vi /etc/rc.conf
fsck_y_enable="YES" # "NO"
firewall_enable="YES" # "NO"
firewall_script="/etc/ipfw.rules" # "/etc/rc.firewall"
tcp_drop_synfin="YES" # "NO"
icmp_drop_redirect="YES" # "NO"
syslogd_flags="-ss" # "-s"
sshd_enable="YES" # "NO"
ntpdate_enable="YES" # "NO"
ntpdate_flags="-b -s -4" # "-b"
ntpdate_hosts="ptbtime2.ptb.de" # ""
keymap="german.iso" # "NO"
font8x16="ISO8859-1" # "NO"
font8x14="ISO8859-1" # "NO"
font8x8="ISO8859-1" # "NO"
sendmail_submit_enable="NO" # "YES"
sendmail_outbound_enable="NO" # "YES"
sendmail_msp_queue_enable="NO" # "YES"
cron_flags="$cron_flags -J 15" # ""
webmin_enable="YES" # "<not defined>"
nginx_enable="YES" # "<not defined>"
php_fpm_enable="YES" # "<not defined>"
mysql_enable="YES" # "<not defined>"
proftpd_enable="YES" # "<not defined>"
linux_enable="YES"
vi /etc/src.conf
WITH_BIND_SIGCHASE=YES
WITH_ICONV=YES
vi /etc/make.conf
THREAD=8
INSTALL_NODEBUG=YES
INSTALL_NODEBUG=YES
MASTER_SITE_BACKUP?= http://ftp4.de.freebsd.org/pub/FreeBSD/ports/distfiles/${DIST_SUBDIR}/
MASTER_SITE_OVERRIDE?= ${MASTER_SITE_BACKUP}
KERNCONF?=GENERIC
CPUTYPE?=opteron
CFLAGS= -O2 -fno-strict-aliasing -pipe
CXXFLAGS+= -fconserve-space
COPTFLAGS= -O -pipe
PRINTERDEVICE=ascii
SUP_UPDATE=
SUP=/usr/bin/csup
SUPFLAGS= -g -L 2
SUPHOST=cvsup.de.FreeBSD.org
SUPFILE=/usr/share/examples/cvsup/standard-supfile
WITHOUT_X11=YES
echo '59 2 * * * root /usr/sbin/ntpdate -b -s -4 ptbtime2.ptb.de' >> /etc/crontab
vi /etc/profile
LANG=de_DE.ISO8859-1; export LANG
MM_CHARSET=ISO-8859-1; export MM_CHARSET
vi /etc/csh.login
setenv LANG de_DE.ISO8859-1
setenv MM_CHARSET ISO-8859-1
vi /etc/login.conf
default:\
:passwd_format=blf:\
:minpasswordlen=8:\
:mixpasswordcase=true:\
:idletime=30:\
:umask=022:
unicode|Unicode Users Accounts:\
:charset=UTF-8:\
:lang=de_DE.ISO8859-1:
:tc=default:
cap_mkdb /etc/login.conf
pw usermod root -L unicode
vi /etc/ttys
console none unknown off insecure
vi /etc/gettytab
P|Pc|Pc console:\
:ht:np:sp#115200:\
:cl=\E[H\E[2J:
Anschliessend muss die Datei in eine Systemdatenbank umgewandelt werden.
cap_mkdb /etc/login.conf
passwd root
passwd master
vi /etc/csh.cshrc
setenv LSCOLORS "Dxfxcxdxbxegedabagacad"
alias l ls -lha
alias ls ls -GF
vi /root/.cshrc
# $FreeBSD: release/9.1.0/etc/root/dot.cshrc 170088 2007-05-29 06:37:58Z dougb $
#
# .cshrc - csh resource script, read at beginning of execution by each shell
#
# see also csh(1), environ(7).
#
alias h history 25
alias j jobs -l
alias la ls -a
alias lf ls -FA
alias ll ls -lA
# A righteous umask
umask 22
set path = (/sbin /bin /usr/sbin /usr/bin /usr/games /usr/local/sbin /usr/local/bin $HOME/bin)
setenv EDITOR ee
setenv PAGER more
setenv BLOCKSIZE K
if ($?prompt) then
# An interactive shell -- set some stuff up
set prompt = "[%B%n%b@%B%m%b:%B%~%b] %# "
set filec
set history = 1000
set savehist = 1000
set mail = (/var/mail/$USER)
if ( $?tcsh ) then
bindkey "^W" backward-delete-word
bindkey -k up history-search-backward
bindkey -k down history-search-forward
bindkey ^[[3~ delete-char
endif
endif
su - master
umask 0077
vi .cshrc
# $FreeBSD: release/9.1.0/share/skel/dot.cshrc 170119 2007-05-29 22:07:57Z dougb $
#
# .cshrc - csh resource script, read at beginning of execution by each shell
#
# see also csh(1), environ(7).
#
alias h history 25
alias j jobs -l
alias la ls -a
alias lf ls -FA
alias ll ls -lA
# A righteous umask
umask 22
set path = (/sbin /bin /usr/sbin /usr/bin /usr/games /usr/local/sbin /usr/local/bin $HOME/bin)
setenv EDITOR ee
setenv PAGER more
setenv BLOCKSIZE K
if ($?prompt) then
# An interactive shell -- set some stuff up
set prompt = "[%B%n%b@%B%m%b:%B%~%b] %# "
set filec
set history = 1000
set savehist = 1000
set mail = (/var/mail/$USER)
if ( $?tcsh ) then
bindkey "^W" backward-delete-word
bindkey -k up history-search-backward
bindkey -k down history-search-forward
bindkey ^[[3~ delete-char
endif
endif
vi .vimrc
set background=dark
syntax on
set hlsearch
set nocompatible
set autoindent
set smartindent
set tabstop=2
set shiftwidth=2
set showmatch
set ruler
set incsearch
cp .vimrc /home/master
vi /etc/ipfw.rules
IPF="ipfw -q add"
ipfw -q -f flush
#loopback
$IPF allow all from any to any via lo0
$IPF deny all from any to 127.0.0.0/8
$IPF deny all from 127.0.0.0/8 to any
$IPF deny tcp from any to any frag
# statefull
$IPF check-state
$IPF allow tcp from any to any established
$IPF allow all from any to any out keep-state
$IPF allow icmp from any to any
# Erlaube FTP
$IPF allow tcp from any to any 21 in setup
$IPF allow tcp from any 20 to any 1024-65535 in setup
# passive mode FTP erlauben - nicht empfohlen - wird ins log geschrieben
# um Missbrauch nachvollziehen zu koennen
$IPF allow log tcp from any 1024-65535 to any 1024-65535 in setup
# open port ssh (22), mail (25)
$IPF allow tcp from any to any 22 in
$IPF allow tcp from any to any 22 out
$IPF allow udp from any to any 53 in
$IPF allow tcp from any to any 53 in
$IPF allow udp from any to any 53 out
$IPF allow tcp from any to any 53 out
# http (80), dns (53) webmin (10000)
$IPF allow udp from any to any 80 in
$IPF allow tcp from any to any 80 in
$IPF allow udp from any to any 443 in
$IPF allow tcp from any to any 443 in
$IPF allow udp from any to any 445 in
$IPF allow tcp from any to any 445 in
$IPF allow udp from any to any 8080 in
$IPF allow tcp from any to any 8080 in
$IPF allow tcp from any to any 10000 in
$IPF allow tcp from any to any 10000 out
$IPF allow tcp from any to any 3306 in
$IPF allow tcp from any to any 3306 out
# Mail 110 143 25 465 585 993 995
$IPF allow tcp from any to any 25 in
$IPF allow tcp from any to any 25 out
$IPF allow tcp from any to any 110 in
$IPF allow tcp from any to any 110 out
$IPF allow tcp from any to any 143 in
$IPF allow tcp from any to any 143 out
$IPF allow tcp from any to any 465 in
$IPF allow tcp from any to any 465 out
$IPF allow tcp from any to any 585 in
$IPF allow tcp from any to any 585 out
$IPF allow tcp from any to any 993 in
$IPF allow tcp from any to any 993 out
$IPF allow tcp from any to any 995 in
$IPF allow tcp from any to any 995 out
#Default deny
$IPF deny all from any to any
echo 'firewall_enable="YES"' >> /etc/rc.conf
echo 'firewall_script="/etc/ipfw.rules"' >> /etc/rc.conf
csup -L 2 -h cvsup.FreeBSD.org /usr/share/examples/cvsup/ports-supfile
portsnap fetch
portsnap extract
portsnap update
cd /usr/ports/ports-mgmt/portupgrade && make install clean
cd /usr/ports/devel/subversion && make install
cd /usr/src && fetch http://ftp4.de.freebsd.org/pub/FreeBSD/releases/amd64/9.1-RELEASE/src.txz && tar -C / -xvzf src.txz && rm src.txz
portinstall portmaster
portinstall portaudit
mkdir -p /usr/compat/linux/proc
ln -s /usr/compat /compat
vi /etc/fstab
linproc /compat/linux/proc linprocfs rw 0 0
fdesc /dev/fd fdescfs rw 0 0
proc /proc procfs rw 0 0
mount -t fdescfs fdesc /dev/fd
mount -t procfs proc /proc
mount linproc
cd /usr/ports/emulators/linux_base-f10
make install clean
cd /usr/ports/distfiles
fetch ftp://ftp.tmn.ru/pub/FreeBSD/distfiles/mc-4.8.1.7.tar.xz
portinstall wget wput gzip zip
portinstall htop
portinstall vim
portinstall mc
portinstall -c sshguard-ipfw
cd /usr/ports/ftp/proftpd && make config
cd /usr/ports/databases/mariadb55-server && make config
cd /usr/ports/www/nginx && make config
cd /usr/ports/lang/php5 && make config
cd /usr/ports/lang/php5-extensions && make config
mkdir -p /opt/conf
cd /opt/conf
wget http://geolite.maxmind.com/download/geoip/database/GeoLiteCountry/GeoIP.dat.gz
gunzip ./GeoIP.dat.gz
mkdir -p /var/www/vhost1/faceblogger.de
mkdir -p /var/www/vhost1/db.faceblogger.de
mkdir -p /var/www/vhost2/dust-fighter.de
mkdir -p /var/www/vhost2/sourcebans.dust-fighter.de
pw addgroup web01
pw addgroup web02
adduser web01
adduser web02
chmod -R 777 /var/www/vhost1/domain.de
chmod -R 777 /var/www/vhost1/domain.de
chown -R web01:web01 /var/www/vhost1/domain.de
chown -R web01:web01 /var/www/vhost1/domain.de
chmod -R 777 /var/www/vhost2/domain.de
chmod -R 777 /var/www/vhost2/domain.de
chown -R web02:web02 /var/www/vhost2/domain.de
chown -R web02:web02 /var/www/vhost2/domain.de
mysqladmin -u root password xxxxxxxxxxxxxxx
mkdir -p /var/log/nginx
vim /var/log/nginx/error.log
vi update.sh
#!/bin/sh
LOG_FILE="/var/log/freebsd-update.log"
echo "Starting updates: `date`" | tee -a ${LOG_FILE}
echo "***"
echo "*** Checking for FreeBSD patches..."
echo "***"
/usr/sbin/freebsd-update fetch | tee -a ${LOG_FILE}
/usr/sbin/freebsd-update install | tee -a ${LOG_FILE}
echo "***"
echo "*** Updating ports tree..."
echo "***"
/usr/sbin/portsnap fetch update | tee -a ${LOG_FILE}
echo "***"
echo "*** Updating ports extract..."
echo "***"
/usr/sbin/portsnap fetch extract | tee -a ${LOG_FILE}
echo "***"
echo "*** Looking for ports to update..."
echo "***"
/usr/local/sbin/portmaster -a --no-confirm | tee -a ${LOG_FILE}
echo "***"
echo "*** Checking installed ports for known security problems..."
echo "***"
/usr/local/sbin/portaudit -Fva | tee -a ${LOG_FILE}
echo "Finished updates: `date`" | tee -a ${LOG_FILE}
chmod +x update.sh
./update.sh
cd /usr/obj
chflags -R noschg *
rm -rf *
grep IPFIREWALL /usr/src/sys/amd64/conf
cd /usr/src/sys/amd64/conf
cp GENERIC IPFWKERNEL
vim IPFWKERNEL
ihr fügt nun folgendes ein
machine amd64
cpu HAMMER
ident GENERIC
options IPFIREWALL # required for IPFW
options IPFIREWALL_VERBOSE # optional; logging
options IPFIREWALL_VERBOSE_LIMIT=10 # optional; don't get too many log entries
options IPDIVERT # needed for natd
cd /usr/src
make buildkernel KERNCONF=IPFWKERNEL
make installkernel KERNCONF=IPFWKERNEL