From f9301e0fe52313581920026a186955c78fcbe831 Mon Sep 17 00:00:00 2001 From: Cullum Smith Date: Tue, 22 Oct 2024 22:01:49 -0400 Subject: zfs autosnapshots, syncthing, pam cleanup --- files/etc/cron.d/zfs-autosnapshot.freebsd | 5 + files/etc/cron.d/zfs-trim.freebsd | 1 - files/etc/cron.d/zfs.freebsd | 2 + files/etc/login.access.freebsd | 13 ++ files/etc/pam.d/kde.freebsd | 2 +- files/etc/pam.d/login.freebsd | 3 +- files/etc/pam.d/other.freebsd | 8 ++ files/etc/pam.d/sddm.freebsd | 3 +- files/etc/pam.d/sshd.freebsd | 4 +- files/etc/pam.d/su.freebsd | 10 ++ files/etc/pam.d/sudo.freebsd | 3 +- files/etc/pam.d/system.freebsd | 8 ++ files/etc/pf.conf.nfs_server | 52 ++++++++ files/usr/local/etc/nginx/vhosts.conf.nfs_server | 38 ++++++ .../local/etc/poudriere.d/pkglist.pkg_repository | 3 + files/usr/local/etc/rc.d/syncthing_user.nfs_server | 86 ++++++++++++++ .../local/etc/syncthing.template.xml.nfs_server | 131 +++++++++++++++++++++ files/usr/share/skel/dot.login.freebsd | 4 + files/usr/share/skel/dot.profile.freebsd | 6 + files/usr/share/skel/dot.shrc.freebsd | 19 +++ 20 files changed, 393 insertions(+), 8 deletions(-) create mode 100644 files/etc/cron.d/zfs-autosnapshot.freebsd delete mode 100644 files/etc/cron.d/zfs-trim.freebsd create mode 100644 files/etc/cron.d/zfs.freebsd create mode 100644 files/etc/login.access.freebsd create mode 100644 files/etc/pam.d/other.freebsd create mode 100644 files/etc/pam.d/su.freebsd create mode 100644 files/etc/pam.d/system.freebsd create mode 100644 files/etc/pf.conf.nfs_server create mode 100644 files/usr/local/etc/nginx/vhosts.conf.nfs_server create mode 100644 files/usr/local/etc/rc.d/syncthing_user.nfs_server create mode 100644 files/usr/local/etc/syncthing.template.xml.nfs_server create mode 100644 files/usr/share/skel/dot.login.freebsd create mode 100644 files/usr/share/skel/dot.profile.freebsd create mode 100644 files/usr/share/skel/dot.shrc.freebsd (limited to 'files') diff --git a/files/etc/cron.d/zfs-autosnapshot.freebsd b/files/etc/cron.d/zfs-autosnapshot.freebsd new file mode 100644 index 0000000..0cc1e3b --- /dev/null +++ b/files/etc/cron.d/zfs-autosnapshot.freebsd @@ -0,0 +1,5 @@ +15,30,45 * * * * root /usr/local/sbin/zfs-auto-snapshot frequent 4 +0 * * * * root /usr/local/sbin/zfs-auto-snapshot hourly 24 +7 0 * * * root /usr/local/sbin/zfs-auto-snapshot daily 7 +14 0 * * 7 root /usr/local/sbin/zfs-auto-snapshot weekly 4 +28 0 1 * * root /usr/local/sbin/zfs-auto-snapshot monthly 12 diff --git a/files/etc/cron.d/zfs-trim.freebsd b/files/etc/cron.d/zfs-trim.freebsd deleted file mode 100644 index 80e0cd5..0000000 --- a/files/etc/cron.d/zfs-trim.freebsd +++ /dev/null @@ -1 +0,0 @@ -@weekly root zpool list -Ho name | xargs -r -n1 zpool trim diff --git a/files/etc/cron.d/zfs.freebsd b/files/etc/cron.d/zfs.freebsd new file mode 100644 index 0000000..477f1df --- /dev/null +++ b/files/etc/cron.d/zfs.freebsd @@ -0,0 +1,2 @@ +@weekly root zpool list -Ho name | xargs -r -n1 zpool trim +@monthly root zpool list -Ho name | xargs -r zpool scrub diff --git a/files/etc/login.access.freebsd b/files/etc/login.access.freebsd new file mode 100644 index 0000000..e6667db --- /dev/null +++ b/files/etc/login.access.freebsd @@ -0,0 +1,13 @@ +# Always allow root logins. ++:root:ALL + +$(if [ -n "${login_access_groups:-}" ] || [ -n "${login_access_users:-}" ]; then + printf -- '-:ALL EXCEPT ' +if [ -n "${login_access_groups:-}" ]; then + printf '(%s) ' ${login_access_groups} +fi +if [ -n "${login_access_users:-}" ]; then + printf '%s ' ${login_access_users} +fi + printf ':ALL\n' +fi) diff --git a/files/etc/pam.d/kde.freebsd b/files/etc/pam.d/kde.freebsd index 8f87b98..cb89294 100644 --- a/files/etc/pam.d/kde.freebsd +++ b/files/etc/pam.d/kde.freebsd @@ -1,5 +1,5 @@ auth required /usr/local/lib/security/pam_krb5.so try_first_pass account required /usr/local/lib/security/pam_krb5.so -account required pam_login_access.so +account required pam_login_access.so nodefgroup account required pam_unix.so diff --git a/files/etc/pam.d/login.freebsd b/files/etc/pam.d/login.freebsd index 164fcb0..ae50bbe 100644 --- a/files/etc/pam.d/login.freebsd +++ b/files/etc/pam.d/login.freebsd @@ -5,12 +5,13 @@ auth required pam_unix.so no_warn try_first_pass nullok account requisite pam_securetty.so account required pam_nologin.so account required /usr/local/lib/security/pam_krb5.so -account required pam_login_access.so +account required pam_login_access.so nodefgroup account required pam_unix.so session required pam_lastlog.so no_fail session required pam_xdg.so session required /usr/local/lib/security/pam_krb5.so +session optional /usr/local/lib/pam_mkhomedir.so mode=0700 password sufficient /usr/local/lib/security/pam_krb5.so try_first_pass password required pam_unix.so no_warn try_first_pass diff --git a/files/etc/pam.d/other.freebsd b/files/etc/pam.d/other.freebsd new file mode 100644 index 0000000..38db8c5 --- /dev/null +++ b/files/etc/pam.d/other.freebsd @@ -0,0 +1,8 @@ +auth required pam_unix.so no_warn try_first_pass + +account required pam_nologin.so +account required pam_unix.so + +session required pam_permit.so + +password required pam_permit.so diff --git a/files/etc/pam.d/sddm.freebsd b/files/etc/pam.d/sddm.freebsd index 6a75823..c222750 100644 --- a/files/etc/pam.d/sddm.freebsd +++ b/files/etc/pam.d/sddm.freebsd @@ -10,12 +10,13 @@ auth optional pam_kwallet5.so account requisite pam_securetty.so account required pam_nologin.so account required /usr/local/lib/security/pam_krb5.so -account required pam_login_access.so +account required pam_login_access.so nodefgroup account required pam_unix.so session required pam_lastlog.so no_fail session required pam_xdg.so no_fail session required /usr/local/lib/security/pam_krb5.so +session optional /usr/local/lib/pam_mkhomedir.so mode=0700 session optional pam_kwallet5.so auto_start password required /usr/local/lib/security/pam_krb5.so try_first_pass diff --git a/files/etc/pam.d/sshd.freebsd b/files/etc/pam.d/sshd.freebsd index 559a980..1f81b48 100644 --- a/files/etc/pam.d/sshd.freebsd +++ b/files/etc/pam.d/sshd.freebsd @@ -3,11 +3,11 @@ auth required pam_unix.so no_warn try_first_pass account required pam_nologin.so account required /usr/local/lib/security/pam_krb5.so -account required pam_login_access.so +account required pam_login_access.so nodefgroup account required pam_unix.so session required /usr/local/lib/security/pam_krb5.so -session required pam_permit.so +session required /usr/local/lib/pam_mkhomedir.so mode=0700 password sufficient /usr/local/lib/security/pam_krb5.so try_first_pass password required pam_unix.so no_warn try_first_pass diff --git a/files/etc/pam.d/su.freebsd b/files/etc/pam.d/su.freebsd new file mode 100644 index 0000000..0bd3ea0 --- /dev/null +++ b/files/etc/pam.d/su.freebsd @@ -0,0 +1,10 @@ +auth sufficient pam_rootok.so no_warn +auth sufficient pam_self.so no_warn +auth requisite pam_group.so no_warn group=wheel root_only fail_safe ruser +auth sufficient /usr/local/lib/security/pam_krb5.so try_first_pass +auth required pam_unix.so no_warn try_first_pass nullok + +account required /usr/local/lib/security/pam_krb5.so +account required pam_unix.so + +session required pam_permit.so diff --git a/files/etc/pam.d/sudo.freebsd b/files/etc/pam.d/sudo.freebsd index 6a6b0a4..6c0a573 100644 --- a/files/etc/pam.d/sudo.freebsd +++ b/files/etc/pam.d/sudo.freebsd @@ -2,10 +2,9 @@ auth sufficient /usr/local/lib/security/pam_krb5.so try_first_pass auth required pam_unix.so no_warn try_first_pass account required /usr/local/lib/security/pam_krb5.so -account required pam_login_access.so account required pam_unix.so -account required pam_permit.so +session required pam_permit.so password sufficient /usr/local/lib/security/pam_krb5.so try_first_pass password required pam_unix.so no_warn try_first_pass diff --git a/files/etc/pam.d/system.freebsd b/files/etc/pam.d/system.freebsd new file mode 100644 index 0000000..b85310c --- /dev/null +++ b/files/etc/pam.d/system.freebsd @@ -0,0 +1,8 @@ +auth required pam_unix.so no_warn try_first_pass nullok + +account required pam_unix.so + +session required pam_lastlog.so no_fail +session required pam_xdg.so + +password required pam_unix.so no_warn try_first_pass diff --git a/files/etc/pf.conf.nfs_server b/files/etc/pf.conf.nfs_server new file mode 100644 index 0000000..628ed7c --- /dev/null +++ b/files/etc/pf.conf.nfs_server @@ -0,0 +1,52 @@ +$(if [ -n "${pf_egress_interfaces:-}" ]; then + printf 'egress = "{ %s }"\n' "$(join ', ' $pf_egress_interfaces)" + else + printf 'egress = "%s"\n' "$BOXCONF_DEFAULT_INTERFACE" + fi) +allowed_tcp_ports = "{ $(join ', ' ${allowed_tcp_ports:-}) }" +allowed_udp_ports = "{ $(join ', ' ${allowed_udp_ports:-}) }" + +$([ "${acme_standalone:-}" = true ] && cat < ($egress) port $acme_standalone_port' + +[ -n "${redirect_tcp_ports:-}" ] && printf \ + 'rdr on $egress inet proto tcp to port %s -> ($egress) port %s\n' $redirect_tcp_ports + +[ -n "${redirect_udp_ports:-}" ] && printf \ + 'rdr on $egress inet proto udp to port %s -> ($egress) port %s\n' $redirect_udp_ports) + +antispoof quick for \$egress + +block all +pass out quick on \$egress inet +pass in quick on \$egress inet proto icmp all icmp-type { echoreq, unreach } + +$([ "${acme_standalone:-}" = true ] && echo \ + 'pass in quick on $egress inet proto tcp to port $acme_standalone_port user $acme_standalone_user' + +[ -n "${allowed_tcp_ports:-}" ] && echo \ + 'pass in quick on $egress inet proto tcp to port $allowed_tcp_ports' + +[ -n "${allowed_udp_ports:-}" ] && echo \ + 'pass in quick on $egress inet proto udp to port $allowed_udp_ports' + +[ "$BOXCONF_VIRTUALIZATION_TYPE" == jail ] || echo \ + 'pass in quick on $egress inet proto { tcp, udp } to port $nfscbd_port' + +for user in ${syncthing_users:-}; do uid=$(id -u "$user"); eval "port=\$syncthing_${user}_port"; printf \ + 'pass in quick on $egress inet proto { tcp, udp } to port %s user %s\n' "$port" "$(id -u "$user")" +done) diff --git a/files/usr/local/etc/nginx/vhosts.conf.nfs_server b/files/usr/local/etc/nginx/vhosts.conf.nfs_server new file mode 100644 index 0000000..e6fa55b --- /dev/null +++ b/files/usr/local/etc/nginx/vhosts.conf.nfs_server @@ -0,0 +1,38 @@ +$(for user in ${syncthing_users:-}; do cat < "${syncthing_user_iconfdir}/config.xml" + fi +} + +if [ -n "$syncthing_user_instances" ]; then + _1=$1 + if [ $# -gt 1 ]; then + shift + syncthing_user_instances=$* + fi + + rc=0 + for syncthing_user_user in $syncthing_user_instances; do + syncthing_user_group=$syncthing_user_user + syncthing_user_iconfdir="${syncthing_user_confdir}/${syncthing_user_user}" + syncthing_user_irundir="${syncthing_user_rundir}/${syncthing_user_user}" + unset syncthing_user_port + eval "syncthing_user_port=\$syncthing_user_${syncthing_user_user}_port" + + if [ -z "${syncthing_user_port:-}" ]; then + echo "syncthing_user_${syncthing_user_user}_port not defined in /etc/rc.conf - skipping" 1>&2 + continue + fi + + pidfile="${syncthing_user_rundir}/${syncthing_user_user}/syncthing.pid" + command_args="-cf -s info -l daemon -T syncthing-${syncthing_user_user} -p ${pidfile} -t syncthing-${syncthing_user_user} \ + ${procname} ${syncthing_user_args} --home=${syncthing_user_iconfdir} --gui-address=unix://${syncthing_user_irundir}/syncthing.sock" + + run_rc_command "$_1" + if [ $? -ne 0 ]; then rc=1; fi + + unset _pidcmd _rc_restart_done + done + + exit $rc +else + echo 'No users defined. Set syncthing_user_instances in /etc/rc.conf.' 1>&2 + exit 1 +fi diff --git a/files/usr/local/etc/syncthing.template.xml.nfs_server b/files/usr/local/etc/syncthing.template.xml.nfs_server new file mode 100644 index 0000000..3ee90a1 --- /dev/null +++ b/files/usr/local/etc/syncthing.template.xml.nfs_server @@ -0,0 +1,131 @@ + + +
tcp://__FQDN__:__PORT__
+ false + false + 0 + 0 + 0 + false + 0 + 0 + + +
unix://__SOCK__
+ 770 + default + true + + + + quic://0.0.0.0:__PORT__ + tcp://0.0.0.0:__PORT__ + default + false + false + 0 + [ff12::8384]:0 + 0 + 0 + 60 + false + 10 + false + false + 60 + 30 + 10 + -1 + 0 + + https://data.syncthing.net/newdata + false + 1800 + 0 + false + 24 + false + 5 + false + 1 + https://upgrades.syncthing.net/meta.json + false + 10 + 0 + false + 0 + https://crash.syncthing.net/newcrash + false + 0 + 0 + default + auto + 0 + true + false + 0 + 0 + false + 10 + 20 + 30 + 40 + 50 + 0 + + + + basic + + + + 1 + + 3600 + + basic + + 0 + 0 + 0 + random + false + 0 + 0 + 10 + false + false + false + 25 + .stfolder + false + 0 + 2 + false + standard + standard + false + false + false + false + false + false + + 1024 + 4096 + + + +
dynamic
+ false + false + 0 + 0 + 0 + false + 0 + 0 + + + + diff --git a/files/usr/share/skel/dot.login.freebsd b/files/usr/share/skel/dot.login.freebsd new file mode 100644 index 0000000..6afb9f2 --- /dev/null +++ b/files/usr/share/skel/dot.login.freebsd @@ -0,0 +1,4 @@ +# .login - csh login script, read by login shell, after `.cshrc' at login. + +# Query terminal size; useful for serial lines. +if ( -x /usr/bin/resizewin ) /usr/bin/resizewin -z diff --git a/files/usr/share/skel/dot.profile.freebsd b/files/usr/share/skel/dot.profile.freebsd new file mode 100644 index 0000000..0197635 --- /dev/null +++ b/files/usr/share/skel/dot.profile.freebsd @@ -0,0 +1,6 @@ +export CLICOLOR=1 +export PAGER=less +export LESS='-iMRS -x2' +export EDITOR=vi +export LSCOLORS=DxfxgxgxcxxbxbaCacADAd +export ENV="${HOME}/.shrc" diff --git a/files/usr/share/skel/dot.shrc.freebsd b/files/usr/share/skel/dot.shrc.freebsd new file mode 100644 index 0000000..bc8e8da --- /dev/null +++ b/files/usr/share/skel/dot.shrc.freebsd @@ -0,0 +1,19 @@ +reset=$'\e[0m' +blue=$'\e[0;34m' +green=$'\e[0;32m' +PS1="\[${green}\]\u@\h\[${reset}\]:\[${blue}\]\W\[${green}\]\$\[${reset}\] " +unset reset blue green + +alias ls='ls -FHh' +alias ll='ls -l' +alias la='ls -la' +alias ..='cd ..' +alias ...='cd ../..' +alias mkdir='mkdir -p' +alias df='df -h' +alias du='du -ch' + +bind ^[[A ed-search-prev-history +bind ^[[B ed-search-next-history +bind "\\e[1;5C" em-next-word +bind "\\e[1;5D" ed-prev-word -- cgit v1.2.3