<?xml version="1.0" encoding="iso-8859-1"?>

<?xml version="1.0" encoding="iso-8859-1"?>

<!--

<!--

     The FreeBSD Documentation Project

     The FreeBSD Documentation Project

     $FreeBSD$

     $FreeBSD$

-->

-->

<chapter xmlns="http://docbook.org/ns/docbook"

<chapter xmlns="http://docbook.org/ns/docbook"

  xmlns:xlink="http://www.w3.org/1999/xlink" version="5.0"

  xmlns:xlink="http://www.w3.org/1999/xlink" version="5.0"

  xml:id="network-servers">

  xml:id="network-servers">

  <!--

  <!--

  <chapterinfo>

  <chapterinfo>

    <authorgroup>

    <authorgroup>

      <author>

      <author>

	<firstname>Murray</firstname>

	<firstname>Murray</firstname>

	<surname>Stokely</surname>

	<surname>Stokely</surname>

	<contrib>Reorganized by in July 2004</contrib>

	<contrib>Reorganized by in July 2004</contrib>

      </author>

      </author>

    </authorgroup>

    </authorgroup>

  </chapterinfo>

  </chapterinfo>

  -->

  -->

  <title>Network Servers</title>

  <title>Network Servers</title>

  <sect1 xml:id="network-servers-synopsis">

  <sect1 xml:id="network-servers-synopsis">

    <title>Synopsis</title>

    <title>Synopsis</title>

    <para>This chapter covers some of the more frequently used network

    <para>This chapter covers some of the more frequently used network

      services on &unix; systems.  This includes installing,

      services on &unix; systems.  This includes installing,

      configuring, testing, and maintaining many different types of

      configuring, testing, and maintaining many different types of

      network services.  Example configuration files are included

      network services.  Example configuration files are included

      throughout this chapter for reference.</para>

      throughout this chapter for reference.</para>

    <para>By the end of this chapter, readers will know:</para>

    <para>By the end of this chapter, readers will know:</para>

    <itemizedlist>

    <itemizedlist>

      <listitem>

      <listitem>

	<para>How to manage the <application>inetd</application>

	<para>How to manage the <application>inetd</application>

	  daemon.</para>

	  daemon.</para>

      </listitem>

      </listitem>

      <listitem>

      <listitem>

	<para>How to set up the Network File System

	<para>How to set up the Network File System

	  (<acronym>NFS</acronym>).</para>

	  (<acronym>NFS</acronym>).</para>

      </listitem>

      </listitem>

      <listitem>

      <listitem>

	<para>How to set up the Network Information Server

	<para>How to set up the Network Information Server

	  (<acronym>NIS</acronym>) for centralizing and sharing

	  (<acronym>NIS</acronym>) for centralizing and sharing

	  user accounts.</para>

	  user accounts.</para>

      </listitem>

      </listitem>

      <listitem>

      <listitem>

	<para>How to set &os; up to act as an <acronym>LDAP</acronym>

	<para>How to set &os; up to act as an <acronym>LDAP</acronym>

	  server or client</para>

	  server or client</para>

      </listitem>

      </listitem>

      <listitem>

      <listitem>

	<para>How to set up automatic network settings using

	<para>How to set up automatic network settings using

	  <acronym>DHCP</acronym>.</para>

	  <acronym>DHCP</acronym>.</para>

      </listitem>

      </listitem>

      <listitem>

      <listitem>

	<para>How to set up a Domain Name Server

	<para>How to set up a Domain Name Server

	  (<acronym>DNS</acronym>).</para>

	  (<acronym>DNS</acronym>).</para>

      </listitem>

      </listitem>

      <listitem>

      <listitem>

	<para>How to set up the <application>Apache</application>

	<para>How to set up the <application>Apache</application>

	  <acronym>HTTP</acronym> Server.</para>

	  <acronym>HTTP</acronym> Server.</para>

      </listitem>

      </listitem>

      <listitem>

      <listitem>

	<para>How to set up a File Transfer Protocol

	<para>How to set up a File Transfer Protocol

	  (<acronym>FTP</acronym>) server.</para>

	  (<acronym>FTP</acronym>) server.</para>

      </listitem>

      </listitem>

      <listitem>

      <listitem>

	<para>How to set up a file and print server for &windows;

	<para>How to set up a file and print server for &windows;

	  clients using <application>Samba</application>.</para>

	  clients using <application>Samba</application>.</para>

      </listitem>

      </listitem>

      <listitem>

      <listitem>

	<para>How to synchronize the time and date, and set up a

	<para>How to synchronize the time and date, and set up a

	  time server using the Network Time Protocol

	  time server using the Network Time Protocol

	  (<acronym>NTP</acronym>).</para>

	  (<acronym>NTP</acronym>).</para>

      </listitem>

      </listitem>

      <listitem>

      <listitem>

	<para>How to set up <acronym>iSCSI</acronym>.</para>

	<para>How to set up <acronym>iSCSI</acronym>.</para>

      </listitem>

      </listitem>

    </itemizedlist>

    </itemizedlist>

    <para>This chapter assumes a basic knowledge of:</para>

    <para>This chapter assumes a basic knowledge of:</para>

    <itemizedlist>

    <itemizedlist>

      <listitem>

      <listitem>

	<para><filename>/etc/rc</filename> scripts.</para>

	<para><filename>/etc/rc</filename> scripts.</para>

      </listitem>

      </listitem>

      <listitem>

      <listitem>

	<para>Network terminology.</para>

	<para>Network terminology.</para>

      </listitem>

      </listitem>

      <listitem>

      <listitem>

	<para>Installation of additional third-party

	<para>Installation of additional third-party

	  software (<xref linkend="ports"/>).</para>

	  software (<xref linkend="ports"/>).</para>

      </listitem>

      </listitem>

    </itemizedlist>

    </itemizedlist>

  </sect1>

  </sect1>

  <sect1 xml:id="network-inetd">

  <sect1 xml:id="network-inetd">

    <title>The <application>inetd</application>

    <title>The <application>inetd</application>

      Super-Server</title>

      Super-Server</title>

    <!--

    <!--

    <sect1info>

    <sect1info>

      <authorgroup>

      <authorgroup>

	<author>

	<author>

	  <firstname>Chern</firstname>

	  <firstname>Chern</firstname>

	  <surname>Lee</surname>

	  <surname>Lee</surname>

	  <contrib>Contributed by </contrib>

	  <contrib>Contributed by </contrib>

	</author>

	</author>

      </authorgroup>

      </authorgroup>

      <authorgroup>

      <authorgroup>

	<author>

	<author>

	  <contrib>Updated by </contrib>

	  <contrib>Updated by </contrib>

	  <othername>The &os; Documentation Project</othername>

	  <othername>The &os; Documentation Project</othername>

	</author>

	</author>

      </authorgroup>

      </authorgroup>

    </sect1info>

    </sect1info>

    -->

    -->

    <para>The &man.inetd.8; daemon is sometimes referred to as a

    <para>The &man.inetd.8; daemon is sometimes referred to as a

      Super-Server because it manages connections for many services.

      Super-Server because it manages connections for many services.

      Instead of starting multiple applications, only the

      Instead of starting multiple applications, only the

      <application>inetd</application> service needs to be started.

      <application>inetd</application> service needs to be started.

      When a connection is received for a service that is managed by

      When a connection is received for a service that is managed by

      <application>inetd</application>, it determines which program

      <application>inetd</application>, it determines which program

      the connection is destined for, spawns a process for that

      the connection is destined for, spawns a process for that

      program, and delegates the program a socket.  Using

      program, and delegates the program a socket.  Using

      <application>inetd</application> for services that are not

      <application>inetd</application> for services that are not

      heavily used can reduce system load, when compared to running

      heavily used can reduce system load, when compared to running

      each daemon individually in stand-alone mode.</para>

      each daemon individually in stand-alone mode.</para>

    <para>Primarily, <application>inetd</application> is used to

    <para>Primarily, <application>inetd</application> is used to

      spawn other daemons, but several trivial protocols are handled

      spawn other daemons, but several trivial protocols are handled

      internally, such as <application>chargen</application>,

      internally, such as <application>chargen</application>,

      <application>auth</application>,

      <application>auth</application>,

      <application>time</application>,

      <application>time</application>,

      <application>echo</application>,

      <application>echo</application>,

      <application>discard</application>, and

      <application>discard</application>, and

      <application>daytime</application>.</para>

      <application>daytime</application>.</para>

    <para>This section covers the basics of configuring

    <para>This section covers the basics of configuring

      <application>inetd</application>.</para>

      <application>inetd</application>.</para>

    <sect2 xml:id="network-inetd-conf">

    <sect2 xml:id="network-inetd-conf">

      <title>Configuration File</title>

      <title>Configuration File</title>

      <para>Configuration of <application>inetd</application> is

      <para>Configuration of <application>inetd</application> is

	done by editing <filename>/etc/inetd.conf</filename>.  Each

	done by editing <filename>/etc/inetd.conf</filename>.  Each

	line of this configuration file represents an application

	line of this configuration file represents an application

	which can be started by <application>inetd</application>.  By

	which can be started by <application>inetd</application>.  By

	default, every line starts with a comment

	default, every line starts with a comment

	(<literal>#</literal>), meaning that

	(<literal>#</literal>), meaning that

	<application>inetd</application> is not listening for any

	<application>inetd</application> is not listening for any

	applications.  To configure <application>inetd</application>

	applications.  To configure <application>inetd</application>

	to listen for an application's connections, remove the

	to listen for an application's connections, remove the

	<literal>#</literal> at the beginning of the line for that

	<literal>#</literal> at the beginning of the line for that

	application.</para>

	application.</para>

      <para>After saving your edits, configure

      <para>After saving your edits, configure

	<application>inetd</application> to start at system boot by

	<application>inetd</application> to start at system boot by

	editing <filename>/etc/rc.conf</filename>:</para>

	editing <filename>/etc/rc.conf</filename>:</para>

      <programlisting>inetd_enable="YES"</programlisting>

      <programlisting>inetd_enable="YES"</programlisting>

      <para>To start  <application>inetd</application> now, so that it

      <para>To start  <application>inetd</application> now, so that it

	listens for the service you configured, type:</para>

	listens for the service you configured, type:</para>

      <screen>&prompt.root; <userinput>service inetd start</userinput></screen>

      <screen>&prompt.root; <userinput>service inetd start</userinput></screen>

      <para>Once <application>inetd</application> is started, it needs

      <para>Once <application>inetd</application> is started, it needs

	to be notified whenever a modification is made to

	to be notified whenever a modification is made to

	<filename>/etc/inetd.conf</filename>:</para>

	<filename>/etc/inetd.conf</filename>:</para>

      <example xml:id="network-inetd-reread">

      <example xml:id="network-inetd-reread">

	<title>Reloading the <application>inetd</application>

	<title>Reloading the <application>inetd</application>

	  Configuration File</title>

	  Configuration File</title>

	<screen>&prompt.root; <userinput>service inetd reload</userinput></screen>

	<screen>&prompt.root; <userinput>service inetd reload</userinput></screen>

      </example>

      </example>

      <para>Typically, the default entry for an application does not

      <para>Typically, the default entry for an application does not

	need to be edited beyond removing the <literal>#</literal>.

	need to be edited beyond removing the <literal>#</literal>.

	In some situations, it may be appropriate to edit the default

	In some situations, it may be appropriate to edit the default

	entry.</para>

	entry.</para>

      <para>As an example, this is the default entry for &man.ftpd.8;

      <para>As an example, this is the default entry for &man.ftpd.8;

	over IPv4:</para>

	over IPv4:</para>

      <programlisting>ftp     stream  tcp     nowait  root    /usr/libexec/ftpd       ftpd -l</programlisting>

      <programlisting>ftp     stream  tcp     nowait  root    /usr/libexec/ftpd       ftpd -l</programlisting>

      <para>The seven columns in an entry are as follows:</para>

      <para>The seven columns in an entry are as follows:</para>

      <programlisting>service-name

      <programlisting>service-name

socket-type

socket-type

protocol

protocol

{wait|nowait}[/max-child[/max-connections-per-ip-per-minute[/max-child-per-ip]]]

{wait|nowait}[/max-child[/max-connections-per-ip-per-minute[/max-child-per-ip]]]

user[:group][/login-class]

user[:group][/login-class]

server-program

server-program

server-program-arguments</programlisting>

server-program-arguments</programlisting>

      <para>where:</para>

      <para>where:</para>

      <variablelist>

      <variablelist>

	<varlistentry>

	<varlistentry>

	  <term>service-name</term>

	  <term>service-name</term>

	  <listitem>

	  <listitem>

	    <para>The service name of the daemon to start.  It must

	    <para>The service name of the daemon to start.  It must

	      correspond to a service listed in

	      correspond to a service listed in

	      <filename>/etc/services</filename>.  This determines

	      <filename>/etc/services</filename>.  This determines

	      which port <application>inetd</application> listens on

	      which port <application>inetd</application> listens on

	      for incoming connections to that service.  When using a

	      for incoming connections to that service.  When using a

	      custom service, it must first be added to

	      custom service, it must first be added to

	      <filename>/etc/services</filename>.</para>

	      <filename>/etc/services</filename>.</para>

	  </listitem>

	  </listitem>

	</varlistentry>

	</varlistentry>

	<varlistentry>

	<varlistentry>

	  <term>socket-type</term>

	  <term>socket-type</term>

	  <listitem>

	  <listitem>

	    <para>Either <literal>stream</literal>,

	    <para>Either <literal>stream</literal>,

	      <literal>dgram</literal>, <literal>raw</literal>, or

	      <literal>dgram</literal>, <literal>raw</literal>, or

	      <literal>seqpacket</literal>.  Use

	      <literal>seqpacket</literal>.  Use

	      <literal>stream</literal> for TCP connections and

	      <literal>stream</literal> for TCP connections and

	      <literal>dgram</literal> for

	      <literal>dgram</literal> for

	      <acronym>UDP</acronym> services.</para>

	      <acronym>UDP</acronym> services.</para>

	  </listitem>

	  </listitem>

	</varlistentry>

	</varlistentry>

	<varlistentry>

	<varlistentry>

	  <term>protocol</term>

	  <term>protocol</term>

	  <listitem>

	  <listitem>

	    <para>Use one of the following protocol names:</para>

	    <para>Use one of the following protocol names:</para>

	    <informaltable frame="none" pgwide="1">

	    <informaltable frame="none" pgwide="1">

	      <tgroup cols="2">

	      <tgroup cols="2">

		<thead>

		<thead>

		  <row>

		  <row>

		    <entry>Protocol Name</entry>

		    <entry>Protocol Name</entry>

		    <entry>Explanation</entry>

		    <entry>Explanation</entry>

		  </row>

		  </row>

		</thead>

		</thead>

		<tbody>

		<tbody>

		  <row>

		  <row>

		    <entry>tcp or tcp4</entry>

		    <entry>tcp or tcp4</entry>

		    <entry>TCP IPv4</entry>

		    <entry>TCP IPv4</entry>

		  </row>

		  </row>

		  <row>

		  <row>

		    <entry>udp or udp4</entry>

		    <entry>udp or udp4</entry>

		    <entry><acronym>UDP</acronym> IPv4</entry>

		    <entry><acronym>UDP</acronym> IPv4</entry>

		  </row>

		  </row>

		  <row>

		  <row>

		    <entry>tcp6</entry>

		    <entry>tcp6</entry>

		    <entry>TCP IPv6</entry>

		    <entry>TCP IPv6</entry>

		  </row>

		  </row>

		  <row>

		  <row>

		    <entry>udp6</entry>

		    <entry>udp6</entry>

		    <entry><acronym>UDP</acronym> IPv6</entry>

		    <entry><acronym>UDP</acronym> IPv6</entry>

		  </row>

		  </row>

		  <row>

		  <row>

		    <entry>tcp46</entry>

		    <entry>tcp46</entry>

		    <entry>Both TCP IPv4 and IPv6</entry>

		    <entry>Both TCP IPv4 and IPv6</entry>

		  </row>

		  </row>

		  <row>

		  <row>

		    <entry>udp46</entry>

		    <entry>udp46</entry>

		    <entry>Both <acronym>UDP</acronym> IPv4 and

		    <entry>Both <acronym>UDP</acronym> IPv4 and

		      IPv6</entry>

		      IPv6</entry>

		  </row>

		  </row>

		</tbody>

		</tbody>

	      </tgroup>

	      </tgroup>

	    </informaltable>

	    </informaltable>

	  </listitem>

	  </listitem>

	</varlistentry>

	</varlistentry>

	<varlistentry>

	<varlistentry>

	  <term>{wait|nowait}[/max-child[/max-connections-per-ip-per-minute[/max-child-per-ip]]]</term>

	  <term>{wait|nowait}[/max-child[/max-connections-per-ip-per-minute[/max-child-per-ip]]]</term>

	  <listitem>

	  <listitem>

	    <para>In this field, <option>wait</option> or

	    <para>In this field, <option>wait</option> or

	      <option>nowait</option> must be specified.

	      <option>nowait</option> must be specified.

	      <option>max-child</option>,

	      <option>max-child</option>,

	      <option>max-connections-per-ip-per-minute</option> and

	      <option>max-connections-per-ip-per-minute</option> and

	      <option>max-child-per-ip</option> are optional.</para>

	      <option>max-child-per-ip</option> are optional.</para>

	    <para><option>wait|nowait</option> indicates whether or

	    <para><option>wait|nowait</option> indicates whether or

	      not the service is able to handle its own socket.

	      not the service is able to handle its own socket.

	      <option>dgram</option> socket types must use

	      <option>dgram</option> socket types must use

	      <option>wait</option> while

	      <option>wait</option> while

	      <option>stream</option> daemons, which are usually

	      <option>stream</option> daemons, which are usually

	      multi-threaded, should use <option>nowait</option>.

	      multi-threaded, should use <option>nowait</option>.

	      <option>wait</option> usually hands off multiple sockets

	      <option>wait</option> usually hands off multiple sockets

	      to a single daemon, while <option>nowait</option> spawns

	      to a single daemon, while <option>nowait</option> spawns

	      a child daemon for each new socket.</para>

	      a child daemon for each new socket.</para>

	    <para>The maximum number of child daemons

	    <para>The maximum number of child daemons

	      <application>inetd</application> may spawn is set by

	      <application>inetd</application> may spawn is set by

	      <option>max-child</option>.  For example, to limit ten

	      <option>max-child</option>.  For example, to limit ten

	      instances of the daemon, place a <literal>/10</literal>

	      instances of the daemon, place a <literal>/10</literal>

	      after <option>nowait</option>.  Specifying

	      after <option>nowait</option>.  Specifying

	      <literal>/0</literal> allows an unlimited number of

	      <literal>/0</literal> allows an unlimited number of

	      children.</para>

	      children.</para>

	    <para><option>max-connections-per-ip-per-minute</option>

	    <para><option>max-connections-per-ip-per-minute</option>

	      limits the number of connections from any particular

	      limits the number of connections from any particular

	      <acronym>IP</acronym> address per minute.  Once the

	      <acronym>IP</acronym> address per minute.  Once the

	      limit  is reached, further connections from this IP

	      limit  is reached, further connections from this IP

	      address will be dropped until the end of the minute.

	      address will be dropped until the end of the minute.

	      For example, a value of <literal>/10</literal> would

	      For example, a value of <literal>/10</literal> would

	      limit any particular <acronym>IP</acronym> address to

	      limit any particular <acronym>IP</acronym> address to

	      ten connection attempts per minute.

	      ten connection attempts per minute.

	      <option>max-child-per-ip</option> limits the number of

	      <option>max-child-per-ip</option> limits the number of

	      child processes that can be started on behalf on any

	      child processes that can be started on behalf on any

	      single <acronym>IP</acronym> address at any moment.

	      single <acronym>IP</acronym> address at any moment.

	      These options can limit excessive resource consumption

	      These options can limit excessive resource consumption

	      and help to prevent Denial of Service attacks.</para>

	      and help to prevent Denial of Service attacks.</para>

	    <para>An example can be seen in the default settings for

	    <para>An example can be seen in the default settings for

	      &man.fingerd.8;:</para>

	      &man.fingerd.8;:</para>

	    <programlisting>finger stream  tcp     nowait/3/10 nobody /usr/libexec/fingerd fingerd -k -s</programlisting>

	    <programlisting>finger stream  tcp     nowait/3/10 nobody /usr/libexec/fingerd fingerd -k -s</programlisting>

	  </listitem>

	  </listitem>

	</varlistentry>

	</varlistentry>

	<varlistentry>

	<varlistentry>

	  <term>user</term>

	  <term>user</term>

	  <listitem>

	  <listitem>

	    <para>The username the daemon

	    <para>The username the daemon

	      will run as.  Daemons typically run as

	      will run as.  Daemons typically run as

	      <systemitem class="username">root</systemitem>,

	      <systemitem class="username">root</systemitem>,

	      <systemitem class="username">daemon</systemitem>, or

	      <systemitem class="username">daemon</systemitem>, or

	      <systemitem class="username">nobody</systemitem>.</para>

	      <systemitem class="username">nobody</systemitem>.</para>

	  </listitem>

	  </listitem>

	</varlistentry>

	</varlistentry>

	<varlistentry>

	<varlistentry>

	  <term>server-program</term>

	  <term>server-program</term>

	  <listitem>

	  <listitem>

	    <para>The full path to the daemon.  If the daemon is a

	    <para>The full path to the daemon.  If the daemon is a

	      service provided by <application>inetd</application>

	      service provided by <application>inetd</application>

	      internally, use <option>internal</option>.</para>

	      internally, use <option>internal</option>.</para>

	  </listitem>

	  </listitem>

	</varlistentry>

	</varlistentry>

	<varlistentry>

	<varlistentry>

	  <term>server-program-arguments</term>

	  <term>server-program-arguments</term>

	  <listitem>

	  <listitem>

	    <para>Used to specify any command arguments to be passed

	    <para>Used to specify any command arguments to be passed

	      to the daemon on invocation.  If the daemon is an

	      to the daemon on invocation.  If the daemon is an

	      internal service, use

	      internal service, use

	      <option>internal</option>.</para>

	      <option>internal</option>.</para>

	  </listitem>

	  </listitem>

	</varlistentry>

	</varlistentry>

      </variablelist>

      </variablelist>

    </sect2>

    </sect2>

    <sect2 xml:id="network-inetd-cmdline">

    <sect2 xml:id="network-inetd-cmdline">

      <title>Command-Line Options</title>

      <title>Command-Line Options</title>

      <para>Like most server daemons, <application>inetd</application>

      <para>Like most server daemons, <application>inetd</application>

	has a number of options that can be used to modify its

	has a number of options that can be used to modify its

	behavior.  By default, <application>inetd</application> is

	behavior.  By default, <application>inetd</application> is

	started with <literal>-wW -C 60</literal>.  These options

	started with <literal>-wW -C 60</literal>.  These options

	enable TCP wrappers for all services, including internal

	enable TCP wrappers for all services, including internal

	services, and prevent any <acronym>IP</acronym> address from

	services, and prevent any <acronym>IP</acronym> address from

	requesting any service more than 60 times per minute.</para>

	requesting any service more than 60 times per minute.</para>

      <para>To change the default options which are passed to

      <para>To change the default options which are passed to

	<application>inetd</application>, add an entry for

	<application>inetd</application>, add an entry for

	<literal>inetd_flags</literal> in

	<literal>inetd_flags</literal> in

	<filename>/etc/rc.conf</filename>.  If

	<filename>/etc/rc.conf</filename>.  If

	<application>inetd</application> is already running, restart

	<application>inetd</application> is already running, restart

	it with <command>service inetd restart</command>.</para>

	it with <command>service inetd restart</command>.</para>

      <para>The available rate limiting options are:</para>

      <para>The available rate limiting options are:</para>

      <variablelist>

      <variablelist>

	<varlistentry>

	<varlistentry>

	  <term>-c maximum</term>

	  <term>-c maximum</term>

	  <listitem>

	  <listitem>

	    <para>Specify the default maximum number of simultaneous

	    <para>Specify the default maximum number of simultaneous

	      invocations of each service, where the default is

	      invocations of each service, where the default is

	      unlimited.  May be overridden on a per-service basis by

	      unlimited.  May be overridden on a per-service basis by

	      using <option>max-child</option> in

	      using <option>max-child</option> in

	      <filename>/etc/inetd.conf</filename>.</para>

	      <filename>/etc/inetd.conf</filename>.</para>

	  </listitem>

	  </listitem>

	</varlistentry>

	</varlistentry>

	<varlistentry>

	<varlistentry>

	  <term>-C rate</term>

	  <term>-C rate</term>

	  <listitem>

	  <listitem>

	    <para>Specify the default maximum number of times a

	    <para>Specify the default maximum number of times a

	      service can be invoked from a single

	      service can be invoked from a single

	      <acronym>IP</acronym> address per minute.  May be

	      <acronym>IP</acronym> address per minute.  May be

	      overridden on a per-service basis by using

	      overridden on a per-service basis by using

	      <option>max-connections-per-ip-per-minute</option> in

	      <option>max-connections-per-ip-per-minute</option> in

	      <filename>/etc/inetd.conf</filename>.</para>

	      <filename>/etc/inetd.conf</filename>.</para>

	  </listitem>

	  </listitem>

	</varlistentry>

	</varlistentry>

	<varlistentry>

	<varlistentry>

	  <term>-R rate</term>

	  <term>-R rate</term>

	  <listitem>

	  <listitem>

	    <para>Specify the maximum number of times a service can be

	    <para>Specify the maximum number of times a service can be

	      invoked in one minute, where the default is

	      invoked in one minute, where the default is

	      <literal>256</literal>.  A rate of <literal>0</literal>

	      <literal>256</literal>.  A rate of <literal>0</literal>

	      allows an unlimited number.</para>

	      allows an unlimited number.</para>

	  </listitem>

	  </listitem>

	</varlistentry>

	</varlistentry>

	<varlistentry>

	<varlistentry>

	  <term>-s maximum</term>

	  <term>-s maximum</term>

	  <listitem>

	  <listitem>

	    <para>Specify the maximum number of times a service can be

	    <para>Specify the maximum number of times a service can be

	      invoked from a single <acronym>IP</acronym> address at

	      invoked from a single <acronym>IP</acronym> address at

	      any one time, where the default is unlimited.  May be

	      any one time, where the default is unlimited.  May be

	      overridden on a per-service basis by using

	      overridden on a per-service basis by using

	      <option>max-child-per-ip</option> in

	      <option>max-child-per-ip</option> in

	      <filename>/etc/inetd.conf</filename>.</para>

	      <filename>/etc/inetd.conf</filename>.</para>

	  </listitem>

	  </listitem>

	</varlistentry>

	</varlistentry>

      </variablelist>

      </variablelist>

      <para>Additional options are available.  Refer to &man.inetd.8;

      <para>Additional options are available.  Refer to &man.inetd.8;

	for the full list of options.</para>

	for the full list of options.</para>

    </sect2>

    </sect2>

    <sect2 xml:id="network-inetd-security">

    <sect2 xml:id="network-inetd-security">

      <title>Security Considerations</title>

      <title>Security Considerations</title>

      <para>Many of the daemons which can be managed by

      <para>Many of the daemons which can be managed by

	<application>inetd</application> are not security-conscious.

	<application>inetd</application> are not security-conscious.

	Some daemons, such as <application>fingerd</application>, can

	Some daemons, such as <application>fingerd</application>, can

	provide information that may be useful to an attacker.  Only

	provide information that may be useful to an attacker.  Only

	enable the services which are needed and monitor the system

	enable the services which are needed and monitor the system

	for excessive connection attempts.

	for excessive connection attempts.

	<literal>max-connections-per-ip-per-minute</literal>,

	<literal>max-connections-per-ip-per-minute</literal>,

	<literal>max-child</literal> and

	<literal>max-child</literal> and

	<literal>max-child-per-ip</literal> can be used to limit such

	<literal>max-child-per-ip</literal> can be used to limit such

	attacks.</para>

	attacks.</para>

      <para>By default, TCP wrappers is enabled.  Consult

      <para>By default, TCP wrappers is enabled.  Consult

	&man.hosts.access.5; for more information on placing TCP

	&man.hosts.access.5; for more information on placing TCP

	restrictions on various

	restrictions on various

	<application>inetd</application> invoked daemons.</para>

	<application>inetd</application> invoked daemons.</para>

    </sect2>

    </sect2>

  </sect1>

  </sect1>

  <sect1 xml:id="network-nfs">

  <sect1 xml:id="network-nfs">

    <info>

    <info>

      <title>Network File System (NFS)</title>

      <title>Network File System (NFS)</title>

      <authorgroup>

      <authorgroup>

	<author>

	<author>

	  <personname>

	  <personname>

	    <firstname>Tom</firstname>

	    <firstname>Tom</firstname>

	    <surname>Rhodes</surname>

	    <surname>Rhodes</surname>

	  </personname>

	  </personname>

	  <contrib>Reorganized and enhanced by </contrib>

	  <contrib>Reorganized and enhanced by </contrib>

	</author>

	</author>

      </authorgroup>

      </authorgroup>

      <authorgroup>

      <authorgroup>

	<author>

	<author>

	  <personname>

	  <personname>

	    <firstname>Bill</firstname>

	    <firstname>Bill</firstname>

	    <surname>Swingle</surname>

	    <surname>Swingle</surname>

	  </personname>

	  </personname>

	  <contrib>Written by </contrib>

	  <contrib>Written by </contrib>

	</author>

	</author>

      </authorgroup>

      </authorgroup>

    </info>

    </info>

    <indexterm><primary>NFS</primary></indexterm>

    <indexterm><primary>NFS</primary></indexterm>

    <para>&os; supports the Network File System

    <para>&os; supports the Network File System

      (<acronym>NFS</acronym>), which allows a server to share

      (<acronym>NFS</acronym>), which allows a server to share

      directories and files with clients over a network.  With

      directories and files with clients over a network.  With

      <acronym>NFS</acronym>, users and programs can access files on

      <acronym>NFS</acronym>, users and programs can access files on

      remote systems as if they were stored locally.</para>

      remote systems as if they were stored locally.</para>

    <para><acronym>NFS</acronym> has many practical uses.  Some of

    <para><acronym>NFS</acronym> has many practical uses.  Some of

      the more common uses include:</para>

      the more common uses include:</para>

    <itemizedlist>

    <itemizedlist>

      <listitem>

      <listitem>

	<para>Data that would otherwise be duplicated on each client

	<para>Data that would otherwise be duplicated on each client

	  can be kept in a single location and accessed by clients

	  can be kept in a single location and accessed by clients

	  on the network.</para>

	  on the network.</para>

      </listitem>

      </listitem>

      <listitem>

      <listitem>

	<para>Several clients may need access to the

	<para>Several clients may need access to the

	  <filename>/usr/ports/distfiles</filename> directory.

	  <filename>/usr/ports/distfiles</filename> directory.

	  Sharing that directory allows for quick access to the

	  Sharing that directory allows for quick access to the

	  source files without having to download them to each

	  source files without having to download them to each

	  client.</para>

	  client.</para>

      </listitem>

      </listitem>

      <listitem>

      <listitem>

	<para>On large networks, it is often more convenient to

	<para>On large networks, it is often more convenient to

	  configure a central <acronym>NFS</acronym> server on which

	  configure a central <acronym>NFS</acronym> server on which

	  all user home directories are stored.  Users can log into

	  all user home directories are stored.  Users can log into

	  a client anywhere on the network and have access to their

	  a client anywhere on the network and have access to their

	  home directories.</para>

	  home directories.</para>

      </listitem>

      </listitem>

      <listitem>

      <listitem>

	<para>Administration of <acronym>NFS</acronym> exports is

	<para>Administration of <acronym>NFS</acronym> exports is

	  simplified.  For example, there is only one file system

	  simplified.  For example, there is only one file system

	  where security or backup policies must be set.</para>

	  where security or backup policies must be set.</para>

      </listitem>

      </listitem>

      <listitem>

      <listitem>

	<para>Removable media storage devices can be used by other

	<para>Removable media storage devices can be used by other

	  machines on the network.  This reduces the number of devices

	  machines on the network.  This reduces the number of devices

	  throughout the network and provides a centralized location

	  throughout the network and provides a centralized location

	  to manage their security.  It is often more convenient to

	  to manage their security.  It is often more convenient to

	  install software on multiple machines from a centralized

	  install software on multiple machines from a centralized

	  installation media.</para>

	  installation media.</para>

      </listitem>

      </listitem>

    </itemizedlist>

    </itemizedlist>

    <para><acronym>NFS</acronym> consists of a server and one or more

    <para><acronym>NFS</acronym> consists of a server and one or more

      clients.  The client remotely accesses the data that is stored

      clients.  The client remotely accesses the data that is stored

      on the server machine.  In order for this to function properly,

      on the server machine.  In order for this to function properly,

      a few processes have to be configured and running.</para>

      a few processes have to be configured and running.</para>

    <para>These daemons must be running on the server:</para>

    <para>These daemons must be running on the server:</para>

    <indexterm>

    <indexterm>

      <primary>NFS</primary>

      <primary>NFS</primary>

	<secondary>server</secondary>

	<secondary>server</secondary>

     </indexterm>

     </indexterm>

     <indexterm>

     <indexterm>

       <primary>file server</primary>

       <primary>file server</primary>

	<secondary>UNIX clients</secondary>

	<secondary>UNIX clients</secondary>

      </indexterm>

      </indexterm>

      <indexterm>

      <indexterm>

	<primary><application>rpcbind</application></primary>

	<primary><application>rpcbind</application></primary>

      </indexterm>

      </indexterm>

      <indexterm>

      <indexterm>

	<primary><application>mountd</application></primary>

	<primary><application>mountd</application></primary>

      </indexterm>

      </indexterm>

      <indexterm>

      <indexterm>

	<primary><application>nfsd</application></primary>

	<primary><application>nfsd</application></primary>

      </indexterm>

      </indexterm>

      <informaltable frame="none" pgwide="1">

      <informaltable frame="none" pgwide="1">

	<tgroup cols="2">

	<tgroup cols="2">

	  <colspec colwidth="1*"/>

	  <colspec colwidth="1*"/>

	  <colspec colwidth="3*"/>

	  <colspec colwidth="3*"/>

	  <thead>

	  <thead>

	    <row>

	    <row>

	      <entry>Daemon</entry>

	      <entry>Daemon</entry>

	      <entry>Description</entry>

	      <entry>Description</entry>

	    </row>

	    </row>

	  </thead>

	  </thead>

	  <tbody>

	  <tbody>

	    <row>

	    <row>

	      <entry><application>nfsd</application></entry>

	      <entry><application>nfsd</application></entry>

	      <entry>The <acronym>NFS</acronym> daemon which services

	      <entry>The <acronym>NFS</acronym> daemon which services

		requests from <acronym>NFS</acronym> clients.</entry>

		requests from <acronym>NFS</acronym> clients.</entry>

	    </row>

	    </row>

	    <row>

	    <row>

	      <entry><application>mountd</application></entry>

	      <entry><application>mountd</application></entry>

	      <entry>The <acronym>NFS</acronym> mount daemon which

	      <entry>The <acronym>NFS</acronym> mount daemon which

		carries out requests received from

		carries out requests received from

		<application>nfsd</application>.</entry>

		<application>nfsd</application>.</entry>

	    </row>

	    </row>

	    <row>

	    <row>

	      <entry><application>rpcbind</application></entry>

	      <entry><application>rpcbind</application></entry>

	      <entry> This daemon allows <acronym>NFS</acronym>

	      <entry> This daemon allows <acronym>NFS</acronym>

		clients to discover which port the

		clients to discover which port the

		<acronym>NFS</acronym> server is using.</entry>

		<acronym>NFS</acronym> server is using.</entry>

	    </row>

	    </row>

	  </tbody>

	  </tbody>

	</tgroup>

	</tgroup>

      </informaltable>

      </informaltable>

      <para>Running &man.nfsiod.8; on the client can improve

      <para>Running &man.nfsiod.8; on the client can improve

	performance, but is not required.</para>

	performance, but is not required.</para>

      <sect2 xml:id="network-configuring-nfs">

      <sect2 xml:id="network-configuring-nfs">

	<title>Configuring the Server</title>

	<title>Configuring the Server</title>

	<indexterm>

	<indexterm>

	  <primary>NFS</primary>

	  <primary>NFS</primary>

	  <secondary>configuration</secondary>

	  <secondary>configuration</secondary>

	</indexterm>

	</indexterm>

      <para>The file systems which the <acronym>NFS</acronym> server

      <para>The file systems which the <acronym>NFS</acronym> server

	will share are specified in <filename>/etc/exports</filename>.

	will share are specified in <filename>/etc/exports</filename>.

	Each line in this file specifies a file system to be exported,

	Each line in this file specifies a file system to be exported,

	which clients have access to that file system, and any access

	which clients have access to that file system, and any access

	options.  When adding entries to this file, each exported file

	options.  When adding entries to this file, each exported file

	system, its properties, and allowed hosts must occur on a

	system, its properties, and allowed hosts must occur on a

	single line.  If no clients are listed in the entry, then any

	single line.  If no clients are listed in the entry, then any

	client on the network can mount that file system.</para>

	client on the network can mount that file system.</para>

      <indexterm>

      <indexterm>

	<primary>NFS</primary>

	<primary>NFS</primary>

	<secondary>export examples</secondary>

	<secondary>export examples</secondary>

      </indexterm>

      </indexterm>

      <para>The following <filename>/etc/exports</filename> entries

      <para>The following <filename>/etc/exports</filename> entries

	demonstrate how to export file systems.  The examples can be

	demonstrate how to export file systems.  The examples can be

	modified to match the file systems and client names on the

	modified to match the file systems and client names on the

	reader's network.  There are many options that can be used in

	reader's network.  There are many options that can be used in

	this file, but only a few will be mentioned here.  See

	this file, but only a few will be mentioned here.  See

	&man.exports.5; for the full list of options.</para>

	&man.exports.5; for the full list of options.</para>

      <para>This example shows how to export

      <para>This example shows how to export

	<filename>/cdrom</filename> to three hosts named

	<filename>/cdrom</filename> to three hosts named

	<replaceable>alpha</replaceable>,

	<replaceable>alpha</replaceable>,

	<replaceable>bravo</replaceable>, and

	<replaceable>bravo</replaceable>, and

	<replaceable>charlie</replaceable>:</para>

	<replaceable>charlie</replaceable>:</para>

      <programlisting>/cdrom -ro <replaceable>alpha</replaceable> <replaceable>bravo</replaceable> <replaceable>charlie</replaceable></programlisting>

      <programlisting>/cdrom -ro <replaceable>alpha</replaceable> <replaceable>bravo</replaceable> <replaceable>charlie</replaceable></programlisting>

      <para>The <literal>-ro</literal> flag makes the file system

      <para>The <literal>-ro</literal> flag makes the file system

	read-only, preventing clients from making any changes to the

	read-only, preventing clients from making any changes to the

	exported file system.  This example assumes that the host

	exported file system.  This example assumes that the host

	names are either in <acronym>DNS</acronym> or in

	names are either in <acronym>DNS</acronym> or in

	<filename>/etc/hosts</filename>.  Refer to &man.hosts.5; if

	<filename>/etc/hosts</filename>.  Refer to &man.hosts.5; if

	the network does not have a <acronym>DNS</acronym>

	the network does not have a <acronym>DNS</acronym>

	server.</para>

	server.</para>

      <para>The next example exports <filename>/home</filename> to

      <para>The next example exports <filename>/home</filename> to

	three clients by <acronym>IP</acronym> address.  This can be

	three clients by <acronym>IP</acronym> address.  This can be

	useful for networks without <acronym>DNS</acronym> or

	useful for networks without <acronym>DNS</acronym> or

	<filename>/etc/hosts</filename> entries.  The

	<filename>/etc/hosts</filename> entries.  The

	<literal>-alldirs</literal> flag allows subdirectories to be

	<literal>-alldirs</literal> flag allows subdirectories to be

	mount points.  In other words, it will not automatically mount

	mount points.  In other words, it will not automatically mount

	the subdirectories, but will permit the client to mount the

	the subdirectories, but will permit the client to mount the

	directories that are required as needed.</para>

	directories that are required as needed.</para>

      <programlisting>/usr/home  -alldirs  10.0.0.2 10.0.0.3 10.0.0.4</programlisting>

      <programlisting>/usr/home  -alldirs  10.0.0.2 10.0.0.3 10.0.0.4</programlisting>

      <para>This next example exports <filename>/a</filename> so that

      <para>This next example exports <filename>/a</filename> so that

	two clients from different domains may access that file

	two clients from different domains may access that file

	system.  The <option>-maproot=root</option> allows <systemitem

	system.  The <option>-maproot=root</option> allows <systemitem

	  class="username">root</systemitem> on the remote system to

	  class="username">root</systemitem> on the remote system to

	write data on the exported file system as <systemitem

	write data on the exported file system as <systemitem

	  class="username">root</systemitem>.  If

	  class="username">root</systemitem>.  If

	<literal>-maproot=root</literal> is not specified, the

	<literal>-maproot=root</literal> is not specified, the

	client's <systemitem class="username">root</systemitem> user

	client's <systemitem class="username">root</systemitem> user

	will be mapped to the server's <systemitem

	will be mapped to the server's <systemitem

	  class="username">nobody</systemitem> account and will be

	  class="username">nobody</systemitem> account and will be

	subject to the access limitations defined for <systemitem

	subject to the access limitations defined for <systemitem

	  class="username">nobody</systemitem>.</para>

	  class="username">nobody</systemitem>.</para>

      <programlisting>/a  -maproot=root  host.example.com box.example.org</programlisting>

      <programlisting>/a  -maproot=root  host.example.com box.example.org</programlisting>

      <para>A client can only be specified once per file system.  For

      <para>A client can only be specified once per file system.  For

	example, if <filename>/usr</filename> is a single file system,

	example, if <filename>/usr</filename> is a single file system,

	these entries would be invalid as both entries specify the

	these entries would be invalid as both entries specify the

	same host:</para>

	same host:</para>

      <programlisting># Invalid when /usr is one file system

      <programlisting># Invalid when /usr is one file system

/usr/src   client

/usr/src   client

/usr/ports client</programlisting>

/usr/ports client</programlisting>

      <para>The correct format for this situation is to use one

      <para>The correct format for this situation is to use one

	entry:</para>

	entry:</para>

      <programlisting>/usr/src /usr/ports  client</programlisting>

      <programlisting>/usr/src /usr/ports  client</programlisting>

      <para>The following is an example of a valid export list, where

      <para>The following is an example of a valid export list, where

	<filename>/usr</filename> and <filename>/exports</filename>

	<filename>/usr</filename> and <filename>/exports</filename>

	are local file systems:</para>

	are local file systems:</para>

      <programlisting># Export src and ports to client01 and client02, but only

      <programlisting># Export src and ports to client01 and client02, but only

# client01 has root privileges on it

# client01 has root privileges on it

/usr/src /usr/ports -maproot=root    client01

/usr/src /usr/ports -maproot=root    client01

/usr/src /usr/ports               client02

/usr/src /usr/ports               client02

# The client machines have root and can mount anywhere

# The client machines have root and can mount anywhere

# on /exports. Anyone in the world can mount /exports/obj read-only

# on /exports. Anyone in the world can mount /exports/obj read-only

/exports -alldirs -maproot=root      client01 client02

/exports -alldirs -maproot=root      client01 client02

/exports/obj -ro</programlisting>

/exports/obj -ro</programlisting>

      <para>To enable the processes required by the

      <para>To enable the processes required by the

	<acronym>NFS</acronym> server at boot time, add these options

	<acronym>NFS</acronym> server at boot time, add these options

	to <filename>/etc/rc.conf</filename>:</para>

	to <filename>/etc/rc.conf</filename>:</para>

      <programlisting>rpcbind_enable="YES"

      <programlisting>rpcbind_enable="YES"

nfs_server_enable="YES"

nfs_server_enable="YES"

mountd_flags="-r"</programlisting>

mountd_flags="-r"</programlisting>

      <para>The server can be started now by running this

      <para>The server can be started now by running this

	command:</para>

	command:</para>

      <screen>&prompt.root; <userinput>service nfsd start</userinput></screen>

      <screen>&prompt.root; <userinput>service nfsd start</userinput></screen>

      <para>Whenever the <acronym>NFS</acronym> server is started,

      <para>Whenever the <acronym>NFS</acronym> server is started,

	<application>mountd</application> also starts automatically.

	<application>mountd</application> also starts automatically.

	However, <application>mountd</application> only reads

	However, <application>mountd</application> only reads

	<filename>/etc/exports</filename> when it is started.  To make

	<filename>/etc/exports</filename> when it is started.  To make

	subsequent <filename>/etc/exports</filename> edits take effect

	subsequent <filename>/etc/exports</filename> edits take effect

	immediately, force <application>mountd</application> to reread

	immediately, force <application>mountd</application> to reread

	it:</para>

	it:</para>

      <screen>&prompt.root; <userinput>service mountd reload</userinput></screen>

      <screen>&prompt.root; <userinput>service mountd reload</userinput></screen>

    </sect2>

    </sect2>

    <sect2>

    <sect2>

      <title>Configuring the Client</title>

      <title>Configuring the Client</title>

      <para>To enable <acronym>NFS</acronym> clients, set this option

      <para>To enable <acronym>NFS</acronym> clients, set this option

	in each client's <filename>/etc/rc.conf</filename>:</para>

	in each client's <filename>/etc/rc.conf</filename>:</para>

      <programlisting>nfs_client_enable="YES"</programlisting>

      <programlisting>nfs_client_enable="YES"</programlisting>

      <para>Then, run this command on each <acronym>NFS</acronym>

      <para>Then, run this command on each <acronym>NFS</acronym>

	client:</para>

	client:</para>

      <screen>&prompt.root; <userinput>service nfsclient start</userinput></screen>

      <screen>&prompt.root; <userinput>service nfsclient start</userinput></screen>

      <para>The client now has everything it needs to mount a remote

      <para>The client now has everything it needs to mount a remote

	file system.  In these examples, the server's name is

	file system.  In these examples, the server's name is

	<systemitem>server</systemitem> and the client's name is

	<systemitem>server</systemitem> and the client's name is

	<systemitem>client</systemitem>.  To mount

	<systemitem>client</systemitem>.  To mount

	<filename>/home</filename> on

	<filename>/home</filename> on

	<systemitem>server</systemitem> to the

	<systemitem>server</systemitem> to the

	<filename>/mnt</filename> mount point on

	<filename>/mnt</filename> mount point on

	<systemitem>client</systemitem>:</para>

	<systemitem>client</systemitem>:</para>

      <indexterm>

      <indexterm>

	<primary>NFS</primary>

	<primary>NFS</primary>

	<secondary>mounting</secondary>

	<secondary>mounting</secondary>

      </indexterm>

      </indexterm>

      <screen>&prompt.root; <userinput>mount server:/home /mnt</userinput></screen>

      <screen>&prompt.root; <userinput>mount server:/home /mnt</userinput></screen>

      <para>The files and directories in

      <para>The files and directories in

	<filename>/home</filename> will now be available on

	<filename>/home</filename> will now be available on

	<systemitem>client</systemitem>, in the

	<systemitem>client</systemitem>, in the

	<filename>/mnt</filename> directory.</para>

	<filename>/mnt</filename> directory.</para>

      <para>To mount a remote file system each time the client boots,

      <para>To mount a remote file system each time the client boots,

	add it to <filename>/etc/fstab</filename>:</para>

	add it to <filename>/etc/fstab</filename>:</para>

      <programlisting>server:/home	/mnt	nfs	rw	0	0</programlisting>

      <programlisting>server:/home	/mnt	nfs	rw	0	0</programlisting>

      <para>Refer to &man.fstab.5; for a description of all available

      <para>Refer to &man.fstab.5; for a description of all available

	options.</para>

	options.</para>

    </sect2>

    </sect2>

    <sect2>

    <sect2>

      <title>Locking</title>

      <title>Locking</title>

      <para>Some applications require file locking to operate

      <para>Some applications require file locking to operate

	correctly.  To enable locking, add these lines to

	correctly.  To enable locking, add these lines to

	<filename>/etc/rc.conf</filename> on both the client and

	<filename>/etc/rc.conf</filename> on both the client and

	server:</para>

	server:</para>

      <programlisting>rpc_lockd_enable="YES"

      <programlisting>rpc_lockd_enable="YES"

rpc_statd_enable="YES"</programlisting>

rpc_statd_enable="YES"</programlisting>

      <para>Then start the applications:</para>

      <para>Then start the applications:</para>

      <screen>&prompt.root; <userinput>service lockd start</userinput>

      <screen>&prompt.root; <userinput>service lockd start</userinput>

&prompt.root; <userinput>service statd start</userinput></screen>

&prompt.root; <userinput>service statd start</userinput></screen>

      <para>If locking is not required on the server, the

      <para>If locking is not required on the server, the

	<acronym>NFS</acronym> client can be configured to lock

	<acronym>NFS</acronym> client can be configured to lock

	locally by including <option>-L</option> when running

	locally by including <option>-L</option> when running

	<application>mount</application>.  Refer to &man.mount.nfs.8;

	<application>mount</application>.  Refer to &man.mount.nfs.8;

	for further details.</para>

	for further details.</para>

    </sect2>

    </sect2>

    <sect2 xml:id="network-amd">

    <sect2 xml:id="network-amd">

      <info>

      <info>

	<title>Automating Mounts with &man.amd.8;</title>

	<title>Automating Mounts with &man.amd.8;</title>

	<authorgroup>

	<authorgroup>

	  <author>

	  <author>

	    <personname>

	    <personname>

	      <firstname>Wylie</firstname>

	      <firstname>Wylie</firstname>

	      <surname>Stilwell</surname>

	      <surname>Stilwell</surname>

	    </personname>

	    </personname>

	    <contrib>Contributed by </contrib>

	    <contrib>Contributed by </contrib>

	  </author>

	  </author>

	</authorgroup>

	</authorgroup>

	<authorgroup>

	<authorgroup>

	  <author>

	  <author>

	    <personname>

	    <personname>

	      <firstname>Chern</firstname>

	      <firstname>Chern</firstname>

	      <surname>Lee</surname>

	      <surname>Lee</surname>

	    </personname>

	    </personname>

	    <contrib>Rewritten by </contrib>

	    <contrib>Rewritten by </contrib>

	  </author>

	  </author>

	</authorgroup>

	</authorgroup>

      </info>

      </info>

      <indexterm><primary>amd</primary></indexterm>

      <indexterm><primary>amd</primary></indexterm>

      <indexterm>

      <indexterm>

	<primary>automatic mounter daemon</primary>

	<primary>automatic mounter daemon</primary>

      </indexterm>

      </indexterm>

      <para>The automatic mounter daemon,

      <para>The automatic mounter daemon,

	<application>amd</application>, automatically mounts a remote

	<application>amd</application>, automatically mounts a remote

	file system whenever a file or directory within that file

	file system whenever a file or directory within that file

	system is accessed.  File systems that are inactive for a

	system is accessed.  File systems that are inactive for a

	period of time will be automatically unmounted by

	period of time will be automatically unmounted by

	<application>amd</application>.</para>

	<application>amd</application>.</para>

      <para>This daemon provides an alternative to modifying

      <para>This daemon provides an alternative to modifying

	<filename>/etc/fstab</filename> to list every client.  It

	<filename>/etc/fstab</filename> to list every client.  It

	operates by attaching itself as an  <acronym>NFS</acronym>

	operates by attaching itself as an  <acronym>NFS</acronym>

	server to the <filename>/host</filename> and

	server to the <filename>/host</filename> and

	<filename>/net</filename> directories.  When a file is

	<filename>/net</filename> directories.  When a file is

	accessed within one of these directories,

	accessed within one of these directories,

	<application>amd</application> looks up the corresponding

	<application>amd</application> looks up the corresponding

	remote mount and automatically mounts it.

	remote mount and automatically mounts it.

	<filename>/net</filename> is used to mount an exported file

	<filename>/net</filename> is used to mount an exported file

	system from an <acronym>IP</acronym> address while

	system from an <acronym>IP</acronym> address while

	<filename>/host</filename> is used to mount an export from a

	<filename>/host</filename> is used to mount an export from a

	remote hostname.  For instance, an attempt to access a file

	remote hostname.  For instance, an attempt to access a file

	within <filename>/host/foobar/usr</filename> would tell

	within <filename>/host/foobar/usr</filename> would tell

	<application>amd</application> to mount the

	<application>amd</application> to mount the

	<filename>/usr</filename> export on the host

	<filename>/usr</filename> export on the host

	<systemitem>foobar</systemitem>.</para>

	<systemitem>foobar</systemitem>.</para>

      <example>

      <example>

	<title>Mounting an Export with

	<title>Mounting an Export with

	  <application>amd</application></title>

	  <application>amd</application></title>

	<para>In this example, <command>showmount -e</command> shows

	<para>In this example, <command>showmount -e</command> shows

	  the exported file systems that can be mounted from the

	  the exported file systems that can be mounted from the

	  <acronym>NFS</acronym> server,

	  <acronym>NFS</acronym> server,

	  <systemitem>foobar</systemitem>:</para>

	  <systemitem>foobar</systemitem>:</para>

	<screen>&prompt.user; <userinput>showmount -e foobar</userinput>

	<screen>&prompt.user; <userinput>showmount -e foobar</userinput>

Exports list on foobar:

Exports list on foobar:

/usr                               10.10.10.0

/usr                               10.10.10.0

/a                                 10.10.10.0

/a                                 10.10.10.0

&prompt.user; <userinput>cd /host/foobar/usr</userinput></screen>

&prompt.user; <userinput>cd /host/foobar/usr</userinput></screen>

      </example>

      </example>

      <para>The output from <command>showmount</command> shows

      <para>The output from <command>showmount</command> shows

	<filename>/usr</filename> as an export.  When changing

	<filename>/usr</filename> as an export.  When changing

	directories to <filename>/host/foobar/usr</filename>,

	directories to <filename>/host/foobar/usr</filename>,

	<application>amd</application> intercepts the request and

	<application>amd</application> intercepts the request and

	attempts to resolve the hostname

	attempts to resolve the hostname

	<systemitem>foobar</systemitem>.  If successful,

	<systemitem>foobar</systemitem>.  If successful,

	<application>amd</application> automatically mounts the

	<application>amd</application> automatically mounts the

	desired export.</para>

	desired export.</para>

      <para>To enable <application>amd</application> at boot time, add

      <para>To enable <application>amd</application> at boot time, add

	this line to <filename>/etc/rc.conf</filename>:</para>

	this line to <filename>/etc/rc.conf</filename>:</para>

      <programlisting>amd_enable="YES"</programlisting>

      <programlisting>amd_enable="YES"</programlisting>

      <para>To start <application>amd</application> now:</para>

      <para>To start <application>amd</application> now:</para>

      <screen>&prompt.root; <userinput>service amd start</userinput></screen>

      <screen>&prompt.root; <userinput>service amd start</userinput></screen>

      <para>Custom flags can be passed to

      <para>Custom flags can be passed to

	<application>amd</application> from the

	<application>amd</application> from the

	<varname>amd_flags</varname> environment variable.  By

	<varname>amd_flags</varname> environment variable.  By

	default, <varname>amd_flags</varname> is set to:</para>

	default, <varname>amd_flags</varname> is set to:</para>

      <programlisting>amd_flags="-a /.amd_mnt -l syslog /host /etc/amd.map /net /etc/amd.map"</programlisting>

      <programlisting>amd_flags="-a /.amd_mnt -l syslog /host /etc/amd.map /net /etc/amd.map"</programlisting>

      <para>The default options with which exports are mounted are

      <para>The default options with which exports are mounted are

	defined in <filename>/etc/amd.map</filename>.  Some of the

	defined in <filename>/etc/amd.map</filename>.  Some of the

	more advanced features of <application>amd</application> are

	more advanced features of <application>amd</application> are

	defined in <filename>/etc/amd.conf</filename>.</para>

	defined in <filename>/etc/amd.conf</filename>.</para>

      <para>Consult &man.amd.8; and &man.amd.conf.5; for more

      <para>Consult &man.amd.8; and &man.amd.conf.5; for more

	information.</para>

	information.</para>

    </sect2>

    </sect2>

    <sect2 xml:id="network-autofs">

    <sect2 xml:id="network-autofs">

      <title>Automating Mounts with &man.autofs.5;</title>

      <title>Automating Mounts with &man.autofs.5;</title>

      <note>

      <note>

	<para>The &man.autofs.5; automount facility is supported

	<para>The &man.autofs.5; automount facility is supported

	  starting with &os; 10.1-RELEASE.  To use the

	  starting with &os; 10.1-RELEASE.  To use the

	  automounter functionality in older versions of &os;, use

	  automounter functionality in older versions of &os;, use

	  &man.amd.8; instead.  This chapter only describes the

	  &man.amd.8; instead.  This chapter only describes the

	  &man.autofs.5; automounter.</para>

	  &man.autofs.5; automounter.</para>

      </note>

      </note>

      <indexterm><primary>autofs</primary></indexterm>

      <indexterm><primary>autofs</primary></indexterm>

      <indexterm>

      <indexterm>

	<primary>automounter subsystem</primary>

	<primary>automounter subsystem</primary>

      </indexterm>

      </indexterm>

      <para>The &man.autofs.5; facility is a common name for several

      <para>The &man.autofs.5; facility is a common name for several

	components that, together, allow for automatic mounting of

	components that, together, allow for automatic mounting of

	remote and local filesystems whenever a file or directory

	remote and local filesystems whenever a file or directory

	within that file system is accessed.  It consists of the

	within that file system is accessed.  It consists of the

	kernel component, &man.autofs.5;, and several userspace

	kernel component, &man.autofs.5;, and several userspace

	applications: &man.automount.8;, &man.automountd.8; and

	applications: &man.automount.8;, &man.automountd.8; and

	&man.autounmountd.8;.  It serves as an alternative for

	&man.autounmountd.8;.  It serves as an alternative for

	&man.amd.8; from previous &os; releases.  Amd is still

	&man.amd.8; from previous &os; releases.  Amd is still

	provided for backward compatibility purposes, as the two use

	provided for backward compatibility purposes, as the two use

	different map format; the one used by autofs is the same as

	different map format; the one used by autofs is the same as

	with other SVR4 automounters, such as the ones in Solaris,

	with other SVR4 automounters, such as the ones in Solaris,

	MacOS X, and Linux.</para>

	MacOS X, and Linux.</para>

      <para>The &man.autofs.5; virtual filesystem is mounted on

      <para>The &man.autofs.5; virtual filesystem is mounted on

	specified mountpoints by &man.automount.8;, usually invoked

	specified mountpoints by &man.automount.8;, usually invoked

	during boot.</para>

	during boot.</para>

      <para>Whenever a process attempts to access file within the

      <para>Whenever a process attempts to access file within the

	&man.autofs.5; mountpoint, the kernel will notify

	&man.autofs.5; mountpoint, the kernel will notify

	&man.automountd.8; daemon and pause the triggering process.

	&man.automountd.8; daemon and pause the triggering process.

	The &man.automountd.8; daemon will handle kernel requests by

	The &man.automountd.8; daemon will handle kernel requests by

	finding the proper map and mounting the filesystem according

	finding the proper map and mounting the filesystem according

	to it, then signal the kernel to release blocked process.  The

	to it, then signal the kernel to release blocked process.  The

	&man.autounmountd.8; daemon automatically unmounts automounted

	&man.autounmountd.8; daemon automatically unmounts automounted

	filesystems after some time, unless they are still being

	filesystems after some time, unless they are still being

	used.</para>

	used.</para>

      <para>The primary autofs configuration file is

      <para>The primary autofs configuration file is

	<filename>/etc/auto_master</filename>.  It assigns individual

	<filename>/etc/auto_master</filename>.  It assigns individual

	maps to top-level mounts.  For an explanation of

	maps to top-level mounts.  For an explanation of

	<filename>auto_master</filename> and the map syntax, refer to

	<filename>auto_master</filename> and the map syntax, refer to

	&man.auto.master.5;.</para>

	&man.auto.master.5;.</para>

      <para>There is a special automounter map mounted on

      <para>There is a special automounter map mounted on

	<filename>/net</filename>.  When a file is accessed within

	<filename>/net</filename>.  When a file is accessed within

	this directory, &man.autofs.5; looks up the corresponding

	this directory, &man.autofs.5; looks up the corresponding

	remote mount and automatically mounts it.  For instance, an

	remote mount and automatically mounts it.  For instance, an

	attempt to access a file within

	attempt to access a file within

	<filename>/net/foobar/usr</filename> would tell

	<filename>/net/foobar/usr</filename> would tell

	&man.automountd.8; to mount the <filename

	&man.automountd.8; to mount the <filename

	  >/usr</filename> export from the host

	  >/usr</filename> export from the host

	<systemitem class="fqdomainname">foobar</systemitem>.</para>

	<systemitem class="fqdomainname">foobar</systemitem>.</para>

      <example>

      <example>

	<title>Mounting an Export with &man.autofs.5;</title>

	<title>Mounting an Export with &man.autofs.5;</title>

	<para>In this example, <command>showmount -e</command> shows

	<para>In this example, <command>showmount -e</command> shows

	  the exported file systems that can be mounted from the

	  the exported file systems that can be mounted from the

	  <acronym>NFS</acronym> server,

	  <acronym>NFS</acronym> server,

	  <systemitem class="fqdomainname">foobar</systemitem>:</para>

	  <systemitem class="fqdomainname">foobar</systemitem>:</para>

	<screen>&prompt.user; <userinput>showmount -e foobar</userinput>

	<screen>&prompt.user; <userinput>showmount -e foobar</userinput>

Exports list on foobar:

Exports list on foobar:

/usr                               10.10.10.0

/usr                               10.10.10.0

/a                                 10.10.10.0

/a                                 10.10.10.0

&prompt.user; <userinput>cd /net/foobar/usr</userinput></screen>

&prompt.user; <userinput>cd /net/foobar/usr</userinput></screen>

      </example>

      </example>

      <para>The output from <command>showmount</command> shows

      <para>The output from <command>showmount</command> shows

	<filename>/usr</filename> as an export.

	<filename>/usr</filename> as an export.

	When changing directories to <filename

	When changing directories to <filename

	  >/host/foobar/usr</filename>,

	  >/host/foobar/usr</filename>,

	&man.automountd.8; intercepts the request and attempts to

	&man.automountd.8; intercepts the request and attempts to

	resolve the hostname <systemitem

	resolve the hostname <systemitem

	  class="fqdomainname">foobar</systemitem>.  If successful,

	  class="fqdomainname">foobar</systemitem>.  If successful,

	&man.automountd.8; automatically mounts the source

	&man.automountd.8; automatically mounts the source

	export.</para>

	export.</para>

      <para>To enable &man.autofs.5; at boot time, add this line to

      <para>To enable &man.autofs.5; at boot time, add this line to

	<filename>/etc/rc.conf</filename>:</para>

	<filename>/etc/rc.conf</filename>:</para>

      <programlisting>autofs_enable="YES"</programlisting>

      <programlisting>autofs_enable="YES"</programlisting>

      <para>Then &man.autofs.5; can be started by running:</para>

      <para>Then &man.autofs.5; can be started by running:</para>

      <screen>&prompt.root; <userinput>service automount start</userinput>

      <screen>&prompt.root; <userinput>service automount start</userinput>

&prompt.root; <userinput>service automountd start</userinput>

&prompt.root; <userinput>service automountd start</userinput>

&prompt.root; <userinput>service autounmountd start</userinput></screen>

&prompt.root; <userinput>service autounmountd start</userinput></screen>

      <para>The &man.autofs.5; map format is the same as in other

      <para>The &man.autofs.5; map format is the same as in other

	  OS X document</link>.</para>

	  OS X document</link>.</para>

      <para>Consult the &man.automount.8;, &man.automountd.8;,

      <para>Consult the &man.automount.8;, &man.automountd.8;,

	&man.autounmountd.8;, and &man.auto.master.5; manual pages for

	&man.autounmountd.8;, and &man.auto.master.5; manual pages for

	more information.</para>

	more information.</para>

    </sect2>

    </sect2>

  </sect1>

  </sect1>

  <sect1 xml:id="network-nis">

  <sect1 xml:id="network-nis">

    <!--

    <!--

    <sect1info>

    <sect1info>

      <authorgroup>

      <authorgroup>

	<author>

	<author>

	  <firstname>Bill</firstname>

	  <firstname>Bill</firstname>

	  <surname>Swingle</surname>

	  <surname>Swingle</surname>

	  <contrib>Written by </contrib>

	  <contrib>Written by </contrib>

	</author>

	</author>

      </authorgroup>

      </authorgroup>

      <authorgroup>

      <authorgroup>

	<author>

	<author>

	  <firstname>Eric</firstname>

	  <firstname>Eric</firstname>

	  <surname>Ogren</surname>

	  <surname>Ogren</surname>

	  <contrib>Enhanced by </contrib>

	  <contrib>Enhanced by </contrib>

	</author>

	</author>

	<author>

	<author>

	  <firstname>Udo</firstname>

	  <firstname>Udo</firstname>

	  <surname>Erdelhoff</surname>

	  <surname>Erdelhoff</surname>

	</author>

	</author>

      </authorgroup>

      </authorgroup>

    </sect1info>

    </sect1info>

    -->

    -->

    <title>Network Information System

    <title>Network Information System

      (<acronym>NIS</acronym>)</title>

      (<acronym>NIS</acronym>)</title>

    <indexterm><primary>NIS</primary></indexterm>

    <indexterm><primary>NIS</primary></indexterm>

    <indexterm><primary>Solaris</primary></indexterm>

    <indexterm><primary>Solaris</primary></indexterm>

    <indexterm><primary>HP-UX</primary></indexterm>

    <indexterm><primary>HP-UX</primary></indexterm>

    <indexterm><primary>AIX</primary></indexterm>

    <indexterm><primary>AIX</primary></indexterm>

    <indexterm><primary>Linux</primary></indexterm>

    <indexterm><primary>Linux</primary></indexterm>

    <indexterm><primary>NetBSD</primary></indexterm>

    <indexterm><primary>NetBSD</primary></indexterm>

    <indexterm><primary>OpenBSD</primary></indexterm>

    <indexterm><primary>OpenBSD</primary></indexterm>

    <indexterm>

    <indexterm>

      <primary>yellow pages</primary>

      <primary>yellow pages</primary>

      <see>NIS</see>

      <see>NIS</see>

    </indexterm>

    </indexterm>

    <para>Network Information System (<acronym>NIS</acronym>) is

    <para>Network Information System (<acronym>NIS</acronym>) is

      designed to centralize administration of &unix;-like systems

      designed to centralize administration of &unix;-like systems

      such as &solaris;, HP-UX, &aix;, Linux, NetBSD, OpenBSD, and

      such as &solaris;, HP-UX, &aix;, Linux, NetBSD, OpenBSD, and

      &os;.  <acronym>NIS</acronym> was originally known as Yellow

      &os;.  <acronym>NIS</acronym> was originally known as Yellow

      Pages but the name was changed due to trademark issues.   This

      Pages but the name was changed due to trademark issues.   This

      is the reason why <acronym>NIS</acronym> commands begin with

      is the reason why <acronym>NIS</acronym> commands begin with

      <literal>yp</literal>.</para>

      <literal>yp</literal>.</para>

    <indexterm>

    <indexterm>

      <primary>NIS</primary>

      <primary>NIS</primary>

      <secondary>domains</secondary>

      <secondary>domains</secondary>

      </indexterm>

      </indexterm>

    <para><acronym>NIS</acronym> is a Remote Procedure Call

    <para><acronym>NIS</acronym> is a Remote Procedure Call

      (<acronym>RPC</acronym>)-based client/server system that allows

      (<acronym>RPC</acronym>)-based client/server system that allows

      a group of machines within an <acronym>NIS</acronym> domain to

      a group of machines within an <acronym>NIS</acronym> domain to

      share a common set of configuration files.  This permits a

      share a common set of configuration files.  This permits a

      system administrator to set up <acronym>NIS</acronym> client

      system administrator to set up <acronym>NIS</acronym> client

      systems with only minimal configuration data and to add, remove,

      systems with only minimal configuration data and to add, remove,

      or modify configuration data from a single location.</para>

      or modify configuration data from a single location.</para>

    <para>&os; uses version 2 of the <acronym>NIS</acronym>

    <para>&os; uses version 2 of the <acronym>NIS</acronym>

      protocol.</para>

      protocol.</para>

    <sect2>

    <sect2>

      <title><acronym>NIS</acronym> Terms and Processes</title>

      <title><acronym>NIS</acronym> Terms and Processes</title>

      <para>Table 28.1 summarizes the terms and important processes

      <para>Table 28.1 summarizes the terms and important processes

	used by <acronym>NIS</acronym>:</para>

	used by <acronym>NIS</acronym>:</para>

      <indexterm>

      <indexterm>

	<primary><application>rpcbind</application></primary>

	<primary><application>rpcbind</application></primary>

      </indexterm>

      </indexterm>

      <indexterm>

      <indexterm>

	<primary><application>portmap</application></primary>

	<primary><application>portmap</application></primary>

      </indexterm>

      </indexterm>

      <table frame="none" pgwide="1">

      <table frame="none" pgwide="1">

	<title><acronym>NIS</acronym> Terminology</title>

	<title><acronym>NIS</acronym> Terminology</title>

	<tgroup cols="2">

	<tgroup cols="2">

	  <colspec colwidth="1*"/>

	  <colspec colwidth="1*"/>

	  <colspec colwidth="3*"/>

	  <colspec colwidth="3*"/>

	  <thead>

	  <thead>

	    <row>

	    <row>

	      <entry>Term</entry>

	      <entry>Term</entry>

	      <entry>Description</entry>

	      <entry>Description</entry>

	    </row>

	    </row>

	  </thead>

	  </thead>

	  <tbody>

	  <tbody>

	    <row>

	    <row>

	      <entry><acronym>NIS</acronym> domain name</entry>

	      <entry><acronym>NIS</acronym> domain name</entry>

	      <entry><acronym>NIS</acronym> servers and clients share

	      <entry><acronym>NIS</acronym> servers and clients share

		an <acronym>NIS</acronym> domain name.  Typically,

		an <acronym>NIS</acronym> domain name.  Typically,

		this name does not have anything to do with

		this name does not have anything to do with

		<acronym>DNS</acronym>.</entry>

		<acronym>DNS</acronym>.</entry>

	    </row>

	    </row>

	    <row>

	    <row>

	      <entry>&man.rpcbind.8;</entry>

	      <entry>&man.rpcbind.8;</entry>

	      <entry>This service enables <acronym>RPC</acronym> and

	      <entry>This service enables <acronym>RPC</acronym> and

		must be running in order to run an

		must be running in order to run an

		<acronym>NIS</acronym> server or act as an

		<acronym>NIS</acronym> server or act as an

		<acronym>NIS</acronym> client.</entry>

		<acronym>NIS</acronym> client.</entry>

	    </row>

	    </row>

	    <row>

	    <row>

	      <entry>&man.ypbind.8;</entry>

	      <entry>&man.ypbind.8;</entry>

	      <entry>This service binds an <acronym>NIS</acronym>

	      <entry>This service binds an <acronym>NIS</acronym>

		client to its <acronym>NIS</acronym> server.  It will

		client to its <acronym>NIS</acronym> server.  It will

		take the <acronym>NIS</acronym> domain name and use

		take the <acronym>NIS</acronym> domain name and use

		<acronym>RPC</acronym> to connect to the server.  It

		<acronym>RPC</acronym> to connect to the server.  It

		is the core of client/server communication in an

		is the core of client/server communication in an

		<acronym>NIS</acronym> environment.  If this service

		<acronym>NIS</acronym> environment.  If this service

		is not running on a client machine, it will not be

		is not running on a client machine, it will not be

		able to access the <acronym>NIS</acronym>

		able to access the <acronym>NIS</acronym>

		server.</entry>

		server.</entry>