И так, разворачиваю FreeBSD 13.0 (x64) в качестве площадки для разработок.
"Нарезаем" загрузочную флешку. Изначально - все по сценарию, клавиатура koi8-r, файловая система ZFS автоматом, два HDD (в режиме ACHI) в stripped, игры исключаем, автозапуск sshd обязательно. Сетевые настройки (в /etc/resolv.conf используем поисковый домен - loc), настройки пользователя (включить в группу wheel обязательно). Запуск ssh-клиента (putty), подключение пользователем, запуск команды su. Здесь и далее - пользуемся редактором ee.
Небольшой тюнинг процессов сборки:
ee /etc/make.conf
CPUTYPE?=core-avx-i MAKE_JOBS_NUMBER?=5 WITH=ICONV WITHOUT_DEBUG=YES
portsnap fetch extract
pkg install misc/mc
pkg install shells/bash
pkg install shells/bash-completion
Правим /root/.profile
... EDITOR=mcedit; export EDITOR ...
Правим /root/.cshrc
... setenv EDITOR mcedit ...
Релогаемся, чтобы редактор mcedit начал вызываться по-умолчанию.
Bash ставим по причине отсутствия сабшелла у пользователей, отличных от рута, в Midnight Commander'е. У рута по-умолчанию установлен csh, у обычных пользователей sh. Для того, чтобы увидеть используемый шелл, выполняем:
echo $SHELL
Выполняем:
chsh <пользователь>
Путь к bash'у - /usr/local/bin/bash
А в /home/пользователь/.profile добавляем:
[[ $PS1 && -f /usr/local/share/bash-completion/bash_completion.sh ]] && \ source /usr/local/share/bash-completion/bash_completion.sh
В файле /etc/ssh/sshd_config убираем комментарии со строчки:
PubkeyAuthentication yes ... AuthorizedKeysFile .ssh/authorized_keys
В домашнем каталоге пользователя (не рута!) создаем файл ключей:
mkdir -p ~/.ssh
touch ~/.ssh/authorized_keys
chmod 0744 ~/.ssh
chmod 0644 ~/.ssh/authorized_keys
Сперва добавим в /etc/login.conf следующие строки:
utf8|UTF-8 Users Accounts:\ :charset=UTF-8:\ :lang=en_US.UTF-8:\ :tc=default: utf8r|Russian UTF-8 Users Accounts:\ :charset=UTF-8:\ :lang=ru_RU.UTF-8:\ :tc=default:
Далее, для пользователя root и majestio (тут и далее - выбираем своего) прописываем:
cap_mkdb /etc/login.conf
pw usermod -n root -L utf8
pw usermod -n majestio -L utf8r
Выкачиваем шрифты terminus на выбор в каталог /usr/share/vt/fonts/:
cd /usr/share/vt/fonts/
fetch http://majestio.info/assets/stuff/ter-u16.fnt
Прописываем нужный в /etc/rc.conf, и за одно переключение Рус/Лат по Ctrl-Shift:
font8x16="ter-u16.fnt" keymap="ru.win"
А в /boot/loader.conf прописываем:
hw.vga.textmode=0 kern.vty=vt kern.maxfiles=65535
Пересобираем ядро согласно Хэндбуку. На этапе редактирования конфигурации ядра надо проверить наличие следующих параметров (согласно /usr/local/share/doc/postgresql/README-server), при необходимости добавить/изменить:
# PostgreSQL options SYSVSHM # как правило options SYSVSEM # сейчас эти опции options SYSVMSG # в ядре по умолчанию options SHMMAXPGS=65536 options SEMMNI=40 options SEMMNS=240 options SEMUME=40 options SEMMNU=120 # Firewall options IPFIREWALL options IPFIREWALL_VERBOSE options IPFIREWALL_VERBOSE_LIMIT=5 options DEVICE_POLLING options TEKEN_UTF8
Собственно процесс пересборки (исходное работоспособное ядро положим в /boot/kernel.good):
cp -R /boot/kernel /boot/kernel.good
cd /usr/src/sys/amd64/conf
cp GENERIC MYKERNEL
mcedit MYKERNEL
cd /usr/src
make buildkernel KERNCONF=MYKERNEL
make installkernel KERNCONF=MYKERNEL
Для корректной работы powerd необходимо изменить /boot/device.hint
hint.acpi_throttle.0.disabled="0" hint.p4tcc.0.disabled="0"
Не перегружаясь, настраиваем файервол. Для этого добавим строки в /etc/rc.conf
firewall_enable="YES" firewall_type="closed" firewall_script="/etc/ipfw.rules"
И создадим файл /etc/ipfw.rules следующего содержания:
#!/bin/sh
################ Начало файла с правилами IPFW ##################
# Сброс всех правил перед началом работы скрипта.
ipfw -q -f flush
# Префикс для создания правил
cmd="ipfw -q add" # команда добавления правил
eth="em0" # название интерфейса
gw="192.168.1.1" # адрес шлюза
#################################################################
# Нет ограничений на внутреннем интерфейсе локальной сети
# Нет необходимости в этом, если у вас нет локальной сети.
# Замените xl0 на название интерфейса вашей локальной сети
#################################################################
$cmd 00005 allow all from any to any via $eth
#################################################################
# Нет ограничений на интерфейсе Loopback
#################################################################
$cmd 00010 allow all from any to any via lo0
#################################################################
# Разрешить пакет, если он был ранее добавлен в "динамическую"
# таблицу при помощи выражения allow keep-state
#################################################################
$cmd 00015 check-state
#################################################################
# Раздел правил для исходящего трафика на внешнем интерфейсе
#################################################################
# Разрешить исходящий трафик к DNS серверу (DNS-на шлюзе)
$cmd 00110 allow tcp from any to $gw 53 out via $eth setup keep-state
$cmd 00111 allow udp from any to $gw 53 out via $eth keep-state
# Разрешить исходящий трафик для незащищенного www соединения
$cmd 00200 allow tcp from any to any 80 out via $eth setup keep-state
# Разрешить исходящий трафик для защищенного www соединения
# https с поддержкой TLS и SSL
$cmd 00220 allow tcp from any to any 443 out via $eth setup keep-state
# Разрешить исходящий POP/SMTP
$cmd 00230 allow tcp from any to any 25 out via $eth setup keep-state
$cmd 00231 allow tcp from any to any 110 out via $eth setup keep-state
# Разрешить исходящий трафик для FreeBSD (make install & CVSUP)
# По сути назначаем пользователю root полные привилегии.
$cmd 00240 allow tcp from me to any out via $eth setup keep-state uid root
# Разрешаем исходящий icmp ping
$cmd 00250 allow icmp from any to any out via $eth keep-state
# Разрешаем исходящий трафик Time
$cmd 00260 allow tcp from any to any 37 out via $eth setup keep-state
# Разрешаем исходящий трафик nntp news
$cmd 00270 allow tcp from any to any 119 out via $eth setup keep-state
# Разрешаем исходящий защищённый трафик FTP, Telnet и SCP
# Эта функция использует SSH (secure shell)
$cmd 00280 allow tcp from any to any 22 out via $eth setup keep-state
# Разрешаем исходящий трафик whois
$cmd 00290 allow tcp from any to any 43 out via $eth setup keep-state
# Запрещаем и заносим в журнал остальной исходящий трафик.
# Обеспечивает политику межсетевого экрана закрытого типа
$cmd 00299 deny log all from any to any out via $eth
#################################################################
# Раздел правил для входящего трафика на внешнем интерфейсе
#################################################################
# Запрещаем весь входящий трафик с немаршрутизируемых сетей
$cmd 00300 deny all from 192.168.0.0/16 to any in via $eth # RFC 1918 private IP
$cmd 00301 deny all from 172.16.0.0/12 to any in via $eth # RFC 1918 private IP
$cmd 00302 deny all from 10.0.0.0/8 to any in via $eth # RFC 1918 private IP
$cmd 00303 deny all from 127.0.0.0/8 to any in via $eth # loopback
$cmd 00304 deny all from 0.0.0.0/8 to any in via $eth # loopback
$cmd 00305 deny all from 169.254.0.0/16 to any in via $eth # DHCP auto-config
$cmd 00306 deny all from 192.0.2.0/24 to any in via $eth # reserved for docs
$cmd 00307 deny all from 204.152.64.0/23 to any in via $eth # Sun cluster interconnect
$cmd 00308 deny all from 224.0.0.0/3 to any in via $eth # Class D & E multicast
# Запрещаем пинг извне
$cmd 00310 deny icmp from any to any in via $eth
# Запрещаем ident
$cmd 00315 deny tcp from any to any 113 in via $eth
# Запрещаем все Netbios службы. 137=name, 138=datagram, 139=session
# Netbios это MS/Windows сервис обмена.
# Блокируем MS/Windows hosts2 запросы сервера имен на порту 81
$cmd 00320 deny tcp from any to any 137 in via $eth
$cmd 00321 deny tcp from any to any 138 in via $eth
$cmd 00322 deny tcp from any to any 139 in via $eth
$cmd 00323 deny tcp from any to any 81 in via $eth
# Запрещаем любые опоздавшие пакеты
$cmd 00330 deny all from any to any frag in via $eth
# Запрещаем ACK пакеты, которые не соответствуют динамической таблице правил.
$cmd 00332 deny tcp from any to any established in via $eth
# Разрешить входящий трафик для www, так как я использую сервер apache
$cmd 00400 allow tcp from any to me 80 in via $eth setup limit src-addr 2
# Разрешить входящий трафик безопасных FTP, Telnet и SCP из глобальной сети
$cmd 00410 allow tcp from any to me 22 in via $eth setup limit src-addr 2
# Разрешить входящий трафик PostgreSQL & MySQL & VNC
$cmd 00430 allow tcp from any to me 5432 in via $eth setup limit src-addr 2
$cmd 00431 allow tcp from any to me 3306 in via $eth setup limit src-addr 2
$cmd 00432 allow tcp from any to me 5900 in via $eth setup limit src-addr 2
# Отбрасываем и заносим в журнал все входящие соединения снаружи
$cmd 00499 deny log all from any to any in via $eth
# Всё остальное запрещено по умолчанию
# Запрещаем и заносим в журнал все пакеты для дальнейшего анализа
$cmd 00999 deny log all from any to any
################ Конец файла правил IPFW ########################
Теперь можно перегружаться:
reboot
freebsd-update fetch
freebsd-update install
Лень все собирать, будем ставить из пакетов:
pkg install x11/xorg
pkg install x11-drivers/xf86-video-vmware # для работы под VMWare
pkg install open-vm-tools # для работы под VMWare
pkg install x11-wm/xfce4
Message from wayland-1.20.0: -- Wayland requires XDG_RUNTIME_DIR to be defined to a path that will contain "wayland-%d" unix(4) sockets. This is usually handled by consolekit2 (via ck-launch-session) or pam_xdg (via login). ===== Message from freetype2-2.11.1: -- The 2.7.x series now uses the new subpixel hinting mode (V40 port's option) as the default, emulating a modern version of ClearType. This change inevitably leads to different rendering results, and you might change port's options to adapt it to your taste (or use the new "FREETYPE_PROPERTIES" environment variable). The environment variable "FREETYPE_PROPERTIES" can be used to control the driver properties. Example: FREETYPE_PROPERTIES=truetype:interpreter-version=35 \ cff:no-stem-darkening=1 \ autofitter:warping=1 This allows to select, say, the subpixel hinting mode at runtime for a given application. If LONG_PCF_NAMES port's option was enabled, the PCF family names may include the foundry and information whether they contain wide characters. For example, "Sony Fixed" or "Misc Fixed Wide", instead of "Fixed". This can be disabled at run time with using pcf:no-long-family-names property, if needed. Example: FREETYPE_PROPERTIES=pcf:no-long-family-names=1 How to recreate fontconfig cache with using such environment variable, if needed: # env FREETYPE_PROPERTIES=pcf:no-long-family-names=1 fc-cache -fsv The controllable properties are listed in the section "Controlling FreeType Modules" in the reference's table of contents (/usr/local/share/doc/freetype2/reference/index.html, if documentation was installed). ===== Message from xorg-server-1.20.13,1: -- Xorg-server has been installed. If your kernel is compiled with the EVDEV_SUPPORT option enabled (default starting from FreeBSD 12.1) it is recommended to enable evdev mode in pointer device drivers like ums(4) and psm(4). This will give improvements like better tilt wheel support for mice and centralized gesture support via xf86-input-synaptics or libinput drivers for touchpads. This is also needed for PS/2 devices to be properly detected by Xorg when moused service is disabled in /etc/rc.conf and kernel is compiled with EVDEV_SUPPORT. To enable evdev in such a device, run the following: # sysctl kern.evdev.rcpt_mask=6 To make it persistent across reboots, add the following to /etc/sysctl.conf: kern.evdev.rcpt_mask=6 In case you're using a serial mouse or any other mouse that *only* works over sysmouse(4) and moused(8) on an evdev enabled kernel, please run this: # sysctl kern.evdev.rcpt_mask=3 To make it persistent across reboots, add to this /etc/sysctl.conf: kern.evdev.rcpt_mask=3 ===== Message from dejavu-2.37_1: -- Make sure that the freetype module is loaded. If it is not, add the following line to the "Modules" section of your X Windows configuration file: Load "freetype" Add the following line to the "Files" section of X Windows configuration file: FontPath "/usr/local/share/fonts/dejavu/" Note: your X Windows configuration file is typically /etc/X11/XF86Config if you are using XFree86, and /etc/X11/xorg.conf if you are using X.Org. ===== Message from xterm-370: -- You installed xterm with wide chars support. This introduces some limitations comparing to the plain single chars version: this version of xterm will use UTF-8 charset for selection buffers, breaking 8-bit copy/paste support unless you are using UTF-8 or ISO8859-1 locale. If you want 8-bit charset selections to work as before, use "eightBitSelectTypes" XTerm resource setting. For further information refer to the SELECT/PASTE section of xterm(1) manual page.
По рекомендации выше для EVDEV поставим:
pkg install xf86-input-synaptics
И, по-скольку у нас moused не включен в /etc/rc.conf, по пропишем в /etc/sysctl.conf следующую настройку:
kern.evdev.rcpt_mask=6
Далее ставим необходимые пакеты для XFCE4:
pkg install xfce4-appfinder
pkg install xfce4-appmenu-plugin
pkg install xfce4-clipman-plugin
pkg install xfce4-dashboard
pkg install xfce4-datetime-plugin
pkg install xfce4-desktop
pkg install xfce4-docklike-plugin
pkg install xfce4-genmon-plugin
pkg install xfce4-mailwatch-plugin
pkg install xfce4-mount-plugin
pkg install xfce4-notifyd
pkg install xfce4-panel-profiles
pkg install xfce4-places-plugin
pkg install xfce4-screenshooter-plugin
pkg install xfce4-session
pkg install xfce4-settings
pkg install xfce4-taskmanager
pkg install xfce4-terminal
pkg install xfce4-verve-plugin
pkg install xfce4-weather-plugin
pkg install xfce4-whiskermenu-plugin
pkg install xfce4-wm
pkg install xfce4-wm-themes
pkg install xfce4-xkb-plugin
Message from libxkbcommon-1.4.0_2: -- If arrow keys don't work under X11 switch to legacy rules e.g., For sh/bash/ksh/zsh run and (optionally) add into ~/.profile: export XKB_DEFAULT_RULES=xorg For csh/tcsh run and (optionally) add into ~/.login: setenv XKB_DEFAULT_RULES xorg - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Message from libgtop-2.40.0: -- In order to use the File System read/write monitor, you must chmod /dev/devstat so that all users can open it read-only. For example: # chmod 0444 /dev/devstat In order for this to persist across reboots, add the following to /etc/devfs.conf: perm devstat 0444 ===== Message from libexo-4.16.3: -- If you are upgrading your packages, due to a problem with the pkg package management tool libexo requires to be upgraded by itself before the rest of packages, to ensure correct installation, as described in UPDATING entry 20210102. If you skipped the manual step and XFCE parts are failing due to missing libraries, please run "pkg upgrade -f libexo" to force reinstalling the missing parts. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Message from libsoup-2.74.0_3: -- libsoup can use NTLM authentication if it is compiled with the SMB option. To use it, you must install a port that provides NTLM, like net/samba412 or net/samba413. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Message from xfce4-appmenu-plugin-0.7.6: -- When using the panel appmenu as an XFCE menu applet, you have to configure the appmenu to show in the panel applet, rather than on each individual window. This configuration should remove any 'double' menus you may experience: # xfconf-query -c xsettings -p /Gtk/ShellShowsMenubar -n -t bool -s true # xfconf-query -c xsettings -p /Gtk/ShellShowsAppmenu -n -t bool -s true This configuration will load the appmenu-gtk-module for XFCE: # xfconf-query -c xsettings -p /Gtk/Modules -n -t string -s "appmenu-gtk-module" - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Message from cyrus-sasl-2.1.28: -- You can use sasldb2 for authentication, to add users use: saslpasswd2 -c username If you want to enable SMTP AUTH with the system Sendmail, read Sendmail.README NOTE: This port has been compiled with a default pwcheck_method of auxprop. If you want to authenticate your user by /etc/passwd, PAM or LDAP, install ports/security/cyrus-sasl2-saslauthd and set sasl_pwcheck_method to saslauthd after installing the Cyrus-IMAPd 2.X port. You should also check the /usr/local/lib/sasl2/*.conf files for the correct pwcheck_method. If you want to use GSSAPI mechanism, install ports/security/cyrus-sasl2-gssapi. If you want to use SRP mechanism, install ports/security/cyrus-sasl2-srp. If you want to use LDAP auxprop plugin, install ports/security/cyrus-sasl2-ldapdb. ===== Message from openldap24-client-2.4.59_4: -- The OpenLDAP client package has been successfully installed. Edit /usr/local/etc/openldap/ldap.conf to change the system-wide client defaults. Try `man ldap.conf' and visit the OpenLDAP FAQ-O-Matic at http://www.OpenLDAP.org/faq/index.cgi?file=3 for more information. ===== Message from libinotify-20211018: -- You might want to consider increasing the kern.maxfiles tunable if you plan to use this library for applications that need to monitor activity of a lot of files. ===== Message from gamin-0.1.10_10: -- Gamin will only provide realtime notification of changes for at most n files, where n is the minimum value between (kern.maxfiles * 0.7) and (kern.maxfilesperproc - 200). Beyond that limit, files will be polled. If you often open several large folders with Nautilus, you might want to increase the kern.maxfiles tunable (you do not need to set kern.maxfilesperproc, since it is computed at boot time from kern.maxfiles). The behavior of gamin can be controlled via the various gaminrc files. See http://www.gnome.org/~veillard/gamin/config.html on how to create these files. In particular, if you find gam_server is taking up too much CPU time polling for changes, something like the following may help in one of the gaminrc files: # reduce polling frequency to once per 10 seconds # for UFS file systems in order to lower CPU load fsset ufs poll 10 -- ===> NOTICE: The gamin port currently does not have a maintainer. As a result, it is more likely to have unresolved issues, not be up-to-date, or even be removed in the future. To volunteer to maintain this port, please create an issue at: https://bugs.freebsd.org/bugzilla More information about port maintainership is available at: https://docs.freebsd.org/en/articles/contributing/#ports-contributing ===== Message from samba412-4.12.15_3: -- How to start: http://wiki.samba.org/index.php/Samba4/HOWTO * Your configuration is: /usr/local/etc/smb4.conf * All the relevant databases are under: /var/db/samba4 * All the logs are under: /var/log/samba4 * Provisioning script is: /usr/local/bin/samba-tool For additional documentation check: http://wiki.samba.org/index.php/Samba4 Bug reports should go to the: https://bugzilla.samba.org/ ===== Message from libbluray-1.3.0_2,1: -- ===> NOTICE: The libbluray port currently does not have a maintainer. As a result, it is more likely to have unresolved issues, not be up-to-date, or even be removed in the future. To volunteer to maintain this port, please create an issue at: https://bugs.freebsd.org/bugzilla More information about port maintainership is available at: https://docs.freebsd.org/en/articles/contributing/#ports-contributing ===== Message from xfce4-tumbler-4.16.0_15: -- To override the default configuration, you must copy the rc-file: mkdir ~/.config/tumbler cp /usr/local/etc/xdg/tumbler/tumbler.rc ~/.config/tumbler The COVER plugin requires manual configuration. For more information see http://docs.xfce.org/xfce/thunar/tumbler - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Message from xfce4-session-4.16.0: -- To be able to shutdown or reboot your system, you'll have to add .rules files in /usr/local/etc/polkit-1/rules.d directory. Which looks like this (replace PUTYOURGROUPHERE by your group): polkit.addRule(function (action, subject) { if ((action.id == "org.freedesktop.consolekit.system.restart" || action.id == "org.freedesktop.consolekit.system.stop") && subject.isInGroup("PUTYOURGROUPHERE")) { return polkit.Result.YES; } }); For those who have working suspend/resume: polkit.addRule(function (action, subject) { if (action.id == "org.freedesktop.consolekit.system.suspend" && subject.isInGroup("PUTYOURGROUPHERE")) { return polkit.Result.YES; } }); This port installs a startup file for xscreensaver but it is disabled by default. This is so because the XFCE metaport installs xfce4-screensaver to autostart and having both enabled causes conflicts. If you want to change the screen saver being used and enable xscreensaver please go to the Session and Startup settings, and in the Application Autostart tab enable only the relevant screensaver: Screensaver -> to enable xscreensaver XFCE Screensaver -> to enable xfce4-screensaver - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Message from xfce4-terminal-1.0.0_1: -- Some options could need manual change to ~/.config/xfce4/terminal/terminalrc: To reduce the height of tabs, add the hidden 'MiscSlimTabs' option: MiscSlimTabs=TRUE By default this option is not defined. If you have configured a custom color cursor you will also need to add: ColorCursorUseDefault=FALSE to have such configuration still working, otherwise reconfigure the color in the GUI. Keep in mind, when you change an option in Preferences window, this file is overwritten.
Для пользователя добавляем в ~/.profile
export XKB_DEFAULT_RULES=xorg
в ~/.login добавляем
setenv XKB_DEFAULT_RULES xorg
в /etc/devfs.conf добавляем
perm devstat 0444
Выполняем
pkg upgrade -f libexo
И еще
mkdir ~/.config/tumbler
cp /usr/local/etc/xdg/tumbler/tumbler.rc ~/.config/tumbler
Создаем файл /usr/local/etc/polkit-1/rules.d/60-reboot.rules
polkit.addRule(function (action, subject) { if ((action.id == "org.freedesktop.consolekit.system.restart" || action.id == "org.freedesktop.consolekit.system.stop") && subject.isInGroup("wheel")) { return polkit.Result.YES; } });
Создаем файл /usr/local/etc/polkit-1/rules.d/70-suspend.rules
polkit.addRule(function (action, subject) { if ((action.id == "org.freedesktop.consolekit.system.restart" || action.id == "org.freedesktop.consolekit.system.stop") && subject.isInGroup("wheel")) { return polkit.Result.YES; } });
Создаем конфиг от имени пользователя
mkdir -p ~/.config/xfce4/terminal
touch ~/.config/xfce4/terminal/terminalrc
В файл touch ~/.config/xfce4/terminal/terminalrc добавляем:
MiscSlimTabs=TRUE ColorCursorUseDefault=FALSE
Создаем конфигурационный файл X11 */etc/X11/xorg.conf следующего содержания:
Section "ServerLayout" Identifier "XFree86 Configured" Screen 0 "Screen0" 0 0 InputDevice "Mouse0" "CorePointer" InputDevice "Keyboard0" "CoreKeyboard" EndSection Section "Files" ModulePath "/usr/local/lib/xorg/modules" FontPath "/usr/local/share/fonts/programmer/" FontPath "/usr/local/share/fonts/cyrillic/" FontPath "/usr/local/share/fonts/misc/" FontPath "/usr/local/share/fonts/OTF/" FontPath "/usr/local/share/fonts/TTF/" FontPath "/usr/local/share/fonts/Type1/" FontPath "/usr/local/share/fonts/75dpi/" FontPath "/usr/local/share/fonts/100dpi/" FontPath "/usr/local/share/fonts/dejavu/" EndSection Section "Module" Load "dbe" Load "dri" Load "dri2" Load "extmod" Load "glx" Load "record" Load "freetype" EndSection Section "InputDevice" Identifier "Keyboard0" Driver "evdev" Option "XkbModel" "pc105" Option "XkbLayout" "us,ru" Option "XkbOptions" "compose:lwin,grp:lctrl_lshift_toggle,numpad:microsoft,ctrl:nocaps" EndSection Section "InputDevice" Identifier "Mouse0" Driver "vmmouse" Option "Protocol" "auto" Option "Device" "/dev/sysmouse" Option "ZAxisMapping" "4 5 6 7" EndSection Section "Monitor" Identifier "vmware" VendorName "VMware, Inc" HorizSync 30-100 VertRefresh 56-120 EndSection Section "Device" Identifier "VMware SVGA" Driver "vmware" BusID "PCI:0:15:0" EndSection Section "Screen" Identifier "Screen0" Device "VMware SVGA" Monitor "vmware" EndSection
И добавляем в /etc/rc.conf:
dbus_enable="YES" hald_enable="YES" # kdm4_enable="YES" <-- по желанию сразу логин в иксах, но лучче не надо vmware_guest_vmblock_enable="YES" vmware_guest_vmhgfs_enable="YES" vmware_guest_vmmemctl_enable="YES" vmware_guest_vmxnet_enable="YES" vmware_guestd_enable="YES"
В файл /boot/loader.conf добавляем
fusefs_load="YES"
Cоздаем скрипт для запуска xfce4 для пользователя:
echo "exec startxfce4" > ~/.xinitrc
Небольшие косметические правки для лучшего отображения шрифтов на LCD-экране:
cd /usr/ports/print/freetype
make -DWITH_LCD_FILTERING deinstall reinstall
Тут в меню конфигурации порта выбираем все опции:
cd /usr/ports/print/freetype2
make deinstall reinstall
Последний этап потребует компиляции множества либ, поэтому стоит попробовать (я не пробовал) другой вариант:
cd /usr/ports/print/freetype2
make deinstall
make config
make install BATCH=YES
Возможно получится собрать все остальное без лишних запросов.
Далее экспериментируем с рендерингом шрифтов с помощью переменной окружения FREETYPE_PROPERTIES (выбираем Infinality):
FREETYPE_PROPERTIES=truetype:interpreter-version=38 \ cff:no-stem-darkening=1 \ autofitter:warping=1 \ pcf:no-long-family-names=1
где interpreter-version:
Копируем нужные шрифты в каталог /usr/local/share/fonts/programmer
Правим ~/.Xresources, приводим к виду:
Xft.dpi: 96 Xft.antialias: true Xft.hinting: true Xft.rgba: rgb Xft.autohint: false Xft.hintstyle: hintslight Xft.lcdfilter: lcddefault
Выполняем:
mkfontdir /usr/local/share/fonts/programmer
fc-cache -f
//FIXME: советуют еще сделать в домашнем каталоге файл а-ля ~/.fonts
<?xml version="1.0"?>
<!DOCTYPE fontconfig SYSTEM "fonts.dtd">
<fontconfig>
<!--
install ==> print/freetype2 [WITH_LCD_FILTERING=yes and assumes BCI not disabled]
install ==> x11-fonts/dejavu
install ==> x11-fonts/webfonts
install ==> x11-fonts/terminus-font
-->
<!-- reject all bitmap fonts, with the exception of 'terminus' -->
<selectfont>
<acceptfont>
<pattern>
<patelt name="family"> <string>Terminus</string> </patelt>
</pattern>
</acceptfont>
<rejectfont>
<pattern>
<patelt name="scalable"> <bool>false</bool> </patelt>
</pattern>
</rejectfont>
</selectfont>
<!-- preferred aliases -->
<alias> <family>serif</family>
<prefer>
<family>DejaVu Serif</family>
</prefer>
</alias>
<!-- preferred aliases -->
<alias> <family>sans-serif</family>
<prefer>
<family>DejaVu Sans</family>
</prefer>
</alias>
<!-- preferred aliases -->
<alias> <family>monospace</family>
<prefer>
<family>DejaVu Sans Mono</family>
<family>Terminus</family>
</prefer>
</alias>
<!-- default quality settings -->
<match target="font">
<edit mode="assign" name="rgba"> <const>none</const> </edit>
<edit mode="assign" name="antialias"> <bool>true</bool> </edit>
<edit mode="assign" name="autohint"> <bool>true</bool> </edit>
<edit mode="assign" name="hinting"> <bool>true</bool> </edit>
<edit mode="assign" name="hintstyle"> <const>hintfull</const> </edit>
</match>
<!-- reduce ringing ==> requires freetype2 'WITH_LCD_FILTERING=yes' -->
<match target="font">
<edit mode="assign" name="lcdfilter"> <const>lcdlight</const> </edit>
</match>
<!-- disable autohinting for bold fonts -->
<match target="font">
<test compare="more" name="weight"> <const>medium</const> </test>
<edit mode="assign" name="autohint"> <bool>false</bool> </edit>
</match>
<!-- disable autohinting for fonts that don't need it -->
<match target="pattern" name="family">
<test qual="any" name="family">
<string>Andale Mono</string>
<string>Arial</string>
<string>Arial Black</string>
<string>Comic Sans MS</string>
<string>Courier New</string>
<string>Georgia</string>
<string>Impact</string>
<string>Trebuchet MS</string>
<string>Tahoma</string>
<string>Times New Roman</string>
<string>Verdana</string>
<string>Webdings</string>
</test>
<edit mode="assign" name="hinting"> <bool>true</bool> </edit>
<edit mode="assign" name="autohint"> <bool>false</bool> </edit>
</match>
</fontconfig>
Делаем перезагрузку и загружаем иксы уже в VMWare:
startx
//FIXME: есть еще команда, которая уже исполняется при запущенных иксах:
xfconf-query -c xsettings -p /Xft/Lcdfilter -n -t string -s lcddefault
где помимо lcddefault допускается использовать:
Будем устанавливать версию 13.6, а не 14.2 так как устанавливаемый далее пакет Qt5 потребует именно 13.6, во избежания конфликтов. Устанавливаем нужные пакеты и готовим рабочий каталог:
pkg install postgresql13-server
pkg install postgresql13-contrib
pkg install postgresql13-plperl
mkdir -p /mnt/tree/pgsql/data
cd /mnt/tree
chown -R postgres:postgres pgsql
Message from postgresql13-server-13.6: -- For procedural languages and postgresql functions, please note that you might have to update them when updating the server. If you have many tables and many clients running, consider raising kern.maxfiles using sysctl(8), or reconfigure your kernel appropriately. The port is set up to use autovacuum for new databases, but you might also want to vacuum and perhaps backup your database regularly. There is a periodic script, /usr/local/etc/periodic/daily/502.pgsql, that you may find useful. You can use it to backup and perform vacuum on all databases nightly. Per default, it performs `vacuum analyze'. See the script for instructions. For autovacuum settings, please review ~postgres/data/postgresql.conf. If you plan to access your PostgreSQL server using ODBC, please consider running the SQL script /usr/local/share/postgresql/odbc.sql to get the functions required for ODBC compliance. Please note that if you use the rc script, /usr/local/etc/rc.d/postgresql, to initialize the database, unicode (UTF-8) will be used to store character data by default. Set postgresql_initdb_flags or use login.conf settings described below to alter this behaviour. See the start rc script for more info. To set limits, environment stuff like locale and collation and other things, you can set up a class in /etc/login.conf before initializing the database. Add something similar to this to /etc/login.conf: --- postgres:\ :lang=en_US.UTF-8:\ :setenv=LC_COLLATE=C:\ :tc=default: --- and run `cap_mkdb /etc/login.conf'. Then add 'postgresql_class="postgres"' to /etc/rc.conf. ====================================================================== To initialize the database, run /usr/local/etc/rc.d/postgresql initdb You can then start PostgreSQL by running: /usr/local/etc/rc.d/postgresql start For postmaster settings, see ~postgres/data/postgresql.conf NB. FreeBSD's PostgreSQL port logs to syslog by default See ~postgres/data/postgresql.conf for more info NB. If you're not using a checksumming filesystem like ZFS, you might wish to enable data checksumming. It can be enabled during the initdb phase, by adding the "--data-checksums" flag to the postgresql_initdb_flags rcvar. Otherwise you can enable it later by pg_checksums. Check the initdb(1) manpage for more info and make sure you understand the performance implications. ====================================================================== To run PostgreSQL at startup, add 'postgresql_enable="YES"' to /etc/rc.conf - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Message from postgresql13-contrib-13.6_2: -- The PostgreSQL contrib utilities have been installed. Please see /usr/local/share/doc/postgresql/contrib/README for more information. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Message from postgresql13-plperl-13.6: -- PL/Perl has been installed. Check the createlang(l) manpage for more info. You can install PL/Perl as trusted or untrusted, by using either "createlang plperl" or "createlang plperlu".
В файл /etc/rc.conf дописываем
postgresql_enable="YES" postgresql_data="/mnt/tree/pgsql/data" postgresql_flags="-w -s -m fast" postgresql_initdb_flags="--encoding=utf-8 --lc-collate=ru_RU.UTF-8 --locale=ru_RU.UTF-8" postgresql_class="postgres"
Создаем новый класс пользователей с кодировкой по умолчанию UTF8 специально для сервиса postgresql и задаем его пользователю pgsql, для этого добавляем в /etc/login.conf:
postgres|PostgreSQL User Account:\ :lang=ru_RU.UTF-8:\ :setenv=LC_COLLATE=ru_RU.UTF-8: \ :charset=UTF-8:\ :tc=default:
Обновляем:
cap_mkdb /etc/login.conf
Выполняем инициализацию кластера:
service postgresql initdb
The files belonging to this database system will be owned by user "postgres". This user must also own the server process. The database cluster will be initialized with locale "ru_RU.UTF-8". The default text search configuration will be set to "russian". Data page checksums are disabled. fixing permissions on existing directory /mnt/tree/pgsql/data ... ok creating subdirectories ... ok selecting dynamic shared memory implementation ... posix selecting default max_connections ... 100 selecting default shared_buffers ... 128MB selecting default time zone ... Europe/Minsk creating configuration files ... ok running bootstrap script ... ok performing post-bootstrap initialization ... ok syncing data to disk ... ok initdb: warning: enabling "trust" authentication for local connections You can change this by editing pg_hba.conf or using the option -A, or --auth-local and --auth-host, the next time you run initdb. Success. You can now start the database server using: /usr/local/bin/pg_ctl -D /mnt/tree/pgsql/data -l logfile start
Теперь переходим к настройке сервиса. По умолчанию все конфигурационные файлы хранятся в корне кластера, в моей конфигурации это /mnt/tree/pgsql/data. Управление параметрами сервиса осуществляется тремя конфигурационными файлами:
В файл /mnt/tree/pgsql/data/pg_hba.conf дописываем строчку - разрешения доступа по сети 192.168.1.0:
host all all 192.168.1.0/24 trust
В файле /mnt/tree/pgsql/data/postgresql.conf находим и изменяем строчки:
listen_addresses='*' # принимать соединения на любом интерфейсе (обычно строка комментирована - раскомментировать!) lc_messages='C' # вывод сообщений с английской локалью
Стартуем сервер:
service postgresql start
Прописываем пароль для postgress:
psql --username=postgres
ALTER USER "postgres" WITH PASSWORD 'new_password';
\q
Убеждаемся, что сервер запущен и слушает порт 5432
sockstat -4 -l | grep postgres
postgres postgres 1405 7 tcp4 *:5432 *:*
Дополнительно установим GUI-оболочку управления сервером pgadmin3
pkg install pgadmin3
На этом установка сервера PostgreSQL завершена.
pkg install databases/mysql57-server
mkdir -p /mnt/tree/mysql/data
mkdir -p /mnt/tree/mysql/temp
mkdir -p /mnt/tree/mysql/mysql-files
cd /mnt/tree
chmod -R 750 mysql
chown -R mysql:mysql mysql
Message from mysql57-server-5.7.38: -- Initial password for first time use of MySQL is saved in $HOME/.mysql_secret ie. when you want to use "mysql -u root -p" first you should see password in /root/.mysql_secret MySQL57 has a default /usr/local/etc/mysql/my.cnf, remember to replace it with your own or set `mysql_optfile="$YOUR_CNF_FILE` in rc.conf.
Правим /usr/local/etc/mysql/my.cnf на:
[client] port = 3306 socket = /tmp/mysql.sock [mysql] prompt = \u@\h [\d]>\_ no_auto_rehash [mysqld] user = mysql port = 3306 socket = /tmp/mysql.sock bind-address = 0.0.0.0 basedir = /usr/local datadir = /mnt/tree/mysql/data tmpdir = /mnt/tree/mysql/temp slave-load-tmpdir = /mnt/tree/mysql/temp secure-file-priv = /mnt/tree/mysql/mysql-files log-bin = mysql-bin log-output = TABLE master-info-repository = TABLE relay-log-info-repository = TABLE relay-log-recovery = 1 slow-query-log = 1 server-id = 1 sync_binlog = 1 sync_relay_log = 1 binlog_cache_size = 16M expire_logs_days = 30 default_password_lifetime = 0 enforce-gtid-consistency = 1 gtid-mode = ON safe-user-create = 1 lower_case_table_names = 1 explicit-defaults-for-timestamp = 1 myisam-recover-options = BACKUP,FORCE open_files_limit = 32768 table_open_cache = 16384 table_definition_cache = 8192 net_retry_count = 16384 key_buffer_size = 256M max_allowed_packet = 64M query_cache_type = 0 query_cache_size = 0 long_query_time = 0.5 innodb_buffer_pool_size = 1G innodb_data_home_dir = /mnt/tree/mysql/data innodb_log_group_home_dir = /mnt/tree/mysql/data innodb_data_file_path = ibdata1:128M:autoextend innodb_temp_data_file_path = ibtmp1:128M:autoextend innodb_flush_method = O_DIRECT innodb_log_file_size = 256M innodb_log_buffer_size = 16M innodb_write_io_threads = 8 innodb_read_io_threads = 8 innodb_autoinc_lock_mode = 2 skip-symbolic-links [mysqldump] max_allowed_packet = 256M quote_names quick
cd /mnt/tree/mysql/data
/usr/local/libexec/mysqld --initialize --user=mysql
Запоминаем пароль для рута. Там после инициализации выводится, например:
[Note] A temporary password is generated for root@localhost: A,4>qtWr,ynu
В /etc/rc.conf добавляем:
mysql_enable="YES" mysql_dbdir="/mnt/tree/mysql/data"
service mysql-server start
mysql -u root -p
Используем запомненный пароль для рута, в оболочке mysql выполняем:
ALTER USER 'root'@'localhost' IDENTIFIED BY '<новый-пароль-рута>'; CREATE USER 'user'@'%' IDENTIFIED BY '<пароль-юзера>' PASSWORD EXPIRE NEVER; GRANT ALL PRIVILEGES ON *.* TO 'user'@'%'; \q
На этом установка MySQL сервера закончена. Удаляем неиспользуемые зависимости:
pkg autoremove
Выключаем гостевую систему и делаем резервную копию гостевой системы VMWare.