├── README.md ├── anonymous-ftp-jail-HOWTO ├── collectd-exec-scripts └── exec-squid.sh ├── collectd-exec-squid-HOWTO ├── csync2-jail-HOWTO ├── freebsd-install-guide-public ├── monitorix-setup-HOWTO ├── openvpn-jail-HOWTO ├── patches ├── 450.status-security ├── 450.status-security.patch.txt ├── PR182711_serviio-samples-pkg-plist.patch ├── PR188020_isc-dhcp-server.diff ├── PR196839_epair.4.diff ├── PR197150_fluxbox-1.3.6_1.diff ├── PR197693_fluxbox-1.3.7.diff ├── PR198021_serviio-1.5_1.diff ├── PR198210_py27-radicale-0.8_2.diff ├── PR198297_davmail-4.6.1.diff ├── PR198297_davmail_vuxml.diff ├── PR198571_lldpd-0.7.13_1.diff ├── PR198882_php55-5.5.23.diff ├── PR198993_php5-5.4.39.diff ├── PR199091_cassandra_vuxml.diff ├── PR199150.pflog ├── PR199150.pflog.patch ├── PR199257_whatweb-0.4.8.7.d0256.b.diff ├── PR199508_chrony-1.31.1.diff ├── PR199678_wpa_supplicant-2.4_1.diff ├── PR199721_10-contrib_wpa_src_p2p_p2p.c.diff ├── PR199721_11-contrib_wpa_src_p2p_p2p.c.diff ├── PR199864_zfsboot.diff ├── PR200040_zope213-2.13.22_1.diff ├── PR200172_salt-vuxml.patch ├── PR200233_py27-libnacl-1.4.2.diff ├── PR200311_virtualbox-ose_vuxml.diff ├── patch-src_FbTk_TextButton.cc └── serviio-1.5.diff ├── puppet-dashboard-jails-HOWTO └── squid-jail-HOWTO /README.md: -------------------------------------------------------------------------------- 1 | my-freebsd-build 2 | ================ 3 | 4 | Everything for a full FreeBSD server -------------------------------------------------------------------------------- /anonymous-ftp-jail-HOWTO: -------------------------------------------------------------------------------- 1 | ################################################################################ 2 | ## FTP Jail Configuration ## 3 | ################################################################################ 4 | # Anonymous FTP suited for a few quick internal uses only. 5 | # 6 | # Modified from: 7 | # http://157.85.32.130/freebsd/servers/ftp/ftpd.html 8 | # http://www5.us.freebsd.org/doc/handbook/network-ftp.html 9 | ################################################################################ 10 | 11 | ezjail-admin create -f lan ftp.mydomain.name 10.100.102.13 12 | ezjail-admin console -f ftp.mydomain.name 13 | passwd 14 | 15 | pkg install bash portmaster tmux vim-lite pstree cmdwatch tree 16 | echo '#WITH_PKGNG=yes #only uncommented on earlier releases than 10' >> /etc/make.conf 17 | echo 'WITH_SSP_PORTS=yes' >> /etc/make.conf 18 | 19 | # Add anonymous user 20 | pw useradd -m -n ftp -c "Anonymous FTP User,,," -s /sbin/nologin -d "/var/ftp" 21 | 22 | # Remove the skel directory created above and create default ftp structure 23 | cd /var/ftp 24 | rm -r .* 25 | mkdir etc pub incoming 26 | chown -R root:ftp /var/ftp/ 27 | chmod 755 etc pub 28 | chown -R nobody incoming 29 | chmod 5777 incoming 30 | echo "ftp" >> /etc/ftpchroot 31 | touch /var/log/ftpd 32 | 33 | # Finalize and activate 34 | echo 'ftpd_enable="YES"' >> /etc/rc.conf.local 35 | echo 'ftpd_flags="-ASll"' >> /etc/rc.conf.local 36 | service ftpd start 37 | -------------------------------------------------------------------------------- /collectd-exec-scripts/exec-squid.sh: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # Exec script for collectd to read Squid stats 3 | # Optional: Specify and uncomment to monitor inside a jail from host on FreeBSD 4 | #HOST_TO_MONITOR="10.100.102.19" 5 | #PATH=$PATH:/usr/jails/squid.test.com/usr/local/sbin/ 6 | 7 | SQUID_HOST="${HOST_TO_MONITOR:-localhost}" 8 | HOSTNAME="${COLLECTD_HOSTNAME:-`hostname -s`}" 9 | INTERVAL="${COLLECTD_INTERVAL:-60}" 10 | 11 | while sleep "$INTERVAL" 12 | do 13 | squidclient -h "$SQUID_HOST" cache_object://localhost/counters \ 14 | | awk -F ' = ' -v HOSTNAME=$HOSTNAME -v INTERVAL=$INTERVAL \ 15 | '/requests|^(server|client)/ \ 16 | { print "PUTVAL", HOSTNAME"/exec-squid/counter-squid/"$1, "interval="INTERVAL, "N:"$2 }' 17 | 18 | squidclient -h "$SQUID_HOST" cache_object://localhost/ipcache \ 19 | | awk -F ':' -v HOSTNAME=$HOSTNAME -v INTERVAL=$INTERVAL \ 20 | '/IPcache (Requests|Hits|Misses)/ \ 21 | { gsub(/ /, "", $1); gsub(/ /, "", $2); 22 | print "PUTVAL", HOSTNAME"/exec-squid/counter-squid/"$1, "interval="INTERVAL, "N:"$2 }' 23 | 24 | squidclient -h "$SQUID_HOST" cache_object://localhost/storedir \ 25 | | awk -F ':' -v HOSTNAME=$HOSTNAME -v INTERVAL=$INTERVAL \ 26 | '/(Maximum Swap Size|Current Store Swap Size)/ \ 27 | { gsub(/KB/, ""); gsub(/ /, "", $1); gsub(/ /, "", $2); 28 | print "PUTVAL", HOSTNAME"/exec-squid/gauge-squid/"$1, "interval="INTERVAL, "N:"$2 }' 29 | done 30 | -------------------------------------------------------------------------------- /collectd-exec-squid-HOWTO: -------------------------------------------------------------------------------- 1 | ################################################################################ 2 | ## Collectd Squid Monitoring Configuration ## 3 | ################################################################################ 4 | # A shell script suitable for Collectd to use with the "Exec" Plugin. 5 | # 6 | # Basic monitoring technique is based off what Monitorix does in Perl, rewritten 7 | # into a standard Bourne shell script with Awk to handle reformatting. 8 | # 9 | # Written 2014 by Jason Unovitch 10 | # jason.unovitch@gmail.com 11 | # https://github.com/junovitch 12 | ################################################################################ 13 | 14 | # Get the script 15 | fetch https://raw.githubusercontent.com/junovitch/my-freebsd-build/master/collectd-exec-scripts/exec-squid.sh 16 | 17 | # Alternately 18 | cat > /usr/local/sbin/exec-squid.sh << 'EOF' 19 | #!/bin/sh 20 | # Exec script for collectd to read Squid stats 21 | # Optional: Specify and uncomment to monitor inside a jail from host on FreeBSD 22 | #HOST_TO_MONITOR="10.100.102.19" 23 | #PATH=$PATH:/usr/jails/squid.test.com/usr/local/sbin/ 24 | 25 | SQUID_HOST="${HOST_TO_MONITOR:-localhost}" 26 | HOSTNAME="${COLLECTD_HOSTNAME:-`hostname -s`}" 27 | INTERVAL="${COLLECTD_INTERVAL:-60}" 28 | 29 | while sleep "$INTERVAL" 30 | do 31 | squidclient -h "$SQUID_HOST" cache_object://localhost/counters \ 32 | | awk -F ' = ' -v HOSTNAME=$HOSTNAME -v INTERVAL=$INTERVAL \ 33 | '/requests|^(server|client)/ \ 34 | { print "PUTVAL", HOSTNAME"/exec-squid/counter-squid/"$1, "interval="INTERVAL, "N:"$2 }' 35 | 36 | squidclient -h "$SQUID_HOST" cache_object://localhost/ipcache \ 37 | | awk -F ':' -v HOSTNAME=$HOSTNAME -v INTERVAL=$INTERVAL \ 38 | '/IPcache (Requests|Hits|Misses)/ \ 39 | { gsub(/ /, "", $1); gsub(/ /, "", $2); 40 | print "PUTVAL", HOSTNAME"/exec-squid/counter-squid/"$1, "interval="INTERVAL, "N:"$2 }' 41 | 42 | squidclient -h "$SQUID_HOST" cache_object://localhost/storedir \ 43 | | awk -F ':' -v HOSTNAME=$HOSTNAME -v INTERVAL=$INTERVAL \ 44 | '/(Maximum Swap Size|Current Store Swap Size)/ \ 45 | { gsub(/KB/, ""); gsub(/ /, "", $1); gsub(/ /, "", $2); 46 | print "PUTVAL", HOSTNAME"/exec-squid/gauge-squid/"$1, "interval="INTERVAL, "N:"$2 }' 47 | done 48 | 'EOF' 49 | 50 | 51 | # Exec Plugin config changes for Collectd: 52 | # collectd.conf 53 | LoadPlugin exec 54 | 55 | Exec "_collectd:_collectd" "/usr/local/sbin/exec-squid.sh" 56 | 57 | 58 | 59 | # Squid changes if monitoring a FreeBSD jail from the host. Normally, monitoring 60 | # from 127.0.0.1 is allowed and no changes are needed. 61 | --- squid.conf 2014-12-03 00:11:44.000000000 +0000 62 | +++ squid.conf 2014-12-03 00:36:02.000000000 +0000 63 | @@ -5,6 +5,8 @@ 64 | # Example rule allowing access from your local networks. 65 | # Adapt to list your (internal) IP networks from where browsing 66 | # should be allowed 67 | +acl jailhost src 10.100.102.2 68 | +acl jailhost src 10.100.102.19 69 | acl localnet src 10.0.0.0/8 # RFC1918 possible internal network 70 | acl localnet src 172.16.0.0/12 # RFC1918 possible internal network 71 | acl localnet src 192.168.0.0/16 # RFC1918 possible internal network 72 | @@ -35,6 +37,7 @@ 73 | 74 | # Only allow cachemgr access from localhost 75 | http_access allow localhost manager 76 | +http_access allow jailhost manager 77 | http_access deny manager 78 | 79 | # We strongly recommend the following be uncommented to protect innocent 80 | -------------------------------------------------------------------------------- /csync2-jail-HOWTO: -------------------------------------------------------------------------------- 1 | ################################################################################ 2 | ## Csync2 Jail Configuration ## 3 | ################################################################################ 4 | # 5 | # Unison was a better fit than Csync2 because it is two way and faster than 6 | # Csync2 with the number of files synced up, but this did work out. 7 | # 8 | # Written in April 2013 by Jason Unovitch 9 | # jason.unovitch@gmail.com 10 | # https://github.com/junovitch 11 | # 12 | # References: 13 | # http://oss.linbit.com/csync2/paper.pdf 14 | # http://linuxaria.com/howto/csync2-a-filesystem-syncronization-tool-for-linux?lang=en 15 | # 16 | 17 | ezjail-admin create -f lan csync-jail 10.100.102.10 18 | 19 | # Make mount directories 20 | mkdir -p /usr/jails/csync-jail/zfs/homedirs/public 21 | mkdir -p /usr/jails/csync-jail/zfs/homedirs/common_assorted 22 | mkdir -p /usr/jails/csync-jail/zfs/homedirs/common_media 23 | mkdir -p /usr/jails/csync-jail/zfs/homedirs/common_photo_albums 24 | 25 | # Update ezjail mount file with each Nullfs mount 26 | cat >> /etc/fstab.csync_jail_unovitch_com << __EOF__ 27 | /zfs/homedirs /usr/jails/csync-jail/zfs/homedirs nullfs rw 0 0 28 | /zfs/homedirs/public /usr/jails/csync-jail/zfs/homedirs/public nullfs rw 0 0 29 | /zfs/homedirs/common_assorted /usr/jails/csync-jail/zfs/homedirs/common_assorted nullfs rw 0 0 30 | /zfs/homedirs/common_media /usr/jails/csync-jail/zfs/homedirs/common_media nullfs rw 0 0 31 | /zfs/homedirs/common_photo_albums /usr/jails/csync-jail/zfs/homedirs/common_photo_albums nullfs rw 0 0 32 | __EOF__ 33 | 34 | # Start jail and change password 35 | ezjail-admin console -f csync-jail 36 | passwd 37 | 38 | # Install csync (using pkg) 39 | echo 'WITH_PKGNG=yes' >> /etc/make.conf 40 | portmaster net/csync2 41 | 42 | # Generate preshared keys 43 | cd /usr/local/etc 44 | csync2 -k csync2.psk 45 | openssl genrsa -out csync2_ssl_key.pem 1024 46 | openssl req -new -key csync2_ssl_key.pem -out csync2_ssl_cert.csr 47 | openssl x509 -req -days 600 -in csync2_ssl_cert.csr -signkey csync2_ssl_key.pem -out csync2_ssl_cert.pem 48 | 49 | # Make config using preshared key and desktop/server jail 50 | cat > csync2.cfg << __EOF__ 51 | group mycluster 52 | { 53 | host desktop; 54 | host csync-jail; 55 | 56 | key /usr/local/etc/csync2.psk; 57 | 58 | include /zfs/homedirs; 59 | auto younger; 60 | } 61 | __EOF__ 62 | 63 | # Enable csync and update /etc/services with its protocol information 64 | printf 'csync2\t\t30865/tcp #cluster synchronization tool\n' >> /etc/services 65 | echo 'csync2_enable="YES"' >> /etc/rc.conf 66 | 67 | # Create a daily periodic job to run the sync 68 | cat > /usr/local/etc/periodic/daily/999-csync2 << __EOF__ 69 | #!/bin/sh 70 | # 71 | # /usr/local/etc/periodic/daily/999-csync2 2013-03-08 72 | # 73 | # Run csync2 push 74 | # 75 | 76 | # If there is a global system configuration file, suck it in. 77 | # 78 | if [ -r /etc/defaults/periodic.conf ] 79 | then 80 | . /etc/defaults/periodic.conf 81 | source_periodic_confs 82 | fi 83 | 84 | hostname=\`hostname\` 85 | rc=0 86 | case "\$daily_csync2_enable" in 87 | [Yy][Ee][Ss]) 88 | if [ ! -f /var/db/csync2/\${hostname}.db ]; then 89 | echo '\$daily_csync2_enable is enabled but' \ 90 | "/var/db/csync2/\${hostname}.db doesn't exist" 91 | rc=2 92 | else 93 | echo "" 94 | echo "Running Csync2 backup:" 95 | /usr/local/sbin/csync2 -x 96 | rc=\$? 97 | fi 98 | ;; 99 | *) 100 | rc=0 101 | ;; 102 | esac 103 | exit \$rc 104 | __EOF__ 105 | chmod 555 /usr/local/etc/periodic/daily/999-csync2 106 | 107 | # Enable daily csync job 108 | echo 'daily_csync2_enable="YES"' >> /etc/periodic.conf 109 | service csync2 start 110 | -------------------------------------------------------------------------------- /monitorix-setup-HOWTO: -------------------------------------------------------------------------------- 1 | ################################################################################ 2 | ## Monitorix Configuration ## 3 | ################################################################################ 4 | # 5 | # Monitorix is a great tool for monitoring system activity on small servers. 6 | # After coming across a good Carbon/Graphite guide I went that route as it's 7 | # easier to see everything in one place rather than going to a web server 8 | # running on each system. 9 | # 10 | # In these example: 11 | # 10.100.102.2 is the LAN address of the host 12 | # 10.100.102.15 is the address of a jail running BIND 13 | # 10.100.102.18 is the address of a jail running MySQL 14 | # 10.100.102.19 is the address of a jail running Squid 15 | # 16 | # Monitorix is configured to monitor services running in those jails and listen 17 | # on the host address only. 18 | # 19 | # Written 2014 by Jason Unovitch 20 | # jason.unovitch@gmail.com 21 | # https://github.com/junovitch 22 | ################################################################################ 23 | 24 | # Install Monitorix 25 | pkg install sysutils/monitorix databases/p5-DBD-mysql 26 | 27 | # Change Monitorix user from 'nobody' to 'www' which can write graphs in the 28 | # image directory ( /usr/local/www/monitorix/imgs ) 29 | patch -l /usr/local/etc/monitorix.conf << 'EOF' 30 | 28,29c28,29 31 | < user = nobody 32 | < group = nobody 33 | --- 34 | > user = www 35 | > group = www 36 | 'EOF' 37 | 38 | # Enable Monitorix 39 | sysrc monitorix_enable=YES 40 | 41 | # Start Monitorix 42 | service monitorix start 43 | 44 | # Monitorix is already useful and will start collecting data. It can be found at 45 | # http://your-host:8080/monitorix 46 | # 47 | # However, there are a few Linux specific paths and device names that should be 48 | # fixed along with some other services to monitor and preferences to change. 49 | 50 | ################################################################################ 51 | # Force listening on the LAN Internal IP only to be jail friendly 52 | ################################################################################ 53 | 54 | patch -l /usr/local/etc/monitorix.conf << 'EOF' 55 | 26c26 56 | < host = 57 | --- 58 | > host = 10.100.102.2 59 | 'EOF' 60 | 61 | ################################################################################ 62 | # Update NICs from Linux names to FreeBSD driver names 63 | ################################################################################ 64 | 65 | patch -l /usr/local/etc/monitorix.conf << 'EOF' 66 | 225c225 67 | < list = eth0 68 | --- 69 | > list = em0, em1 70 | 227c227,228 71 | < eth0 = FastEthernet LAN, 0, 10000000 72 | --- 73 | > em0 = GigabitEthernet DMZ, 0, 10000000 74 | > em1 = GigabitEthernet LAN, 0, 10000000 75 | 229c230 76 | < gateway = eth0 77 | --- 78 | > gateway = 79 | 'EOF' 80 | 81 | ################################################################################ 82 | # Configure disk monitoring using sysutils/smartmontools and update disk names 83 | ################################################################################ 84 | 85 | pkg install sysutils/smartmontools 86 | 87 | patch -l /usr/local/etc/monitorix.conf << 'EOF' 88 | 70c70 89 | < disk = n 90 | --- 91 | > disk = y 92 | 186c186 93 | < 0 = /dev/sda, /dev/sdb, /dev/sdc 94 | --- 95 | > 0 = /dev/ada0, /dev/ada1, /dev/ada2, /dev/ada3 96 | 'EOF' 97 | 98 | ################################################################################ 99 | # Configure monitoring MySQL database jail 100 | # - The following will need to be done in the jail to allow this: 101 | # CREATE USER 'monitorix'@'10.100.102.18' IDENTIFIED BY 'MY_MONITORIX_PASSWORD'; 102 | ################################################################################ 103 | 104 | patch -l /usr/local/etc/monitorix.conf << 'EOF' 105 | 81c81 106 | < mysql = n 107 | --- 108 | > mysql = y 109 | 333,334c334,335 110 | < list = localhost 111 | < # list = /var/lib/mysql/mysql.sock 112 | --- 113 | > list = 10.100.102.18 114 | > # list = /tmp/mysql.sock 115 | 336c337 116 | < localhost = 3306, user, secret 117 | --- 118 | > 10.100.102.18 = 3306, monitorix, MY_MONITORIX_PASSWORD 119 | 'EOF' 120 | 121 | ################################################################################ 122 | # Configure monitoring Squid jail 123 | # - Fix log file path 124 | # - Enable monitoring 125 | # - Fix path for 'squidclient' command 126 | # 127 | # Note: Add the following lines to squid.conf inside that jail followed by a 128 | # `service squid reload` . Normally, this access is only allowed for localhost 129 | # so the IP of the jail must be allowed. 130 | # 131 | # acl jailhost src 10.100.102.19 132 | # acl jailhost src 192.168.102.19 133 | # http_access allow jailhost manager 134 | ################################################################################ 135 | 136 | patch -l /usr/local/etc/monitorix.conf << 'EOF' 137 | 55c55 138 | < squid_log = /var/log/squid/access.log 139 | --- 140 | > squid_log = /usr/jails/squid-jail.mydomain.name/var/log/squid/access.log 141 | 82c82 142 | < squid = n 143 | --- 144 | > squid = y 145 | 346c347 146 | < cmd = squidclient -h 127.0.0.1 147 | --- 148 | > cmd = /usr/jails/squid-jail.mydomain.name/usr/local/sbin/squidclient -h 10.100.102.19 149 | 'EOF' 150 | 151 | ################################################################################ 152 | # Configure monitoring BIND 153 | # - Enable monitoring 154 | # - Patch all paths from localhost to the jail's IP address 155 | # 156 | # Note: BIND must be built with the NEWSTATS option and the following config 157 | # must be in the named.conf followed up with a `service named reload`. 158 | # 159 | # statistics-channels { 160 | # inet 127.0.0.1 port 8053; 161 | # }; 162 | ################################################################################ 163 | 164 | patch -l /usr/local/etc/monitorix.conf << 'EOF' 165 | 85c85 166 | < bind = n 167 | --- 168 | > bind = y 169 | 383c383 170 | < list = http://localhost:8053/ 171 | --- 172 | > list = http://10.100.102.15:8053/ 173 | 385c385 174 | < http://localhost:8053/ = A, AAAA, ANY, DS, MX, NS, PTR, SOA, SRV, TXT, NAPTR, A6, CNAME, SPF, KEY, DNSKEY, HINFO, WKS, PX, NSAP 175 | --- 176 | > http://10.100.102.15:8053/ = A, AAAA, ANY, DS, MX, NS, PTR, SOA, SRV, TXT, NAPTR, A6, CNAME, SPF, KEY, DNSKEY, HINFO, WKS, PX, NSAP 177 | 388c388 178 | < http://localhost:8053/ = A, AAAA, ANY, DS, MX, NS, PTR, SOA, SRV, TXT, NAPTR, A6, CNAME, SPF, KEY, DNSKEY, HINFO, WKS, PX, NSAP 179 | --- 180 | > http://10.100.102.15:8053/ = A, AAAA, ANY, DS, MX, NS, PTR, SOA, SRV, TXT, NAPTR, A6, CNAME, SPF, KEY, DNSKEY, HINFO, WKS, PX, NSAP 181 | 391c391 182 | < http://localhost:8053/ = Requestv4, Requestv6, ReqEdns0, ReqBadEDNSVer, ReqTSIG, ReqSIG0, ReqBadSIG, ReqTCP, Response, QrySuccess, QryAuthAns, QryNoauthAns, QryReferral, QryNxrrset, QrySERVFAIL, QryNXDOMAIN, QryRecursion, QryDuplicate, QryDropped, QryFailure 183 | --- 184 | > http://10.100.102.15:8053/ = Requestv4, Requestv6, ReqEdns0, ReqBadEDNSVer, ReqTSIG, ReqSIG0, ReqBadSIG, ReqTCP, Response, QrySuccess, QryAuthAns, QryNoauthAns, QryReferral, QryNxrrset, QrySERVFAIL, QryNXDOMAIN, QryRecursion, QryDuplicate, QryDropped, QryFailure 185 | 394c394 186 | < http://localhost:8053/ = Queryv4, Queryv6, Responsev4, Responsev6, NXDOMAIN, SERVFAIL, FORMERR, OtherError, EDNS0Fail, Truncated, Lame, Retry, QueryTimeout, GlueFetchv4, GlueFetchv6, GlueFetchv4Fail, GlueFetchv6Fail, ValAttempt, ValOk, ValNegOk 187 | --- 188 | > http://10.100.102.15:8053/ = Queryv4, Queryv6, Responsev4, Responsev6, NXDOMAIN, SERVFAIL, FORMERR, OtherError, EDNS0Fail, Truncated, Lame, Retry, QueryTimeout, GlueFetchv4, GlueFetchv6, GlueFetchv4Fail, GlueFetchv6Fail, ValAttempt, ValOk, ValNegOk 189 | 397c397 190 | < http://localhost:8053/ = A, !A, AAAA, !AAAA, DLV, !DLV, DS, !DS, MX, NS, CNAME, !CNAME, SOA, !SOA, !ANY, PTR, RRSIG, NSEC, DNSKEY, NXDOMAIN 191 | --- 192 | > http://10.100.102.15:8053/ = A, !A, AAAA, !AAAA, DLV, !DLV, DS, !DS, MX, NS, CNAME, !CNAME, SOA, !SOA, !ANY, PTR, RRSIG, NSEC, DNSKEY, NXDOMAIN 193 | 'EOF' 194 | 195 | ################################################################################ 196 | # Other personal preferences: 197 | # - Give it a title 198 | # - Turn on show gaps so things like reboots or outages have no data 199 | # - Also change the coloring on those gaps to a light gray rather than white 200 | # - Make detailed graphs bigger 201 | ################################################################################ 202 | 203 | patch -l /usr/local/etc/monitorix.conf << 'EOF' 204 | 6c6 205 | < title = Place a title here 206 | --- 207 | > title = My Monitorix 208 | 15c15 209 | < show_gaps = n 210 | --- 211 | > show_gaps = y 212 | 606c607 213 | < gap = FFFFFF 214 | --- 215 | > gap = 202020 216 | 617c618 217 | < zoom = 800x300 218 | --- 219 | > zoom = 1200x450 220 | 'EOF' 221 | -------------------------------------------------------------------------------- /openvpn-jail-HOWTO: -------------------------------------------------------------------------------- 1 | ################################################################################ 2 | ## OpenVPN Jail Configuration ## 3 | ################################################################################ 4 | # 5 | # OpenVPN works fine once running in a jail. However, I've opted not to continue 6 | # using it like this as there are a few gotchas. I'm using OpenVPN on my LAN's 7 | # router/firewall as things are just easier to manage doing it that way and just 8 | # running as a dedicated user with TLS auth is good enough for me security wise. 9 | # 10 | # Issues to keep in mind: 11 | # - Stopping OpenVPN from inside the jail relinquishes the tunnel's IP. This 12 | # means you have to restart the whole jail from the outside anytime you need 13 | # to restart OpenVPN. 14 | # - Clients have difficulty talking to jails on other FIBs on the same host. 15 | # The traffic leaves the jail to it's gateway only to come right back at the 16 | # host to route to the VPN client. Generally things don't work well. 17 | # - While not bad, it's some extra effort to deal with routes and interface 18 | # configs from the host. 19 | # 20 | # References: 21 | # http://forums.freebsd.org/showthread.php?t=22143 22 | ################################################################################ 23 | 24 | # Prep work on host 25 | # Create tunnel and enable routing 26 | ifconfig tun create 27 | sysctl net.inet.ip.forwarding=1 28 | 29 | # Make tunnel and routing configuration persistent 30 | echo '' >> /etc/rc.conf 31 | echo '# OpenVPN server' >> /etc/rc.conf 32 | echo 'cloned_interfaces="tun"' >> /etc/rc.conf 33 | echo 'gateway_enable="YES"' >> /etc/rc.conf 34 | 35 | # Enable devfs ruleset similar to ezjail default but allowing access to tun0 36 | cat >> /etc/devfs.rules << 'EOF' 37 | 38 | # Rules for VPN jail 39 | # 40 | [devfsrules_jail_with_vpn=5] 41 | add include $devfsrules_hide_all 42 | add include $devfsrules_unhide_basic 43 | add include $devfsrules_unhide_login 44 | add path tun0 unhide 45 | add path zfs unhide 46 | 'EOF' 47 | 48 | # Finally, create vpn jail 49 | ezjail-admin create -f dmz vpn.mydomain.name 192.168.102.19 50 | 51 | # Set to use devfs rules and assign interface IP on jail start 52 | sed -i '' -e 's/devfs_ruleset="4"/devfs_ruleset="5"/' /usr/local/etc/ezjail/vpn_mydomain_name 53 | echo 'export jail_vpn_mydomain_name_exec_prestart0="/sbin/ifconfig tun0 inet 10.100.103.1/32 10.100.103.2"' >> /usr/local/etc/ezjail/vpn_mydomain_name 54 | echo 'export jail_vpn_mydomain_name_exec_prestart1="/sbin/route add -net 10.100.103.0/24 10.100.103.2"' >> /usr/local/etc/ezjail/vpn_mydomain_name 55 | 56 | # Certificate Authority should not be in the jail for security reasons. 57 | # In the case that it's on the host system, copy keys from the host into 58 | # the new jail now. 59 | mkdir -p /usr/jails/vpn.mydomain.name/usr/local/etc/openvpn/keys/ 60 | cp /usr/local/etc/openvpn-ca/keys/vpn.* /usr/jails/vpn.mydomain.name/usr/local/etc/openvpn/keys/ 61 | cp /usr/local/etc/openvpn-ca/keys/ta.key /usr/jails/vpn.mydomain.name/usr/local/etc/openvpn/keys/ 62 | cp /usr/local/etc/openvpn-ca/keys/ca.crt /usr/jails/vpn.mydomain.name/usr/local/etc/openvpn/keys/ 63 | cp /usr/local/etc/openvpn-ca/keys/dh2048.pem /usr/jails/vpn.mydomain.name/usr/local/etc/openvpn/keys/ 64 | 65 | # Finally, actually start the VPN jail to handle configuration there. 66 | ezjail-admin console -f vpn.mydomain.name 67 | passwd 68 | 69 | pkg install bash portmaster tmux vim-lite pstree cmdwatch tree 70 | echo '#WITH_PKGNG=yes #only uncommented on earlier releases than 10' >> /etc/make.conf 71 | echo 'WITH_SSP_PORTS=yes' >> /etc/make.conf 72 | 73 | # OpenVPN installation and configuration 74 | pkg install openvpn 75 | 76 | pw groupadd -n _openvpn -g 1194 77 | pw useradd -n _openvpn -c "OpenVPN daemon,,," -d "/var/empty" -u 1194 -g _openvpn -s /usr/sbin/nologin 78 | 79 | cat > /usr/local/etc/openvpn/openvpn.conf << 'EOF' 80 | port 1194 81 | proto udp 82 | dev tun0 83 | ifconfig-noexec 84 | route-noexec 85 | 86 | server 10.100.103.0 255.255.255.0 87 | push "route 192.168.102.0 255.255.255.0" 88 | push "route 10.100.102.0 255.255.255.0" 89 | # FOR ALL TRAFFIC # push "redirect-gateway def1" 90 | push "dhcp-option DNS 10.100.102.15" 91 | push "dhcp-option DOMAIN mydomain.name" 92 | 93 | ca /usr/local/etc/openvpn/keys/ca.crt 94 | cert /usr/local/etc/openvpn/keys/vpn.mydomain.name.crt 95 | key /usr/local/etc/openvpn/keys/vpn.mydomain.name.key 96 | dh /usr/local/etc/openvpn/keys/dh2048.pem 97 | tls-auth /usr/local/etc/openvpn/keys/ta.key 0 98 | ifconfig-pool-persist /var/tmp/openvpn-pool.txt 99 | 100 | user _openvpn 101 | group _openvpn 102 | comp-lzo 103 | persist-key 104 | persist-tun 105 | keepalive 20 60 106 | cipher AES-256-CBC 107 | verb 3 108 | mute 20 109 | 'EOF' 110 | 111 | # Enable and Start OpenVPN 112 | echo 'openvpn_enable="YES"' >> /etc/rc.conf.local 113 | service openvpn start 114 | -------------------------------------------------------------------------------- /patches/450.status-security: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # $FreeBSD: release/9.1.0/etc/periodic/daily/450.status-security 221432 2011-05-04 12:48:02Z netchild $ 4 | # 5 | # Fixed 2013-05-23 by jason.unovitch@gmail.com 6 | # See http://www.freebsd.org/cgi/query-pr.cgi?pr=178611 7 | 8 | # If there is a global system configuration file, suck it in. 9 | # 10 | if [ -r /etc/defaults/periodic.conf ] 11 | then 12 | . /etc/defaults/periodic.conf 13 | source_periodic_confs 14 | fi 15 | 16 | case "$daily_status_security_enable" in 17 | [Yy][Ee][Ss]) 18 | echo "" 19 | echo "Security check:" 20 | 21 | case "$daily_status_security_inline" in 22 | [Yy][Ee][Ss]) 23 | export security_output="";; 24 | *) 25 | export security_output="${daily_status_security_output}";; 26 | esac 27 | 28 | case "$security_output" in 29 | "") 30 | rc=3;; 31 | /*) 32 | echo " (output logged separately)" 33 | rc=0;; 34 | *) 35 | echo " (output mailed separately)" 36 | rc=0;; 37 | esac 38 | 39 | periodic security || rc=3;; 40 | 41 | *) rc=0;; 42 | esac 43 | 44 | exit $rc 45 | -------------------------------------------------------------------------------- /patches/450.status-security.patch.txt: -------------------------------------------------------------------------------- 1 | --- /root/450.status-security.20130508 2013-05-09 06:09:24.000000000 +0000 2 | +++ /etc/periodic/daily/450.status-security 2013-05-12 05:09:34.000000000 +0000 3 | @@ -20,17 +20,18 @@ 4 | [Yy][Ee][Ss]) 5 | export security_output="";; 6 | *) 7 | - export security_output="${daily_status_security_output}" 8 | - case "${daily_status_security_output}" in 9 | - "") 10 | - rc=3;; 11 | - /*) 12 | - echo " (output logged separately)" 13 | - rc=0;; 14 | - *) 15 | - echo " (output mailed separately)" 16 | - rc=0;; 17 | - esac;; 18 | + export security_output="${daily_status_security_output}";; 19 | + esac 20 | + 21 | + case "$security_output" in 22 | + "") 23 | + rc=3;; 24 | + /*) 25 | + echo " (output logged separately)" 26 | + rc=0;; 27 | + *) 28 | + echo " (output mailed separately)" 29 | + rc=0;; 30 | esac 31 | 32 | periodic security || rc=3;; 33 | -------------------------------------------------------------------------------- /patches/PR182711_serviio-samples-pkg-plist.patch: -------------------------------------------------------------------------------- 1 | --- /root/old-serviio-pkg-plist 2013-10-04 22:33:36.000000000 +0000 2 | +++ /usr/ports/net/serviio/pkg-plist 2013-10-04 22:18:54.000000000 +0000 3 | @@ -41,6 +41,10 @@ 4 | @unexec cmp %D/%%ETCDIR%%/profiles.xml %D/%%ETCDIR%%/profiles.dist.xml && rm -f %D/%%ETCDIR%%/profiles.xml || echo Modified profiles.xml remains in %D/%%ETCDIR%% 5 | @unexec cmp %D/%%ETCDIR%%/log4j.xml %D/%%ETCDIR%%/log4j.dist.xml && rm -f %D/%%ETCDIR%%/log4j.xml || echo Modified log4j.xml remains in %D/%%ETCDIR%% 6 | @unexec cmp %D/%%ETCDIR%%/console-log4j.properties %D/%%ETCDIR%%/console-log4j.dist.properties && rm -f %D/%%ETCDIR%%/console-log4j.properties || echo Modified console-log4j.properties remains in %D/%%ETCDIR%% 7 | +@exec [ -f %D/%%ETCDIR%%/application-profiles.xml ] || cp -v %D/%%ETCDIR%%/application-profiles.dist.xml %D/%%ETCDIR%%/application-profiles.xml 8 | +@exec [ -f %D/%%ETCDIR%%/profiles.xml ] || cp -v %D/%%ETCDIR%%/profiles.dist.xml %D/%%ETCDIR%%/profiles.xml 9 | +@exec [ -f %D/%%ETCDIR%%/log4j.xml ] || cp -v %D/%%ETCDIR%%/log4j.dist.xml %D/%%ETCDIR%%/log4j.xml 10 | +@exec [ -f %D/%%ETCDIR%%/console-log4j.properties ] || cp -v %D/%%ETCDIR%%/console-log4j.dist.properties %D/%%ETCDIR%%/console-log4j.properties 11 | %%ETCDIR%%/profiles.dist.xml 12 | %%ETCDIR%%/log4j.dist.xml 13 | %%ETCDIR%%/application-profiles.dist.xml 14 | -------------------------------------------------------------------------------- /patches/PR188020_isc-dhcp-server.diff: -------------------------------------------------------------------------------- 1 | Index: isc-dhcp41-server/Makefile 2 | =================================================================== 3 | --- isc-dhcp41-server/Makefile (revision 349587) 4 | +++ isc-dhcp41-server/Makefile (working copy) 5 | @@ -119,6 +119,9 @@ 6 | 7 | .if ${PORT_OPTIONS:MPARANOIA} 8 | CONFIGURE_ARGS+= --enable-paranoia --enable-early-chroot 9 | +SUB_LIST+= PARANOIA=yes 10 | +.else 11 | +SUB_LIST+= PARANOIA=no 12 | .endif 13 | 14 | .if ${PORT_OPTIONS:MIPV6} 15 | Index: isc-dhcp42-server/Makefile 16 | =================================================================== 17 | --- isc-dhcp42-server/Makefile (revision 349587) 18 | +++ isc-dhcp42-server/Makefile (working copy) 19 | @@ -91,6 +91,9 @@ 20 | 21 | .if ${PORT_OPTIONS:MPARANOIA} 22 | CONFIGURE_ARGS+=--enable-paranoia --enable-early-chroot 23 | +SUB_LIST+= PARANOIA=yes 24 | +.else 25 | +SUB_LIST+= PARANOIA=no 26 | .endif 27 | 28 | .if ${PORT_OPTIONS:MLDAP} 29 | Index: isc-dhcp43-server/Makefile 30 | =================================================================== 31 | --- isc-dhcp43-server/Makefile (revision 349587) 32 | +++ isc-dhcp43-server/Makefile (working copy) 33 | @@ -91,6 +91,9 @@ 34 | 35 | .if ${PORT_OPTIONS:MPARANOIA} 36 | CONFIGURE_ARGS+=--enable-paranoia --enable-early-chroot 37 | +SUB_LIST+= PARANOIA=yes 38 | +.else 39 | +SUB_LIST+= PARANOIA=no 40 | .endif 41 | 42 | .if ${PORT_OPTIONS:MLDAP} 43 | -------------------------------------------------------------------------------- /patches/PR196839_epair.4.diff: -------------------------------------------------------------------------------- 1 | Index: share/man/man4/epair.4 2 | =================================================================== 3 | --- share/man/man4/epair.4 (revision 276952) 4 | +++ share/man/man4/epair.4 (working copy) 5 | @@ -89,9 +89,9 @@ 6 | To change the default addresses one may use the SIOCSIFADDR ioctl(2) or 7 | ifconfig(8) utility. 8 | .Pp 9 | -The basic intend is to provide connectivity between two virtual 10 | +The basic intent is to provide connectivity between two virtual 11 | network stack instances. 12 | -When connected to a 13 | +When connected to an 14 | .Xr if_bridge 4 15 | one end of the interface pair can also be part of another (virtual) LAN. 16 | As with any other Ethernet interface one can configure 17 | -------------------------------------------------------------------------------- /patches/PR197150_fluxbox-1.3.6_1.diff: -------------------------------------------------------------------------------- 1 | Index: Makefile 2 | =================================================================== 3 | --- Makefile (revision 378189) 4 | +++ Makefile (working copy) 5 | @@ -3,6 +3,7 @@ 6 | 7 | PORTNAME= fluxbox 8 | PORTVERSION= 1.3.6 9 | +PORTREVISION= 1 10 | CATEGORIES= x11-wm 11 | MASTER_SITES= SF 12 | DISTFILES= ${PORTNAME}-${PORTVERSION}${EXTRACT_SUFX} 13 | Index: files/patch-src_FbTk_TextButton.cc 14 | =================================================================== 15 | --- files/patch-src_FbTk_TextButton.cc (revision 0) 16 | +++ files/patch-src_FbTk_TextButton.cc (working copy) 17 | @@ -0,0 +1,21 @@ 18 | +--- src/FbTk/TextButton.cc.orig 2013-06-17 11:38:14 UTC 19 | ++++ src/FbTk/TextButton.cc 20 | +@@ -143,11 +143,17 @@ void TextButton::drawText(int x_offset, 21 | + unsigned int textlen = visual.size(); 22 | + unsigned int button_width = width(); 23 | + unsigned int button_height = height(); 24 | ++ const int max_width = static_cast(button_width) - x_offset - 25 | ++ m_left_padding - m_right_padding; 26 | ++ 27 | ++ if (max_width <= bevel()) { 28 | ++ return; 29 | ++ } 30 | + 31 | + translateSize(m_orientation, button_width, button_height); 32 | + 33 | + // horizontal alignment, cut off text if needed 34 | +- int align_x = FbTk::doAlignment(button_width - x_offset - m_left_padding - m_right_padding, 35 | ++ int align_x = FbTk::doAlignment(max_width, 36 | + bevel(), justify(), font(), 37 | + visual.data(), visual.size(), 38 | + textlen); // return new text len 39 | 40 | Property changes on: files/patch-src_FbTk_TextButton.cc 41 | ___________________________________________________________________ 42 | Added: svn:mime-type 43 | ## -0,0 +1 ## 44 | +text/plain 45 | \ No newline at end of property 46 | Added: fbsd:nokeywords 47 | ## -0,0 +1 ## 48 | +yes 49 | \ No newline at end of property 50 | Added: svn:eol-style 51 | ## -0,0 +1 ## 52 | +native 53 | \ No newline at end of property 54 | -------------------------------------------------------------------------------- /patches/PR197693_fluxbox-1.3.7.diff: -------------------------------------------------------------------------------- 1 | Index: Makefile 2 | =================================================================== 3 | --- Makefile (revision 378756) 4 | +++ Makefile (working copy) 5 | @@ -2,8 +2,7 @@ 6 | # $FreeBSD$ 7 | 8 | PORTNAME= fluxbox 9 | -PORTVERSION= 1.3.6 10 | -PORTREVISION= 1 11 | +PORTVERSION= 1.3.7 12 | CATEGORIES= x11-wm 13 | MASTER_SITES= SF 14 | DISTFILES= ${PORTNAME}-${PORTVERSION}${EXTRACT_SUFX} 15 | Index: distinfo 16 | =================================================================== 17 | --- distinfo (revision 378756) 18 | +++ distinfo (working copy) 19 | @@ -1,5 +1,5 @@ 20 | -SHA256 (fluxbox-1.3.6.tar.gz) = cb54eb62d3dba2f282a50fbdd077d26a2c9f555c12b5bf664b1192ece7669527 21 | -SIZE (fluxbox-1.3.6.tar.gz) = 1312141 22 | +SHA256 (fluxbox-1.3.7.tar.gz) = c99e2baa06fff1e96342b20415059d12ff1fa2917ade0173c75b2fa570295b9f 23 | +SIZE (fluxbox-1.3.7.tar.gz) = 1267833 24 | SHA256 (fb-doc-mfhtml-20060629.tgz) = 98d37b73dbb1caf1361b098bffc69d1f365f9b324a71f622ba72ed5da5d9b9ec 25 | SIZE (fb-doc-mfhtml-20060629.tgz) = 115560 26 | SHA256 (fluxbook-20060629.pdf) = 8f225b101e9ab81543182c83699aeef3fe86370d72da215831321c903eee9cde 27 | Index: files/patch-src__FbTk__TextButton.cc 28 | =================================================================== 29 | --- files/patch-src__FbTk__TextButton.cc (revision 378756) 30 | +++ files/patch-src__FbTk__TextButton.cc (working copy) 31 | @@ -1,21 +0,0 @@ 32 | ---- src/FbTk/TextButton.cc 2015-01-28 11:12:27.000000000 +0200 33 | -+++ src/FbTk/TextButton.cc 2015-01-28 11:14:03.000000000 +0200 34 | -@@ -143,11 +143,17 @@ 35 | - unsigned int textlen = visual.size(); 36 | - unsigned int button_width = width(); 37 | - unsigned int button_height = height(); 38 | -+ const int max_width = static_cast(button_width) - x_offset - 39 | -+ m_left_padding - m_right_padding; 40 | -+ 41 | -+ if (max_width <= bevel()) { 42 | -+ return; 43 | -+ } 44 | - 45 | - translateSize(m_orientation, button_width, button_height); 46 | - 47 | - // horizontal alignment, cut off text if needed 48 | -- int align_x = FbTk::doAlignment(button_width - x_offset - m_left_padding - m_right_padding, 49 | -+ int align_x = FbTk::doAlignment(max_width, 50 | - bevel(), justify(), font(), 51 | - visual.data(), visual.size(), 52 | - textlen); // return new text len 53 | Index: files/patch-src__fluxbox.cc 54 | =================================================================== 55 | --- files/patch-src__fluxbox.cc (revision 378756) 56 | +++ files/patch-src__fluxbox.cc (working copy) 57 | @@ -1,6 +1,6 @@ 58 | ---- ./src/fluxbox.cc.orig 2013-02-13 10:04:05.899812000 +0000 59 | -+++ ./src/fluxbox.cc 2013-09-20 15:41:23.584087389 +0000 60 | -@@ -1355,7 +1355,7 @@ 61 | +--- src/fluxbox.cc.orig 2015-02-08 10:44:45 UTC 62 | ++++ src/fluxbox.cc 63 | +@@ -1316,7 +1316,7 @@ void Fluxbox::revertFocus() { 64 | FocusControl::setFocusedWindow(0); 65 | } 66 | 67 | Index: files/patch-src__fluxbox.hh 68 | =================================================================== 69 | --- files/patch-src__fluxbox.hh (revision 378756) 70 | +++ files/patch-src__fluxbox.hh (working copy) 71 | @@ -1,11 +1,11 @@ 72 | ---- ./src/fluxbox.hh.orig 2013-02-13 10:04:05.899812000 +0000 73 | -+++ ./src/fluxbox.hh 2013-09-20 15:41:23.585087645 +0000 74 | -@@ -88,7 +88,7 @@ 75 | - /// main event loop 76 | - void eventLoop(); 77 | +--- src/fluxbox.hh.orig 2015-02-08 10:44:45 UTC 78 | ++++ src/fluxbox.hh 79 | +@@ -103,7 +103,7 @@ public: 80 | + WinClient *searchWindow(Window); 81 | + BScreen *searchScreen(Window w); 82 | bool validateWindow(Window win) const; 83 | - bool validateClient(const WinClient *client) const; 84 | + bool validateClient(WinClient *client) const; 85 | 86 | - void grab(); 87 | - void ungrab(); 88 | + // Not currently implemented until we decide how it'll be used 89 | + //WinClient *searchGroup(Window); 90 | Index: files/patch-util__fluxbox-generate_menu.in 91 | =================================================================== 92 | --- files/patch-util__fluxbox-generate_menu.in (revision 378756) 93 | +++ files/patch-util__fluxbox-generate_menu.in (working copy) 94 | @@ -1,6 +1,6 @@ 95 | ---- util/fluxbox-generate_menu.in.orig 2012-12-10 18:26:53.000000000 +0100 96 | -+++ util/fluxbox-generate_menu.in 2013-01-02 14:22:14.000000000 +0100 97 | -@@ -68,7 +68,7 @@ 98 | +--- util/fluxbox-generate_menu.in.orig 2015-02-08 10:44:45 UTC 99 | ++++ util/fluxbox-generate_menu.in 100 | +@@ -68,7 +68,7 @@ Options: 101 | -d Other path(s) to recursively search for *.desktop files 102 | -ds Wider search for *.desktop files (takes more time) 103 | -i Other path(s) to search for icons 104 | @@ -9,7 +9,7 @@ 105 | -is Wider search for icons (worth the extra time) 106 | -in Skip icon search 107 | 108 | -@@ -85,7 +85,7 @@ 109 | +@@ -85,7 +85,7 @@ Options: 110 | Only for packagers: 111 | 112 | -p Prefix; default is @PREFIX@ 113 | @@ -18,7 +18,7 @@ 114 | -q KDE-prefix; idem dito 115 | 116 | 117 | -@@ -145,13 +145,42 @@ 118 | +@@ -145,13 +145,42 @@ testoption() { 119 | esac 120 | } 121 | 122 | @@ -67,7 +67,7 @@ 123 | 124 | #echo "replaceWithinString: $1, $2, $3" >&2 125 | #echo ${1//$2/$3} # causes error in BSD even though not used 126 | -@@ -203,7 +232,7 @@ 127 | +@@ -203,7 +232,7 @@ convertIcon(){ 128 | if [ -f "${entry_icon}" ]; then 129 | : echo "File exists. To overwrite, type: convert \"$1\" \"$entry_icon\"" >&2 130 | else 131 | @@ -76,7 +76,7 @@ 132 | convert "$1" "$entry_icon" 133 | # echo convert "$1" , "$entry_icon" >> $ICONMAPPING 134 | else 135 | -@@ -275,7 +304,7 @@ 136 | +@@ -275,7 +304,7 @@ doSearch(){ 137 | # echo -n "for $temp_icon" 138 | eval doSearchLoop $USER_ICONPATHS \ 139 | "$FB_ICONDIR" \ 140 | @@ -85,7 +85,7 @@ 141 | ${OTHER_ICONPATHS} \ 142 | 143 | 144 | -@@ -558,7 +587,7 @@ 145 | +@@ -558,7 +587,7 @@ rm -f ${MENUFILENAME}.tmp 146 | 147 | 148 | WHOAMI=`whoami` 149 | @@ -94,7 +94,7 @@ 150 | 151 | # Check for Imlib2-support 152 | if @pkgprefix@fluxbox@pkgsuffix@@EXEEXT@ -info 2> /dev/null | grep -q "^IMLIB"; then 153 | -@@ -1271,16 +1300,16 @@ 154 | +@@ -1271,16 +1300,16 @@ if [ ! "${INSTALL}" = Yes ]; then 155 | # These are prefixes; So if fluxbox is installed in @PREFIX@/bin/fluxbox 156 | # your prefix is: @PREFIX@ 157 | 158 | @@ -115,7 +115,7 @@ 159 | 160 | 161 | # --- Boolean variables. 162 | -@@ -1327,29 +1356,21 @@ 163 | +@@ -1327,29 +1356,21 @@ while [ $# -gt 0 ]; do 164 | -g) GNOMEMENU=yes; shift;; 165 | -in) NO_ICON=yes; shift;; 166 | -is) OTHER_ICONPATHS=" 167 | @@ -157,7 +157,7 @@ 168 | " 169 | # /usr/share/apps \ 170 | shift;; 171 | -@@ -1420,13 +1441,12 @@ 172 | +@@ -1420,13 +1441,12 @@ fi 173 | # prefix 174 | PREFIX="${PREFIX:=@PREFIX@}" 175 | if [ -z "${PREFIX}" -o ! -d "${PREFIX}" ]; then 176 | @@ -173,7 +173,7 @@ 177 | if [ -n "${GNOME_PREFIX}" -a -d "$GNOME_PREFIX/share/gnome" ]; then 178 | break; 179 | fi 180 | -@@ -1434,7 +1454,7 @@ 181 | +@@ -1434,7 +1454,7 @@ done 182 | # Will remain $PREFIX if all else fails 183 | 184 | # kde prefix 185 | @@ -182,38 +182,28 @@ 186 | if [ -n "${KDE_PREFIX}" -a -d "$KDE_PREFIX/share/applnk" ]; then 187 | break; 188 | fi 189 | -@@ -1522,7 +1542,7 @@ 190 | +@@ -1522,7 +1542,7 @@ if find_it_options $MY_BROWSER; then 191 | else 192 | [ -n "$MY_BROWSER" ] && echo "Warning: you chose an invalid browser." >&2 193 | #The precise order is up for debate. 194 | -- for browser in firefox mozilla-firefox mozilla-firebird MozillaFirebird opera skipstone mozilla seamonkey galeon konqueror dillo netscape w3m amaya links lynx; do 195 | -+ for browser in chrome firefox mozilla-firefox mozilla-firebird MozillaFirebird linux-opera opera skipstone mozilla seamonkey galeon konqueror dillo netscape w3m amaya links lynx; do 196 | +- for browser in firefox mozilla-firefox chrome chromium google-chrome mozilla-firebird MozillaFirebird opera skipstone mozilla seamonkey galeon konqueror dillo netscape w3m amaya links lynx; do 197 | ++ for browser in firefox mozilla-firefox chrome chromium google-chrome mozilla-firebird MozillaFirebird linux-opera opera skipstone mozilla seamonkey galeon konqueror dillo netscape w3m amaya links lynx; do 198 | if find_it_options $browser; then 199 | DEFAULT_BROWSER=$browser 200 | break 201 | -@@ -1581,9 +1601,10 @@ 202 | - 203 | - case "$DEFAULT_BROWSERNAME" in 204 | - links|w3m|lynx) append "[exec] (${DEFAULT_BROWSERNAME}) {${DEFAULT_TERM} -e ${DEFAULT_BROWSER} ${HOMEPAGE}}" ;; 205 | -- firefox|firebird|mozilla|seamonkey|phoenix|galeon|dillo|netscape|amaya) append "[exec] (${DEFAULT_BROWSERNAME}) {${DEFAULT_BROWSER}}" ;; 206 | -+ chrome|firefox|firebird|mozilla|seamonkey|phoenix|galeon|dillo|netscape|amaya) append "[exec] (${DEFAULT_BROWSERNAME}) {${DEFAULT_BROWSER}}" ;; 207 | +@@ -1589,6 +1609,7 @@ case "$DEFAULT_BROWSERNAME" in 208 | + chrome|chromium) append "[exec] (${DEFAULT_BROWSERNAME}) {${DEFAULT_BROWSER}}" ;; 209 | + google-chrome) append "[exec] (${DEFAULT_BROWSERNAME}) {${DEFAULT_BROWSER}}" ;; 210 | konqueror) append "[exec] (konqueror) {kfmclient openProfile webbrowsing}" ;; 211 | -- opera) append "[exec] (opera) {env QT_XFT=true opera}" ;; 212 | -+ linux-opera) append "[exec] (linux-opera) {linux-opera}" ;; 213 | -+ opera) append "[exec] (opera) {opera}" ;; 214 | ++ linux-opera) append "[exec] (linux-opera) {env QT_XFT=true linux-opera}" ;; 215 | + opera) append "[exec] (opera) {env QT_XFT=true opera}" ;; 216 | MozillaFirebird) append "[exec] (firebird) {MozillaFirebird}" ;; 217 | MozillaFirefox) append "[exec] (firefox) {MozillaFirefox}" ;; 218 | - *) append "[exec] ($DEFAULT_BROWSERNAME) {$DEFAULT_BROWSER}" ;; 219 | -@@ -1600,9 +1621,10 @@ 220 | - 221 | - append_submenu "${NETMENU}" 222 | +@@ -1608,6 +1629,7 @@ append_submenu "${NETMENU}" 223 | append_submenu "${BROWSERMENU}" 224 | -- normal_find firefox mozilla-firefox MozillaFirefox galeon mozilla seamonkey dillo netscape vncviewer 225 | -+ normal_find chrome firefox mozilla-firefox MozillaFirefox galeon mozilla seamonkey dillo netscape vncviewer 226 | + normal_find chrome chromium firefox google-chrome mozilla-firefox MozillaFirefox galeon mozilla seamonkey dillo netscape vncviewer 227 | find_it links append "[exec] (links-graphic) {links -driver x ${HOMEPAGE}}" 228 | -- find_it opera append "[exec] (opera) {env QT_XFT=true opera}" 229 | -+ find_it linux-opera append "[exec] (linux-opera) {linux-opera}" 230 | -+ find_it opera append "[exec] (opera) {opera}" 231 | ++ find_it linux-opera append "[exec] (linux-opera) {env QT_XFT=true opera}" 232 | + find_it opera append "[exec] (opera) {env QT_XFT=true opera}" 233 | find_it konqueror append "[exec] (konqueror) {kfmclient openProfile webbrowsing}" 234 | find_it links append "[exec] (links) {${DEFAULT_TERM} -e links ${HOMEPAGE}}" 235 | - find_it w3m append "[exec] (w3m) {${DEFAULT_TERM} -e w3m ${HOMEPAGE}}" 236 | -------------------------------------------------------------------------------- /patches/PR198021_serviio-1.5_1.diff: -------------------------------------------------------------------------------- 1 | Index: Makefile 2 | =================================================================== 3 | --- Makefile (revision 379854) 4 | +++ Makefile (working copy) 5 | @@ -3,7 +3,7 @@ 6 | 7 | PORTNAME= serviio 8 | PORTVERSION= 1.5 9 | -#PORTREVISION= 0 10 | +PORTREVISION= 1 11 | CATEGORIES= net multimedia java www 12 | MASTER_SITES= http://download.serviio.org/releases/ 13 | EXTRACT_SUFX= -linux.tar.gz 14 | Index: files/serviiod.in 15 | =================================================================== 16 | --- files/serviiod.in (revision 379854) 17 | +++ files/serviiod.in (working copy) 18 | @@ -19,6 +19,7 @@ 19 | # Setup Serviio specific properties 20 | JAVA_OPTS="-Djava.net.preferIPv4Stack=true -Djava.awt.headless=true -Dorg.restlet.engine.loggerFacadeClass=org.restlet.ext.slf4j.Slf4jLoggerFacade -Dderby.system.home=/var/db/serviio -Dserviio.home=$HOME -Dffmpeg.location=%%LOCALBASE%%/bin/ffmpeg -Ddcraw.location=%%LOCALBASE%%/bin/dcraw" 21 | JAVA_OPTS="${JAVA_OPTS} -Djcs.auxiliary.DC.attributes.DiskPath=/var/db/serviio" 22 | +JAVA_VERSION="1.8+" 23 | 24 | # A kludge to get the -D... flags to Java, rather than to Serviio itself: 25 | for o in "$@" 26 | @@ -31,5 +32,5 @@ 27 | done 28 | 29 | # Execute the JVM in the foreground 30 | -export HOME PATH 31 | +export HOME PATH JAVA_VERSION 32 | exec java -Xmx512M -Xms20M -XX:+UseG1GC -XX:GCTimeRatio=1 -XX:MinHeapFreeRatio=10 -XX:MaxHeapFreeRatio=20 $JAVA_OPTS -classpath "$SERVIIO_CLASS_PATH" org.serviio.MediaServer "$@" 2>&1 >/dev/null 33 | -------------------------------------------------------------------------------- /patches/PR198210_py27-radicale-0.8_2.diff: -------------------------------------------------------------------------------- 1 | Index: Makefile 2 | =================================================================== 3 | --- Makefile (revision 380313) 4 | +++ Makefile (working copy) 5 | @@ -3,7 +3,7 @@ 6 | 7 | PORTNAME= radicale 8 | PORTVERSION= 0.8 9 | -PORTREVISION= 1 10 | +PORTREVISION= 2 11 | CATEGORIES= www python 12 | MASTER_SITES= CHEESESHOP 13 | PKGNAMEPREFIX= ${PYTHON_PKGNAMEPREFIX} 14 | @@ -34,7 +34,7 @@ 15 | .endif 16 | 17 | .if ${PORT_OPTIONS:MHTTP} 18 | -RUN_DEPENDS+= ${PYTHON_PKGNAMEPREFIX}requests1>=0:${PORTSDIR}/www/py-requests1 19 | +RUN_DEPENDS+= ${PYTHON_PKGNAMEPREFIX}requests1>=0:${PORTSDIR}/www/py-requests1 20 | .endif 21 | 22 | .if ${PORT_OPTIONS:MLDAP} 23 | @@ -47,6 +47,7 @@ 24 | 25 | post-install: 26 | ${MKDIR} ${STAGEDIR}/${ETCDIR} 27 | + ${MKDIR} ${STAGEDIR}/${DATADIR} 28 | ${INSTALL_DATA} ${WRKSRC}/config ${STAGEDIR}/${ETCDIR}/config.sample 29 | ${INSTALL_DATA} ${WRKSRC}/logging ${STAGEDIR}/${ETCDIR}/logging.sample 30 | 31 | Index: pkg-plist 32 | =================================================================== 33 | --- pkg-plist (revision 380313) 34 | +++ pkg-plist (working copy) 35 | @@ -1,6 +1,6 @@ 36 | bin/radicale 37 | -%%ETCDIR%%/config.sample 38 | -%%ETCDIR%%/logging.sample 39 | +@sample %%ETCDIR%%/config.sample 40 | +@sample %%ETCDIR%%/logging.sample 41 | %%PYTHON_LIBDIR%%/site-packages/radicale/__init__.py 42 | %%PYTHON_LIBDIR%%/site-packages/radicale/__init__.pyc 43 | %%PYTHON_LIBDIR%%/site-packages/radicale/__init__.pyo 44 | @@ -61,11 +61,4 @@ 45 | %%PYTHON_LIBDIR%%/site-packages/radicale/xmlutils.py 46 | %%PYTHON_LIBDIR%%/site-packages/radicale/xmlutils.pyc 47 | %%PYTHON_LIBDIR%%/site-packages/radicale/xmlutils.pyo 48 | -@dirrmtry %%ETCDIR%% 49 | -@dirrm %%PYTHON_LIBDIR%%/site-packages/radicale 50 | -@dirrm %%PYTHON_LIBDIR%%/site-packages/radicale/auth 51 | -@dirrm %%PYTHON_LIBDIR%%/site-packages/radicale/rights 52 | -@dirrm %%PYTHON_LIBDIR%%/site-packages/radicale/storage 53 | -@dirrmtry %%PYTHON_LIBDIR%%/site-packages 54 | -@dirrmtry %%PYTHON_LIBDIR%% 55 | -@exec /usr/bin/install -d -o radicale %%DATADIR%% 56 | +@dir(radicale,radicale,0755) %%DATADIR%% 57 | -------------------------------------------------------------------------------- /patches/PR198297_davmail-4.6.1.diff: -------------------------------------------------------------------------------- 1 | Index: mail/davmail/Makefile 2 | =================================================================== 3 | --- mail/davmail/Makefile (revision 387127) 4 | +++ mail/davmail/Makefile (working copy) 5 | @@ -2,7 +2,7 @@ 6 | # $FreeBSD$ 7 | 8 | PORTNAME= davmail 9 | -PORTVERSION= 4.5.1 10 | +PORTVERSION= 4.6.1 11 | CATEGORIES= mail java 12 | MASTER_SITES= SF/davmail/davmail/${PORTVERSION} 13 | DISTNAME= ${PORTNAME}-src-${PORTVERSION}-${REVISION} 14 | @@ -14,11 +14,12 @@ 15 | 16 | USES= dos2unix tar:tgz 17 | DOS2UNIX_FILES= build.xml 18 | +NO_ARCH= yes 19 | USE_ANT= yes 20 | USE_JAVA= yes 21 | JAVA_VERSION= 1.6+ 22 | ALL_TARGET= release 23 | -REVISION= 2303 24 | +REVISION= 2343 25 | # port build number, same as on DISTNAME 26 | MAKE_ARGS= -Drevision=${REVISION} 27 | MAKE_ENV+= "ANT_OPTS=-Dfile.encoding=UTF-8" 28 | @@ -46,9 +47,9 @@ 29 | -not -name "*.rpm" \ 30 | -not -name "*.desktop" \ 31 | -exec ${INSTALL_DATA} \{} ${STAGEDIR}${DATADIR}/\{} \; 32 | - @${INSTALL_SCRIPT} ${WRKDIR}/davmail.sh ${STAGEDIR}${PREFIX}/bin/davmail 33 | - @${INSTALL_DATA} ${WRKSRC}/src/etc/davmail.properties \ 34 | + ${INSTALL_SCRIPT} ${WRKDIR}/davmail.sh ${STAGEDIR}${PREFIX}/bin/davmail 35 | + ${INSTALL_DATA} ${WRKSRC}/src/etc/davmail.properties \ 36 | ${STAGEDIR}${PREFIX}/etc/davmail.properties.sample 37 | - @${INSTALL_DATA} ${WRKSRC}/dist/davmail.desktop ${STAGEDIR}${PREFIX}/share/applications/ 38 | + ${INSTALL_DATA} ${WRKSRC}/dist/davmail.desktop ${STAGEDIR}${PREFIX}/share/applications/ 39 | 40 | .include 41 | Index: mail/davmail/distinfo 42 | =================================================================== 43 | --- mail/davmail/distinfo (revision 387127) 44 | +++ mail/davmail/distinfo (working copy) 45 | @@ -1,2 +1,2 @@ 46 | -SHA256 (davmail-src-4.5.1-2303.tgz) = 2621a5cbc81c06d0345ec05c93664a052e2e9d2d2bfda8e731a8fb94fd70f752 47 | -SIZE (davmail-src-4.5.1-2303.tgz) = 22670415 48 | +SHA256 (davmail-src-4.6.1-2343.tgz) = 1e6f5c88469416276fd7301990ddaa048dd177eb90e3348ae8d54b22df38997e 49 | +SIZE (davmail-src-4.6.1-2343.tgz) = 22659201 50 | Index: mail/davmail/files/patch-build.xml 51 | =================================================================== 52 | --- mail/davmail/files/patch-build.xml (revision 387127) 53 | +++ mail/davmail/files/patch-build.xml (working copy) 54 | @@ -1,6 +1,6 @@ 55 | ---- build.xml.orig 2013-04-23 16:50:41.883412959 +0200 56 | -+++ build.xml 2013-04-23 16:51:32.230415374 +0200 57 | -@@ -58,7 +58,7 @@ 58 | +--- build.xml.orig 2015-05-23 02:27:12 UTC 59 | ++++ build.xml 60 | +@@ -59,7 +59,7 @@ 61 | 62 | 63 | 64 | @@ -9,3 +9,14 @@ 65 | 66 | 67 | 68 | Index: mail/davmail/files/patch-src__etc__davmail.properties 69 | =================================================================== 70 | --- mail/davmail/files/patch-src__etc__davmail.properties (revision 387127) 71 | +++ mail/davmail/files/patch-src__etc__davmail.properties (working copy) 72 | @@ -1,11 +0,0 @@ 73 | ---- src/etc/davmail.properties.orig 2014-06-03 18:17:10.000000000 -0400 74 | -+++ src/etc/davmail.properties 2014-06-10 18:06:05.000000000 -0400 75 | -@@ -58,7 +58,7 @@ 76 | - davmail.disableUpdateCheck=false 77 | - 78 | - # Send keepalive character during large folder and messages download 79 | --davmail.enableKeepalive=false 80 | -+davmail.enableKeepAlive=false 81 | - # Message count limit on folder retrieval 82 | - davmail.folderSizeLimit=0 83 | - # Default windows domain for NTLM and basic authentication 84 | Index: mail/davmail/pkg-plist 85 | =================================================================== 86 | --- mail/davmail/pkg-plist (revision 387127) 87 | +++ mail/davmail/pkg-plist (working copy) 88 | @@ -14,6 +14,7 @@ 89 | %%JAVASHAREDIR%%/davmail/DavMail.app/Contents/Java/jcifs-1.3.14.jar 90 | %%JAVASHAREDIR%%/davmail/DavMail.app/Contents/Java/jdom-1.0.jar 91 | %%JAVASHAREDIR%%/davmail/DavMail.app/Contents/Java/libgrowl-0.2.jar 92 | +%%JAVASHAREDIR%%/davmail/DavMail.app/Contents/Java/libgrowl.jnilib 93 | %%JAVASHAREDIR%%/davmail/DavMail.app/Contents/Java/log4j-1.2.16.jar 94 | %%JAVASHAREDIR%%/davmail/DavMail.app/Contents/Java/mail-1.4.3.jar 95 | %%JAVASHAREDIR%%/davmail/DavMail.app/Contents/Java/slf4j-api-1.3.1.jar 96 | @@ -24,8 +25,6 @@ 97 | %%JAVASHAREDIR%%/davmail/DavMail.app/Contents/Java/xercesImpl-2.8.1.jar 98 | %%JAVASHAREDIR%%/davmail/DavMail.app/Contents/MacOS/davmail 99 | %%JAVASHAREDIR%%/davmail/DavMail.app/Contents/MacOS/libgrowl.jnilib 100 | -%%JAVASHAREDIR%%/davmail/DavMail.app/Contents/PkgInfo 101 | -%%JAVASHAREDIR%%/davmail/DavMail.app/Contents/Resources/en.lproj/Localizable.strings 102 | %%JAVASHAREDIR%%/davmail/DavMail.app/Contents/Resources/tray.icns 103 | %%JAVASHAREDIR%%/davmail/davmail.jar 104 | %%JAVASHAREDIR%%/davmail/davmail.png 105 | -------------------------------------------------------------------------------- /patches/PR198297_davmail_vuxml.diff: -------------------------------------------------------------------------------- 1 | Index: security/vuxml/vuln.xml 2 | =================================================================== 3 | --- security/vuxml/vuln.xml (revision 387127) 4 | +++ security/vuxml/vuln.xml (working copy) 5 | @@ -57,6 +57,34 @@ 6 | 7 | --> 8 | 9 | + 10 | + davmail -- fix potential CVE-2014-3566 vulnerability (POODLE) 11 | + 12 | + 13 | + davmail 14 | + 4.6.0 15 | + 16 | + 17 | + 18 | + 19 | +

Mickaël Guessant reports:

20 | +
21 | +

DavMail 4.6.0 released

22 | +

Enhancements: Fix potential CVE-2014-3566 vulnerability.

23 | +
24 | + 25 | + 26 | + 27 | + http://sourceforge.net/p/davmail/mailman/message/33279118/ 28 | + http://sourceforge.net/p/davmail/code/2322/ 29 | + CVE-2014-3566 30 | + 31 | + 32 | + 2014-10-27 33 | + 2015-05-23 34 | + 35 | + 36 | + 37 | 38 | dnsmasq -- remotely exploitable buffer overflow in release candidate 39 | 40 | -------------------------------------------------------------------------------- /patches/PR198571_lldpd-0.7.13_1.diff: -------------------------------------------------------------------------------- 1 | Index: Makefile 2 | =================================================================== 3 | --- Makefile (revision 381237) 4 | +++ Makefile (working copy) 5 | @@ -3,6 +3,7 @@ 6 | 7 | PORTNAME= lldpd 8 | PORTVERSION= 0.7.13 9 | +PORTREVISION= 1 10 | CATEGORIES= net-mgmt 11 | MASTER_SITES= http://media.luffy.cx/files/${PORTNAME}/ 12 | 13 | Index: files/lldpd.in 14 | =================================================================== 15 | --- files/lldpd.in (revision 381237) 16 | +++ files/lldpd.in (working copy) 17 | @@ -27,6 +27,4 @@ 18 | command=%%PREFIX%%/sbin/${name} 19 | pidfile=/var/run/${name}.pid 20 | 21 | -command_args=${lldpd_flags} 22 | - 23 | run_rc_command "$1" 24 | -------------------------------------------------------------------------------- /patches/PR198882_php55-5.5.23.diff: -------------------------------------------------------------------------------- 1 | Index: Makefile 2 | =================================================================== 3 | --- Makefile (revision 382444) 4 | +++ Makefile (working copy) 5 | @@ -2,7 +2,7 @@ 6 | # $FreeBSD$ 7 | 8 | PORTNAME= php55 9 | -PORTVERSION= 5.5.22 10 | +PORTVERSION= 5.5.23 11 | PORTREVISION?= 0 12 | CATEGORIES?= lang devel www 13 | MASTER_SITES= ${MASTER_SITE_PHP} 14 | Index: distinfo 15 | =================================================================== 16 | --- distinfo (revision 382444) 17 | +++ distinfo (working copy) 18 | @@ -1,4 +1,4 @@ 19 | -SHA256 (php-5.5.22.tar.bz2) = c218c184bef2905bc79fcdda6040f3d1738261395fb706396935d1c6f6e162bb 20 | -SIZE (php-5.5.22.tar.bz2) = 13305486 21 | +SHA256 (php-5.5.23.tar.bz2) = a99ab264dcd40181baa9defeaa4b21eb2c20d4e9316b904cc05f628762e6ada7 22 | +SIZE (php-5.5.23.tar.bz2) = 13308115 23 | SHA256 (php-5.5.x-mail-header.patch) = b0b5a7c961b2052eb14d9528e76155cbeaa881fb9b4a49f452f9dab07b6fb1c4 24 | SIZE (php-5.5.x-mail-header.patch) = 3379 25 | -------------------------------------------------------------------------------- /patches/PR198993_php5-5.4.39.diff: -------------------------------------------------------------------------------- 1 | Index: Makefile 2 | =================================================================== 3 | --- Makefile (revision 382444) 4 | +++ Makefile (working copy) 5 | @@ -2,7 +2,7 @@ 6 | # $FreeBSD$ 7 | 8 | PORTNAME= php5 9 | -PORTVERSION= 5.4.38 10 | +PORTVERSION= 5.4.39 11 | PORTREVISION?= 0 12 | CATEGORIES?= lang devel www 13 | MASTER_SITES= ${MASTER_SITE_PHP} 14 | Index: distinfo 15 | =================================================================== 16 | --- distinfo (revision 382444) 17 | +++ distinfo (working copy) 18 | @@ -1,4 +1,4 @@ 19 | -SHA256 (php-5.4.38.tar.bz2) = abf37db0cfadc9bb814f9df35f6aa966ad63f4f4c4475e432ec625568a5d3e88 20 | -SIZE (php-5.4.38.tar.bz2) = 12273298 21 | +SHA256 (php-5.4.39.tar.bz2) = 7ceb76538e709c74533210ae41148d5c01c330ac8a73220954bbc4fcae69d77e 22 | +SIZE (php-5.4.39.tar.bz2) = 12271717 23 | SHA256 (php-5.4.x-mail-header.patch) = 005ae1cd8ed17c72d7b09dee9c4466e8b16d4ecba7fe11276731ed6ff9fbb344 24 | SIZE (php-5.4.x-mail-header.patch) = 3379 25 | -------------------------------------------------------------------------------- /patches/PR199091_cassandra_vuxml.diff: -------------------------------------------------------------------------------- 1 | Index: security/vuxml/vuln.xml 2 | =================================================================== 3 | --- security/vuxml/vuln.xml (revision 387127) 4 | +++ security/vuxml/vuln.xml (working copy) 5 | @@ -57,6 +57,53 @@ 6 | 7 | --> 8 | 9 | + 10 | + cassandra -- remote execution of arbitrary code 11 | + 12 | + 13 | + cassandra 14 | + 1.2.01.2.19 15 | + 16 | + 17 | + cassandra2 18 | + 2.0.02.0.14 19 | + 2.1.02.1.4 20 | + 21 | + 22 | + 23 | + 24 | +

Jake Luciani reports:

25 | +
26 | +

Under its default configuration, Cassandra binds an unauthenticated 27 | + JMX/RMI interface to all network interfaces. As RMI is an API for the 28 | + transport and remote execution of serialized Java, anyone with access 29 | + to this interface can execute arbitrary code as the running user.

30 | +

Mitigation:

31 | +

1.2.x has reached EOL, so users of <= 1.2.x are recommended to upgrade 32 | + to a supported version of Cassandra, or manually configure encryption 33 | + and authentication of JMX, 34 | + (see https://wiki.apache.org/cassandra/JmxSecurity).

35 | +

2.0.x users should upgrade to 2.0.14

36 | +

2.1.x users should upgrade to 2.1.4

37 | +

Alternately, users of any version not wishing to upgrade can 38 | + reconfigure JMX/RMI to enable encryption and authentication according 39 | + to https://wiki.apache.org/cassandra/JmxSecurityor 40 | + http://docs.oracle.com/javase/7/docs/technotes/guides/management/agent.html

41 | +

Credit:

42 | +

This issue was discovered by Georgi Geshev of MWR InfoSecurity

43 | +
44 | + 45 | + 46 | + 47 | + http://mail-archives.apache.org/mod_mbox/cassandra-dev/201504.mbox/raw/%3CCALamADJu4yo=cO8HgA6NpgFc1wQN_VNqpkMn-3SZwhPq9foLBw@mail.gmail.com%3E/ 48 | + CVE-2015-0225 49 | + 50 | + 51 | + 2015-04-01 52 | + 2015-05-23 53 | + 54 | + 55 | + 56 | 57 | dnsmasq -- remotely exploitable buffer overflow in release candidate 58 | 59 | -------------------------------------------------------------------------------- /patches/PR199150.pflog: -------------------------------------------------------------------------------- 1 | #!/bin/sh 2 | # 3 | # $FreeBSD: stable/10/etc/rc.d/pflog 274327 2014-11-09 20:08:43Z jpaetzel $ 4 | # 5 | 6 | # PROVIDE: pflog 7 | # REQUIRE: FILESYSTEMS netif FILESYSTEMS 8 | # KEYWORD: nojail 9 | 10 | . /etc/rc.subr 11 | 12 | name="pflog" 13 | rcvar="pflog_enable" 14 | command="/sbin/pflogd" 15 | pidfile="/var/run/pflogd.pid" 16 | start_precmd="pflog_prestart" 17 | stop_postcmd="pflog_poststop" 18 | extra_commands="reload resync" 19 | 20 | # for backward compatibility 21 | resync_cmd="pflog_resync" 22 | 23 | pflog_prestart() 24 | { 25 | load_kld pflog || return 1 26 | 27 | # create pflog_dev interface if needed 28 | if ! ifconfig $pflog_dev > /dev/null 2>&1; then 29 | if ! ifconfig $pflog_dev create; then 30 | warn "could not create $pflog_dev." 31 | return 1 32 | fi 33 | fi 34 | 35 | # set pflog_dev interface to up state 36 | if ! ifconfig $pflog_dev up; then 37 | warn "could not bring up $pflog_dev." 38 | return 1 39 | fi 40 | 41 | # -p flag requires striping pidfile's leading /var/run and trailing .pid 42 | pidfile=$(echo $pidfile | sed -e 's|/var/run/||' -e 's|.pid$||') 43 | 44 | # prepare the command line for pflogd 45 | rc_flags="-p $pidfile -f $pflog_logfile -i $pflog_dev $rc_flags" 46 | 47 | # report we're ready to run pflogd 48 | return 0 49 | } 50 | 51 | pflog_poststop() 52 | { 53 | if ! ifconfig $pflog_dev down; then 54 | warn "could not bring down $pflog_dev." 55 | return 1 56 | fi 57 | 58 | if [ "$pflog_instances" ] && [ -n "$pflog_instances" ]; then 59 | rm $pidfile 60 | fi 61 | 62 | return 0 63 | } 64 | 65 | # for backward compatibility 66 | pflog_resync() 67 | { 68 | run_rc_command reload 69 | } 70 | 71 | load_rc_config $name 72 | 73 | # Check if spawning multiple pflogd and told what to spawn 74 | if [ -n "$2" ]; then 75 | # Set required variables 76 | eval pflog_dev=\$pflog_${2}_dev 77 | eval pflog_logfile=\$pflog_${2}_logfile 78 | eval pflog_flags=\$pflog_${2}_flags 79 | # Check that required vars have non-zero length, warn if not. 80 | if [ -z $pflog_dev ]; then 81 | warn "pflog_dev not set" 82 | continue 83 | fi 84 | if [ -z $pflog_logfile ]; then 85 | warn "pflog_logfile not set" 86 | continue 87 | fi 88 | 89 | # Provide a unique pidfile name for pflogd -p flag 90 | pidfile="/var/run/pflogd.$2.pid" 91 | 92 | # Override service name and execute command 93 | name=$pflog_dev 94 | run_rc_command "$1" 95 | # Check if spawning multiple pflogd and not told what to spawn 96 | elif [ "$pflog_instances" ] && [ -n "$pflog_instances" ]; then 97 | # Interate through requested instances. 98 | for i in $pflog_instances; do 99 | /etc/rc.d/pflog $1 $i 100 | done 101 | else 102 | # Typical case, spawn single instance only. 103 | pflog_dev=${pflog_dev:-"pflog0"} 104 | run_rc_command "$1" 105 | fi 106 | -------------------------------------------------------------------------------- /patches/PR199150.pflog.patch: -------------------------------------------------------------------------------- 1 | Index: etc/rc.d/pflog 2 | =================================================================== 3 | --- etc/rc.d/pflog (revision 281061) 4 | +++ etc/rc.d/pflog (working copy) 5 | @@ -24,6 +24,14 @@ 6 | { 7 | load_kld pflog || return 1 8 | 9 | + # create pflog_dev interface if needed 10 | + if ! ifconfig $pflog_dev > /dev/null 2>&1; then 11 | + if ! ifconfig $pflog_dev create; then 12 | + warn "could not create $pflog_dev." 13 | + return 1 14 | + fi 15 | + fi 16 | + 17 | # set pflog_dev interface to up state 18 | if ! ifconfig $pflog_dev up; then 19 | warn "could not bring up $pflog_dev." 20 | @@ -30,24 +38,16 @@ 21 | return 1 22 | fi 23 | 24 | + # -p flag requires striping pidfile's leading /var/run and trailing .pid 25 | + pidfile=$(echo $pidfile | sed -e 's|/var/run/||' -e 's|.pid$||') 26 | + 27 | # prepare the command line for pflogd 28 | - rc_flags="-f $pflog_logfile -i $pflog_dev $rc_flags" 29 | + rc_flags="-p $pidfile -f $pflog_logfile -i $pflog_dev $rc_flags" 30 | 31 | # report we're ready to run pflogd 32 | return 0 33 | } 34 | 35 | -pflog_poststart() { 36 | - # Allow child pflogd to settle 37 | - sleep 0.10 38 | - # More elegant(?) method for getting a unique pid 39 | - if [ -f /var/run/pflogd.pid ]; then 40 | - mv /var/run/pflogd.pid $pidfile 41 | - else 42 | - warn "/var/run/pflogd.pid does not exist. Too fast." 43 | - fi 44 | -} 45 | - 46 | pflog_poststop() 47 | { 48 | if ! ifconfig $pflog_dev down; then 49 | @@ -70,29 +70,33 @@ 50 | 51 | load_rc_config $name 52 | 53 | -# Check if spawning multiple pflogd 54 | -echo "Starting pflogd: $pflog_instances" 55 | -if [ "$pflog_instances" ] && [ -n "$pflog_instances" ]; then 56 | - start_postcmd="pflog_poststart" 57 | +# Check if spawning multiple pflogd and told what to spawn 58 | +if [ -n "$2" ]; then 59 | + # Set required variables 60 | + eval pflog_dev=\$pflog_${2}_dev 61 | + eval pflog_logfile=\$pflog_${2}_logfile 62 | + eval pflog_flags=\$pflog_${2}_flags 63 | + # Check that required vars have non-zero length, warn if not. 64 | + if [ -z $pflog_dev ]; then 65 | + warn "pflog_dev not set" 66 | + continue 67 | + fi 68 | + if [ -z $pflog_logfile ]; then 69 | + warn "pflog_logfile not set" 70 | + continue 71 | + fi 72 | + 73 | + # Provide a unique pidfile name for pflogd -p flag 74 | + pidfile="/var/run/pflogd.$2.pid" 75 | + 76 | + # Override service name and execute command 77 | + name=$pflog_dev 78 | + run_rc_command "$1" 79 | +# Check if spawning multiple pflogd and not told what to spawn 80 | +elif [ "$pflog_instances" ] && [ -n "$pflog_instances" ]; then 81 | # Interate through requested instances. 82 | for i in $pflog_instances; do 83 | - # Set required variables 84 | - eval pflog_dev=\$pflog_${i}_dev 85 | - eval pflog_logfile=\$pflog_${i}_logfile 86 | - eval pflog_flags=\$pflog_${i}_flags 87 | - # Check that required vars have non-zero length, warn if not. 88 | - if [ -z $pflog_dev ]; then 89 | - warn "pflog_dev not set" 90 | - continue 91 | - fi 92 | - if [ -z $pflog_logfile ]; then 93 | - warn "pflog_logfile not set" 94 | - continue 95 | - fi 96 | - # pflogd sets a pidfile, but the name is hardcoded. Concoct a 97 | - # unique pidfile name. 98 | - pidfile="/var/run/pflogd.$i.pid" 99 | - run_rc_command "$1" 100 | + /etc/rc.d/pflog $1 $i 101 | done 102 | else 103 | # Typical case, spawn single instance only. 104 | -------------------------------------------------------------------------------- /patches/PR199257_whatweb-0.4.8.7.d0256.b.diff: -------------------------------------------------------------------------------- 1 | Index: Makefile 2 | =================================================================== 3 | --- Makefile (revision 385083) 4 | +++ Makefile (working copy) 5 | @@ -2,7 +2,7 @@ 6 | # $FreeBSD$ 7 | 8 | PORTNAME= whatweb 9 | -DISTVERSION= 0.4.8-${GH_COMMIT} 10 | +DISTVERSION= 0.4.8-${GH_TAGNAME} 11 | CATEGORIES= security www 12 | 13 | MAINTAINER= rm@FreeBSD.org 14 | @@ -13,13 +13,13 @@ 15 | USE_GITHUB= yes 16 | GH_ACCOUNT= urbanadventurer 17 | GH_PROJECT= WhatWeb 18 | -GH_COMMIT= 126e729 19 | -GH_TAGNAME= ${GH_COMMIT} 20 | +GH_TAGNAME= 7d0256b 21 | 22 | USE_RUBY= yes 23 | USE_RUBY_FEATURES= iconv 24 | RUBY_NO_BUILD_DEPENDS= yes 25 | NO_BUILD= yes 26 | +NO_ARCH= yes 27 | PORTDOCS= CHANGELOG INSTALL README whatweb.xsl 28 | 29 | post-patch: 30 | Index: distinfo 31 | =================================================================== 32 | --- distinfo (revision 385083) 33 | +++ distinfo (working copy) 34 | @@ -1,2 +1,2 @@ 35 | -SHA256 (whatweb-0.4.8-126e729.tar.gz) = 8f181b51e900fb6c7506bd96a103c12c7313871f88bb6bb4b30d60f598b9fc9e 36 | -SIZE (whatweb-0.4.8-126e729.tar.gz) = 1303182 37 | +SHA256 (urbanadventurer-WhatWeb-0.4.8-7d0256b-7d0256b_GH0.tar.gz) = 18ca3d5913c11b7da79eb723f837f8ee5f3803fdaae2b63a06b063e5acfd7f49 38 | +SIZE (urbanadventurer-WhatWeb-0.4.8-7d0256b-7d0256b_GH0.tar.gz) = 1094423 39 | Index: pkg-plist 40 | =================================================================== 41 | --- pkg-plist (revision 385083) 42 | +++ pkg-plist (working copy) 43 | @@ -58,6 +58,7 @@ 44 | %%RUBY_SITELIBDIR%%/whatweb/plugins/1024-CMS.rb 45 | %%RUBY_SITELIBDIR%%/whatweb/plugins/360-web-manager.rb 46 | %%RUBY_SITELIBDIR%%/whatweb/plugins/3COM-NBX.rb 47 | +%%RUBY_SITELIBDIR%%/whatweb/plugins/3dcart.rb 48 | %%RUBY_SITELIBDIR%%/whatweb/plugins/4D.rb 49 | %%RUBY_SITELIBDIR%%/whatweb/plugins/4images.rb 50 | %%RUBY_SITELIBDIR%%/whatweb/plugins/68-Classifieds-Script.rb 51 | @@ -129,6 +130,7 @@ 52 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Apache-CouchDB.rb 53 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Apache-Forrest.rb 54 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Apache-Struts.rb 55 | +%%RUBY_SITELIBDIR%%/whatweb/plugins/Apache-Tomcat.rb 56 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Apache-Traffic-Server.rb 57 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Apache-Wicket.rb 58 | %%RUBY_SITELIBDIR%%/whatweb/plugins/AppServ.rb 59 | @@ -199,6 +201,7 @@ 60 | %%RUBY_SITELIBDIR%%/whatweb/plugins/BoonEx-Dolphin.rb 61 | %%RUBY_SITELIBDIR%%/whatweb/plugins/BosClassifieds.rb 62 | %%RUBY_SITELIBDIR%%/whatweb/plugins/BrewBlogger.rb 63 | +%%RUBY_SITELIBDIR%%/whatweb/plugins/Brightcove.rb 64 | %%RUBY_SITELIBDIR%%/whatweb/plugins/BroadWin-WebAccess.rb 65 | %%RUBY_SITELIBDIR%%/whatweb/plugins/BrowserCMS.rb 66 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Buddy-Zone.rb 67 | @@ -279,6 +282,7 @@ 68 | %%RUBY_SITELIBDIR%%/whatweb/plugins/ConfTool.rb 69 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Connect2.rb 70 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Constructr-CMS.rb 71 | +%%RUBY_SITELIBDIR%%/whatweb/plugins/Content-Language.rb 72 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Content-Security-Policy.rb 73 | %%RUBY_SITELIBDIR%%/whatweb/plugins/ContentXXL.rb 74 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Contentteller-CMS.rb 75 | @@ -288,6 +292,7 @@ 76 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Cougar.rb 77 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Covalent-Enterprise-Ready-Server.rb 78 | %%RUBY_SITELIBDIR%%/whatweb/plugins/CoyotePoint-Load-Balancer.rb 79 | +%%RUBY_SITELIBDIR%%/whatweb/plugins/CrazyEgg.rb 80 | %%RUBY_SITELIBDIR%%/whatweb/plugins/CreateLive-Cms.rb 81 | %%RUBY_SITELIBDIR%%/whatweb/plugins/CrushFTP.rb 82 | %%RUBY_SITELIBDIR%%/whatweb/plugins/CubeCart.rb 83 | @@ -435,6 +440,7 @@ 84 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Gitorious.rb 85 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Gitweb.rb 86 | %%RUBY_SITELIBDIR%%/whatweb/plugins/GoServe.rb 87 | +%%RUBY_SITELIBDIR%%/whatweb/plugins/Google-Analytics.rb 88 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Google-Maps.rb 89 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Google-Search-Appliance.rb 90 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Google-Talk-Chatback.rb 91 | @@ -530,7 +536,9 @@ 92 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Internet-Cluster-Manager.rb 93 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Internet-Rimon-Filter.rb 94 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Intoto-Router.rb 95 | +%%RUBY_SITELIBDIR%%/whatweb/plugins/Intrasrv.rb 96 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Intraxxion-CMS.rb 97 | +%%RUBY_SITELIBDIR%%/whatweb/plugins/Intrinsyc-deviceWEB.rb 98 | %%RUBY_SITELIBDIR%%/whatweb/plugins/InverseFlow-Help-Desk-System.rb 99 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Ionize-CMS.rb 100 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Ipswitch-IMail.rb 101 | @@ -552,6 +560,7 @@ 102 | %%RUBY_SITELIBDIR%%/whatweb/plugins/KSS.rb 103 | %%RUBY_SITELIBDIR%%/whatweb/plugins/KSearch.rb 104 | %%RUBY_SITELIBDIR%%/whatweb/plugins/KaZaA.rb 105 | +%%RUBY_SITELIBDIR%%/whatweb/plugins/Kabana.rb 106 | %%RUBY_SITELIBDIR%%/whatweb/plugins/KaiBB.rb 107 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Kajona.rb 108 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Kampyle.rb 109 | @@ -588,6 +597,7 @@ 110 | %%RUBY_SITELIBDIR%%/whatweb/plugins/LanRTC.rb 111 | %%RUBY_SITELIBDIR%%/whatweb/plugins/LandShop.rb 112 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Lantronix-Device.rb 113 | +%%RUBY_SITELIBDIR%%/whatweb/plugins/LaserWash.rb 114 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Lasernet-CMS.rb 115 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Lasso-Web-Data-Engine.rb 116 | %%RUBY_SITELIBDIR%%/whatweb/plugins/LetoDMS.rb 117 | @@ -838,7 +848,6 @@ 118 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Phorum.rb 119 | %%RUBY_SITELIBDIR%%/whatweb/plugins/PhotoPost-PHP.rb 120 | %%RUBY_SITELIBDIR%%/whatweb/plugins/PhotoStore.rb 121 | -%%RUBY_SITELIBDIR%%/whatweb/plugins/Phusion_Passenger.rb 122 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Pi3Web.rb 123 | %%RUBY_SITELIBDIR%%/whatweb/plugins/PieCrust.rb 124 | %%RUBY_SITELIBDIR%%/whatweb/plugins/PithCMS.rb 125 | @@ -1199,6 +1208,7 @@ 126 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Web-Publishing-Wizard.rb 127 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Web-Wiz-Rich-Text-Editor.rb 128 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Web2.rb 129 | +%%RUBY_SITELIBDIR%%/whatweb/plugins/Web2py.rb 130 | %%RUBY_SITELIBDIR%%/whatweb/plugins/WebAsyst-Shop-Script.rb 131 | %%RUBY_SITELIBDIR%%/whatweb/plugins/WebDAV.rb 132 | %%RUBY_SITELIBDIR%%/whatweb/plugins/WebHare-Application-Portal.rb 133 | @@ -1236,6 +1246,7 @@ 134 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Wiseguy.rb 135 | %%RUBY_SITELIBDIR%%/whatweb/plugins/WoW-Server-Status.rb 136 | %%RUBY_SITELIBDIR%%/whatweb/plugins/WooFramework.rb 137 | +%%RUBY_SITELIBDIR%%/whatweb/plugins/WordFusion.rb 138 | %%RUBY_SITELIBDIR%%/whatweb/plugins/WordPress-Mobile-Pack.rb 139 | %%RUBY_SITELIBDIR%%/whatweb/plugins/WordPress-Stats.rb 140 | %%RUBY_SITELIBDIR%%/whatweb/plugins/Worldgroup-Server.rb 141 | @@ -1347,6 +1358,7 @@ 142 | %%RUBY_SITELIBDIR%%/whatweb/plugins/censura.rb 143 | %%RUBY_SITELIBDIR%%/whatweb/plugins/cgi-backdoor.rb 144 | %%RUBY_SITELIBDIR%%/whatweb/plugins/cgiproxy.rb 145 | +%%RUBY_SITELIBDIR%%/whatweb/plugins/cgit.rb 146 | %%RUBY_SITELIBDIR%%/whatweb/plugins/chillyCMS.rb 147 | %%RUBY_SITELIBDIR%%/whatweb/plugins/cisco-vpn-3000-concentrator.rb 148 | %%RUBY_SITELIBDIR%%/whatweb/plugins/citrix-metaframe.rb 149 | @@ -1392,6 +1404,7 @@ 150 | %%RUBY_SITELIBDIR%%/whatweb/plugins/dugallery.rb 151 | %%RUBY_SITELIBDIR%%/whatweb/plugins/dvr-webclient.rb 152 | %%RUBY_SITELIBDIR%%/whatweb/plugins/dwr.rb 153 | +%%RUBY_SITELIBDIR%%/whatweb/plugins/eBuilding.rb 154 | %%RUBY_SITELIBDIR%%/whatweb/plugins/eDirectory.rb 155 | %%RUBY_SITELIBDIR%%/whatweb/plugins/eFront.rb 156 | %%RUBY_SITELIBDIR%%/whatweb/plugins/eGroupWare.rb 157 | @@ -1557,8 +1570,8 @@ 158 | %%RUBY_SITELIBDIR%%/whatweb/plugins/open-auto-classifieds.rb 159 | %%RUBY_SITELIBDIR%%/whatweb/plugins/open-blog.rb 160 | %%RUBY_SITELIBDIR%%/whatweb/plugins/open-freeway.rb 161 | +%%RUBY_SITELIBDIR%%/whatweb/plugins/open-graph-protocol.rb 162 | %%RUBY_SITELIBDIR%%/whatweb/plugins/openEngine.rb 163 | -%%RUBY_SITELIBDIR%%/whatweb/plugins/open_graph_protocol.rb 164 | %%RUBY_SITELIBDIR%%/whatweb/plugins/open_search.rb 165 | %%RUBY_SITELIBDIR%%/whatweb/plugins/opencms.rb 166 | %%RUBY_SITELIBDIR%%/whatweb/plugins/openid.rb 167 | @@ -1570,6 +1583,7 @@ 168 | %%RUBY_SITELIBDIR%%/whatweb/plugins/pageup-people.rb 169 | %%RUBY_SITELIBDIR%%/whatweb/plugins/panasonic-network-camera.rb 170 | %%RUBY_SITELIBDIR%%/whatweb/plugins/parked-domain.rb 171 | +%%RUBY_SITELIBDIR%%/whatweb/plugins/passenger.rb 172 | %%RUBY_SITELIBDIR%%/whatweb/plugins/password_field.rb 173 | %%RUBY_SITELIBDIR%%/whatweb/plugins/pcextreme.rb 174 | %%RUBY_SITELIBDIR%%/whatweb/plugins/phPhotoAlbum.rb 175 | @@ -1700,7 +1714,6 @@ 176 | %%RUBY_SITELIBDIR%%/whatweb/plugins/thttpd.rb 177 | %%RUBY_SITELIBDIR%%/whatweb/plugins/title.rb 178 | %%RUBY_SITELIBDIR%%/whatweb/plugins/tomatoCMS.rb 179 | -%%RUBY_SITELIBDIR%%/whatweb/plugins/tomcat.rb 180 | %%RUBY_SITELIBDIR%%/whatweb/plugins/toner-cart.rb 181 | %%RUBY_SITELIBDIR%%/whatweb/plugins/toshiba-network-camera.rb 182 | %%RUBY_SITELIBDIR%%/whatweb/plugins/toshiba-printer.rb 183 | -------------------------------------------------------------------------------- /patches/PR199508_chrony-1.31.1.diff: -------------------------------------------------------------------------------- 1 | Index: net/chrony/Makefile 2 | =================================================================== 3 | --- net/chrony/Makefile (revision 386983) 4 | +++ net/chrony/Makefile (working copy) 5 | @@ -2,7 +2,7 @@ 6 | # $FreeBSD$ 7 | 8 | PORTNAME= chrony 9 | -PORTVERSION= 1.31 10 | +PORTVERSION= 1.31.1 11 | CATEGORIES= net 12 | MASTER_SITES= http://download.tuxfamily.org/chrony/ 13 | 14 | @@ -34,6 +34,10 @@ 15 | IPV6_CATEGORIES= ipv6 16 | IPV6_CONFIGURE_OFF= --disable-ipv6 17 | 18 | +post-stage: 19 | + ${STRIP_CMD} ${STAGEDIR}${PREFIX}/bin/chronyc 20 | + ${STRIP_CMD} ${STAGEDIR}${PREFIX}/sbin/chronyd 21 | + 22 | post-install: 23 | .for f in chrony.conf.example chrony.conf.example2 chrony.keys.example 24 | ${INSTALL_DATA} ${WRKSRC}/examples/${f} ${STAGEDIR}${PREFIX}/etc 25 | Index: net/chrony/distinfo 26 | =================================================================== 27 | --- net/chrony/distinfo (revision 386983) 28 | +++ net/chrony/distinfo (working copy) 29 | @@ -1,2 +1,2 @@ 30 | -SHA256 (chrony-1.31.tar.gz) = a35e1cae46ecbe14af2023bb47a72a03d79591b2ff65f0072b3400153224996d 31 | -SIZE (chrony-1.31.tar.gz) = 395742 32 | +SHA256 (chrony-1.31.1.tar.gz) = 0ba9f4b58e20b2eaae921eb8c798108ef72d8ea6fdcc7eb0167b56690d212348 33 | +SIZE (chrony-1.31.1.tar.gz) = 395797 34 | Index: net/chrony/files/patch-examples-chrony.conf.example 35 | =================================================================== 36 | --- net/chrony/files/patch-examples-chrony.conf.example (revision 386983) 37 | +++ net/chrony/files/patch-examples-chrony.conf.example (working copy) 38 | @@ -1,4 +1,4 @@ 39 | ---- examples/chrony.conf.example.orig 2014-01-31 20:12:59 +0800 40 | +--- examples/chrony.conf.example.orig 2015-04-07 14:35:16 UTC 41 | +++ examples/chrony.conf.example 42 | @@ -42,6 +42,13 @@ 43 | # Failing that, there are a lot of public NTP servers. There is a list 44 | @@ -23,7 +23,7 @@ 45 | 46 | # Tell chronyd which numbered key in the file is used as the password 47 | # for chronyc. (You can pick any integer up to 2**32-1. '1' is just a 48 | -@@ -129,7 +136,7 @@ commandkey 1 49 | +@@ -132,7 +139,7 @@ generatecommandkey 50 | # still running and bail out. If you want to change the path to the PID 51 | # file, uncomment this line and edit it. The default path is shown. 52 | 53 | @@ -32,7 +32,7 @@ 54 | 55 | ####################################################################### 56 | ### INITIAL CLOCK CORRECTION 57 | -@@ -152,8 +159,8 @@ commandkey 1 58 | +@@ -155,8 +162,8 @@ generatecommandkey 59 | # produce some graphs of your system's timekeeping performance, or you 60 | # need help in debugging a problem. 61 | 62 | Index: net/chrony/files/patch-examples-chrony.conf.example2 63 | =================================================================== 64 | --- net/chrony/files/patch-examples-chrony.conf.example2 (revision 386983) 65 | +++ net/chrony/files/patch-examples-chrony.conf.example2 (working copy) 66 | @@ -1,4 +1,4 @@ 67 | ---- examples/chrony.conf.example2.orig 2014-01-31 20:12:59 +0800 68 | +--- examples/chrony.conf.example2.orig 2015-04-07 14:35:16 UTC 69 | +++ examples/chrony.conf.example2 70 | @@ -1,9 +1,17 @@ 71 | # Use public servers from the pool.ntp.org project. 72 | -------------------------------------------------------------------------------- /patches/PR199678_wpa_supplicant-2.4_1.diff: -------------------------------------------------------------------------------- 1 | Index: Makefile 2 | =================================================================== 3 | --- Makefile (revision 384690) 4 | +++ Makefile (working copy) 5 | @@ -2,6 +2,7 @@ 6 | 7 | PORTNAME= wpa_supplicant 8 | PORTVERSION= 2.4 9 | +PORTREVISION= 1 10 | CATEGORIES= security net 11 | MASTER_SITES= http://w1.fi/releases/ 12 | 13 | Index: files/patch-src_p2p_p2p.c 14 | =================================================================== 15 | --- files/patch-src_p2p_p2p.c (revision 0) 16 | +++ files/patch-src_p2p_p2p.c (working copy) 17 | @@ -0,0 +1,10 @@ 18 | +--- src/p2p/p2p.c.orig 2015-04-24 22:44:26 UTC 19 | ++++ src/p2p/p2p.c 20 | +@@ -778,6 +778,7 @@ int p2p_add_device(struct p2p_data *p2p, 21 | + if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0) 22 | + os_memcpy(dev->interface_addr, addr, ETH_ALEN); 23 | + if (msg.ssid && 24 | ++ msg.ssid[1] <= sizeof(dev->oper_ssid) && 25 | + (msg.ssid[1] != P2P_WILDCARD_SSID_LEN || 26 | + os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN) 27 | + != 0)) { 28 | 29 | Property changes on: files/patch-src_p2p_p2p.c 30 | ___________________________________________________________________ 31 | Added: svn:eol-style 32 | ## -0,0 +1 ## 33 | +native 34 | \ No newline at end of property 35 | Added: svn:mime-type 36 | ## -0,0 +1 ## 37 | +text/plain 38 | \ No newline at end of property 39 | Added: fbsd:nokeywords 40 | ## -0,0 +1 ## 41 | +yes 42 | \ No newline at end of property 43 | -------------------------------------------------------------------------------- /patches/PR199721_10-contrib_wpa_src_p2p_p2p.c.diff: -------------------------------------------------------------------------------- 1 | Index: contrib/wpa/src/p2p/p2p.c 2 | =================================================================== 3 | --- contrib/wpa/src/p2p/p2p.c (revision 281987) 4 | +++ contrib/wpa/src/p2p/p2p.c (working copy) 5 | @@ -661,6 +661,7 @@ 6 | if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0) 7 | os_memcpy(dev->interface_addr, addr, ETH_ALEN); 8 | if (msg.ssid && 9 | + msg.ssid[1] <= sizeof(dev->oper_ssid) && 10 | (msg.ssid[1] != P2P_WILDCARD_SSID_LEN || 11 | os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN) 12 | != 0)) { 13 | -------------------------------------------------------------------------------- /patches/PR199721_11-contrib_wpa_src_p2p_p2p.c.diff: -------------------------------------------------------------------------------- 1 | Index: contrib/wpa/src/p2p/p2p.c 2 | =================================================================== 3 | --- contrib/wpa/src/p2p/p2p.c (revision 282020) 4 | +++ contrib/wpa/src/p2p/p2p.c (working copy) 5 | @@ -778,6 +778,7 @@ 6 | if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0) 7 | os_memcpy(dev->interface_addr, addr, ETH_ALEN); 8 | if (msg.ssid && 9 | + msg.ssid[1] <= sizeof(dev->oper_ssid) && 10 | (msg.ssid[1] != P2P_WILDCARD_SSID_LEN || 11 | os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN) 12 | != 0)) { 13 | -------------------------------------------------------------------------------- /patches/PR199864_zfsboot.diff: -------------------------------------------------------------------------------- 1 | Index: usr.sbin/bsdinstall/scripts/zfsboot 2 | =================================================================== 3 | --- usr.sbin/bsdinstall/scripts/zfsboot (revision 282336) 4 | +++ usr.sbin/bsdinstall/scripts/zfsboot (working copy) 5 | @@ -157,6 +157,7 @@ 6 | 7 | # Create /var and friends 8 | /var mountpoint=/var,canmount=off 9 | + /var/audit 10 | /var/crash exec=off,setuid=off 11 | /var/log exec=off,setuid=off 12 | /var/mail atime=on 13 | -------------------------------------------------------------------------------- /patches/PR200040_zope213-2.13.22_1.diff: -------------------------------------------------------------------------------- 1 | Index: Makefile 2 | =================================================================== 3 | --- Makefile (revision 385593) 4 | +++ Makefile (working copy) 5 | @@ -2,6 +2,7 @@ 6 | 7 | PORTNAME= zope213 8 | PORTVERSION= 2.13.22 9 | +PORTREVISION= 1 10 | CATEGORIES= www python zope 11 | MASTER_SITES= CHEESESHOP 12 | DISTNAME= Zope2-${PORTVERSION} 13 | @@ -81,9 +82,9 @@ 14 | 15 | USES= python:2 zip 16 | USE_PYTHON= distutils autoplist 17 | +NO_ARCH= yes 18 | 19 | -PKGMESSAGE= ${WRKDIR}/pkg-message 20 | -SUB_FILES= instance-message package-pkg-message pkg-message 21 | +SUB_FILES= pkg-message 22 | SUB_LIST= ZOPEINSTANCEBASE=${ZOPEINSTANCEBASE} \ 23 | ZOPE_USER=${ZOPE_USER} \ 24 | ZOPEINSTANCEDIR=${ZOPEINSTANCEDIR} 25 | @@ -93,30 +94,7 @@ 26 | ZOPEINSTANCEBASE?= ${PREFIX}/www/Zope213 27 | ZOPEINSTANCEDIR?= ${ZOPEINSTANCEBASE}/${ZOPEINSTANCENAME} 28 | 29 | -.if defined(BATCH) 30 | -ISBATCH= --user admin:test123 31 | -.else 32 | -ISBATCH= "" 33 | -.endif 34 | +post-patch: 35 | + @${REINPLACE_CMD} -e 's/#.*effective-user chrism/effective-user ${ZOPE_USER}/' ${WRKSRC}/src/Zope2/utilities/skel/etc/zope.conf.in 36 | 37 | -.if defined(INSTANCENAME) 38 | -ZOPEINSTANCENAME= ${INSTANCENAME} 39 | -.endif 40 | - 41 | -instance: 42 | - @${LOCALBASE}/bin/mkzopeinstance --dir ${ZOPEINSTANCEDIR} ${ISBATCH} 43 | - @${CHOWN} ${ZOPE_USER}:${ZOPE_USER} ${ZOPEINSTANCEDIR}/var 44 | - @${CHOWN} ${ZOPE_USER}:${ZOPE_USER} ${ZOPEINSTANCEDIR}/log 45 | - @${SED} ${SUB_LIST:S/$/!g/:S/^/ -e s!%%/:S/=/%%!/} \ 46 | - ${FILESDIR}/zope.conf_changes \ 47 | - | ${PATCH} --silent ${ZOPEINSTANCEDIR}/etc/zope.conf 48 | - @${RM} ${ZOPEINSTANCEDIR}/etc/zope.conf.orig 49 | - @${CAT} ${WRKDIR}/instance-message 50 | - 51 | -post-install: 52 | - @${CAT} ${WRKDIR}/pkg-message 53 | - 54 | -pre-package: 55 | - @${INSTALL_DATA} ${WRKDIR}/package-pkg-message ${PKGMESSAGE} 56 | - 57 | .include 58 | Index: files/instance-message.in 59 | =================================================================== 60 | --- files/instance-message.in (revision 385593) 61 | +++ files/instance-message.in (working copy) 62 | @@ -1,16 +0,0 @@ 63 | -********************************************************************** 64 | - 65 | -Zope instance successfully installed 66 | - 67 | -If Zope should get started automatically when the system starts, 68 | -please add the following line to /etc/rc.conf 69 | - 70 | -zope213_enable="YES" 71 | - 72 | -If you are using not default instance location, please add this 73 | -line to /etc/rc.conf to make it working: 74 | - 75 | -zope213_instances="%%ZOPEINSTANCEDIR%%" 76 | - 77 | -If there is already a zope213_instances entry please add 78 | -%%ZOPEINSTANCEDIR%% separated by a space. 79 | Index: files/package-pkg-message.in 80 | =================================================================== 81 | --- files/package-pkg-message.in (revision 385593) 82 | +++ files/package-pkg-message.in (working copy) 83 | @@ -1,28 +0,0 @@ 84 | -********************************************************************** 85 | - 86 | -Zope Successfull installed. 87 | - 88 | -To create an instance of Zope please run 89 | -%%LOCALBASE%%/bin/mkzopeinstance --dir 90 | - 91 | - is the directory where the instance files should 92 | - be installed. This can be %%ZOPEINSTANCEBASE%% 93 | - 94 | -Command-line options to 'mkzopeinstance' are available, and can be 95 | -investigated by running 'mkzopeinstance --help'. 96 | - 97 | -Zope instances, created by mkzopeinstance, will not be removed 98 | -when the package is deinstalled. You'll have to delete them yourself. 99 | - 100 | -If Zope should get started automatically when the system starts, 101 | -please add the following line to /etc/rc.conf 102 | - 103 | -zope213_enable="YES" 104 | - 105 | -If you are using not default instance location, please add this 106 | -line to /etc/rc.conf to make it working: 107 | - 108 | -zope213_instances="" 109 | - 110 | -Additional Zope instances have to be added to zope213_instances 111 | -separated by a space. 112 | Index: files/pkg-message.in 113 | =================================================================== 114 | --- files/pkg-message.in (revision 385593) 115 | +++ files/pkg-message.in (working copy) 116 | @@ -2,22 +2,27 @@ 117 | 118 | Zope Successfull installed. 119 | 120 | -To create an instance of Zope please run 121 | -make instance 122 | +To create an instance of Zope using the default location, please run: 123 | 124 | -You can set the following Variables in /etc/make.conf 125 | +%%LOCALBASE%%/bin/mkzopeinstance --dir %%ZOPEINSTANCEDIR%% 126 | +chown %%ZOPE_USER%%:%%ZOPE_USER%% %%ZOPEINSTANCEDIR%%var 127 | +chown %%ZOPE_USER%%:%%ZOPE_USER%% %%ZOPEINSTANCEDIR%%log 128 | 129 | -ZOPEINSTANCEBASE Directory where Zope instance should go 130 | - (default: %%ZOPEINSTANCEBASE%%) 131 | -ZOPEINSTANCENAME Default name for a new Zope instance 132 | - (default: none) 133 | +Command-line options to 'mkzopeinstance' are available, and can be 134 | +investigated by running 'mkzopeinstance --help'. 135 | 136 | -If you want have multiple Zope you should run 137 | -make instance INSTANCENAME= 138 | +Zope instances, created by mkzopeinstance, will not be removed 139 | +when the package is deinstalled. You'll have to delete them yourself. 140 | 141 | -You may also define BATCH option if you want instance to be created with 142 | -default username/password pair for instance administartor (admin:test123): 143 | -make instance BATCH=yes 144 | +If you are not using the default instance location, please use the 145 | +desired paths during creation and add this line to /etc/rc.conf: 146 | 147 | -Zope instances, created by `make instance', will not be removed when the 148 | -port is deinstalled. You'll have to delete them yourself. 149 | +zope213_instances="" 150 | + 151 | +Additional Zope instances have to be added to zope213_instances 152 | +separated by a space. 153 | + 154 | +If Zope should get started automatically when the system starts, 155 | +please add the following line to /etc/rc.conf: 156 | + 157 | +zope213_enable="YES" 158 | Index: files/zope.conf_changes 159 | =================================================================== 160 | --- files/zope.conf_changes (revision 385593) 161 | +++ files/zope.conf_changes (working copy) 162 | @@ -1,10 +0,0 @@ 163 | ---- zope.conf.in 2011-11-30 15:30:18.000000000 +0400 164 | -+++ zope.conf 2011-11-30 15:43:40.000000000 +0400 165 | -@@ -161,6 +161,7 @@ 166 | - # 167 | - # effective-user chrism 168 | - 169 | -+effective-user %%ZOPE_USER%% 170 | - 171 | - # Directive: enable-product-installation 172 | - # 173 | -------------------------------------------------------------------------------- /patches/PR200172_salt-vuxml.patch: -------------------------------------------------------------------------------- 1 | Index: security/vuxml/vuln.xml 2 | =================================================================== 3 | --- security/vuxml/vuln.xml (revision 386492) 4 | +++ security/vuxml/vuln.xml (working copy) 5 | @@ -57,6 +57,48 @@ 6 | 7 | --> 8 | 9 | + 10 | + py-salt -- potential shell injection vulnerabilities 11 | + 12 | + 13 | + py27-salt 14 | + 2015.5.0 15 | + 16 | + 17 | + 18 | + 19 | +

Colton Myers reports:

20 | +
21 | +

In order to fix potential shell injection vulnerabilities in salt 22 | + modules, a change has been made to the various cmd module functions. 23 | + These functions now default to python_shell=False, which means that 24 | + the commands will not be sent to an actual shell.

25 | +

The largest side effect of this change is that "shellisms", such as 26 | + pipes, will not work by default. The modules shipped with salt have 27 | + been audited to fix any issues that might have arisen from this 28 | + change. Additionally, the cmd state module has been unaffected, and 29 | + use of cmd.run in jinja is also unaffected. cmd.run calls on the 30 | + CLI will also allow shellisms.

31 | +

However, custom execution modules which use shellisms in cmd calls 32 | + will break, unless you pass python_shell=True to these calls.

33 | +

As a temporary workaround, you can set cmd_safe: False in your 34 | + minion and master configs. This will revert the default, but is 35 | + also less secure, as it will allow shell injection vulnerabilities 36 | + to be written in custom code. We recommend you only set this 37 | + setting for as long as it takes to resolve these issues in your 38 | + custom code, then remove the override.

39 | +
40 | + 41 | + 42 | + 43 | + http://docs.saltstack.com/en/latest/topics/releases/2015.5.0.html 44 | + 45 | + 46 | + 2015-05-11 47 | + 2015-05-16 48 | + 49 | + 50 | + 51 | 52 | rubygem-redcarpet -- XSS vulnerability 53 | 54 | -------------------------------------------------------------------------------- /patches/PR200233_py27-libnacl-1.4.2.diff: -------------------------------------------------------------------------------- 1 | Index: Makefile 2 | =================================================================== 3 | --- Makefile (revision 386492) 4 | +++ Makefile (working copy) 5 | @@ -2,7 +2,7 @@ 6 | # $FreeBSD$ 7 | 8 | PORTNAME= libnacl 9 | -PORTVERSION= 1.4.0 10 | +PORTVERSION= 1.4.2 11 | CATEGORIES= security python 12 | MASTER_SITES= CHEESESHOP 13 | PKGNAMEPREFIX= ${PYTHON_PKGNAMEPREFIX} 14 | Index: distinfo 15 | =================================================================== 16 | --- distinfo (revision 386492) 17 | +++ distinfo (working copy) 18 | @@ -1,2 +1,2 @@ 19 | -SHA256 (libnacl-1.4.0.tar.gz) = fee644e684472b307e864db0d01d81915e7fc2c9fd4a64c15a35e4883102d7d5 20 | -SIZE (libnacl-1.4.0.tar.gz) = 28233 21 | +SHA256 (libnacl-1.4.2.tar.gz) = 2443c9c8835bc3e337de1ba137fd783a1d73ef3d404966d960255c29910e58cf 22 | +SIZE (libnacl-1.4.2.tar.gz) = 28162 23 | -------------------------------------------------------------------------------- /patches/PR200311_virtualbox-ose_vuxml.diff: -------------------------------------------------------------------------------- 1 | Index: security/vuxml/vuln.xml 2 | =================================================================== 3 | --- security/vuxml/vuln.xml (revision 387127) 4 | +++ security/vuxml/vuln.xml (working copy) 5 | @@ -57,6 +57,42 @@ 6 | 7 | --> 8 | 9 | + 10 | + virtualbox-ose -- buffer overflow vulnerability in QEMU's virtual Floppy Disk Controller (FDC) 11 | + 12 | + 13 | + virtualbox-ose 14 | + 4.3.28 15 | + 16 | + 17 | + 18 | + 19 | +

Oracle reports:

20 | +
21 | +

This Security Alert addresses security issue CVE-2015-3456 22 | + ("VENOM"), a buffer overflow vulnerability in QEMU's virtual Floppy 23 | + Disk Controller (FDC). The vulnerable FDC code is included in 24 | + various virtualization platforms and is used in some Oracle products. 25 | + The vulnerability may be exploitable by an attacker who has access 26 | + to an account on the guest operating system with privilege to access 27 | + the FDC. The attacker may be able to send malicious code to the FDC 28 | + that is executed in the context of the hypervisor process on the host 29 | + operating system. This vulnerability is not remotely exploitable 30 | + without authentication, i.e., may not be exploited over a network 31 | + without the need for a username and password.

32 | +
33 | + 34 | + 35 | + 36 | + http://www.oracle.com/technetwork/topics/security/alert-cve-2015-3456-2542656.html 37 | + CVE-2015-3456 38 | + 39 | + 40 | + 2015-05-15 41 | + 2015-05-23 42 | + 43 | + 44 | + 45 | 46 | dnsmasq -- remotely exploitable buffer overflow in release candidate 47 | 48 | -------------------------------------------------------------------------------- /patches/patch-src_FbTk_TextButton.cc: -------------------------------------------------------------------------------- 1 | --- src/FbTk/TextButton.cc.orig 2013-06-17 11:38:14 UTC 2 | +++ src/FbTk/TextButton.cc 3 | @@ -143,11 +143,17 @@ void TextButton::drawText(int x_offset, 4 | unsigned int textlen = visual.size(); 5 | unsigned int button_width = width(); 6 | unsigned int button_height = height(); 7 | + const int max_width = static_cast(button_width) - x_offset - 8 | + m_left_padding - m_right_padding; 9 | + 10 | + if (max_width <= bevel()) { 11 | + return; 12 | + } 13 | 14 | translateSize(m_orientation, button_width, button_height); 15 | 16 | // horizontal alignment, cut off text if needed 17 | - int align_x = FbTk::doAlignment(button_width - x_offset - m_left_padding - m_right_padding, 18 | + int align_x = FbTk::doAlignment(max_width, 19 | bevel(), justify(), font(), 20 | visual.data(), visual.size(), 21 | textlen); // return new text len 22 | -------------------------------------------------------------------------------- /patches/serviio-1.5.diff: -------------------------------------------------------------------------------- 1 | Index: Makefile 2 | =================================================================== 3 | --- Makefile (revision 377896) 4 | +++ Makefile (working copy) 5 | @@ -2,8 +2,8 @@ 6 | # $FreeBSD$ 7 | 8 | PORTNAME= serviio 9 | -PORTVERSION= 1.4.1.2 10 | -PORTREVISION= 2 11 | +PORTVERSION= 1.5 12 | +#PORTREVISION= 0 13 | CATEGORIES= net multimedia java www 14 | MASTER_SITES= http://download.serviio.org/releases/ 15 | EXTRACT_SUFX= -linux.tar.gz 16 | @@ -15,6 +15,7 @@ 17 | 18 | NO_BUILD= yes 19 | USE_JAVA= yes 20 | +JAVA_VERSION= 1.8 21 | USES= dos2unix 22 | DOS2UNIX_GLOB= derby.properties 23 | 24 | @@ -36,10 +37,10 @@ 25 | ${MKDIR} ${STAGEDIR}${PREFIX}/etc/${PORTNAME} 26 | .for f in application-profiles profiles log4j 27 | ${INSTALL_DATA} ${WRKSRC}/config/$f.xml \ 28 | - ${STAGEDIR}${ETCDIR}/$f.dist.xml 29 | + ${STAGEDIR}${ETCDIR}/$f.xml.sample 30 | .endfor 31 | ${INSTALL_DATA} ${FILESDIR}/console-log4j.properties \ 32 | - ${STAGEDIR}${ETCDIR}/console-log4j.dist.properties 33 | + ${STAGEDIR}${ETCDIR}/console-log4j.properties.sample 34 | ${INSTALL_SCRIPT} ${WRKDIR}/serviiod ${STAGEDIR}${PREFIX}/sbin 35 | ${INSTALL_SCRIPT} ${WRKDIR}/serviio-console ${STAGEDIR}${PREFIX}/bin 36 | 37 | Index: distinfo 38 | =================================================================== 39 | --- distinfo (revision 377896) 40 | +++ distinfo (working copy) 41 | @@ -1,2 +1,2 @@ 42 | -SHA256 (serviio-1.4.1.2-linux.tar.gz) = 76f208716e2c1c8d7ed52eb2f57bd190ee622acd9529e225a59424bd1b12a0a2 43 | -SIZE (serviio-1.4.1.2-linux.tar.gz) = 20701487 44 | +SHA256 (serviio-1.5-linux.tar.gz) = e933de2f5f9da95cc3cdc3afba9d5b623fd5fd4189c5f7f247d4718e14166c3c 45 | +SIZE (serviio-1.5-linux.tar.gz) = 22055839 46 | Index: files/serviio-console.in 47 | =================================================================== 48 | --- files/serviio-console.in (revision 377896) 49 | +++ files/serviio-console.in (working copy) 50 | @@ -13,10 +13,10 @@ 51 | for j in $SERVIIO_CONSOLE_HOME/*.jar; do 52 | SERVIIO_CONSOLE_CLASS_PATH="$SERVIIO_CONSOLE_CLASS_PATH:$j" 53 | done 54 | -#SERVIIO_CONSOLE_CLASS_PATH="$SERVIIO_CONSOLE_HOME/serviio-client.jar:$SERVIIO_CONSOLE_HOME/serviio.jar:$SERVIIO_CONSOLE_HOME/log4j.jar:$SERVIIO_CONSOLE_HOME/slf4j-api.jar:$SERVIIO_CONSOLE_HOME/slf4j-log4j12.jar:$SERVIIO_CONSOLE_HOME/jul-to-slf4j.jar:$SERVIIO_CONSOLE_HOME/org.restlet.jar:$SERVIIO_CONSOLE_HOME/org.restlet.ext.xstream.jar:$SERVIIO_CONSOLE_HOME/xstream.jar" 55 | 56 | # Setup Serviio specific properties 57 | -JAVA_OPTS="-Dserviio.home=$SERVIIO_CONSOLE_HOME -Djava.net.preferIPv4Stack=true -Dffmpeg.location=%%LOCALBASE%%/bin/ffmpeg -Dlog4j.configuration=file:%%ETCDIR%%/console-log4j.properties" 58 | +JAVA_OPTS="-Dserviio.home=$SERVIIO_CONSOLE_HOME -Djava.net.preferIPv4Stack=true -Dorg.restlet.engine.loggerFacadeClass=org.restlet.ext.slf4j.Slf4jLoggerFacade" 59 | +JAVA_OPTS="${JAVA_OPTS} -Dlog4j.configuration=file:%%ETCDIR%%/console-log4j.properties" 60 | 61 | # A kludge to get the -D... flags to Java, rather than to Serviio itself: 62 | for o in "$@" 63 | @@ -29,4 +29,4 @@ 64 | done 65 | 66 | # Execute the JVM in the foreground 67 | -exec java -Xms5M -XX:+UseParNewGC -XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=10 $JAVA_OPTS -classpath "$SERVIIO_CONSOLE_CLASS_PATH" org.serviio.console.ServiioConsole "$@" 68 | +exec java -Xms5M -XX:+UseG1GC -XX:GCTimeRatio=1 -XX:MinHeapFreeRatio=5 -XX:MaxHeapFreeRatio=10 $JAVA_OPTS -classpath "$SERVIIO_CONSOLE_CLASS_PATH" org.serviio.console.ServiioConsole "$@" 69 | Index: files/serviiod.in 70 | =================================================================== 71 | --- files/serviiod.in (revision 377896) 72 | +++ files/serviiod.in (working copy) 73 | @@ -17,10 +17,9 @@ 74 | SERVIIO_CLASS_PATH="$SERVIIO_CLASS_PATH:%%ETCDIR%%" 75 | 76 | # Setup Serviio specific properties 77 | -JAVA_OPTS="-Djava.net.preferIPv4Stack=true -Djava.awt.headless=true -Dderby.system.home=/var/db/serviio -Dserviio.home=$HOME -Dffmpeg.location=%%LOCALBASE%%/bin/ffmpeg" 78 | +JAVA_OPTS="-Djava.net.preferIPv4Stack=true -Djava.awt.headless=true -Dorg.restlet.engine.loggerFacadeClass=org.restlet.ext.slf4j.Slf4jLoggerFacade -Dderby.system.home=/var/db/serviio -Dserviio.home=$HOME -Dffmpeg.location=%%LOCALBASE%%/bin/ffmpeg -Ddcraw.location=%%LOCALBASE%%/bin/dcraw" 79 | JAVA_OPTS="${JAVA_OPTS} -Djcs.auxiliary.DC.attributes.DiskPath=/var/db/serviio" 80 | 81 | - 82 | # A kludge to get the -D... flags to Java, rather than to Serviio itself: 83 | for o in "$@" 84 | do 85 | @@ -33,4 +32,4 @@ 86 | 87 | # Execute the JVM in the foreground 88 | export HOME PATH 89 | -exec java -Xmx512M -Xms20M -XX:+UseParNewGC -XX:MinHeapFreeRatio=10 -XX:MaxHeapFreeRatio=20 $JAVA_OPTS -classpath "$SERVIIO_CLASS_PATH" org.serviio.MediaServer "$@" 2>&1 >/dev/null 90 | +exec java -Xmx512M -Xms20M -XX:+UseG1GC -XX:GCTimeRatio=1 -XX:MinHeapFreeRatio=10 -XX:MaxHeapFreeRatio=20 $JAVA_OPTS -classpath "$SERVIIO_CLASS_PATH" org.serviio.MediaServer "$@" 2>&1 >/dev/null 91 | Index: pkg-plist 92 | =================================================================== 93 | --- pkg-plist (revision 377896) 94 | +++ pkg-plist (working copy) 95 | @@ -17,10 +17,12 @@ 96 | %%JAVAJARDIR%%/serviio/jdom.jar 97 | %%JAVAJARDIR%%/serviio/jnat-pmplib.jar 98 | %%JAVAJARDIR%%/serviio/jul-to-slf4j.jar 99 | +%%JAVAJARDIR%%/serviio/log4j.jar 100 | %%JAVAJARDIR%%/serviio/lucene-analyzers-common.jar 101 | %%JAVAJARDIR%%/serviio/lucene-core.jar 102 | -%%JAVAJARDIR%%/serviio/log4j.jar 103 | %%JAVAJARDIR%%/serviio/org.restlet.ext.gson.jar 104 | +%%JAVAJARDIR%%/serviio/org.restlet.ext.simple.jar 105 | +%%JAVAJARDIR%%/serviio/org.restlet.ext.slf4j.jar 106 | %%JAVAJARDIR%%/serviio/org.restlet.ext.xstream.jar 107 | %%JAVAJARDIR%%/serviio/org.restlet.jar 108 | %%JAVAJARDIR%%/serviio/padlock.jar 109 | @@ -28,24 +30,17 @@ 110 | %%JAVAJARDIR%%/serviio/rome.jar 111 | %%JAVAJARDIR%%/serviio/sbbi-upnp.jar 112 | %%JAVAJARDIR%%/serviio/serviio-client.jar 113 | -%%JAVAJARDIR%%/serviio/serviio-media-browser.jar 114 | -%%JAVAJARDIR%%/serviio/serviio-media-browser-web.jar 115 | +%%JAVAJARDIR%%/serviio/serviio-mediabrowser-api.jar 116 | +%%JAVAJARDIR%%/serviio/serviio-mediabrowser-web.jar 117 | %%JAVAJARDIR%%/serviio/serviio.jar 118 | +%%JAVAJARDIR%%/serviio/simple.jar 119 | %%JAVAJARDIR%%/serviio/slf4j-api.jar 120 | %%JAVAJARDIR%%/serviio/slf4j-log4j12.jar 121 | %%JAVAJARDIR%%/serviio/streamflyer-core.jar 122 | %%JAVAJARDIR%%/serviio/winp.jar 123 | %%JAVAJARDIR%%/serviio/xstream.jar 124 | -@unexec cmp %D/%%ETCDIR%%/application-profiles.xml %D/%%ETCDIR%%/application-profiles.dist.xml && rm -f %D/%%ETCDIR%%/application-profiles.xml || echo Modified application-profiles.xml remains in %D/%%ETCDIR%% 125 | -@unexec cmp %D/%%ETCDIR%%/profiles.xml %D/%%ETCDIR%%/profiles.dist.xml && rm -f %D/%%ETCDIR%%/profiles.xml || echo Modified profiles.xml remains in %D/%%ETCDIR%% 126 | -@unexec cmp %D/%%ETCDIR%%/log4j.xml %D/%%ETCDIR%%/log4j.dist.xml && rm -f %D/%%ETCDIR%%/log4j.xml || echo Modified log4j.xml remains in %D/%%ETCDIR%% 127 | -@unexec cmp %D/%%ETCDIR%%/console-log4j.properties %D/%%ETCDIR%%/console-log4j.dist.properties && rm -f %D/%%ETCDIR%%/console-log4j.properties || echo Modified console-log4j.properties remains in %D/%%ETCDIR%% 128 | -%%ETCDIR%%/profiles.dist.xml 129 | -%%ETCDIR%%/log4j.dist.xml 130 | -%%ETCDIR%%/application-profiles.dist.xml 131 | -%%ETCDIR%%/console-log4j.dist.properties 132 | -@exec [ -f %D/%%ETCDIR%%/application-profiles.xml ] || cp -v %D/%%ETCDIR%%/application-profiles.dist.xml %D/%%ETCDIR%%/application-profiles.xml 133 | -@exec [ -f %D/%%ETCDIR%%/profiles.xml ] || cp -v %D/%%ETCDIR%%/profiles.dist.xml %D/%%ETCDIR%%/profiles.xml 134 | -@exec [ -f %D/%%ETCDIR%%/log4j.xml ] || cp -v %D/%%ETCDIR%%/log4j.dist.xml %D/%%ETCDIR%%/log4j.xml 135 | -@exec [ -f %D/%%ETCDIR%%/console-log4j.properties ] || cp -v %D/%%ETCDIR%%/console-log4j.dist.properties %D/%%ETCDIR%%/console-log4j.properties 136 | +@sample %%ETCDIR%%/profiles.xml.sample 137 | +@sample %%ETCDIR%%/log4j.xml.sample 138 | +@sample %%ETCDIR%%/application-profiles.xml.sample 139 | +@sample %%ETCDIR%%/console-log4j.properties.sample 140 | @dir %%JAVAJARDIR%%/serviio/plugins 141 | -------------------------------------------------------------------------------- /puppet-dashboard-jails-HOWTO: -------------------------------------------------------------------------------- 1 | ################################################################################ 2 | # 3 | # I've been using Puppet for most of this year using the standard 4 | # sysutils/puppet with its included WEBrick server. While that works for me, 5 | # I was interested in having the Puppet Dashboard and figured it would be an 6 | # excellent opportunity to work with something new and learn something in the 7 | # process. My goal here is to take what I have learned and cover how to set up 8 | # a production quality Puppetmaster/Puppet Dashboard installation from scratch. 9 | # Many of the steps will follow along closely with Puppet Lab's online 10 | # instructions so I would encourage you to read along with their detailed 11 | # explanation as you do the steps. 12 | # 13 | # Written in 2013 by Jason Unovitch 14 | # jason.unovitch@gmail.com 15 | # https://github.com/junovitch 16 | # 17 | ################################################################################ 18 | # 19 | # Assumptions 20 | # I've started with a pair of bare FreeBSD 9.2-RELEASE VMs to test out the 21 | # procedure on to ensure I didn't miss anything from my live setup. We'll need 22 | # to do a few things to stage our environment. Our server VM will also run 23 | # both the Dashboard and Puppet master. With enough clients this may have to 24 | # be on different systems. Much of the same configuration will still apply. 25 | # Adapt accordingly if this doesn't fit your environment. 26 | # 27 | ################################################################################ 28 | # 29 | # For these two VMs, I'll use the following /etc/hosts file. 30 | # Ensure that DNS resolves appropriately in a live environment. 31 | # 32 | # 10.100.82.10 client.example.com client 33 | # 10.100.82.2 jailhost.example.com jailhost 34 | # 10.100.82.3 mariadb.example.com mariadb 35 | # 10.100.82.4 puppet.example.com dashboard.example.com puppet dashboard 36 | # 37 | # 38 | ################################################################################ 39 | # On jailhost.example.com we'll set up a basic environment: 40 | 41 | pkg_add -r ezjail 42 | ezjail-admin install 43 | ezjail-admin update -P 44 | 45 | ################################################################################ 46 | # MariaDB Database Jail Prep 47 | # databases/mariadb55-server will handle the back end requirements of Puppet 48 | # Dashboard. MySQL can also be used as well. 49 | # 50 | # Configure the jail on jailhost.example.com: 51 | 52 | ezjail-admin create mariadb.example.com 10.100.82.3 53 | cp /etc/resolv.conf /usr/jails/mariadb.example.com/etc/ 54 | cp /etc/hosts /usr/jails/mariadb.example.com/etc/ 55 | ezjail-admin console -f mariadb.example.com 56 | 57 | # On mariadb.example.com: 58 | 59 | pkg_add -r portmaster 60 | portmaster databases/mariadb55-server 61 | 62 | # Creating and Configurating MariaDB Database for Puppet Dashboard 63 | # http://docs.puppetlabs.com/dashboard/manual/1.2/bootstrapping.html#creating-and-configuring-a-mysql-database 64 | # 65 | # Tuning: Copy one of the default config files and change the max packet size to 66 | # allow for the 17 MB data rows that Dashboard can occasionally send. 67 | 68 | cp /usr/local/share/mysql/my-huge.cnf /var/db/mysql/my.cnf 69 | patch /var/db/mysql/my.cnf << 'EOF' 70 | 32c32,33 71 | < max_allowed_packet = 1M 72 | --- 73 | > # Allow 32MB packet Size for ~17MB size rows Puppet dashboard sends 74 | > max_allowed_packet = 32M 75 | 'EOF' 76 | 77 | # Enable and start MariaDB 78 | 79 | echo 'mysql_enable="YES"' >> /etc/rc.conf 80 | service mysql-server start 81 | 82 | # Prepare Database for use by running the secure installation. 83 | # Choose a root password and answer yes to all questions. 84 | mysql_secure_installation 85 | 86 | # Login to MariaDB and create appropriate tables for Dashboard. 87 | mysql -u root -p 88 | 89 | CREATE DATABASE dashboard_production CHARACTER SET utf8; 90 | CREATE DATABASE dashboard_development CHARACTER SET utf8; 91 | CREATE DATABASE dashboard_test CHARACTER SET utf8; 92 | CREATE USER 'dashboard'@'10.100.82.4' IDENTIFIED BY 'dashboard_password'; 93 | GRANT ALL PRIVILEGES ON dashboard_production.* TO 'dashboard'@'10.100.82.4'; 94 | GRANT ALL PRIVILEGES ON dashboard_development.* TO 'dashboard'@'10.100.82.4'; 95 | GRANT ALL PRIVILEGES ON dashboard_test.* TO 'dashboard'@'10.100.82.4'; 96 | flush privileges; 97 | quit; 98 | 99 | ################################################################################ 100 | # Puppet Jail Prep 101 | # 102 | # On jailhost.example.com we'll set up a basic environment: 103 | 104 | ezjail-admin create puppet.example.com 10.100.82.4 105 | cp /etc/hosts /usr/jails/puppet.example.com/etc/ 106 | cp /etc/resolv.conf /usr/jails/puppet.example.com/etc/ 107 | ezjail-admin console -f puppet.example.com 108 | 109 | # Installing Dependencies: Install Puppet, Git, Nginx, and Ruby Components 110 | # http://docs.puppetlabs.com/dashboard/manual/1.2/bootstrapping.html#installing-dependencies 111 | 112 | echo 'rubygem-passenger_UNSET+=APACHE22' >> /etc/make.conf 113 | echo 'rubygem-passenger_SET+=NGINX' >> /etc/make.conf 114 | echo 'nginx_SET+=PASSENGER' >> /etc/make.conf 115 | echo 'DEFAULT_VERSIONS= ruby=1.9' >> /etc/make.conf 116 | pkg_add -r portmaster 117 | portmaster sysutils/puppet sysutils/puppet-lint devel/git www/nginx devel/ruby-gems devel/rubygem-rake converters/ruby-iconv www/rubygem-passenger sysutils/rubygem-bundler databases/mysql55-client databases/postgresql93-client textproc/libxslt www/node databases/sqlite3 118 | 119 | # Puppet Initial Testing 120 | # At this point, Puppet needs to be started so that all its SSL keys can be 121 | # generated. This gives the chance to test that Puppet does work before anything 122 | # else gets stacked on as well as ensures the SSL keys referenced by Nginx's 123 | # config file are in place before that step. 124 | 125 | service puppetmaster onestart 126 | 127 | # On client.example.com - start Puppet on the client system 128 | 129 | service puppet onestart 130 | 131 | # On puppet.example.com - sign client.example.com's SSL key on the Puppetmaster 132 | 133 | puppet cert sign client.example.com 134 | 135 | # On client.example.com - Run a test on the client to ensure it works and do a onestop afterwards 136 | 137 | puppet agent --test 138 | service puppet onestop 139 | 140 | # Puppet Dashboard Installation 141 | # http://docs.puppetlabs.com/dashboard/manual/1.2/bootstrapping.html#installing-puppet-dashboard 142 | # Installing from Git 143 | 144 | cd /usr/local/share 145 | git clone git://github.com/sodabrew/puppet-dashboard.git 146 | 147 | # Puppet Dashboard Configuration 148 | # http://docs.puppetlabs.com/dashboard/manual/1.2/bootstrapping.html#configuring-dashboard 149 | # database.yml: Copy the example database YAML file. Update with database information. 150 | 151 | cd /usr/local/share/puppet-dashboard/config 152 | cp database.yml.example database.yml 153 | 154 | patch database.yml << 'EOF' 155 | 49c49 156 | < password: 157 | --- 158 | > password: dashboard_password 159 | 51c51,52 160 | < adapter: postgresql 161 | --- 162 | > adapter: mysql2 163 | > host: 10.100.82.3 164 | 56c57 165 | < password: 166 | --- 167 | > password: dashboard_password 168 | 58c59,60 169 | < adapter: postgresql 170 | --- 171 | > adapter: mysql2 172 | > host: 10.100.82.3 173 | 63c65 174 | < password: 175 | --- 176 | > password: dashboard_password 177 | 65,66c67,68 178 | < adapter: postgresql 179 | < 180 | --- 181 | > adapter: mysql2 182 | > host: 10.100.82.3 183 | 51a52 184 | 'EOF' 185 | chmod 660 database.yml 186 | 187 | # settings.yml: Copy the example settings YAML file. No changes needed. 188 | 189 | cd /usr/local/share/puppet-dashboard/config 190 | cp settings.yml.example settings.yml 191 | chmod 660 settings.yml 192 | 193 | # Fix shebang line in External Node Classifier Script. 194 | sed -i '' -e 's/#! \/usr\/bin\/ruby/#!\/usr\/local\/bin\/ruby/' /usr/local/share/puppet-dashboard/bin/external_node 195 | 196 | # Install gems required in the 'Gemfile' via the Rubygem Bundler. 197 | 198 | cd /usr/local/share/puppet-dashboard 199 | bundle install --path vendor/bundle 200 | 201 | # Generate secret_token. Cleanup any errors and the default token after 202 | # generating the new one. 203 | 204 | echo "secret_token: `bundle exec rake secret`" >> config/settings.yml 205 | vi config/settings.yml 206 | 207 | # Creating and Configuring a MariaDB Database - Preparing Schema 208 | # http://docs.puppetlabs.com/dashboard/manual/1.2/bootstrapping.html#creating-and-configuring-a-mysql-database 209 | # At this point the database was already installed in another jail with some 210 | # blank tables. We need to run rake to finish the process with the database 211 | # structure needed. 212 | 213 | cd /usr/local/share/puppet-dashboard 214 | env RAILS_ENV=production bundle exec rake db:setup 215 | env RAILS_ENV=development bundle exec rake db:setup 216 | 217 | # Testing That Dashboard is Working 218 | # http://docs.puppetlabs.com/dashboard/manual/1.2/bootstrapping.html#testing-that-dashboard-is-working 219 | # 220 | # Run Dashboard using Ruby's built-in WEBrick server to validate functionality. 221 | # It will be available at http://dashboard:3000 222 | 223 | cd /usr/local/share/puppet-dashboard 224 | bundle exec rails server 225 | 226 | # Before going into a production environment, Dashboard 2.0 must precompile 227 | # assets for production. 228 | 229 | env RAILS_ENV=production bundle exec rake assets:precompile 230 | 231 | # Manually create the 'puppet-dashboard' user and fix permissions on everything 232 | 233 | pw groupadd -n puppet-dashboard -g 800 234 | pw useradd -n puppet-dashboard -c "Puppet Dashboard,,," -u 800 -g puppet-dashboard -s /usr/sbin/nologin 235 | 236 | mkdir /usr/local/share/puppet-dashboard/certs 237 | chgrp -R puppet-dashboard /usr/local/share/puppet-dashboard 238 | find /usr/local/share/puppet-dashboard/certs -type d -exec chmod g+w {} \; 239 | find /usr/local/share/puppet-dashboard/certs -type f -exec chmod g+w {} \; 240 | find /usr/local/share/puppet-dashboard/tmp -type d -exec chmod g+w {} \; 241 | find /usr/local/share/puppet-dashboard/tmp -type f -exec chmod g+w {} \; 242 | find /usr/local/share/puppet-dashboard/log -type d -exec chmod g+w {} \; 243 | find /usr/local/share/puppet-dashboard/log -type f -exec chmod g+w {} \; 244 | 245 | # Configuring Puppet 246 | # http://docs.puppetlabs.com/dashboard/manual/1.2/bootstrapping.html#configuring-puppet 247 | # 248 | # All agent nodes have to be configured to submit reports to the master. 249 | # The master has to be configured to send reports to Dashboard. If you already 250 | # have a working Puppet installation you can configure it to distribute the 251 | # updated puppet.conf to your hosts. 252 | # 253 | # Examples: 254 | # puppet.conf (on each agent) 255 | # 256 | # [agent] 257 | # report = true 258 | # 259 | # 260 | # puppet.conf (on the Puppetmaster) 261 | # 262 | # [master] 263 | # reports = store, http 264 | # reporturl = http://dashboard.example.com:3000/reports/upload 265 | # node_terminus = exec 266 | # external_nodes = /usr/bin/env PUPPET_DASHBOARD_URL=http://dashboard.example.com:3000 /usr/local/share/puppet-dashboard/bin/external_node 267 | # 268 | # 269 | # Testing Puppet's Connection to Dashboard 270 | # From a Puppet agent, run puppet agent --test. A new background task should 271 | # show in the Dashboard UI at http://dashboard:3000 272 | # 273 | # Starting and Managing Delayed Job Workers 274 | # http://docs.puppetlabs.com/dashboard/manual/1.2/bootstrapping.html#starting-and-managing-delayed-job-workers 275 | # Using the monitor script 276 | # Dashboard ships a worker process maanager under script/delayed_job. It can 277 | # manually start delayed jobs via the following command: 278 | 279 | su -m puppet-dashboard -c 'env RAILS_ENV=production bundle exec script/delayed_job -p dashboard -n 2 -m start' 280 | 281 | # However, rather than manually triggering background workers, this rc script 282 | # will accomplish the same thing and ensure the background jobs get started 283 | # on the next reboot. 284 | 285 | cat > /usr/local/etc/rc.d/dashboard_workers << 'EOF' 286 | #!/bin/sh 287 | 288 | # PROVIDE: dashboard_workers 289 | # REQUIRE: LOGIN 290 | # KEYWORD: shutdown 291 | 292 | # By default dashboard_workers uses flags '-n 1' for 1 worker. This should be 293 | # adjusted to the number of CPU cores. 294 | dashboard_workers_enable=${dashboard_workers_enable:-"NO"} 295 | dashboard_workers_flags=${dashboard_workers_flags:-"-n 1"} 296 | # The default rails environment is set to production 297 | dashboard_workers_env=${dashboard_workers_env:-"/usr/bin/env PATH=${PATH}:/usr/local/bin RAILS_ENV=production"} 298 | # The default user is set to puppet-dashboard and install location is set to 299 | # /usr/local/share/puppet-dashboard. 300 | dashboard_workers_user=${dashboard_workers_user:-"puppet-dashboard"} 301 | dashboard_workers_chdir=${dashboard_workers_chdir:-"/usr/local/share/puppet-dashboard"} 302 | 303 | . /etc/rc.subr 304 | 305 | name="dashboard_workers" 306 | rcvar="dashboard_workers_enable" 307 | load_rc_config $name 308 | extra_commands="reload run zap status" 309 | 310 | # All commands call the same function and strip the fast|one|quiet prefix 311 | # to deliver to the bundler. 312 | reload_cmd="f_dashboard_workers reload" 313 | restart_cmd="f_dashboard_workers restart" 314 | run_cmd="f_dashboard_workers run" 315 | start_cmd="f_dashboard_workers start" 316 | status_cmd="f_dashboard_workers status" 317 | stop_cmd="f_dashboard_workers stop" 318 | zap_cmd="f_dashboard_workers zap" 319 | 320 | # Use the function's ARVG $1 as the bundler program's '-m' flag 321 | f_dashboard_workers() 322 | { 323 | cd $dashboard_workers_chdir && \ 324 | su -m "$dashboard_workers_user" \ 325 | -c "${dashboard_workers_env} bundle exec script/delayed_job ${rc_flags} -p dashboard -m $1" || \ 326 | echo "Failed to $1 dashboard_workers" 327 | } 328 | 329 | run_rc_command "$1" 330 | 'EOF' 331 | chmod 555 /usr/local/etc/rc.d/dashboard_workers 332 | 333 | 334 | # With that in place, we need to override the defaults and enable the script 335 | # along with setting '-n 4' workers to match the number of processor cores and 336 | # ensure it's ready for a production workload. 337 | 338 | echo 'dashboard_workers_enable="YES"' >> /etc/rc.conf 339 | echo 'dashboard_workers_flags="-n 4"' >> /etc/rc.conf 340 | service dashboard_workers start 341 | 342 | # Running Dashboard in a Production-Quality Server (Nginx/Passenger) 343 | # http://docs.puppetlabs.com/dashboard/manual/1.2/bootstrapping.html#running-dashboard-in-a-production-quality-server 344 | # 345 | # Configuring Nginx and Passenger 346 | # Since Puppet Lab's documentation is focused on Apache, I found the following 347 | # two links extremely helpful for information about Nginx/Passenger 348 | # configuration. They refer to CentOS but it wasn't too difficult to translate 349 | # what was needed. 350 | # 351 | # http://z0mbix.github.io/blog/2012/03/01/use-nginx-and-passenger-to-power-your-puppet-master/ 352 | # http://www.watters.ws/mediawiki/index.php/Configure_puppet_master_using_nginx_and_mod_passenger 353 | # 354 | # Our /usr/local/etc/nginx/nginx.conf file: 355 | 356 | cat > /usr/local/etc/nginx/nginx.conf << 'EOF' 357 | user www www; 358 | worker_processes 4; 359 | error_log /var/log/nginx/error.log notice; 360 | pid /var/run/nginx.pid; 361 | 362 | events { 363 | worker_connections 1024; 364 | } 365 | 366 | http { 367 | passenger_root /usr/local/lib/ruby/gems/1.9/gems/passenger-4.0.29; 368 | passenger_ruby /usr/local/bin/ruby; 369 | passenger_max_pool_size 15; 370 | passenger_pool_idle_time 300; 371 | #passenger_spawn_method direct; # Uncomment on Ruby 1.8 for ENC to work 372 | 373 | include mime.types; 374 | default_type application/octet-stream; 375 | sendfile on; 376 | tcp_nopush on; 377 | keepalive_timeout 65; 378 | tcp_nodelay on; 379 | 380 | server { 381 | listen 3000; 382 | server_name dashboard.example.com; 383 | 384 | passenger_enabled on; 385 | passenger_user puppet-dashboard; 386 | passenger_group puppet-dashboard; 387 | 388 | access_log /var/log/nginx/dashboard_access.log; 389 | 390 | root /usr/local/share/puppet-dashboard/public; 391 | } 392 | server { 393 | listen 8140 ssl; 394 | server_name puppet.example.com; 395 | 396 | passenger_enabled on; 397 | passenger_set_cgi_param HTTP_X_CLIENT_DN $ssl_client_s_dn; 398 | passenger_set_cgi_param HTTP_X_CLIENT_VERIFY $ssl_client_verify; 399 | passenger_user puppet; 400 | passenger_group puppet; 401 | 402 | access_log /var/log/nginx/puppet_access.log; 403 | 404 | root /usr/local/etc/puppet/rack/public; 405 | ssl_certificate /var/puppet/ssl/certs/puppet.example.com.pem; 406 | ssl_certificate_key /var/puppet/ssl/private_keys/puppet.example.com.pem; 407 | ssl_crl /var/puppet/ssl/ca/ca_crl.pem; 408 | ssl_client_certificate /var/puppet/ssl/certs/ca.pem; 409 | ssl_ciphers SSLv2:-LOW:-EXPORT:RC4+RSA; 410 | ssl_prefer_server_ciphers on; 411 | ssl_verify_client optional; 412 | ssl_verify_depth 1; 413 | ssl_session_cache shared:SSL:128m; 414 | ssl_session_timeout 5m; 415 | } 416 | } 417 | 'EOF' 418 | 419 | # Create the log directory to prevent issues on startup. 420 | 421 | mkdir /var/log/nginx 422 | 423 | # Enable a daily log file rotation via newsyslog.conf 424 | 425 | printf "/var/log/nginx/*.log\t\t\t644 7\t * @T00 JG /var/run/nginx.pid 30\n" >> /etc/newsyslog.conf 426 | 427 | # If the puppetmaster service is still running from earlier testing, stop it now 428 | 429 | service puppetmaster onestop 430 | 431 | # With initial setup of the Puppetmaster done, a RACK file that Nginx will use 432 | # to start the Ruby application will be needed. Copy/paste the example. 433 | 434 | mkdir -p /usr/local/etc/puppet/rack/public 435 | cat > /usr/local/etc/puppet/rack/config.ru << 'EOF' 436 | # Trimmed back FreeBSD Version of https://github.com/puppetlabs/puppet/blob/master/ext/rack/files/config.ru 437 | $0 = "master" 438 | ARGV << "--rack" 439 | ARGV << "--confdir" << "/usr/local/etc/puppet" 440 | ARGV << "--vardir" << "/var/puppet" 441 | require 'puppet/util/command_line' 442 | run Puppet::Util::CommandLine.new.execute 443 | 'EOF' 444 | chown -R puppet:puppet /usr/local/etc/puppet/rack 445 | 446 | # Enable nginx service and start it. At this point basic functionality is online. 447 | echo 'nginx_enable="YES"' >> /etc/rc.conf 448 | service nginx start 449 | 450 | # Configuring Dashboard - Advanced Features 451 | # http://docs.puppetlabs.com/dashboard/manual/1.2/configuring.html 452 | 453 | # Generating Certs and Connecting to the Puppet Master 454 | # With separate Puppet/Dashboard systems the puppet cert sign dashboard will 455 | # be on the Puppetmaster. 456 | 457 | cd /usr/local/share/puppet-dashboard 458 | su -m puppet-dashboard -c 'bundle exec rake cert:create_key_pair' 459 | su -m puppet-dashboard -c 'bundle exec rake cert:request' 460 | puppet cert sign dashboard 461 | su -m puppet-dashboard -c 'bundle exec rake cert:retrieve' 462 | 463 | # Enabling Inventory Support 464 | # Example auth.conf (on Puppet master) 465 | # 466 | # path /facts 467 | # auth yes 468 | # method find, search 469 | # allow dashboard 470 | # 471 | # 472 | # Enabling the Filebucket Viewer 473 | # Example site.pp (on Puppet master) 474 | # 475 | # filebucket { "main": 476 | # server => "{your puppet master}", 477 | # path => false, 478 | # } 479 | # 480 | # 481 | # In either site.pp, in an individual init.pp, or in a specific manifest. 482 | # 483 | # File { backup => "main" } 484 | # 485 | # 486 | # Go back and add the line for Inventory Support. 487 | 488 | cd /usr/local/share/puppet-dashboard/config 489 | 490 | patch settings.yml << 'EOF' 491 | 35c35 492 | < enable_inventory_service: false 493 | --- 494 | > enable_inventory_service: true 495 | 45c45 496 | < use_file_bucket_diffs: false 497 | --- 498 | > use_file_bucket_diffs: true 499 | 54c54 500 | 'EOF' 501 | 502 | # With all the updates made, restart so that it takes effect. 503 | service nginx restart 504 | 505 | # For future maintenance, periodic jobs to prune old reports and run DB optimization. 506 | 507 | mkdir -p /usr/local/etc/periodic/monthly 508 | cat > /usr/local/etc/periodic/monthly/clean_dashboard_database.sh << 'EOF' 509 | #!/bin/sh 510 | cd /usr/local/share/puppet-dashboard && \ 511 | echo "Pruning Old Reports from Puppet Dashboard Database" && \ 512 | /usr/bin/su -m puppet-dashboard -c '/usr/local/bin/bundle exec rake RAILS_ENV=production reports:prune upto=1 unit=mon' && \ 513 | echo "Optimizing Database" && \ 514 | /usr/bin/su -m puppet-dashboard -c '/usr/local/bin/bundle exec rake RAILS_ENV=production db:raw:optimize' 515 | 'EOF' 516 | chmod 755 /usr/local/etc/periodic/monthly/clean_dashboard_database.sh 517 | 518 | mkdir -p /usr/local/etc/periodic/weekly 519 | cat > /usr/local/etc/periodic/weekly/clean_puppet_reports.sh << 'EOF' 520 | #!/bin/sh 521 | echo "Pruning Puppetmaster Reports greater than 7 days old" 522 | echo -n " Reports Removed:" 523 | find /var/puppet/reports -mtime +7 | xargs rm -v | wc -l 524 | 'EOF' 525 | chmod 755 /usr/local/etc/periodic/weekly/clean_puppet_reports.sh 526 | -------------------------------------------------------------------------------- /squid-jail-HOWTO: -------------------------------------------------------------------------------- 1 | ################################################################################ 2 | ## Squid Jail Configuration ## 3 | ################################################################################ 4 | # Configuration for Squid in a jail. The default port, 3128, is set up to not 5 | # cache anything and port 3129 is set up to cache. An apt-get friendly config 6 | # is in place to cache downloaded packages. 7 | # 8 | # This is based off my current Squid config. However, I no longer run Squid in 9 | # a jail as shown below as I now run the same setup at the edge of my network 10 | # on a more powerful router that handles all the filtering/proxying/firewalling 11 | # for my home network. 12 | # 13 | # Written 2014 by Jason Unovitch 14 | # jason.unovitch@gmail.com 15 | # https://github.com/junovitch 16 | ################################################################################ 17 | 18 | ezjail-admin create -f dmz squid.mydomain.name 10.100.102.19 19 | ezjail-admin console -f squid.mydomain.name 20 | passwd 21 | 22 | # Install Squid 23 | pkg install squid 24 | 25 | 'EOF' 26 | 27 | # Patch Squid configuration 28 | patch /usr/local/etc/squid/squid.conf << 'EOF' 29 | --- squid.conf 2014-12-03 00:11:44.000000000 +0000 30 | +++ squid.conf 2014-12-03 00:17:27.000000000 +0000 31 | @@ -24,6 +24,12 @@ 32 | acl Safe_ports port 777 # multiling http 33 | acl CONNECT method CONNECT 34 | 35 | +acl no_cache myport 3128 36 | +acl cache myport 3129 37 | + 38 | +cache deny no_cache 39 | +cache allow cache 40 | + 41 | # 42 | # Recommended minimum Access Permission configuration: 43 | # 44 | @@ -57,9 +63,12 @@ 45 | 46 | # Squid normally listens to port 3128 47 | http_port 3128 48 | +http_port 3129 49 | 50 | # Uncomment and adjust the following to add a disk cache directory. 51 | -#cache_dir ufs /var/squid/cache/squid 100 16 256 52 | +cache_dir ufs /var/squid/cache/squid 8192 16 256 53 | +cache_replacement_policy heap LFUDA 54 | +maximum_object_size 1024 MB 55 | 56 | # Leave coredumps in the first cache dir 57 | coredump_dir /var/squid/cache/squid 58 | @@ -67,7 +76,38 @@ 59 | # 60 | # Add any of your own refresh_pattern entries above these. 61 | # 62 | -refresh_pattern ^ftp: 1440 20% 10080 63 | -refresh_pattern ^gopher: 1440 0% 1440 64 | refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 65 | -refresh_pattern . 0 20% 4320 66 | +refresh_pattern ^ftp: 1440 20% 10080 67 | +refresh_pattern ^gopher: 1440 0% 1440 68 | +refresh_pattern deb$ 525600 100% 1576800 69 | +refresh_pattern udeb$ 525600 100% 1576800 70 | +refresh_pattern tar.gz$ 525600 100% 1576800 71 | +refresh_pattern DiffIndex$ 0 20% 4320 refresh-ims 72 | +refresh_pattern PackagesIndex$ 0 20% 4320 refresh-ims 73 | +refresh_pattern Packages\.bz2$ 0 20% 4320 refresh-ims 74 | +refresh_pattern Packages\.gz$ 0 20% 4320 refresh-ims 75 | +refresh_pattern Packages\.lzma$ 0 20% 4320 refresh-ims 76 | +refresh_pattern SourcesIndex$ 0 20% 4320 refresh-ims 77 | +refresh_pattern Sources\.bz2$ 0 20% 4320 refresh-ims 78 | +refresh_pattern Sources\.gz$ 0 20% 4320 refresh-ims 79 | +refresh_pattern Sources\.lzma$ 0 20% 4320 refresh-ims 80 | +refresh_pattern Release$ 0 20% 4320 refresh-ims 81 | +refresh_pattern Release\.gpg$ 0 20% 4320 refresh-ims 82 | +refresh_pattern Translation-en\.bzip2$ 0 20% 4320 refresh-ims 83 | +refresh_pattern Translation-en\.bz2$ 0 20% 4320 refresh-ims 84 | +refresh_pattern Translation-en\.gz$ 0 20% 4320 refresh-ims 85 | +refresh_pattern Translation-en\.lzma$ 0 20% 4320 refresh-ims 86 | +refresh_pattern Translation-fr\.bzip2$ 0 20% 4320 refresh-ims 87 | +refresh_pattern Translation-fr\.bz2$ 0 20% 4320 refresh-ims 88 | +refresh_pattern Translation-fr\.gz$ 0 20% 4320 refresh-ims 89 | +refresh_pattern Translation-fr\.lzma$ 0 20% 4320 refresh-ims 90 | +refresh_pattern . 0 20% 4320 91 | +refresh_all_ims on 92 | + 93 | +# 94 | +# General administrative or security options. 95 | +# 96 | +logfile_rotate 5 97 | +httpd_suppress_version_string on 98 | +forwarded_for off 99 | +visible_hostname squid.lan 100 | 'EOF' 101 | 102 | # Enable a daily log file rotation via root crontab 103 | printf "0\t8\t*\t*\t*\t/usr/local/sbin/squid -k rotate\n" >> /var/cron/tabs/root 104 | 105 | # Fix permissions and enable 106 | chgrp squid /usr/local/etc/squid/squid.conf 107 | echo 'squid_enable="YES"' >> /etc/rc.conf.local 108 | 109 | # Initialize cache directory 110 | squid -z 111 | 112 | # Start Squid 113 | service squid start 114 | --------------------------------------------------------------------------------