use a more
thorough method of finding old files to delete. Partly just because this
is the right thing to do, but also to silently fix the extra log that
would have been left behind forever with the previous method.

PR: conf/160848
Submitted by: Andrey Zonov <andrey@zonov.org>

Increase default scrub threshold from 30 days to 5 weeks. Using
whole weeks makes it easier to predicate when the scrub would
happen.

MFC after: 1 week

Fix error message in case the backup storage directory does not exist and
cannot be created ($daily_backup_pkgdb_dbdir -> $daily_backup_pkgdb_dir).
MFC after: 1 week

Add WITHOUT_UTMPX switch to the build system.

This knob removes the tools that are exclusively used to view and
maintain the databases maintained by utmpx, namely last, users, who,
wtmpcvt, ac, lastlogin and utxrm.

The tool w is not in this list, because it has some other functionality
which is unrelated to utmpx; it is hardlinked to the uptime tool.

Don't omit ac(8) as part of WITHOUT_ACCT.

The WITHOUT_ACCT switch is supposed to omit tools related to process
accounting, namely accton and sa. ac(8) is just a simple tool that
prints statistics based on data in the utx.log database. It has nothing
to do with the former.

Eliminate extraneous pipelines and tr calls.

Approved by: kib (mentor)
MFC after: 3 days

Convert the allowed characters '-', '.', and ':' in a ZFS pool name to _
to avoid causing errors in the shell script.

Submitted by: William Grzybowski <william88@gmail.com>
Approved by: kib (mentor)
MFC after: 7 days
Sponsored by: iXsystems

1. If PKG_DBDIR cannot be determined from make, set the default
2. Add the -H flag to tar in case /var/db/pkg itself is a symlink
3. Direct stderr to /dev/null to suppress the leading slash warning [1]

PR: ports/156810 [1]
Submitted by: Jeremy Chadwick <freebsd@jdc.parodius.com> [1]

The security run requests unmaskable output, even if the only output is to
tell that there is a separate email or that the output is logged to a file.

This commit changes the return code for the non-inline case to tell that
this message is not important enough and can be masked if necessary. The
messages from the security checks themself are not affected by this and
show up as before in the periodic security email/file.

The inline case still requests to not mask the output, as with the current
way of handling this there is no easy way to handle this.

PR: 138692
Analysis/patch atch by: Chris Cowart <ccowart@timesinks.net>
X-MFC after: on request

Use proper return codes (valuable output, invalid config, problems).

MFC after: 1 week

Hook the 220.backup-pkgdb script I added to the build unconditionally

Hook up 610.ipf6denied based on MK_IPFILTER as 510.ipfdenied is now

Poked by: Andrzej Tobola <ato@iem.pw.edu.pl>

Add svn:executable property on remaining period scripts without it

Add a daily period script to back up /var/db/pkg

The final product contains work from the originator, and
Florent Thoumie <florent.thoumie@gmail.com>. The final
product contains considerable re-working by me, so all
responsibility for bugs rests under my pointy hat.

PR: ports/145957
Submitted by: Eitan Adler <EitanAdlerList@gmail.com>

Add the svn:executable property to the scripts that are missing it

Update how accounting log files are rotated.

The old version had a race between the time that the old file was
cp'ed to acct.0 and the time that 'sa -s' was run that prevented
the commands that occurred in the meantime from being backed up.

It's also arguable that the old version was inefficient in using
cp which can be a problem on a space-constrained system.

This version avoids both problems, albeit it's considerably more
complicated. The advantage of putting the log rotation in the rc.d
script is that it can handle the _enable and _file questions without
having to do gymnastics to discover either value in the periodic script.

As a side effect of reviewing the rc.d script I cleaned it up a bit.

Fix logic error introduced in previous commit.
Along the way make some efficiency improvements.

Submitted by: jilles
Approved by: kib (mentor)
MFC after: 3 days

This script parses output of userland tools. In the case of a faulted
zpool the output causes the script to bail out with syntax errors.
Since a scrub of a faulted zpool is pointless, just skip over any pools
marked as such.

PR: conf/150228
Submitted by: jpaetzel
Approved by: kib (mentor)
MFC after: 3 days
MFC note: only for RELENG_8

Add an (off by default) check for negative permissions (where the
group on a object has less permissions that everyone). These
permissions will not work reliably over NFS if you have more than
14 supplemental groups and are usually not what you mean.

MFC after: 1 week

Hide 460.chkportsum in MK_PKGTOOLS != no case.

Submitted by: Alex Kozlov <spam rm-rf kiev ua>
MFC after: 2 weeks

- Change the threshold from 'running next scrub the <value+1>th day after the
last one' to 'running next scrub the <value>th day after the last one'.
- Improve wording.

Requested by: jhell <jhell@DataIX.net>
MFC after: 1 week

Connect the new script 490.status-pkg-changes (see r210863)
to the build, so it gets actually installed.

Approved by: des (mentor)
MFC after: 17 days

- Fixes to the chkportsum script to handle better some special cases,
like spaces in filename

Submitted by: Alex Kozlov <spam@rm-rf.kiev.ua>
Approved by: delphij (mentor)

Add a daily script to the periodic framework that reports
changes to the package database, i.e. any packages that
have been added, updated or deleted in the past 24 hours.
The format is intentionally simple and concise.

That information is particularly useful on servers that
are maintained by multiple administrators. When someone
adds, updates or deletes a package, the others will see
it in the daily periodic output.

This script is disabled by default.

PR: conf/113913
Submitted by: olli
Approved by: des (mentor)
MFC after: 3 weeks

- Add a periodic script, which can be used to find installed ports' files with
mismatched checksum

PR: conf/124641
Submitted by: Alex Kozlov <spam@rm-rf.kiev.ua>
Approved by: delphij (mentor)

- add the zfs scrub script
- move the zfs status script into the MK_ZFS conditional to respect
WITHOUT_ZFS

Noticed by: Andrzej Tobola <ato@iem.pw.edu.pl>

Add a periodic zfs scrub script.

Features:
- configurable amount of days between scrubs (default value or per pool)
- do not scrub directly after pool creation (respects the configured
number of days between scrubs)
- do not scrub if a scrub is in progress
- tells how to see the status of the scrub
- tells how many days since the last scrub if it skips the scrubbing
- warns if a non-existent pool is specified explicitely
(default: no pools specified -> all currently imported pools are
handled)
- runs late in the periodic run to not slow down the other periodic daily
scripts

Discussed on: fs@

Add a new build option, MAN_UTILS. This option lets you control building
utilities and related support files for manual pages, which were previously
controlled by MAN. For POLA, the default depends on MAN, i.e., WITHOUT_MAN
implies WITHOUT_MAN_UTILS and WITH_MAN implies WITH_MAN_UTILS. This patch
is slightly improved by me from:

PR: misc/145212

Remove trailing white space. No functional changes.

Let rc and periodic infrastructure and newsyslog use the utmpx files.

Silence warning printed by getfsspec(3) when /etc/fstab does not exist
fstab: /etc/fstab:0: No such file or directory
and from dump(8) when setfsent(3) fails due to /etc/fstab not existing:
DUMP: Can't open /etc/fstab for dump table information: No such...

This makes daily and security periodic runs somewhat cleaner in jails
which lack /etc/fstab files.

MFC after: 1 month

Rather than using both -prune (which requires directory-first tree traversal)
and -delete (which implies depth-first traversal), avoid using -delete in
favour of -execdir.

This has a side-effect of not removing directories that contain files,
even if we delete all of those files, but IMHO that's a better option
than specifying all possible local filesystem types in this script.

PR: 122811
MFC after: 3 weeks

Update this script so that it handles different ruleset failures
differently. The output now shows the ruleset and shortens to
slightly different text (using $daily_status_mail_rejects_shorten),
but it should be more descriptive.

PR: 35018
Inspired by: Mikhail Teterin - mi at aldan dot algebra dot com
MFC after: 3 weeks

Fix typo to install 400.status-pkg, again.

Sort `mount -p' output by name before checking for any differences.

I noticed on a system at home that restarting named(8) causes the
/var/named/dev mount to be moved to the bottom of the mount list,
because it gets remounted. When I received the daily security email this
morning, I was quite amazed to see that the security report listed the
differences, while it was nothing out of the ordinary.

If we just throw the `mount -p' output through sort(1), we'll only
receive notifications about changes to mounts if something has really
changed.

add new build knobs and jigger some existing controls to improve
control over the result of buildworld and installworld; this especially
helps packaging systems such as nanobsd

Reviewed by: various (posted to arch)
MFC after: 1 month

Improve periodic/security/550.ipfwlimit a bit:
- don't run it if net.inet.ip.fw.verbose = 0 as it is pointless
- handle rules without logging limit correctly [1]
(those rules show up without logamount in "ipfw -a list")

PR: conf/126060 [1]
MFC after: 1 month

Rev. 1.8 broke matching on lines where the failure mode is at the head
of the message, such as:
Jun 30 10:49:21 rogue sshd[17553]: Invalid user iceman from 127.0.0.1

PR: conf/124569
Submitted by: Taku <taku@tekipaki.jp>

Add a missing ;.

PR: misc/122069
Submitted by: taku@tekipaki.jp
MFC after: 3 days
Approved by: imp (mentor, implicit trivial change).

Eliminate xargs in favor of find -exec {} +

Rewrite to consume significantly less memory, by using find -s instead of
find | sort. As a bonus, this simplifies the logic considerably. Also
remove the bogus "overruning the args to ls" comment and the corresponding
"-n 20" argument to xargs; the whole point with xargs is precisely that it
knows how large the argument list can safely get.

Note that the first run of the updated script may hypotheticall produce
false positives due to differences between find's and sort's sorting
algorithm. I haven't seen this during testing, but others might.

MFC after: 2 weeks

A new configuration variable, daily_status_mail_rejects_shorten, allows
the rejected mail reports to tally the rejects per blacklist without
providing details about individual sender hosts. The default configuration
keeps the reports in their original form.

MFC after: 1 week

Also check setuid executables on ZFS.

o Install 480.status-ntpd.

Pointed out by: Henrik Brix Anders

o Add a script to check ntpd(8) state. Default is off.

PR: conf/112604
Submitted by: Oliver Fromme
MFC after: 1 month

Add ZFS periodic scripts that monitors status of ZFS pools.

Submitted by: des

Only match on log messages containing fail,invalid,
bad or illegal. This prevents matching on systems that
have a name that matches the query.

PR: conf/107560
Submitted by: Christian Laursen <cfsl at pil dot dk>
MFC after: 3 days
Approved by: imp (mentor)

Move to the preferred syntax for nice (-n) instead
of the depricated one.

PR: conf/108611
Submitted by: TAOKA Fumiyoshi <fmysh at iijmio-mail dot jp>
Approved by: imp (mentor)

Use egrep instead of grep so that reporting of login failures (broken
by revision 1.6) works again. This fix is already in RELENG_6, but was
never committed to HEAD.

The kvm_mkdb(8) is long dead.

Add login.conf checking to periodic security scripts. If the login.conf file
is not UID/GID 0, limits will be ignored and a strange error sent to auth.log.

Head nod: ru, rwatson

o Add missed $start variable in the grep statement back.

PR: conf/96658
Submitted by: James Snow
MFC after: 1 week

Move etc/rc.firewall6 to ipfw2+v6, update related rc.d and periodic scripts.
Since ipfw2 now does dual-stack, statistics for IPv6 come from the ipfw
scripts as well.

Fix output and exit status when daily_mailq_shorten is set to YES

PR: conf/93472
MFC after: 3

Enhance loginfail: it will catch sshd, proftpd and su errors, as well as other programs

PR: conf/70973
Submitted by: Ryan Sommers" <ryans@gamersimpact.com>
Approved by: philip (mentor)
MFC after: 3 days

Add periodic scripts that check the status of graid3(8), gstripe(8)
and gconcat(8) devices, respectively.

Approved by: rwatson (mentor)

When there are no interesting information in output, exit with 0.

PR: conf/92299
Submitted by: Petr Rehor <prehor@gmail.com>
Approved by: philip (mentor)
MFC after: 3 days

o Add 406.status-gmirror, sort.

Submitted by: brueffer

Add a daily script to show the status of gmirror(8) devices.

Update the test for failed zone transfers to reflect BIND 9.3.1 semantics
Simplify the shell scripting a bit, and remove a useless grep | sed

The problem was pointed out by the PR, and I used part of the solution
suggested there, but the semantics changed again for 9.2.x -> 9.3.x.

PR: conf/74228
Submitted by: Jeremy Chadwick <freebsd@jdc.parodius.com>

A new version of rev. 1.4: postpone a temporary file creation
until we realize if ipfw(4) ever used.

PR: bin/85970
Submitted by: Andre Albsmeier
MFC after: 3 days

Fix braino in last commit. Print nothing if ipfw(4) is not present.

When looking for new lines in diff output, grep for '^[>+]' instead of
'^>', in order to catch both normal and unified diffs.

Problem reported by: volker at vwsoft dot com via -stable
MFC after: 3 days

- Correctly parse output, when logging amount is limited in the
rule itself, not in verbose_limit sysctl. [1]
- Do check rules, even if verbose_limit is set 0. Rules may have
their own log limits.

PR: conf/77929
Submitted by: Andriy Gapon [1]
Reviewed by: matteo

Purge orphan catpages.

PR: conf/35242
Submitted by: Annihilator <annihilator.c@usa.net>

Replace "ipfw l", which is now deprecated, with "ipfw list".

Approved by: grehan (mentor)

Don't do setuid checks on file systems mounted with noexec option.

Reviewed by: brian, ru
MFC after: 1 week

Sed doesn't grok '[ \t]' -- it doesn't expand the \t :(

As there are no tabs in maillog, reduce the expression so that only spaces
are used.

Problem raised by: Leif Neland root at internet dot dk

Oops, the < in arg1=< is optional - treat it as such!

Adjust the mail reject output so that it gives an abreviated reason for the
reject. For example:

Checking for rejected mail hosts:
48 getherbalnow.info (451... resolve)
46 absorb.com (451... resolve)
4 tgmart01.codns.com (553... exist)
3 kali.com.cn (451... resolve)
2 genie.com (451... resolve)
1 zv.qy (553... exist)
1 zd.hinet.hr (553... exist)
....

The bit in parenthesis is the reject code and the last word on the line -
enough to give the admin a better chance of seeing real problems (hopefully!).

While I'm here, remove the "<" at the start of rejects coming from "from"
addresses without a name@ part.

I had to rewrite the patch given by the submitter as this script has been
sed'ified (used to be perl) and I think the reject code is useful....

PR: 17377
Idea from: root at ns dot internet dot dk
MFC after: 7 days

Collapse "fgrep | egrep | sed" down to a single sed.

This also trims extraneous commas from domain names.

MFC after: 7 days

Start the dreaded NOFOO -> NO_FOO conversion.

OK'ed by: core

Teach periodic(8) security output to display information about blocked
packet counts by pf(4).

This adds a ``daily_status_security_pfdenied_enable'' variable to
periodic.conf, which defaults to ``YES'' as the matching IPF(W) versions.

The output will look like this (line wrapped):

pf denied packets:
> block drop log on rl0 proto tcp all [ Evaluations: 504986 Packets: 0
Bytes: 0 States: 0 ]
> block drop log on rl0 all [ Evaluations: 18559 Packets: 427 Bytes: 140578
States: 0 ]

Submitted by: clive (thanks a lot!)
MFC after: 2 weeks

Add a knob 'daily_status_security_diff_flags' controlling the
format of the 'diff' output generated during periodic(8) scripts.

Submitted by: keramida (script changes)
Reviewed by: keramida (man page changes)

Allow the location of the INDEX file to specified to pkg_version.
This is particularly convenient on a cluster of machines to prevent
having to rebuild the INDEX file on each.

Reviewed by: portmgr

Add script for checking ipv6 blocked packets from PR.

PR: misc/50154
Submitted by: Kimura Fuyuki <fuyuki@hadaly.org>

Don't remove empty dirs if their names are in $daily_clean_tmps_ignore

Use hoststat/purgestat instead of sendmail -bh/-bH so the calls can
be properly mailwrapper'ed.

PR: conf/60676
Submitted by: Colin Percival <cperciva@daemonology.net>, maxim
MFC after: 4 days

Use %e in the date(1) format string to eliminate the sed(1) command.

Add status checking of ATA raid to the daily periodic scripts.

Have mktemp(1) construct the temporary file name for us instead
of providing a template manually.

Submitted by: Lars Eggert <larse@isi.edu>

Remove 220.backup-distfile since it has been deleted.

Reported by: mdodd
Pointy hat to: jhb

Complete removal of 320.rdist by removing its entry from periodic.conf and
removing the related 220.backup-distfile script and associatd periodic.conf
entry.

Discussed with: obrien

320.rdist is OBE as we don't have rdist in the base system any more.

This is OBE as we don't have rdist in the base system any longer.

Do not do manually what sendmail(8) can do better automatically.
Tell sendmail to clean up its own host status cache.
The error condition handling could probably be done better.

Add support for bzip2ed log files.

Avoid using perl in the periodic & security scripts. This brings the
base system one step closer to being totally perl-free.

Approved by: re (jhb)

Do not emit a message on stderr when one of the compared files
is shorter than the other.

Reviewed by: roberto
MFC after: 3 days

Remove incorrect output redirection.

Reviewed by: roberto
Committed from: EuroBSDCon Amsterdam
MFC after: 3 days

Add newly-added sripts to FILES.

Reviewed by: roberto

Add a new /etc/periodic/security script to check for packets
rejected by ipfilter (510.ipfdenied), and a corresponding periodic.conf
knob (daily_status_security_ipfdenied_enable).

Reviewed by: roberto
Approved by: re@

Factor out code across various /etc/periodic/security scripts into a
separate file, /etc/periodic/security/security.functions.

Reviewed by: roberto (mentor)
Approved by: re@

When considering temporary files for deletion, don't examine the mtime
and atime only, but also the ctime. Otherwise, files extracted from
tar or zip archives will immediately be declared stale since they've
got their mtime reset to the original mtime.

Reviewed by: brian
MFC after: 1 week

Add a pkg_version variable so that it's possible to run portsversion instead
of pkg_version in periodic/weekly/400.status-pkg.

Make it work with POSIX sort (POS arg).
All old sorts understand -k too.

Only create a temporary file if we are actually going to do something
in the script. Eliminates a bug where we create a temp file, but don't
delete it since the rm(1) is only done if the check is enabled.

PR: bin/40960
Submitted by: frf <frf@xocolatl.com>
MFC after: 3 days

o Test and change to the correct directory, /var/spool/.hoststat
o Bring if/then style in sync with /etc/rc scripts

PR: conf/41570
Submitted by: Konstantin M Volevatch <cox@rosnet.ru>
MFC after: 1 week

If all file systems are marked nosuid, the line:

MP=`mount -t ufs | grep -v " nosuid" | awk '{ print $3 }' | sort`

sets ${MP} to an empty string so the next line:

set ${MP}

actually just dumps all of the shells variables to stdout (and therefore
the security report). Fixed by surrounding the code which goes through the
mounts with a test for an empty string before using ${MP}.

Reviewed by: brian
MFC after: 3 days

Install scripts via FILES (purposedly not via SCRIPTS that would
strip the suffixes).

s/${INSTALL} -c/${INSTALL} ${COPY}/

Mention that we're checking kernel log messages, even if there's
no output.

PR: 39618
MFC after: 1 week

Temporarily change our umask to 066 so that the potential creation
of wtmp.0 is done as mode 600.

This ensures that tight permissions set in /etc/newsyslog.conf for
wtmp logging aren't ``betrayed''.

Suggested by: lumpy <lumpy@the.whole.net>
MFC after: 3 days

Change ``dmesg -a'' to ``dmesg''.

The change was introduced in src/etc/security 1.53 almost a year ago
in an attempt to see ipfw deny message logs.

However, ipfw deny/reject logs have been displayed since version 1.13
of the same file as a separate ``job'' and have since moved to
src/etc/periodic/security/500.ipfwdenied.

MFC after: 3 days

Tighten up temporary file permissions and move them to ${TMPDIR:-/tmp}

Problem reported by: lumpy <lumpy@the.whole.net>
MFC after: 3 days

Return 3 unless $daily_status_security_enable != YES.
Returning $? masks security output when ``periodic security'' is successful !

MFC after: 3 days

Fix the output when daily_status_mailq_shorten is set to YES

PR: 23766
Mostly submitted by: lambert@ssabsd.csw.net
MFC after: 3 days

Remove leading whitespace from the setuid file lists.

Due to the way we run ls(1), through xargs(1), the leading whitespace
can change even when the setuid files haven't. To avoid displaying
these lines, we currently run diff(1) with the '-w' option. However,
this is probably not the ideal way to go; there is a very, very small
possibility for diff(1) to miss things is shouldn't. So, with the
leading space cleaned, we can revert to the '-b' option which is
"safer."

PR: conf/37618
Reviewed by: brian
MFC after: 3 days

Handle .bz2 files created by newsyslog

PR: 37529
Partially submitted by: Peter Hollaubek <fifteen@inext.hu>
MFC after: 1 week

Update mail queue related periodic scripts to account for sendmail 8.12's
clientmqueue (submit mail queue).

The new mailq display is only active if both the old
daily_status_mailq_enable is set to "YES" and the new
daily_status_include_submit_mailq is set to "YES" so people who disabled
440.status-mailq won't have any surprises.

Likewise, the new queue run is only active if both the old
daily_queuerun_enable is set to "YES" and the new daily_submit_queuerun
is set to "YES" so people who disabled 500.queuerun won't have any
surprises.

While I am here, remove the [ ! -d /var/spool/mqueue ] checks from
both scripts as the queue directory isn't always /var/spool/mqueue for
the main daemon -- it can be set to anything in the sendmail.cf file.

MFC after: 1 week

No need to explicitly check for both cases when using grep -i.

Update login failure checking to check auth.log instead of messages,
and teach it to look for more general classes of failures, including
SSH login failures. This is similar but not identical to a patch
submitted by aeonflux@synapse.subneural.net.

Environmental variable was not being passed to a subshell as intended.

PR: bin/35558
Submitted by: Nicolas Rachinsky <list@rachinsky.de>

Set rc=1 rather than 0 so that setting daily_show_success=YES masks
the output of all goes well.

PR: 34825
Submitted by: Valentin Nechayev <netch@netch.kiev.ua>
MFC after: 3 weeks

Fix a stray character that found its way into a filename.

Work around the bugfeature of test(1).

PR: bin/32822

Long ago, there was just /etc/daily. Then /etc/security was split out
of /etc/daily. Some time later, /etc/daily became a set of periodic(8)
scripts. Now, this evolution continues, and /etc/security has been
broken into periodic(8) scripts to make local customization easier and
more maintainable.

Reviewed by: ru
Approved by: ru

Make sure the security check output includes a To: line in the
same way the daily run output does.

Handle wtmp.0 being compressed

PR: 32113
Submitted by: Yar Tikhiy <yar@comp.chem.msu.su>
MFC after: 1 week

After further discussion on -CURRENT, some people (jhb) do not like
the idea of not masking passwords on comments in case the
administrator comments out an entry without clearing the
password. Instead completely ignore comments (since they have no
security impact) when doing the diff of the old and new passwd file.

Suggested by: rwatson

No need to hide stuff in the $FreeBSD$ tag or in other comments like,

Backup passwd and group files:
1c1
< # $FreeBSD:(password):09:07 peter Exp $
---
> # $FreeBSD:(password):27:16 ache Exp $

MFC after: 1 week

UUCP removal Phase III.

Run the uustat command as the uucp user, not as root.

Remove $daily_status_named_logs and figure out which /var/log/messages*
files to look an (in the same way that /etc/security does).

Don't single-quote $start, reducing it to an empty string.

MFC after: 3 days

Don't try to remove directories unless we've emptied them first

Submitted by: NIIMI Satoshi <sa2c@and.or.jp>
PR: 28355
MFC after: 1 week

Recognize and support new output which pkg_version(1) might produce.

PR: 27707
Approved by: bmah, markm

Small adjustment to whitespace in output

Remove vestiges of MFS.

Truly limit the path to local filesystems.

Default daily_accounting_flags to -q. I thought this was a typo in the
originally submitted patch (oops!).

Also check for an empty $daily_accounting_save.

Submitted by: Udo Schweigert <Udo.Schweigert@cert.siemens.de>

Add $daily_accounting_save and $daily_accounting_flags

Submitted by: Udo Schweigert <Udo.Schweigert@cert.siemens.de>
MFC after: 2 weeks

Add 470.status-named.

Reminded by: gshapiro

Remind the user that they need to check CPAN manually for updates
to perl5 modules installed by hand.

Fixed typo.

PR: bin/26836
Submitted by: Matthew Seaman <matthew.seaman@tornadogroup.com>

Check for denied zone transfers (AXFR and IXFR).

Identify obsolete ports

setlocale(3) has been fixed to match POSIX standard:
LC_ALL takes precedence over other LC_* envariables.

Add 500.queuerun

Move the sendmail -q from cron to periodic, as suggested by a few people.
This has the benefit of adding a random start time element as daily
processing takes a different amount of time on different machines.

Allow the output of /etc/security to be logged or mailed to different
users in line with ${daily,weekly,monthly}_output using a new
$daily_status_security_output variable.

PR: 24643

Cope with ports that have multiple versions *and* have embedded ``-''s
in their name.

Understand ``multiple versions'' lines emitted from pkg_version.

Handle multiple words in $daily_clean_disks_files

PR: 23805
Submitted mostly by: Norbert Papke <npapke@telus.net>

Finish the job of conditionalizing UUCP by preventing files in /etc/uucp
from being installed, and make rmail conditional on neither of
NO_SENDMAIL and NOUUCP.

PR: bin/21321
Submitted by: Me

Case is irrelevant when sorting mail redirects

PR: 21600
Submitted by: David Wolfskill <dhw@whistle.com>

Remove a forgotten line

Submitted by: Philipp Mergenthaler <un1i@rz.uni-karlsruhe.de>

Another overhaul of the periodic stuff.

All periodic sub-scripts <larf> now have their return codes interpreted
by periodic(8). Output may be masked based on variable values in
periodic.conf.

It's also now possible to email periodic output to arbitrary addresses,
or to send it to a log file, examples of which can be found in
newsyslog.conf.

The upshot of it all should be no discernable changes to the default
behaviour of periodic(8).

PR: 21250

Correct variable spelling

PR: 20841

Complete migration of aliases file to /etc/mail/aliases.
The maintainers of share/examples/diskless/README.TEMPLATING and mergemaster
have been contacted so those may be updated as well.

Correct dodgy wild card expansion

PR: 20514

Introduce a new option, daily_status_disks_df_flags, which specifies
the command-line arguments to be used for the call to df(1) when
daily_status_disks_enable is set to YES.

The name of the new variable was chosen by the maintainer of our
periodic hierarchy, Brian Somers.

PR: 19631

Add $daily_status_mail_rejects_logs, defaulting to 3 to control
how many /var/log/maillog* files to check

PR: 19587

Correct two variable names

Mostly submitted by: howardjp@wam.umd.edu
PR: 19567

Added 400.status-pkg.

Forgotten by: brian

Add weekly_status_pkg_enable (defaults to NO)

Allow compressed acct files

PR: 19483
Submitted by: Ben Smithurst <ben@scientia.demon.co.uk>

daily_status_network_enable -> daily_status_network_usedns

Submitted by: Alexander Leidinger <Alexander@leidinger.net>

Introduce /etc/defaults/periodic.conf, similar in concept to rc.conf.
The only change in the default functionality should be that
the output reports are slightly more verbose WRT files deleted.

Not objected to by: freebsd-arch

Use $clear_daily_* from rc.conf to decide what should be deleted

Reviewed by: The silence of -committers

Clean /tmp and /var/tmp if $clear_tmp_enable is set to YES in rc.conf
Clean /compat/linux/tmp if $linux_enable is also set to YES in rc.conf

Revert to rev 1.3 since the sed'ing is wrong. Revisit this after 4.0-RELEASE.

Update the sed action to match the change to "diff -u".
Otherwise the encrypted password of any account who's information changed
was shown in the daily email to root.

Submitted by: jhb

Use the *much* more readable unified diff format.

Use manpath -L for man locales

"make install" did not install 150.clean-hoststat.

PR: bin/12497

localize it

Submitted by: "Alexey Zelkin" <phantom@crimea.edu>

$Id$ -> $FreeBSD$

Update the locate database even if user nobody can't stat root's
home directory.

PR: 10700
Submitted by: Sergey Korsak <skif@1plus1.net>

Don't delete quota files when clean-tmps is enabled.

Remove remaining traces of the prototype...

Clean up persistent host status from sendmail(8) (if so configured).
I had accumulated years' worth of junk files; now others won't
have to.

Finally remove the ancient `-exec rm -f {} ;' cruft that used to be
used to cleanup old files, and replace it by -delete which has been
present in our find(1) for ages now.

Now that newsyslog is capable of doing this at a specific time,
let it rotate /var/log/wtmp again, and update monthly/200.accounting to
take this into account. (Some sites might want to change the parameters
of the rotation; it's easier to do this when it's all centralized in
newsyslog.conf.)

UUCP Cleanup should be done by the UUCP user.

PR: bin/7749
Submitted by: Ruslan Ermilov <ru@ucb.crimea.ua>

Avoid the ``ruptime: no hosts in /var/rwho.'' message by not calling
rwho iff /var/rwho is empty. Call `uptime' instead. This doesn't
belong under `network' right away, but at least reports the same
informaton about the local system. rwhod is not turned on by default
(for good reason), and i've already seen too many of the above
messages...

Remove useless `BINOWN=root' now that it is the default.

Fixed double slashes in a pathname.

Fixed some style bugs. Ensure no creation of an obj directory so that
we don't need to chdir before installing.

Add a chkgrp run after backing up the passwd and group files.

Suggested-by: Andreas Klemm

Changed /usr/sbin/mailq to /usr/bin/mailq

PR: 1708, 5448
Reviewed by: Alex Nash, Steve Price
Enhance wtmp monthly handling

Count _all_ rejects, not made by check_mail and check_relay only.
There can be private rules which produce rejects.
Pointed out by: áÎÄÒÅÊ þÅÒÎÏ×

Count hosts and sort by score.

Replace sed(1) with perl(1). The 4.4BSD sed programm is
200 times slower than perl or SunOS 5.5.1 sed.

Remove ``start='' used when testing :-(

Just list one of each domain that was rejected
(although only by Scheck_relay or Scheck_mail).
Suggested by: ache

Add an example for busy mail servers, commented out.

Do not run by default. Can grow your root mailbox up to 2Mb per day
since SPAMmers like to retry often

Use manpath(1) to determine the value of ${MANPATH} instead of
using one of two hard-coded values.

PR: 5365
Submitted by: Ruslan Shevchenko <rssh@cam.grad.kiev.ua>

Don't test for executability of /usr/sbin/sysctl [before execing
plain sysctl]. We already assumed that many standard commands
exist, and sysctl is not special.

Check for rejected mail
Not commented on by: freebsd-hackers

Check for files belongs to an unknown user or unknown group.
Do not run by default.

Delete unused code.

Fix typo in my prev. commit

Do not remove /var/tmp/vi.recover

Remove 100.clean-src

Cosmetic changes.
Submitted by: Philippe Charnier <charnier@xp11.frmug.org>

This was disabled, but it doesn't even make sense to leave it in as
an example, it's totally bogus.

This commit was generated by cvs2svn to compensate for changes in r28263,
which included commits to RCS files with non-trunk default branches.