Lars Sommer, lasg@lasg.dk, 2009-05-21 DISCLAIMER: This is a personal note made for personal usage.It might not be easy usable nor explaining. This is personal notes. Get an idea of why this combination of programs are agood idea first. --- Installation: Install these ports: security/amavisd-new security/clamav You also need databases/p5-DBD-mysql60 to let Amavis check your DSN in the MySQL mailserver DB --- Initial configuration: Enable amavisd-new and clamav in /etc/rc.conf with the following lines: clamav_clamd_enable="YES" clamav_freshclam_enable="YES" amavisd_enable="YES" Optionally enable amavisd tmp ram disk with: (example 512k) amavisd_ram="512m" Let the user clamav be a member in the group vscan, so that: $ id clamav uid=106(clamav) gid=106(clamav) groups=106(clamav), 6(mail), 110(vscan) by: pw user mod clamav…

Lars Sommer, lasg@lasg.dk, 2007-10-22DISCLAIMER: This is a personal note made for personal usage. It might not be easy usable nor explaining. For use with my Postfix+Dovecot setup. Squirrelmail is very simple. Look at Roundcube, Horde Imp or Zibra for something more modern. Installation: Install this port:mail/squirrelmail Install plugins:mail/squirrelmail-secure_login-plugin The plugin secure_login gives ssl enabled login screen. More nice plugins could come here… Configure squirrelmail: cd /usr/local/www/squirrelmail./configure “D. Set pre-defined settings for specific IMAP servers”dovecot In “2. Server Settings”, in “B. Update SMTP Settings : localhost:25”set “7. SMTP Authentication : login”to use SASL. “8. Plugins”“17. secure_login” Enable in apaches httpd.conf: Alias /webmail/ “/usr/local/www/squirrelmail/”Allow from all

Lars Sommer, lasg@lasg.dk, 2009-03-17DISCLAIMER: This is a personal note made for personal usage. It might not be easy usable nor explaining. This setup is installing Mailman on a working mailserver running Postfix, with virtual domains in MySQL,and with a working webserver running Apache 2. Installation: Install the portmail/mailmanEnable the option POSTFIX See eventually:/usr/local/share/doc/mailman/FreeBSD-post-install-notes Add the the bottom of /usr/local/mailman/Mailman/mm_cfg.py:SMTPHOST = ‘lasg.dk’MTA = ‘Postfix’POSTFIX_STYLE_VIRTUAL_DOMAINS = [‘lasg.dk’,’hosting.lasg.dk’] Add to postfix/main.cf:alias_maps = hash:/usr/local/mailman/data/aliases Edit in postfix/main.cf, the virtual_alias_maps line:virtual_alias_maps = mysql:/usr/local/etc/postfix/mysql_virtual_alias_maps.cf,hash:/usr/local/mailman/data/virtual-mailman Add to /etc/rc.conf:mailman_enable=”YES” Check permissions on /usr/local/mailman/data/aliases, aliases.db, virtual-mailman, virtual-mailman.dbto be in group “mailman” and with permissions rw-rw—- Apache configuration: This is a very simple config for Apache.This can be inserted within a virtual…

Lars Sommer, lasg@lasg.dk, 2007-09-06Updated to FreeBSD 7.2, 2009-08-26DISCLAIMER: This is a personal note made for personal usage. It might not be easy usable nor explaining. Please note: Cacti do not have memory/free scripts for FreeBSD. You can eitherhack in the linux scripts, or look at the Cacti website, at the add-on scripts. Install these ports:net-mgmt/cactiNO NOT THIS: net/cactid Messages from the ports: If you update cacti, open a login page, an updating processwill start automatically.

Lars Sommer, lasg@lasg.dk, 2007-09-24DISCLAIMER: This is a personal note made for personal usage. It might not be easy usable nor explaining. Install the main port on the monitoring host:sysutils/munin-main And the node package on all nodes which should be monitored:(Often including on the monitoring host)sysutils/munin-node Good documented config in:/usr/local/etc/munin/munin.conf/usr/local/etc/munin/munin-node.conf Enable in /etc/rc.conf:munin_node_enable=”YES” Add in httpd.conf:Alias /munin “/usr/local/www/munin/” Order Deny,AllowDeny from allAllow from localhost 127.0.0.1 No perhaps not this one…:Insert this in the crontabs:*/5 * * * * root /usr/local/bin/munin-cron –force-root 2>&1 > /dev/null

Lars Sommer, lasg@lasg.dk, v.1 2008-03-08DISCLAIMER: This is a personal note made for personal usage. It might not be easy usable nor explaining. Install this port:irc/unreal With these options:HUBNOSPOOFSSLIPV6 Add to rc.conf:unrealircd_enable=”YES” Copy my unreal.conf Create a SSL cert.

Lars Sommer, lasg@lasg.dk, v.2, 2008-03-08DISCLAIMER: This is a personal note made for personal usage. It might not be easy usable nor explaining. Installation: Install this port:irc/bitlbee With these options:RECODE Insert in /etc/services:bitlbee 6668/tcp Insert in /etc/inet.confbitlbee stream tcp nowait lasg /usr/local/sbin/bitlbee bitlbee cd /usr/local/etc/bitlbee/cp bitlbee.conf.orig bitlbee.confvi bitlbee.conf Set:AuthMode = ClosedAuthPassword = mysecretpw For proxy, this can be used in bitlbee.conf;Proxy = http://wwwproxy.kom.aau.dk:3128 Remember to backup your.nicks.accounts chown lasg /usr/local/etc/bitlbee

Making a caching adblocking or tranparent local web proxyLars Sommer, lasg@lasg.dkLast updated: 2010-03-06 This will result in a chain like:LAN – Junkbuster – Squid – pf – Internet Installation:Install this port:www/squidEnable transparent proxying with PF: SQUID_PF Initialize Squid swap directories by running squid -z once. Install this port:www/junkbuster Eventually these two for statistics:Does not exist anymore 11-04-19 www/squidclientswww/calamaris Add to rc.conf:squid_enable=”YES”junkbuster_enable=”YES” /usr/local/etc/squid/squid.conf is a HUGE file.If NOT using it in a transparent pf mode nothing needs to be changed. If using it in a transparent pf mode, the following changes must be applied to squid.conf:http_port 127.0.0.1:3128 transparentHmm: The following does not seem to be needed:http_access deny to_localhostacl our_networks src 10.6.6.0/24http_access allow our_networksvisible_hostname…

Last updated: 2010-04-17Lars Sommer, lasg@lasg.dk Without any plugins, I maintain a small text file of blocked domains and regex’ed URLs. Install the Squid webproxy as described in another note. In /usr/local/etc/squid/squid.conf, add:acl denied_domains dstdomain “/usr/local/etc/squid/denied_domains.acl”acl filetypes urlpath_regex -i “/usr/local/etc/squid/denied_filetypes.acl”acl url_ads url_regex “/usr/local/etc/squid/denied_ads.acl”http_access deny url_adshttp_access deny filetypeshttp_access deny denied_domainshttp_access allow localnethttp_access deny all If inserting all this explicit in the end of the file e.g.,then remember to comment out these earlier in the file:http_access allow localnethttp_access deny all Make the ACL files. Examples are:cat denied_domains.acl.evilsite.com.tradedoubler.com cat denied_filetypes.acl.(exe)$.(dll)$ cat denied_ads.acl/adv/..gif$ /[Aa]ds/..gif$/[Aa]d[Pp]ix//[Aa]d[Ss]erver/[Aa][Dd]/..[GgJj][IiPp][FfGg]$ /[Bb]annerads/ /adbanner..[GgJj][IiPp][FfGg]$/images/ad//reklame//RealMedia/ads/.*^http://www.submit-it.*^http://www.eads.*^http://ads.^http://ad.^http://ads02.^http://adaver.. ^http://adforce. adbot.com /ads/..gif.*_ad..*cgi Reload squid configuration:squid -k reconfigure I got a large +7000 line domain block file from MISSING