This is cfengine-Reference.info, produced by makeinfo version 4.0 from
cfengine-Reference.texinfo.

INFO-DIR-SECTION System Utilities
START-INFO-DIR-ENTRY
* cfengine Reference: (cfengine-Reference.info).
                        Cfengine is a language based tool specifically
                        designed for configuring and maintaining BSD
                        and System-5-like operating systems attached
                        to a TCP/IP network.
END-INFO-DIR-ENTRY


File: cfengine-Reference.info,  Node: SOLARIS 2,  Next: FreeBSD,  Prev: SUN (4.1.*),  Up: FAQS and Tips

SOLARIS 2
---------

_Q:_
     _I keep getting a `bad address' error when cfengine tries to reset
     the netmask and broadcast address._

_A:_
     This is a bug in the sockets library on solaris. It is supposed to
     be fixed in solaris 2.5.

_Q:_
     _How can I add my own file `rc.local' to the startup bootfiles
     automatically?_

_A:_
     For example, create a file called `/local/etc/rc.local' which
     looks something like this:

          #
          # rc.local
          #
          PATH=/local/gnu/bin:/bin:/usr/bin:/usr/sbin; export PATH
          
          #!/bin/sh
          
          if [ "`hostname`" = "net-server" ]; then
          
             echo Starting WWW server
             /local/httpd_1.4/httpd -d /local/httpd_1.4
          
             echo Starting GNU finger server
             /local/etc/fingerd
          
          fi
          
          echo Starting ypbind
          /usr/lib/netsvc/yp/ypbind
          
          echo Adding a default route and flushing table
          
          route -f add default my-gateway 1
          
          echo Starting xdm
          
          /local/bin/start-xdm

     Now add an entry to your `cfengine.conf' file like this


             solaris::
          
                { /etc/rc3.d/S99rc-local
          
                AutoCreate
                AppendIfNoSuchLine "exec sh /local/etc/rc.local"
                }

_Q:_
     _The solaris installation program creates `/tmp' without the
     sticky bit set, so that any user can delete any files in `/tmp'.
     It also means that a race condition can occur in the kernel which
     can give away root access to any user!_

_A:_
     Add the following line to the configuration immediately!


          files:
          
             /tmp mode=1777 action=fixdirs

_Q:_
     _The ftp program will not allow me to log in to my own account!_

_A:_
     The problem is that your shell is not in the system file
     `/etc/shells'.  Add a line something like this:


          editfiles:
          
             { /etc/shells
          
             AppendIfNoSuchLine "/local/bin/tcsh"
             }

_Q:_
     _`tcsh' prints an error message on startup and will not read my
     `.cshrc' file._

_A:_
     The problem is the central login file distributed with solaris.
     `tcsh' can't understand it. Add a line


          disable:
          
              /etc/.login type=file

     You might want to replace this with a link to your own file.

_Q:_
     _Why does solaris fill up the routing table with hundreds of
     addresses under the loop-back interface? (see netstat -r)_

_A:_
     First of all, get the latest patches for solaris, there are bugs in
     the kernel of solaris 2.4 which makes this worse. Second, make
     sure you have a file `/etc/defaultrouter' with the IP address of
     your local gateway, if you don't intend to run your system as a
     router. For instance:

          files:
          
            solaris::
          
               /etc/defaultrouter o=root g=other m=644 act=touch
          
          editfiles:
          
             solaris::
          
                { /etc/defaultrouter
          
                AppendIfNoSuchLine "xxx.xxx.xxx.1"
                }

     where `xxx.xxx.xxx.1' is the IP address of your gateway.

_Q:_
     When trying to boot the system, solaris fails with the error
     message: _fork: rescource temporarily unavailable/vfork failed_.
     The system then claims that there is something wrong with one of
     the file systems.

_A:_
     The file `/etc/system' has probably been corrupted. If this file
     does not exist, solaris establish the kernel properly and will not
     fork any processes. Things usually die early on in the boot
     process. This causes the side effect that the first fork the
     system needs to perform (to check the disk file systems) fails and
     misinterprets the reason for failure of the command. This makes it
     look as though something is wrong with the disks. Add a line:


          files:
          
             /etc/system o=root g=root m=0644 action=touch

_Q:_
     I am currently involved with setting up machines with jumpstart.
     Jumpstart as you may know allows handsfree installation of
     solaris.  One of the things it allows you to do is specify a
     "finish" script.  I am running cfengine from this script to do the
     bulk of the configuration.  During jumpstart, the root of the
     machine you are installing is actually under "/a".  This leads to
     problems with cfengine with LOCKFILEDIR and LOGFILEDIR at the very
     least. It would cause problems with all assumptions cfengine makes
     about system files too.  What would be execeedingly nice would be
     a command line option to redefine where root is assumed to be.  I
     realize this would be pretty hairy with respect to mounting
     through cfengine, but it would be very useful.  For file editing
     and such a root prefix macro woudlprobably work ok.  Let me know
     what you think.

_A:_
     Define the filenames

           $(root)/filename

     and set `$(root)' to `""' or `"/a"' depending on context?  That
     way you could the above without screwing up other things which
     might be needed. You can switch off the locks with `-K'. And you
     could override the `vfstab' location for solaris in the resource
     file.



File: cfengine-Reference.info,  Node: FreeBSD,  Prev: SOLARIS 2,  Up: FAQS and Tips

FreeBSD
-------

_Q:_
     _How can I stop my FreeBSD system from running the `/etc/daily'
     script which mails me every single day, week and month?_

_A:_
     Add an editfiles command



           freebsd::
          
             { /etc/crontab
          
             HashCommentLinesContaining "daily"
             HashCommentLinesContaining "weekly"
             HashCommentLinesContaining "monthly"
             }

_Q:_
     Why don't filesystems get mounted in the freebsd version of
     cfengine?

_A:_
     Cfengine fixes the `/etc/fstab' file, but has to choose between
     one of two courses of action when mounting, owing to a bug in the
     mount command on FreeBSD machines. Cfengine mounts filesystems
     each time it runs. On all other supported systems this causes no
     problems,: once a filesystem is mounted it will not be mounted
     again.  Under FreeBSD however, a filesystem gets mounted again
     each time mount is run, leading to multiple mount information in
     the mount table.  This causes cfengine to warn the filesystem is
     mounted many times, and could eventually result in a problem for
     the FreeBSD machine.  The policy is therefore to use mount options
     which do not cause this behaviour, but an unfortunate side-effect
     is that newly defined filesystems do not get mounted. You can
     override the mount options if you want to force multiple mounting.


File: cfengine-Reference.info,  Node: Using the help scripts,  Next: Example configuration file,  Prev: Problem solving,  Up: Top

Using the help scripts
**********************

   The following Perl scripts are included as examples and helpful
tools in your system administration package.  If you do not have Perl,
you should get it -- it is a very useful language for system
administration.

* Menu:

* cfwrap::
* cfmail::


File: cfengine-Reference.info,  Node: cfwrap,  Next: cfmail,  Prev: Using the help scripts,  Up: Using the help scripts

cfwrap
======

   It is useful to run cfengine on a daily basis from a `cron' script.
Use a line like the following one to start cfengine each night.  (Note
the curiosities of older BSD cronfiles).
     0 0 * * * /usr/local/lib/cfengine-3.0/bin/cfwrap cfdaily

where _cfdaily_ is a script which looks something like

     #!/bin/sh
     
     CFINPUTS=/usr/lib/cfengine/inputs
     
     /usr/local/bin/cfengine

You will need to include full path names to the scripts in the cron
file.  The syntax for using `cfwrap' is as follows.

     host% cfwrap mycommand
     
     host% cfwrap cfengine
     
     host% cfwrap script_which_sets_CFINPUTS_and_calls_cfengine

   When you run cfengine it normally only generates output if something
is wrong which needs your attention.  If you are running cfengine as a
`cron' job then the results of each job are normally mailed back to you
-- or to root.  But this causes problems in a networked environment,
since mail to root is usually redirected to some central place which
local system administrators cannot access.  Moreover, you have no way
of knowing which host sent the information.  The solution is to use a
script as a wrapper.  The script simply executes some command and
collects the output from that command into a file which then gets
mailed to some address.

   The address to be mailed to is obtained directly from cfengine by
calling it with the _-a_ switch.  The name of the host running cfengine
is prepended to the file before it is sent making it easy to see where
each message originated.  This is also transferred to the subject
header of the mail message.  `cfwrap' calls `cfmail' in order to mail
the result of the command back to the system administrator.


File: cfengine-Reference.info,  Node: cfmail,  Prev: cfwrap,  Up: Using the help scripts

cfmail
======

   Because there are no standard mail-agents except for _sendmail_, the
wrapper script _cfwrap_ calls its own simple mail agent _cfmail_ to
send the message.  Note that the _flags_ variable in the script
_cfmail_ arranges for the mail message to be sent with a return address
other than "root".  This means that if the recipient of the mail should
decide to hit `r' for `reply' to reply to the message, you have a
chance of getting to see the message before it vanishes along with the
rest of the mail to _root_ into the same black hole that swallows up
all those credit cards, house-keys and odd socks that disappear on a
daily basis.

   You might have to tweak the scripts slightly to tailor them to your
own needs.  They are used as follows:

     host% echo test ....  | cfmail -s "Test message" mark


File: cfengine-Reference.info,  Node: Example configuration file,  Next: Runtime Options,  Prev: Using the help scripts,  Up: Top

Example configuration files
***************************

   Here is a sample from a large configuration file, just to give you
some ideas. The file is broken up into manageable pieces for
convenience.

* Menu:

* cfengine.conf::
* cf.groups::
* cf.main::
* cf.site::
* cf.motd::
* cf.users::
* cf.solaris::
* cf.linux::
* cf.freebsd::
* cfd.conf::


File: cfengine-Reference.info,  Node: cfengine.conf,  Next: cf.groups,  Prev: Example configuration file,  Up: Example configuration file

cfengine.conf
=============

     #####################################################################
     #
     #  CFENGINE CONFIGURATION FOR site = iu.hioslo.no
     #
     #  This file is for root only.
     #
     ######################################################################
     
     ###
     #
     # BEGIN cfengine.conf
     #
     ###
     
     import:
     
        #
        # Split things up to keep things tidy
        #
     
        any::
                         cf.groups
                         cf.main
                         cf.site
                         cf.motd
     
        hpux::           cf.hpux
        linux::          cf.linux
        solaris::        cf.solaris
        sun4::           cf.sun4
        ultrix::         cf.ultrix
        freebsd::        cf.freebsd
     
        #
        # Do you want to do this ?
        #
     
        AllHomeServers:: cf.users
     
     
     ###
     #
     # END cfengine.conf
     #
     ###


File: cfengine-Reference.info,  Node: cf.groups,  Next: cf.main,  Prev: cfengine.conf,  Up: Example configuration file

cf.groups
=========

     ##############################################################
     #
     # cf.groups - for iu.hioslo.no
     #
     # This file contains  all group/class definitions
     #
     #################################################################
     
     ###
     #
     # BEGIN cf.groups
     #
     ###
     
     groups:
     
        #
        # Define some groups
        #
     
        iu = ( nexus ferengi regula borg dax lore axis worf daystrom voyager
               aud1 aud2 aud3 aud4 bajor ds9 takpah takpeh nostromo galron
               thistledown rama chaos pc-steinarj pc-hildeh way jart kosh )
     
        diskless   = ( regula ferengi lore )
     
        standalone = ( nexus axis dax borg worf daystrom voyager
                       aud1 aud2 aud3 aud4 bajor ds9 takpah takpeh
                       nostromo galron thistledown rama pc-torejo
                       pc-steinarj pc-hildeh )
     
        AllHomeServers   = ( nexus )
        AllBinaryServers = ( nexus borg )
     
        XBootServer  = ( nexus )
        WWWServers   = ( nexus )
        FTPserver    = ( nexus )
        NameServers  = ( nexus )
        PasswdServer = ( nexus )
        BackupHost   = ( nexus )
     
        MailHub      = ( nexus )
        MailClients  = ( iu -nexus )
     
     ###
     #
     # END cf.groups
     #
     ###


File: cfengine-Reference.info,  Node: cf.main,  Next: cf.site,  Prev: cf.groups,  Up: Example configuration file

cf.main
=======

     ##############################################################
     #
     # cf.main - for iu.hioslo.no
     #
     # This file contains generic config stuff
     #
     #################################################################
     
     ###
     #
     # BEGIN cf.main
     #
     ###
     
     control:
     
        access    = ( root )        # Only root should run this
     
        site      = ( iu )
        domain    = ( iu.hioslo.no )
        sysadm    = ( drift@iu.hioslo.no )
     
        repository = ( /var/spool/cfengine )
     
        netmask   = ( 255.255.255.0 )
        timezone  = ( MET )
        nfstype   = ( nfs )
     
        sensiblesize  = ( 1000 )
        sensiblecount = ( 2 )
        editfilesize  = ( 20000 )
     
        mountpattern = ( /$(site)/$(host) )
        homepattern  = ( u? )
     
        #
        # If we undefine this with cfengine -N longjob
        # then we switch off all jobs labelled with this class
        #
     
        addclasses = ( longjob )
     
        #
        # Macros & constants are inherited downwards in imports
        # but are not passed up to parent files. Good idea to
        # define them all here
        #
     
        masterfiles = ( /iu/nexus/local/iu )
        main_server = ( nexus )
        cfbin       = ( /iu/nexus/local/gnu/lib/cfengine/bin )
        gnu         = ( /local/gnu )
        ftp         = ( /local/iu/ftp )
        nisslave    = ( dax )
        nisfiles    = ( /iu/nexus/local/iu/etc )
     
        #
        # The action sequence for daily (full) runs and
        # for hourly updates (called with -DHourly)
        #
     
        Hr00::
     
           actionsequence =
              (
              copy
              mountall
              mountinfo
              checktimezone
              netconfig
              resolve
              unmount
              shellcommands
              addmounts
              links.Prepare
              files.Prepare
              directories
              links.Rest
              mailcheck
              mountall
              required
              tidy
              disable
              editfiles
              files.Rest
              processes
              )
     
        !Hr00::
     
           actionsequence =
              (
              resolve
              shellcommands
              copy
              editfiles
              processes
     	 links
              )
     
        force::
     
           actionsequence =
              (
              files.Prepare.Rest
              tidy
              )
     
     ######################################################################
     
     homeservers:
     
        iu:: nexus
     
     binservers:
     
        iu.solaris::                 nexus
        iu.linux::                   borg
     
     mailserver:
     
        any:: nexus:/var/mail
     
     mountables:
     
        any::
              nexus:/iu/nexus/u1
              nexus:/iu/nexus/u2
              nexus:/iu/nexus/u3
              nexus:/iu/nexus/u4
              nexus:/iu/nexus/u5
              nexus:/iu/nexus/u6
              nexus:/iu/nexus/ua
              nexus:/iu/nexus/ud
              nexus:/iu/nexus/local
              nexus:/opt/NeWSprint
              nexus:/opt/AcroRead
              borg:/iu/borg/local
              dax:/iu/dax/local
     
     miscmounts:
     
        linux||freebsd::   nexus:/iu/nexus/local /iu/nexus/local ro
     
     ######################################################################
     
     broadcast:
     
       ones
     
     defaultroute:
     
        cadeler30-gw
     
     ######################################################################
     
     resolve:
     
           128.39.89.10  # nexus
           158.36.85.10  # samson.hioslo.no
           129.241.1.99
     
     ######################################################################
     
     tidy:
     
        #
        # Some global tidy-ups
        #
     
           /tmp/                    pat=*             r=inf     A=1
           /var/tmp                 pat=*             r=inf     A=1
           /                        pat=core          r=1       A=0
           /etc                     pat=core          r=1       A=0
     
     ######################################################################
     
     ignore:                       # Don't check or tidy these directories
     
           /local/lib/gnu/emacs/lock/
           /local/tmp
           ftp
           projects
           /local/bin/top
           /local/lib/tex/fonts
           /local/iu/etc
           /local/etc
           /local/iu/httpd/conf
           /usr/tmp/locktelelogic
           /usr/tmp/lockIDE
           RootMailLog
     
           #
           # Emacs lock files etc
           #
     
           !*
           /local/lib/xemacs
     
           #
           # X11 keeps X server data in /tmp/.X11
           # better not delete this!
           #
     
           .X11
     
           #
           # Some users like to give a file or two 777 protection here
           # so netsurfers can update a log or counter when running as
           # `nobody'
           #
     
           www
     
     #####################################################################
     
     disable:
     
        /etc/hosts.equiv
        /etc/nologin
        /usr/lib/sendmail.fc
     
     
     ###
     #
     # END cf.main
     #
     ###


File: cfengine-Reference.info,  Node: cf.site,  Next: cf.motd,  Prev: cf.main,  Up: Example configuration file

cf.site
=======

     ##############################################################
     #
     # cf.site - for iu.hioslo.no
     #
     # This file contains site specific data
     #
     #################################################################
     
     ###
     #
     # BEGIN cf.site
     #
     ###
     
     links:
     
        Prepare::
     
           /local     -> /$(site)/$(binserver)/local
           /usr/local -> /local
     
        dax::
     
           /iu/dax/local             +> /iu/nexus/local
           /projects                 -> /iu/dax/local/projects
           /iu/nexus/u1/sowille/data -> /iu/dax/scratch/data
     
        XBootServer::
     
           #
           # Set up a /local/tftpboot area where all X terminal
           # stuff will be kept.
           #
     
           /tftpboot                  -> /local/tftpboot
           /local/tftpboot/td/configs -> /local/tftpboot/td/examples/configs
           /etc/bootptab              -> /tftpboot/bootptab
           /tftpboot/usr/lib/X11/td   -> /tftpboot/td
     
        NameServers::
     
           /etc/named.boot -> /local/iu/named/named.boot
     
        MailHub::
     
           /etc/mail/sendmail.cf ->! /iu/nexus/local/mail/sendmail.cf
     
        MailClients.solaris::
     
           /etc/mail/sendmail.cf ->! /iu/nexus/local/mail/client.cf
     
        nexus::
     
     	/local/bin +> /local/latex/bin
     
     #############################################################
     
     disable:
     
       #
       # We run Berkeley sendmail and the config files are
       # all under /iu/nexus/local/lib/mail
       #
     
         /etc/aliases
     
      WWWServers.Sunday::
     
        #
        # Disabling these log files weekly prevents them from
        # growing so enormous that they fill the disk!
        #
     
        /local/iu/httpd/logs/access_log   rotate=empty
        /local/iu/httpd/logs/agent_log    rotate=empty
        /local/iu/httpd/logs/error_log    rotate=empty
        /local/iu/httpd/logs/referer_log  rotate=empty
     
        #
        # CERT warning, security fix
        #
     
       any::
     
         /usr/lib/expreserve
     
       FTPserver.Sunday.Hr00::
     
        /local/iu/xferlog rotate=3
     
     #################################################################
     
     files:
     
       Prepare::
     
           /etc/motd              m=0644 r=0 o=root act=touch
           /.cshrc                m=0644 r=0 o=root act=touch
     
        PasswdServer::
     
           /local/iu/etc/passwd m=0644 o=root g=other action=fixplain
           /local/iu/etc/shadow m=0644 o=root g=other action=fixplain
     
        WWWServers.Rest::
     
           /local/iu/www                           m=775        g=www act=fixall r=inf
           /local/iu/httpd/conf                    m=664 o=root g=www act=fixall r=inf
           /local/iu/www/cgi-bin-public/count_file m=777 o=root g=www act=fixplain
     
        FTPserver::
     
           #
           # Make sure anonymous ftp areas have the correct
           # protection, or logins won't be able to read
           # files - or perhaps a security risk. This is
           # solaris 2 specific...
           #
     
           $(ftp)/pub        mode=755 o=ftp  g=ftp  r=inf act=fixall
           $(ftp)/Obin       mode=111 o=root g=other      act=fixall
           $(ftp)/etc        mode=111 o=root g=other      act=fixdirs
           $(ftp)/usr/bin/ls mode=111 o=root g=other      act=fixall
           $(ftp)/dev        mode=555 o=root g=other      act=fixall
           $(ftp)/usr        mode=555 o=root g=other      act=fixdirs
     
        Prepare::
     
           /etc/shells mode=0644 action=touch
     
        AllBinaryServers.Rest.longjob::
     
          /local mode=-0002 r=inf owner=root,bin group=0,1,2,3,4,5,6,7,staff
                 links=tidy action=fixall
     
          /local/iu/RootMailLog  m=0666 action=touch
     
        dax.Rest::
     
         /iu/dax/scratch        r=0 o=root mode=1777 action=fixall
         /iu/dax/local/projects r=0 o=root mode=755  action=fixdirs
     
        nexus::
     
         /local/mail/sendmail.cf o=root m=444 act=fixplain
     
         /iu/nexus/ua/robot/.rhosts o=robot m=600 act=touch
     
         /local/iu/named/pz         o=root  m=644 act=fixall r=1
     
         /local/latex/lib/tex/texmf/fonts  owner=root
                                           mode=1666
                                           recurse=inf
                                           action=fixall
     
     #################################################################
     
     tidy:
     
           #
           # Make sure the file repository doesn't fill up
           #
     
           /var/spool/cfengine pattern=*    age=3
     
           /var                pattern=core age=0  r=inf
           /var/spool/mqueue   pattern=*    age=14 type=mtime
     
        BackupHost::
     
           # Here we tidy old backup tar files from the backup area
           # A special tmp area gets cleared every 4 days. The files
           # are created by Audun's backup help script (see shellcommands)
     
           /iu/nexus/backup1      pat=*  age=7
     
     #################################################################
     
     shellcommands:
     
        PasswdServer::
     
           # Build and install the BSD compatible passwd file
           # from the master passwd/shadow file on solaris
     
           "/local/iu/bin/BuildPasswdFiles"
           "/local/iu/bin/BuildGroupFiles"
     
       BackupHost.Sunday.Hr00|BackupHost.Wednesday.Hr00::
     
           #
           # Make a system backup of /iu/nexus/u? with Audun's script
           #
     
           "$(cfbin)/cfbackup -p -f /iu/nexus/backup1 -s /iu/nexus/ud"
           "$(cfbin)/cfbackup -p -f /iu/nexus/backup1 -s /iu/nexus/ua"
           "$(cfbin)/cfbackup -p -f /iu/nexus/backup1 -s /iu/nexus/u1"
           "$(cfbin)/cfbackup -p -f /iu/nexus/backup1 -s /iu/nexus/u2"
           "$(cfbin)/cfbackup -p -f /iu/nexus/backup2 -s /iu/nexus/u3"
           "$(cfbin)/cfbackup -p -f /iu/nexus/backup2 -s /iu/nexus/u4"
           "$(cfbin)/cfbackup -p -f /iu/nexus/backup2 -s /iu/nexus/u5"
           "$(cfbin)/cfbackup -p -f /iu/nexus/backup2 -s /iu/nexus/u6"
     
       nexus.Sunday.longjob.Hr00::
     
           #
           # See how much rubbish users have accumulated each Sunday
           #
     
           "$(cfbin)/noseyparker /iu/nexus/u1 $(sysadm) "
           "$(cfbin)/noseyparker /iu/nexus/u2 $(sysadm) "
           "$(cfbin)/noseyparker /iu/nexus/u3 $(sysadm) "
           "$(cfbin)/noseyparker /iu/nexus/u4 $(sysadm) "
           "$(cfbin)/noseyparker /iu/nexus/u5 $(sysadm) "
           "$(cfbin)/noseyparker /iu/nexus/u6 $(sysadm) "
           "$(cfbin)/noseyparker /iu/nexus/ua $(sysadm) nomail"
           "$(cfbin)/noseyparker /iu/nexus/ud $(sysadm) nomail"
     
        nexus.longjob.Hr00::
     
           #
           # Update the GNU find/locate database each night
           #
     
           "$(gnu)/lib/locate/updatedb"
           "/local/iu/bin/newhomepage.sh"
     
     ###############################################################
     
     editfiles:
     
         #
         # cfengine installs itself as a cron job - sneaky! :)
         #
     
         { /var/spool/cron/crontabs/root
     
         AppendIfNoSuchLine "0 * * * * $(cfbin)/cfwrap $(cfbin)/cfhourly"
         }
     
        FTPserver::
     
           { /etc/shells
     
           AppendIfNoSuchLine "/bin/tcsh"
           AppendIfNoSuchLine "/local/gnu/bin/bash"
           }
     
     
        XBootServer::
     
           { /etc/inetd.conf
     
           AppendIfNoSuchLine
               "bootp dgram udp wait root /local/bin/bootpd bootpd -i -d"
           }
     
        nexus::
     
           { /iu/nexus/ua/robot/.rhosts
     
           AppendIfNoSuchLine "borg"
           AppendIfNoSuchLine "borg.iu.hioslo.no"
           AppendIfNoSuchLine "aud4"
           AppendIfNoSuchLine "aud4.iu.hioslo.no"
           }
     
        dax::
     
           { /etc/system
     
           AppendIfNoSuchLine "set pt_cnt=128"
           }
     
     
     ######################################################################
     
     required:
     
        #
        # Any host must have a /local, /usr/local fs. Check that
        # it exists and looks sensible. (i.e. not empty)
        #
     
        /$(site)/$(binserver)/local
     
     
     ######################################################################
     
     copy:
     
        #
        # NIS seems broken at IU, so here we use NFS to fudge
        # a file distribution as a temporary solution. Actually
        # this makes the system work faster without NIS!
        #
     
           $(nisfiles)/services dest=/etc/services o=root g=other mode=0644
           $(nisfiles)/hosts.deny dest=/etc/hosts.deny o=root mode=0644
     
        !debian::
     
           $(nisfiles)/hosts    dest=/etc/hosts o=root g=other mode=0644
     
        PasswdServer::
     
           /etc/passwd dest=$(nisfiles)/passwd o=root g=other mode=0644
           /etc/shadow dest=$(nisfiles)/shadow o=root g=other mode=0644
     
        nexus::
     
           /local/iu/etc/dfstab dest=/etc/dfs/dfstab  o=root  mode=0744
     
        solaris.!PasswdServer::
     
           $(nisfiles)/passwd dest=/etc/passwd o=root g=other mode=0644
           $(nisfiles)/shadow dest=/etc/shadow o=root g=other mode=0600
           $(nisfiles)/group.solaris dest=/etc/group o=root g=other mode=0644
     
        linux::
     
           $(nisfiles)/passwd.linux dest=/etc/passwd o=root g=other mode=0644
           $(nisfiles)/group.linux dest=/etc/group o=root g=other mode=0644
     
     ###############################################################
     
     processes:
     
           "eggdrop"                           signal=kill
           "irc"                               signal=kill
           "ping"                              signal=kill
           "NetXRay"                           signal=kill
           "netxray"                           signal=kill
           "ypserv"                            signal=kill
           "ypbind"                            signal=kill
           "rarpd"                             signal=kill
           "rpc.boot"                          signal=kill
           "README"                            signal=kill # You don't sh README !
     
        !XBootServer::
     
           "bootp"                             signal=kill
     
        #
        # These processes are not killed every hour, but once a day
        # when cfengine runs at night. Note that there are often
        # hanging pine and elm processes. These programs crash and
        # go berserk, using hundreds of hours of CPU time.
        #
     
        Hr00::
     
           "cron"                 signal=hup  # HUP these to update their config
           "inetd"                signal=hup
     
           "/local/sdt/sdt/bin"   signal=term # For those elektro dudes who forget
                                              # to log out
           "netscape"             signal=kill
           "pine"                 signal=kill
           "elm"                  signal=kill
     
     
     ###
     #
     # END cf.site
     #
     ###


File: cfengine-Reference.info,  Node: cf.motd,  Next: cf.users,  Prev: cf.site,  Up: Example configuration file

cf.motd
=======


     ##################################################################
     #
     # cf.motd
     #
     # This file is used to set the message of the day file on
     # each host
     #
     ##################################################################
     
      #####
      #
      # BEGIN cf.motd
      #
      #####
     
     
     control:
     
        #
        # This points to the file containing general text
        #
     
        masterfile      = ( /iu/nexus/local/iu/etc/motd-master )
        local_message   = ( /etc/motd.local )
     
     editfiles:
     
           { /etc/motd
     
           BeginGroupIfFileIsNewer "$(masterfile)"
             EmptyEntireFilePlease
             InsertFile "$(masterfile)"
             InsertFile "$(local_message)"
             PrependIfNoSuchLine "This system is running $(class):$(arch)"
           EndGroup
           }
     
      #####
      #
      # BEGIN cf.motd
      #
      #####


File: cfengine-Reference.info,  Node: cf.users,  Next: cf.solaris,  Prev: cf.motd,  Up: Example configuration file

cf.users
========

   Whether or not you perform any special services for users, with or
without their consent is entirely a matter of local policy. In a school
or college situation, users are often uncooperative and some are even
irresponsible.  This file shows you what you could do in an environment
with inexperienced users, but please don't feel as though you have to be
this totalitarian.

     #################################################################
     #
     # cf.users - for iu.hioslo.no
     #
     # This file contains user specific actions
     #
     #################################################################
     
     ###
     #
     # BEGIN cf.users
     #
     ###
     
     ignore:
     
         robot
     
     tidy:
     
        longjob::
     
          #
          # Some users just don't understand what they are doing
          # and this is safest, allbeit totalitarian
          #
     
          home                 pat=.rhosts                      age=0
     
          #
          # Tidy up users' home dirs
          #
     
          home                 pat=core             r=inf       age=0
          home                 pat=a.out            r=inf       age=1
          home                 p=*%                 r=inf       age=2
          home                 p=*~                 r=inf       age=2
          home                 p=#*                 r=inf       age=1
          home                 p=*.dvi              r=inf       age=14   type=ctime
          home                 p=*.log              r=inf       age=2
          home                 p=Log.*              r=inf       age=3
          home                 p=CKP                r=inf       age=1
          home                 p=BAK                r=inf       age=1
          home                 p=log                r=inf       age=0
          home                 p=*.o                r=inf       age=0
          home                 p=*.aux              r=inf       age=3
          home                 p=*.zip              r=inf       age=7
          home/.deleted        p=*                  r=inf       age=0
          home/.wastebacket    p=*                  r=inf       age=14
          home/www             p=*~                 r=inf       age=1
     
          #
          # Clear the big cache files netscape creates
          #
     
          home/.netscape-cache  p=cache????*         r=inf       age=0
          home/.MCOM-cache      p=cache????*         r=inf       age=0
          home/.netscape/cache  p=*                  r=inf       age=0
     
     
     #################################################################
     
     files:
     
        AllHomeServers.longjob.rest::
     
          #
          # Check users files are not writable to the world
          # and there are no stale links (pointing nowhere)
          #
     
          home mode=o-w recurse=inf action=fixall # links=tidy
     
          home/.xsession mode=755 action=fixall
          home/.cshrc    mode=755 action=fixall
     
     #################################################################
     
     copy:
     
        Hr00.longjob::
     
        #
        # Make sure each user has an up to date standard
        # setup.  Cshrc just sources in a big standard file
        # which is kept in ~user/../.setupfiles/cshrc
        # to reduce disk wastage
        #
     
        $(masterfiles)/lib/Cshrc   dest=home/.cshrc
        $(masterfiles)/lib/tkgrc   dest=home/.tkgrc
        $(masterfiles)/lib/fvwm2rc dest=home/.fvwm2rc
     
     
     ###
     #
     # END cf.users
     #
     ###


File: cfengine-Reference.info,  Node: cf.solaris,  Next: cf.linux,  Prev: cf.users,  Up: Example configuration file

cf.solaris
==========

     #################################################################
     #
     # cf.solaris - for iu.hioslo.no
     #
     # This file contains solaris specific patches
     #
     #################################################################
     
     ###
     #
     # BEGIN cf.solaris
     #
     ###
     
     directories:
     
          #
          # httpd/netscape want this to exist for some bizarre reason
          #
     
           /usr/lib/X11/nls
     
     ################################################################
     
     tidy:
     
          /var/log  pattern=syslog.* age=0
     
        MailHub::
     
          /var/mail pattern=lp       age=0
     
     #################################################################
     
     files:
     
       #
       # If this doesn't exist fork will not work and the
       # system will not even be able to run the /etc/rc
       # scripts at boottime
       #
     
       /etc/system     o=root g=root m=644 action=touch
     
       /var/log/syslog o=root        m=666 action=touch
     
     #############################################################
     
     copy:
     
        #
        # Some standard setup files, can't link because
        # machine won't boot if their not on / partition.
        #
     
        /local/bin/tcsh dest=/bin/tcsh mode=755
     
        /local/iu/etc/nsswitch.standalone dest=/etc/nsswitch.conf
     
       #
       # Our named server uses a newer BIND
       # Put this here so that it will be preserved under
       # solaris reinstallation
       #
     
       NameServers::
     
        /local/iu/sbin/in.named         dest=/usr/sbin/in.named         mode=555
        /local/iu/sbin/in.named.reload  dest=/usr/sbin/in.named.reload  mode=555
        /local/iu/sbin/in.named.restart dest=/usr/sbin/in.named.restart mode=555
        /local/iu/sbin/in.ndc           dest=/usr/sbin/in.ndc           mode=555
        /local/iu/sbin/named-xfer       dest=/usr/sbin/named-xfer       mode=555
        /local/iu/lib/nslookup.help     dest=/usr/lib/nslookup.help     mode=444
     
       any::
        /local/iu/lib/libresolv.a        dest=/usr/lib/libresolv.a      mode=444
        /local/iu/lib/libresolv.so.2     dest=/usr/lib/libresolv.so.2   mode=444
        /local/bin/nslookup              dest=/usr/sbin/nslookup        mode=444
     
     ##############################################################
     
     editfiles:
     
           { /etc/netmasks
     
           AppendIfNoSuchLine "128.39  255.255.255.0"
           }
     
           { /etc/defaultrouter
     
           AppendIfNoSuchLine "128.39.89.1"
           }
     
           { /usr/openwin/lib/app-defaults/XConsole
     
           AppendIfNoSuchLine "XConsole.autoRaise: on"
           }
     
        #
        # CERT security patch for vold vulnerability
        #
     
        { /etc/rmmount.conf
     
        HashCommentLinesContaining "action cdrom"
        HashCommentLinesContaining "action floppy"
        }
     
     ##############################################################
     
     disable:
     
         /etc/.login  type=file
         /etc/aliases
     
        #
        # These files are ENORMOUS, don't let them fill the disk
        #
     
        Wednesday::
     
           /var/lp/logs/lpsched rotate=empty
     
           /var/adm/wtmpx       rotate=empty
           /var/adm/wtmp        rotate=empty
     
     ##############################################################
     
     files:
     
         /etc/passwd        m=0644 o=root g=other action=fixplain
         /etc/shadow        m=0600 o=root g=other action=fixplain
         /etc/defaultrouter m=0644 o=root g=other action=touch
         /var/adm/wtmpx     m=0664 o=adm  g=adm   action=touch
         /var/adm/wtmp      m=0644 o=root g=adm   action=touch
         /var/adm/utmp      m=0644 o=root g=adm   action=fixplain
         /var/adm/utmpx     m=0664 o=adm  g=adm   action=fixplain
     
         /tmp m=1777                              action=fixdirs
     
     ##############################################################
     
     disable:
     
        #
        # CERT security patch
        #
     
        /usr/openwin/bin/kcms_calibrate
        /usr/openwin/bin/kcms_configure
        /usr/bin/admintool
     
     ################################################################
     
     shellcommands:
     
        AllBinaryServers.Saturday.longjob.Hr00::
     
           #
           # Make sure the man -k / apropos data are up to date
           #
     
           "/usr/bin/catman  -M /local/man"
           "/usr/bin/catman  -M /local/X11R5/man"
           "/usr/bin/catman  -M /usr/man"
           "/usr/bin/catman  -M /local/gnu/man"
           "/usr/bin/catman  -M /usr/openwin/share/man"
           "/usr/bin/catman  -M /local/X11R5/man"
           "/usr/bin/catman  -M /usr/share/man"
     
     ################################################################
     
     editfiles:
     
     
           #
           # A painless way to add an rc.local script to the rc files
           # under solaris without having to fight though inittab
           #
     
           { /etc/rc3.d/S15nfs.server
     
           AppendIfNoSuchLine "sh /local/iu/etc/rc.local"
           }
     
           #
           # umask defined when inetd starts is inherited by all subprocesses
           # including ftpd which saves with mode 666 (!) unless we do this
           #
     
           { /etc/rc2.d/S72inetsvc
     
           PrependIfNoSuchLine "umask 022"
           }
     
     
     ###
     #
     # END cf.solaris
     #
     ###


File: cfengine-Reference.info,  Node: cf.linux,  Next: cf.freebsd,  Prev: cf.solaris,  Up: Example configuration file

cf.linux
========

     #################################################################
     #
     # cf.linux - for iu.hioslo.no
     #
     # This file contains debian linux specific patches
     #
     #################################################################
     
     ###
     #
     # BEGIN cf.linux
     #
     ###
     
     files:
     
           /etc/printcap m=644 o=root action=fixplain
     
          #
          # Cert advisories
          #
     
           /bin/mount         m=755 o=root action=fixall
           /bin/umount        m=755 o=root action=fixall
     
     #######################################################################
     
       disable:
     
          #
          # Cert advisories
          #
     
           /sbin/dip-3.3.7n
     
     ########################################################################
     
     links:
     
         /local/bin/tcsh   ->  /bin/tcsh
     
         /local/lib/mail   ->  /$(site)/$(main_server)/local/lib/mail
     
     ########################################################################
     
     editfiles:
     
       #
       # Samba default mode needs to be set...
       #
     
        { /etc/smb.conf
     
        ReplaceAll "700" With "644"
        }
     
       #
       # Linux date is very stupid and needs a very careful
       # TZ definition, otherwise it loses
       #
     
        { /etc/csh.cshrc
     
        AppendIfNoSuchLine "setenv TZ 'MET-1MET DST-2,M3.5.0/2,M10.5.0/3'"
        }
     
       #
       # resolv+ ordering
       #
     
        { /etc/host.conf
     
        PrependIfNoSuchLine "order bind"
        }
     
     
       #
       # Should have been configured already (!)
       #
     
        { /etc/ld.so.conf
     
        AppendIfNoSuchLine "/usr/X11R6/lib"
        }
     
       #
       # Kill annoying messages
       #
     
        { /etc/cron.daily/standard
     
        HashCommentLinesContaining "security"
        }
     
     #########################################################################
     
     shellcommands:
     
       Hr00::
     
          #
          # Find/locate database
          #
     
          "/usr/bin/updatedb"
     
     ###
     #
     # END cf.linux
     #
     ###


File: cfengine-Reference.info,  Node: cf.freebsd,  Next: cfd.conf,  Prev: cf.linux,  Up: Example configuration file

cf.freebsd / cf.netbsd
======================

   FreeBSD, OpenBSD and NetBSD are sufficiently similar to have a single
file for all.

     #################################################################
     #
     # cf.bsd - for iu.hioslo.no
     #
     # This file contains bsd specific patches
     #
     #################################################################
     
     ###
     #
     # BEGIN cf.bsd
     #
     ###
     
     links:
     
         /usr/spool        ->  /var/spool
         /local/bin/tcsh   ->  /bin/tcsh
         /local/bin/perl   ->  /usr/bin/perl
         /usr/lib/sendmail ->  /usr/sbin/sendmail
     
     #################################################################
     
     files:
     
        /usr/tmp mode=1777 owner=root action=fixall
     
     #################################################################
     
     editfiles:
     
        #
        # Comment out all lines to shut up this annoying cfengine-like
        # script, which sends mail every day!!!
        #
     
        { /etc/crontab
     
        HashCommentLinesContaining "daily"
        HashCommentLinesContaining "weekly"
        HashCommentLinesContaining "monthly"
        }
     
     #################################################################
     
     copy:
     
           $(masterfiles)/etc/printcap.client      dest=/etc/printcap mode=0644
     
     #########################################################################
     
     shellcommands:
     
       Hr00::
     
         "/usr/libexec/locate.updatedb"
         "/usr/bin/makewhatis /usr/share/man:/usr/X11R6/man"
     
     ###
     #
     # END cf.bsd
     #
     ###


File: cfengine-Reference.info,  Node: cfd.conf,  Prev: cf.freebsd,  Up: Example configuration file

cfd.conf
========

     #########################################################
     #
     # This is a cfd config file
     #
     # The access control here follows after any tcpd
     # control in /etc/hosts.allow and /etc/hosts.deny
     #
     #########################################################
     
      #
      # Could import cf.groups here and use a structure like
      # in cfengine.conf, cf.main, cf.groups
      #
     
     control:
     
       public = ( /usr/local/publicfiles )
     
       almost_public = ( /usr/local/almostpublicfiles )
     
       cfrunCommand = ( /iu/nexus/ud/mark/comp/Tests/cfrun-command )
     
       MaxConnections = ( 10 )
     
     #########################################################
     
     admit:   # or grant:
     
          $(public) *
     
          $(almost_public) *.iu.hioslo.no *.gnu.ai.mit.edu
     
          /etc/passwd *.iu.hioslo.no
     
          #
          # Who can exec cfengine remotely?
          #
     
          $(cfrunCommand) *.iu.hioslo.no
     
     #########################################################
     
     deny:
     
          $(public)/special *.moneyworld.com

