###
###  Copyright 2000-2007 University of Illinois Board of Trustees
###  All rights reserved. 
###
###  platform-freebsd5 - FreeBSD-specific Configuration (FreeBSD 5)
###
###  Campus Information Technologies and Educational Services
###  University of Illinois at Urbana-Champaign
###

### Start with the FreeBSD 4 configuration and override the differences.

%include "platform-freebsd4.conf"

crontabs {
  operator    => [
          {
			type => vixie,
               minute => "*/11",
               command => "/usr/libexec/save-entropy"
          }
	]
};

### Add perl to the package list 
### since it is no longer in the base system.
pkg_install_list {
	perl
};

### If we are using PackageManager::FreeBSD::Ports,
### then we need to adjust for the new index file.
# pkg_index_file "/usr/ports/INDEX-5";

### sendmail config
sendmail_aliases->delete nobody;
sendmail_aliases->delete uucp;
sendmail_ostype "freebsd5";

sendmail_aliases {
  proxy => root
};

### Name Server Switch configurations
name_service_conf_path "/etc/nsswitch.conf";
name_service_delimiter ": ";
name_service_seperator " ";
name_service_switch->unset;
name_service_switch {
	hosts => [ files, dns ],
	group => [ files ],
	networks => [ files ],
	passwd => [ files ],
	shells => [ files ]
};

### ssh config
ssh_options {
  ForwardX11Trusted	=> yes
};

# list_rc_scripts_cmd "/bin/ls -1 /etc/rc.d/* /usr/local/etc/rc.d/*.sh";

### RCng Configuration setup						What Control module
rc_scripts {
	amd => { state => disable, rc_var => amd_enable },			# NFS_Client
	cron => { state => disable, rc_var => cron_enable },		# cron
	inetd => { state => disable, rc_var => inetd_enable },		# inetd
	lpd => { state => disable, rc_var => lpd_enable },			# Printers
	mountd => { state => disable, rc_var => mountd_enable },	# NFS_Client/NFS_Server
	named => { state => disable, rc_var => named_enable },		# CachingDNS
	nfs_client => { state => disable, rc_var => nfs_client_enable },	# NFS_Client
	nfs_server => { state => disable, rc_var => nfs_server_enable },	# NFS_Server
	ntpd => { state => disable, rc_var => ntpd_enable },		# NTP
	rpcbind => { state => disable, rc_var => rpcbind_enable },	# NFS_Client/NFS_Server
	sendmail => { state => disable, rc_var => sendmail_enable },	# sendmail
	sshd => { state => disable, rc_var => sshd_enable },		# sshd
	syslogd => { state => disable, rc_var => syslogd_enable },	# syslog

	### The following are used when default_script_behavior is not
	### set to ignore.
	apm => { state => ignore, rc_var => apm_enable },
	apmd => { state => ignore, rc_var => apmd_enable },
	atm1 => { state => ignore, rc_var => atm_enable },
	atm2 => { state => ignore, rc_var => atm_enable },
	atm3 => { state => ignore, rc_var => atm_enable },
	bgfsck => { state => ignore, rc_var => background_fsck },
	bootparams => { state => ignore, rc_var => bootparamd_enable },
	devd => { state => ignore, rc_var => devd_enable },
	dmesg => { state => ignore, rc_var => dmesg_enable },
	ike => { state => ignore, rc_var => ike_enable },
	ip6addrctl => { state => ignore, rc_var => ip6addrctl_enable },
	ipfilter => { state => ignore, rc_var => ipfilter_enable },
	ipfs => { state => ignore, rc_var => ipfs_enable },
	ipfw => { state => ignore, rc_var => firewall_enable },
	ipmon => { state => ignore, rc_var => ipmon_enable },
	ipnat => { state => ignore, rc_var => ipnat_enable },
	ipsec => { state => ignore, rc_var => ipsec_enable },
	ipxrouted => { state => ignore, rc_var => ipxrouted_enable },
	jail => { state => ignore, rc_var => jail_enable },
	kadmind => { state => ignore, rc_var => kadmind5_server_enable },
	kerberos => { state => ignore, rc_var => kerberos5_server_enable },
	keyserv => { state => ignore, rc_var => keyserv_enable },
	kldxref => { state => ignore, rc_var => kldxref_enable },
	kpasswdd => { state => ignore, rc_var => kpasswdd_server_enable },
	lomac => { state => ignore, rc_var => lomac_enable },
	moused => { state => ignore, rc_var => moused_enable },
	mroute6d => { state => ignore, rc_var => mroute6d_enable },
	mrouted => { state => ignore, rc_var => mrouted_enable },
	natd => { state => ignore, rc_var => natd_enable },
	ntpdate => { state => ignore, rc_var => ntpdate_enable },
	pccard => { state => ignore, rc_var => pccard_enable },
	pf => { state => ignore, rc_var => pf_enable },
	pflog => { state => ignore, rc_var => pflog_enable },
	"ppp-user" => { state => ignore, rc_var => ppp_enable },
	pppoed => { state => ignore, rc_var => pppoed_enable },
	quota => { state => ignore, rc_var => enable_quotas },
	rarpd => { state => ignore, rc_var => rarpd_enable },
	route6d => { state => ignore, rc_var => ipv6_router_enable },
	routed => { state => ignore, rc_var => router_enable },
	rtadvd => { state => ignore, rc_var => rtadvd_enable },
	securelevel => { state => ignore, rc_var => kern_securelevel_enable },
	timed => { state => ignore, rc_var => timed_enable },
	usbd => { state => ignore, rc_var => usbd_enable },
	vinum => { state => ignore, rc_var => start_vinum },
	virecover => { state => ignore, rc_var => virecover_enable },
	watchdogd => { state => ignore, rc_var => watchdogd_enable },
	ypbind => { state => ignore, rc_var => nis_client_enable },
	yppasswdd => { state => ignore, rc_var => nis_yppasswdd_enable },
	ypserv => { state => ignore, rc_var => nis_server_enable },
	ypset => { state => ignore, rc_var => nis_ypset_enable },
	ypupdated => { state => ignore, rc_var => rpc_ypupdated_enable },
	ypxfrd => { state => ignore, rc_var => nis_ypxfrd_enable },

	### These are common scripts found in /usr/local/etc/rc.d
	rsyncd => { 
		state => ignore,
		rc_var => rsyncd_enable
	},
	"000.compat4x.sh" => {
		state => ignore,
		fullname => "/usr/local/etc/rc.d/000.compat4x.sh",
		enable_cmd => "chmod +x %f",
		enable_test => "test -x %f",
		disable_cmd => "chmod -x %f",
		disable_test => "test ! -x %f"
	},
	"001.vmware.sh" => {
		state => ignore,
		fullname => "/usr/X11R6/etc/rc.d/001.vmware.sh",
		enable_cmd => "chmod +x %f",
		enable_test => "test -x %f",
		disable_cmd => "chmod -x %f",
		disable_test => "test ! -x %f"
	},
	"rtc.sh" => {
		state => ignore,
		fullname => "/usr/local/etc/rc.d/rtc.sh",
		enable_cmd => "chmod +x %f",
		enable_test => "test -x %f",
		disable_cmd => "chmod -x %f",
		disable_test => "test ! -x %f"
	}
};


### PAM configuration
pam_directory yes;
pam_conf->unset;

pam_conf { ftpd => [
	"auth		required	pam_nologin.so		no_warn",
	"auth		sufficient	pam_opie.so		no_warn no_fake_prompts",
	"auth		requisite	pam_opieaccess.so	no_warn allow_local",
	"auth		required	pam_unix.so		no_warn try_first_pass",
	"account		required	pam_unix.so",
	"session		required	pam_permit.so"
]};

pam_conf { gdm => [
	"auth		required	pam_nologin.so		no_warn",
	"auth		required	pam_unix.so		no_warn try_first_pass",
	"account		required	pam_unix.so",
	"session		required	pam_permit.so"
]};

pam_conf { imap => [
	"auth		required	pam_unix.so		no_warn try_first_pass"
]};

pam_conf { kde => [
	"auth		required	pam_nologin.so		no_warn",
	"auth		required	pam_unix.so		no_warn try_first_pass",
	"account		required	pam_unix.so",
	"session		required	pam_permit.so"
]};

pam_conf { login => [
	"auth		required	pam_nologin.so		no_warn",
	"auth		sufficient	pam_self.so		no_warn",
	"auth		include		system",
	"account		requisite	pam_securetty.so",
	"account		include		system",
	"session		include		system",
	"password	include		system"
]};

pam_conf { other => [
	"auth		required	pam_nologin.so		no_warn",
	"auth		sufficient	pam_opie.so		no_warn no_fake_prompts",
	"auth		requisite	pam_opieaccess.so	no_warn allow_local",
	"auth		required	pam_unix.so		no_warn try_first_pass",
	"account		required	pam_login_access.so",
	"account		required	pam_unix.so",
	"session		required	pam_permit.so",
	"password	required	pam_permit.so"
]};

pam_conf { passwd => [
	"password	required	pam_unix.so		no_warn try_first_pass nullok"
]};

pam_conf { pop3 => [
	"auth		required	pam_unix.so		no_warn try_first_pass"
]};

pam_conf { rexecd => [
	"auth		required	pam_nologin.so		no_warn",
	"auth		required	pam_unix.so		no_warn use_first_pass",
	"account		required	pam_ftpusers.so		no_warn disallow",
	"account		required	pam_unix.so		no_warn",
	"session		required	pam_permit.so",
	"password	required	pam_deny.so"
]};

pam_conf { rsh => [
	"auth		required	pam_nologin.so		no_warn",
	"auth		required	pam_rhosts.so		no_warn",
	"account		required	pam_unix.so",
	"session		required	pam_permit.so",
	"password	required	pam_deny.so"
]};

pam_conf { sshd => [
	"auth		required	pam_nologin.so		no_warn",
	"auth		sufficient	pam_opie.so		no_warn no_fake_prompts",
	"auth		requisite	pam_opieaccess.so	no_warn allow_local",
	"auth		required	pam_unix.so		no_warn try_first_pass",
	"account		required	pam_login_access.so",
	"account		required	pam_unix.so",
	"session		required	pam_permit.so",
	"password	required	pam_unix.so		no_warn try_first_pass"
]};

pam_conf { su => [
	"auth		sufficient	pam_rootok.so		no_warn",
	"auth		sufficient	pam_self.so		no_warn",
	"auth		requisite	pam_group.so		no_warn group=wheel root_only fail_safe",
	"auth		include		system",
	"account		include		system",
	"session		required	pam_permit.so"
]};

pam_conf { system => [
	"auth		sufficient	pam_opie.so		no_warn no_fake_prompts",
	"auth		requisite	pam_opieaccess.so	no_warn allow_local",
	"auth		required	pam_unix.so		no_warn try_first_pass nullok",
	"account		required	pam_login_access.so",
	"account		required	pam_unix.so",
	"session		required	pam_lastlog.so		no_fail",
	"password	required	pam_unix.so		no_warn try_first_pass"
]};

pam_conf { telnetd => [
	"auth		required	pam_nologin.so		no_warn",
	"auth		sufficient	pam_opie.so		no_warn no_fake_prompts",
	"auth		requisite	pam_opieaccess.so	no_warn allow_local",
	"auth		required	pam_unix.so		no_warn try_first_pass",
	"account		required	pam_login_access.so",
	"account		required	pam_unix.so",
	"session		required	pam_lastlog.so		no_fail",
	"password	required	pam_unix.so		no_warn try_first_pass"
]};

pam_conf { xdm => [
	"auth		required	pam_nologin.so		no_warn",
	"auth		required	pam_unix.so		no_warn try_first_pass",
	"account		required	pam_unix.so",
	"session		required	pam_permit.so",
	"password	required	pam_deny.so"
]};

pam_conf { ftp => [
	"auth		required	pam_nologin.so		no_warn",
	"auth		sufficient	pam_opie.so		no_warn no_fake_prompts",
	"auth		requisite	pam_opieaccess.so	no_warn allow_local",
	"auth		required	pam_unix.so		no_warn try_first_pass",
	"account		required	pam_unix.so",
	"session		required	pam_permit.so"
]};