Applied Mathematics 8
授業資料/第12回
をテンプレートにして作成
開始行:
* FreeBSD のバージョンアップ [#mb67a367]
さて，FreeBSD 6.3R が 2008.01.18 にめでたくリリースされた.
そこで，これまで培った知識，ノウハウ((知らないことを教え...
やりかたを全部書いてしまってはなんにも皆の為にならんので...
具体的には，http://www.jp.freebsd.org/www.FreeBSD.org/rel...
なお，一次資料を読み込む訓練も兼ねて，バージョンアップに...
** 注意ポイント [#ud19a177]
ただし，注意すべきポイントは書いておこう.
OS のバージョンアップとなると，当然，システム中のソフトウ...
これらは具体的には，例えば次のようなものがある. 他にも考...
+ 設定ファイルの固まりである /etc ディレクトリは念の為 ま...
具体的には，バージョンアップ作業前に
cd /
cd -Rp /etc /etc.old-20080201
などとすればよい.
&br;
+ /etc/resolv.conf は，自前の BIND ではなくて，できれば外...
要するにこの場合はバージョンアップ作業前に
nameserver 192.168.125.14
にいったん戻しておく，ということだな.
&br;
+ システムに関わる作業は常に作業ログを取る癖をつけよう. p...
&br;
+ ある方法でアップグレードする場合，途中でファイルの「正...
&br;
+その他，例えば，カーネルファイルがおかしくなると起動しな...
** 実際の作業ログ [#sda66f66]
以下に，サンプルとして作業ログを示しておこう.
ただし，このまま真似するだけになってしまってはなんにもな...
> fetch http:people.freebsd.org/~cperciva/freebsd-updat...
> fetch http:people.freebsd.org/~cperciva/freebsd-updat...
> gpg --verify freebsd-update-upgrade.tgz.asc freebsd-u...
gpg: 金 11/16 23:01:38 2007 JSTにDSA鍵ID CA6CDFB2で施さ...
gpg: 署名を検査できません: No public key
> gpg --keyserver pgp.nic.ad.jp --recv-key CA6CDFB2
gpg: 鍵輪「/root/.gnupg/secring.gpg」ができました
gpg: 鍵CA6CDFB2をhkpからサーバーpgp.nic.ad.jpに要求
gpg: 鍵CA6CDFB2: 重複したユーザーIDの検出 - 併合
gpg: /root/.gnupg/trustdb.gpg: 信用データベースができま...
gpg: 鍵CA6CDFB2: 公開鍵“FreeBSD Security Officer <secur...
gpg: 絶対的に信用する鍵が見つかりません
gpg: 処理数の合計: 1
gpg: 読込み: 1
> gpg --verify freebsd-update-upgrade.tgz.asc freebsd-u...
gpg: 金 11/16 23:01:38 2007 JSTにDSA鍵ID CA6CDFB2で施さ...
gpg: “FreeBSD Security Officer <security-officer@FreeBS...
gpg: 警告: この鍵は信用できる署名で証明されていません!
gpg: この署名が所有者のものかどうかの検証手段があ...
主鍵の指紋: C374 0FC5 69A6 FBB1 4AED B131 15D6 8804 CA...
> tar xfv freebsd-update-upgrade.tgz
x freebsd-update.sh
x freebsd-update.conf
> sh ./freebsd-update.sh -f freebsd-update.conf -r 6.3-...
Looking up update.FreeBSD.org mirrors... 1 mirrors found.
Fetching metadata signature for 6.2-RELEASE from update...
Fetching metadata index... done.
Fetching 1 metadata files... done.
Inspecting system... done.
The following components of FreeBSD seem to be installed:
kernel/generic src/base src/sys world/base world/dict w...
world/games world/info world/manpages world/proflibs
The following components of FreeBSD do not seem to be i...
kernel/smp src/bin src/contrib src/crypto src/etc src/g...
src/include src/krb5 src/lib src/libexec src/release sr...
src/secure src/share src/tools src/ubin src/usbin world...
Does this look reasonable (y/n)? y
Fetching metadata signature for 6.3-RELEASE from update...
Fetching metadata index... done.
Fetching 1 metadata patches. done.
Applying metadata patches... done.
Fetching 1 metadata files... done.
Inspecting system... done.
Fetching files from 6.2-RELEASE for merging... done.
Preparing to download files...7322 patches.....10....20...
Applying patches... done.
Fetching 1260 files... done.
Attempting to automatically merge changes in files... d...
The following file could not be merged automatically: /...
Press Enter to edit this file in emacs and resolve the ...
manually...
(適切に編集. 自分で書き足したり直したりした部分が有効で...
The following changes, which occurred between FreeBSD 6...
FreeBSD 6.3-RELEASE have been merged into /etc/hosts.al...
--- current version
+++ new version
@@ -1,8 +1,8 @@
#
# hosts.allow access control file for "tcp wrapped" ap...
-# $FreeBSD: src/etc/hosts.allow,v 1.19.8.1 2006/02/19 ...
+# $FreeBSD: src/etc/hosts.allow,v 1.19.8.2 2007/01/20 ...
#
# NOTE: The hosts.deny file is deprecated.
# Place both 'allow' and 'deny' rules in the hos...
# See hosts_options(5) for the format of this file.
# hosts_access(5) no longer fully applies.
@@ -67,10 +67,11 @@
rpcbind : 192.0.2.32/255.255.255.224 : allow
rpcbind : 192.0.2.96/255.255.255.224 : allow
rpcbind : ALL : deny
# NIS master server. Only local nets should have access
+# (Since this is an RPC service, rpcbind needs to be c...
ypserv : localhost : allow
ypserv : .unsafe.my.net.example.com : deny
ypserv : .my.net.example.com : allow
ypserv : ALL : deny
Does this look reasonable (y/n)? y
The following changes, which occurred between FreeBSD 6...
FreeBSD 6.3-RELEASE have been merged into /var/named/et...
--- current version
+++ new version
@@ -1,16 +1,17 @@
- $FreeBSD: src/etc/namedb/named.conf,v 1.21.2.1 2005/0...
+ $FreeBSD: src/etc/namedb/named.conf,v 1.21.2.6.2.1 20...
Refer to the named.conf(5) and named(8) man pages, an...
in /usr/share/doc/bind9 for more details.
If you are going to set up an authoritative server, m...
understand the hairy details of how DNS works. Even ...
simple mistakes, you can break connectivity for affec...
or cause huge amounts of useless Internet traffic.
options {
+ Relative to the chroot directory, if any
directory "/etc/namedb";
pid-file "/var/run/named/pid";
dump-file "/var/dump/named_dump.db";
statistics-file "/var/stats/named.stats";
@@ -25,15 +26,23 @@
If you have IPv6 enabled on this system, uncomment th...
use as a local resolver. To give access to the netwo...
an IPv6 address, or the keyword "any".
listen-on-v6 { ::1; };
+/* These options are available for BIND 9.4.x
+ These zones are already covered by the empty zones li...
+ If you remove the related empty zones below, comment ...
+ disable-empty-zone "255.255.255.255.IN-ADDR.ARP...
+ disable-empty-zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0...
+ disable-empty-zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0...
+*/
+
In addition to the "forwarders" clause, you can force...
server to never initiate queries of its own, but alwa...
forwarders only, by enabling the following line:
- forward only;
+ forward only;
If you've got a DNS server around at your upstream pr...
its IP address here, and enable the line below. This...
benefit from its cache, thus reduce overall DNS traff...
/*
@@ -53,26 +62,178 @@
If you enable a local name server, don't forget to en...
first in your /etc/resolv.conf so this server will be...
Also, make sure to enable it in /etc/rc.conf.
+ The traditional root hints mechanism. Use this, OR th...
+zone "." { type hint; file "named.root"; };
+
+/* Slaving the following zones from the root name ...
+ significant advantages:
+ 1. Faster local resolution for your users
+ 2. No spurious traffic will be sent from your n...
+ 3. Greater resilience to any potential root ser...
+
+ On the other hand, this method requires more mo...
+ hints file to be sure that an unexpected failur...
+ incapacitated your server. Name servers that a...
+ of clients will benefit more from this approach...
+ hosts. Use with caution.
+
+ To use this mechanism, uncomment the entries be...
+ the hint zone above.
+*/
+/*
zone "." {
- type hint;
- file "named.root";
+ type slave;
+ file "slave/root.slave";
+ masters {
+ 192.5.5.241; F.ROOT-SERVERS.NET.
+ };
+ notify no;
};
-
-zone "0.0.127.IN-ADDR.ARPA" {
- type master;
- file "master/localhost.rev";
+zone "arpa" {
+ type slave;
+ file "slave/arpa.slave";
+ masters {
+ 192.5.5.241; F.ROOT-SERVERS.NET.
+ };
+ notify no;
};
-
- RFC 3152
-zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0....
- type master;
- file "master/localhost-v6.rev";
+zone "in-addr.arpa" {
+ type slave;
+ file "slave/in-addr.arpa.slave";
+ masters {
+ 192.5.5.241; F.ROOT-SERVERS.NET.
+ };
+ notify no;
};
+
+=======
+*/
+
+/* Serving the following zones locally will preven...
+ for these zones leaving your network and going ...
+ name servers. This has two significant advanta...
+ 1. Faster local resolution for your users
+ 2. No spurious traffic will be sent from your n...
+*/
+ RFC 1912
+zone "localhost" { type master; file "master/loc...
+zone "127.in-addr.arpa" { type master; file "master/lo...
+zone "255.in-addr.arpa" { type master; file "ma...
+
+ RFC 1912-style zone for IPv6 localhost address
+zone "0.ip6.arpa" { type master; file "master/loc...
+
+ "This" Network (RFCs 1912 and 3330)
+zone "0.in-addr.arpa" { type master; file "ma...
+
+ Private Use Networks (RFC 1918)
+zone "10.in-addr.arpa" { type master; file "ma...
+zone "16.172.in-addr.arpa" { type master; file "ma...
+zone "17.172.in-addr.arpa" { type master; file "ma...
+zone "18.172.in-addr.arpa" { type master; file "ma...
+zone "19.172.in-addr.arpa" { type master; file "ma...
+zone "20.172.in-addr.arpa" { type master; file "ma...
+zone "21.172.in-addr.arpa" { type master; file "ma...
+zone "22.172.in-addr.arpa" { type master; file "ma...
+zone "23.172.in-addr.arpa" { type master; file "ma...
+zone "24.172.in-addr.arpa" { type master; file "ma...
+zone "25.172.in-addr.arpa" { type master; file "ma...
+zone "26.172.in-addr.arpa" { type master; file "ma...
+zone "27.172.in-addr.arpa" { type master; file "ma...
+zone "28.172.in-addr.arpa" { type master; file "ma...
+zone "29.172.in-addr.arpa" { type master; file "ma...
+zone "30.172.in-addr.arpa" { type master; file "ma...
+zone "31.172.in-addr.arpa" { type master; file "ma...
+zone "168.192.in-addr.arpa" { type master; file "ma...
+
+ Link-local/APIPA (RFCs 3330 and 3927)
+zone "254.169.in-addr.arpa" { type master; file "ma...
+
+ TEST-NET for Documentation (RFC 3330)
+zone "2.0.192.in-addr.arpa" { type master; file "ma...
+
+ Router Benchmark Testing (RFC 3330)
+zone "18.198.in-addr.arpa" { type master; file "ma...
+zone "19.198.in-addr.arpa" { type master; file "ma...
+
+ IANA Reserved - Old Class E Space
+zone "240.in-addr.arpa" { type master; ...
+zone "241.in-addr.arpa" { type master; ...
+zone "242.in-addr.arpa" { type master; ...
+zone "243.in-addr.arpa" { type master; ...
+zone "244.in-addr.arpa" { type master; ...
+zone "245.in-addr.arpa" { type master; ...
+zone "246.in-addr.arpa" { type master; ...
+zone "247.in-addr.arpa" { type master; ...
+zone "248.in-addr.arpa" { type master; ...
+zone "249.in-addr.arpa" { type master; ...
+zone "250.in-addr.arpa" { type master; ...
+zone "251.in-addr.arpa" { type master; ...
+zone "252.in-addr.arpa" { type master; ...
+zone "253.in-addr.arpa" { type master; ...
+zone "254.in-addr.arpa" { type master; ...
+
+ IPv6 Unassigned Addresses (RFC 4291)
+zone "1.ip6.arpa" { type master; file "ma...
+zone "3.ip6.arpa" { type master; file "ma...
+zone "4.ip6.arpa" { type master; file "ma...
+zone "5.ip6.arpa" { type master; file "ma...
+zone "6.ip6.arpa" { type master; file "ma...
+zone "7.ip6.arpa" { type master; file "ma...
+zone "8.ip6.arpa" { type master; file "ma...
+zone "9.ip6.arpa" { type master; file "ma...
+zone "a.ip6.arpa" { type master; file "ma...
+zone "b.ip6.arpa" { type master; file "ma...
+zone "c.ip6.arpa" { type master; file "ma...
+zone "d.ip6.arpa" { type master; file "ma...
+zone "e.ip6.arpa" { type master; file "ma...
+zone "0.f.ip6.arpa" { type master; file "ma...
+zone "1.f.ip6.arpa" { type master; file "ma...
+zone "2.f.ip6.arpa" { type master; file "ma...
+zone "3.f.ip6.arpa" { type master; file "ma...
+zone "4.f.ip6.arpa" { type master; file "ma...
+zone "5.f.ip6.arpa" { type master; file "ma...
+zone "6.f.ip6.arpa" { type master; file "ma...
+zone "7.f.ip6.arpa" { type master; file "ma...
+zone "8.f.ip6.arpa" { type master; file "ma...
+zone "9.f.ip6.arpa" { type master; file "ma...
+zone "a.f.ip6.arpa" { type master; file "ma...
+zone "b.f.ip6.arpa" { type master; file "ma...
+zone "0.e.f.ip6.arpa" { type master; file "ma...
+zone "1.e.f.ip6.arpa" { type master; file "ma...
+zone "2.e.f.ip6.arpa" { type master; file "ma...
+zone "3.e.f.ip6.arpa" { type master; file "ma...
+zone "4.e.f.ip6.arpa" { type master; file "ma...
+zone "5.e.f.ip6.arpa" { type master; file "ma...
+zone "6.e.f.ip6.arpa" { type master; file "ma...
+zone "7.e.f.ip6.arpa" { type master; file "ma...
+
+ IPv6 ULA (RFC 4193)
+zone "c.f.ip6.arpa" { type master; file "ma...
+zone "d.f.ip6.arpa" { type master; file "ma...
+
+ IPv6 Link Local (RFC 4291)
+zone "8.e.f.ip6.arpa" { type master; file "ma...
+zone "9.e.f.ip6.arpa" { type master; file "ma...
+zone "a.e.f.ip6.arpa" { type master; file "ma...
+zone "b.e.f.ip6.arpa" { type master; file "ma...
+
+ IPv6 Deprecated Site-Local Addresses (RFC 3879)
+zone "c.e.f.ip6.arpa" { type master; file "ma...
+zone "d.e.f.ip6.arpa" { type master; file "ma...
+zone "e.e.f.ip6.arpa" { type master; file "ma...
+zone "f.e.f.ip6.arpa" { type master; file "ma...
+
+ IP6.INT is Deprecated (RFC 4159)
+zone "ip6.int" { type master; file "ma...
+
+
+
zone "sub17.cl.math.sci.osaka-u.ac.jp" {
type master;
file "master/sub17.zone";
};
@@ -81,52 +242,38 @@
serve demonstration/documentation purposes!
Example slave zone config entries. It can be conveni...
a slave at least for the zone your own domain is in. ...
your network administrator for the IP address of the ...
- primary.
+ master name server.
- Never forget to include the reverse lookup (IN-ADDR.A...
- (This is named after the first bytes of the IP addres...
- order, with ".IN-ADDR.ARPA" appended.)
-
- Before starting to set up a primary zone, make sure y...
- understand how DNS and BIND works. There are sometimes
- non-obvious pitfalls. Setting up a slave zone is sim...
+ Do not forget to include the reverse lookup zone!
+ This is named after the first bytes of the IP address...
+ order, with ".IN-ADDR.ARPA" appended, or ".IP6.ARPA" ...
+
+ Before starting to set up a master zone, make sure yo...
+ understand how DNS and BIND work. There are sometimes
+ non-obvious pitfalls. Setting up a slave zone is usu...
NB: Don't blindly enable the examples below. :-) Use...
and addresses instead.
-/* An example master zone
-zone "example.net" {
- type master;
- file "master/example.net";
-};
-*/
-
/* An example dynamic zone
key "exampleorgkey" {
- algorithm hmac-md5;
- secret "sf87HJqjkqh8ac87a02lla==";
+ algorithm hmac-md5;
+ secret "sf87HJqjkqh8ac87a02lla==";
};
zone "example.org" {
type master;
allow-update {
key "exampleorgkey";
};
file "dynamic/example.org";
};
*/
-/* Examples of forward and reverse slave zones
-zone "example.com" {
- type slave;
- file "slave/example.com";
- masters {
- 192.168.1.1;
- };
-};
+/* Example of a slave reverse zone
zone "1.168.192.in-addr.arpa" {
type slave;
file "slave/1.168.192.in-addr.arpa";
masters {
192.168.1.1;
Does this look reasonable (y/n)? y
The following files will be removed as part of updating...
/boot/kernel/hptmv.ko
/usr/share/doc/de_DE.ISO8859-1/books/handbook/install-s...
...
The following files will be added as part of updating t...
/boot/kernel/acpi_dock.ko
/boot/kernel/coretemp.ko
...
The following files will be updated as part of updating...
/COPYRIGHT
/bin/[
...
> sh ./freebsd-update.sh -f freebsd-update.conf install
Installing updates...
Kernel updates have been installed. Please reboot and ...
"./freebsd-update.sh install" again to finish installin...
> shutdown -r now
FreeBSD 6.3-RELEASE (GENERIC) #0: Wed Jan 16 04:18:52 U...
(ちなみに，再起動後のログイン時には…)
(再起動後)
> sh ./freebsd-update.sh -f freebsd-update.conf install
Installing updates... done.
> shutdown -r now
* さらに余裕があれば… [#mff60e10]
port などもできるだけ新しくしておこう. 時おりこまめに作業...
> portaudit -Fad
auditfile.tbz 100% of ...
New database installed.
Database created: 2008年 1月27日 日曜日 08時10分01秒 JST
0 problem(s) in your installed packages found.
> portsnap fetch
Looking up portsnap.FreeBSD.org mirrors... 4 mirrors fo...
Fetching snapshot tag from portsnap2.FreeBSD.org... done.
Latest snapshot on server matches what we already have.
No updates needed.
> portupgrade -na -x 'emacs*'
---> Reading default options: -v -L /var/log/ports/%s:...
---> Session started at: Sun, 27 Jan 2008 08:16:08 +0900
…略…
---> Packages processed: 0 done, 639 ignored, 0 skippe...
---> Session ended at: Sun, 27 Jan 2008 08:18:57 +0900...
というような感じに, ほぼ最新の状況を保つことができる.
*** レポート [#f869e25c]
実際にバージョンアップを行い，
uname -v
とすると
FreeBSD 6.3-RELEASE #0: Wed Jan 16 04:18:52 UTC 2008 ...
という出力が得られるようにせよ.
また，その後，
dig @127.0.0.1 www.osaka-u.ac.jp
として，自前の BIND がきちんと動いていることを確認してか...
また，上のリリース資料web の ''Dedication'' という部分を...
また，その中に出てくる人物について調査し，その結果につい...
また，FreeBSD 6.3R はいつまでサポートされる予定かについて...
終了行:
* FreeBSD のバージョンアップ [#mb67a367]
さて，FreeBSD 6.3R が 2008.01.18 にめでたくリリースされた.
そこで，これまで培った知識，ノウハウ((知らないことを教え...
やりかたを全部書いてしまってはなんにも皆の為にならんので...
具体的には，http://www.jp.freebsd.org/www.FreeBSD.org/rel...
なお，一次資料を読み込む訓練も兼ねて，バージョンアップに...
** 注意ポイント [#ud19a177]
ただし，注意すべきポイントは書いておこう.
OS のバージョンアップとなると，当然，システム中のソフトウ...
これらは具体的には，例えば次のようなものがある. 他にも考...
+ 設定ファイルの固まりである /etc ディレクトリは念の為 ま...
具体的には，バージョンアップ作業前に
cd /
cd -Rp /etc /etc.old-20080201
などとすればよい.
&br;
+ /etc/resolv.conf は，自前の BIND ではなくて，できれば外...
要するにこの場合はバージョンアップ作業前に
nameserver 192.168.125.14
にいったん戻しておく，ということだな.
&br;
+ システムに関わる作業は常に作業ログを取る癖をつけよう. p...
&br;
+ ある方法でアップグレードする場合，途中でファイルの「正...
&br;
+その他，例えば，カーネルファイルがおかしくなると起動しな...
** 実際の作業ログ [#sda66f66]
以下に，サンプルとして作業ログを示しておこう.
ただし，このまま真似するだけになってしまってはなんにもな...
> fetch http:people.freebsd.org/~cperciva/freebsd-updat...
> fetch http:people.freebsd.org/~cperciva/freebsd-updat...
> gpg --verify freebsd-update-upgrade.tgz.asc freebsd-u...
gpg: 金 11/16 23:01:38 2007 JSTにDSA鍵ID CA6CDFB2で施さ...
gpg: 署名を検査できません: No public key
> gpg --keyserver pgp.nic.ad.jp --recv-key CA6CDFB2
gpg: 鍵輪「/root/.gnupg/secring.gpg」ができました
gpg: 鍵CA6CDFB2をhkpからサーバーpgp.nic.ad.jpに要求
gpg: 鍵CA6CDFB2: 重複したユーザーIDの検出 - 併合
gpg: /root/.gnupg/trustdb.gpg: 信用データベースができま...
gpg: 鍵CA6CDFB2: 公開鍵“FreeBSD Security Officer <secur...
gpg: 絶対的に信用する鍵が見つかりません
gpg: 処理数の合計: 1
gpg: 読込み: 1
> gpg --verify freebsd-update-upgrade.tgz.asc freebsd-u...
gpg: 金 11/16 23:01:38 2007 JSTにDSA鍵ID CA6CDFB2で施さ...
gpg: “FreeBSD Security Officer <security-officer@FreeBS...
gpg: 警告: この鍵は信用できる署名で証明されていません!
gpg: この署名が所有者のものかどうかの検証手段があ...
主鍵の指紋: C374 0FC5 69A6 FBB1 4AED B131 15D6 8804 CA...
> tar xfv freebsd-update-upgrade.tgz
x freebsd-update.sh
x freebsd-update.conf
> sh ./freebsd-update.sh -f freebsd-update.conf -r 6.3-...
Looking up update.FreeBSD.org mirrors... 1 mirrors found.
Fetching metadata signature for 6.2-RELEASE from update...
Fetching metadata index... done.
Fetching 1 metadata files... done.
Inspecting system... done.
The following components of FreeBSD seem to be installed:
kernel/generic src/base src/sys world/base world/dict w...
world/games world/info world/manpages world/proflibs
The following components of FreeBSD do not seem to be i...
kernel/smp src/bin src/contrib src/crypto src/etc src/g...
src/include src/krb5 src/lib src/libexec src/release sr...
src/secure src/share src/tools src/ubin src/usbin world...
Does this look reasonable (y/n)? y
Fetching metadata signature for 6.3-RELEASE from update...
Fetching metadata index... done.
Fetching 1 metadata patches. done.
Applying metadata patches... done.
Fetching 1 metadata files... done.
Inspecting system... done.
Fetching files from 6.2-RELEASE for merging... done.
Preparing to download files...7322 patches.....10....20...
Applying patches... done.
Fetching 1260 files... done.
Attempting to automatically merge changes in files... d...
The following file could not be merged automatically: /...
Press Enter to edit this file in emacs and resolve the ...
manually...
(適切に編集. 自分で書き足したり直したりした部分が有効で...
The following changes, which occurred between FreeBSD 6...
FreeBSD 6.3-RELEASE have been merged into /etc/hosts.al...
--- current version
+++ new version
@@ -1,8 +1,8 @@
#
# hosts.allow access control file for "tcp wrapped" ap...
-# $FreeBSD: src/etc/hosts.allow,v 1.19.8.1 2006/02/19 ...
+# $FreeBSD: src/etc/hosts.allow,v 1.19.8.2 2007/01/20 ...
#
# NOTE: The hosts.deny file is deprecated.
# Place both 'allow' and 'deny' rules in the hos...
# See hosts_options(5) for the format of this file.
# hosts_access(5) no longer fully applies.
@@ -67,10 +67,11 @@
rpcbind : 192.0.2.32/255.255.255.224 : allow
rpcbind : 192.0.2.96/255.255.255.224 : allow
rpcbind : ALL : deny
# NIS master server. Only local nets should have access
+# (Since this is an RPC service, rpcbind needs to be c...
ypserv : localhost : allow
ypserv : .unsafe.my.net.example.com : deny
ypserv : .my.net.example.com : allow
ypserv : ALL : deny
Does this look reasonable (y/n)? y
The following changes, which occurred between FreeBSD 6...
FreeBSD 6.3-RELEASE have been merged into /var/named/et...
--- current version
+++ new version
@@ -1,16 +1,17 @@
- $FreeBSD: src/etc/namedb/named.conf,v 1.21.2.1 2005/0...
+ $FreeBSD: src/etc/namedb/named.conf,v 1.21.2.6.2.1 20...
Refer to the named.conf(5) and named(8) man pages, an...
in /usr/share/doc/bind9 for more details.
If you are going to set up an authoritative server, m...
understand the hairy details of how DNS works. Even ...
simple mistakes, you can break connectivity for affec...
or cause huge amounts of useless Internet traffic.
options {
+ Relative to the chroot directory, if any
directory "/etc/namedb";
pid-file "/var/run/named/pid";
dump-file "/var/dump/named_dump.db";
statistics-file "/var/stats/named.stats";
@@ -25,15 +26,23 @@
If you have IPv6 enabled on this system, uncomment th...
use as a local resolver. To give access to the netwo...
an IPv6 address, or the keyword "any".
listen-on-v6 { ::1; };
+/* These options are available for BIND 9.4.x
+ These zones are already covered by the empty zones li...
+ If you remove the related empty zones below, comment ...
+ disable-empty-zone "255.255.255.255.IN-ADDR.ARP...
+ disable-empty-zone "0.0.0.0.0.0.0.0.0.0.0.0.0.0...
+ disable-empty-zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0...
+*/
+
In addition to the "forwarders" clause, you can force...
server to never initiate queries of its own, but alwa...
forwarders only, by enabling the following line:
- forward only;
+ forward only;
If you've got a DNS server around at your upstream pr...
its IP address here, and enable the line below. This...
benefit from its cache, thus reduce overall DNS traff...
/*
@@ -53,26 +62,178 @@
If you enable a local name server, don't forget to en...
first in your /etc/resolv.conf so this server will be...
Also, make sure to enable it in /etc/rc.conf.
+ The traditional root hints mechanism. Use this, OR th...
+zone "." { type hint; file "named.root"; };
+
+/* Slaving the following zones from the root name ...
+ significant advantages:
+ 1. Faster local resolution for your users
+ 2. No spurious traffic will be sent from your n...
+ 3. Greater resilience to any potential root ser...
+
+ On the other hand, this method requires more mo...
+ hints file to be sure that an unexpected failur...
+ incapacitated your server. Name servers that a...
+ of clients will benefit more from this approach...
+ hosts. Use with caution.
+
+ To use this mechanism, uncomment the entries be...
+ the hint zone above.
+*/
+/*
zone "." {
- type hint;
- file "named.root";
+ type slave;
+ file "slave/root.slave";
+ masters {
+ 192.5.5.241; F.ROOT-SERVERS.NET.
+ };
+ notify no;
};
-
-zone "0.0.127.IN-ADDR.ARPA" {
- type master;
- file "master/localhost.rev";
+zone "arpa" {
+ type slave;
+ file "slave/arpa.slave";
+ masters {
+ 192.5.5.241; F.ROOT-SERVERS.NET.
+ };
+ notify no;
};
-
- RFC 3152
-zone "1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0....
- type master;
- file "master/localhost-v6.rev";
+zone "in-addr.arpa" {
+ type slave;
+ file "slave/in-addr.arpa.slave";
+ masters {
+ 192.5.5.241; F.ROOT-SERVERS.NET.
+ };
+ notify no;
};
+
+=======
+*/
+
+/* Serving the following zones locally will preven...
+ for these zones leaving your network and going ...
+ name servers. This has two significant advanta...
+ 1. Faster local resolution for your users
+ 2. No spurious traffic will be sent from your n...
+*/
+ RFC 1912
+zone "localhost" { type master; file "master/loc...
+zone "127.in-addr.arpa" { type master; file "master/lo...
+zone "255.in-addr.arpa" { type master; file "ma...
+
+ RFC 1912-style zone for IPv6 localhost address
+zone "0.ip6.arpa" { type master; file "master/loc...
+
+ "This" Network (RFCs 1912 and 3330)
+zone "0.in-addr.arpa" { type master; file "ma...
+
+ Private Use Networks (RFC 1918)
+zone "10.in-addr.arpa" { type master; file "ma...
+zone "16.172.in-addr.arpa" { type master; file "ma...
+zone "17.172.in-addr.arpa" { type master; file "ma...
+zone "18.172.in-addr.arpa" { type master; file "ma...
+zone "19.172.in-addr.arpa" { type master; file "ma...
+zone "20.172.in-addr.arpa" { type master; file "ma...
+zone "21.172.in-addr.arpa" { type master; file "ma...
+zone "22.172.in-addr.arpa" { type master; file "ma...
+zone "23.172.in-addr.arpa" { type master; file "ma...
+zone "24.172.in-addr.arpa" { type master; file "ma...
+zone "25.172.in-addr.arpa" { type master; file "ma...
+zone "26.172.in-addr.arpa" { type master; file "ma...
+zone "27.172.in-addr.arpa" { type master; file "ma...
+zone "28.172.in-addr.arpa" { type master; file "ma...
+zone "29.172.in-addr.arpa" { type master; file "ma...
+zone "30.172.in-addr.arpa" { type master; file "ma...
+zone "31.172.in-addr.arpa" { type master; file "ma...
+zone "168.192.in-addr.arpa" { type master; file "ma...
+
+ Link-local/APIPA (RFCs 3330 and 3927)
+zone "254.169.in-addr.arpa" { type master; file "ma...
+
+ TEST-NET for Documentation (RFC 3330)
+zone "2.0.192.in-addr.arpa" { type master; file "ma...
+
+ Router Benchmark Testing (RFC 3330)
+zone "18.198.in-addr.arpa" { type master; file "ma...
+zone "19.198.in-addr.arpa" { type master; file "ma...
+
+ IANA Reserved - Old Class E Space
+zone "240.in-addr.arpa" { type master; ...
+zone "241.in-addr.arpa" { type master; ...
+zone "242.in-addr.arpa" { type master; ...
+zone "243.in-addr.arpa" { type master; ...
+zone "244.in-addr.arpa" { type master; ...
+zone "245.in-addr.arpa" { type master; ...
+zone "246.in-addr.arpa" { type master; ...
+zone "247.in-addr.arpa" { type master; ...
+zone "248.in-addr.arpa" { type master; ...
+zone "249.in-addr.arpa" { type master; ...
+zone "250.in-addr.arpa" { type master; ...
+zone "251.in-addr.arpa" { type master; ...
+zone "252.in-addr.arpa" { type master; ...
+zone "253.in-addr.arpa" { type master; ...
+zone "254.in-addr.arpa" { type master; ...
+
+ IPv6 Unassigned Addresses (RFC 4291)
+zone "1.ip6.arpa" { type master; file "ma...
+zone "3.ip6.arpa" { type master; file "ma...
+zone "4.ip6.arpa" { type master; file "ma...
+zone "5.ip6.arpa" { type master; file "ma...
+zone "6.ip6.arpa" { type master; file "ma...
+zone "7.ip6.arpa" { type master; file "ma...
+zone "8.ip6.arpa" { type master; file "ma...
+zone "9.ip6.arpa" { type master; file "ma...
+zone "a.ip6.arpa" { type master; file "ma...
+zone "b.ip6.arpa" { type master; file "ma...
+zone "c.ip6.arpa" { type master; file "ma...
+zone "d.ip6.arpa" { type master; file "ma...
+zone "e.ip6.arpa" { type master; file "ma...
+zone "0.f.ip6.arpa" { type master; file "ma...
+zone "1.f.ip6.arpa" { type master; file "ma...
+zone "2.f.ip6.arpa" { type master; file "ma...
+zone "3.f.ip6.arpa" { type master; file "ma...
+zone "4.f.ip6.arpa" { type master; file "ma...
+zone "5.f.ip6.arpa" { type master; file "ma...
+zone "6.f.ip6.arpa" { type master; file "ma...
+zone "7.f.ip6.arpa" { type master; file "ma...
+zone "8.f.ip6.arpa" { type master; file "ma...
+zone "9.f.ip6.arpa" { type master; file "ma...
+zone "a.f.ip6.arpa" { type master; file "ma...
+zone "b.f.ip6.arpa" { type master; file "ma...
+zone "0.e.f.ip6.arpa" { type master; file "ma...
+zone "1.e.f.ip6.arpa" { type master; file "ma...
+zone "2.e.f.ip6.arpa" { type master; file "ma...
+zone "3.e.f.ip6.arpa" { type master; file "ma...
+zone "4.e.f.ip6.arpa" { type master; file "ma...
+zone "5.e.f.ip6.arpa" { type master; file "ma...
+zone "6.e.f.ip6.arpa" { type master; file "ma...
+zone "7.e.f.ip6.arpa" { type master; file "ma...
+
+ IPv6 ULA (RFC 4193)
+zone "c.f.ip6.arpa" { type master; file "ma...
+zone "d.f.ip6.arpa" { type master; file "ma...
+
+ IPv6 Link Local (RFC 4291)
+zone "8.e.f.ip6.arpa" { type master; file "ma...
+zone "9.e.f.ip6.arpa" { type master; file "ma...
+zone "a.e.f.ip6.arpa" { type master; file "ma...
+zone "b.e.f.ip6.arpa" { type master; file "ma...
+
+ IPv6 Deprecated Site-Local Addresses (RFC 3879)
+zone "c.e.f.ip6.arpa" { type master; file "ma...
+zone "d.e.f.ip6.arpa" { type master; file "ma...
+zone "e.e.f.ip6.arpa" { type master; file "ma...
+zone "f.e.f.ip6.arpa" { type master; file "ma...
+
+ IP6.INT is Deprecated (RFC 4159)
+zone "ip6.int" { type master; file "ma...
+
+
+
zone "sub17.cl.math.sci.osaka-u.ac.jp" {
type master;
file "master/sub17.zone";
};
@@ -81,52 +242,38 @@
serve demonstration/documentation purposes!
Example slave zone config entries. It can be conveni...
a slave at least for the zone your own domain is in. ...
your network administrator for the IP address of the ...
- primary.
+ master name server.
- Never forget to include the reverse lookup (IN-ADDR.A...
- (This is named after the first bytes of the IP addres...
- order, with ".IN-ADDR.ARPA" appended.)
-
- Before starting to set up a primary zone, make sure y...
- understand how DNS and BIND works. There are sometimes
- non-obvious pitfalls. Setting up a slave zone is sim...
+ Do not forget to include the reverse lookup zone!
+ This is named after the first bytes of the IP address...
+ order, with ".IN-ADDR.ARPA" appended, or ".IP6.ARPA" ...
+
+ Before starting to set up a master zone, make sure yo...
+ understand how DNS and BIND work. There are sometimes
+ non-obvious pitfalls. Setting up a slave zone is usu...
NB: Don't blindly enable the examples below. :-) Use...
and addresses instead.
-/* An example master zone
-zone "example.net" {
- type master;
- file "master/example.net";
-};
-*/
-
/* An example dynamic zone
key "exampleorgkey" {
- algorithm hmac-md5;
- secret "sf87HJqjkqh8ac87a02lla==";
+ algorithm hmac-md5;
+ secret "sf87HJqjkqh8ac87a02lla==";
};
zone "example.org" {
type master;
allow-update {
key "exampleorgkey";
};
file "dynamic/example.org";
};
*/
-/* Examples of forward and reverse slave zones
-zone "example.com" {
- type slave;
- file "slave/example.com";
- masters {
- 192.168.1.1;
- };
-};
+/* Example of a slave reverse zone
zone "1.168.192.in-addr.arpa" {
type slave;
file "slave/1.168.192.in-addr.arpa";
masters {
192.168.1.1;
Does this look reasonable (y/n)? y
The following files will be removed as part of updating...
/boot/kernel/hptmv.ko
/usr/share/doc/de_DE.ISO8859-1/books/handbook/install-s...
...
The following files will be added as part of updating t...
/boot/kernel/acpi_dock.ko
/boot/kernel/coretemp.ko
...
The following files will be updated as part of updating...
/COPYRIGHT
/bin/[
...
> sh ./freebsd-update.sh -f freebsd-update.conf install
Installing updates...
Kernel updates have been installed. Please reboot and ...
"./freebsd-update.sh install" again to finish installin...
> shutdown -r now
FreeBSD 6.3-RELEASE (GENERIC) #0: Wed Jan 16 04:18:52 U...
(ちなみに，再起動後のログイン時には…)
(再起動後)
> sh ./freebsd-update.sh -f freebsd-update.conf install
Installing updates... done.
> shutdown -r now
* さらに余裕があれば… [#mff60e10]
port などもできるだけ新しくしておこう. 時おりこまめに作業...
> portaudit -Fad
auditfile.tbz 100% of ...
New database installed.
Database created: 2008年 1月27日 日曜日 08時10分01秒 JST
0 problem(s) in your installed packages found.
> portsnap fetch
Looking up portsnap.FreeBSD.org mirrors... 4 mirrors fo...
Fetching snapshot tag from portsnap2.FreeBSD.org... done.
Latest snapshot on server matches what we already have.
No updates needed.
> portupgrade -na -x 'emacs*'
---> Reading default options: -v -L /var/log/ports/%s:...
---> Session started at: Sun, 27 Jan 2008 08:16:08 +0900
…略…
---> Packages processed: 0 done, 639 ignored, 0 skippe...
---> Session ended at: Sun, 27 Jan 2008 08:18:57 +0900...
というような感じに, ほぼ最新の状況を保つことができる.
*** レポート [#f869e25c]
実際にバージョンアップを行い，
uname -v
とすると
FreeBSD 6.3-RELEASE #0: Wed Jan 16 04:18:52 UTC 2008 ...
という出力が得られるようにせよ.
また，その後，
dig @127.0.0.1 www.osaka-u.ac.jp
として，自前の BIND がきちんと動いていることを確認してか...
また，上のリリース資料web の ''Dedication'' という部分を...
また，その中に出てくる人物について調査し，その結果につい...
また，FreeBSD 6.3R はいつまでサポートされる予定かについて...
ページ名:
