Installing FreeBSD 6 for Internet Server

2.1. Partition Layout

Before start the installation process. You must make up your mind about the partition layout of the hard disk because it is only the thing you can not change after install the system

Assume that you have single disk of moderate size (32GB or up) my suggestion for partition layout are:

2.2. Upgrade FreeBSD source and ports

After install FreeBSD 6 and ports tree from CD. You need to upgrade your system to the lastest patch to protect your system against various types of attack.

You need a pre-build program (or package in FreeBSD) to upgrade your system. The package is net/cvsup-without-gui which can be used to upgrade both source and ports tree.

For example,as the time of this writing version of 6 is 6.0 and assume that the platform is i386. The command to download and install cvsup are:

    # fetch ftp://ftp.freebsd.org/pub/FreeBSD/releases/i386/6.0-RELEASE/packages/net/cvsup-without-gui-16.1h_2.tbz
    cvsup-without-gui-16.1h_2.tbz                 100% of  754 kB   37 kBps 00m00s
    # pkg_add cvsup-without-gui-16.1h_2.tbz

    #For complete list of cvsupd see CVSup Sites on FreeBSD handbook.
    *default host=cvsup12.freebsd.org
    *default base=/usr
    *default prefix=/usr
    *default release=cvs
    *default delete use-rel-suffix
    *default tag=RELENG_6_0
    
    *default compress
    src-all
    ports-all tag=.
   

    # /usr/local/bin/cvsup -L2 cvs-supfile
   

2.3. Rebuild FreeBSD

Edit your /etc/make.conf (copy the default from /usr/src/share/examples/etc/make.conf). At least change the CPUTYPE to match your machine. See gcc 3.4.4 manual for detail of each CPUTYPE. FreeBSD building system may not be able to use all CPUTYPE in gcc manual. If your CPUTYPE cause a build error, try the other one. This is the example of my make.conf:

CPUTYPE?= p4         #Use ?= not = to allow FreeBSD build process to override this value
#CPUTYPE?= k8       #For Athlon64 on i386
#CPUTYPE?= athlon64 #For Athlon64 on AMD64

machine         i386
#machine        amd64
cpu             I686_CPU
#cpu            HAMMER

#options        SMP         # Symmetric MultiProcessor Kernel

ident           GAIA-I386
#ident          GAIA-AMD64

#Adjust memory limit for 4G RAM for i386
options         KVA_PAGES=384               #1.5 G for kernels
options         MAXDSIZ=(1536UL*1024*1024)  #1.5 G for data
options         MAXSSIZ=(128UL*1024*1024)   #128M for stack
                                            #Leave 896KB for code segment
options         DFLDSIZ=(1536UL*1024*1024)  #Set default data size to 1.5G

options         SCHED_4BSD
options         PREEMPTION              # Enable kernel thread preemption
options         INET                    # InterNETworking
options         FFS                     # Berkeley Fast Filesystem
options         SOFTUPDATES             # Enable FFS soft updates support
options         UFS_ACL                 # Support for access control lists
options         UFS_DIRHASH             # Improve performance on big directories
options         MD_ROOT                 # MD is a potential root device
options         CD9660                  # ISO 9660 Filesystem
options         PROCFS                  # Process filesystem (requires PSEUDOFS)
options         PSEUDOFS                # Pseudo-filesystem framework
options         GEOM_GPT                # GUID Partition Tables.
options         COMPAT_43               # Compatible with BSD 4.3 [KEEP THIS!]
#options        COMPAT_IA32             # Compatible with i386 binaries
options         COMPAT_FREEBSD4         # Compatible with FreeBSD4
options         COMPAT_FREEBSD5         # Compatible with FreeBSD5
options         SCSI_DELAY=5000         # Delay (in ms) before probing SCSI
options         KTRACE                  # ktrace(1) support
options         SYSVSHM                 # SYSV-style shared memory
options         SYSVMSG                 # SYSV-style message queues
options         SYSVSEM                 # SYSV-style semaphores
options         _KPOSIX_PRIORITY_SCHEDULING # POSIX P1003_1B real-time extensions
options         KBD_INSTALL_CDEV        # install a CDEV entry in /dev

options         ADAPTIVE_GIANT          # Giant mutex is adaptive.

#Kernel Options for PostgreSQL with large shared memory (312.5M)
options         SYSVSHM                 #SYSV-style shared memory
options         SYSVMSG                 #SYSV-style message queues
options         SYSVSEM                 #SYSV-style semaphores
options         SHMMAXPGS=80000
options         SHMSEG=256
options         SHMMNI=256
options         SEMMNI=256
options         SEMMNS=512
options         SEMMNU=256
options         SEMMAP=256
#PostgreSQL use a alot of shared memory - default is 200
options         PMAP_SHPGPERPROC=512

#Firewall & NAT & DummyNet, may be needed in jail setup
options         IPFIREWALL
options         IPDIVERT
options         IPFIREWALL_DEFAULT_TO_ACCEPT
options         IPFIREWALL_VERBOSE
options         IPFIREWALL_VERBOSE_LIMIT=100
options         DUMMYNET
options         IPFIREWALL_FORWARD

options         QUOTA

device          apic                    # I/O APIC
device          pci
# Floppy drives
device          fdc

# ATA and ATAPI devices
device          ata
device          atadisk         # ATA disk drives
device          ataraid         # ATA RAID drives
device          atapicd         # ATAPI CDROM drives
device          atapifd         # ATAPI floppy drives
device          atapist         # ATAPI tape drives
options         ATA_STATIC_ID   # Static device numbering

# SCSI peripherals
device          scbus           # SCSI bus (required for SCSI)
device          ch              # SCSI media changers
device          da              # Direct Access (disks)
device          sa              # Sequential Access (tape etc)
device          cd              # CD
device          pass            # Passthrough device (direct SCSI access)
device          ses             # SCSI Environmental Services (and SAF-TE)

# atkbdc0 controls both the keyboard and the PS/2 mouse
device          atkbdc          # AT keyboard controller
device          atkbd           # AT keyboard
device          psm             # PS/2 mouse

device          vga             # VGA video card driver
device          splash          # Splash screen and screen saver support

# syscons is the default console driver, resembling an SCO console
device          sc
device          agp             # support several AGP chipsets

# Power management support (see NOTES for more options)
device          apm
# Add suspend/resume support for the i8254.
device          pmtimer

# Serial (COM) ports
device          sio             # 8250, 16[45]50 based serial ports
# Parallel port
device          ppc
device          ppbus           # Parallel port bus (required)
device          lpt             # Printer
device          plip            # TCP/IP over parallel
device          ppi             # Parallel port interface device
#device         vpo             # Requires scbus and da

# PCI Ethernet NICs that use the common MII bus controller code.
# NOTE: Be sure to keep the 'device miibus' line in order to use these NICs!
device          miibus          # MII bus support
device          sk              # SysKonnect SK-984x & SK-982x gigabit Ethernet

# Pseudo devices.
device          loop            # Network loopback
device          random          # Entropy device
device          ether           # Ethernet support
device          sl              # Kernel SLIP
device          ppp             # Kernel PPP
device          tun             # Packet tunnel.
device          pty             # Pseudo-ttys (telnet etc)
device          md              # Memory "disks"
device          gif             # IPv6 and IPv4 tunneling
device          faith           # IPv6-to-IPv4 relaying (translation)
device          io
device          mem

# The `bpf' device enables the Berkeley Packet Filter.
# Be aware of the administrative consequences of enabling this!
# Note that 'bpf' is required for DHCP.
device          bpf             # Berkeley packet filter

# USB support
device          uhci            # UHCI PCI->USB interface
device          ohci            # OHCI PCI->USB interface
device          ehci            # EHCI PCI->USB interface (USB 2.0)
device          usb             # USB Bus (required)
#device         udbp            # USB Double Bulk Pipe devices
device          ugen            # Generic
device          uhid            # "Human Interface Devices"
device          ukbd            # Keyboard
device          ulpt            # Printer
device          umass           # Disks/Mass storage - Requires scbus and da
device          ums             # Mouse
device          uscanner        # Scanners

# cd / 
# mergemaster -pai 
# cd /usr/src 
# make -j2 buildworld  -- For dual CPU use -j4 
# make -j2 buildkernel KERNCONF=XXX 
# make installkernel KERNCONF=XXX 
# cd / 
# mergemaster -ai 
-- clear temproot 
# cd /var/tmp/temproot 
# chflags noschg var/empty 
# find . -type l -delete 
# find . -empty -delete 
-- check the leftover files, replace or delete as you please  
# cd /var/tmp 
# rm -rf temproot

 # shutdown now

# cd /usr/src
# make installworld

2.4. Set System Configuration

There are 4 system configuration files you may need to modify.

1. /etc/rc.conf, check that you have these 3 lines

   sshd_enable="YES"
   sendmail_enable="NONE"
   syslogd_flags="-ss"
   
   firewall_enable="YES"
   firewall_type="/etc/ipfw.rules"
   
   #If your ISP has a reliable DNS service you can use its service,
   #otherwise it better to rely on ourself.
   #Don't forget to run : cd /etc/namedb/ && ./make-localhost
   named_enable="YES"
   
   quota_enable="YES"
   #It is a time consume job, better run it later after we got access to the system
   check_quotas="NO"
   #Don't forget to run : quotacheck -a after next reboot to create a quota file
   

   
   
   

2. /etc/sysctl.conf

   security.bsd.see_other_uids=0
   kern.coredump=0
   net.inet.icmp.drop_redirect=1
   net.inet.tcp.blackhole=2
   net.inet.udp.blackhole=1
   net.inet.ip.rtexpire=2
   net.inet.ip.rtminexpire=2
   kern.ipc.somaxconn=512
   

   
   
   

3. /boot/loader.conf

   autoboot_delay="3"
   kern.ipc.maxsockets=81920
   kern.ipc.maxsockbuf=1048576
   

   
   
   

4. /etc/hosts

   You should swap the first 2 lines to make sure that you will get IPv4 (127.0.0.1) address for localhost instead of IPv6 (::1) because some program does not support IPv6.

   127.0.0.1               localhost localhost.my.domain
   ::1                     localhost localhost.my.domain
   #Our IP is 10.0.0.34 and our name is gaia.net0.intranet
   10.0.0.34               gaia gaia.net0.intranet
   

   
   
   

5. /etc/ssh/sshd_config

   #Assume that our IP is 10.0.0.34
   ListenAddress 10.0.0.34:22
   # Change to yes to enable built-in password authentication.
   # SecureCRT need this option 
   PasswordAuthentication yes
   # If UseDNS is "yes" and your resolver is not work (i.e DNS server is down), 
   # you can not log in.
   UseDNS no
   
   #Allow only admin to login from anywhere
   AllowUsers cws@*
   
   Subsystem   sftp    /usr/libexec/sftp-server
   

   
   
   

6. /etc/fstab

   /dev/ad6s1g  /home  ufs  rw,userquota,groupquota   2     2
   

   
   
   

7. /var/named/etc/namedb/named.conf

   listen-on       { 127.0.0.1; };
   allow-recursion { 127.0.0.1; };
   

   
   
   

8. /etc/resolv.conf

   nameserver 127.0.0.1
   

   
   
   

9. /etc/ipfw.rules

   #more rules later
   
   add 65535 allow ip from any to any
   

   
   
   

It is also a good idea to change /etc/motd to something that look more legal such as

* * * * * * * * * * * * * W A R N I N G * * * * * * * * * * * * * * *
THIS SYSTEM IS RESTRICTED TO AUTHORIZED USERS FOR AUTHORIZED USE ONLY.
UNAUTHORIZED ACCESS IS STRICTLY PROHIBITED AND MAY BE PUNISHABLE UNDER
THE COMPUTER FRAUD AND ABUSE ACT OF 1986 OR OTHER APPLICABLE LAWS.
IF NOT AUTHORIZED TO ACCESS THIS SYSTEM, DISCONNECT NOW. BY CONTINUING,
YOU CONSENT TO YOUR KEYSTROKES AND DATA CONTENT BEING MONITORED. ALL
PERSONS ARE HEREBY NOTIFIED THAT THE USE OF THIS SYSTEM CONSTITUTES
CONSENT TO MONITORING AND AUDITING. THE ADMINISTRATORS ALSO RESERVE THE
RIGHT TO CANCEL OR LOCK YOUR ACCOUNT AT ANY GIVEN TIME. ALL TERMS
DESCRIBED ABOVE ARE SUBJECT TO CHANGE WITHOUT ANY GIVEN NOTICE. IF YOU
DO NOT AGREE TO THESE TERMS LOGOUT NOW!
* * * * * * * * * * * * * W A R N I N G * * * * * * * * * * * * * * *

3.1. System Utilities

The system utilities I always install on my server are:

3.2. Install Databases

mysql_enable="YES"
mysql_dbdir="/home/mysql"
mysql_args="--bind-address=127.0.0.1"

# mkdir /home/mysql 
# mkdir /home/mysql/tmp 
# cp /usr/local/share/mysql/my-medium.cnf /home/mysql/my.cnf 
# chown -R mysql:mysql /home/mysql

[mysqld]
...
max_allowed_packet = 4M
...
#log-bin
skip-innodb
tmpdir          = /home/mysql/tmp

#For development machine, you may need slow query log 
#to track a badly write SQL.
long_query_time = 10
log_slow_queries = /home/mysql/slow-query.log

...

# /usr/local/etc/rc.d/mysql-server.sh start
# mysql -u root
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 2 to server version: 4.1.14

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> SET PASSWORD FOR root@localhost=PASSWORD('xxx');
Query OK, 0 rows affected (0.02 sec)

mysql>

postgresql_enable="YES"
postgresql_data="/home/pgsql/data"

-- rsync preserve symbolic link while cp is not
# rsync -a -v /usr/local/pgsql /home/
# su -m pgsql
# initdb /home/pgsql/data

# TYPE  DATABASE    USER        CIDR-ADDRESS          METHOD
# "local" is for Unix domain socket connections only
local   all         pgsql                             ident sameuser
local   all         all                               md5
# IPv4 local connections:
host    all         all         127.0.0.1/32          md5
# IPv6 local connections:
host    all         all         ::1/128               md5

shared_buffers = 30000 # min 16, at least max_connections*2, 8KB each
work_mem = 32768               # min 64, size in KB

max_fsm_pages = 40000          # min max_fsm_relations*16, 6 bytes each
max_fsm_relations = 1000       # min 100, ~50 bytes each

wal_buffers = 32       # min 4, 8KB each
checkpoint_segments = 8        # in logfile segments, min 1, 16MB each
effective_cache_size = 4000    # typically 8KB each

#logging
log_destination = 'stderr' 
redirect_stderr = on
log_directory = 'pg_log'
log_filename = 'postgresql-%Y-%m-%d_%H%M%S.log'
log_rotation_age =1440
log_rotation_size = 10240
#slow query log -- enable for developer to check slow query
#log_min_duration_statement = 10
#log_line_prefix = '%t [%u:%d] '

# su pgsql
# psql template1
Welcome to psql 8.0.4, the PostgreSQL interactive terminal.

Type:  \copyright for distribution terms
       \h for help with SQL commands
       \? for help with psql commands
       \g or terminate with semicolon to execute query
       \q to quit

template1=# CREATE USER sa WITH PASSWORD 'xxxx' CREATEDB CREATEUSER
CREATE USER
template1=#

# cd /home/www/public_ssl
# ln -s /usr/local/www/phpMyAdmin
# ln -s /usr/local/www/data/phpPgAdmin

$cfg['Servers'][0]['host']          = 'localhost';
$cfg['Servers'][0]['connect_type']  = 'socket';
$cfg['Servers'][0]['auth_type']     = 'http';

3.3. Install WWW Server

# mkdir /var/log/httpd

AddModule mod_deflate.c
#The following lines can be put in .htaccess if you want
#to enable deflate per directory
<IfModule mod_deflate.c>
DeflateEnable On
DeflateMinLength 3000
DeflateCompLevel 1
DeflateProxied Off
DeflateHTTP 1.0
DeflateDisableRange "MSIE 4."
DeflateTypes text/plain text/html
</IfModule>

# sh /etc/periodic/weekly/310.locate
# locate CA.pl
# /usr/src/crypto/openssl/apps/CA.pl -newreq
Generating a 1024 bit RSA private key
.......................................++++++
...........++++++
writing new private key to 'newreq.pem'
Enter PEM pass phrase:xxxxxx
Verifying - Enter PEM pass phrase:xxxxxx
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:TH
State or Province Name (full name) [Some-State]:Bangkok
Locality Name (eg, city) []:Phayathai
Organization Name (eg, company) [Internet Widgits Pty Ltd]:MiracleNet Group Co., Ltd.
Organizational Unit Name (eg, section) []:Hosting Service
Common Name (eg, YOUR name) []:gaia.net0.intranet
Email Address []:root@net0.intranet

Please enter the following 'extra' attributes
to be sent with your certificate request
A challenge password []:
An optional company name []:MiracleNet Group Co., Ltd.
Request (and private key) is in newreq.pem
# openssl rsa < newreq.pem > newkey.pem
Enter pass phrase:xxxxxx
writing RSA key

# mkdir -p /home/admin/CA
# cd /home/admin/CA
# /usr/src/crypto/openssl/apps/CA.pl -newca
CA certificate filename (or enter to create)
<ENTER>
Making CA certificate ...
Generating a 1024 bit RSA private key
........................++++++
........++++++
writing new private key to './demoCA/private/cakey.pem'
Enter PEM pass phrase:xxxxx2
Verifying - Enter PEM pass phrase:xxxxx2
-----
You are about to be asked to enter information that will be incorporated
into your certificate request.
What you are about to enter is what is called a Distinguished Name or a DN.
There are quite a few fields but you can leave some blank
For some fields there will be a default value,
If you enter '.', the field will be left blank.
-----
Country Name (2 letter code) [AU]:TH
State or Province Name (full name) [Some-State]:Bangkok
Locality Name (eg, city) []:Phayathai
Organization Name (eg, company) [Internet Widgits Pty Ltd]:Miraclenet Group Co.,  Ltd.
Organizational Unit Name (eg, section) []:Hosting Service
Common Name (eg, YOUR name) []:miraclenet.co.th
Email Address []:root@miraclenet.co.th
# cp /home/admin/CA/newreq.pem .
# /usr/src/crypto/openssl/apps/CA.pl -sign
Using configuration from /etc/ssl/openssl.cnf
Enter pass phrase for ./demoCA/private/cakey.pem:xxxxx2
Check that the request matches the signature
Signature ok
...
Certificate is to be certified until Nov 29 02:13:01 2006 GMT (365 days)
Sign the certificate? [y/n]:y

1 out of 1 certificate requests certified, commit? [y/n]y
Write out database with 1 new entries
Data Base Updated
Signed certificate is in newcert.pem

# cp newcert.pem /usr/local/etc/apache/ssl.crt/gaia.crt
# cp newkey.pem /usr/local/etc/apache/ssl.key/gaia.key
# cd /usr/local/etc/apache/ssl.crt/
# make
-- Don't forget to edit SSLCertificateFile and SSLCertificateKeyFile 
-- in httpd.conf to point to new crt and key

<IfModule mod_php4.c>
    AddType application/x-httpd-php .php
    AddType application/x-httpd-php-source .phps
</IfModule>

# rcorder /etc/rc.d/* /usr/local/etc/rc.d/*
...
/etc/rc.d/yppasswdd
/usr/local/etc/rc.d/apache.sh
/etc/rc.d/LOGIN
/usr/local/etc/rc.d/rsyncd.sh
/usr/local/etc/rc.d/mysql-server.sh
/usr/local/etc/rc.d/010.pgsql.sh
/usr/local/etc/rc.d/000.pkgtools.sh
/usr/local/etc/rc.d/000.compat5x.sh
/usr/local/etc/rc.d/000.compat4x.sh
...

gaia# diff -u apache.sh.org apache.sh
--- apache.sh.org       Sat May 20 14:04:48 2006
+++ apache.sh   Sat May 20 14:04:56 2006
@@ -2,7 +2,7 @@
 # $FreeBSD: ports/www/apache13-modssl/files/rcng.sh,v 1.5 2006/02/20 20:47:46 dougb Exp $

 # PROVIDE: apache
-# REQUIRE: DAEMON
+# REQUIRE: DAEMON compat5x
 # BEFORE: LOGIN
 # KEYWORD: shutdown

# rcorder /etc/rc.d/* /usr/local/etc/rc.d/*
...
/etc/rc.d/yppasswdd
/usr/local/etc/rc.d/000.compat5x.sh
/usr/local/etc/rc.d/apache.sh
/etc/rc.d/LOGIN
...

output_buffering = On
zlib.output_compression = On
register_argc_argv = Off
magic_quotes_gpc = Off  #When On, It cause more problems because we don't know 
                        #the quote come from user input or from this option.
[Zend]
zend_optimizer.optimization_level=15
zend_extension_manager.optimizer="/usr/local/lib/php/20020429/Optimizer"
zend_extension_manager.optimizer_ts="/usr/local/lib/php/20020429/Optimizer_TS"
zend_extension="/usr/local/lib/php/20020429/ZendExtensionManager.so"
zend_extension_ts="/usr/local/lib/php/20020429/ZendExtensionManager_TS.so"

LogFile="bunzip2 -dc /var/log/httpd/access.log.0.bz2 |"
SiteDomain="gaia.net0.intranet"
HostAliases="localhost 127.0.0.1"
DNSLookup=0   
DirData="/home/www/public_html/stats/data"
DirCgi="/stats/cgi-bin"
DirIcons="/stats/icons"
LoadPlugin="geoip GEOIP_STANDARD /usr/local/share/GeoIP/GeoIP.dat"
UseFramesWhenCGI=0
LogFormat=1

# mkdir -p /home/www/apache
# htpasswd -cm /home/www/apache/passwd stats
# mkdir -p /home/www/public_html/stats/data
# cd /home/www/public_html/stats
# ln -s /usr/local/www/awstats/cgi-bin
# ln -s /usr/local/www/awstats/classes
# ln -s /usr/local/www/awstats/css
# ln -s /usr/local/www/awstats/icons
# ln -s /usr/local/www/awstats/js

<?
header("Location:/stats/cgi-bin/awstats.pl?config=gaia");
?>

AuthType Basic
AuthName "Gaia Access Statistic"
AuthUserFile /home/www/apache/passwd
Require user stats
Options FollowSymLinks

Options ExecCGI
AddHandler cgi-script .pl

#crontab -e
0 0 * * * /home/admin/bin/rotatelog.pl
10 0 * * *  /home/www/public_html/stats/cgi-bin/awstats.pl -config=gaia -update
0 0  2 * * /home/admin/bin/geoip_update.sh

4.1. Prepare Mail System Database

We store our customer e-mail accounts on MySQL database to make it easier to manipulate and increase look up speed. Most of the information on this section come from Martin List-Petersen's ISP Mailserver Solution Howto.

CREATE DATABASE maildb;
USE maildb;

CREATE TABLE `alias` (
  `email` varchar(255) NOT NULL default '',    
  `destination` varchar(255) NOT NULL default '',
  `customer_id` varchar(16) NOT NULL default '',
  PRIMARY KEY `email` (`email`),
  KEY `customer_id` (`customer_id`)
) ENGINE=MyISAM;

CREATE TABLE `transport` (
  `domain` varchar(255) NOT NULL default '',
  `transport` varchar(128) NOT NULL default '',
  `customer_id` varchar(16) NOT NULL default '',
  PRIMARY KEY (`domain`),
  KEY `customer_id` (`customer_id`)
) ENGINE=MyISAM;

CREATE TABLE `user` (
  `email` varchar(128) NOT NULL default '',
  `passwd` varchar(128) NOT NULL default '$1$X$XXX',
  `name` varchar(128) NOT NULL default '',
  `uid` int(6) NOT NULL default '65534',    
  `gid` int(6) NOT NULL default '65534',
  `home` varchar(255) NOT NULL default '',  
  `maildir` varchar(255) NOT NULL default '',
  `allow_login` enum('Y','N') NOT NULL default 'Y', 
  `allow_receive` enum('Y','N') NOT NULL default 'Y', 
  `customer_id` varchar(16) NOT NULL default '',
  PRIMARY KEY  (`email`),
  KEY `customer_id` (`customer_id`)
) ENGINE=MyISAM;

We need 3 MySQL user accounts with difference privileges .

1. maildb -- Owner of the database can do everything to the database.

2. maildb_auth -- Can read every fields in user table. Use by courier-authlib.

3. maildb_smtp -- Can read every fields on the database except passwd. Use by postfix. The user/password of this account must store in a word readable file in /usr/local/etc/postfix ,therefore, give minimum access to this account.

GRANT USAGE ON maildb.* TO 'maildb'@'localhost' IDENTIFIED BY '*********';
GRANT ALL PRIVILEGES ON `maildb` . * TO 'maildb'@'localhost' WITH GRANT OPTION;
GRANT USAGE ON maildb. * TO 'maildb_auth'@'localhost' IDENTIFIED BY '*********';
GRANT SELECT ON `maildb`.`user` TO 'maildb_auth'@'localhost';
GRANT USAGE ON maildb. * TO 'maildb_smtp'@'localhost' IDENTIFIED BY '*********';
GRANT SELECT ON `maildb`.`alias` TO 'maildb_smtp'@'localhost';
GRANT SELECT ON `maildb`.`transport` TO 'maildb_smtp'@'localhost';
GRANT SELECT (
`email` , `name` , `uid` , `gid` , `home` , `maildir` , `allow_login` , `allow_receive` , `customer_id`
) ON `maildb`.`user`
TO 'maildb_smtp'@'localhost';

4.2. Config amavisd-new and dspam

First append the lines to /etc/rc.conf to enable the service.

#Amavis/ClamAV/SpamAssasin
clamav_clamd_enable="YES"
clamav_freshclam_enable="YES"
amavisd_enable="YES"

# vi /etc/group
spamd:*:58:
vscan:*:110:clamav
clamav:*:106:

# chmod u-s,a+rx /usr/local/bin/dspam
# cd /var/amavis
# ln -s /var/db/dspam

$mydomain = 'gaia.net0.intranet';   # a convenient default for other settings
$dspam = 'dspam';              # Allow dspam

#Don't forget to uncomment 'ClamAV-clamd' to enable clamav

#If you want to accept .zip and .bz2, remove the comment on
#[ qr'^\.(Z|gz|bz2)$'           => 0 ] and
#[ qr'^\.(zip|rar|arc|arj|zoo)$'=> 0 ] 

#Discard all filtered mail -- don't notify sender
$final_virus_destiny      = D_DISCARD;
$final_banned_destiny     = D_DISCARD;
$final_spam_destiny       = D_DISCARD;
$final_bad_header_destiny = D_DISCARD;

$recipient_delimiter = '-';

#If someting go wrong enable the following options and take a look at
#/var/log/maillog and your mailheader
#$log_level = 5;
#$sa_tag_level_deflt = 0;

To setup dspam, you must cread a dspam user and database on MySQL. Give that user full access to the database and run the script in /usr/local/share/examples/dspam/mysql/mysql_objects-4.1.sql.

# mysql -u root -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 144 to server version: 4.1.14

Type 'help;' or '\h' for help. Type '\c' to clear the buffer.

mysql> CREATE DATABASE dspam;
Query OK, 1 row affected (0.00 sec)
mysql> GRANT USAGE ON dspam.* TO 'dspam'@'localhost' IDENTIFIED BY '*********';
Query OK, 1 row affected (0.00 sec)
mysql> GRANT ALL PRIVILEGES ON `dspam` . * TO 'dspam'@'localhost' WITH GRANT OPTION;
Query OK, 1 row affected (0.00 sec)
mysql> USE dspam;
Database changed
mysql> \. /usr/local/share/examples/dspam/mysql/mysql_objects-4.1.sql

StorageDriver /usr/local/lib/libmysql_drv.so
MySQLServer     /tmp/mysql.sock
#MySQLPort
MySQLUser               dspam
MySQLPass               xxxxxx
MySQLDb                 dspam
#MySQLCompress          true

#For Relearn false negative and false positive
MySQLUIDInSignature     on
Preference "signatureLocation=headers"

#We work with amavisd-new
IgnoreHeader X-Spam-Status
IgnoreHeader X-Spam-Scanned
IgnoreHeader X-Virus-Scanner-Result

#Add the following line and take a look at /var/log/dspam/dspam.debug 
#if something don't work as expected
#Debug vscan

4.3. Config courier-authlib and cyrus-sasl2

Edit /usr/local/etc/authlib/authmysqlrc:

MYSQL_SERVER          localhost
MYSQL_USERNAME        maildb_auth
MYSQL_PASSWORD        xxxxx
MYSQL_SOCKET          /tmp/mysql.sock
MYSQL_DATABASE        maildb
MYSQL_USER_TABLE      user
MYSQL_CRYPT_PWFIELD   passwd
MYSQL_LOGIN_FIELD     email
MYSQL_MAILDIR_FIELD   maildir
MYSQL_WHERE_CLAUSE    allow_login='Y'

authmodulelist="authpam authmysql"

For cyrus-sasl2, create the file /usr/local/lib/sasl2/smtpd.conf with content:

pwcheck_method: authdaemond
authdaemond_path: /var/run/authdaemond/socket

# chmod o+x /var/run/authdaemond

4.4. Config postfix

#Postfix
postfix_enable="YES"
sendmail_enable="NONE"
sendmail_flags="-bd"
sendmail_outbound_enable="NO"
sendmail_submit_enable="NO"
sendmail_msp_queue_enable="NO"
daily_clean_hoststat_enable="NO"
daily_status_mail_rejects_enable="NO"
daily_status_include_submit_mailq="NO"
daily_submit_queuerun="NO"

#!/bin/sh
# PROVIDE: postfix
# REQUIRE: NETWORKING SERVERS
# BEFORE: DAEMON
# AFTER: mysql-server
# KEYWORD: shutdown

. /etc/rc.subr

name="postfix"
rcvar=`set_rcvar`

load_rc_config ${name}

: ${postfix_enable="NO"}

command=/usr/local/sbin/postfix
pidfile=/var/spool/${name}/pid/master.pid
start_cmd="postfix_cmd start"
stop_cmd="postfix_cmd stop"
restart_cmd="postfix_cmd stop && postfix_cmd start"
echo ${pidfile}
postfix_cmd () {
    case $1 in
    start)
        echo "Starting ${name}."
        ${command} start
        ;;
    stop)
        echo "Stopping ${name}."
        ${command} stop
        ;;
    esac
}

run_rc_command "$1"

smtp      inet  n       -       n       -       -       smtpd

smtp-amavis unix -  -   n -   2  lmtp
    -o lmtp_data_done_timeout=1200
    -o lmtp_send_xforward_command=yes

127.0.0.1:smtp      inet  n       -       n       -       -       smtpd
        -o content_filter=

10.0.0.34:smtp      inet  n       -       n       -       -       smtpd
        -o content_filter=smtp-amavis:[127.0.0.1]:10024

127.0.0.1:10025 inet n - n - - smtpd
    -o content_filter=
    -o local_recipient_maps=
    -o relay_recipient_maps=
    -o smtpd_restriction_classes=
    -o smtpd_client_restrictions=
    -o smtpd_helo_restrictions=
    -o smtpd_sender_restrictions=
    -o smtpd_recipient_restrictions=permit_mynetworks,reject
    -o mynetworks=127.0.0.0/8
    -o strict_rfc821_envelopes=yes

inet_interfaces = 10.0.0.34, 127.0.0.1
recipient_delimiter = -
home_mailbox = Maildir/
#Set size limit to 50MB
mailbox_size_limit = 51200000         
virtual_mailbox_limit= 51200000       

mynetworks = 127.0.0.0/8,10.0.0.34/32

#MAP
transport_maps=mysql:/usr/local/etc/postfix/transport.cf
virtual_mailbox_base=/
virtual_mailbox_maps=mysql:/usr/local/etc/postfix/virtual_mailbox.cf
virtual_alias_maps=mysql:/usr/local/etc/postfix/virtual_alias.cf
virtual_uid_maps=mysql:/usr/local/etc/postfix/virtual_uid.cf
virtual_gid_maps=mysql:/usr/local/etc/postfix/virtual_gid.cf

#Receive name form $myhostname and any domain in transport table
mydestination= $myhostname,$transport_maps

#Valid local user name from  local user, /etc/alias, virtual user and virtual alias
local_recipient_maps=proxy:unix:passwd.byname,$alias_maps,$virtual_mailbox_maps,$virtual_alias_maps

#Set .forward name
forward_path = $home/.forward$recipient_delimiter$extension,$home/.forward

# sasl config
broken_sasl_auth_clients = yes
smtpd_sasl_auth_enable = yes
smtpd_sasl_local_domain =
smtpd_sender_restrictions = permit_sasl_authenticated,permit_mynetworks
smtpd_recipient_restrictions = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination
smtpd_sasl_security_options = noanonymous

# tls config
smtp_use_tls = yes
smtpd_use_tls = yes
smtp_tls_note_starttls_offer = yes
smtpd_tls_auth_only = no
smtpd_tls_key_file = /usr/local/etc/postfix/gaia.pem
smtpd_tls_cert_file = /usr/local/etc/postfix/gaia.pem
smtpd_tls_CAfile = /usr/local/etc/postfix/gaia.pem
smtpd_tls_loglevel = 1
smtpd_tls_received_header = yes
smtpd_tls_session_cache_timeout = 3600s
tls_random_source = dev:/dev/urandom
smtpd_tls_sender_restrictions = permit_sasl_authenticated,permit_mynetworks
smtpd_tls_recipient_restrictions  = permit_sasl_authenticated,permit_mynetworks,reject_unauth_destination

user         = maildb_smtp
password     = xxxx
dbname       = maildb
table        = transport
select_field = transport
where_field  = domain
socket       = /tmp/mysql.sock

user         = maildb_smtp
password     = xxxx
dbname       = maildb
table        = user
select_field = maildir
where_field  = email
additional_conditions= and allow_receive='Y'
socket       = /tmp/mysql.sock

user         = maildb_smtp
password     = xxxx
dbname       = maildb
table        = alias
select_field = destination
where_field  = email
socket       = /tmp/mysql.sock

user         = maildb_smtp
password     = xxxx
dbname       = maildb
table        = user
select_field = uid
where_field  = email
socket       = /tmp/mysql.sock

user         = maildb_smtp
password     = xxxx
dbname       = maildb
table        = user
select_field = gid
where_field  = email
socket       = /tmp/mysql.sock

# cp /usr/local/etc/apache/ssl.crt/gaia.crt /usr/local/etc/postfix/gaia.pem
# cat /usr/local/etc/apache/ssl.key/gaia.key >> /usr/local/etc/postfix/gaia.pem
# chmod og-r /usr/local/etc/postfix/gaia.pem

4.5. Config courier IMAP4/POP3/IMAP4S/POP3S

To use courier imap you need to change the config file in /usr/local/etc/courier-imap and create an certificate for IMAP4S and POP3S or just use the certificate from postfix.

/etc/rc.conf

#IMAP
courier_authdaemond_enable="YES"
courier_imap_imapd_enable="YES"
courier_imap_imapd_ssl_enable="YES"
courier_imap_pop3d_enable="YES"
courier_imap_pop3d_ssl_enable="YES"

#The default is listen to all IP, remove or comment the line ADDRESS=0
#ADDRESS=0
#127.0.0.1 for SquirrelMail, 10.0.0.34 for rest of the world
PORT=127.0.0.1.143,10.0.0.34.143

#Many company has an sigle external IP for their office ,so every request
#from that company will alwasys come from the same IP.
MAXPERIP=16

#SSLADDRESS=0
SSLPORT=10.0.0.34.993
MAXPERIP=16
TLS_CERTFILE=/usr/local/etc/postfix/gaia.pem

#ADDRESS=0
#We use POP3 to authenticate user in our admin page.
#Just connect to port 110, then send USER xxx\r\n,PASS xxx\r\n 
#So we listen on 127.0.0.1 
PORT=127.0.0.1.110,10.0.0.34.110

MAXPERIP=16

#SSLADDRESS=0
SSLPORT=10.0.0.34.995
MAXPERIP=16
TLS_CERTFILE=/usr/local/etc/postfix/gaia.pem

4.6. Warning in /var/log/maillog

There are some unused authentication method /usr/local/lib/sasl2 such as

libsasldb.a     libsasldb.so    libsasldb.so.2
libcrammd5.a    libcrammd5.so   libcrammd5.so.2
libdigestmd5.a  libdigestmd5.so libdigestmd5.so.2

warning: SASL authentication failure: no user in db
warning: SASL authentication failure: no secret in database
warning: t42.net0.intranet[10.0.0.31]: SASL CRAM-MD5 authentication failed

4.7. Config SquirrelMail

After install squirrelmail and create a symbolic link to HTTPS main page with command

# ln -s /usr/local/www/squirrelmail /home/www/public_ssl/mail

# cd /usr/local/www/squirrelmail && ./configure

4.8. Add email user

Add e-mail account to this system is simple, just follow the steps:

1. Create a FreeBSD user for that domain.

2. Create a maildir for the email address with command maildirmake. Set owner and group to the user created in previous step.

3. Add the domain to transport table with transport set to virtual:.

4. Add the user to user table with each fileld as indicated in user table.

#pw user add test -s /sbin/nologin
#mkdir -p /home/vhost/test/mail/gaia-test.net0.intranet
#maildirmake /home/vhost/test/mail/gaia-test.net0.intranet/test1
#maildirmake /home/vhost/test/mail/gaia-test.net0.intranet/test1/.~SPAM
#maildirmake /home/vhost/test/mail/gaia-test.net0.intranet/test1/.~VIRUS
#maildirmake /home/vhost/test/mail/gaia-test.net0.intranet/test1/.~Report-SPAM
#maildirmake /home/vhost/test/mail/gaia-test.net0.intranet/test1/.~Report-NOTSPAM
#chown -R test:test /home/vhost/test/mail/gaia-test.net0.intranet/test1
#echo INBOX.~SPAM > /home/vhost/test/mail/gaia-test.net0.intranet/test1/courierimapsubscribed
#echo INBOX.~VIRUS >> /home/vhost/test/mail/gaia-test.net0.intranet/test1/courierimapsubscribed
#echo INBOX.~Report-SPAM >> /home/vhost/test/mail/gaia-test.net0.intranet/test1/courierimapsubscribed
#echo INBOX.~Report-NOTSPAM >> /home/vhost/test/mail/gaia-test.net0.intranet/test1/courierimapsubscribed
#id test
uid=1002(test) gid=1002(test) groups=1002(test)
#userdbpw -md5
Password:
Reenter password:
$1$X$XXX
#mysql -u maildb -p maildb
mysql> INSERT INTO transport (domain,transport,customer_id) 
    -> VALUES ('gaia-test.net0.intranet','virtual:','test');
mysql> INSERT INTO user ( email,passwd,name,uid,gid,home,maildir,
    -> allow_login,allow_receive,customer_id) VALUES (
    -> 'test1@gaia-test.net0.intranet', '$1$X$XXX', 'Test User', '1002', '1002',
    -> '/home/vhost/test/mail/gaia-test.net0.intranet/test1',
    -> '/home/vhost/test/mail/gaia-test.net0.intranet/test1/', 'Y', 'Y', 'test');

To enable user to manage their own account , I create a PHP script to manage a database part and write a small perl daemon that run as root to manage Maildir part. The PHP use fsockopen to talk to the perl daemon. Unfortunely, the script and daemon is my company property which I can not giveout without the permission from by boss.

User can access their mailbox by mail/squirrelmail or any email client such as mail/thunderbird. The FreeBSD user use their login user/password and virtual user user their email/password (i.e test1@test.intranet) to access the mailbox. User mail client need to support TLS/SASL2 if they want to relay their mail via this server.

Using SquirrelMail as a mail client give another plus. It allow me to write a plugin to allow virtual user to change their own password. The plugin need my perl daemon to run, so you can not take it and run the script. I put it to show how to write the plugin and to compile with GPL licence of SquirrelMail. You must move the plugin folder to /usr/local/www/squirrelmail/plugins and use squirrelmail configure script to enable the plugin. This is code of change_vhostpass.

4.9. Manage spam mail

I config the server to not notify user when they got spam or virus mail. The mail that identified as a spam or infested are move to the quarantine directory /var/virusmails. Every 5 minutes , I run a script to move the mail in quarantine directory to user "INBOX.~SPAM" or "INBOX.~VIRUS" and leave it there for user to check. After 7 days, another cron script is run to remove the spam/virus mail older than 7 days.

crontab -u root -e
*/5  *  * * * /home/admin/bin/move-spam-mail.pl 2>/dev/null
crontab -u test -e
0  1  * * * cd /home/vhost/test/mail && /usr/bin/find . \( -mtime +7 -a -name 'BLOCKED-*' \) -delete

$default_unseen_notify = 3;

4.10. Relern misclassified mail

dspam has an ability to re-learn mail. To use this feature make sure that the file /usr/local/etc/dspam.conf has these two lines

MySQLUIDInSignature    on
Preference "signatureLocation=headers"

#cat spam-mail | dspam --user vscan --class=spam --source=error
#cat notspam-mail | dspam --user vscan --class=innocent --source=error

The method I use to implement on this server is .~Report-SPAM and .~Report-NOTSPAM folder for each user. SquirrelMail or IMAP user can use the move command to move spam/not-spam mail to these 2 folders with header intact. We can run cron job to scan the mail in these folder ,then run the above command on each mail.

crontab -u root -e
0  1  * * * find /home/vhost -name '.~Report-SPAM' -exec /home/admin/bin/dspam-relearn.pl spam '{}'/cur \;
0  2  * * * find /home/vhost -name '.~Report-NOTSPAM' -exec /home/admin/bin/dspam-relearn.pl innocent '{}'/cur \;

#!/usr/local/bin/perl -w

my $DSPAM_PATH = "/usr/local/bin/dspam";
my $DSPAM_FLAGS = "--user vscan --source=error";

if ( scalar(@ARGV) < 2 ||
     $ARGV[0] ne "spam" &&  $ARGV[0] ne "innocent" )
{
        die "usage: $0 spam|innocent folder_name";
}

my $mail_class = $ARGV[0];
my $PATH = $ARGV[1];
if ( !opendir(SPAM_DIR,$PATH) )
{
        print STDERR "Can not open $PATH\n";
        exit(1);
}

my $fname='';
my $t = time();
my @flist;
my $p;
while( ($fname=readdir(SPAM_DIR)) )
{
        $p = "$PATH/$fname";
        if ( -f $p )
        {
                my @st = stat("$PATH/$fname");
                if ( $t - $st[9] > 3 )
                {
                        push(@flist,$p);
                }
        }
}
closedir(SPAM_DIR);

foreach $p (@flist)
{
        #relearn
        `/bin/cat \"$p\" | $DSPAM_PATH $DSPAM_FLAGS --class=$mail_class 2>&1`;
        unlink($p);
}

5.1. Prepare Host

After got the IP from the ISP , we need to add it to our server with the following command:

#ifconfig sk0 alias 10.0.0.35 netmask 255.255.255.255
#vi /etc/rc.conf
ifconfig_sk0_alias0="inet 10.0.0.35 netmask 255.255.255.255"

There is a little inconvenient in jail system. You can not access a service in the main host with the loop back IP 127.0.0.1 , so any service on host (such as DNS) must listen to the host real IP. But if the service listen on the real IP, another machine can also access that server. This is why I complie IPFW support in the kernel.

/var/named/etc/namedb/named.conf

listen-on       { 127.0.0.1; 10.0.0.34; };
allow-recursion { 127.0.0.1; 10.0.0.34; 10.0.0.35; };

#Bandwidth statistic -- our accounting need this information
add 00100 count ip from 10.0.0.35 to not me
add 00101 count ip from not me to 10.0.0.35

#Additional rules for DNS service
add 50000 deny  ip from not me to 10.0.0.34 53

Each of our customer got 2 FreeBSD user ids , one is a main account and another is an account that run apache. User and group in the jail is independent from the host but to reduce the headache when manage the server I add both user in the host first, then copy the uid/gid to the jail.

#pw user add www_test -s /sbin/nologin -d /nonexistent -G test
#id test
uid=1002(test) gid=1002(test) groups=1002(test)
#id www_test
uid=1003(www_test) gid=1003(www_test) groups=1003(www_test), 1002(test)

If you want sshd in the jail log the message to host system log, you must edit the host /etc/rc.conf to allow syslogd to listen to the request from the jail.

syslogd_flag="-ss -l /home/vhost/test/var/run/log"

5.2. Prepare Jail

The jailed process can not access files outside jail. You must copy all programs/files and libraries need by the programs to the jail. I write a perl script copy_dep.pl which use ldd(1) command to copy all required files.

nameserver 10.0.0.34

127.0.0.1  localhost localhost.localdomain
10.0.0.34   gaia    gaia.net0.intranet
10.0.0.35   selene  selene.net0.intranet

# -- Use real group id -- copy from the host /etc/group
wheel:*:0:root
sshd:*:22:
pgsql:*:70:
mysql:*:88:
nogroup:*:65533:
nobody:*:65534:
test:*:1002:www_test
www_test:*:1003:

# -- Use real group id -- 
#touch /home/vhost/test/etc/master.passwd
#vipw -d /home/vhost/test/etc
# -- home and shell of root account MUST be existed in the jail 
root:*:0:0::0:0:Charlie &:/:/bin/sh
sshd:*:22:22::0:0:Secure Shell Daemon:/var/empty:/usr/sbin/nologin
pgsql:*:70:70::0:0:PostgreSQL Daemon:/:/usr/sbin/nologin
mysql:*:88:88::0:0:MySQL Daemon:/:/usr/sbin/nologin
nobody:*:65534:65534::0:0:Unprivileged user:/nonexistent:/usr/sbin/nologin
test:*:1002:1002::0:0:User &:/www_data/home:/bin/sh
www_test:*:1003:1003::0:0:User &:/www_data:/usr/sbin/nologin
# -- To change password use
#pw -V /home/vhost/test/etc usermod test -h 0
# -- Only main user need a password

mkdir /home/vhost/test/dev
/sbin/mount -t devfs dev /home/vhost/test/dev
-- see /etc/default/devfs.rules to check rule number of devfsrules_jail
/sbin/devfs -m /home/vhost/test/dev rule -s 4 applyset

#mkdir /home/vhost/test/tmp
#chgrp test /home/vhost/test/tmp
#chmod g+rw /home/vhost/test/tmp

#/home/admin/bin/copy_dep.pl /home/vhost/test  /bin/sh /libexec/ld-elf.so.1
#mkdir /home/vhost/test/dev
#mount -t devfs dev /home/vhost/test/dev
#/sbin/devfs -m /home/vhost/test/dev rule -s 4 applyset
#mkdir /home/vhost/test/etc
#vi /home/vhost/test/etc/resolv.conf
...
#jail -l -U root -i /home/vhost/test selene.net0.intranet 10.0.0.35 /bin/sh
-- Now you should be in the jail unless there is a mising files.
#/usr/sbin/sshd -Dd
#/usr/local/sbin/httpd -DSSL
...

#mkdir -p /home/vhost/test/etc/ssh
#/usr/bin/ssh-keygen -t rsa1 
                  -b 1024 -f /home/vhost/test/etc/ssh/ssh_host_key -N ''
#/usr/bin/ssh-keygen -t dsa 
                  -f /home/vhost/test/etc/ssh/ssh_host_dsa_key -N ''
#/usr/bin/ssh-keygen -t rsa 
                  -f /home/vhost/test/etc/ssh/ssh_host_rsa_key -N ''
#cp /etc/ssh/moduli /home/vhost/test/etc/ssh/
#cp /etc/ssh/ssh_config /home/vhost/test/etc/ssh/

ListenAddress 10.0.0.35:22
PasswordAuthentication yes
UseDNS no

#I can not make PAM work in chroot/jail
UsePAM no

AllowUsers test@*
Subsystem   sftp    /usr/libexec/sftp-server

#mkdir -p /home/vhost/test/var/empty
#chflags schg /home/vhost/test/var/empty

#cp /etc/auth.conf /home/vhost/test/etc
#mkdir -p /home/vhost/test/var/log
#touch /home/vhost/test/var/log/wtmp
#touch /home/vhost/test/var/log/lastlog

#/home/admin/bin/copy_dep.pl /home/vhost/test  /usr/local/libexec/apache/*

#rsync -a -v /usr/local/lib/php /home/vhost/test/usr/local/lib
#/home/admin/bin/copy_dep.pl /home/vhost/test  /usr/local/lib/php/20020429/*.so

#cp -r /usr/local/etc/apache /home/vhost/test/usr/local/etc

#rsync -a -v --delete  /usr/local/etc/php /home/vhost/test/usr/local/etc

#cp /usr/local/etc/php.ini /home/vhost/test/usr/local/etc

#mkdir -p /home/vhost/test/var/log/httpd

#rsync -a -v /usr/local/lib/perl5 /home/vhost/test/usr/local/lib/

[client]
...
socket          = /home/tmp/mysql.sock
[mysqld]
port            = 3306
...
socket          = /home/tmp/mysql.sock
...

unix_socket_directory = '/home/tmp'

#vi /etc/group
home_tmp:*:900:mysql,pgsql
#mkdir /home/tmp
#chgrp home_tmp /home/tmp
#chmod g+w /home/tmp
#ln -s /home/tmp/mysql.sock /tmp/mysql.sock
#ln -s /home/tmp/.s.PGSQL.5432 /tmp/.s.PGSQL.5432
#ln -s /home/tmp/.s.PGSQL.5432.lock /tmp/.s.PGSQL.5432.lock

#!/usr/local/bin/perl -w
use strict;
my @FILE_LIST = ('mysql.sock','.s.PGSQL.5432','.s.PGSQL.5432.lock');
my %CHECK_INODE;

sub trim($)
{
        my $string = shift;
        $string =~ s/^\s+//;$string =~ s/\s+$//;return $string;
}

if ( !open(RC_CONF,"/etc/rc.conf") ){ die "Can not open /etc/rc.conf"; }

my $jail_list = '';
READ_RC_CONF:
while ( <RC_CONF> )
{
        my $line = $_;

        if ( $line =~ /\s*jail_list\s*=\s*(.*)/ )
        {
                $jail_list = $1;chop($jail_list);last READ_RC_CONF;
        }

}

if ( $jail_list =~ /([^#]+)/ ) { $jail_list = trim($1); }
if ( $jail_list =~ /"([^"]+)/ ) { $jail_list = trim($1); }

my @JAIL_USER = split(/\s+/,$jail_list);

my $check_name;
foreach $check_name (@FILE_LIST)
{
       my @st = stat("/home/tmp/$check_name");
       if ( scalar(@st) >= 13 ) { $CHECK_INODE{$check_name} = $st[1]; }
       else { $CHECK_INODE{$check_name} = 0; }
}

foreach my $user (@JAIL_USER)
{
    foreach $check_name (@FILE_LIST)
    {
        my $re_link = 1;
        my $fname = "/home/vhost/$user/tmp/$check_name";
        if ( -e $fname )
        {
            my @st = stat($fname);

            if ( scalar(@st) > 1 && $st[1] == $CHECK_INODE{$check_name} ) { $re_link = 0; }
        }

        if ( $re_link && $CHECK_INODE{$check_name} > 0 )
        {
            unlink($fname);
            if ( !link("/home/tmp/$check_name",$fname) )
            {
                print STDERR "Can not create a hard link [$fname]\n";
            }
        }
    }
}

/*
##################################################################
# $Id: article.sgml,v 1.2 2006/05/27 05:44:30 cws Exp $
# Copyright (C) MiracleNet Group (http://miraclenet.co.th)
#           Chatchawan Wongsiriprasert
##################################################################
*/
#include <stdio.h>
#include <stdlib.h>
#include <time.h>

main(int argc,char *argv[])
{
    FILE * out;
    char buf[8192];
    time_t t;

    time(&t);
    srandom(t);

    umask(0007);
    sprintf(buf,"/var/spool/mqueue/mail-%010d-%010d",t,random());
    if ( (out=fopen(buf,"wt")) == 0 )
    {
        perror("Can not open mail file");
        exit(1);
    }

    while ( fgets(buf,sizeof(buf),stdin) != 0 )
    {
        fputs(buf,out);
    }
    fclose(out);

    return 0;
}

#gcc -O2  -o /home/vhost/test/usr/sbin/sendmail sendmail.c
#mkdir -p /home/vhost/test/var/spool/mqueue
#chgrp test /home/vhost/test/var/spool/mqueue
#chmod g+w /home/vhost/test/var/spool/mqueue

#!/bin/sh

user_id=`/usr/bin/id -nu`
VHOST_BASE=/home/vhost
SPOOL_FOLDER=var/spool/mqueue

MAIL_LIST=`ls ${VHOST_BASE}/${user_id}/${SPOOL_FOLDER}/mail-* 2>/dev/null`
if [ $? -eq 0 ];
then
for mail_file in ${MAIL_LIST}
do
        /bin/cat ${mail_file} | /usr/sbin/sendmail -t -i
        /bin/rm ${mail_file}
done
fi

#crontab -u test -e 
0-59/5 * * * * /home/admin/bin/vhost-relay-mail.sh

5.3. Start Jail

In FreeBSD 6, it is very easy to create a jail using /etc/rc.d/jail script. All you need is put the jail configuration in /etc/rc.conf and let FreeBSD startup script do the work.

/etc/rc.conf

vhost_enable="YES"       # Our script to handle virtual host script

jail_enable="YES"        # Set to NO to disable starting of any jails
jail_list="test"            # Space separated list of names of jails
jail_set_hostname_allow="NO" # Allow root user in a jail to change its hostname
jail_socket_unixiproute_only="YES" # Route only TCP/IP within a jail
jail_sysvipc_allow="YES"  #For ZendOptimizer

jail_test_rootdir="/home/vhost/test"
jail_test_hostname="selene.net0.intranet"
jail_test_ip="10.0.0.35"
jail_test_exec_start="/bin/sh /etc/rc.jail"
jail_test_devfs_enable="YES"
jail_test_devfs_ruleset="devfsrules_jail"

/home/vhost/test/etc/rc.jail

#!/bin/sh

/usr/sbin/sshd
/usr/local/sbin/httpd -DSSL

/usr/local/etc/rc.d/vhost.sh

#!/bin/sh
# PROVIDE: vhost
# REQUIRE: NETWORKING SERVERS
# BEFORE: DAEMON
# AFTER: mysql-server postgresql
# KEYWORD: shutdown

. /etc/rc.subr

name="vhost"
rcvar=`set_rcvar`

load_rc_config ${name}

: ${postfix_enable="NO"}

start_cmd="vhost_start"
stop_cmd="vhost_stop"

vhost_start () {
        echo "Starting ${name}."
        /home/admin/bin/check_jail_db.pl
}

vhost_stop () {
        echo "Stopping ${name}."
}

run_rc_command "$1"

You can use the command jls(8) , jexec(8) and killall(1) -j to manipulate the program in the jail.