FreeBSDの導入

導入CDの作成

ftp://ftp.freebsd.org/pub/FreeBSD/releases/amd64/amd64/ISO-IMAGES/12.1/

仮想環境では、isoイメージをそのままマウントして導入をします。

導入作業

導入メディアでの起動

キーボードの選択

ホスト名の設定

インストールするコンポーネントの設定

ディスクスライス(区画)の設定

インストール後の作業

root パスワードの設定

ネットワークインタフェースの設定

CMOS Clockの設定

タイムゾーンの設定

サービスの設定

システムセキュリティー強化項目

ユーザーの追加

FreeBSD - ユーザ管理 - ユーザ追加（adduser）

13.3. アカウント情報の管理

インストーラーの終了

PowerD の設定

powerd_enable="YES"
powerd_flags="-a adaptive -n adaptive"

追加したユーザーのroot昇格を許可

wheel:*:0:root,追加ユーザー

リブート

# exit

sshの準備

hostsへの追加

.ssh ディレクトリーの圧縮

% tar cvf ssh.tar .ssh

転送

% scp ユーザー@旧ホスト:ssh.tar ./ssh.tar

展開

% tar xvf ssh.tar

セキュリティー強化

% diff -u sshd_config.org_2020-05-12 sshd_config
--- sshd_config.org_2020-05-12  2019-11-01 13:28:52.000000000 +0900
+++ sshd_config 2020-05-12 06:15:31.004268000 +0900
@@ -33,7 +33,7 @@
 # Authentication:

 #LoginGraceTime 2m
-#PermitRootLogin no
+PermitRootLogin no　　　　　　　　　　　<=== rootでのログインの禁止
 #StrictModes yes
 #MaxAuthTries 6
 #MaxSessions 10
@@ -58,11 +58,11 @@
 #IgnoreRhosts yes

 # Change to yes to enable built-in password authentication.
-#PasswordAuthentication no
+PasswordAuthentication no　　　　　　　 <=== パスワード認証の禁止
 #PermitEmptyPasswords no

 # Change to no to disable PAM authentication
-#ChallengeResponseAuthentication yes
+ChallengeResponseAuthentication no　　　<=== パスワード認証の禁止

 # Kerberos options
 #KerberosAuthentication no

コンソールログの記録

FreeBSD コンソールのログをファイルへ記録する方法

OSの最新化＆アプリ導入準備

System Updateの実行

System Update

アップデートの取得

# freebsd-update fetch

アップデートの適用

# freebsd-update install
# shutdown -r now

アプリ更新の準備

pkg

# pkg info pkg
The package management tool is not yet installed on your system.
Do you want to fetch and install it now? [y/N]: y
Bootstrapping pkg from pkg+http://pkg.FreeBSD.org/FreeBSD:12:amd64/quarterly, please wait...
Verifying signature with trusted certificate pkg.freebsd.org.2013102301... done
Installing pkg-1.13.2...
Extracting pkg-1.13.2: 100%
pkg-1.13.2
Name           : pkg
Version        : 1.13.2
Installed on   : Fri May  8 13:25:59 2020 JST
Origin         : ports-mgmt/pkg
Architecture   : FreeBSD:12:amd64
Prefix         : /usr/local
Categories     : ports-mgmt
Licenses       : BSD2CLAUSE
Maintainer     : pkg@FreeBSD.org
WWW            : https://wiki.freebsd.org/pkgng
Comment        : Package manager
Options        :
        DOCS           : on
Shared Libs provided:
        libpkg.so.4
Annotations    :
        FreeBSD_version: 1201000
Flat size      : 26.1MiB
Description    :
Package management tool

WWW: https://wiki.freebsd.org/pkgng
# pkg version -v
pkg-1.13.2                         >   succeeds port (port has 1.12.0)
# pkg update

ports & portupgrade

portupgrade の導入

# pkg search portupgrade
portupgrade-2.4.16,2           FreeBSD ports/packages administration and management tool suite
portupgrade-devel-20180309,3   FreeBSD ports/packages management tool (devel version)
# pkg install portupgrade-2.4.16,2
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.
Updating database digests format: 100%
The following 9 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
        db5: 5.3.28_7
        indexinfo: 0.3.1
        libedit: 3.1.20191211,1
        libffi: 3.2.1_3
        libunwind: 20170615
        libyaml: 0.2.2
        portupgrade: 2.4.16,2
        ruby: 2.6.5,1
        ruby26-bdb: 0.6.6_7

Number of packages to be installed: 9

The process will require 91 MiB more space.
20 MiB to be downloaded.

Proceed with this action? [y/N]: y
  ～～～ 途中省略 ～～～ 
Message from ruby-2.6.5,1:

--
Some of the standard commands are provided as separate ports for ease
of upgrading:

        devel/ruby-gems:        gem - RubyGems package manager
        devel/rubygem-irb:      irb - Interactive Ruby
        devel/rubygem-rake:     rake - Ruby Make
        devel/rubygem-rdoc:     rdoc - Ruby Documentation System

And some of the standard libraries are provided as separate ports
since they require extra dependencies:

        databases/rubygem-dbm:  DBM module
        databases/rubygem-gdbm: GDBM module

Install them as occasion demands.

ports collectionの更新

# portsnap fetch
Looking up portsnap.FreeBSD.org mirrors... 6 mirrors found.
Fetching public key from ec2-ap-northeast-1.portsnap.freebsd.org... done.
Fetching snapshot tag from ec2-ap-northeast-1.portsnap.freebsd.org... done.
Fetching snapshot metadata... done.
Fetching snapshot generated at Fri May  8 09:10:04 JST 2020:
  ～～～ 途中省略 ～～～ 
Extracting snapshot... done.
Verifying snapshot integrity... done.
Fetching snapshot tag from ec2-ap-northeast-1.portsnap.freebsd.org... done.
Fetching snapshot metadata... done.
Updating from Fri May  8 09:10:04 JST 2020 to Fri May  8 12:57:52 JST 2020.
Fetching 5 metadata patches... done.
Applying metadata patches... done.
Fetching 0 metadata files... done.
Fetching 12 patches.
(12/12) 100.00%  done.
done.
Applying patches...
done.
Fetching 2 new ports or files... done.
# portsnap extract　　　<=== 初回のみ必要
/usr/ports/.arcconfig
/usr/ports/.gitattributes
  ～～～ 途中省略 ～～～ 
/usr/ports/x11/zenity/
Building new INDEX files... done.
# portsnap update
Ports tree is already up to date.
# portsdb -Uu　　　<=== サーバーごと落ちる
Updating the ports index ... Generating INDEX20200508-72776-1pfzpda - please wait..--- describe.accessibility ---
--- describe.arabic ---

# pkgdb -F　　　<=== pkg check に変わった
# pkg check -d -a
Checking all packages: 100%

# pkg install pkg_tree
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.
The following 2 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
        perl5: 5.30.2
        pkg_tree: 1.1_4

Number of packages to be installed: 2

The process will require 58 MiB more space.
14 MiB to be downloaded.

Proceed with this action? [y/N]: y
　　～～～ 途中省略 ～～～
Message from pkg_tree-1.1_4:

--
===>   NOTICE:

The pkg_tree port currently does not have a maintainer. As a result, it is
more likely to have unresolved issues, not be up-to-date, or even be removed in
the future. To volunteer to maintain this port, please create an issue at:

https://bugs.freebsd.org/bugzilla

More information about port maintainership is available at:

https://www.freebsd.org/doc/en/articles/contributing/ports-contributing.html#maintain-port

メールの基本設定

認証ライブラリーの導入とsendmailでの利用

cyrus-sasl-2 導入

# pkg search cyrus-sasl
cyrus-sasl-2.1.27_1            RFC 2222 SASL (Simple Authentication and Security Layer)
cyrus-sasl-gssapi-2.1.27_1     SASL GSSAPI authentication plugin
cyrus-sasl-ldapdb-2.1.27       SASL LDAPDB auxprop plugin
cyrus-sasl-saslauthd-2.1.27_1  SASL authentication server for cyrus-sasl2
cyrus-sasl-sql-2.1.27          SASL SQL plugins
cyrus-sasl-srp-2.1.27          SASL SRP authentication plugin
linux-c7-cyrus-sasl-lib-2.1.26_4 RFC 2222 SASL (Simple Authentication and Security Layer) (Linux CentOS 7.7.1908)
# pkg install cyrus-sasl-2.1.27_1
[1/1] Fetching cyrus-sasl-2.1.27_1.txz: 100%  959 KiB 982.1kB/s    00:01
Checking integrity... done (0 conflicting)
[1/1] Installing cyrus-sasl-2.1.27_1...
*** Added group `cyrus' (id 60)
*** Added user `cyrus' (id 60)
[1/1] Extracting cyrus-sasl-2.1.27_1: 100%
=====
Message from cyrus-sasl-2.1.27_1:

--
You can use sasldb2 for authentication, to add users use:

        saslpasswd2 -c username

If you want to enable SMTP AUTH with the system Sendmail, read
Sendmail.README

NOTE: This port has been compiled with a default pwcheck_method of
      auxprop.  If you want to authenticate your user by /etc/passwd,
      PAM or LDAP, install ports/security/cyrus-sasl2-saslauthd and
      set sasl_pwcheck_method to saslauthd after installing the
      Cyrus-IMAPd 2.X port.  You should also check the
      /usr/local/lib/sasl2/*.conf files for the correct
      pwcheck_method.
      If you want to use GSSAPI mechanism, install
      ports/security/cyrus-sasl2-gssapi.
      If you want to use SRP mechanism, install
      ports/security/cyrus-sasl2-srp.
      If you want to use LDAP auxprop plugin, install
      ports/security/cyrus-sasl2-ldapdb.

/etc/rc.confへの設定追加

# cat >> /etc/rc.conf
sendmail_enable="YES"
saslauthd_enable="YES"
inetd_enable="YES"

認証方法の指定追加

# cat >> /usr/local/lib/sasl2/Sendmail.conf
pwcheck_method: passwd

sendmail がcyrus-sasl2を使うように

# cat >> /etc/make.conf
SENDMAIL_CFLAGS=-I/usr/local/include/sasl -DSASL
SENDMAIL_LDFLAGS=-L/usr/local/lib
SENDMAIL_LDADD=-lsasl2

ライブラリーのコンパイル

# cd /usr/src/lib/libsm
# make obj depend all
[Creating objdir /usr/obj/usr/src/amd64.amd64/lib/libsm...]
ln -sf /usr/src/contrib/sendmail/include/sm/os/sm_os_freebsd.h sm_os.h
　　～～～ 途中省略 ～～～
building static sm library
ar -crD libsm.a `NM='nm' NMFLAGS=''  lorder assert.o debug.o errstring.o exc.o heap.o match.o rpool.o strdup.o strerror.o strl.o clrerr.o fclose.o feof.o ferror.o fflush.o fget.o fpos.o findfp.o flags.o fopen.o fprintf.o fpurge.o fput.o fread.o fscanf.o fseek.o fvwrite.o fwalk.o fwrite.o get.o makebuf.o put.o refill.o rewind.o setvbuf.o smstdio.o snprintf.o sscanf.o stdio.o strio.o ungetc.o vasprintf.o vfprintf.o vfscanf.o vprintf.o vsnprintf.o wbuf.o wsetup.o string.o stringf.o xtrap.o strto.o test.o strcasecmp.o strrevcmp.o signal.o clock.o config.o sem.o shm.o mbdb.o strexit.o cf.o ldap.o niprop.o mpeix.o memstat.o util.o inet6_ntop.o  | tsort -q`
ranlib -D libsm.a

# cd /usr/src/lib/libsmutil
# make obj depend all
[Creating objdir /usr/obj/usr/src/amd64.amd64/lib/libsmutil...]
ln -sf /usr/src/contrib/sendmail/include/sm/os/sm_os_freebsd.h sm_os.h
　　～～～ 途中省略 ～～～
ar -crD libsmutil.a `NM='nm' NMFLAGS=''  lorder debug.o err.o lockfile.o safefile.o snprintf.o cf.o  | tsort -q`
ranlib -D libsmutil.a

# cd /usr/src/usr.sbin/sendmail
# make cleandir obj
[Creating objdir /usr/obj/usr/src/amd64.amd64/usr.sbin/sendmail...]
　　～～～ 途中省略 ～～～
rm -f .depend .depend.* GPATH GRTAGS GSYMS GTAGS
# make
objcopy --only-keep-debug sendmail.full sendmail.debug
objcopy --strip-debug --add-gnu-debuglink=sendmail.debug  sendmail.full sendmail
ln -sf /usr/src/contrib/sendmail/include/sm/os/sm_os_freebsd.h sm_os.h
echo sendmail.full: /usr/lib/libc.a  /usr/lib/libutil.a /usr/obj/usr/src/amd64.amd64/lib/libsm/libsm.a /usr/obj/usr/src/amd64.amd64/lib/libsmutil/libsmutil.a /usr/lib/libssl.a /usr/lib/libcrypto.a /usr/lib/libwrap.a >> .depend
　　～～～ 途中省略 ～～～
gzip -cn /usr/src/contrib/sendmail/src/mailq.1 > mailq.1.gz
gzip -cn /usr/src/contrib/sendmail/src/newaliases.1 > newaliases.1.gz
gzip -cn /usr/src/contrib/sendmail/src/aliases.5 > aliases.5.gz
gzip -cn /usr/src/contrib/sendmail/src/sendmail.8 > sendmail.8.gz
# make install
install  -s -o root -g smmsp -m 2555   sendmail /usr/libexec/sendmail/sendmail
install  -d /usr/lib/debug/usr/libexec/sendmail/
install  -o root -g smmsp -m 444  sendmail.debug /usr/lib/debug/usr/libexec/sendmail/sendmail.debug
install  -o root -g wheel -m 444 mailq.1.gz  /usr/share/man/man1/
install  -o root -g wheel -m 444 newaliases.1.gz  /usr/share/man/man1/
install  -o root -g wheel -m 444 aliases.5.gz  /usr/share/man/man5/
install  -o root -g wheel -m 444 sendmail.8.gz  /usr/share/man/man8/
rm -f /usr/share/man/man8/hoststat.8 /usr/share/man/man8/hoststat.8.gz;  install -l h -o root -g wheel -m 444  /usr/share/man/man8/sendmail.8.gz /usr/share/man/man8/hoststat.8.gz
rm -f /usr/share/man/man8/purgestat.8 /usr/share/man/man8/purgestat.8.gz;  install -l h -o root -g wheel -m 444  /usr/share/man/man8/sendmail.8.gz /usr/share/man/man8/purgestat.8.gz
#

sendmailの基本設定

.mcの編集

テンプレートの作成

# cd /etc/mail
# make
cp -f freebsd.mc jp024914_dev.takanome.mine.nu.mc
/usr/bin/m4 -D_CF_DIR_=/usr/share/sendmail/cf/   /usr/share/sendmail/cf/m4/cf.m4 jp024914_dev.takanome.mine.nu.mc > jp024914_dev.takanome.mine.nu.cf
cp -f freebsd.submit.mc jp024914_dev.takanome.mine.nu.submit.mc
/usr/bin/m4 -D_CF_DIR_=/usr/share/sendmail/cf/   /usr/share/sendmail/cf/m4/cf.m4 jp024914_dev.takanome.mine.nu.submit.mc > jp024914_dev.takanome.mine.nu.submit.cf

<host名>.mcの編集

# diff -u local_host.takanome.mine.nu.mc.org_2020-05-09 local_host.takanome.mine.nu.mc
--- local_host.takanome.mine.nu.mc.org_2020-05-10 2020-05-10 04:25:41.895346000 +0900
+++ local_host.takanome.mine.nu.mc        2020-05-10 08:16:12.432033000 +0900
@@ -42,6 +42,7 @@
 #  /usr/share/sendmail/cf/README or
 #  /usr/src/contrib/sendmail/cf/README
 #
+#
 #  NOTE: If you enable RunAsUser, make sure that you adjust the permissions
 #  and owner of the SSL certificates and keys in /etc/mail/certs to be usable
 #  by that user.
@@ -52,6 +53,9 @@
 OSTYPE(freebsd6)
 DOMAIN(generic)

+Dwlocal_host　　　　　　<== 今回追加
+Dmtakanome.mine.nu　　　<== 今回追加
+
 FEATURE(access_db, `hash -o -T<TMPF> /etc/mail/access')
 FEATURE(blacklist_recipients)
 FEATURE(local_lmtp)
@@ -88,6 +92,9 @@
 dnl Dialup users should uncomment and define this appropriately
 dnl define(`SMART_HOST', `your.isp.mail.server')

+define(`SMART_HOST', `smtp.nifty.com.')dnl
+dnl define(`ESMTP_MAILER_ARGS', `TCP $h 587')dnl
+
 dnl Uncomment the first line to change the location of the default
 dnl /etc/mail/local-host-names and comment out the second line.
 dnl define(`confCW_FILE', `-o /etc/mail/sendmail.cw')
@@ -99,6 +106,27 @@

 define(`confBIND_OPTS', `WorkAroundBrokenAAAA')
 define(`confNO_RCPT_ACTION', `add-to-undisclosed')
-define(`confPRIVACY_FLAGS', `authwarnings,noexpn,novrfy')
+dnl define(`confPRIVACY_FLAGS', `authwarnings,noexpn,novrfy')
+define(`confPRIVACY_FLAGS', `goaway')dnl
+define(`confTRUSTED_USERS', `mailman')dnl
+define(`confOPERATORS', `.:@!^/[]+')dnl
+
+define(`ALIAS_FILE',`/etc/mail/aliases,/usr/local/etc/mail/aliases')dnl
+
+MASQUERADE_AS(`$m')dnl
+FEATURE(`always_add_domain')dnl
+FEATURE(`masquerade_envelope')dnl
+FEATURE(`masquerade_entire_domain')dnl
+FEATURE(`allmasquerade')dnl
+
+FEATURE(`authinfo', `hash /etc/mail/relay-auth')dnl
+
+dnl set SASL options
+TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN ANONYMOUS')dnl
+dnl TRUST_AUTH_MECH(`ANONYMOUS')dnl
+define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN ANONYMOUS')dnl
+dnl define(`confAUTH_MECHANISMS', `ANONYMOUS')dnl
+define(`_REC_AUTH_' `_REC_FULL_AUTH_')dnl
+
 MAILER(local)
 MAILER(smtp)

access

# cp access.sample access
# cat >> access
localhost       RELAY
127.0.0.1       RELAY
10.50   RELAY

aliases

# diff -u aliases.org_2020-05-09 aliases
--- aliases.org_2020-05-09      2019-11-01 13:32:27.000000000 +0900
+++ aliases     2020-05-09 13:01:21.732252000 +0900
@@ -21,7 +21,7 @@

 # Basic system aliases -- these MUST be present
 MAILER-DAEMON: postmaster
-postmaster: root
+postmaster: root, n_yone@apost.plala.or.jp

 # General redirections for pseudo accounts
 _dhcp: root
@@ -66,9 +66,9 @@
 # SUPPORT MAILBOX NAMES FOR SPECIFIC INTERNET SERVICES
 ftp:           root
 ftp-bugs:      ftp
-# hostmaster:  root
-# webmaster:   root
-# www:                 webmaster
+hostmaster:    root, 管理者@外部ドメイン 
+webmaster:     root
+www:           webmaster

 # NOTE: /var/msgs and /var/msgs/bounds must be owned by sendmail's
 #      DefaultUser (defaults to mailnull) for the msgs alias to work.
@@ -77,3 +77,11 @@

 # bit-bucket: /dev/null
 # dev-null: bit-bucket
+
+ユーザー別名: ローカル_ユーザー, 管理者@外部ドメイン 
+
+mailman:       ローカル_ユーザー
+投稿アドレス:      ローカル_ユーザー
+

# cat >> ~/.forward
ローカル_管理者

sendmail.cfへの反映

ローカルホスト

# make
/usr/bin/m4 -D_CF_DIR_=/usr/share/sendmail/cf/   /usr/share/sendmail/cf/m4/cf.m4 ローカルホスト.takanome.mine.nu.mc > ローカルホスト.takanome.mine.nu.cf
/usr/bin/m4 -D_CF_DIR_=/usr/share/sendmail/cf/   /usr/share/sendmail/cf/m4/cf.m4 ローカルホスト.takanome.mine.nu.submit.mc > ローカルホスト.takanome.mine.nu.submit.cf
/usr/sbin/makemap hash access.db < access
chmod 0640 access.db
/usr/sbin/sendmail -bi -OAliasFile=/etc/mail/aliases
/etc/mail/aliases: 37 aliases, longest 35 bytes, 497 bytes total
chmod 0640 /etc/mail/aliases.db
# make install
install -m 444 ローカルホスト.takanome.mine.nu.cf /etc/mail/sendmail.cf
install -m 444 ローカルホスト.takanome.mine.nu.submit.cf /etc/mail/submit.cf
# mkdir /usr/local/etc/mail
# ln -s /etc/mail/aliases.db /usr/local/etc/mail/aliases.db

local-host-names

# cat local-host-names
ローカルホスト.takanome.mine.nu　　　　<=== FQDN
takanome.mine.nu　　　　　<=== Domain

プロバイダーに提示するユーザー情報の指定

AuthInfo:your.host.name "U:name" "I:name@your.host.name" "P:password"

# makemap hash relay-auth < relay-auth
# chmod 600 relay-auth.db relay-auth

認証データベースを作る

# saslpasswd2 [-u ドメイン] -c ローカルユーザー名
Password: パスワード
Again (for verification): パスワード

# sasldblistusers2
ローカルユーザー名@ドメイン: userPassword

# saslpasswd2 [-u ドメイン] ローカルユーザー名
Password: パスワード
Again (for verification): パスワード

# saslpasswd2 [-u ドメイン] -d ローカルユーザー名

SSL 関連

# cd /etc/mail
# mv certs certs.org
# mkdir -m 755 certs
# cd ..
# tar xvf ~localadmin/mail_certs.tar
x mail/certs/cacert.pem
x mail/certs/dh.param
x mail/certs/host.cert
x mail/certs/host.key

endmail設定(3)Submissionポート（サブミッション・ポート）＆ SMTP-AUTH(認証)＆ STARTTLSを使ってみる

sendmail の version 8.13 で TLS を使用して SMTP を実行するためのサポート

再起動

# shutdown -r now

動作確認

Mail送信テスト

# mail -s サブジェクト アドレス

送信者	宛先	ポイント
Local	host無し一般ユーザー	送信者DOMAIN付きでローカル配送されているか
Local	host無しroot	.forwardが効いているか
Local	host無し一般Alias	aliasesが効いているか
Local	FQDN一般ユーザー	送信者DOMAIN付きでローカル配送されているか FQDN指定でも配送されるか
Local	DOMAIN一般ユーザー	送信者DOMAIN付きでローカル配送されているか DOMAIN指定でも配送されるか
Local	外部DOMAINユーザー	外部配送がリレーサーバーに送られているか

Mail受信テスト

送信者	宛先	ポイント
外部	DOMAIN一般ユーザー
外部	DOMAIN Aliasユーザー

qpopperの導入

インストール

# pkg update
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.
# pkg search qpopper
qpopper-4.1.0_6                Berkeley POP 3 server (now maintained by Qualcomm)
# pkg install qpopper
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
        qpopper: 4.1.0_6

Number of packages to be installed: 1

79 KiB to be downloaded.

Proceed with this action? [y/N]: y
[1/1] Fetching qpopper-4.1.0_6.txz: 100%   79 KiB  81.1kB/s    00:01
Checking integrity... done (0 conflicting)
[1/1] Installing qpopper-4.1.0_6...
===> Creating groups.
Using existing group 'daemon'.
===> Creating users
Using existing user 'pop'.
[1/1] Extracting qpopper-4.1.0_6: 100%
=====
Message from qpopper-4.1.0_6:

--
To enable the qpopper-daemon, add the following line to your /etc/inetd.conf:

   pop3 stream tcp nowait root /usr/local/libexec/qpopper qpopper -s
--
===>   NOTICE:

The qpopper port currently does not have a maintainer. As a result, it is
more likely to have unresolved issues, not be up-to-date, or even be removed in
the future. To volunteer to maintain this port, please create an issue at:

https://bugs.freebsd.org/bugzilla

More information about port maintainership is available at:

https://www.freebsd.org/doc/en/articles/contributing/ports-contributing.html#maintain-port

inetd.confの修正

# cd /etc
# cp -p inetd.conf inetd.conf.org_2020-05-11
# vi inetd.conf
# diff -u /etc/inetd.conf.org_2020-05-11 /etc/inetd.conf
@@ -74,6 +74,7 @@
 # example entry for the optional pop3 server
 #
 #pop3  stream  tcp     nowait  root    /usr/local/libexec/popper       popper
+pop3   stream  tcp     nowait  root    /usr/local/libexec/qpopper      qpopper -s
 #
 # example entry for the optional imap4 server
 #

inetd起動設定

# cat >> /etc/rc.conf
inetd_enable="YES"
# /etc/rc.d/inetd start
Starting inetd.

inetd再起動

# ps -ax | grep inetd
5397  -  Is      0:00.00 /usr/sbin/inetd -wW -C 60
5415  0  R+      0:00.00 grep inetd
# kill -1 5397

環境の移行とバックアップ

これはこのサイト特別の事情です。

維持管理環境の複製

本番環境のDiskコピー

Disk管理関連

ZFS外部Diskの引き継ぎ

Oracle Solaris ZFS 管理ガイド

ZFS ストレージプールをインポートする

ZFSの有効化

# cat >> /etc/rc.conf
zfs_enable="YES"

プールの確認

# zpool import
   pool: zpool0
     id: 245675149710498882
  state: ONLINE
 status: The pool was last accessed by another system.
 action: The pool can be imported using its name or numeric identifier and
        the '-f' flag.
   see: http://illumos.org/msg/ZFS-8000-EY
 config:

        zpool0      ONLINE
          ada1s1    ONLINE

ZFS ストレージプールをインポートする

# zpool import -f zpool0

インポート後の確認

# zpool history　　<=== poolに対する操作の記録が表示される
History for 'zpool0':
2015-06-21.16:41:13 zpool create zpool0 ada1s1
2015-06-21.17:15:15 zfs create -o mountpoint=/usb_hd zpool0/usb_hd
2020-05-12.10:58:58 zpool import -f zpool0
# mount　　<=== mountpointも復元されている
/dev/ada0s1a on / (ufs, local, journaled soft-updates)
devfs on /dev (devfs, local, multilabel)
zpool0/usb_hd on /usb_hd (zfs, local, nfsv4acls)
zpool0 on /zpool0 (zfs, local, nfsv4acls)

外部Diskのバックアップ

# fdisk -I /dev/da0　　ディスク全体を1つのスライスにする
# zpool create zpool_bk da0s1　　作成したスライスに zpool_bk というプールを作成
# zfs create -o mountpoint=/usb_hd_bk zpool_bk/usb_hd_bk　　/usb_hd_bk にマウントする
# zpool export zpool_bk　　プールと作成したDiskを取り外しできるようにする

# zpool import　　受入マシンで、import可能なプールを確認する
# zpool import zpool_bk　　プールをimportすると、同時にマウントされる

# cd /usb_hd　　初期バックアップ
# tar cvf - . | (cd ../usb_hd_bk ; tar xvf -)　　tarコマンドで属性等も一括してコピー

S.M.A.R.T.ツールの導入

smartmontools によるハードディスクの自己診断機能

導入と設定

smartmontools によるハードディスクの自己診断機能

# pkg install smartmontools
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
        smartmontools: 7.1

Number of packages to be installed: 1

The process will require 2 MiB more space.
443 KiB to be downloaded.

Proceed with this action? [y/N]: y
[1/1] Fetching smartmontools-7.1.txz: 100%  443 KiB 454.0kB/s    00:01
Checking integrity... done (0 conflicting)
[1/1] Installing smartmontools-7.1...
[1/1] Extracting smartmontools-7.1: 100%
=====
Message from smartmontools-7.1:

--
smartmontools has been installed

To check the status of drives, use the following:

        /usr/local/sbin/smartctl -a /dev/ad0    for first ATA/SATA drive
        /usr/local/sbin/smartctl -a /dev/da0    for first SCSI drive
        /usr/local/sbin/smartctl -a /dev/ada0   for first SATA drive

To include drive health information in your daily status reports,
add a line like the following to /etc/periodic.conf:
        daily_status_smart_devices="/dev/ad0 /dev/da0"
substituting the appropriate device names for your SMART-capable disks.

To enable drive monitoring, you can use /usr/local/sbin/smartd.
A sample configuration file has been installed as
/usr/local/etc/smartd.conf.sample
Copy this file to /usr/local/etc/smartd.conf and edit appropriately

To have smartd start at boot
        echo 'smartd_enable="YES"' >> /etc/rc.conf
# echo '# smartd_enable="YES"' >> /etc/rc.conf
# cd /usr/local/etc/
# cp smartd.conf.sample smartd.conf
# diff -u smartd.conf.sample smartd.conf
--- smartd.conf.sample  2020-04-24 15:12:49.000000000 +0900
+++ smartd.conf 2020-05-12 11:38:15.696356000 +0900
@@ -20,7 +20,7 @@
 # Directives listed below, which will be applied to all devices that
 # are found.  Most users should comment out DEVICESCAN and explicitly
 # list the devices that they wish to monitor.
-DEVICESCAN
+#DEVICESCAN

 # Alternative setting to ignore temperature and power-on hours reports
 # in syslog.

smartctl 確認

# smartctl --scan
/dev/ada0 -d atacam # /dev/ada0, ATA device
/dev/ada1 -d atacam # /dev/ada1, ATA device
/dev/cd0 -d atacam # /dev/cd0, ATA device
# smartctl -a /dev/ada0
smartctl 7.1 2019-12-30 r5022 [FreeBSD 12.1-RELEASE-p3 amd64] (local build)
Copyright (C) 2002-19, Bruce Allen, Christian Franke, www.smartmontools.org

=== START OF INFORMATION SECTION ===
Device Model:     HGST HTS545032A7E681  FDE
Serial Number:    TM84D3482H623M
LU WWN Device Id: 5 000cca 733e3175a
Firmware Version: GGBLBE10
User Capacity:    320,072,933,376 bytes [320 GB]
Sector Sizes:     512 bytes logical, 4096 bytes physical
Rotation Rate:    5400 rpm
Form Factor:      2.5 inches
Device is:        Not in smartctl database [for details use: -P showall]
ATA Version is:   ATA8-ACS T13/1699-D revision 6
SATA Version is:  SATA 2.6, 6.0 Gb/s (current: 3.0 Gb/s)
Local Time is:    Tue May 12 12:33:10 2020 JST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

=== START OF READ SMART DATA SECTION ===
SMART overall-health self-assessment test result: PASSED

General SMART Values:
Offline data collection status:  (0x00) Offline data collection activity
                                        was never started.
                                        Auto Offline Data Collection: Disabled.
Self-test execution status:      (   0) The previous self-test routine completed
                                        without error or no self-test has ever
                                        been run.
Total time to complete Offline
data collection:                (   45) seconds.
Offline data collection
capabilities:                    (0x5b) SMART execute Offline immediate.
                                        Auto Offline data collection on/off support.
                                        Suspend Offline collection upon new
                                        command.
                                        Offline surface scan supported.
                                        Self-test supported.
                                        No Conveyance Self-test supported.
                                        Selective Self-test supported.
SMART capabilities:            (0x0003) Saves SMART data before entering
                                        power-saving mode.
                                        Supports SMART auto save timer.
Error logging capability:        (0x01) Error logging supported.
                                        General Purpose Logging supported.
Short self-test routine
recommended polling time:        (   2) minutes.
Extended self-test routine
recommended polling time:        (  90) minutes.
SCT capabilities:              (0x003d) SCT Status supported.
                                        SCT Error Recovery Control supported.
                                        SCT Feature Control supported.
                                        SCT Data Table supported.

SMART Attributes Data Structure revision number: 16
Vendor Specific SMART Attributes with Thresholds:
ID# ATTRIBUTE_NAME          FLAG     VALUE WORST THRESH TYPE      UPDATED  WHEN_FAILED RAW_VALUE
  1 Raw_Read_Error_Rate     0x000b   100   100   062    Pre-fail  Always       -       0
  2 Throughput_Performance  0x0005   100   100   040    Pre-fail  Offline      -       0
  3 Spin_Up_Time            0x0007   215   215   033    Pre-fail  Always       -       1
  4 Start_Stop_Count        0x0012   100   100   000    Old_age   Always       -       11
  5 Reallocated_Sector_Ct   0x0033   100   100   005    Pre-fail  Always       -       0
  7 Seek_Error_Rate         0x000b   100   100   067    Pre-fail  Always       -       0
  8 Seek_Time_Performance   0x0005   100   100   040    Pre-fail  Offline      -       0
  9 Power_On_Hours          0x0012   100   100   000    Old_age   Always       -       47
 10 Spin_Retry_Count        0x0013   100   100   060    Pre-fail  Always       -       0
 12 Power_Cycle_Count       0x0032   100   100   000    Old_age   Always       -       11
191 G-Sense_Error_Rate      0x000a   100   100   000    Old_age   Always       -       0
192 Power-Off_Retract_Count 0x0032   100   100   000    Old_age   Always       -       1
193 Load_Cycle_Count        0x0012   100   100   000    Old_age   Always       -       5142
194 Temperature_Celsius     0x0002   193   193   000    Old_age   Always       -       31 (Min/Max 21/38)
196 Reallocated_Event_Count 0x0032   100   100   000    Old_age   Always       -       0
197 Current_Pending_Sector  0x0022   100   100   000    Old_age   Always       -       0
198 Offline_Uncorrectable   0x0008   100   100   000    Old_age   Offline      -       0
199 UDMA_CRC_Error_Count    0x000a   200   200   000    Old_age   Always       -       0
223 Load_Retry_Count        0x000a   100   100   000    Old_age   Always       -       0

SMART Error Log Version: 1
No Errors Logged

SMART Self-test log structure revision number 1
Num  Test_Description    Status                  Remaining  LifeTime(hours)  LBA_of_first_error
# 1  Extended offline    Completed without error       00%         1         -

SMART Selective self-test log data structure revision number 1
 SPAN  MIN_LBA  MAX_LBA  CURRENT_TEST_STATUS
    1        0        0  Not_testing
    2        0        0  Not_testing
    3        0        0  Not_testing
    4        0        0  Not_testing
    5        0        0  Not_testing
Selective self-test flags (0x0):
  After scanning selected spans, do NOT read-scan remainder of disk.
If Selective self-test is pending on power-up, resume after 0 minute delay.

アプリ導入

Apacheの導入

パッケージインストール

# pkg search apache
～～ 省略 ～～ 
apache24-2.4.43                Version 2.4.x of Apache web server
～～ 省略 ～～ 
# pkg install apache24
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.
The following 9 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
        apache24: 2.4.43
        apr: 1.7.0.1.6.1_1
        expat: 2.2.8
        gdbm: 1.18.1_1
        gettext-runtime: 0.20.1
        libnghttp2: 1.40.0
        libxml2: 2.9.10
        pcre: 8.43_2
        readline: 8.0.4

Number of packages to be installed: 9

The process will require 46 MiB more space.
8 MiB to be downloaded.

Proceed with this action? [y/N]: y
[1/9] Fetching apache24-2.4.43.txz: 100%    5 MiB 744.9kB/s    00:07
[2/9] Fetching libnghttp2-1.40.0.txz: 100%  116 KiB 118.5kB/s    00:01
[3/9] Fetching libxml2-2.9.10.txz: 100%  827 KiB 847.3kB/s    00:01
[4/9] Fetching expat-2.2.8.txz: 100%  125 KiB 127.6kB/s    00:01
[5/9] Fetching pcre-8.43_2.txz: 100%    1 MiB   1.3MB/s    00:01
[6/9] Fetching apr-1.7.0.1.6.1_1.txz: 100%  469 KiB 479.8kB/s    00:01
[7/9] Fetching gdbm-1.18.1_1.txz: 100%  163 KiB 166.6kB/s    00:01
[8/9] Fetching readline-8.0.4.txz: 100%  354 KiB 362.7kB/s    00:01
[9/9] Fetching gettext-runtime-0.20.1.txz: 100%  158 KiB 161.8kB/s    00:01
Checking integrity... done (0 conflicting)
[1/9] Installing readline-8.0.4...
[1/9] Extracting readline-8.0.4: 100%
[2/9] Installing gettext-runtime-0.20.1...
[2/9] Extracting gettext-runtime-0.20.1: 100%
[3/9] Installing expat-2.2.8...
[3/9] Extracting expat-2.2.8: 100%
[4/9] Installing gdbm-1.18.1_1...
[4/9] Extracting gdbm-1.18.1_1: 100%
[5/9] Installing libnghttp2-1.40.0...
[5/9] Extracting libnghttp2-1.40.0: 100%
[6/9] Installing libxml2-2.9.10...
[6/9] Extracting libxml2-2.9.10: 100%
[7/9] Installing pcre-8.43_2...
[7/9] Extracting pcre-8.43_2: 100%
[8/9] Installing apr-1.7.0.1.6.1_1...
[8/9] Extracting apr-1.7.0.1.6.1_1: 100%
[9/9] Installing apache24-2.4.43...
===> Creating groups.
Using existing group 'www'.
===> Creating users
Using existing user 'www'.
[9/9] Extracting apache24-2.4.43: 100%
=====
Message from apr-1.7.0.1.6.1_1:

--
The Apache Portable Runtime project removed support for FreeTDS with
version 1.6. Users requiring MS-SQL connectivity must migrate
configurations to use the added ODBC driver and FreeTDS' ODBC features.
=====
Message from apache24-2.4.43:

--
To run apache www server from startup, add apache24_enable="yes"
in your /etc/rc.conf. Extra options can be found in startup script.

Your hostname must be resolvable using at least 1 mechanism in
/etc/nsswitch.conf typically DNS or /etc/hosts or apache might
have issues starting depending on the modules you are using.


- apache24 default build changed from static MPM to modular MPM
- more modules are now enabled per default in the port
- icons and error pages moved from WWWDIR to DATADIR

   If build with modular MPM and no MPM is activated in
   httpd.conf, then mpm_prefork will be activated as default
   MPM in etc/apache24/modules.d to keep compatibility with
   existing php/perl/python modules!

Please compare the existing httpd.conf with httpd.conf.sample
and merge missing modules/instructions into httpd.conf!

基本設定

rc.conf の設定

# cat >> /etc/rc.conf
apache24_enable="YES"
apache24ssl_enable="YES"

httpd.conf の修正

# diff -u httpd.conf.org_2020-05-12 httpd.conf
--- httpd.conf.org_2020-05-12   2020-04-23 19:11:19.000000000 +0900
+++ httpd.conf  2020-05-12 16:18:28.458621000 +0900
@@ -83,13 +83,13 @@
 LoadModule access_compat_module libexec/apache24/mod_access_compat.so
 LoadModule auth_basic_module libexec/apache24/mod_auth_basic.so
 #LoadModule auth_form_module libexec/apache24/mod_auth_form.so
-#LoadModule auth_digest_module libexec/apache24/mod_auth_digest.so
+LoadModule auth_digest_module libexec/apache24/mod_auth_digest.so
 #LoadModule allowmethods_module libexec/apache24/mod_allowmethods.so
 #LoadModule file_cache_module libexec/apache24/mod_file_cache.so
 #LoadModule cache_module libexec/apache24/mod_cache.so
 #LoadModule cache_disk_module libexec/apache24/mod_cache_disk.so
 #LoadModule cache_socache_module libexec/apache24/mod_cache_socache.so
-#LoadModule socache_shmcb_module libexec/apache24/mod_socache_shmcb.so
+LoadModule socache_shmcb_module libexec/apache24/mod_socache_shmcb.so     <== 
 #LoadModule socache_dbm_module libexec/apache24/mod_socache_dbm.so
 #LoadModule socache_memcache_module libexec/apache24/mod_socache_memcache.so
 #LoadModule watchdog_module libexec/apache24/mod_watchdog.so
@@ -145,7 +145,7 @@
 #LoadModule session_dbd_module libexec/apache24/mod_session_dbd.so
 #LoadModule slotmem_shm_module libexec/apache24/mod_slotmem_shm.so
 #LoadModule slotmem_plain_module libexec/apache24/mod_slotmem_plain.so
-#LoadModule ssl_module libexec/apache24/mod_ssl.so
+LoadModule ssl_module libexec/apache24/mod_ssl.so                         <== SSL
 #LoadModule dialup_module libexec/apache24/mod_dialup.so
 #LoadModule http2_module libexec/apache24/mod_http2.so
 #LoadModule proxy_http2_module libexec/apache24/mod_proxy_http2.so
@@ -162,15 +162,15 @@
 #LoadModule asis_module libexec/apache24/mod_asis.so
 #LoadModule info_module libexec/apache24/mod_info.so
 
-       #LoadModule cgid_module libexec/apache24/mod_cgid.so
+       LoadModule cgid_module libexec/apache24/mod_cgid.so                          <== CGI
 
 
-       #LoadModule cgi_module libexec/apache24/mod_cgi.so
+       LoadModule cgi_module libexec/apache24/mod_cgi.so                          <== CGI
 
 #LoadModule dav_fs_module libexec/apache24/mod_dav_fs.so
 #LoadModule dav_lock_module libexec/apache24/mod_dav_lock.so
-#LoadModule vhost_alias_module libexec/apache24/mod_vhost_alias.so
-#LoadModule negotiation_module libexec/apache24/mod_negotiation.so
+LoadModule vhost_alias_module libexec/apache24/mod_vhost_alias.so          <== ?
+LoadModule negotiation_module libexec/apache24/mod_negotiation.so          <== Manualで必要
 LoadModule dir_module libexec/apache24/mod_dir.so
 #LoadModule imagemap_module libexec/apache24/mod_imagemap.so
 #LoadModule actions_module libexec/apache24/mod_actions.so
@@ -213,7 +213,8 @@
 # e-mailed.  This address appears on some server-generated pages, such
 # as error documents.  e.g. admin@your-domain.com
 #
-ServerAdmin you@example.com
+#ServerAdmin you@example.com
+ServerAdmin webmaster@takanome.mine.nu                                 <== 必要なら

 #
 # ServerName gives the name and port that the server uses to identify itself.
@@ -508,7 +509,7 @@
 #Include etc/apache24/extra/httpd-vhosts.conf

 # Local access to the Apache HTTP Server Manual
-#Include etc/apache24/extra/httpd-manual.conf
+Include etc/apache24/extra/httpd-manual.conf                                 <== 必要なら

 # Distributed authoring and versioning (WebDAV)
 #Include etc/apache24/extra/httpd-dav.conf
@@ -522,7 +523,7 @@
 

 # Secure (SSL/TLS) connections
-#Include etc/apache24/extra/httpd-ssl.conf
+Include etc/apache24/extra/httpd-ssl.conf                                    <== SSL
 #
 # Note: The following must must be present to support
 #       starting without SSL on platforms with no /dev/random equivalent

SSL設定

サーバー証明書のコピー

/usr/local/openssl/certs/server/server-cert.pem        <=== サーバー証明書
/usr/local/openssl/certs/server/server-keynp.pem       <=== サーバー秘密鍵
/usr/local/openssl/demoCA/cacert.pem                   <=== 認証局証明書(クライアント証明書の確認用)

Apache SNIで、1IP上の複数サイトでSSL証明書を利用する

Apacheでマルチドメイン証明書で複数のSSLサイトを構成する

httpd-ssl.conf

# diff -u httpd-ssl.conf.org_2020-05-13 httpd-ssl.conf
--- httpd-ssl.conf.org_2020-05-13       2020-04-23 19:11:19.000000000 +0900
+++ httpd-ssl.conf      2020-05-13 03:31:00.439695000 +0900
@@ -121,9 +121,10 @@
 

 #   General setup for the virtual host
-DocumentRoot "/usr/local/www/apache24/data"
-ServerName www.example.com:443
-ServerAdmin you@example.com
+#DocumentRoot "/usr/local/www/apache24/data"
+ServerName takanome.mine.nu:443
+ServerAdmin webmaster@takanome.mine.nu
 ErrorLog "/var/log/httpd-error.log"
 TransferLog "/var/log/httpd-access.log"

@@ -141,7 +142,8 @@
 #   Some ECC cipher suites (http://www.ietf.org/rfc/rfc4492.txt)
 #   require an ECC certificate which can also be configured in
 #   parallel.
-SSLCertificateFile "/usr/local/etc/apache24/server.crt"
+#SSLCertificateFile "/usr/local/etc/apache24/server.crt"
+SSLCertificateFile "/usr/local/openssl/certs/server/server-cert.pem"
 #SSLCertificateFile "/usr/local/etc/apache24/server-dsa.crt"
 #SSLCertificateFile "/usr/local/etc/apache24/server-ecc.crt"

@@ -151,7 +153,8 @@
 #   you've both a RSA and a DSA private key you can configure
 #   both in parallel (to also allow the use of DSA ciphers, etc.)
 #   ECC keys, when in use, can also be configured in parallel
-SSLCertificateKeyFile "/usr/local/etc/apache24/server.key"
+#SSLCertificateKeyFile "/usr/local/etc/apache24/server.key"
+SSLCertificateKeyFile "/usr/local/openssl/certs/server/server-keynp.pem"
 #SSLCertificateKeyFile "/usr/local/etc/apache24/server-dsa.key"
 #SSLCertificateKeyFile "/usr/local/etc/apache24/server-ecc.key"

@@ -173,6 +176,8 @@
 #         Makefile to update the hash symlinks after changes.
 #SSLCACertificatePath "/usr/local/etc/apache24/ssl.crt"
 #SSLCACertificateFile "/usr/local/etc/apache24/ssl.crt/ca-bundle.crt"
+SSLCACertificatePath "/usr/local/openssl/demoCA"
+SSLCACertificateFile "/usr/local/openssl/demoCA/cacert.pem"

 #   Certificate Revocation Lists (CRL):
 #   Set the CA revocation path where to find CA CRLs for client
@@ -194,6 +199,8 @@
 #   issuer chain before deciding the certificate is not valid.
 #SSLVerifyClient require
 #SSLVerifyDepth  10
+SSLVerifyClient none
+SSLVerifyDepth  10

 #   TLS-SRP mutual authentication:
 #   Enable TLS-SRP and set the path to the OpenSSL SRP verifier
@@ -251,6 +258,22 @@
 
 
     SSLOptions +StdEnvVars
+
+
+#SSLInsecureRenegotiation on
+
+Alias /private /usr/local/www/apache24/data_private/
+
+
+    SSLRequireSSL
+#    SSLVerifyClient require
+#    SSLRequire %{SSL_CLIENT_VERIFY} eq "SUCCESS"
+#    SSLOptions  +StrictRequire +OptRenegotiate
+
+    Options Indexes FollowSymLinks
+    Require all granted
+    DirectoryIndex index.htm index.html
+
 

 #   SSL Protocol Adjustments:

ユーザー認証の設定

パスワードファイルの準備

# htpasswd -c "/usr/local/etc/apache24/user.basic" takanome
New password: パスワード
Re-type new password: パスワード(再入力)
Adding password for user takanome

# root@jp024914c:/usr/local/etc/apache24 # cp -p /tmp/etc/apache24/user.basic .

サイトでの認証設定

コンテンツディレクトリーの移動

# cd /usr/local/www
# mv apache24 apache24.org_2020-05-13
# ln -s /usb_hd/backups/www/apache24/ apache24
# ls -l
total 4
lrwxr-xr-x  1 root  wheel   29 May 13 05:13 apache24 -> /usb_hd/backups/www/apache22/
drwxr-xr-x  6 root  wheel  512 May 12 13:46 apache24.org_2020-05-13

Apache 再起動と確認

# /usr/local/etc/rc.d/apache24 stop
apache24 not running? (check /var/run/httpd.pid).　　　　　　　<=== 開始していないため
# /usr/local/etc/rc.d/apache24 start
Performing sanity check on apache24 configuration:
Syntax OK
Starting apache24.

Mailman

GNU Mailman

パッケージの導入

# pkg search mailman
ja-mailman-2.1.14.j7_6,1       Japanized mailman which is a mailing list manager with a web front-end
mailman-2.1.30_4               Mailing list manager with user-friendly web front-end
# pkg install ja-mailman
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.
The following 2 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
        ja-mailman: 2.1.14.j7_6,1
        python27: 2.7.18

Number of packages to be installed: 2

The process will require 101 MiB more space.
14 MiB to be downloaded.

Proceed with this action? [y/N]: y
[1/2] Fetching ja-mailman-2.1.14.j7_6,1.txz: 100%    3 MiB   3.6MB/s    00:01
[2/2] Fetching python27-2.7.18.txz: 100%   11 MiB   1.9MB/s    00:06
Checking integrity... done (0 conflicting)
[1/2] Installing python27-2.7.18...
[1/2] Extracting python27-2.7.18: 100%
[2/2] Installing ja-mailman-2.1.14.j7_6,1...
===> Creating groups.
Creating group 'mailman' with gid '91'.
===> Creating users
Creating user 'mailman' with uid '91'.
[2/2] Extracting ja-mailman-2.1.14.j7_6,1: 100%
---> Starting post-install script
---> Running update
Upgrading from version 0x0 to 0x2010ef0
getting rid of old source files
no lists == nothing to do, exiting
---> Checking crontab(5) file for user "mailman"
---> Creating crontab(5) file for user "mailman"
---> Checking (and fixing) file and directory permissions
=====
Message from python27-2.7.18:

--
Note that some standard Python modules are provided as separate ports
as they require additional dependencies. They are available as:

bsddb           databases/py-bsddb
gdbm            databases/py-gdbm
sqlite3         databases/py-sqlite3
tkinter         x11-toolkits/py-tkinter
--
===>   NOTICE:

This port is deprecated; you may wish to reconsider installing it:

EOLed upstream.

It is scheduled to be removed on or after 2020-12-31.
=====
Message from ja-mailman-2.1.14.j7_6,1:

--
Mailman has been installed, but requires further configuration before use!

You will have to configure both your MTA (mail server) and web server to
integrate with Mailman.  If the port's documentation has been installed,
extensive post-installation instructions may be found in:

  /usr/local/share/doc/mailman/FreeBSD-post-install-notes

Note (1):  If you use an alternate MTA (meaning "not Sendmail"), you MUST
be sure that the correct value of MAIL_GID was used when this port or
package was built.  You can choose your MTA with the correct MAIL_GID by
running "make config" in the Mailman port directory.

Note (2):  The entire Mailman installation resides under /usr/local/mailman.
The command-line scripts necessary to administer Mailman have been
installed in /usr/local/mailman/bin.

Note (3):  As of version 2.1, Mailman's queue runner runs as a daemon and
is started by a script in /usr/local/etc/rc.d

In order to make private archives searchable with namazu2, you need copy
or link /usr/local/libexec/namazu.cgi to
/usr/local/mailman/archives/private// and configure .namazurc
to refer to /usr/local/etc/namazu/namazu-sample.
You can also see the Japanese document in

--
===>   NOTICE:

This port is deprecated; you may wish to reconsider installing it:

Uses deprecated version of python.

It is scheduled to be removed on or after 2020-09-15.

mm_cfg.pyの修正

# cd /usr/local/mailman/Mailman
# vi mm_cfg.py
# diff -u mm_cfg.py.org_2020-05-13 mm_cfg.py
--- mm_cfg.py.org_2020-05-13    2020-05-12 00:09:43.000000000 +0900
+++ mm_cfg.py   2014-10-04 15:29:56.000000000 +0900
@@ -52,3 +52,30 @@
 # Put YOUR site-specific settings below this line.
 DEFAULT_SERVER_LANGUAGE = 'ja'
 GLOBAL_PIPELINE.insert(1, 'iso2022jpfix')
+
+
+#SENDMAIL_CMD = '/usr/local/etc/mail/jsendmail'
+
+DEFAULT_EMAIL_HOST = 'takanome.mine.nu'
+DEFAULT_URL_HOST = 'takanome.mine.nu'
+add_virtualhost('takanome.mine.nu', 'takanome.mine.nu')
+
+DEFAULT_REPLY_GOES_TO_LIST = 1
+DEFAULT_URL_PATTERN = 'https://%s/mailman/'
+PUBLIC_ARCHIVE_URL = 'https://%(hostname)s/pipermail/%(listname)s'
+DEFAULT_SUBJECT_PREFIX = "[%(real_name)s:%%04d]"
+DEFAULT_LIST_ADVERTISED = No
+DEFAULT_ARCHIVE_PRIVATE = 1
+DEFAULT_FIRST_STRIP_REPLY_TO = Yes
+ARCHIVE_TO_MBOX = 2
+OLD_STYLE_PREFIXING = No
+DEFAULT_SEND_WELCOME_MSG = No
+DEFAULT_SUBSCRIBE_POLICY = 2
+DEFAULT_PRIVATE_ROSTER = 2
+ALLOW_RFC2369_OVERRIDES = No
+DEFAULT_MAX_MESSAGE_SIZE = 1000
+DEFAULT_DIGESTABLE = No
+DEFAULT_DEFAULT_MEMBER_MODERATION = Yes
+IMAGE_LOGOS = '/mailman-icons/'

サイトパスワードの設定

# cd /usr/local/mailman
# bin/mmsitepass password
Password changed.

リストの復元

# cd /usr/local/mailman
# mv lists lists.org_2020-05-14
# ln -s /usb_hd/mailman/lists lists
# ls -ld lists*
lrwxr-xr-x  1 root  mailman   21 May 14 08:25 lists -> /usb_hd/mailman/lists
drwxrwsr-x  2 root  mailman  512 May 12 00:09 lists.org_2020-05-14

mail aliasesの設定

aliasesの内容生成

# cd /usr/local/mailman
# bin/genaliases
To finish creating your mailing list, you must edit your /etc/aliases (or
equivalent) file by adding the following lines, and possibly running the
`newaliases' program:

## mailman mailing list
mailman:              "|/usr/local/mailman/mail/mailman post mailman"
mailman-admin:        "|/usr/local/mailman/mail/mailman admin mailman"
mailman-bounces:      "|/usr/local/mailman/mail/mailman bounces mailman"
mailman-confirm:      "|/usr/local/mailman/mail/mailman confirm mailman"
mailman-join:         "|/usr/local/mailman/mail/mailman join mailman"
mailman-leave:        "|/usr/local/mailman/mail/mailman leave mailman"
mailman-owner:        "|/usr/local/mailman/mail/mailman owner mailman"
mailman-request:      "|/usr/local/mailman/mail/mailman request mailman"
mailman-subscribe:    "|/usr/local/mailman/mail/mailman subscribe mailman"
mailman-unsubscribe:  "|/usr/local/mailman/mail/mailman unsubscribe mailman"

sendmailへの登録

# cd /etc/mail
# vi aliases
# make
/usr/sbin/sendmail -bi -OAliasFile=/etc/mail/aliases
/etc/mail/aliases: 46 aliases, longest 54 bytes, 1114 bytes total
#

apache との連携設定

# for mailman

#<IfModule alias_module>
    ScriptAlias /mailman/ /usr/local/mailman/cgi-bin/

#</IfModule>

<Directory /usr/local/mailman/cgi-bin>
    AllowOverride None
    Options ExecCGI
    SetHandler cgi-script
    Require all granted
    SSLRequireSSL
</Directory>

Alias /pipermail/ "/usr/local/mailman/archives/public/"

<Directory "/usr/local/mailman/archives/public/">
    Options FollowSymLinks Indexes
    AllowOverride None
    Require all granted
        AddDefaultCharset Off
        SSLRequireSSL
</Directory>

Alias /mailman-icons/ "/usr/local/www/icons/"

<Directory "/usr/local/www/icons/">
    Options FollowSymLinks
    AllowOverride None
    Require all granted
</Directory>

Cronの設定

# crontab -u mailman -l
# At 8AM every day, mail reminders to admins as to pending requests.
# They are less likely to ignore these reminders if they're mailed
# early in the morning, but of course, this is local time... ;)
0 8 * * * /usr/local/bin/python2.7 -S /usr/local/mailman/cron/checkdbs
#
# At 9AM, send notifications to disabled members that are due to be
# reminded to re-enable their accounts.
0 9 * * * /usr/local/bin/python2.7 -S /usr/local/mailman/cron/disabled
#
# Noon, mail digests for lists that do periodic as well as threshhold delivery.
0 12 * * * /usr/local/bin/python2.7 -S /usr/local/mailman/cron/senddigests
#
# 5 AM on the first of each month, mail out password reminders.
0 5 1 * * /usr/local/bin/python2.7 -S /usr/local/mailman/cron/mailpasswds
#
# Every 5 mins, try to gate news to mail.  You can comment this one out
# if you don't want to allow gating, or don't have any going on right now,
# or want to exclusively use a callback strategy instead of polling.
#0,5,10,15,20,25,30,35,40,45,50,55 * * * * /usr/local/bin/python2.7 -S /usr/local/mailman/cron/gate_news
#
# At 3:27am every night, regenerate the gzip'd archive file.  Only
# turn this on if the internal archiver is used and
# GZIP_ARCHIVE_TXT_FILES is false in mm_cfg.py
27 3 * * * /usr/local/bin/python2.7 -S /usr/local/mailman/cron/nightly_gzip
#
# At 4:30AM daily, cull old entries from the 'bad' and 'shunt' queues.
30 4 * * * /usr/local/bin/python2.7 -S /usr/local/mailman/cron/cull_bad_shunt

# cd /usr/local/mailman
# crontab -u mailman cron/crontab.in

qrunner の自動起動設定

rc.confの更新

# cat >> /etc/rc.conf
mailman_enable="YES"

手動での起動

# cd /usr/local/etc/rc.d
# ./mailman start

アーカイブメールの設定

# cd /usr/local/mailman
# mv archives archives.org_2020-02-13
# ln -s /usb_hd/mailman/archives .

Mailman 管理者マニュアル

Mailman　普通配送メールを個人別にカスタマイズ

Samba

インストール

# pkg search samba
p5-Samba-LDAP-0.05_2           Manage a Samba PDC with an LDAP Backend
p5-Samba-SIDhelper-0.0.0_3     Create SIDs based on G/UIDs
samba-nsupdate-9.14.2_1        nsupdate utility with GSS-TSIG support
samba410-4.10.13               Free SMB/CIFS and AD/DC server and client for Unix

# pkg install samba410
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.
The following 47 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
        avahi-app: 0.7_3
        ca_root_nss: 3.52
        cmocka: 1.1.5
        dbus: 1.12.16
        dbus-glib: 0.110
        gamin: 0.1.10_10
        glib: 2.56.3_7,1
        gmp: 6.2.0
        gnome_subr: 1.0
        gnutls: 3.6.13
        gobject-introspection: 1.56.1,1
        jansson: 2.12
        libICE: 1.0.10,1
        libSM: 1.2.3,1
        libX11: 1.6.9,1
        libXau: 1.0.9
        libXdmcp: 1.1.3
        libarchive: 3.4.2,1
        libdaemon: 0.14_1
        libgcrypt: 1.8.5
        libgpg-error: 1.37
        libiconv: 1.14_11
        libidn2: 2.3.0_1
        libinotify: 20180201_1
        liblz4: 1.9.2_1,1
        libpthread-stubs: 0.4
        libsunacl: 1.0.1
        libtasn1: 4.15.0
        libunistring: 0.9.10_1
        libxcb: 1.13.1
        lmdb: 0.9.24_1,1
        lzo2: 2.10_1
        nettle: 3.5.1_1
        openldap-client: 2.4.50
        p11-kit: 0.23.18.1
        popt: 1.16_2
        py37-dnspython: 1.16.0
        py37-iso8601: 0.1.12
        py37-setuptools: 44.0.0
        python37: 3.7.7
        samba410: 4.10.13
        talloc: 2.3.0
        tdb: 1.4.2,1
        tevent: 0.10.1
        tpm-emulator: 0.7.4_2
        trousers: 0.3.14_2
        xorgproto: 2019.2

Number of packages to be installed: 47

The process will require 375 MiB more space.
66 MiB to be downloaded.

Proceed with this action? [y/N]: y
[1/47] Fetching samba410-4.10.13.txz: 100%   31 MiB   6.4MB/s    00:05
[2/47] Fetching libsunacl-1.0.1.txz: 100%    7 KiB   6.9kB/s    00:01
[3/47] Fetching cmocka-1.1.5.txz: 100%   33 KiB  33.3kB/s    00:01
[4/47] Fetching libtasn1-4.15.0.txz: 100%  598 KiB 612.0kB/s    00:01
[5/47] Fetching libgcrypt-1.8.5.txz: 100%  740 KiB 757.6kB/s    00:01
[6/47] Fetching libgpg-error-1.37.txz: 100%  274 KiB 280.8kB/s    00:01
[7/47] Fetching gnutls-3.6.13.txz: 100%    2 MiB   2.6MB/s    00:01
[8/47] Fetching trousers-0.3.14_2.txz: 100%  474 KiB 485.9kB/s    00:01
[9/47] Fetching tpm-emulator-0.7.4_2.txz: 100%  114 KiB 116.6kB/s    00:01
[10/47] Fetching gmp-6.2.0.txz: 100%  478 KiB 489.5kB/s    00:01
[11/47] Fetching p11-kit-0.23.18.1.txz: 100%  434 KiB 444.6kB/s    00:01
[12/47] Fetching ca_root_nss-3.52.txz: 100%  289 KiB 296.0kB/s    00:01
[13/47] Fetching nettle-3.5.1_1.txz: 100%    1 MiB   1.2MB/s    00:01
[14/47] Fetching libidn2-2.3.0_1.txz: 100%  110 KiB 113.1kB/s    00:01
[15/47] Fetching libunistring-0.9.10_1.txz: 100%  528 KiB 541.1kB/s    00:01
[16/47] Fetching openldap-client-2.4.50.txz: 100%    1 MiB   1.1MB/s    00:01
[17/47] Fetching avahi-app-0.7_3.txz: 100%  427 KiB 437.0kB/s    00:01
[18/47] Fetching gnome_subr-1.0.txz: 100%    2 KiB   1.9kB/s    00:01
[19/47] Fetching libdaemon-0.14_1.txz: 100%   32 KiB  32.4kB/s    00:01
[20/47] Fetching gobject-introspection-1.56.1,1.txz: 100%    1 MiB   1.2MB/s    00:01
[21/47] Fetching python37-3.7.7.txz: 100%   16 MiB   4.2MB/s    00:04
[22/47] Fetching glib-2.56.3_7,1.txz: 100%    3 MiB   3.2MB/s    00:01
[23/47] Fetching libiconv-1.14_11.txz: 100%  606 KiB 620.3kB/s    00:01
[24/47] Fetching dbus-glib-0.110.txz: 100%  163 KiB 167.1kB/s    00:01
[25/47] Fetching dbus-1.12.16.txz: 100%  368 KiB 376.5kB/s    00:01
[26/47] Fetching libX11-1.6.9,1.txz: 100%    2 MiB   1.7MB/s    00:01
[27/47] Fetching libxcb-1.13.1.txz: 100%    1 MiB   1.1MB/s    00:01
[28/47] Fetching libXdmcp-1.1.3.txz: 100%   14 KiB  14.5kB/s    00:01
[29/47] Fetching xorgproto-2019.2.txz: 100%  217 KiB 222.3kB/s    00:01
[30/47] Fetching libXau-1.0.9.txz: 100%   11 KiB  11.3kB/s    00:01
[31/47] Fetching libpthread-stubs-0.4.txz: 100%    2 KiB   2.0kB/s    00:01
[32/47] Fetching libSM-1.2.3,1.txz: 100%   23 KiB  23.7kB/s    00:01
[33/47] Fetching libICE-1.0.10,1.txz: 100%   92 KiB  94.1kB/s    00:01
[34/47] Fetching py37-dnspython-1.16.0.txz: 100%  184 KiB 188.6kB/s    00:01
[35/47] Fetching py37-setuptools-44.0.0.txz: 100%  512 KiB 524.3kB/s    00:01
[36/47] Fetching tevent-0.10.1.txz: 100%   49 KiB  50.0kB/s    00:01
[37/47] Fetching talloc-2.3.0.txz: 100%   48 KiB  49.3kB/s    00:01
[38/47] Fetching py37-iso8601-0.1.12.txz: 100%   12 KiB  12.2kB/s    00:01
[39/47] Fetching popt-1.16_2.txz: 100%   62 KiB  63.2kB/s    00:01
[40/47] Fetching libinotify-20180201_1.txz: 100%   26 KiB  26.7kB/s    00:01
[41/47] Fetching jansson-2.12.txz: 100%   42 KiB  43.1kB/s    00:01
[42/47] Fetching gamin-0.1.10_10.txz: 100%   51 KiB  52.7kB/s    00:01
[43/47] Fetching tdb-1.4.2,1.txz: 100%   81 KiB  82.7kB/s    00:01
[44/47] Fetching lmdb-0.9.24_1,1.txz: 100%  100 KiB 102.9kB/s    00:01
[45/47] Fetching libarchive-3.4.2,1.txz: 100%  797 KiB 816.0kB/s    00:01
[46/47] Fetching lzo2-2.10_1.txz: 100%  110 KiB 112.2kB/s    00:01
[47/47] Fetching liblz4-1.9.2_1,1.txz: 100%  159 KiB 163.1kB/s    00:01
Checking integrity... done (0 conflicting)
[1/47] Installing xorgproto-2019.2...
[1/47] Extracting xorgproto-2019.2: 100%
[2/47] Installing libXdmcp-1.1.3...
[2/47] Extracting libXdmcp-1.1.3: 100%
[3/47] Installing libXau-1.0.9...
[3/47] Extracting libXau-1.0.9: 100%
[4/47] Installing libpthread-stubs-0.4...
[4/47] Extracting libpthread-stubs-0.4: 100%
[5/47] Installing libxcb-1.13.1...
[5/47] Extracting libxcb-1.13.1: 100%
[6/47] Installing libICE-1.0.10,1...
[6/47] Extracting libICE-1.0.10,1: 100%
[7/47] Installing gmp-6.2.0...
[7/47] Extracting gmp-6.2.0: 100%
[8/47] Installing python37-3.7.7...
[8/47] Extracting python37-3.7.7: 100%
[9/47] Installing libiconv-1.14_11...
[9/47] Extracting libiconv-1.14_11: 100%
[10/47] Installing libX11-1.6.9,1...
[10/47] Extracting libX11-1.6.9,1: 100%
[11/47] Installing libSM-1.2.3,1...
[11/47] Extracting libSM-1.2.3,1: 100%
[12/47] Installing libtasn1-4.15.0...
[12/47] Extracting libtasn1-4.15.0: 100%
[13/47] Installing tpm-emulator-0.7.4_2...
===> Creating groups.
Creating group '_tss' with gid '601'.
===> Creating users
Creating user '_tss' with uid '601'.
[13/47] Extracting tpm-emulator-0.7.4_2: 100%
[14/47] Installing ca_root_nss-3.52...
[14/47] Extracting ca_root_nss-3.52: 100%
[15/47] Installing libunistring-0.9.10_1...
[15/47] Extracting libunistring-0.9.10_1: 100%
[16/47] Installing glib-2.56.3_7,1...
[16/47] Extracting glib-2.56.3_7,1: 100%
No schema files found: doing nothing.
[17/47] Installing dbus-1.12.16...
===> Creating groups.
Creating group 'messagebus' with gid '556'.
===> Creating users
Creating user 'messagebus' with uid '556'.
[17/47] Extracting dbus-1.12.16: 100%
[18/47] Installing libgpg-error-1.37...
[18/47] Extracting libgpg-error-1.37: 100%
[19/47] Installing trousers-0.3.14_2...
===> Creating groups.
Using existing group '_tss'.
===> Creating users
Using existing user '_tss'.
[19/47] Extracting trousers-0.3.14_2: 100%
[20/47] Installing p11-kit-0.23.18.1...
[20/47] Extracting p11-kit-0.23.18.1: 100%
[21/47] Installing nettle-3.5.1_1...
[21/47] Extracting nettle-3.5.1_1: 100%
[22/47] Installing libidn2-2.3.0_1...
[22/47] Extracting libidn2-2.3.0_1: 100%
[23/47] Installing gnome_subr-1.0...
[23/47] Extracting gnome_subr-1.0: 100%
[24/47] Installing libdaemon-0.14_1...
[24/47] Extracting libdaemon-0.14_1: 100%
[25/47] Installing gobject-introspection-1.56.1,1...
[25/47] Extracting gobject-introspection-1.56.1,1: 100%
[26/47] Installing dbus-glib-0.110...
[26/47] Extracting dbus-glib-0.110: 100%
[27/47] Installing py37-setuptools-44.0.0...
[27/47] Extracting py37-setuptools-44.0.0: 100%
[28/47] Installing talloc-2.3.0...
[28/47] Extracting talloc-2.3.0: 100%
[29/47] Installing lzo2-2.10_1...
[29/47] Extracting lzo2-2.10_1: 100%
[30/47] Installing liblz4-1.9.2_1,1...
[30/47] Extracting liblz4-1.9.2_1,1: 100%
[31/47] Installing libsunacl-1.0.1...
[31/47] Extracting libsunacl-1.0.1: 100%
[32/47] Installing cmocka-1.1.5...
[32/47] Extracting cmocka-1.1.5: 100%
[33/47] Installing libgcrypt-1.8.5...
[33/47] Extracting libgcrypt-1.8.5: 100%
[34/47] Installing gnutls-3.6.13...
[34/47] Extracting gnutls-3.6.13: 100%
[35/47] Installing openldap-client-2.4.50...
[35/47] Extracting openldap-client-2.4.50: 100%
[36/47] Installing avahi-app-0.7_3...
===> Creating groups.
Creating group 'avahi' with gid '558'.
===> Creating users
Creating user 'avahi' with uid '558'.
[36/47] Extracting avahi-app-0.7_3: 100%
[37/47] Installing py37-dnspython-1.16.0...
[37/47] Extracting py37-dnspython-1.16.0: 100%
[38/47] Installing tevent-0.10.1...
[38/47] Extracting tevent-0.10.1: 100%
[39/47] Installing py37-iso8601-0.1.12...
[39/47] Extracting py37-iso8601-0.1.12: 100%
[40/47] Installing popt-1.16_2...
[40/47] Extracting popt-1.16_2: 100%
[41/47] Installing libinotify-20180201_1...
[41/47] Extracting libinotify-20180201_1: 100%
[42/47] Installing jansson-2.12...
[42/47] Extracting jansson-2.12: 100%
[43/47] Installing gamin-0.1.10_10...
[43/47] Extracting gamin-0.1.10_10: 100%
[44/47] Installing tdb-1.4.2,1...
[44/47] Extracting tdb-1.4.2,1: 100%
[45/47] Installing lmdb-0.9.24_1,1...
[45/47] Extracting lmdb-0.9.24_1,1: 100%
[46/47] Installing libarchive-3.4.2,1...
[46/47] Extracting libarchive-3.4.2,1: 100%
[47/47] Installing samba410-4.10.13...
[47/47] Extracting samba410-4.10.13: 100%
=====
Message from python37-3.7.7:

--
Note that some standard Python modules are provided as separate ports
as they require additional dependencies. They are available as:

py37-gdbm       databases/py-gdbm@py37
py37-sqlite3    databases/py-sqlite3@py37
py37-tkinter    x11-toolkits/py-tkinter@py37
=====
Message from ca_root_nss-3.52:

--
FreeBSD does not, and can not warrant that the certification authorities
whose certificates are included in this package have in any way been
audited for trustworthiness or RFC 3647 compliance.

Assessment and verification of trust is the complete responsibility of the
system administrator.


This package installs symlinks to support root certificates discovery by
default for software that uses OpenSSL.

This enables SSL Certificate Verification by client software without manual
intervention.

If you prefer to do this manually, replace the following symlinks with
either an empty file or your site-local certificate bundle.

  * /etc/ssl/cert.pem
  * /usr/local/etc/ssl/cert.pem
  * /usr/local/openssl/cert.pem
=====
Message from trousers-0.3.14_2:

--
To run tcsd automatically, add the following line to /etc/rc.conf:

tcsd_enable="YES"

You might want to edit /usr/local/etc/tcsd.conf to reflect your setup.

If you want to use tcsd with software TPM emulator, use the following
configuration in /etc/rc.conf:

tcsd_enable="YES"
tcsd_mode="emulator"
tpmd_enable="YES"

To use TPM, add your_account to '_tss' group like following:

# pw groupmod _tss -m your_account
=====
Message from cmocka-1.1.5:

--
For more information on using cmocka, see https://api.cmocka.org
=====
Message from openldap-client-2.4.50:

--
The OpenLDAP client package has been successfully installed.

Edit
  /usr/local/etc/openldap/ldap.conf
to change the system-wide client defaults.

Try `man ldap.conf' and visit the OpenLDAP FAQ-O-Matic at
  http://www.OpenLDAP.org/faq/index.cgi?file=3
for more information.
=====
Message from libinotify-20180201_1:

--
Libinotify functionality on FreeBSD is missing support for

  - detecting a file being moved into or out of a directory within the
    same filesystem
  - certain modifications to a symbolic link (rather than the
    file it points to.)

in addition to the known limitations on all platforms using kqueue(2)
where various open and close notifications are unimplemented.

This means the following regression tests will fail:

Directory notifications:
   IN_MOVED_FROM
   IN_MOVED_TO

Open/close notifications:
   IN_OPEN
   IN_CLOSE_NOWRITE
   IN_CLOSE_WRITE

Symbolic Link notifications:
   IN_DONT_FOLLOW
   IN_ATTRIB
   IN_MOVE_SELF
   IN_DELETE_SELF

Kernel patches to address the missing directory and symbolic link
notifications are available from:

https://github.com/libinotify-kqueue/libinotify-kqueue/tree/master/patches

You might want to consider increasing the kern.maxfiles tunable if you plan
to use this library for applications that need to monitor activity of a lot
of files.
=====
Message from gamin-0.1.10_10:

--
Gamin will only provide realtime notification of changes for at most n files,
where n is the minimum value between (kern.maxfiles * 0.7) and
(kern.maxfilesperproc - 200). Beyond that limit, files will be polled.

If you often open several large folders with Nautilus, you might want to
increase the kern.maxfiles tunable (you do not need to set
kern.maxfilesperproc, since it is computed at boot time from kern.maxfiles).

The behavior of gamin can be controlled via the various gaminrc files.
See http://www.gnome.org/~veillard/gamin/config.html on how to create
these files.  In particular, if you find gam_server is taking up too much
CPU time polling for changes, something like the following may help
in one of the gaminrc files:

# reduce polling frequency to once per 10 seconds
# for UFS file systems in order to lower CPU load
fsset ufs poll 10
--
===>   NOTICE:

The gamin port currently does not have a maintainer. As a result, it is
more likely to have unresolved issues, not be up-to-date, or even be removed in
the future. To volunteer to maintain this port, please create an issue at:

https://bugs.freebsd.org/bugzilla

More information about port maintainership is available at:

https://www.freebsd.org/doc/en/articles/contributing/ports-contributing.html#maintain-port
=====
Message from samba410-4.10.13:

--
How to start: http://wiki.samba.org/index.php/Samba4/HOWTO

* Your configuration is: /usr/local/etc/smb4.conf

* All the relevant databases are under: /var/db/samba4

* All the logs are under: /var/log/samba4

* Provisioning script is: /usr/local/bin/samba-tool

For additional documentation check: http://wiki.samba.org/index.php/Samba4

Bug reports should go to the: https://bugzilla.samba.org/

#

設定＆ユーザーの復元

Samba-serverセットアップメモ(FreeBSD)

家庭内サーバーの構築 - 5. ファイルサーバーの構築(Samba 4.8.2)

設定

/usr/local/sam4.cnf 
# testparm -v

ユーザー

/var/db/samba4/private/passdb.tdb
/var/db/samba4/private/secrets.tdb
# pdbedit -L

samba4/user/script

samba4/smbpasswdからsamba4へ/その２

rc.conf

# echo 'samba_server_enable="YES"' >> /etc/rc.conf

Subversion

インストール

# pkg search subversion
java-subversion-1.13.0         Java bindings for Version control system
p5-subversion-1.13.0           Perl bindings for Version control system
py27-subversion-1.13.0         Python bindings for version control system
ruby-subversion-1.13.0         Ruby bindings for version control system
subversion-1.13.0_1            Version control system
subversion-book-4515           Subversion Documentation HTML/PDF
subversion-gnome-keyring-1.13.0 Gnome Keyring integration for Version control system
subversion-lts-1.10.6          Version control system, long-time-support version
# pkg install subversion
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.
The following 10 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
        gnupg: 2.2.20
        libassuan: 2.5.3
        libksba: 1.3.5_1
        npth: 1.6
        pinentry: 1.1.0_6
        pinentry-tty: 1.1.0
        serf: 1.3.9_4
        sqlite3: 3.30.1_2,1
        subversion: 1.13.0_1
        utf8proc: 2.4.0

Number of packages to be installed: 10

The process will require 37 MiB more space.
7 MiB to be downloaded.

Proceed with this action? [y/N]: y
[1/10] Fetching subversion-1.13.0_1.txz: 100%    3 MiB   1.7MB/s    00:02
[2/10] Fetching serf-1.3.9_4.txz: 100%   82 KiB  84.1kB/s    00:01
[3/10] Fetching utf8proc-2.4.0.txz: 100%   59 KiB  60.5kB/s    00:01
[4/10] Fetching gnupg-2.2.20.txz: 100%    2 MiB   1.1MB/s    00:02
[5/10] Fetching pinentry-1.1.0_6.txz: 100%   16 KiB  16.6kB/s    00:01
[6/10] Fetching pinentry-tty-1.1.0.txz: 100%   28 KiB  29.1kB/s    00:01
[7/10] Fetching libassuan-2.5.3.txz: 100%   78 KiB  79.5kB/s    00:01
[8/10] Fetching libksba-1.3.5_1.txz: 100%  164 KiB 168.0kB/s    00:01
[9/10] Fetching npth-1.6.txz: 100%   20 KiB  21.0kB/s    00:01
[10/10] Fetching sqlite3-3.30.1_2,1.txz: 100%    1 MiB   1.4MB/s    00:01
Checking integrity... done (0 conflicting)
[1/10] Installing libassuan-2.5.3...
[1/10] Extracting libassuan-2.5.3: 100%
[2/10] Installing pinentry-tty-1.1.0...
[2/10] Extracting pinentry-tty-1.1.0: 100%
[3/10] Installing pinentry-1.1.0_6...
[3/10] Extracting pinentry-1.1.0_6: 100%
[4/10] Installing libksba-1.3.5_1...
[4/10] Extracting libksba-1.3.5_1: 100%
[5/10] Installing npth-1.6...
[5/10] Extracting npth-1.6: 100%
[6/10] Installing sqlite3-3.30.1_2,1...
[6/10] Extracting sqlite3-3.30.1_2,1: 100%
[7/10] Installing serf-1.3.9_4...
[7/10] Extracting serf-1.3.9_4: 100%
[8/10] Installing utf8proc-2.4.0...
[8/10] Extracting utf8proc-2.4.0: 100%
[9/10] Installing gnupg-2.2.20...
[9/10] Extracting gnupg-2.2.20: 100%
[10/10] Installing subversion-1.13.0_1...
[10/10] Extracting subversion-1.13.0_1: 100%
=====
Message from gnupg-2.2.20:

--
GnuPG, when run on hosts without IPv6 connectivity, may fail to connect to
dual-stack hkp servers [1].  As a workaround, add

disable-ipv6

to

/usr/local/etc/dirmngr.conf

[1] https://dev.gnupg.org/rGecfc4db3a2f8bc2652ba4ac4de5ca1cd13bfcbec


# pkg search mod_dav_svn
mod_dav_svn-1.13.0             Apache module for subversion serving

# pkg install mod_dav_svn
Updating FreeBSD repository catalogue...
FreeBSD repository is up to date.
All repositories are up to date.
The following 1 package(s) will be affected (of 0 checked):

New packages to be INSTALLED:
        mod_dav_svn: 1.13.0

Number of packages to be installed: 1

80 KiB to be downloaded.

Proceed with this action? [y/N]: y
[1/1] Fetching mod_dav_svn-1.13.0.txz: 100%   80 KiB  81.7kB/s    00:01
Checking integrity... done (0 conflicting)
[1/1] Installing mod_dav_svn-1.13.0...
[1/1] Extracting mod_dav_svn-1.13.0: 100%

#

Apache側の設定

httpd.conf 修正

# diff -u httpd.conf_2020-05-12 httpd.conf
--- httpd.conf_2020-05-12       2020-05-12 16:18:28.458621000 +0900
+++ httpd.conf  2020-05-24 11:45:10.961777000 +0900
@@ -156,7 +156,7 @@
 LoadModule unixd_module libexec/apache24/mod_unixd.so
 #LoadModule heartbeat_module libexec/apache24/mod_heartbeat.so
 #LoadModule heartmonitor_module libexec/apache24/mod_heartmonitor.so
-#LoadModule dav_module libexec/apache24/mod_dav.so
+LoadModule dav_module libexec/apache24/mod_dav.so
 LoadModule status_module libexec/apache24/mod_status.so
 LoadModule autoindex_module libexec/apache24/mod_autoindex.so
 #LoadModule asis_module libexec/apache24/mod_asis.so

modules.d/220_subversion.conf の修正

# diff -u 220_subversion.conf.org_2020-05-24 220_subversion.conf
--- 220_subversion.conf.org_2020-05-24  2020-05-20 06:06:48.000000000 +0900
+++ 220_subversion.conf 2020-05-24 11:40:31.214979000 +0900
@@ -13,9 +13,9 @@
 ## ==========================================================================
 ## Subversion modules
 ## ==========================================================================
-#LoadModule dav_svn_module     libexec/apache24/mod_dav_svn.so
-#LoadModule authz_svn_module   libexec/apache24/mod_authz_svn.so
-#LoadModule dontdothat_module  libexec/apache24/mod_dontdothat.so
+LoadModule dav_svn_module     libexec/apache24/mod_dav_svn.so
+LoadModule authz_svn_module   libexec/apache24/mod_authz_svn.so
+LoadModule dontdothat_module  libexec/apache24/mod_dontdothat.so


 ## ==========================================================================

FreeBSD 12.1R の再導入

導入CDの作成

導入作業

導入メディアでの起動

キーボードの選択

ホスト名の設定

インストールするコンポーネントの設定

ディスク スライス(区画)の設定

インストール後の作業

root パスワードの設定

ネットワークインタフェースの設定

CMOS Clockの設定

タイムゾーン の設定

サービスの設定

システム セキュリティー強化項目

ユーザーの追加

インストーラーの終了

PowerD の設定

追加したユーザーのroot昇格を許可

リブート

sshの準備

hostsへの追加

.ssh ディレクトリーの圧縮

転送

展開

セキュリティー強化

コンソール ログの記録

System Updateの実行

アップデートの取得

アップデートの適用

アプリ更新の準備

pkg

ports & portupgrade

portupgrade の導入

ports collectionの更新

認証ライブラリーの導入とsendmailでの利用

cyrus-sasl-2 導入

/etc/rc.confへの設定追加

認証方法の指定追加

sendmail がcyrus-sasl2を使うように

ライブラリーのコンパイル

sendmailの基本設定

.mcの編集

テンプレートの作成

<host名>.mcの編集

access

aliases

sendmail.cfへの反映

local-host-names

プロバイダーに提示するユーザー情報の指定

認証データベースを作る

SSL 関連

再起動

動作確認

Mail送信テスト

Mail受信テスト

qpopperの導入

インストール

inetd.confの修正

inetd起動設定

inetd再起動

維持管理環境の複製

本番環境のDiskコピー

ZFS外部Diskの引き継ぎ

ZFSの有効化

プールの確認

ZFS ストレージプールをインポートする

インポート後の確認

外部Diskのバックアップ

S.M.A.R.T.ツールの導入

導入と設定

smartctl 確認

パッケージインストール

基本設定

rc.conf の設定

httpd.conf の修正

SSL設定

サーバー証明書のコピー

httpd-ssl.conf

ユーザー認証の設定

ディスクスライス(区画)の設定

タイムゾーンの設定

システムセキュリティー強化項目

コンソールログの記録

コンテンツディレクトリーの移動

サイトパスワードの設定

アーカイブメールの設定

設定＆ユーザーの復元