If you installed with the Kernel Developer option you should have the source tree, if you aren't sure look for the directory '/usr/src/sys' ( ls /usr/src/sys ) or more specifically '/usr/src/sys/i386/conf' ( ls /usr/src/sys/i386/conf ). if you have both of these and they are not empty..kewl!

How about we update the source tree to current before going off and building a kernel, eh? If this is a nice fresh install from a new .iso or you just don't care you can skip the next part.

a. (without ports) execute /stand/sysinstall, select 'configure', 'packages', 'ftp', '<ftp server of choice..i like ftp2.freebsd.org>'. first go to 'net', scroll down and select 'cvsup-without-gui', then 'ok' to return to the previous listing. and select 'install'. wait for it to do it's thing and then exit from the utility.
b. (with ports) cd /usr/ports/net/cvsup-without-gui, then make install clean, wait...
c. Create a cvsup file..i normally do two..one for ports and one for source in the /usr dir. use ee or vi to create the file as follows:

edit cvs.src

#begin file: *default tag=. *default host=cvsup2.freebsd.org *default prefix=/usr *default base=/usr/local/etc/cvsup/sup *default cvs delete use-rel-suffix compress src-all release=cvs tag=RELENG_4_8 #end file

about the only thing to pay attention to here is the 'host', and the 'tag'. 'tag' is the release you want to get, and 'host' is who you want to get it from. Hard, eh?

d. Create the directories that cvsup will want when you run it: mkdir -p /usr/local/etc/cvsup/sup
e. Since you just installed a new program you want to use, you will need to type rehash to get bsd to rescan the paths for new files. once done cd /usr then cvsup cvs.src and wait for it to complete.

cd /usr/src/sys/i386/conf to get there, then make a copy of the GENERIC kernel..i normally just call it kern2 for starts. cp GENERIC kern2

go through the file and read all the nifty little comments. they are extremely helpful in explaining what all those options and devices are. another excellent source is the LINT file in the same directory. PLEASE FOR THE LOVE OF GOD DO NOT BUILD A KERNEL FROM LINT!! Lint helps out mostly in customizing your kernel for your specific CPU, Sound Support, some application tweaks, and if you are so inclined, Firewall options. Some basics i always have:

# Samba Stuff
options SMBFS	# Samba Filesystem Support
options NETSMB	# Basic Samba Support
options NETSMBCRYPTO	# Windows Encrypted Password Support
options LIBICONV	# Needed by NETSMBCRYPTO
options LIBMCHAIN	# Needed by NETSMBCRYPTO
options SUIDDIR	# Helps Samba with file/directory Permissions
# Sound Stuff
device pcm	# New PCI Sound Driver
device sbc	# Soundblaster pcm Audio Bridge Driver
# Video Tweak
options VESA	# Enables Kernel VESA support (makes splash look better)
# Console Tweaks
options SC_DISABLE_DDBKEY	# Disables Debugging Keys
options SC_DISABLE_REBOOT	# Disables rebooting with Ctrl+Alt+Del
options SC_TWOBUTTON_MOUSE	# Enables Console Cut/Paste w/ Mouse
# CPU Tweaks
options CPU_WT_ALLOC	# AMD Cache Tweak
options CPU_ENABLE_SSE	# Enable MMX/3dNow! Extensions
options CPU_ATHLON_SSE_HACK	# Athlon Hack in case Extensions were not enabled in BIOS
options NO_MEMORY_HOLE	# Disables 15-16 MB Memory Hole (non-Intel Systems)
options CPU_FASTER_5X86_FPU	# Uses Faster Floating Point Algorithm

config -r kern2..if there are no errors then to get on with compiling and automatically reboot when done cd ../../compile/kern2 && make depend && make && make install && reboot now. the && strings the commands together in such a way that if any one fails the next will not be executed.

if by chance something has gone awry when booting though, reboot again, when it says 'hit enter to boot or any key..blah blah blah'..hit any other key. at the prompt type unload, then load kernel.GENERIC, then boot. this will boot you with the original GENERIC kernel. that way you can go back in and fix whatever has gone wrong. one note..if you have an ATHLON, you need to specify the cpu type of i686 to correctly identify the processor.

This is about as easy as it gets. The cvs.src supfile used for upgrading the kernel sources actually updated the entire source tree. so if you have done this recently, just cd /usr/src and type make world. told ya it was hard.

if you are upgrading because a new release has come out i'd recommend updating your sources, doing the make world then going back and rebuilding the kernel from your previous config file. that keeps the kernel in sync with the release, though it is not totally necessary.

Take extreme care when editing the rc.conf. if you miss a single quotation mark you could cause yourself a headache as the machine may not boot normally. If this occurs the standard '/' mount will be probably set read-only. makes fixing the problem kinda hard when the filesystem is mounted read-only, eh? one way to solve this is to from the /etc directory run /bin/mount -a. this SHOULD read the 'fstab' file in the '/etc' directory and re-mount '/' as read/write so you can fix the problem. if it doesn't, then type 'mount' take note of the '/' mounting..most likely it will be something similar to /dev/ad0s1a. issue the command mount -w /dev/ad0s1a / and you will be read/write at least on '/' so that you can find/fix the problem.

pretty straight forward. This file is mainly used to define local loopback (localhost) and machines on your local network if you do not have DNS setup and/or all hosts updated in the DNS database. A personal suggestion from me on HOSTS files in a network is simply this: DON'T DO IT. The administrative headache isn't worth it.

edit /etc/gettytab file. find the line that reads: :cb:ce:ck:lc:fd#1000:im=\r\n%s/%m (%h) (%t)\r\n\r\n:sp#1200:\. you can change the underlined part of this to read whatever you like. what this changes is the message that the consoles display at the login prompt. so make it :cb:ce:ck:lc:fd#1000:im=\r\n<Insert Witty Saying Here.>\r\n\r\n:sp#1200:\ have fun with it.

this is normally the first thing that i go in and edit after an install/upgrade. the contents of this file are shown to you immediately after logging in.

there are really only a couple things that i always do in this file as a good habit. i'm sure there are better ones, but at least i'm making an attempt to be more secure.

Building from ports:
cd /usr/ports/net/bind8 && make install clean
cd /usr/ports/net/isc-dhcpd3 && make install clean

Installing with /stand/sysinstall:
run /stand/sysinstall, select 'configure', select 'packages', choose the source type..typically 'FTP', choose an FTP server (for some reason ftp2.freebsd.org seems more reliable most of the time). choose the 'net' topic, scroll down and select 'Bind-8.3.3' and 'ISC-DHCPD3', install, exit.

cd /usr/local/etc/rc.d, find the sample startup script for dhcpd (isc-dhcpd.sh.sample). copy the sample to a normal startup script

cp isc-dhcpd.sh.sample dhcpd.sh

my script has the dhcpd.conf file being in the '/etc' dir, which by default it is not. the script installed by ISC-DHCPD3 is '/usr/local/etc/rc.isc-dhcpd.conf.sample'. my personal preference is to keep as many .conf files in /etc as i can, so the easy way to do this is to copy the sample to the ISC default, then link it..

cd /usr/local/etc
cp rc.isc-dhcpd.conf.sample rc.isc-dhcpd.conf
ln -s /usr/local/etc/rc.isc-dhcpd.conf /etc/dhcpd.conf

this creates a symbolic link from /etc/dhcpd.conf to the default file. that way you still have both of them. if you decide not to do this you will have to change the config_dir and config_file declarations in the dhcpd.sh example file.

Before setting up Bind, then making them talk to each other you will need to use the 'dnssec-keygen' utility. this will create an encrypted key pair for dynamic update validation and security between Bind and the updating client (in this case the local DHCP server). my understanding is that as of Bind 8.3.3 and ISC-DHCPD3 only HMAC-MD5 encryption is mutually supported. for more information on 'dnssec-keygen' check the man page. as an example just use a nice simple encryption scheme..

dnssec-keygen -a HMAC-MD5 -b 512 -n HOST <keyname>

<keyname> should be the FQDN of the bind server, remember that a REAL FQDN has the trailing 'dot' on the name..ie "<hostname>.slashdot.org."

ok, let's assume we're doing this for ns1.mydomain.com and that this machine is the Primary DNS Server for the domain.

dnssec-keygen -a HMAC-MD5 -b 512 -n HOST ns1.mydomain.com.

this will give you two files as output, the Public Key and the Private Key:
Kns1.mydomain.com.+157+49718.key and Kns1.mydomain.com.+157+49718.private
what you will need for the dhcpd.conf and named.conf files is the value of 'Key:' in the private key.

cat Kns1.mydomain.com.+157+49718.private

Private-key-format: v1.2 Algorithm: 157 (HMAC_MD5) Key: ophXG56IFTeaOECfiI8F0tHflUCjaoUKgX8+POjmBQYNYqR5p39UUHJOzvNb65xl+48erx5sA+Y8MdrmX2XOYA==

cd /etc/namedb
edit named.conf

key ns1.mydomain.com. { algorithm hmac-md5; secret "ophXG56IFTeaOECfiI8F0tHflUCjaoUKgX8+POjmBQYNYqR5p39UUHJOzvNb65xl+48erx5sA+Y8MdrmX2XOYA=="; }; zone "mydomain.com" { type master; file "mydomain.com.hosts"; allow-update {  key ns1.mydomain.com.;  }; }; zone "168.192.in-addr.arpa" { type master; file "192.168.rev"; allow-update {  key ns1.mydomain.com.;  }; };

Take note of the fomatting..for one thing the semicolons and curly-braces, and also the location of the quotation marks. The formatting is different between the dhcpd.conf and the named.conf files.

The key and zone statements set initial values for bind, "file" declarations denote where bind will store and retreive information. "allow-update" enables ddns updates for that zone, and finally the "key" declarations set the security for the ddns update method.

edit /etc/namedb/mydomain.com.hosts

Input the basic forward zone defaults

;BIND DUMP V8
$ORIGIN mydomain.com.
	38400	IN SOA	ns1.mydomain.com. root.mydomain.com. (
			1038176012 10800 3600 604800 38400 ) ;Cl=3
	38400	IN NS	ns1.mydomain.com. ;Cl=3
ns1	38400	IN A	192.168.0.1 ;Cl=3

edit /etc/named/192.168.rev

Input the basic reverse zone defaults

;BIND DUMP V8
$ORIGIN 192.in-addr.arpa.
168	38400	IN SOA	ns1.mydomain.com. root.mydomain.com.168.192.in-addr.arpa. (
			1038176012 10800 3600 604800 38400 ) ;Cl=4
	38400	IN NS	ns1.mydomain.com. ;Cl=4
$ORIGIN 0.168.192.IN-ADDR.ARPA.
1	38400	IN PTR	ns1.mydomain.com. ;Cl=4

ok, now to see if bind will pick up the new files and run with them. though first we need to make sure that both mydomain.com.hosts and 192.168.rev are writable (funny how they need to be for dynamic updates to work, eh?). do a chmod 640 /etc/namedb/mydomain.com.hosts then chmod 644 /etc/namedb/192.168.rev to set the proper file permissions, then restart bind..ndc restart. fyi, you can also use ndc stop and ndc start. and if you make any manual modifications to the zone files after starting bind be sure to check the file permissions again in case they get changed back to 444 (aka Read-Only).

if you are setting this up from over an ssh session (or god forbid telnet) you won't get any feedback from the daemon on restart, so you'll need to cat /var/log/messages to see whether bind is happy with your files.

one problem you might run into is the initial serial number/time setting for the records. bind requires no more than a 5 minute variance from the current localhost time for ddns updates to work. the serial number is the first number in the SOA record. i personally recommend simply setting the initial value to the current date and hour, then letting bind change it however it wants to when it starts. for instance, instead of 1038176012 in the example set the value to something like 2002010101 for Jan 1, 2002 at 1:00 am.

if you hadn't guessed i'm using the Class-C Reserved 192.168.0.x range for my example. so long as you made the symbolic link in /etc as i suggested above, edit /etc/dhcpd.conf and define your range, otherwise edit /usr/local/etc/rc.isc-dhcpd.conf.

# dhcpd.conf authoritative; use-host-decl-names on; ddns-updates on; ddns-update-style interim; option domain-name "mydomain.com"; option domain-name-servers 192.168.0.1; # lease times are in seconds default-lease-time 14400; max-lease-time 76800; allow unknown-clients; log-facility local7; subnet 192.168.0.0 netmask 255.255.255.0 {   option subnet-mask 255.255.255.0;   ddns-updates on;   ddns-domainname="mydomain.com";   ddns-rev-domain=".in-addr.arpa";   range 192.168.0.2 192.168.0.254;   option broadcast-address 192.168.0.255;   option routers 192.168.0.1;   } key ns1.mydomain.com. {   algorithm hmac-md5 ;   secret ophXG56IFTeaOECfiI8F0tHflUCjaoUKgX8+POjmBQYNYqR5p39UUHJOzvNb65xl+48erx5sA+Y8MdrmX2XOYA==; } # primary is the IP of the dns server to send updates to zone mydomain.com. {   primary 127.0.0.1;   key ns1.mydomain.com. ;   } zone 168.192.in-addr.arpa. {   primary 127.0.0.1;   key ns1.mydomain.com. ;   }

Most of the settings are self explainatory. Only essential basics/standards are shown here. Please note the slight differences in formatting here versus the named.conf file. For more information on dhcp options check man dhcpd.conf and man dhcp options.

Now, restart dhcpd using the startup script /usr/local/etc/rc.d/dhcpd.sh restart. so long as everything is set correctly you should now have ddns working between dhcp and bind. to check whether dhcp is handing out leases try to get one. i highly recommend disabling any other dhcp servers on your network at this point as they could create some confusion. kill your remote session (if connected via SSH) and then either set your machine up as a dhcp client, or manually force your machine to renew it's current lease. if you get a new IP and it's in the 192.168.0.x range, odds are dhcp is up and running. now reconnect to the server so we can make sure that the daemons are playing nicely with each other.

execute tail -f /var/db/dhcpd.leases on the server then force your client machine to once again renew it's IP. You should see some happy messages like:

lease 192.168.0.254 {
  starts 1 2001/1/01 08:01:24;
  ends 1 2001/1/01 12:01:24;
  binding state active;
  next binding state free;
  hardware ethernet 00:90:27:17:56:e7;
  uid "\001\000\220'\027V\347";
  set ddns-rev-name = "254.0.168.192.in-addr.arpa.";
  set ddns-txt = "310aa7170c900ab74cd0928d2f78e56d27";
  set ddns-fwd-name = "client.mydomain.com";
  client-hostname "client";
}

You should also see two new *.log files in ls /etc/namedb. if you do not see these two new files, recheck the file permissions on your zone files, restart bind, and try again.

Installing from ports:
cd /usr/ports/security/cyrus-sasl2
make install clean
You will want to enable DB3, OpenLDAP2 (if you plan to add it later), PWCHECK, PAMPWCHECK, and SASLAUTHD.

Installing from /stand/sysinstall:
/stand/sysinstall
select 'Configure', 'Packages', 'Ftp', 'ftp2.freebsd.org' (my preference), then when the Index is loaded..'Security', and finally 'Cyrus-Sasl'. Select the package, 'Install', then exit when done.

Cyrus installs a few files/scripts that need to be edited, but we will get back to those later.

I am going to assume that you have the source tree installed. if you do not, go back to part 3 (cvsup) of my kernel customization mini-tutorial.
First we need to create a new file: edit /etc/make.conf
Add in these lines:

SENDMAIL_CFLAGS+=   -I/usr/local/include -DSASL=2 SENDMAIL_LDFLAGS+= -L/usr/local/lib SENDMAIL_LDADD+=    -lsasl2

Anything in this new file will override the default settings in the Makefile when executing a 'make world' in the source tree.

That having been said, you can now either:
-- Rebuild only sendmail: cd /usr/src/usr.sbin/sendmail then make depend && make && make install, and follow the rest of the steps.
-- Rebuild the system: cd /usr/src then make world.

** Note: The FreeBSD 4.x Releases seem to have dependencies which require using make world.

If you already have mail.%lt;hostname%gt;.* files in /etc/mail, then rm /etc/mail/mail.*. Now edit /etc/mail/freebsd.mc and near the end of the file (just above the mailer() statements) add these lines:

define(`confRUN_AS_USER',`root:mail')dnl

TRUST_AUTH_MECH(`DIGEST-MD5 CRAM-MD5 LOGIN')dnl

define(`confAUTH_MECHANISMS',`DIGEST-MD5 CRAM-MD5 LOGIN')dnl

define(`confDONT_BLAME_SENDMAIL',`GroupReadableSASLDBFile')dnl

Save the file, then in the /etc/mail directory type make all install. This will rebuild the config files to incorporate the changes. Next you need to then restart Sendmail. You should be able to either do this by killall -HUP sendmail or sh /etc/rc.sendmail stop, sh /etc/rc.sendmail start. (trying a 'restart' might work, but it didn't for me..).

cd /usr/local/lib/sasl then edit Sendmail.conf (case sensitive).

Change the file to read:

#pwcheck_method: saslauthd pwcheck_method: passwd

This will cause FreeBSD's /etc/passwd file to be used for authentication via Sendmail.

Next, edit /etc/rc.conf and add these lines:

sasl_saslauthd1_enable="YES" sasl_saslauthd1_flags="-a pam"

At this point i think it is a good idea to go ahead and reboot now so we can see where we stand so far.

verify that sendmail's smtp is indeed running by checking netstat -a|grep smtp for "tcp4 0 0 *.smtp *.* LISTEN".

If smtp is running telnet localhost 25, you should connect and get a short welcome message.

Now type EHLO localhost and look for a line similar to 250-AUTH LOGIN. Existence of this statement indicates you now have an AUTH enabled Sendmail.

Installing from ports:
cd /usr/ports/mail/qpopper then make install clean

Installing with /stand/sysinstall /stand/sysinstall, 'configure', 'packages', 'ftp', 'ftp2.freebsd.org' (again, my preference), 'mail', select 'qpopper', 'Install', 'Exit'.

Qpopper has been acting strangely for me running as a daemon, so we'll be running it from inetd for now.

edit /etc/inetd.conf, find the line that begins: #pop3 and change it to read:

pop3 stream tcp nowait root /usr/local/libexec/qpopper qpopper -s -C

Make sure that inetd is enabled in the rc.conf. edit /etc/rc.conf and verify that there is a line that reads: inetd_enable="YES".

See if inetd is already running with ps -aux |grep inetd. if it is kill -HUP the process number. if not just go ahead and execute a simple inetd to start the daemon.

Verify that pop3 is now running by checking the output of netstat -a|grep pop3 for "tcp4 0 0 *.pop3 *.* LISTEN".

If you installed qpopper from /stand/sysinstall instead of installing from ports, a default pop3 access list should have been created. To be sure that the file exists and has a basic user list, cp /etc/ftpusers /usr/local/etc/qpopper/popusers. The popusers file is similar to the ftpusers file in the fact that users listed in this file are denied pop3 access. I highly recommend adding any users who do not need pop3 access and all daemons to this file.

Fire up and configure your favorite e-mail client. Be sure to set authentication for outgoing e-mail via SMTP. If you are using Outlook Express do not enable Log on using Secure Password Authentication as it doesn't work with sendmail. I have tested it successfully with Outlook Express from a Windows client, and Evolution from a FreeBSD client. Persons who do not know how to configure their own e-mail client should not be reading this.

We will install the 'imap-uw' port for our imap support. The port seems to also install it's own ipop2 and ipop3 daemons for pop support. I haven't tested to see if qpopper breaks imap yet, but since it's known to work that's what we'll stick with for the time being. (Please note that the most current version of imap-uw requires patching in order to allow for plaintext logins over non-encrypted communications. So if you plan on using squirrelmail, etc, especially you might want to get an older version of imap-uw or try another imapd.)

cd /usr/ports/mail/imap-uw && make -DWITH_SSL_AND_PLAINTEXT install clean

Now since this is run from inetd we need to uncomment the imap statement in the inetd.conf: edit /etc/inetd.conf

Find the line that reads:

#imap4 stream tcp nowait root /usr/local/libexec/imapd imapd

and change it to:

imap4 stream tcp nowait root /usr/local/libexec/imapd imapd

Next we will also need configure PAM for IMAP: edit /etc/pam.conf

Find the (most likely) existing Mail settings and change them to read:

# Mail services
#imap	auth	required	pam_unix.so	try_first_pass
#pop3	auth	required	pam_unix.so	try_first_pass
imap	auth	required	pam_unix.so
imap	account	required	pam_unix.so	try_first_pass
imap	session	required	pam_deny.so
pop3	auth	required	pam_unix.so
pop3	account	required	pam_unix.so	try_first_pass
pop3	session	required	pam_deny.so

Now as we did with qpopper, see if inetd is already running with ps -aux |grep inetd. if it is kill -HUP the process number. if not just go ahead and execute a simple inetd to start the daemon.

Verify that imap is now running by checking the output of netstat -a|grep imap for "tcp4 0 0 *.imap *.* LISTEN".

So long as imap is running, you should be able to test it with your favorite email client. Setup is the same as pop3 except that you choose IMAP as the server type. SMTP would still be the same, and still requires authentication to send email.

Install OpenSSL, stunnel requires a valid server certificate to work properly. We are installing OpenSSL in order to issue this certificate ourselves, though if you would like to, and have the money to throw around, you can go buy one from verisign.

Installing from Source: cd /usr/ports/security/openssl && make install clean
- or -
Installing from /stand/sysinstall: /stand/sysinstall, select 'Configure', 'Packages', 'FTP', 'ftp2.freebsd.org' (my preference), 'security', 'openssl...', 'Install'

Setup a new Certificate Authority (CA):
Copy the sample config file to the default location: mkdir /etc/ssl, cd /usr/local/openssl, cp openssl.cnf.sample /etc/ssl/openssl.cnf
Now create your new CA: cd /usr/local/openssl/misc, ./CA.sh -newca, hit 'Enter' to setup a new default CA.

Follow the prompts:
- Enter PEM pass phrase: Enter a password, then enter it a second time to verify. (remember it)
- Country Name (2 letter code) [AU]: US
- State or Province Name (full name) [Some-State]: MyState
- Locality Name (eg, city) []: MyCity
- Organization Name (eg, company) [Internet Widgits Pty Ltd]: MyCompany
- Organizational Unit Name (eg, section) []: Whatever, it's optional
- Common Name (eg, YOUR name) []: Server's FQDN..myserver.mydomain.com
- Email Address []: Contact email address...it's optional

First mv demoCA ../CA to move the new CA directory to /usr/local/openssl/CA, then to tell openssl to use the new CA edit ../openssl.cnf, find the line that reads dir = ./demoCA and change it to read dir = /usr/local/openssl/CA