第 30 章网络服务器

安装应用程序: Packages 和 Ports

inetd_enable="YES"
inetd_enable="NO"
# /etc/rc.d/inetd rcvar
# /etc/rc.d/inetd reload
service-namesocket-typeprotocol{wait|nowait}[/max-child[/max-connections-per-ip-per-minute[/max-child-per-ip]]]user[:group][/login-class]server-programserver-program-arguments
ftp stream  tcp nowait  root/usr/libexec/ftpd ftpd -l
finger stream  tcp nowait/3/10 nobody /usr/libexec/fingerd fingerd -s
rpcbind_enable="YES"nfs_server_enable="YES"mountd_flags="-r"
nfs_client_enable="YES"
/cdrom -ro host1 host2 host3
/home  -alldirs  10.0.0.2 10.0.0.3 10.0.0.4
/a  -maproot=root  host.example.com box.example.org
# Invalid when /usr is one file system/usr/src   client/usr/ports client
/usr/src /usr/ports  client
# Export src and ports to client01 and client02, but only# client01 has root privileges on it/usr/src /usr/ports -maproot=rootclient01/usr/src /usr/ports client02# The client machines have root and can mount anywhere# on /exports. Anyone in the world can mount /exports/obj read-only/exports -alldirs -maproot=rootclient01 client02/exports/obj -ro
# kill -HUP `cat /var/run/mountd.pid`
# /etc/rc.d/mountd onereload
# rpcbind# nfsd -u -t -n 4# mountd -r
# nfsiod -n 4
# mount server:/home /mnt
server:/home	/mnt	nfs	rw	0	0
rpc_lockd_enable="YES"rpc_statd_enable="YES"
# /etc/rc.d/lockd start# /etc/rc.d/statd start
% showmount -e foobarExports list on foobar:/usr 10.10.10.0/a 10.10.10.0% cd /host/foobar/usr
amd_enable="YES"
amd_flags="-a /.amd_mnt -l syslog /host /etc/amd.map /net /etc/amd.map"
fastws:/sharedfs /project nfs rw,-r=1024 0 0
# mount -t nfs -o -r=1024 fastws:/sharedfs /project
freebox:/sharedfs /project nfs rw,-w=1024 0 0
# mount -t nfs -o -w=1024 freebox:/sharedfs /project
nisdomainname="test-domain"
nis_server_enable="YES"
nis_yppasswdd_enable="YES"
# /etc/rc.d/ypserv start
# cp /etc/master.passwd /var/yp/master.passwd# cd /var/yp# vi master.passwd
ellington# ypinit -m test-domainServer Type: MASTER Domain: test-domainCreating an YP server will require that you answer a few questions.Questions will all be asked at the beginning of the procedure.Do you want this procedure to quit on non-fatal errors? [y/n: n] nOk, please remember to go back and redo manually whatever fails.If you don't, something might not work.At this point, we have to construct a list of this domains YP servers.rod.darktech.org is already known as master server.Please continue to add any slave servers, one per line. When you aredone with the list, type a <control D>.master server   :  ellingtonnext host to add:  coltranenext host to add:  ^DThe current list of NIS servers looks like this:ellingtoncoltraneIs this correct?  [y/n: y] y[..output from map generation..]NIS Map update completed.ellington has been setup as an YP master server without any errors.
ellington# vi /var/yp/Makefile
NOPUSH = "True"
coltrane# ypinit -s ellington test-domainServer Type: SLAVE Domain: test-domain Master: ellingtonCreating an YP server will require that you answer a few questions.Questions will all be asked at the beginning of the procedure.Do you want this procedure to quit on non-fatal errors? [y/n: n]  nOk, please remember to go back and redo manually whatever fails.If you don't, something might not work.There will be no further questions. The remainder of the procedureshould take a few minutes, to copy the databases from ellington.Transferring netgroup...ypxfr: Exiting: Map successfully transferredTransferring netgroup.byuser...ypxfr: Exiting: Map successfully transferredTransferring netgroup.byhost...ypxfr: Exiting: Map successfully transferredTransferring master.passwd.byuid...ypxfr: Exiting: Map successfully transferredTransferring passwd.byuid...ypxfr: Exiting: Map successfully transferredTransferring passwd.byname...ypxfr: Exiting: Map successfully transferredTransferring group.bygid...ypxfr: Exiting: Map successfully transferredTransferring group.byname...ypxfr: Exiting: Map successfully transferredTransferring services.byname...ypxfr: Exiting: Map successfully transferredTransferring rpc.bynumber...ypxfr: Exiting: Map successfully transferredTransferring rpc.byname...ypxfr: Exiting: Map successfully transferredTransferring protocols.byname...ypxfr: Exiting: Map successfully transferredTransferring master.passwd.byname...ypxfr: Exiting: Map successfully transferredTransferring networks.byname...ypxfr: Exiting: Map successfully transferredTransferring networks.byaddr...ypxfr: Exiting: Map successfully transferredTransferring netid.byname...ypxfr: Exiting: Map successfully transferredTransferring hosts.byaddr...ypxfr: Exiting: Map successfully transferredTransferring protocols.bynumber...ypxfr: Exiting: Map successfully transferredTransferring ypservers...ypxfr: Exiting: Map successfully transferredTransferring hosts.byname...ypxfr: Exiting: Map successfully transferredcoltrane has been setup as an YP slave server without any errors.Don't forget to update map ypservers on ellington.
20* * * * root   /usr/libexec/ypxfr passwd.byname21* * * * root   /usr/libexec/ypxfr passwd.byuid
nisdomainname="test-domain"nis_client_enable="YES"
+:::::::::
+:*::
# /etc/netstart# /etc/rc.d/ypbind start
# allow connections from local host -- mandatory127.0.0.1 255.255.255.255# allow connections from any host# on the 192.168.128.0 network192.168.128.0 255.255.255.0# allow connections from any host# between 10.0.0.0 to 10.0.15.255# this includes the machines in the testlab10.0.0.0255.255.240.0
basie# vipw[在末尾加入 -bill， 并退出]vipw: rebuilding the database...vipw: donebasie# cat /etc/master.passwdroot:[password]:0:0::0:0:The super-user:/root:/bin/cshtoor:[password]:0:0::0:0:The other super-user:/root:/bin/shdaemon:*:1:1::0:0:Owner of many system processes:/root:/sbin/nologinoperator:*:2:5::0:0:System &:/:/sbin/nologinbin:*:3:7::0:0:Binaries Commands and Source,,,:/:/sbin/nologintty:*:4:65533::0:0:Tty Sandbox:/:/sbin/nologinkmem:*:5:65533::0:0:KMem Sandbox:/:/sbin/nologingames:*:7:13::0:0:Games pseudo-user:/usr/games:/sbin/nologinnews:*:8:8::0:0:News Subsystem:/:/sbin/nologinman:*:9:9::0:0:Mister Man Pages:/usr/share/man:/sbin/nologinbind:*:53:53::0:0:Bind Sandbox:/:/sbin/nologinuucp:*:66:66::0:0:UUCP pseudo-user:/var/spool/uucppublic:/usr/libexec/uucp/uucicoxten:*:67:67::0:0:X-10 daemon:/usr/local/xten:/sbin/nologinpop:*:68:6::0:0:Post Office Owner:/nonexistent:/sbin/nologinnobody:*:65534:65534::0:0:Unprivileged user:/nonexistent:/sbin/nologin+:::::::::-billbasie#
ellington# vi /var/yp/netgroup
IT_EMP  (,alpha,test-domain)(,beta,test-domain)IT_APP  (,charlie,test-domain)  (,delta,test-domain)USERS   (,echo,test-domain) (,foxtrott,test-domain) \(,golf,test-domain)INTERNS (,able,test-domain) (,baker,test-domain)
BIGGRP1  (,joe1,domain)  (,joe2,domain)  (,joe3,domain) [...]BIGGRP2  (,joe16,domain)  (,joe17,domain) [...]BIGGRP3  (,joe31,domain)  (,joe32,domain)BIGGROUP  BIGGRP1 BIGGRP2 BIGGRP3
ellington# cd /var/ypellington# make
ellington% ypcat -k netgroupellington% ypcat -k netgroup.byhostellington% ypcat -k netgroup.byuser
+:::::::::
+@IT_EMP:::::::::
+@IT_EMP:::::::::+@IT_APP:::::::::+:::::::::/sbin/nologin
+@IT_EMP:::::::::+@USERS:::::::::+:::::::::/sbin/nologin
BIGSRVIT_EMP  IT_APPSMALLSRV  IT_EMP  IT_APP  ITINTERNUSERBOX   IT_EMP  ITINTERN USERS
+@BOXNAME:::::::::+:::::::::/sbin/nologin
# Define groups of users firstIT_EMP(,alpha,test-domain)(,beta,test-domain)IT_APP(,charlie,test-domain)  (,delta,test-domain)DEPT1 (,echo,test-domain) (,foxtrott,test-domain)DEPT2 (,golf,test-domain) (,hotel,test-domain)DEPT3 (,india,test-domain)(,juliet,test-domain)ITINTERN  (,kilo,test-domain) (,lima,test-domain)D_INTERNS (,able,test-domain) (,baker,test-domain)## Now, define some groups based on rolesUSERS DEPT1   DEPT2 DEPT3BIGSRVIT_EMP  IT_APPSMALLSRV  IT_EMP  IT_APPITINTERNUSERBOX   IT_EMP  ITINTERN  USERS## And a groups for a special tasks# Allow echo and golf to access our anti-virus-machineSECURITY  IT_EMP  (,echo,test-domain)  (,golf,test-domain)## machine-based netgroups# Our main serversWAR BIGSRVFAMINEBIGSRV# User india needs access to this serverPOLLUTION  BIGSRV  (,india,test-domain)## This one is really important and needs more access restrictionsDEATH IT_EMP## The anti-virus-machine mentioned aboveONE SECURITY## Restrict a machine to a single userTWO (,hotel,test-domain)# [...more groups to follow]
# pw useradd jsmith# cd /var/yp# make test-domain
nis_client_enable="YES"	# run client stuff as wellnis_client_flags="-S NIS domain,server"
default:\	:passwd_format=des:\	:copyright=/etc/COPYRIGHT:\	[Further entries elided]
# cap_mkdb /etc/login.conf
crypt_default	=	des blf md5
ifconfig_fxp0="DHCP"
dhclient_program="/sbin/dhclient"dhclient_flags=""
option domain-name "example.com";option domain-name-servers 192.168.4.100;option subnet-mask 255.255.255.0;default-lease-time 3600;max-lease-time 86400;ddns-update-style none;subnet 192.168.4.0 netmask 255.255.255.0 {  range 192.168.4.129 192.168.4.254;  option routers 192.168.4.1;}host mailhost {  hardware ethernet 02:03:04:05:06:07;  fixed-address mailhost.example.com;}
dhcpd_enable="YES"dhcpd_ifaces="dc0"
# /usr/local/etc/rc.d/isc-dhcpd start
# /etc/rc.d/named onestart
named_enable="YES"
// $FreeBSD$//// Refer to the named.conf(5) and named(8) man pages, and the documentation// in /usr/share/doc/bind9 for more details.//// If you are going to set up an authoritative server, make sure you// understand the hairy details of how DNS works.  Even with// simple mistakes, you can break connectivity for affected parties,// or cause huge amounts of useless Internet traffic.options {	// Relative to the chroot directory, if any	directory	"/etc/namedb";	pid-file	"/var/run/named/pid";	dump-file	"/var/dump/named_dump.db";	statistics-file	"/var/stats/named.stats";// If named is being used only as a local resolver, this is a safe default.// For named to be accessible to the network, comment this option, specify// the proper IP address, or delete this option.	listen-on	{ 127.0.0.1; };// If you have IPv6 enabled on this system, uncomment this option for// use as a local resolver.  To give access to the network, specify// an IPv6 address, or the keyword "any".//	listen-on-v6	{ ::1; };// These zones are already covered by the empty zones listed below.// If you remove the related empty zones below, comment these lines out.	disable-empty-zone "255.255.255.255.IN-ADDR.ARPA";	disable-empty-zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";	disable-empty-zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.IP6.ARPA";// If you've got a DNS server around at your upstream provider, enter// its IP address here, and enable the line below.  This will make you// benefit from its cache, thus reduce overall DNS traffic in the Internet./*	forwarders {		127.0.0.1;	};*/// If the 'forwarders' clause is not empty the default is to 'forward first'// which will fall back to sending a query from your local server if the name// servers in 'forwarders' do not have the answer.  Alternatively you can// force your name server to never initiate queries of its own by enabling the// following line://	forward only;// If you wish to have forwarding configured automatically based on// the entries in /etc/resolv.conf, uncomment the following line and// set named_auto_forward=yes in /etc/rc.conf.  You can also enable// named_auto_forward_only (the effect of which is described above).//	include "/etc/namedb/auto_forward.conf";
	/* Modern versions of BIND use a random UDP port for each outgoing query by default in order to dramatically reduce the possibility of cache poisoning.  All users are strongly encouraged to utilize this feature, and to configure their firewalls to accommodate it. AS A LAST RESORT in order to get around a restrictive firewall policy you can try enabling the option below.  Use of this option will significantly reduce your ability to withstand cache poisoning attacks, and should be avoided if at all possible. Replace NNNNN in the example with a number between 49160 and 65530.	*/	// query-source address * port NNNNN;};// If you enable a local name server, don't forget to enter 127.0.0.1// first in your /etc/resolv.conf so this server will be queried.// Also, make sure to enable it in /etc/rc.conf.// The traditional root hints mechanism. Use this, OR the slave zones below.zone "." { type hint; file "named.root"; };/*	Slaving the following zones from the root name servers has some	significant advantages:	1. Faster local resolution for your users	2. No spurious traffic will be sent from your network to the roots	3. Greater resilience to any potential root server failure/DDoS	On the other hand, this method requires more monitoring than the	hints file to be sure that an unexpected failure mode has not	incapacitated your server.  Name servers that are serving a lot	of clients will benefit more from this approach than individual	hosts.  Use with caution.	To use this mechanism, uncomment the entries below, and comment	the hint zone above.*//*zone "." {	type slave;	file "slave/root.slave";	masters {		192.5.5.241;	// F.ROOT-SERVERS.NET.	};	notify no;};zone "arpa" {	type slave;	file "slave/arpa.slave";	masters {		192.5.5.241;	// F.ROOT-SERVERS.NET.	};	notify no;};zone "in-addr.arpa" {	type slave;	file "slave/in-addr.arpa.slave";	masters {		192.5.5.241;	// F.ROOT-SERVERS.NET.	};	notify no;};*//*	Serving the following zones locally will prevent any queries	for these zones leaving your network and going to the root	name servers.  This has two significant advantages:	1. Faster local resolution for your users	2. No spurious traffic will be sent from your network to the roots*/// RFC 1912zone "localhost"	{ type master; file "master/localhost-forward.db"; };zone "127.in-addr.arpa" { type master; file "master/localhost-reverse.db"; };zone "255.in-addr.arpa"	{ type master; file "master/empty.db"; };// RFC 1912-style zone for IPv6 localhost addresszone "0.ip6.arpa"	{ type master; file "master/localhost-reverse.db"; };// "This" Network (RFCs 1912 and 3330)zone "0.in-addr.arpa"		{ type master; file "master/empty.db"; };// Private Use Networks (RFC 1918)zone "10.in-addr.arpa"		{ type master; file "master/empty.db"; };zone "16.172.in-addr.arpa"	{ type master; file "master/empty.db"; };zone "17.172.in-addr.arpa"	{ type master; file "master/empty.db"; };zone "18.172.in-addr.arpa"	{ type master; file "master/empty.db"; };zone "19.172.in-addr.arpa"	{ type master; file "master/empty.db"; };zone "20.172.in-addr.arpa"	{ type master; file "master/empty.db"; };zone "21.172.in-addr.arpa"	{ type master; file "master/empty.db"; };zone "22.172.in-addr.arpa"	{ type master; file "master/empty.db"; };zone "23.172.in-addr.arpa"	{ type master; file "master/empty.db"; };zone "24.172.in-addr.arpa"	{ type master; file "master/empty.db"; };zone "25.172.in-addr.arpa"	{ type master; file "master/empty.db"; };zone "26.172.in-addr.arpa"	{ type master; file "master/empty.db"; };zone "27.172.in-addr.arpa"	{ type master; file "master/empty.db"; };zone "28.172.in-addr.arpa"	{ type master; file "master/empty.db"; };zone "29.172.in-addr.arpa"	{ type master; file "master/empty.db"; };zone "30.172.in-addr.arpa"	{ type master; file "master/empty.db"; };zone "31.172.in-addr.arpa"	{ type master; file "master/empty.db"; };zone "168.192.in-addr.arpa"	{ type master; file "master/empty.db"; };// Link-local/APIPA (RFCs 3330 and 3927)zone "254.169.in-addr.arpa"	{ type master; file "master/empty.db"; };// TEST-NET for Documentation (RFC 3330)zone "2.0.192.in-addr.arpa"	{ type master; file "master/empty.db"; };// Router Benchmark Testing (RFC 3330)zone "18.198.in-addr.arpa"	{ type master; file "master/empty.db"; };zone "19.198.in-addr.arpa"	{ type master; file "master/empty.db"; };// IANA Reserved - Old Class E Spacezone "240.in-addr.arpa"		{ type master; file "master/empty.db"; };zone "241.in-addr.arpa"		{ type master; file "master/empty.db"; };zone "242.in-addr.arpa"		{ type master; file "master/empty.db"; };zone "243.in-addr.arpa"		{ type master; file "master/empty.db"; };zone "244.in-addr.arpa"		{ type master; file "master/empty.db"; };zone "245.in-addr.arpa"		{ type master; file "master/empty.db"; };zone "246.in-addr.arpa"		{ type master; file "master/empty.db"; };zone "247.in-addr.arpa"		{ type master; file "master/empty.db"; };zone "248.in-addr.arpa"		{ type master; file "master/empty.db"; };zone "249.in-addr.arpa"		{ type master; file "master/empty.db"; };zone "250.in-addr.arpa"		{ type master; file "master/empty.db"; };zone "251.in-addr.arpa"		{ type master; file "master/empty.db"; };zone "252.in-addr.arpa"		{ type master; file "master/empty.db"; };zone "253.in-addr.arpa"		{ type master; file "master/empty.db"; };zone "254.in-addr.arpa"		{ type master; file "master/empty.db"; };// IPv6 Unassigned Addresses (RFC 4291)zone "1.ip6.arpa"		{ type master; file "master/empty.db"; };zone "3.ip6.arpa"		{ type master; file "master/empty.db"; };zone "4.ip6.arpa"		{ type master; file "master/empty.db"; };zone "5.ip6.arpa"		{ type master; file "master/empty.db"; };zone "6.ip6.arpa"		{ type master; file "master/empty.db"; };zone "7.ip6.arpa"		{ type master; file "master/empty.db"; };zone "8.ip6.arpa"		{ type master; file "master/empty.db"; };zone "9.ip6.arpa"		{ type master; file "master/empty.db"; };zone "a.ip6.arpa"		{ type master; file "master/empty.db"; };zone "b.ip6.arpa"		{ type master; file "master/empty.db"; };zone "c.ip6.arpa"		{ type master; file "master/empty.db"; };zone "d.ip6.arpa"		{ type master; file "master/empty.db"; };zone "e.ip6.arpa"		{ type master; file "master/empty.db"; };zone "0.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "1.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "2.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "3.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "4.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "5.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "6.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "7.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "8.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "9.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "a.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "b.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "0.e.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "1.e.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "2.e.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "3.e.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "4.e.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "5.e.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "6.e.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "7.e.f.ip6.arpa"		{ type master; file "master/empty.db"; };// IPv6 ULA (RFC 4193)zone "c.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "d.f.ip6.arpa"		{ type master; file "master/empty.db"; };// IPv6 Link Local (RFC 4291)zone "8.e.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "9.e.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "a.e.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "b.e.f.ip6.arpa"		{ type master; file "master/empty.db"; };// IPv6 Deprecated Site-Local Addresses (RFC 3879)zone "c.e.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "d.e.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "e.e.f.ip6.arpa"		{ type master; file "master/empty.db"; };zone "f.e.f.ip6.arpa"		{ type master; file "master/empty.db"; };// IP6.INT is Deprecated (RFC 4159)zone "ip6.int"			{ type master; file "master/empty.db"; };// NB: Do not use the IP addresses below, they are faked, and only// serve demonstration/documentation purposes!//// Example slave zone config entries.  It can be convenient to become// a slave at least for the zone your own domain is in.  Ask// your network administrator for the IP address of the responsible// master name server.//// Do not forget to include the reverse lookup zone!// This is named after the first bytes of the IP address, in reverse// order, with ".IN-ADDR.ARPA" appended, or ".IP6.ARPA" for IPv6.//// Before starting to set up a master zone, make sure you fully// understand how DNS and BIND work.  There are sometimes// non-obvious pitfalls.  Setting up a slave zone is usually simpler.//// NB: Don't blindly enable the examples below. :-)  Use actual names// and addresses instead./* An example dynamic zonekey "exampleorgkey" {	algorithm hmac-md5;	secret "sf87HJqjkqh8ac87a02lla==";};zone "example.org" {	type master;	allow-update {		key "exampleorgkey";	};	file "dynamic/example.org";};*//* Example of a slave reverse zonezone "1.168.192.in-addr.arpa" {	type slave;	file "slave/1.168.192.in-addr.arpa";	masters {		192.168.1.1;	};};*/
zone "example.org" {	type master;	file "master/example.org";};
zone "example.org" {	type slave;	file "slave/example.org";};
$TTL 3600; 1 hour default TTLexample.org.INSOAns1.example.org. admin.example.org. (2006051501; Serial10800   ; Refresh3600; Retry604800  ; Expire300 ; Negative Reponse TTL); DNS ServersINNSns1.example.org.INNSns2.example.org.; MX RecordsINMX 10   mx.example.org.INMX 20   mail.example.org.INA 192.168.1.1; Machine Nameslocalhost INA 127.0.0.1ns1 INA 192.168.1.2ns2 INA 192.168.1.3mxINA 192.168.1.4mailINA 192.168.1.5; Aliaseswww INCNAME   example.org.
记录名  IN 记录类型 值
example.org. IN SOA ns1.example.org. admin.example.org. (2006051501; Serial10800   ; Refresh after 3 hours3600; Retry after 1 hour604800  ; Expire after 1 week300 )   ; Negative Reponse TTL
 IN NS   ns1.example.org.
localhost INA 127.0.0.1ns1 INA 192.168.1.2ns2 INA 192.168.1.3mxINA 192.168.1.4mailINA 192.168.1.5
INA 192.168.1.1
www IN CNAME@
 IN MX   10mail.example.org.
$TTL 36001.168.192.in-addr.arpa. IN SOA ns1.example.org. admin.example.org. (2006051501; Serial10800   ; Refresh3600; Retry604800  ; Expire300 )   ; Negative Reponse TTLINNSns1.example.org.INNSns2.example.org.1 INPTR example.org.2 INPTR ns1.example.org.3 INPTR ns2.example.org.4 INPTR mx.example.org.5 INPTR mail.example.org.
# /usr/local/sbin/apachectl start
# /usr/local/sbin/apachectl stop
# /usr/local/sbin/apachectl restart
# /usr/local/sbin/apachectl graceful
apache_enable="YES"
apache22_enable="YES"
apache_flags=""
NameVirtualHost *
<VirtualHost *>ServerName www.domain.tldDocumentRoot /www/domain.tld</VirtualHost><VirtualHost *>ServerName www.someotherdomain.tldDocumentRoot /www/someotherdomain.tld</VirtualHost>
# cd /usr/ports/www/py-django; make all install clean -DWITH_MOD_PYTHON3 -DWITH_POSTGRESQL
<Location "/">SetHandler python-programPythonPath "['/dir/to/your/django/packages/'] + sys.path"PythonHandler django.core.handlers.modpythonSetEnv DJANGO_SETTINGS_MODULE mysite.settingsPythonAutoReload OnPythonDebug On</Location>
# cd /usr/ports/www/rubygem-rails; make all install clean
# make config
LoadModule php5_modulelibexec/apache/libphp5.so
AddModule mod_php5.c<IfModule mod_php5.c>DirectoryIndex index.php index.html</IfModule><IfModule mod_php5.c>AddType application/x-httpd-php .phpAddType application/x-httpd-php-source .phps</IfModule>
# apachectl graceful
# apachectl graceful
ftp	stream	tcp	nowait	root	/usr/libexec/ftpd	ftpd -l
ftpd_enable="YES"
# /etc/rc.d/ftpd start
% ftp localhost
ftp.info/var/log/xferlog
swat   stream  tcp nowait/400root/usr/local/sbin/swatswat
# smbpasswd -a username
# pdbedit -a -u username
samba_enable="YES"
nmbd_enable="YES"
smbd_enable="YES"
# /usr/local/etc/rc.d/samba startStarting SAMBA: removing stale tdbs :Starting nmbd.Starting smbd.
# /usr/local/etc/rc.d/samba stop
server ntplocal.example.com preferserver timeserver.example.orgserver ntp2a.example.netdriftfile /var/db/ntp.drift
restrict default ignore
restrict 192.168.1.0 mask 255.255.255.0 nomodify notrap
# ntpd -p /var/run/ntpd.pid
 set filter dial 0 deny udp src eq 123 # Prevent NTP traffic from initiating dial out set filter dial 1 permit 0 0 set filter alive 0 deny udp src eq 123 # Prevent incoming NTP traffic from keeping the connection open set filter alive 1 deny udp dst eq 123 # Prevent outgoing NTP traffic from keeping the connection open set filter alive 2 permit 0/0 0/0
+logclient.example.com*.* /var/log/logclient.log
syslogd_enable="YES"syslogd_flags="-a logclient.example.com -v -v"
# touch /var/log/logclient.log
# /etc/rc.d/syslogd restart# pgrep syslog
syslogd_enable="YES"syslogd_flags="-s -v -v"
*.*		@logserv.example.com
# /etc/rc.d/syslogd restart
# logger "Test message from logclient"
syslogd_flags="-d -a logclien.example.com -v -v"
# /etc/rc.d/syslogd restart
logmsg: pri 56, flags 4, from logserv.example.com, msg syslogd: restartsyslogd: restartedlogmsg: pri 6, flags 4, from logserv.example.com, msg syslogd: kernel boot file is /boot/kernel/kernelLogging to FILE /var/log/messagessyslogd: kernel boot file is /boot/kernel/kernelcvthname(192.168.1.10)validate: dgram from IP 192.168.1.10, port 514, name logclient.example.com;rejected in rule 0 due to name mismatch.
syslogd_flags="-d -a logclien.example.com -v -v"
# /etc/rc.d/syslogd restartlogmsg: pri 56, flags 4, from logserv.example.com, msg syslogd: restartsyslogd: restartedlogmsg: pri 6, flags 4, from logserv.example.com, msg syslogd: kernel boot file is /boot/kernel/kernelsyslogd: kernel boot file is /boot/kernel/kernellogmsg: pri 166, flags 17, from logserv.example.com,msg Dec 10 20:55:02 <syslog.err> logserv.example.com syslogd: exiting on signal 2cvthname(192.168.1.10)validate: dgram from IP 192.168.1.10, port 514, name logclient.example.com;accepted in rule 0.logmsg: pri 15, flags 0, from logclient.example.com, msg Dec 11 02:01:28 trhodes: Test message 2Logging to FILE /var/log/logclient.logLogging to FILE /var/log/messages

协议	说明
tcp， tcp4	TCP IPv4
udp， udp4	UDP IPv4
tcp6	TCP IPv6
udp6	UDP IPv6
tcp46	Both TCP IPv4 and v6
udp46	Both UDP IPv4 and v6

术语	说明
NIS 域名	NIS 主服务器和所有其客户机 (包括从服务器) 会使用同一 NIS 域名。和 Windows NT® 域名类似， NIS 域名与 DNS 无关。
rpcbind	必须运行这个程序，才能够启用 RPC (远程过程调用， NIS 用到的一种网络协议)。如果没有运行 rpcbind，则没有办法运行 NIS 服务器，或作为 NIS 客户机。
ypbind	“绑定(bind)” NIS 客户机到它的 NIS 服务器上。这样，它将从系统中获取 NIS 域名，并使用 RPC 连接到服务器上。 ypbind 是 NIS 环境中，客户机-服务器通讯的核心；如果客户机上的 ypbind 死掉的话，它将无法访问 NIS 服务器。
ypserv	只应在 NIS 服务器上运行它；这是 NIS 的服务器进程。如果 ypserv(8) 死掉的话，则服务器将不再具有响应 NIS 请求的能力 (此时，如果有从服务器的话，则会接管操作)。有一些 NIS 的实现 (但不是 FreeBSD 的这个) 的客户机上，如果之前用过一个服务器，而那台服务器死掉的话，并不尝试重新连接到另一个服务器。通常，发生这种情况时，唯一的办法就是重新启动服务器进程 (或者，甚至重新启动服务器) 或客户机上的 ypbind 进程。
rpc.yppasswdd	另一个只应在 NIS 主服务器上运行的进程；这是一个服务程序，其作用是允许 NIS 客户机改变它们的 NIS 口令。如果没有运行这个服务，用户将必须登录到 NIS 主服务器上，并在那里修改口令。

机器名	IP 地址	机器的角色
`ellington`	`10.0.0.2`	NIS 主服务器
`coltrane`	`10.0.0.3`	NIS 从服务器
`basie`	`10.0.0.4`	教员工作站
`bird`	`10.0.0.5`	客户机
`cli[1-11]`	`10.0.0.[6-17]`	其他客户机

用户名	说明
`alpha`, `beta`	IT 部门的普通雇员
`charlie`, `delta`	IT 部门的学徒
`echo`, `foxtrott`, `golf`, ...	普通雇员
`able`, `baker`, ...	目前的实习生

机器名	说明
`war`, `death`,`famine`,`pollution`	最重要的服务器。只有 IT部门的雇员才允许登录这些机器。
`pride`, `greed`,`envy`, `wrath`,`lust`, `sloth`	不太重要的服务器，所有 IT 部门的成员，都可以登录这些机器。
`one`, `two`,`three`, `four`,...	普通工作站。只有真正的雇员才允许登录这些机器。
`trashcan`	一台不包含关键数据的旧机器。即使是实习生，也允许登录它。

服务	描述
nfsd	NFS，为来自NFS客户端的请求服务。
mountd	NFS挂载服务，处理nfsd(8)递交过来的请求。
rpcbind	此服务允许 NFS 客户程序查询正在被 NFS 服务使用的端口。

	这个选项指定了提供给客户机作为默认搜索域的域名。请参考 resolv.conf(5) 以了解关于这一概念的详情。
	这个选项用于指定一组客户机使用的 DNS 服务器，它们之间以逗号分隔。
	提供给客户机的子网掩码。
	客户机可以请求租约的有效期，而如果没有，则服务器将指定一个租约有效期，也就是这个值 (单位是秒)。
	这是服务器允许租出地址的最大时长。如果客户机请求了更长的租期，则它将得到一个地址，但其租期仅限于 `max-lease-time` 秒。
	这个选项用于指定 DHCP 服务器在一个地址被接受或释放时是否应对应尝试更新 DNS。在 ISC 实现中，这一选项是必须指定的。
	指定地址池中可以用来分配给客户机的 IP 地址范围。在这个范围之间，以及其边界的 IP 地址将分配给客户机。
	定义客户机的默认网关。
	主机的硬件 MAC 地址 (这样 DHCP 服务器就能够在接到请求时知道请求的主机身份)。
	指定总是得到同一 IP 地址的主机。请注意在此处使用主机名是对的，因为 DHCP 服务器会在返回租借地址信息之前自行解析主机名。

术语	定义
正向 DNS	将域名映射到 IP 地址
原点 (Origin)	表示特定域文件所在的域
named, BIND	在 FreeBSD 中 BIND 域名服务器软件包的常见叫法。
解析器 (Resolver)	计算机用以向域名服务器查询域名信息的一个系统进程
反向 DNS	将 IP 地址映射为主机名
根域	Internet 域层次的起点。所有的域都在根域之下，类似文件系统中，文件都在根目录之下那样。
域 (Zone)	独立的域，子域，或者由同一机构管理的 DNS 的一部分。

文件	描述
named(8)	BIND 服务程序
rndc(8)	域名服务控制程序
`/etc/namedb`	BIND 存放域名信息的位置。
`/etc/namedb/named.conf`	域名服务配置文件

第 30 章 网络服务器

30.1. 概要

30.2. inetd “超级服务器”

30.2.1. 总览

30.2.2. 设置

30.2.3. 命令行选项

30.2.4. inetd.conf

30.2.5. Security

30.2.6. 杂项

30.3. 网络文件系统（NFS）

30.3.1. NFS是如何工作的

30.3.2. 配置NFS

30.3.3. 锁

30.3.4. 实际应用

30.3.5. 通过 amd 自动地挂接

30.3.6. 与其他系统集成时的常见问题

30.4. 网络信息服务 (NIS/YP)

30.4.1. 它是什么？

30.4.2. 您应该知道的术语和进程

30.4.3. 它是如何工作的？

30.4.3.1. 机器类型

注意:

30.4.4. 使用 NIS/YP

30.4.4.1. 规划

30.4.4.1.1. 选择 NIS 域名

30.4.4.1.2. 服务器的物理要求

30.4.4.2. NIS 服务器

30.4.4.2.1. 配置 NIS 主服务器

注意:

30.4.4.2.2. 初始化 NIS 映射

注意:

30.4.4.2.3. 配置 NIS 从服务器

30.4.4.3. NIS 客户机

30.4.4.3.1. 设置 NIS 客户机

注意:

注意:

30.4.5. NIS 的安全性

注意:

注意:

30.4.6. 不允许某些用户登录

30.4.7. 使用 Netgroups

注意:

警告:

30.4.8. 需要牢记的事项

30.4.9. NIS v1 兼容性

30.4.10. 同时作为 NIS 客户机的 NIS 服务器

30.4.11. 口令格式

注意:

30.5. 网络自动配置 (DHCP)

30.5.1. 什么是 DHCP？

30.5.2. 这一节都介绍哪些内容

30.5.3. 它如何工作

30.5.4. FreeBSD 集成

注意:

注意:

30.5.5. 文件

30.5.6. 进阶读物

30.5.7. 安装和配置 DHCP 服务器

30.5.7.1. 这一章包含哪些内容

30.5.7.2. 安装 DHCP 服务器

注意:

30.5.7.3. 配置 DHCP 服务器

30.5.7.4. 文件

30.6. 域名系统 (DNS)

30.6.1. 纵览

30.6.2. 术语

30.6.3. 运行域名服务器的理由

30.6.4. DNS 如何运作

30.6.5. 启动 BIND

30.6.6. 配置文件

30.6.6.1. /etc/namedb/named.conf

警告:

30.6.6.2. 域文件

30.6.7. 缓存域名服务器

30.6.8. 安全

提示:

30.6.9. 进一步阅读

30.7. Apache HTTP 服务器

30.7.1. 纵览

注意:

第 30 章网络服务器

30.2.4. `inetd.conf`

30.6.6.1. `/etc/namedb/named.conf`

30.11. 使用 `syslogd` 记录远程主机的日志