Garey's Blog–FreeBSD/PHP/GoLang

十二月 15th, 2009

FreeBSD7.2下Lighttpd+PHP+Mysql安装配置笔记

1 Comment, FreeBSD, MySQL, PHP, by garey, 6,872 views.

1,安装mysql
cd /usr/ports/database/mysql51-server
make install clean
2,安装lighttpd
cd /usr/ports/www/lighttpd
make install clean
(默认选项)
3,安装php5
cd /usr/ports/lang/php5
make install clean
(默认选项)
4,安装php5-extensions
cd /usr/ports/lang/php5-extensions
make install clean
增加GD,MBSTRING,MCRYPT,MYSQL,MYSQLI
5,配置lighttpd
vi /usr/local/etc/lighttpd.conf
取消需要用到模块的注释,mod_rewrite,mod_access,mod_fastcgi,
mod_simple_vhost,mod_cgi,mod_compress,mod_accesslog
取消fastcgi.server的注释
fastcgi.server = ( “.php” =>
( “localhost” =>
(
“socket” => “/var/run/lighttpd/php-fastcgi.socket”,
“bin-path” => “/usr/local/bin/php-cgi”
)
)
)
另:
touch /var/log/lighttpd.access.log
touch /var/log/lighttpd.error.log
mkdir /var/run/lighttpd
chown -R www:www /var/run/lighttpd
chown www:www /var/log/lighttpd.access.log
chown www:www /var/log/lighttpd.error.log
6,启动lighttpd和mysql
vi /etc/rc.conf
增加
mysql_enable=”YES”
lighttpd_enable=”YES”
执行
/usr/local/etc/rc.d/lighttpd start
/usr/local/etc/rc.d/mysql start

十二月 15th, 2009

OpenSSH设置RSA密钥登陆

No Comments, FreeBSD, by garey, 4,407 views.

ssh-keygen -t rsa
Generating public/private rsa key pair.
Enter file in which to save the key (/home/garey/.ssh/id_rsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/garey/.ssh/id_rsa.
Your public key has been saved in /home/garey/.ssh/id_rsa.pub.
The key fingerprint is:
57:57:65:2e:29:05:dd:23:37:b1:39:28:8b:93:f5:3a garey@test.bsdart.org
The key’s randomart image is:
+–[ RSA 2048]—-+
| .o.o*|
| ooO+|
| oo.*++|
| +.+o ..|
| S+.. . |
| .. . |
| E |
| . |
| |
+—————–+

cd .ssh/
cp id_rsa.pub authorized_keys

vi /etc/ssh/sshd_config
PasswordAuthentication no
ChallengeResponseAuthentication no
或者
UsePAM no

/etc/rc.d/sshd restart

将私钥id_rsa下载到本地,ssh客户端使用即可。
putty需要用PUTTYGEN.EXE把私钥转换一下才能使用。

十二月 15th, 2009

FreeBSD的IPFW设置

No Comments, FreeBSD, by garey, 4,023 views.

昨天raymond把ipfw编进内核,结果一重启,默认策略把自己挡在门外。
今天把策略重新作了详细研究,再重新编辑了策略。
vi /etc/rc.conf
新增
firewall_enable=”YES”
firewall_type=”UNKNOWN”
firewall_script=”/etc/ipfw.rules”

vi /etc/ipfw.rules
#!/bin/sh

oif=”em0″
iif=”em1″
fwcmd=”/sbin/ipfw -q add”

valid_tcpport=”22,25,53,80,110,465,995″
valid_udpport=”53″

/sbin/ipfw -q -f flush

$fwcmd 00010 check-state
$fwcmd 00020 allow all from any to any via $iif
$fwcmd 00030 allow all from any to any via lo0
$fwcmd 00040 allow all from any to any out via $oif keep-state

$fwcmd 10000 allow tcp from any to me $valid_tcpport in via $oif setup keep-state
$fwcmd 10001 allow udp from any to me $valid_udpport in via $oif keep-state

再执行:sh /etc/ipfw.rules

虽然就这么简单几句,有一丁点错误都可能把自己关门外。

十二月 15th, 2009

FreeBSD系统下Postfix邮件系统的建立

No Comments, FreeBSD, by garey, 5,165 views.

在网上搜了很多关于postfix+mysql的帖子,发现Extmail做的很好,只是本人要用的系统是FreeBSD 7.2,而Extmail For FreeBSD安装手册不是用的mysql,本人结合Extmail For Linux安装手册,成功安装了一套邮件系统(FreeBSD+Postfix+MySQL+Extman)。

一、创建帐号
增加一个存储邮件的帐号和组(vmail)
执行如下命令
pw group add vmail -g 1000
pw user add vmail -u 1000 -g 1000 -s /sbin/nologin -d /dev/null

二、mysql的安装和配置
cd /usr/ports/database/mysql51-server
make install clean

编辑/etc/rc.conf
mysql_enable=”YES”

三、ExtMan的安装
由于在安装过程中要使用ExtMan里面带的文件,因此在此先安装ExtMan。安装时需要选择MySQL支持。
cd /usr/ports/mail/extman/ && make install clean
数据库初始化
mysql -u root -p < /usr/local/www/extman/docs/extmail.sql
mysql -u root -p < /usr/local/www/extman/docs/init.sql

四、安装配置courier-imap POP3/IMAP

Courier-imap的安装

安装时选择:
TRASHQUOTA
AUTH_MYSQL

cd /usr/ports/mail/courier-imap/ && make install clean

Authlib的配置
编辑/usr/local/etc/authlib/authdaemonrc文件,内容类似如下:
authmodulelist=”authmysql”
authmodulelistorig=”authmysql”
daemons=5
authdaemonvar=/var/run/authdaemond
subsystem=mail
DEBUG_LOGIN=0
DEFAULTOPTIONS=”wbnodsn=1″
LOGGEROPTS=”"

增加/var/run/authdaemond的执行权限,在FreeBSD系统下,其他用户默认没有执行权限
chmod +x /var/run/authdaemond 

编辑/usr/local/etc/authlib/authmysqlrc文件,内容类似如下:
MYSQL_SERVER            localhost
MYSQL_USERNAME          extmail
MYSQL_PASSWORD          extmail
MYSQL_SOCKET            /tmp/mysql.sock
MYSQL_PORT              3306
MYSQL_OPT               0
MYSQL_DATABASE          extmail
MYSQL_USER_TABLE        mailbox
MYSQL_CRYPT_PWFIELD     password
MYSQL_UID_FIELD         uidnumber
MYSQL_GID_FIELD         gidnumber
MYSQL_LOGIN_FIELD       username
MYSQL_HOME_FIELD        homedir
MYSQL_NAME_FIELD        name
MYSQL_MAILDIR_FIELD     maildir
MYSQL_QUOTA_FIELD       quota
MYSQL_SELECT_CLAUSE     SELECT username,password,”",uidnumber,gidnumber,
                        CONCAT(‘/home/domains/’,homedir),              
                        CONCAT(‘/home/domains/’,maildir),              
                        quota,                                         
                        name                                           
                        FROM mailbox                                   
                        WHERE username = ‘$(local_part)@$(domain)’

配置支持POP3s
拷贝一份配置文件
cp /usr/local/etc/courier-imap/pop3d.cnf.dist /usr/local/etc/courier-imap/pop3d.cnf

编辑/usr/local/etc/courier-imap/pop3d.cnf文件,类似如下:

RANDFILE = /usr/local/share/courier-imap/pop3d.rand

[ req ]
default_bits = 1024
encrypt_key = yes
distinguished_name = req_dn
x509_extensions = cert_type
prompt = no

[ req_dn ]
C=CN
ST=SH
L=Shang Hai
O=Bsdart
OU=Esdart
CN=bsdartbsdart.org
emailAddress=garey.ding@gmail.com

[ cert_type ]
nsCertType = server

执行如下命令产生供POP3s使用的证书
/usr/local/sbin/mkpop3dcert

配置自动启动
编辑/etc/rc.conf文件,添加如下行:

courier_authdaemond_enable=”YES”
courier_imap_pop3d_enable=”YES”
courier_imap_pop3d_ssl_enable=”YES”

五、Postfix的安装和配置-MTA

安装postfix

安装时选择:

PCRE
SASL2
TLS
MYSQL
VDA
TEST

cd /usr/ports/mail/postfix/ && make install clean

配置postfix

编辑/etc/rc.conf,增加如下一行
sendmail_enable=”NO”
postfix_enable=”YES”
编辑/etc/aliases,确保有如下一行
postfix: root

替换掉系统带的sendmail程序
编辑/etc/mail/mailer.conf,修改:
sendmail        /usr/local/sbin/sendmail
send-mail       /usr/local/sbin/sendmail
mailq           /usr/local/sbin/sendmail
newaliases      /usr/local/sbin/sendmail
hoststat        /usr/local/sbin/sendmail
purgestat       /usr/local/sbin/sendmail

编辑/etc/periodic.conf,加入如下内容,禁掉sendmail的自动维护。
daily_clean_hoststat_enable=”NO”
daily_status_mail_rejects_enable=”NO”
daily_status_include_submit_mailq=”NO”
daily_submit_queuerun=”NO”

执行如下命令

postalias /etc/aliases
chown postfix:postfix /etc/opiekeys

编辑/usr/local/etc/postfix/main.cf
增加
mynetworks = 127.0.0.0/8

mydomain = bsdart.org
myhostname = mail.bsdart.org
myorigin = $mydomain

mail_name = Postfix – by bsdart.org
smtpd_banner = $myhostname ESMTP $mail_name

smtpd_error_sleep_time = 0s
unknown_local_recipient_reject_code = 450

virtual_mailbox_base = /home/domains
virtual_uid_maps=static:1000
virtual_gid_maps=static:1000

virtual_alias_maps = mysql:/usr/local/etc/postfix/mysql_virtual_alias_maps.cf
virtual_mailbox_domains = mysql:/usr/local/etc/postfix/mysql_virtual_domains_maps.cf
virtual_mailbox_maps = mysql:/usr/local/etc/postfix/mysql_virtual_mailbox_maps.cf

SMTP认证设置

编辑/usr/local/lib/sasl2/smtpd.conf

pwcheck_method:authdaemond
log_level:3
mech_list:PLAIN LOGIN
authdaemond_path:/var/run/authdaemond/socket

编辑/usr/local/etc/postfix/main.cf
增加
smtpd_sasl_auth_enable = yes
broken_sasl_auth_clients = yes
smtpd_sasl_local_domain =
#smtpd_sasl_local_domain = $myhostname

postfix反垃圾设置
编辑/usr/local/etc/postfix/main.cf
增加
smtpd_helo_required = yes
smtpd_delay_reject = yes
disable_vrfy_command = yes
smtpd_client_restrictions = check_client_access hash:/usr/local/etc/postfix/client_access
smtpd_helo_restrictions = reject_invalid_hostname,check_helo_access hash:/usr/local/etc/postfix/helo_access
smtpd_sender_restrictions = reject_non_fqdn_sender, reject_unknown_sender_domain, check_sender_access hash:/usr/local/etc/postfix/sender_access
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, reject_unauth_destination, reject_non_fqdn_recipient, reject_unknown_recipient_domain
smtpd_data_restrictions = reject_unauth_pipelining
header_checks = regexp:/usr/local/etc/postfix/head_checks
body_checks = regexp:/usr/local/etc/postfix/body_checks

TLS设置

生成证书,在这里默认私钥的访问密码为123qwe98,请根据自己的情况决定,以后可能会用得到。

mkdir -p /usr/local/etc/postfix/certs/CA
cd /usr/local/etc/postfix/certs/CA
mkdir certs crl newcerts private
echo “01″ > serial
touch index.txt
cp /usr/src/crypto/openssl/apps/openssl.cnf .

编辑openssl.cnf,确认dir参数的值是/usr/local/etc/postfix/certs/CA。然后继续执行如下命令,并根据情况输入信息。输入信息类似如下:

Country Name (2 letter code) [AU]:CN
State or Province Name (full name) [Some-State]:SH
Locality Name (eg, city) []:Shang Hai
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Bsdart
Organizational Unit Name (eg, section) []:bsdart
Common Name (eg, YOUR name) []:bsdart.org
Email Address []:garey.ding@gmail.com

命令如下:

openssl req -new -x509 -keyout private/cakey.pem -out cacert.pem -days 3650 -config openssl.cnf
openssl req -nodes -new -x509 -keyout mykey.pem -out myreq.pem -days 3650 -config openssl.cnf
openssl x509 -x509toreq -in myreq.pem -signkey mykey.pem -out tmp.pem
openssl ca -config openssl.cnf -policy policy_anything -out mycert.pem -infiles tmp.pem
rm tmp.pem
cp cacert.pem mycert.pem mykey.pem /usr/local/etc/postfix/certs/
cd /usr/local/etc/postfix/certs/
chown root:wheel cacert.pem mycert.pem
chown root:postfix mykey.pem
chmod 755 cacert.pem
chmod 644 mycert.pem
chmod 440 mykey.pem
ln -s cacert.pem `openssl x509 -noout -hash < cacert.pem `.0

配置postfix支持TLS
编辑/usr/local/etc/postfix/main.cf
增加
smtpd_use_tls = yes
smtpd_tls_auth_only = no
smtp_tls_CAfile = /usr/local/etc/postfix/certs/cacert.pem
smtp_tls_cert_file = /usr/local/etc/postfix/certs/mycert.pem
smtp_tls_key_file = /usr/local/etc/postfix/certs/mykey.pem
smtpd_tls_CAfile = /usr/local/etc/postfix/certs/cacert.pem
smtpd_tls_cert_file = /usr/local/etc/postfix/certs/mycert.pem
smtpd_tls_key_file = /usr/local/etc/postfix/certs/mykey.pem
smtpd_tls_received_header = yes
smtpd_tls_loglevel = 0
smtpd_starttls_timeout = 60s

配置master.cf,添加如下信息

smtps     inet  n       -       n       -       -       smtpd
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o smtpd_client_restrictions=permit_sasl_authenticated,reject

六、Maildrop的安装和配置-MDA
安装maildrop
安装时选择mysql
cd /usr/ports/mail/maildrop/ && make WITH_AUTHLIB=yes install clean
修改master.cf
修改master.cf的maildrop,类似修改为:

#maildrop  unix  -       n       n       -       -       pipe
#  flags=DRhu user=vmail argv=/usr/local/bin/maildrop -d ${recipient}
maildrop  unix  -       n       n       -       -       pipe
  flags=DRhu user=vmail:vmail argv=/usr/local/bin/maildrop -w 90 -d ${recipient}

编辑/usr/local/etc/postfix/main.cf
增加
virtual_transport=maildrop:
maildrop_destination_concurrency_limit=1
maildrop_destination_recipient_limit=1

编辑文件/usr/local/etc/maildroprc
确保是如下内容:

logfile “/var/log/maildrop.log”
TEST=”/bin/test -f”
#
# Check for custom user .mailfilter file
#
CUSTOM_FILTER=”$HOME/.mailfilter”
`$TEST $CUSTOM_FILTER && exit 1 || exit 0`
if ( $RETURNCODE == 0 )
{
        to “$HOME/Maildir”
}

touch /var/log/maildrop.log
chmod vmail:vmail /var/log/maildrop.log

七、安装配置Apache

安装apache
cd /usr/ports/www/apache22/ &&make WITH_SUEXEC=yes SUEXEC_DOCROOT=/usr/local/www install clean
配置/etc/rc.conf
添加如下一行
apache22_enable=”YES”

虚拟主机配置
编辑/usr/local/etc/apache22/Includes/extmail.conf

NameVirtualHost *:80

    ServerName mail.extmail.org
    DocumentRoot /usr/local/www/extman/html/

    ScriptAlias /extman/cgi “/usr/local/www/extman/cgi/”
    Alias /extman “/usr/local/www/extman/html/”

        SetHandler cgi-script
        Options +ExecCGI
        AllowOverride All
        AllowOverride None
        Options None
        Order allow,deny
        Allow from all

    SuexecUserGroup vmail vmail

八、配置ExtMan
配置extman
编辑/usr/local/www/extman/webman.cf,修改对应的参数如下

SYS_CONFIG = /usr/local/www/extman/
SYS_LANGDIR = /usr/local/www/extman/lang
SYS_TEMPLDIR = /usr/local/www/extman/html
SYS_MAILDIR_BASE = /home/domains
SYS_SESS_DIR = /var/tmp/extman/
SYS_PSIZE = 50
SYS_LANG = zh_CN
SYS_DEFAULT_MAXQUOTA = 10000
SYS_DEFAULT_MAXALIAS = 10000
SYS_DEFAULT_MAXUSERS = 1000
SYS_DEFAULT_MAXNDQUOTA = 100
SYS_BACKEND_TYPE = mysql
SYS_CRYPT_TYPE = md5crypt
SYS_MYSQL_USER = extman
SYS_MYSQL_PASS = extman
SYS_MYSQL_DB = extmail
SYS_MYSQL_HOST = localhost
SYS_MYSQL_SOCKET = /tmp/mysql.sock
SYS_MYSQL_TABLE = manager
SYS_MYSQL_ATTR_USERNAME = username
SYS_MYSQL_ATTR_PASSWD = password

其他设置
执行如下命令
mkdir /var/tmp/extman/
chown –R vmail:vmail /var/tmp/extman/
chmod 700 /var/tmp/extman/
chmod 600 /usr/local/www/extman/webman.cf
unlink /usr/local/www/extman/libs/HTML/KTemplate.pm
cp /usr/local/www/extmail/libs/HTML/KTemplate.pm /usr/local/www/extman/libs/HTML/

配置图形日志
安装依赖软件

cd /usr/ports/databases/rrdtool && make install clean
cd /usr/ports/devel/p5-File-Tail && make install clean
cd /usr/ports/devel/p5-Time-HiRes && make install clean

安装mailgraph_ext

cp -Rfp /usr/local/www/extman/addon/mailgraph_ext/ /usr/local/mailgraph_ext
/usr/local/mailgraph_ext/mailgraph-init start
/usr/local/mailgraph_ext/qmonitor-init start

之后使用root@extmail.org登录Extman后台管理控制台,新建自己需要的bsdart.org域,并建立帐号和别名。
之后就可以用建立好的帐号使用pop3,pop3s,smtp,smtps登录了。

十二月 15th, 2009

BIND启动报错的解决方法

No Comments, FreeBSD, by garey, 4,860 views.

当BIND设置好后,启动的时候总是报如下错误:

Jul 9 14:08:31 file named[32501]: the working directory is not writable

直接修改/etc/namedb目录的权限,在重启BIND之后权限还会恢复过来,问题依旧。在网上搜索之后,得到如下解决办法。

It is what’s called “programmer inflected useless warnings”.
The directory option is used for 2 things:
- The working directory for named
- The base directory for relative path references
For some reason named finds it worth mentioning that it can’t write anything in this directory since a few releases. Conventional setups have not written in the named base dir for decades, but all of a sudden it’s important to spit into logfiles.
If you really want this message to go away, you will need to change the directory option, like:

options {
    // Paths
    directory           “/etc/namedb/letskeepthisdirwriteable”;
}

As a result all your relative path references need to be rewritten, like:

zone “.” {
    type slave;
    file “../slave/root.slave”;
    masters {
        192.5.5.241;    // F.ROOT-SERVERS.NET.
    };
    notify no;
};

I found it better to just ignore this warning.

十二月 15th, 2009

FreeBSD Name Server配置

1 Comment, FreeBSD, by garey, 6,052 views.

FreeBSD系统自带BIND软件,我们编辑/etc/namedb/named.conf即可设置BIND。

把默认的named.conf作个备份
cp /etc/namedb/named.conf /etc/namedb/named.conf.default

修改named.conf
options选项增加
allow-query     { any; };
recursion       no;        // 不提供递归服务
去掉
listen-on       { 127.0.0.1; };

域名记录增加
zone “bsdartbsdart.org” {
type master;
file “bsdart/bsdart.org.db”;
};

zone “23.51.210.in-addr.arpa” {
type master;
file “bsdart/bsdart.org.rev”;
};

新建bsdart目录
mkdir /etc/namedb/bsdart
chown -R bind:wheel /etc/namedb/bsdart

cd /etc/namedb/bsdart
vi bsdart.org.db
$TTL 3600
bsdart.org.     IN      SOA     dns.bsdart.org. admin.bsdart.org. (
2009070901      ; Serial
10800           ; Refresh
3600            ; Retry
604800          ; Expire
300 )           ; Negative Reponse TTL
; DNS Servers
IN      NS      dns.bsdart.org.
; MX Records
IN      MX 10   mail.bsdart.org.

IN      A       210.51.23.23
; Machine Names
localhost       IN      A       127.0.0.1
mail            IN      A       210.51.23.23
dns             IN      A       210.51.23.23
; Aliases
www             IN      CNAME   bsdart.org.

vi bsdart.org.rev
$TTL 3600
23.51.210.in-addr.arpa. IN SOA dns.bsdart.org. admin.bsdart.org. (
2009070901      ; Serial
10800           ; Refresh
3600            ; Retry
604800          ; Expire
300 )           ; Negative Reponse TTL
IN      NS      dns.bsdart.org.
23      IN      PTR     mail.bsdart.org.

vi /etc/rc.conf
新增
named_enable=”YES”