Copy head@r302406 to stable/11 as part of the 11.0-RELEASE cycle.
Prune svn:mergeinfo from the new branch, as nothing has been merged
here.

Additional commits post-branch will follow.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

Allow info to display correctly in for varying tabstop settings

The SAMPLE message and notes where tab seperated for some parts and hence
displayed incorrectly unless tabstop was set to 8. Switch to spaces to it
displays correctly independent of the tabstop setting.

Sponsored by: Multiplay

Disable libwrap (TCP wrappers) support in rpcbind by default, introducing
new command line options -W, to enable it when needed.

On my tests this change by almost ten times improves rpcbind performance.

No objections: many, net@

Comment out lines that use example addresses and example.com names so
that local changes can be made more easily (without having to comment
these lines, and making the diff more readable).

Since NIS is an RPC based service, add a note that when adjusting access
controls in NIS, similar access controls should be considered for the
rpcbind as well.

Reimplementation of world/kernel build options. For details, see:

http://lists.freebsd.org/pipermail/freebsd-current/2006-March/061725.html

The src.conf(5) manpage is to follow in a few days.

Brought to you by: imp, jhb, kris, phk, ru (all bugs are mine)

The libwrap built with NO_INET6=yes cannot parse an IPv6 address.
So, mention it in comment.

Submitted by: Dmitry Morozovsky <marck__at__rinet.ru>
MFC after: 2 days

Use RFC 3849 address for examples.

Pointed out by: mistral@imasy.or.jp
MFC after: 1 week

allow ::1 explicitly.

Pointed out by: mistral@imasy.or.jp
MFC after: 1 week

Removed whitespace at BOF, EOL & EOF.

Enable TCP_WRAPPERs for the NIS server. The protection afforded is
not massive, but usable.

Clear up what the line "ALL : PARANOID : RFC931 20 : deny" means
to tcp wrappers. The description is a little long, but hopefully
accurate.

Fix a misleading comment

Submitted by: Mark Knight <markk@knigma.org>

"Portmapper" -> "Rpcbind" in a comment.

s/portmap/rpcbind
Pointed out by: Hajimu UMEMOTO <ume@mahoroba.org>

Add some examples for IPv6 addresses.

PR: conf/18614
Submitted by: James Housley <jim@thehousleys.net>

Add IP addresses to the rules required to "Allow anything from
localhost", since portmap(8) is included in "anything".

Submitted by: Doug Barton <Doug@gorean.org>

Clarify the disposition of hosts.deny and provide a logically
consistent portmap example rule.
Reviewed by: obrien, markm
Obtained-good-ideas from: obrien

The default rule in this file actually sent mail to root as its default
action when denying access to a service. Unfortunately, this also makes
a dandy denial-of-service attack possible. Change to just log the event
and shoot a "go away" response back down the socket.

Fix English. Also use full spelling and reorg a little while I'm here.

Submitted by: Andy Farkas <andyf@speednet.com.au>

MFS: note that only IP addresses work when wrapping the portmapper.
Make clearer we consider this only an example, and admins should really
write this file for their needs.

$Id$ -> $FreeBSD$

Add a sample entry for Exim, in preparation for the upcoming behaviour
change in the port, where TCP Wrapper support will become the default.

Requested by: markm

Use /usr/bin/finger rather than `safe_finger'.

Use more politically correct examples, and expand the examples a bit.

Add an example hosts.allow for the (base system) tcp_wrappers.
Anyone with good ideas for this is welcome to contribute.