1#!/bin/sh
2#
3# This is defaults/periodic.conf - a file full of useful variables that
4# you can set to change the default behaviour of periodic jobs on your
5# system.  You should not edit this file!  Put any overrides into one of the
6# $periodic_conf_files instead and you will be able to update these defaults
7# later without spamming your local configuration information.
8#
9# The $periodic_conf_files files should only contain values which override
10# values set in this file.  This eases the upgrade path when defaults
11# are changed and new features are added.
12#
13# For a more detailed explanation of all the periodic.conf variables, please
14# refer to the periodic.conf(5) manual page.
15#
16# $FreeBSD: stable/11/etc/defaults/periodic.conf 317857 2017-05-05 21:59:34Z asomers $
17#
18
19# What files override these defaults ?
20periodic_conf_files="/etc/periodic.conf /etc/periodic.conf.local"
21
22# periodic script dirs
23local_periodic="/usr/local/etc/periodic"
24
25# Max time to sleep to avoid causing congestion on download servers
26anticongestion_sleeptime=3600
27
28# Daily options
29
30# These options are used by periodic(8) itself to determine what to do
31# with the output of the sub-programs that are run, and where to send
32# that output.  $daily_output might be set to /var/log/daily.log if you
33# wish to log the daily output and have the files rotated by newsyslog(8)
34#
35daily_output="root"					# user or /file
36daily_show_success="YES"				# scripts returning 0
37daily_show_info="YES"					# scripts returning 1
38daily_show_badconfig="NO"				# scripts returning 2
39
40# 100.clean-disks
41daily_clean_disks_enable="NO"				# Delete files daily
42daily_clean_disks_files="[#,]* .#* a.out *.core *.CKP .emacs_[0-9]*"
43daily_clean_disks_days=3				# If older than this
44daily_clean_disks_verbose="YES"				# Mention files deleted
45
46# 110.clean-tmps
47daily_clean_tmps_enable="NO"				# Delete stuff daily
48daily_clean_tmps_dirs="/tmp"				# Delete under here
49daily_clean_tmps_days="3"				# If not accessed for
50daily_clean_tmps_ignore=".X*-lock .X11-unix .ICE-unix .font-unix .XIM-unix"
51daily_clean_tmps_ignore="$daily_clean_tmps_ignore quota.user quota.group .snap"
52daily_clean_tmps_ignore="$daily_clean_tmps_ignore .sujournal"
53							# Don't delete these
54daily_clean_tmps_verbose="YES"				# Mention files deleted
55
56# 120.clean-preserve
57daily_clean_preserve_enable="YES"			# Delete files daily
58daily_clean_preserve_days=7				# If not modified for
59daily_clean_preserve_verbose="YES"			# Mention files deleted
60
61# 130.clean-msgs
62daily_clean_msgs_enable="YES"				# Delete msgs daily
63daily_clean_msgs_days=					# If not modified for
64
65# 140.clean-rwho
66daily_clean_rwho_enable="YES"				# Delete rwho daily
67daily_clean_rwho_days=7					# If not modified for
68daily_clean_rwho_verbose="YES"				# Mention files deleted
69
70# 150.clean-hoststat
71daily_clean_hoststat_enable="YES"			# Purge sendmail host
72							# status cache daily
73
74# 200.backup-passwd
75daily_backup_passwd_enable="YES"			# Backup passwd & group
76
77# 210.backup-aliases
78daily_backup_aliases_enable="YES"			# Backup mail aliases
79
80# 300.calendar
81daily_calendar_enable="NO"				# Run calendar -a
82
83# 310.accounting
84daily_accounting_enable="YES"				# Rotate acct files
85daily_accounting_compress="NO"				# Gzip rotated files
86daily_accounting_flags=-q				# Flags to /usr/sbin/sa
87daily_accounting_save=3					# How many files to save
88
89# 330.news
90daily_news_expire_enable="YES"				# Run news.expire
91
92# 400.status-disks
93daily_status_disks_enable="YES"				# Check disk status
94daily_status_disks_df_flags="-l -h"			# df(1) flags for check
95
96# 401.status-graid
97daily_status_graid_enable="NO"				# Check graid(8)
98
99# 404.status-zfs
100daily_status_zfs_enable="NO"				# Check ZFS
101daily_status_zfs_zpool_list_enable="YES"		# List ZFS pools
102
103# 406.status-gmirror
104daily_status_gmirror_enable="NO"			# Check gmirror(8)
105
106# 407.status-graid3
107daily_status_graid3_enable="NO" 			# Check graid3(8)
108
109# 408.status-gstripe
110daily_status_gstripe_enable="NO"			# Check gstripe(8)
111
112# 409.status-gconcat
113daily_status_gconcat_enable="NO"			# Check gconcat(8)
114
115# 410.status-mfi
116daily_status_mfi_enable="NO"				# Check mfiutil(8)
117
118# 420.status-network
119daily_status_network_enable="YES"			# Check network status
120daily_status_network_usedns="YES"			# DNS lookups are ok
121daily_status_network_netstat_flags="-d"			# netstat(1) flags
122
123# 430.status-uptime
124daily_status_uptime_enable="YES"			# Check system uptime
125
126# 440.status-mailq
127daily_status_mailq_enable="YES"				# Check mail status
128daily_status_mailq_shorten="NO"				# Shorten output
129daily_status_include_submit_mailq="YES"			# Also submit queue
130
131# 450.status-security
132daily_status_security_enable="YES"			# Security check
133# See also "Security options" below for more options
134daily_status_security_inline="NO"			# Run inline ?
135daily_status_security_output="root"			# user or /file
136
137# 460.status-mail-rejects
138daily_status_mail_rejects_enable="YES"			# Check mail rejects
139daily_status_mail_rejects_logs=3			# How many logs to check
140daily_status_mail_rejects_shorten="NO"			# Shorten output
141
142# 480.leapfile-ntpd
143daily_ntpd_leapfile_enable="YES"			# Fetch NTP leapfile
144
145# 480.status-ntpd
146daily_status_ntpd_enable="NO"				# Check NTP status
147
148# 500.queuerun
149daily_queuerun_enable="YES"				# Run mail queue
150daily_submit_queuerun="YES"				# Also submit queue
151
152# 510.status-world-kernel
153daily_status_world_kernel="YES"				# Check the running
154							# userland/kernel version
155
156# 800.scrub-zfs
157daily_scrub_zfs_enable="NO"
158daily_scrub_zfs_pools=""			# empty string selects all pools
159daily_scrub_zfs_default_threshold="35"		# days between scrubs
160#daily_scrub_zfs_${poolname}_threshold="35"	# pool specific threshold
161
162# 999.local
163daily_local="/etc/daily.local"				# Local scripts
164
165
166# Weekly options
167
168# These options are used by periodic(8) itself to determine what to do
169# with the output of the sub-programs that are run, and where to send
170# that output.  $weekly_output might be set to /var/log/weekly.log if you
171# wish to log the weekly output and have the files rotated by newsyslog(8)
172#
173weekly_output="root"					# user or /file
174weekly_show_success="YES"				# scripts returning 0
175weekly_show_info="YES"					# scripts returning 1
176weekly_show_badconfig="NO"				# scripts returning 2
177
178# 310.locate
179weekly_locate_enable="YES"				# Update locate weekly
180
181# 320.whatis
182weekly_whatis_enable="YES"				# Update whatis weekly
183
184# 330.catman
185weekly_catman_enable="NO"				# Preformat man pages
186
187# 340.noid
188weekly_noid_enable="NO"					# Find unowned files
189weekly_noid_dirs="/"					# Look here
190
191# 450.status-security
192weekly_status_security_enable="YES"			# Security check
193# See also "Security options" above for more options
194weekly_status_security_inline="NO"			# Run inline ?
195weekly_status_security_output="root"			# user or /file
196
197# 999.local
198weekly_local="/etc/weekly.local"			# Local scripts
199
200
201# Monthly options
202
203# These options are used by periodic(8) itself to determine what to do
204# with the output of the sub-programs that are run, and where to send
205# that output.  $monthly_output might be set to /var/log/monthly.log if you
206# wish to log the monthly output and have the files rotated by newsyslog(8)
207#
208monthly_output="root"					# user or /file
209monthly_show_success="YES"				# scripts returning 0
210monthly_show_info="YES"					# scripts returning 1
211monthly_show_badconfig="NO"				# scripts returning 2
212
213# 200.accounting
214monthly_accounting_enable="YES"				# Login accounting
215
216# 450.status-security
217monthly_status_security_enable="YES"			# Security check
218# See also "Security options" above for more options
219monthly_status_security_inline="NO"			# Run inline ?
220monthly_status_security_output="root"			# user or /file
221
222# 999.local
223monthly_local="/etc/monthly.local"			# Local scripts
224
225
226# Security options
227
228security_show_success="YES"				# scripts returning 0
229security_show_info="YES"				# scripts returning 1
230security_show_badconfig="NO"				# scripts returning 2
231
232# These options are used by the security periodic(8) scripts spawned in
233# daily and weekly 450.status-security.
234security_status_logdir="/var/log"			# Directory for logs
235security_status_diff_flags="-b -u"			# flags for diff output
236
237# Each of the security_status_*_period options below can have one of the
238# following values:
239# - NO: do not run at all
240# - daily: only run during the daily security status
241# - weekly: only run during the weekly security status
242# - monthly: only run during the monthly security status
243# Note that if periodic security scripts are run from crontab(5) directly,
244# they will be run unless _enable or _period is set to "NO".
245
246# 100.chksetuid
247security_status_chksetuid_enable="YES"
248security_status_chksetuid_period="daily"
249
250# 110.neggrpperm
251security_status_neggrpperm_enable="YES"
252security_status_neggrpperm_period="daily"
253
254# 200.chkmounts
255security_status_chkmounts_enable="YES"
256security_status_chkmounts_period="daily"
257#security_status_chkmounts_ignore="^amd:"		# Don't check matching
258							# FS types
259security_status_noamd="NO"				# Don't check amd mounts
260
261# 300.chkuid0
262security_status_chkuid0_enable="YES"
263security_status_chkuid0_period="daily"
264
265# 400.passwdless
266security_status_passwdless_enable="YES"
267security_status_passwdless_period="daily"
268
269# 410.logincheck
270security_status_logincheck_enable="YES"
271security_status_logincheck_period="daily"
272
273# 500.ipfwdenied
274security_status_ipfwdenied_enable="YES"
275security_status_ipfwdenied_period="daily"
276
277# 510.ipfdenied
278security_status_ipfdenied_enable="YES"
279security_status_ipfdenied_period="daily"
280
281# 520.pfdenied
282security_status_pfdenied_enable="YES"
283security_status_pfdenied_period="daily"
284
285# 550.ipfwlimit
286security_status_ipfwlimit_enable="YES"
287security_status_ipfwlimit_period="daily"
288
289# 610.ipf6denied
290security_status_ipf6denied_enable="YES"
291security_status_ipf6denied_period="daily"
292
293# 700.kernelmsg
294security_status_kernelmsg_enable="YES"
295security_status_kernelmsg_period="daily"
296
297# 800.loginfail
298security_status_loginfail_enable="YES"
299security_status_loginfail_period="daily"
300
301# 900.tcpwrap
302security_status_tcpwrap_enable="YES"
303security_status_tcpwrap_period="daily"
304
305
306
307# Define source_periodic_confs, the mechanism used by /etc/periodic/*/*
308# scripts to source defaults/periodic.conf overrides safely.
309
310if [ -z "${source_periodic_confs_defined}" ]; then
311        source_periodic_confs_defined=yes
312
313	# Sleep for a random amount of time in order to mitigate the thundering
314	# herd problem of multiple hosts running periodic simultaneously.
315	# Will not sleep when used interactively.
316	# Will sleep at most once per invocation of periodic
317	anticongestion() {
318		[ -n "$PERIODIC_IS_INTERACTIVE" ] && return
319		if [ -f "$PERIODIC_ANTICONGESTION_FILE" ]; then
320			rm -f $PERIODIC_ANTICONGESTION_FILE
321			sleep `jot -r 1 0 ${anticongestion_sleeptime}`
322		fi
323	}
324
325	# Compatibility with old daily variable names.
326	# They can be removed in stable/11.
327	security_daily_compat_var() {
328		local var=$1 dailyvar value
329
330		dailyvar=daily_status_security${var#security_status}
331		periodvar=${var%enable}period
332		eval value=\"\$$dailyvar\"
333		[ -z "$value" ] && return
334		echo "Warning: Variable \$$dailyvar is deprecated," \
335		    "use \$$var instead." >&2
336		case "$value" in
337		[Yy][Ee][Ss])
338			eval $var=YES
339			eval $periodvar=daily
340			;;
341		*)
342			eval $var=\"$value\"
343			;;
344		esac
345	}
346
347	check_yesno_period() {
348		local var="$1" periodvar value period
349
350		eval value=\"\$$var\"
351		case "$value" in
352		[Yy][Ee][Ss]) ;;
353		*) return 1 ;;
354		esac
355
356		periodvar=${var%enable}period
357		eval period=\"\$$periodvar\"
358		case "$PERIODIC" in
359		"security daily")
360			case "$period" in
361			[Dd][Aa][Ii][Ll][Yy]) return 0 ;;
362			*) return 1 ;;
363			esac
364			;;
365		"security weekly")
366			case "$period" in
367			[Ww][Ee][Ee][Kk][Ll][Yy]) return 0 ;;
368			*) return 1 ;;
369			esac
370			;;
371		"security monthly")
372			case "$period" in
373			[Mm][Oo][Nn][Tt][Hh][Ll][Yy]) return 0 ;;
374			*) return 1 ;;
375			esac
376			;;
377		security)
378			# Run directly from crontab(5).
379			case "$period" in
380			[Nn][Oo]) return 1 ;;
381			*) return 0 ;;
382			esac
383			;;
384                '')
385                        # Script run manually.
386                        return 0
387                        ;;
388		*)
389			echo "ASSERTION FAILED: Unexpected value for" \
390			    "\$PERIODIC: '$PERIODIC'" >&2
391			exit 127
392			;;
393		esac
394	}
395
396        source_periodic_confs() {
397                local i sourced_files
398
399                for i in ${periodic_conf_files}; do
400                        case ${sourced_files} in
401                        *:$i:*)
402                                ;;
403                        *)
404                                sourced_files="${sourced_files}:$i:"
405                                [ -r $i ] && . $i
406                                ;;
407                        esac
408                done
409        }
410fi
411