Copy stable/9 to releng/9.3 as part of the 9.3-RELEASE cycle.

Approved by: re (implicit)
Sponsored by: The FreeBSD Foundation

MFC 236352:
Bump date for content missed in r236290

Approved by: cperciva (implicit)

MFC r236290:
Document daily_status_security_chkportsum_enable

PR: docs/167980
Approved by: cperciva (implicit)

MFC r231171:
- Add an option to 404.status-zfs (enabled by default) to list all
zfs pools on the system.

- While here, document daily_status_zfs_enable in periodic.conf(5).

Approved by: jhb

MFC r228355:

- As of r226865, daily_scrub_zfs_default_threshold is 35 days.

PR: 162890

Copy head to stable/9 as part of 9.0-RELEASE release cycle.

Approved by: re (implicit)

Add an (off by default) check for negative permissions (where the
group on a object has less permissions that everyone). These
permissions will not work reliably over NFS if you have more than
14 supplemental groups and are usually not what you mean.

MFC after: 1 week

Fix typos, spelling, formatting and mdoc mistakes found by Nobuyuki while
translating these manual pages. Minor corrections by me.

Submitted by: Nobuyuki Koganemaru <n-kogane@syd.odn.ne.jp>

Add a periodic zfs scrub script.

Features:
- configurable amount of days between scrubs (default value or per pool)
- do not scrub directly after pool creation (respects the configured
number of days between scrubs)
- do not scrub if a scrub is in progress
- tells how to see the status of the scrub
- tells how many days since the last scrub if it skips the scrubbing
- warns if a non-existent pool is specified explicitely
(default: no pools specified -> all currently imported pools are
handled)
- runs late in the periodic run to not slow down the other periodic daily
scripts

Discussed on: fs@

o Add a script to check ntpd(8) state. Default is off.

PR: conf/112604
Submitted by: Oliver Fromme
MFC after: 1 month

Reword previous commit, now supporting better English.

Discussed with: ceri

Belated update for login.conf checks.
Bump doc date.

The kvm_mkdb(8) is long dead.

Markup polishing.

Move etc/rc.firewall6 to ipfw2+v6, update related rc.d and periodic scripts.
Since ipfw2 now does dual-stack, statistics for IPv6 come from the ipfw
scripts as well.

Actually bump the date to the commit-date for the last commit.

Document the graid3(8), gstripe(8) and gconcat(8) periodic scripts.

Document the daily_status_ata_raid_enable and daily_status_gmirror_enable
variables.

Remove references to rdist(1) and friends.

Submitted by: Björn König

Use 'manual page' instead of 'man page' for consistency.

Approved by: re (hrs)

Expand contractions.

Scheduled mdoc(7) sweep.

Teach periodic(8) security output to display information about blocked
packet counts by pf(4).

This adds a ``daily_status_security_pfdenied_enable'' variable to
periodic.conf, which defaults to ``YES'' as the matching IPF(W) versions.

The output will look like this (line wrapped):

pf denied packets:
> block drop log on rl0 proto tcp all [ Evaluations: 504986 Packets: 0
Bytes: 0 States: 0 ]
> block drop log on rl0 all [ Evaluations: 18559 Packets: 427 Bytes: 140578
States: 0 ]

Submitted by: clive (thanks a lot!)
MFC after: 2 weeks

Add a knob 'daily_status_security_diff_flags' controlling the
format of the 'diff' output generated during periodic(8) scripts.

Submitted by: keramida (script changes)
Reviewed by: keramida (man page changes)

Assorted markup, spelling, and grammar fixes.

Spelling and grammar fixups.

Describe pkg_version_index

Reviewed by: joe

mdoc(7) police: Scheduled sweep.

Give more information to users replacing sendmail regarding periodic's
submit mail queue check.

PR: docs/38924

Do not do manually what sendmail(8) can do better automatically.
Tell sendmail to clean up its own host status cache.
The error condition handling could probably be done better.

Uniformly refer to a file system as "file system".

Approved by: re

Add a new /etc/periodic/security script to check for packets
rejected by ipfilter (510.ipfdenied), and a corresponding periodic.conf
knob (daily_status_security_ipfdenied_enable).

Reviewed by: roberto
Approved by: re@

Add a pkg_version variable so that it's possible to run portsversion instead
of pkg_version in periodic/weekly/400.status-pkg.

Update mail queue related periodic scripts to account for sendmail 8.12's
clientmqueue (submit mail queue).

The new mailq display is only active if both the old
daily_status_mailq_enable is set to "YES" and the new
daily_status_include_submit_mailq is set to "YES" so people who disabled
440.status-mailq won't have any surprises.

Likewise, the new queue run is only active if both the old
daily_queuerun_enable is set to "YES" and the new daily_submit_queuerun
is set to "YES" so people who disabled 500.queuerun won't have any
surprises.

While I am here, remove the [ ! -d /var/spool/mqueue ] checks from
both scripts as the queue directory isn't always /var/spool/mqueue for
the main daemon -- it can be set to anything in the sendmail.cf file.

MFC after: 1 week

Fix spelling errors.

Mark daily_news_expire_enable as a variable, not a path.

Long ago, there was just /etc/daily. Then /etc/security was split out
of /etc/daily. Some time later, /etc/daily became a set of periodic(8)
scripts. Now, this evolution continues, and /etc/security has been
broken into periodic(8) scripts to make local customization easier and
more maintainable.

Reviewed by: ru
Approved by: ru

Fixed two typos.

PR: docs/32327
Submitted by: Frans Haarman <frans@haarman.com>

Oops, another obsolete UUCP knob

Note removal of UUCP periodic maintenance knobs

mdoc(7) police: Fixed broken xrefs.

mdoc(7) police:

Avoid using parenthesis enclosure macros (.Pq and .Po/.Pc) with plain text.
Not only this slows down the mdoc(7) processing significantly, but it also
has an undesired (in this case) effect of disabling hyphenation within the
entire enclosed block.

Remove $daily_status_named_logs and figure out which /var/log/messages*
files to look an (in the same way that /etc/security does).

Don't single-quote $start, reducing it to an empty string.

MFC after: 3 days

Removed whitespace at end-of-line; no content changes. I simply did
cd src/share; find man[1-9] -type f|xargs perl -pi -e 's/[ \t]+$//'

BTW, what editors are the culprits? I'm using vim and it shows
me whitespace at EOL in troff files with a thick blue block...

Reviewed by: Silence from cvs diff -b
MFC after: 7 days

mdoc(7) police: removed HISTORY info from the .Os call.

mdoc(7) police: fixed markup in rev. 1.26.

Remove vestiges of MFS.

Default daily_accounting_flags to -q. I thought this was a typo in the
originally submitted patch (oops!).

Also check for an empty $daily_accounting_save.

Submitted by: Udo Schweigert <Udo.Schweigert@cert.siemens.de>

Add $daily_accounting_save and $daily_accounting_flags

Submitted by: Udo Schweigert <Udo.Schweigert@cert.siemens.de>
MFC after: 2 weeks

mdoc(7) police: use .Va and .Vt where appropriate

Check for denied zone transfers (AXFR and IXFR).

mdoc(7) police: normalize .Nd.

Move the sendmail -q from cron to periodic, as suggested by a few people.
This has the benefit of adding a random start time element as daily
processing takes a different amount of time on different machines.

Fix typo: seperate -> separate.

Seperate does not exist in the english language.

Submitted to look at by: kris

mdoc(7) police: split punctuation characters + misc fixes.

Allow the output of /etc/security to be logged or mailed to different
users in line with ${daily,weekly,monthly}_output using a new
$daily_status_security_output variable.

PR: 24643

Prepare for mdoc(7)NG.

mdoc(7) police: use the new features of the Nm macro.

remove fullstops from the end of .Xr lines in SEE ALSO sections.

* Fix inconsistency between "int" and "num"; as far as I can see they mean
the same thing in this context.
* Only include one fullstop in the SEE ALSO line.

PR: 22658
Submitted by: Yoshihiko Sarumaru <mistral@imasy.or.jp>

Change .Os FreeBSD 5.0 to .Os FreeBSD.

PR: 22684
Submitted by: Akinori YAMADA <yamada-a@nextcom.co.jp>

Correct the description of a few options to reflect that commands and/or
the results that they actualy use/generate.

PR: docs/22267
Submitted by: SUZUKI Koichi <koich@cac.co.jp>

Put temporary output in ${TMPDIR:-/tmp}
If $<basedir>_output is not set, don't redirect output

PR: 21395

Another overhaul of the periodic stuff.

All periodic sub-scripts <larf> now have their return codes interpreted
by periodic(8). Output may be masked based on variable values in
periodic.conf.

It's also now possible to email periodic output to arbitrary addresses,
or to send it to a log file, examples of which can be found in
newsyslog.conf.

The upshot of it all should be no discernable changes to the default
behaviour of periodic(8).

PR: 21250

Complete migration of aliases file to /etc/mail/aliases.
The maintainers of share/examples/diskless/README.TEMPLATING and mergemaster
have been contacted so those may be updated as well.

Correct a typo

Spotted by: Jimmy Olgeni <olgeni@uli.it>

Introduce a new option, daily_status_disks_df_flags, which specifies
the command-line arguments to be used for the call to df(1) when
daily_status_disks_enable is set to YES.

The name of the new variable was chosen by the maintainer of our
periodic hierarchy, Brian Somers.

PR: 19631

Use "yesterday's" instead of "yesterdays" as required for correct
grammar.

Since this pushes the line to an unacceptable length, apply the
accepted line breaking style.

De-spam (oops!)

Spotted by: sheldonh

Add $daily_status_mail_rejects_logs, defaulting to 3 to control
how many /var/log/maillog* files to check

PR: 19587

Reword the description of weekly_status_pkg_enable (although not
quite how Sheldon suggested)

Suggested by: sheldonh

Add weekly_status_pkg_enable (defaults to NO)

Mention $daily_accounting_compress

Forgotten by: Ben & I

Introduce /etc/defaults/periodic.conf, similar in concept to rc.conf.
The only change in the default functionality should be that
the output reports are slightly more verbose WRT files deleted.

Not objected to by: freebsd-arch