This is cfengine-Reference.info, produced by makeinfo version 4.2 from
cfengine-Reference.texinfo.

INFO-DIR-SECTION System Utilities
START-INFO-DIR-ENTRY
* cfengine Reference: (cfengine-Reference.info).
                        Cfengine is a language based tool specifically
                        designed for configuring and maintaining BSD
                        and System-5-like operating systems attached
                        to a TCP/IP network.
END-INFO-DIR-ENTRY


File: cfengine-Reference.info,  Node: DenyBadClocks,  Next: DenyConnectionsFrom,  Prev: cfrunCommand,  Up: cfservd control

DenyBadClocks
-------------

   If this is set to `off', cfservd will not deny access to clients
whose clocks are off by more than one hour. The default is to deny
access to systems whose clocks differ by more than one hour. This can
prevent messages of the form `Can't stat' file when remote copying.


File: cfengine-Reference.info,  Node: DenyConnectionsFrom,  Next: cfservd HostnameKeys,  Prev: DenyBadClocks,  Up: cfservd control

DenyConnectionsFrom
-------------------

   Hosts which are included by the allow-list above can be explicitly
denied access using this list.

          control:
     
           DenyConnectionsFrom = ( 128.39.89.76 )  # rogue host


File: cfengine-Reference.info,  Node: cfservd HostnameKeys,  Next: cfservd IfElapsed,  Prev: DenyConnectionsFrom,  Up: cfservd control

HostnameKeys
------------

   If this variable is set to true/on, it causes cfservd to lookup and
store trusted public keys according to their DNS fully qualified host
name, instead of using the IP address.  This can be useful in
environments where hosts do not have fixed IP addresses, but do have
fixed hostnames.


       HostnameKeys = ( on )
   This method of storing keys is not recommended for sites with fixed
IP addresses, since it removes one security barrier from a potential
attacker by potentially allowing DNS spoofing.


File: cfengine-Reference.info,  Node: cfservd IfElapsed,  Next: LogAllConnections,  Prev: cfservd HostnameKeys,  Up: cfservd control

IfElapsed
---------

   The `IfElapsed' anti-spamming filter is also built into `cfservd' so
that a remote user cannot even get as far as causing cfengine to parse
its input files (which could be used for spamming in itself). The time
is in minutes, the default is one hour.


File: cfengine-Reference.info,  Node: LogAllConnections,  Next: MaxConnections,  Prev: cfservd IfElapsed,  Up: cfservd control

LogAllConnections
-----------------

   If set to true, every successful connection will be logged to syslog.
This could be useful for identifying abuses of the service, if the
server should come under attack, e.g. a denial of service attack. The
IP address can then be excluded from the allowed connections list.


File: cfengine-Reference.info,  Node: MaxConnections,  Next: TrustKeysFrom,  Prev: LogAllConnections,  Up: cfservd control

MaxConnections
--------------

   This integer value sets a limit on the maximum number of child
daemon threads which cfservd will `fork' in order to handle remote
requests. The default value is ten.


File: cfengine-Reference.info,  Node: TrustKeysFrom,  Next: DynamicAddresses,  Prev: MaxConnections,  Up: cfservd control

TrustKeysFrom
-------------

   Hosts which are included in this list are automatically trusted, if
cfservd does not know their public key. This allows public keys to be
exchanged. Cfservd will not automatically accept a public key from a
host it does not know, since the key will be used to assert strong
authentication later.  Once a public key has been associated with an IP
address, it will never be updated, unless the existing key is deleted
by hand.

          control:
     
           TrustKeysFrom = ( 128.39.89.76 )     # trusted host
           TrustKeysFrom = ( 128.39.89.76/24 )  # trusted subnet


File: cfengine-Reference.info,  Node: DynamicAddresses,  Prev: TrustKeysFrom,  Up: cfservd control

DynamicAddresses
----------------

   Hosts which are included in this list are assumed to have IP
addresses which can change with time, e.g. hosts which are given IP
addresses by DHCP or a BOOTP like protocol.

          control:
     
           DynamicAddresses = ( 128.39.74.100-200 )  # DHCP range

   If cfservd receives a connection from an IP address that is in this
list, and trustkey is _true_, the existing key for that IP address can
be replaced with a new key, and the old key is recorded in a "used keys"
list, access is granted. If trust is switched off, the server looks in
the "used key list" to see if the key has been seen before. If not
access is refused. If it has been seen before - it uses this earlier
trust to accept the connection and replace the IP-key binding.

   Note that used keys are kept in a database for easy lookup, whereas
fixed keys are kept in files for easy administration. If host keys
change or are reinstalled on the dynamically allocated hosts, then this
database should probably be deleted to purge keys that become illegal.


File: cfengine-Reference.info,  Node: admit grant and deny,  Next: cfrun,  Prev: cfservd control,  Up: Cfservd.conf and cfrun reference

admit, grant and deny
=====================

* Menu:

* root=::
* encrypt=::
* SkipVerify::


File: cfengine-Reference.info,  Node: root=,  Next: encrypt=,  Prev: admit grant and deny,  Up: admit grant and deny

`root='
-------

   This list specifies the names of hosts which are to have read access
to files, regardless of the owner of the file. This effectively gives
root users on connecting hosts privileges to non-root owned files on
the server, but not vice-versa, similar to the NFS root mapping, except
that there is no question of a client being able to modify files on the
server. Caution: cfservd trusts the DNS service, so be aware that cache
poisoning attacks are a possible way of bypassing access controls.

   As of version 2.0.4: Once a verified host address has been
identified with a functioning public/private key authentication, the IP
address is added to the SkipVerify list, so that time is not wasted in
verifying reverse lookups, when the identify can be verified more
efficiently and securely by a key mechanism.


File: cfengine-Reference.info,  Node: encrypt=,  Next: SkipVerify,  Prev: root=,  Up: admit grant and deny

`encrypt=true'
--------------

   If this option is set, cfservd will only serve the named files if
the copy access type is `secure', i.e. on an encrypted link. This
presupposes that cfengine has been compiled with a working OpenSSL
library.


File: cfengine-Reference.info,  Node: SkipVerify,  Prev: encrypt=,  Up: admit grant and deny

SkipVerify
----------

   If connecting hosts use a Network Address Translator in order to
share an IP address, reverse lookup will fail to give a correct
verification of host identity.  You can switch off cfservd's
verification of IP host identity for specific IP addresses or patterns
using this command. E.g.


     SkipVerify = ( 192.0.0.10  192.0.2.  )

   This does not affect key verification.

   NOTE!! This is a security risk because it means that cfservd
implicitly trusts the connecting hosts! You should be very careful in
using Network Address Translators in a secure environment. It is not
recommended for sites which require a high level of security.


File: cfengine-Reference.info,  Node: cfrun,  Next: Firewalls and NATs,  Prev: admit grant and deny,  Up: Cfservd.conf and cfrun reference

`cfrun'
=======

   The general syntactic form of the `cfrun' command is


       cfrun -OPTION --LONGOPTION CLASS1 CLASS2 ...

Since `cfrun' addresses remote hosts, there is an ambiguity in whether
options are intended for the `cfrun' command itself, on the local host,
or whether they are to be passed on to the agent on the remote hosts.
To clarify this distinction, the arguments are organized as follows:


       cfrun -LOCAL OPTIONS -- REMOTE OPTIONS -- REMOTE CLASSES

Local options are processed by `cfrun' on the local host; remote options
are passed on as options to the remote `cfagent' (actually to the
command defined in `cfrunCommand' in the file `cfservd.conf'; remote
classes are processed by the remote `cfservd' service, and specifiy
classes which must be satisfied by the remote host in order to invoke
the remote command.

   The `-q' and `-I' options are always assumed when executing cfengine
remotely, so that `SplayTime' is effectively zero when polling hosts
serially, and the output always shows what is happening on the remote
hosts.

   On connecting to a remote host, cfengine attempts to obtain
credentials by exchanging keys. Unknown keys, in a key exchange, need
to be explicitly accepted on trust. Normally, the interactive `cfrun'
program prompts the user explicitly, (like in the secure shell, `ssh',
connections).  This can be annoying if there are many hosts to connect
to.  The `-T' option tells cfengine to trust all new keys. This option
should be used with caution, and only at times when one is sure that the
hosts one is connecting to are trustworthy.

   Each host evaluates the classes sent by `cfrun' and decides whether
cfengine should be invoked.  Only hosts which belong to the classes
defined on the `cfrun' command line are executed. This allows you to
single out groups of hosts which should execute cfengine, based on the
very classes which you have defined for your configuration.  If no
classes are sent on the command line, then all hosts are run.

   `cfrun' uses a configuration file which is located under the
`CFINPUTS' directory in order to determine which hosts and in which
order it should try to connect. Because cfengine always uses a reliable
TCP protocol for connections, it verifies each connection rather than
simply broadcasting openly. Using this file you can even simulate
broadcasting to hosts outside your subnet.

   This file should contain every host name you ever want to configure
remotely, because you can still select subsets of the file by
specifying classes which the remote host will understand.  If the
remote host is not in one of the classes you specify when you run
`cfrun', then it will simply ignore the request. Conversely, if you do
not place a host in this file, it will never be contacted when you use
the `cfrun' command. The format of the file is as follows


      #
      # Comment ..
      #
      domain=MY.DOMAIN
      access=USER1,USER2
      outputdir=DIRECTORY
      maxchild=NUMBER LIMIT
      hostnamekeys=TRUE/FALSE
     
      HOSTNAME1            OPTIONS
      HOSTNAME2:PORT OPTIONS
      ...
      include=cfrun.site1.external.hosts
      include=cfrun.site1.internal.hosts
      include=cfrun.site2.private.hosts
      include=cfrun.site2.shared.hosts

If the option `outputdir' is present, cfrun forks a separate process
for each host and passes the output to files in a named directory.  The
`maxchild' line limits the number of forked processes.

   It is important to add the domain-name to this file.  The options
you specifiy in this file, per host, are added to those you might
specify on the command line when invoking cfengine remotely.  For
instance, you might know of a bug on one host and decide not to perform
interface configuration on that one machine. You would write a line
like this:


       funny.domain -- -i  # problem host

   You could use `cfrun' inside one of your cfengine configuration
files in order to remotely execute cfengine on all of the other network
machines, by setting up a host list. The disadvantage however is that
cfengine has to poll the systems on the network, which means that
cfengine cannot be working in parallel on all hosts.

   Some other examples:


     e.g.  cfrun -- -- linux          Run on all linux machines
           cfrun -- -p                Ping and parse on all hosts
           cfrun -v -- -p             Ping all, local verbose
           cfrun -v -- -k -- solaris  Local verbose, all solaris, but no copy

   Amongst the local options, one may specify a subset of the hosts
which are to be contacted by cfrun, i.e. to avoid processing the entire
list of hosts. For example, to contact only host1 and host2, given that
they are already in the list of hosts.


     cfrun -v host1 host2
     cfrun -v host1 host2 -- -p


File: cfengine-Reference.info,  Node: Firewalls and NATs,  Prev: cfrun,  Up: Cfservd.conf and cfrun reference

Firewalls and NATs
==================

   Firewalls and Network Address Translators (NAT) can be a problem for
addressing.  Suppose you have a firewall and with a private IP-range
behind the firewall.  You want to update the nodes from a central host.
You can do a two stage configuration: first update the firewall and
then update from the firewall to the nodes.

   But suppose you already use SNAT (Source Network Address
Translation) and DNAT (Destination ...) for the nodes. With DNAT you
can say that socket 22000 on the firewall is routed to HOST-NAME:5308.
DNAT gives us the possibilty to update the nodes from a central server
in one step instead of two.

   If the port command is given cfrun uses this to connect to the client
instead of the default (5308) one.  Here is an example (`cfrun.hosts'):

     domain=example.org
     access=mark,sigmund
     hostnamekeys=true
     
     node1.example.org
     node2.example.org:22000 -DNis
     node2.example.org:22001

   This connects to: 1) node1 with standard port, 2) node2 with port
22000 and extra options -DNis and, 3) node2 with port 22000.


File: cfengine-Reference.info,  Node: Cfexecd reference,  Next: Problem solving,  Prev: Cfservd.conf and cfrun reference,  Up: Top

Cfexecd reference
*****************

   In wrapper mode (non-forking, non-daemon mode), cfagent is run by
adding a line to the root crontab file of each system:

     0,30 * * * * /usr/local/sbin/cfexecd -F

   This is enough to ensure that cfengine will get run. Any output
generated by this job, will be stored in `/var/cfengine/outputs'.

   The program `cfexecd' operates as a wrapper for cfagent.  It has the
following options:

     -h (--help)
     -d (--debug)
     -v (--verbose)
     -f (--file)
     -q (--no-splay)
     -F (--no-fork)
     -1 (--once)
     -g (--foreground)
     -p (--parse-only)
     -L (--ld-library-path)

   In addition, if you add the following to the file `cfagent.conf',
the system administrator will be emailed a summary of any output:


     control:
     
     smtpserver    = ( mailhub.example.org ) # site MTA which can talk smtp
     sysadm        = ( mark@example.org )   # mail address of sysadm
     EmailMaxLines = ( N )             # max lines of output to email
     OutputPrefix  = ( "!" )                 # Line prefix

Fill in suitable values for these variables. `EmailMaxLines' may be set
to 0 to disable email output, a postive integer to set a limit, or
`inf' to email the whole output regardless of its size. If undefined,
`EmailMaxLines' defaults to 100.

   An alternative, or additional way to run cfengine, is to run the
`cfexecd' program is daemon mode (without the `-F') option. In this
mode, the daemon lives in the background and sleeps, activating only in
accordance with a scheduling policy. The default policy is to run once
every hour (equivalent to `Min00_05'). Here is how you would modify
`cfagent.conf' in order to make the daemon execute cfagent every
half-hour:

       control:
     
        # When should cfexecd in daemon mode wake up the agent?
     
        schedule   = ( Min00_05 Min30_35 )
   Note that the time specifications are the basic cfengine _time
classes_.  Although one of these methods should suffice, no harm will
arise from running both cron and the cfexecd side-by-side.  Locking
mechanisms are used by `cfagent' to ensure that no contention will
occur.

   Note, that if problems with library path for compiled-in libraries
occur, an explicit library path can be specified with the `-L' option.

     0,30 * * * * /usr/local/sbin/cfexecd -F -L /local/iu/lib:/local/lib:/local/gnu/lib


File: cfengine-Reference.info,  Node: Problem solving,  Next: Example configuration file,  Prev: Cfexecd reference,  Up: Top

Problem solving
***************

* Menu:

* cf.preconf bootstrap file::
* cfrc resource file::


File: cfengine-Reference.info,  Node: cf.preconf bootstrap file,  Next: cfrc resource file,  Prev: Problem solving,  Up: Problem solving

`cf.preconf' bootstrap file
===========================

   In some cases you will want to run cfengine on a system to configure
it from scratch.  If the system is in a very bad way, it might not even
be able to parse the cfengine configuration file, perhaps because the
network was not properly configured or the DNS (Domain Name Service) was
out of action.  To help prevent this situation, cfengine looks for a
script called `cf.preconf' which gets executed prior to parsing and can
be used to perform any emergency tests.  This file needs only contain
enough to get the system to parse the configuration files.

   `cf.preconf' may be any script in any language.  It need not exist
at all! It is fed one argument by cfengine, namely the system hard-class
for the current system (e.g.  `ultrix').  Here is an example:

     #!/bin/sh
     #
     # cf.preconf is an emergency/bootstrap file to get things going
     # in case cfengine is unable to parse its config file
     #
     
     backupdir=/iu/nexus/local/iu/etc
     
      #
      # If these files don't exist, you might not be able to parse cfagent.conf
      #
     
     if [ ! -s /etc/resolv.conf ]; then
     
      echo Patching basics resolv.conf file
      cat > /etc/resolv.conf << XX
     domain iu.hioslo.no
     nameserver 128.39.89.10
     XX
     
     fi
     
     #
     # SVR4
     #
     
     if [ "$1" = "solaris" ]; then
     
       if [ ! -s "/etc/passwd" ]; then
     
       echo Patching missing passwd file
         /bin/cp $backupdir/passwd /etc/passwd
       fi
     
       if [ ! -s "/etc/shadow" ]; then
     
        echo Patching missing passwd file
        /bin/cp $backupdir/shadow /etc/shadow
       fi
     fi
     
     #
     # BSD 4.3
     #
     
     if [ "$1" = "linux" ]; then
     
        if [ ! -s "/etc/passwd"  ]
        then
     
         echo Patching missing passwd file
         /bin/cp $backupdir/passwd.linux /etc/passwd
        fi
     fi

   Note - in some circumstances, it might be appropriate to exit
cfengine altogether after this script. If the script outputs a string
containing the text "cfengine-preconf-abort", then cfagent will abort
execution immediately after this.


File: cfengine-Reference.info,  Node: cfrc resource file,  Prev: cf.preconf bootstrap file,  Up: Problem solving

`cfrc' resource file
====================

   If, for some reason you are not satisfied with the defaults which
cfengine uses, then you can change them by making an entry in the
resource file.  The default values are defined in the source code file
`classes.c' in the distribution.  The format of the resource file is:

     hardclass.variable: value

For example, you might want to forget about where your HPUX system
mounts its mail directory and mount it under `/usr/spool/mail'.  In
this case you would add the line:

     hpux.maildir: /usr/spool/mail

To redefine the filesystem table for GNU/linux, you would write:

     linux.fstab: /etc/linuxfstab

The full list of re-definable resources is:

        mountcomm       # command used to mount filesystems
        unmountcomm     # command used to unmount filesystems
        ethernet        # name of the ethernet device
        mountopts       # options to above mount command
        fstab           # the name of the filesystemtable
        maildir         # the location of the mail directory
        netstat         # the full path to netstat and options
        pscomm          # the path to the system's ps command
        psopts          # the options used by ps (default aux/ef)

   You should never need to redefine resources unless you decide to do
something non-standard.  Interested readers are referred to the values
in `classes.c'.

   Cfengine is easily extensible so as to support a variety of
architectures.  You can even add your own.  To do so you need, first of
all, to define a new class for the operating system concerned.  The file
_classes.c_ has been separated off from the remainder of the source
code so that you can easily see which data structures need to be
extended.

   To make life as straightforward as possible, three unused classes
have been defined.  They are called (unremarkably) _unused1_, _unused2_
and _unused3_.  If you add any further classes, it will be necessary to
increase the constant _clssattr_ defined in _cf.defs.h_ by one for
every new addition.  You do not need to change _clssattr_ if you simple
replace one of the unused classes by a real class.

   To see fully the impact of what you need to do, you should make a
search for the strings _unused?_ in all of the source files.  Certain
special cases need to be handled for each operating system.  For
example, the form of the filesystem table is quite radically different
on some systems such as AIX.  One thing you must do is to fill in the
default values for the new operating system in the file _classes.c_.

   If you fill in the details for a new operating system before it finds
its way into a new release, you might consider sending the details to
the bug list in the next paragraph.


File: cfengine-Reference.info,  Node: Example configuration file,  Next: Variable Index,  Prev: Problem solving,  Up: Top

Example configuration files
***************************

   Here is a sample from a large configuration file, just to give you
some ideas. The file is broken up into manageable pieces for
convenience.

* Menu:

* cfagent.conf::
* cf.groups::
* cf.main::
* cf.site::
* cf.motd::
* cf.users::
* cf.solaris::
* cf.linux::
* cf.freebsd::
* cfservd.conf::


File: cfengine-Reference.info,  Node: cfagent.conf,  Next: cf.groups,  Prev: Example configuration file,  Up: Example configuration file

cfagent.conf
============

     #####################################################################
     #
     #  CFENGINE CONFIGURATION FOR site = iu.hioslo.no
     #
     #  This file is for root only.
     #
     ######################################################################
     
     ###
     #
     # BEGIN cfagent.conf
     #
     ###
     
     import:
     
        #
        # Split things up to keep things tidy
        #
     
        any::
                         cf.groups
                         cf.main
                         cf.site
                         cf.motd
     
        hpux::           cf.hpux
        linux::          cf.linux
        solaris::        cf.solaris
        sun4::           cf.sun4
        ultrix::         cf.ultrix
        freebsd::        cf.freebsd
     
        #
        # Do you want to do this ?
        #
     
        AllHomeServers:: cf.users
     
     
     ###
     #
     # END cfengine.conf
     #
     ###


File: cfengine-Reference.info,  Node: cf.groups,  Next: cf.main,  Prev: cfagent.conf,  Up: Example configuration file

cf.groups
=========

     ##############################################################
     #
     # cf.groups - for iu.hioslo.no
     #
     # This file contains  all group/class definitions
     #
     #################################################################
     
     ###
     #
     # BEGIN cf.groups
     #
     ###
     
     groups:
     
        #
        # Define some groups
        #
     
        iu = ( nexus ferengi regula borg dax lore axis worf daystrom voyager
               aud1 aud2 aud3 aud4 bajor ds9 takpah takpeh nostromo galron
               thistledown rama chaos pc-steinarj pc-hildeh way jart kosh )
     
        diskless   = ( regula ferengi lore )
     
        standalone = ( nexus axis dax borg worf daystrom voyager
                       aud1 aud2 aud3 aud4 bajor ds9 takpah takpeh
                       nostromo galron thistledown rama pc-torejo
                       pc-steinarj pc-hildeh )
     
        AllHomeServers   = ( nexus )
        AllBinaryServers = ( nexus borg )
     
        XBootServer  = ( nexus )
        WWWServers   = ( nexus )
        FTPserver    = ( nexus )
        NameServers  = ( nexus )
        PasswdServer = ( nexus )
        BackupHost   = ( nexus )
     
        MailHub      = ( nexus )
        MailClients  = ( iu -nexus )
     
     ###
     #
     # END cf.groups
     #
     ###


File: cfengine-Reference.info,  Node: cf.main,  Next: cf.site,  Prev: cf.groups,  Up: Example configuration file

cf.main
=======

     ##############################################################
     #
     # cf.main - for iu.hioslo.no
     #
     # This file contains generic config stuff
     #
     #################################################################
     
     ###
     #
     # BEGIN cf.main
     #
     ###
     
     control:
     
        access    = ( root )        # Only root should run this
     
        site      = ( iu )
        domain    = ( iu.hioslo.no )
        sysadm    = ( drift@iu.hioslo.no )
     
        repository = ( /var/spool/cfengine )
     
        netmask   = ( 255.255.255.0 )
        timezone  = ( MET )
        nfstype   = ( nfs )
     
        sensiblesize  = ( 1000 )
        sensiblecount = ( 2 )
        editfilesize  = ( 20000 )
     
        mountpattern = ( /$(site)/$(host) )
        homepattern  = ( u? )
     
        #
        # If we undefine this with cfengine -N longjob
        # then we switch off all jobs labelled with this class
        #
     
        addclasses = ( longjob )
     
        #
        # Macros & constants are inherited downwards in imports
        # but are not passed up to parent files. Good idea to
        # define them all here
        #
     
        masterfiles = ( /iu/nexus/local/iu )
        main_server = ( nexus )
        cfbin       = ( /iu/nexus/local/gnu/lib/cfengine/bin )
        gnu         = ( /local/gnu )
        ftp         = ( /local/iu/ftp )
        nisslave    = ( dax )
        nisfiles    = ( /iu/nexus/local/iu/etc )
     
        #
        # The action sequence for daily (full) runs and
        # for hourly updates (called with -DHourly)
        #
     
        Hr00::
     
           actionsequence =
              (
              copy
              mountall
              mountinfo
              checktimezone
              netconfig
              resolve
              unmount
              shellcommands
              addmounts
              links.Prepare
              files.Prepare
              directories
              links.Rest
              mailcheck
              mountall
              required
              tidy
              disable
              editfiles
              files.Rest
              processes
              )
     
        !Hr00::
     
           actionsequence =
              (
              resolve
              shellcommands
              copy
              editfiles
              processes
     	 links
              )
     
        force::
     
           actionsequence =
              (
              files.Prepare.Rest
              tidy
              )
     
     ######################################################################
     
     homeservers:
     
        iu:: nexus
     
     binservers:
     
        iu.solaris::                 nexus
        iu.linux::                   borg
     
     mailserver:
     
        any:: nexus:/var/mail
     
     mountables:
     
        any::
              nexus:/iu/nexus/u1
              nexus:/iu/nexus/u2
              nexus:/iu/nexus/u3
              nexus:/iu/nexus/u4
              nexus:/iu/nexus/u5
              nexus:/iu/nexus/u6
              nexus:/iu/nexus/ua
              nexus:/iu/nexus/ud
              nexus:/iu/nexus/local
              nexus:/opt/NeWSprint
              nexus:/opt/AcroRead
              borg:/iu/borg/local
              dax:/iu/dax/local
     
     miscmounts:
     
        linux||freebsd::   nexus:/iu/nexus/local /iu/nexus/local ro
     
     ######################################################################
     
     broadcast:
     
       ones
     
     defaultroute:
     
        cadeler30-gw
     
     ######################################################################
     
     resolve:
     
           128.39.89.10  # nexus
           158.36.85.10  # samson.hioslo.no
           129.241.1.99
     
     ######################################################################
     
     tidy:
     
        #
        # Some global tidy-ups
        #
     
           /tmp/                    pat=*             r=inf     A=1
           /var/tmp                 pat=*             r=inf     A=1
           /                        pat=core          r=1       A=0
           /etc                     pat=core          r=1       A=0
     
     ######################################################################
     
     ignore:                       # Don't check or tidy these directories
     
           /local/lib/gnu/emacs/lock/
           /local/tmp
           ftp
           projects
           /local/bin/top
           /local/lib/tex/fonts
           /local/iu/etc
           /local/etc
           /local/iu/httpd/conf
           /usr/tmp/locktelelogic
           /usr/tmp/lockIDE
           RootMailLog
     
           #
           # Emacs lock files etc
           #
     
           !*
           /local/lib/xemacs
     
           #
           # X11 keeps X server data in /tmp/.X11
           # better not delete this!
           #
     
           .X11
     
           #
           # Some users like to give a file or two 777 protection here
           # so netsurfers can update a log or counter when running as
           # `nobody'
           #
     
           www
     
     #####################################################################
     
     disable:
     
        /etc/hosts.equiv
        /etc/nologin
        /usr/lib/sendmail.fc
     
     
     ###
     #
     # END cf.main
     #
     ###


File: cfengine-Reference.info,  Node: cf.site,  Next: cf.motd,  Prev: cf.main,  Up: Example configuration file

cf.site
=======

     ##############################################################
     #
     # cf.site - for iu.hioslo.no
     #
     # This file contains site specific data
     #
     #################################################################
     
     ###
     #
     # BEGIN cf.site
     #
     ###
     
     links:
     
        Prepare::
     
           /local     -> /$(site)/$(binserver)/local
           /usr/local -> /local
     
        dax::
     
           /iu/dax/local             +> /iu/nexus/local
           /projects                 -> /iu/dax/local/projects
           /iu/nexus/u1/sowille/data -> /iu/dax/scratch/data
     
        XBootServer::
     
           #
           # Set up a /local/tftpboot area where all X terminal
           # stuff will be kept.
           #
     
           /tftpboot                  -> /local/tftpboot
           /local/tftpboot/td/configs -> /local/tftpboot/td/examples/configs
           /etc/bootptab              -> /tftpboot/bootptab
           /tftpboot/usr/lib/X11/td   -> /tftpboot/td
     
        NameServers::
     
           /etc/named.boot -> /local/iu/named/named.boot
     
        MailHub::
     
           /etc/mail/sendmail.cf ->! /iu/nexus/local/mail/sendmail.cf
     
        MailClients.solaris::
     
           /etc/mail/sendmail.cf ->! /iu/nexus/local/mail/client.cf
     
        nexus::
     
     	/local/bin +> /local/latex/bin
     
     #############################################################
     
     disable:
     
       #
       # We run Berkeley sendmail and the config files are
       # all under /iu/nexus/local/lib/mail
       #
     
         /etc/aliases
     
      WWWServers.Sunday::
     
        #
        # Disabling these log files weekly prevents them from
        # growing so enormous that they fill the disk!
        #
     
        /local/iu/httpd/logs/access_log   rotate=empty
        /local/iu/httpd/logs/agent_log    rotate=empty
        /local/iu/httpd/logs/error_log    rotate=empty
        /local/iu/httpd/logs/referer_log  rotate=empty
     
        #
        # CERT warning, security fix
        #
     
       any::
     
         /usr/lib/expreserve
     
       FTPserver.Sunday.Hr00::
     
        /local/iu/xferlog rotate=3
     
     #################################################################
     
     files:
     
       Prepare::
     
           /etc/motd              m=0644 r=0 o=root act=touch
           /.cshrc                m=0644 r=0 o=root act=touch
     
        PasswdServer::
     
           /local/iu/etc/passwd m=0644 o=root g=other action=fixplain
           /local/iu/etc/shadow m=0644 o=root g=other action=fixplain
     
        WWWServers.Rest::
     
           /local/iu/www                           m=775        g=www act=fixall r=inf
           /local/iu/httpd/conf                    m=664 o=root g=www act=fixall r=inf
           /local/iu/www/cgi-bin-public/count_file m=777 o=root g=www act=fixplain
     
        FTPserver::
     
           #
           # Make sure anonymous ftp areas have the correct
           # protection, or logins won't be able to read
           # files - or perhaps a security risk. This is
           # Solaris 2 specific...
           #
     
           $(ftp)/pub        mode=755 o=ftp  g=ftp  r=inf act=fixall
           $(ftp)/Obin       mode=111 o=root g=other      act=fixall
           $(ftp)/etc        mode=111 o=root g=other      act=fixdirs
           $(ftp)/usr/bin/ls mode=111 o=root g=other      act=fixall
           $(ftp)/dev        mode=555 o=root g=other      act=fixall
           $(ftp)/usr        mode=555 o=root g=other      act=fixdirs
     
        Prepare::
     
           /etc/shells mode=0644 action=touch
     
        AllBinaryServers.Rest.longjob::
     
          /local mode=-0002 r=inf owner=root,bin group=0,1,2,3,4,5,6,7,staff
                 links=tidy action=fixall
     
          /local/iu/RootMailLog  m=0666 action=touch
     
        dax.Rest::
     
         /iu/dax/scratch        r=0 o=root mode=1777 action=fixall
         /iu/dax/local/projects r=0 o=root mode=755  action=fixdirs
     
        nexus::
     
         /local/mail/sendmail.cf o=root m=444 act=fixplain
     
         /iu/nexus/ua/robot/.rhosts o=robot m=600 act=touch
     
         /local/iu/named/pz         o=root  m=644 act=fixall r=1
     
         /local/latex/lib/tex/texmf/fonts  owner=root
                                           mode=1666
                                           recurse=inf
                                           action=fixall
     
     #################################################################
     
     tidy:
     
           #
           # Make sure the file repository doesn't fill up
           #
     
           /var/spool/cfengine pattern=*    age=3
     
           /var                pattern=core age=0  r=inf
           /var/spool/mqueue   pattern=*    age=14 type=mtime
     
        BackupHost::
     
           # Here we tidy old backup tar files from the backup area
           # A special tmp area gets cleared every 4 days. The files
           # are created by Audun's backup help script (see shellcommands)
     
           /iu/nexus/backup1      pat=*  age=7
     
     #################################################################
     
     shellcommands:
     
        PasswdServer::
     
           # Build and install the BSD compatible passwd file
           # from the master passwd/shadow file on Solaris
     
           "/local/iu/bin/BuildPasswdFiles"
           "/local/iu/bin/BuildGroupFiles"
     
       BackupHost.Sunday.Hr00|BackupHost.Wednesday.Hr00::
     
           #
           # Make a system backup of /iu/nexus/u? with Audun's script
           #
     
           "$(cfbin)/cfbackup -p -f /iu/nexus/backup1 -s /iu/nexus/ud"
           "$(cfbin)/cfbackup -p -f /iu/nexus/backup1 -s /iu/nexus/ua"
           "$(cfbin)/cfbackup -p -f /iu/nexus/backup1 -s /iu/nexus/u1"
           "$(cfbin)/cfbackup -p -f /iu/nexus/backup1 -s /iu/nexus/u2"
           "$(cfbin)/cfbackup -p -f /iu/nexus/backup2 -s /iu/nexus/u3"
           "$(cfbin)/cfbackup -p -f /iu/nexus/backup2 -s /iu/nexus/u4"
           "$(cfbin)/cfbackup -p -f /iu/nexus/backup2 -s /iu/nexus/u5"
           "$(cfbin)/cfbackup -p -f /iu/nexus/backup2 -s /iu/nexus/u6"
     
       nexus.Sunday.longjob.Hr00::
     
           #
           # See how much rubbish users have accumulated each Sunday
           #
     
           "$(cfbin)/noseyparker /iu/nexus/u1 $(sysadm) "
           "$(cfbin)/noseyparker /iu/nexus/u2 $(sysadm) "
           "$(cfbin)/noseyparker /iu/nexus/u3 $(sysadm) "
           "$(cfbin)/noseyparker /iu/nexus/u4 $(sysadm) "
           "$(cfbin)/noseyparker /iu/nexus/u5 $(sysadm) "
           "$(cfbin)/noseyparker /iu/nexus/u6 $(sysadm) "
           "$(cfbin)/noseyparker /iu/nexus/ua $(sysadm) nomail"
           "$(cfbin)/noseyparker /iu/nexus/ud $(sysadm) nomail"
     
        nexus.longjob.Hr00::
     
           #
           # Update the GNU find/locate database each night
           #
     
           "$(gnu)/lib/locate/updatedb"
           "/local/iu/bin/newhomepage.sh"
     
     ###############################################################
     
     editfiles:
     
         #
         # cfengine installs itself as a cron job - sneaky! :)
         #
     
         { /var/spool/cron/crontabs/root
     
         AppendIfNoSuchLine "0 * * * * $(cfbin)/cfwrap $(cfbin)/cfhourly"
         }
     
        FTPserver::
     
           { /etc/shells
     
           AppendIfNoSuchLine "/bin/tcsh"
           AppendIfNoSuchLine "/local/gnu/bin/bash"
           }
     
     
        XBootServer::
     
           { /etc/inetd.conf
     
           AppendIfNoSuchLine
               "bootp dgram udp wait root /local/bin/bootpd bootpd -i -d"
           }
     
        nexus::
     
           { /iu/nexus/ua/robot/.rhosts
     
           AppendIfNoSuchLine "borg"
           AppendIfNoSuchLine "borg.iu.hioslo.no"
           AppendIfNoSuchLine "aud4"
           AppendIfNoSuchLine "aud4.iu.hioslo.no"
           }
     
        dax::
     
           { /etc/system
     
           AppendIfNoSuchLine "set pt_cnt=128"
           }
     
     
     ######################################################################
     
     required:
     
        #
        # Any host must have a /local, /usr/local fs. Check that
        # it exists and looks sensible. (i.e. not empty)
        #
     
        /$(site)/$(binserver)/local
     
     
     ######################################################################
     
     copy:
     
        #
        # NIS seems broken at IU, so here we use NFS to fudge
        # a file distribution as a temporary solution. Actually
        # this makes the system work faster without NIS!
        #
     
           $(nisfiles)/services dest=/etc/services o=root g=other mode=0644
           $(nisfiles)/hosts.deny dest=/etc/hosts.deny o=root mode=0644
     
        !debian::
     
           $(nisfiles)/hosts    dest=/etc/hosts o=root g=other mode=0644
     
        PasswdServer::
     
           /etc/passwd dest=$(nisfiles)/passwd o=root g=other mode=0644
           /etc/shadow dest=$(nisfiles)/shadow o=root g=other mode=0644
     
        nexus::
     
           /local/iu/etc/dfstab dest=/etc/dfs/dfstab  o=root  mode=0744
     
        solaris.!PasswdServer::
     
           $(nisfiles)/passwd dest=/etc/passwd o=root g=other mode=0644
           $(nisfiles)/shadow dest=/etc/shadow o=root g=other mode=0600
           $(nisfiles)/group.solaris dest=/etc/group o=root g=other mode=0644
     
        linux::
     
           $(nisfiles)/passwd.linux dest=/etc/passwd o=root g=other mode=0644
           $(nisfiles)/group.linux dest=/etc/group o=root g=other mode=0644
     
     ###############################################################
     
     processes:
     
           "eggdrop"                           signal=kill
           "irc"                               signal=kill
           "ping"                              signal=kill
           "NetXRay"                           signal=kill
           "netxray"                           signal=kill
           "ypserv"                            signal=kill
           "ypbind"                            signal=kill
           "rarpd"                             signal=kill
           "rpc.boot"                          signal=kill
           "README"                            signal=kill # You don't sh README !
     
        !XBootServer::
     
           "bootp"                             signal=kill
     
        #
        # These processes are not killed every hour, but once a day
        # when cfengine runs at night. Note that there are often
        # hanging pine and elm processes. These programs crash and
        # go berserk, using hundreds of hours of CPU time.
        #
     
        Hr00::
     
           "cron"                 signal=hup  # HUP these to update their config
           "inetd"                signal=hup
     
           "/local/sdt/sdt/bin"   signal=term # For those elektro dudes who forget
                                              # to log out
           "netscape"             signal=kill
           "pine"                 signal=kill
           "elm"                  signal=kill
     
     
     ###
     #
     # END cf.site
     #
     ###


File: cfengine-Reference.info,  Node: cf.motd,  Next: cf.users,  Prev: cf.site,  Up: Example configuration file

cf.motd
=======


     ##################################################################
     #
     # cf.motd
     #
     # This file is used to set the message of the day file on
     # each host
     #
     ##################################################################
     
      #####
      #
      # BEGIN cf.motd
      #
      #####
     
     
     control:
     
        #
        # This points to the file containing general text
        #
     
        masterfile      = ( /iu/nexus/local/iu/etc/motd-master )
        local_message   = ( /etc/motd.local )
     
     editfiles:
     
           { /etc/motd
     
           BeginGroupIfFileIsNewer "$(masterfile)"
             EmptyEntireFilePlease
             InsertFile "$(masterfile)"
             InsertFile "$(local_message)"
             PrependIfNoSuchLine "This system is running $(class):$(arch)"
           EndGroup
           }
     
      #####
      #
      # BEGIN cf.motd
      #
      #####


File: cfengine-Reference.info,  Node: cf.users,  Next: cf.solaris,  Prev: cf.motd,  Up: Example configuration file

cf.users
========

   Whether or not you perform any special services for users, with or
without their consent is entirely a matter of local policy. In a school
or college situation, users are often uncooperative and some are even
irresponsible.  This file shows you what you could do in an environment
with inexperienced users, but please don't feel as though you have to be
this totalitarian.

     #################################################################
     #
     # cf.users - for iu.hioslo.no
     #
     # This file contains user specific actions
     #
     #################################################################
     
     ###
     #
     # BEGIN cf.users
     #
     ###
     
     ignore:
     
         robot
     
     tidy:
     
        longjob::
     
          #
          # Some users just don't understand what they are doing
          # and this is safest, allbeit totalitarian
          #
     
          home                 pat=.rhosts                      age=0
     
          #
          # Tidy up users' home dirs
          #
     
          home                 pat=core             r=inf       age=0
          home                 pat=a.out            r=inf       age=1
          home                 p=*%                 r=inf       age=2
          home                 p=*~                 r=inf       age=2
          home                 p=#*                 r=inf       age=1
          home                 p=*.dvi              r=inf       age=14   type=ctime
          home                 p=*.log              r=inf       age=2
          home                 p=Log.*              r=inf       age=3
          home                 p=CKP                r=inf       age=1
          home                 p=BAK                r=inf       age=1
          home                 p=log                r=inf       age=0
          home                 p=*.o                r=inf       age=0
          home                 p=*.aux              r=inf       age=3
          home                 p=*.zip              r=inf       age=7
          home/.deleted        p=*                  r=inf       age=0
          home/.wastebacket    p=*                  r=inf       age=14
          home/www             p=*~                 r=inf       age=1
     
          #
          # Clear the big cache files netscape creates
          #
     
          home/.netscape-cache  p=cache????*         r=inf       age=0
          home/.MCOM-cache      p=cache????*         r=inf       age=0
          home/.netscape/cache  p=*                  r=inf       age=0
     
     
     #################################################################
     
     files:
     
        AllHomeServers.longjob.rest::
     
          #
          # Check users files are not writable to the world
          # and there are no stale links (pointing nowhere)
          #
     
          home mode=o-w recurse=inf action=fixall # links=tidy
     
          home/.xsession mode=755 action=fixall
          home/.cshrc    mode=755 action=fixall
     
     #################################################################
     
     copy:
     
        Hr00.longjob::
     
        #
        # Make sure each user has an up to date standard
        # setup.  Cshrc just sources in a big standard file
        # which is kept in ~user/../.setupfiles/cshrc
        # to reduce disk wastage
        #
     
        $(masterfiles)/lib/Cshrc   dest=home/.cshrc
        $(masterfiles)/lib/tkgrc   dest=home/.tkgrc
        $(masterfiles)/lib/fvwm2rc dest=home/.fvwm2rc
     
     
     ###
     #
     # END cf.users
     #
     ###

