summaryrefslogtreecommitdiff
path: root/etc/rc.d
AgeCommit message (Collapse)Author
2023-06-10Add some backwards compat. Adjust grammar.kim
2023-06-05/etc/rc.d/sshd: Use default curve for ECDSA keygen, not NIST P-521.riastradh
The default is NIST P-256, which: (a) has plenty of cryptanalytic security, (b) performs better on essentially all platforms (smaller enough that even the advantage of the Mersenne prime structure of P-521 can't compete), and (c) likely gets more scrutiny on implementations than P-521 since it's more widespread.
2023-06-05/etc/rc.d/sshd: Stop generating DSA host keys by default.riastradh
If you want them you can generate them yourself, but in this day and age (Monday and 2023, specifically) there's no reason to be using DSA except for compatibility with ancient legacy software.
2023-05-26/etc/rc.d/sshd: New check cmd and reload precmd.riastradh
- check cmd: run `sshd -t' to check sshd_config file - reload precmd: run check cmd before reloading so we don't nuke sshd if there's an error in the sshd_config file (It is still possible to effectively nuke sshd by changing the configuration tosomething that won't work on your network, but at least we avoid making sshd just exit on reload when you make a typo in a config option.) XXX pullup-9 XXX pullup-10
2023-02-18Handle missing auth file.mlelstv
Skip empty lines.
2023-02-06If /etc/iscsi/volumes does not exist, explicitly exit with 0 statusmartin
2023-02-03Add start script to attach iscsi volumes at boot.mlelstv
The default is to execute the script (iscsid_volumes=YES), so if you have any volumes defined, you should also start iscsid (iscsid=YES) to avoid error messages.
2022-07-21Make this better ... Allow config file for raidN to be foundkre
in /etc/conf/raid/raidN (as well as in /etc/raidN.conf) (less clutter in /etc). Allow config files to exist for raids that are autoconfigured (just skip anything autoconfigured) - this allows a (simplistic) recovery mechanism if autoconf fails, and makes it simpler to enable/disable autoconf at will, while keeping the raid working. While here, add sh quoting where it is needed, and remove it from where it is pointless.
2022-06-06build system: Revert all the recent additions of MK[...] knobs thatnia
allow conditionally disabling the building of certain user space programs in the 'base' set. There is not enough consensus that this is the right way and a few people had strong objections, see source-changes-d@.
2022-05-29mk: Add a MKPPP flag to exclude pppd(8) and related utilities fromnia
the build
2022-05-28mk: Add MKNTP, MKTCPDUMP knobs.nia
2022-05-25mk: Rename the MKMBONE option to MKMROUTING for greater accuracy andnia
to match the related kernel config option.
2022-05-25mk: Allow building base without the MBONE applications by settingnia
MKMBONE=no in mk.conf
2022-05-15PR 56835: fix sshd startup script to only whine about bogus keys itmartin
created if it actualy did create keys (one should thing that a function called sshd_keygen() only is called to create keys, but the "precmd" magic makes it run every time sshd is started or stopped). Patch from Tom Lane, with modifications suggested by kre and a minor additional cosemtic change.
2022-04-30Like /etc/rc.d/network, add the ability to put a '!' character as thebrad
first character in /etc/gpio.conf and have the rest evaluated in a shell. It is useful to be able to do actions after setting up gpio pins or attaching gpioiic(4).
2022-04-16fix various typos in comments and log messages.andvar
2022-03-02LOGIN: fix typo in descriptiongutteridge
2022-02-20Enable critical_filesystems_zfs.alnsn
2021-11-30Revert previous. Explicitly load the value of npf or pfsborrill
2021-11-26Load rc configuration based on rcvar, not name, so that correct settingssborrill
in /etc/rc.conf.d are loaded. Usually this does not matter as rcvar and name are set to the same value. For pf_boot and npf_boot, rcvar is set to pf and npf respectively. Prior to the change, if: rc.conf contains nfp=YES rc.conf.d/npf does not exist Then: /etc/rc.d/npf_boot rcvar outputs: # npf_boot $npf=YES If: rc.conf contains npf=NO (or is not set) rc.conf.d/npf contains npf=YES Then: /etc/rc.d/npf_boot rcvar outputs: # npf_boot $npf=NO This means that in the latter case, at boot time the npfctl start command is never run and the firewall is not operational.
2021-11-26Use rcvar=$name syntax consistently in rc.d scripts which makes it easier tosborrill
search for rc.d scripts where rcvar differs from name. No functional change.
2021-09-26If key generation happens with not enough entropy in the system, addmartin
a warning to motd pointing at entropy(7) and give instructions how to re-generate the (weak) keys after fixing up entropy. Add a "keyregen" command, which forces regeneration of all host keys to simplify the replacement of weak keys.
2021-08-21fix mainly same typos as in my previous commit but outside sys/dev/dm.andvar
2021-08-03Reverse devpubd dependeny to avoid dangling reference to zfs which ismlelstv
an optional part of the build.
2021-07-31Run devpubd before volume managers and pseudo disks.mlelstv
2021-06-13run sysctl early enough.mlelstv
2021-03-31handle copying of plugins to the chrootchristos
2021-03-09Need to explicitly load value of zfs variable as zfs=YES may be set insborrill
/etc/rc.conf.d/zfs, not /etc/rc.conf.
2021-03-01require NETWORKING otherwise amd can come up before the network is up andchristos
it needs to be able to do DNS.
2021-02-16Enable "/etc/zfs/exports" from "zfs share" in rc.d/mountd and rc.d/mountall.hannken
2021-01-26llvmlockdir -> lvmlockdirmartin
2021-01-26Rename etc/rc.d/llvmlockdir to lvmlockdir - it has nothing to do with LLVM,martin
the name probably was a freudian slip of my fingers when I split that fragment out of another rc.d script.
2021-01-10Various entropy integration improvements.riastradh
- New /etc/security check for entropy in daily security report. - New /etc/rc.d/entropy script runs (after random_seed and rndctl) to check for entropy at boot -- in rc.conf, you can: . set `entropy=check' to halt multiuser boot and enter single-user mode if not enough entropy . set `entropy=wait' to make multiuser boot wait until enough entropy Default is to always boot without waiting -- and rely on other channels like security report to alert the operator if there's a problem. - New man page entropy(7) discussing the higher-level concepts and system integration with cross-references. - New paragraph in afterboot(8) about entropy citing entropy(7) for more details. This change addresses many of the issues discussed in security/55659. This is a first draft; happy to take improvements to the man pages and scripted messages to improve clarity. I considered changing motd to include an entropy warning with a reference to the entropy(7) man page, but it's a little trickier: - Not sure it's appropriate for all users to see at login rather than users who have power to affect the entropy estimate (maybe it is, just haven't decided). - We only have a mechanism for changing once at boot; the message would remain until next boot even if an operator adds enough entropy. - The mechanism isn't really conducive to making a message appear conditionally from boot to boot.
2020-12-25Adjust to "pool" usage in our standard ntp.conf, pointed outmartin
by Connor McLaughlan.
2020-10-16network: Update rtsol optionskim
- Use "-6" instead of "--noipv4" as it seems more appropriate based on the dhcpcd(8) manual page. - Remove "-f /dev/null" as it seems unnecessary with "-6". - Remove "--persistent" as it is in the default /etc/dhcpcd.conf, and this way the user can change it, if they would like to (either through dhcpcd_flags or by editing /etc/dhcpcd.conf). The "-b" (or "--background") option is needed to avoid a timeout error message (and a delay in booting), so it is still left in place.
2020-10-15Update "rtsol" keyword: leave IPv6 autoconf onkim
There is no need to turn off ipv6_autoconf or dhcp6 in dhcpcd to match the previous behaviour with in-kernel RA processing.
2020-10-11Make "rtsol" functional again.kim
2020-09-11Make a ": " suffix a fixed part of the release info tagkim
This results in correct updates to /etc/motd even when the value of motd_release_tag is changed (a likely event). Add safe quoting to outputting the read kernel version. Thanks to kre@ for the feedback.
2020-09-11Add optional release info in /etc/motdkim
My personal preferencese for /etc/rc.conf: update_motd_release=YES motd_release_tag='Binaries: ' This provides an explanation to users about the second version in motd.
2020-09-08Sort - no functional changemartin
2020-09-08Rename MOUNTCRITLOCAL to CRITLOCALMOUNTED to avoid a name collisionmartin
on case insensitive file systems
2020-09-08Make it work with empty /varmartin
2020-07-22Split the local disk availability step into two phases to allow scriptsmartin
that pre-populate parts of the system (e.g. a tmpfs based /var) an easy place to plug in like: # REQUIRE: mountcritlocal # BEFORE: MOUNTCRITLOCAL This also cleans up the existing special handling a bit by separating it into new scripts. All later scripts now depend on MOUNTCRITLOCAL. Discussed on tech-userlevel some time ago.
2020-07-04Trailing whitespaceskrll
2020-06-12Remove in-kernel handling of Router Advertisementsroy
This is much better handled by a user-land tool. Proposed on tech-net here: https://mail-index.netbsd.org/tech-net/2020/04/22/msg007766.html Note that the ioctl SIOCGIFINFO_IN6 no longer sets flags. That now needs to be done using the pre-existing SIOCSIFINFO_FLAGS ioctl. Compat is fully provided where it makes sense, but trying to turn on RA handling will obviously throw an error as it no longer exists. Note that if you use IPv6 temporary addresses, this now needs to be turned on in dhcpcd.conf(5) rather than in sysctl.conf(5).
2020-06-05Add support for npfd_flagschristos
2020-05-31dhcpcd: Empty the chrootroy
While here, set correct optional hooks.
2020-05-24Support resizing wedgesjmcneill
2020-05-07If no random seed file exists on boot, create one.riastradh
rndctl -S triggers entropy consolidation, so whatever we gathered during kernel startup -- interrupt timings, autoconf timings, &c. -- will be incorporated into the seed and into subsequent data read from /dev/urandom, just like if rndctl -L had run at this boot, and the seed will carry them into the next boot too. But it still avoids frequently consolidating entropy on any regular schedule, in order to continue to mitigate iterative-guessing attacks.
2020-05-07Omit needless verbiage in error message.riastradh