install-post.html

FreeBSD操作系统的详细使用手册

         All files uploaded will be owned by this ID.

Group:   Which group you wish the anonymous FTP user to be in.

Comment: String describing this user in /etc/passwd


FTP Root Directory:

        Where files available for anonymous FTP will be kept.

Upload subdirectory:

        Where files uploaded by anonymous FTP users will go.
</pre>

<p>The ftp root directory will be put in <tt class="FILENAME">/var</tt> by default. If
you do not have enough room there for the anticipated FTP needs, the <tt
class="FILENAME">/usr</tt> directory could be used by setting the FTP Root Directory to
<tt class="FILENAME">/usr/ftp</tt>.</p>

<p>When you are satisfied with the values, press <b class="KEYCAP">Enter</b> to
continue.</p>

<pre class="SCREEN">
                          User Confirmation Requested 
         Create a welcome message file for anonymous FTP users?

                              [ Yes ]    No
</pre>

<p>If you select <span class="GUIBUTTON">[&nbsp;Yes&nbsp;]</span> and press <b
class="KEYCAP">Enter</b>, an editor will automatically start allowing you to edit the
message.</p>

<div class="FIGURE"><a id="ANON-FTP4" name="ANON-FTP4"></a>
<p><b>Figure 2-35. Edit the FTP Welcome Message</b></p>

<p><img src="install/ftp-anon2.png" /></p>
</div>

<p>This is a text editor called <tt class="COMMAND">ee</tt>. Use the instructions to
change the message or change the message later using a text editor of your choice. Note
the file name/location at the bottom of the editor screen.</p>

<p>Press <b class="KEYCAP">Esc</b> and a pop-up menu will default to <span
class="GUIMENUITEM">a) leave editor</span>. Press <b class="KEYCAP">Enter</b> to exit and
continue. Press <b class="KEYCAP">Enter</b> again to save changes if you made any.</p>
</div>
</div>

<div class="SECT2">
<h2 class="SECT2"><a id="NFSCONF" name="NFSCONF">2.9.5 Configure Network File
System</a></h2>

<p>Network File System (NFS) allows sharing of files across a network. A machine can be
configured as a server, a client, or both. Refer to <a href="network-nfs.html">Section
23.3</a> for a more information.</p>

<div class="SECT3">
<h3 class="SECT3"><a id="NSF-SERVER-OPTIONS" name="NSF-SERVER-OPTIONS">2.9.5.1 NFS
Server</a></h3>

<pre class="SCREEN">
                       User Confirmation Requested
 Do you want to configure this machine as an NFS server? 

                              Yes    [ No ]
</pre>

<p>If there is no need for a Network File System server, select <span
class="GUIBUTTON">[&nbsp;No&nbsp;]</span> and press <b class="KEYCAP">Enter</b>.</p>

<p>If <span class="GUIBUTTON">[&nbsp;Yes&nbsp;]</span> is chosen, a message will pop-up
indicating that the <tt class="FILENAME">exports</tt> file must be created.</p>

<pre class="SCREEN">
                               Message
Operating as an NFS server means that you must first configure an
/etc/exports file to indicate which hosts are allowed certain kinds of
access to your local filesystems.
Press [Enter] now to invoke an editor on /etc/exports
                               [ OK ]
</pre>

<p>Press <b class="KEYCAP">Enter</b> to continue. A text editor will start allowing the
<tt class="FILENAME">exports</tt> file to be created and edited.</p>

<div class="FIGURE"><a id="NFS-SERVER-EDIT" name="NFS-SERVER-EDIT"></a>
<p><b>Figure 2-36. Editing <tt class="FILENAME">exports</tt></b></p>

<p><img src="install/nfs-server-edit.png" /></p>
</div>

<p>Use the instructions to add the actual exported filesystems now or later using a text
editor of your choice. Note the file name/location at the bottom of the editor
screen.</p>

<p>Press <b class="KEYCAP">Esc</b> and a pop-up menu will default to <span
class="GUIMENUITEM">a) leave editor</span>. Press <b class="KEYCAP">Enter</b> to exit and
continue.</p>
</div>

<div class="SECT3">
<h3 class="SECT3"><a id="NFS-CLIENT-OPTIONS" name="NFS-CLIENT-OPTIONS">2.9.5.2 NFS
Client</a></h3>

<p>The NFS client allows your machine to access NFS servers.</p>

<pre class="SCREEN">
                       User Confirmation Requested
 Do you want to configure this machine as an NFS client? 

                              Yes   [ No ]
</pre>

<p>With the arrow keys, select <span class="GUIBUTTON">[&nbsp;Yes&nbsp;]</span> or <span
class="GUIBUTTON">[&nbsp;No&nbsp;]</span> as appropriate and press <b
class="KEYCAP">Enter</b>.</p>
</div>
</div>

<div class="SECT2">
<h2 class="SECT2"><a id="SECURITYPROFILE" name="SECURITYPROFILE">2.9.6 Security
Profile</a></h2>

<p>A ``security profile'' is a set of configuration options that attempts to achieve the
desired ratio of security to convenience by enabling and disabling certain programs and
other settings. The more severe the security profile, the fewer programs will be enabled
by default. This is one of the basic principles of security: do not run anything except
what you must.</p>

<p>Please note that the security profile is just a default setting. All programs can be
enabled and disabled after you have installed FreeBSD by editing or adding the
appropriate line(s) to <tt class="FILENAME">/etc/rc.conf</tt>. For more information,
please see the <a href="http://www.FreeBSD.org/cgi/man.cgi?query=rc.conf&sektion=5"><span
class="CITEREFENTRY"><span class="REFENTRYTITLE">rc.conf</span>(5)</span></a> manual
page.</p>

<p>The following table describes what each of the security profiles does. The columns are
the choices you have for a security profile, and the rows are the program or feature that
the profile enables or disables.</p>

<div class="TABLE"><a id="AEN2387" name="AEN2387"></a>
<p><b>Table 2-4. Possible Security Profiles</b></p>

<table border="1" class="CALSTABLE">
<col />
<col />
<col />
<thead>
<tr>
<th>&nbsp;</th>
<th>Extreme</th>
<th>Moderate</th>
</tr>
</thead>

<tbody>
<tr>
<td><a href="http://www.FreeBSD.org/cgi/man.cgi?query=sendmail&sektion=8"><span
class="CITEREFENTRY"><span class="REFENTRYTITLE">sendmail</span>(8)</span></a></td>
<td>NO</td>
<td>YES</td>
</tr>

<tr>
<td><a
href="http://www.FreeBSD.org/cgi/man.cgi?query=sshd&sektion=8&manpath=OpenBSD+3.4"><span
class="CITEREFENTRY"><span class="REFENTRYTITLE">sshd</span>(8)</span></a></td>
<td>NO</td>
<td>YES</td>
</tr>

<tr>
<td><a href="http://www.FreeBSD.org/cgi/man.cgi?query=portmap&sektion=8"><span
class="CITEREFENTRY"><span class="REFENTRYTITLE">portmap</span>(8)</span></a></td>
<td>NO</td>
<td>MAYBE <a id="AEN2417" name="AEN2417" href="#FTN.AEN2417"><span
class="footnote">[a]</span></a> </td>
</tr>

<tr>
<td>NFS server</td>
<td>NO</td>
<td>YES</td>
</tr>

<tr>
<td><a href="http://www.FreeBSD.org/cgi/man.cgi?query=securelevel&sektion=8"><span
class="CITEREFENTRY"><span class="REFENTRYTITLE">securelevel</span>(8)</span></a></td>
<td>YES <a id="AEN2429" name="AEN2429" href="#FTN.AEN2429"><span
class="footnote">[b]</span></a> </td>
<td>NO</td>
</tr>
</tbody>

<tr>
<td colspan="3">Notes:<br />
<a id="FTN.AEN2417" name="FTN.AEN2417">a.</a> The portmapper is enabled if the machine
has been configured as an NFS client or server earlier in the installation.<br />
<a id="FTN.AEN2429" name="FTN.AEN2429">b.</a> If you choose a security profile that sets
the securelevel to ``Extreme'' or ``High'', you must be aware of the implications. Please
read the <a href="http://www.FreeBSD.org/cgi/man.cgi?query=init&sektion=8"><span
class="CITEREFENTRY"><span class="REFENTRYTITLE">init</span>(8)</span></a> manual page
and pay particular attention to the meanings of the security levels, or you may have
significant trouble later!<br />
</td>
</tr>
</table>
</div>

<pre class="SCREEN">
                       User Confirmation Requested
 Do you want to select a default security profile for this host (select
 No for "medium" security)? 

                            [ Yes ]    No
</pre>

<p>Selecting <span class="GUIBUTTON">[&nbsp;No&nbsp;]</span> and pressing <b
class="KEYCAP">Enter</b> will set the security profile to medium.</p>

<p>Selecting <span class="GUIBUTTON">[&nbsp;Yes&nbsp;]</span> and pressing <b
class="KEYCAP">Enter</b> will allow selecting a different security profile.</p>

<div class="FIGURE"><a id="SECURITY-PROFILE" name="SECURITY-PROFILE"></a>
<p><b>Figure 2-37. Security Profile Options</b></p>

<p><img src="install/security.png" /></p>
</div>

<p>Press <b class="KEYCAP">F1</b> to display the help. Press <b class="KEYCAP">Enter</b>
to return to selection menu.</p>

<p>Use the arrow keys to choose <span class="GUIMENUITEM">Medium</span> unless your are
sure that another level is required for your needs. With <span
class="GUIBUTTON">[&nbsp;OK&nbsp;]</span> highlighted, press <b
class="KEYCAP">Enter</b>.</p>

<p>An appropriate confirmation message will display depending on which security setting
was chosen.</p>

<pre class="SCREEN">
                                 Message

Moderate security settings have been selected.

Sendmail and SSHd have been enabled, securelevels are
disabled, and NFS server setting have been left intact.
PLEASE NOTE that this still does not save you from having
to properly secure your system in other ways or exercise
due diligence in your administration, this simply picks
a standard set of out-of-box defaults to start with.

To change any of these settings later, edit /etc/rc.conf

                                  [OK]
</pre>

<pre class="SCREEN">
                                 Message

Extreme security settings have been selected.

Sendmail, SSHd, and NFS services have been disabled, and
securelevels have been enabled.
PLEASE NOTE that this still does not save you from having
to properly secure your system in other ways or exercise
due diligence in your administration, this simply picks
a more secure set of out-of-box defaults to start with.

To change any of these settings later, edit /etc/rc.conf

                                  [OK]
</pre>

<p>Press <b class="KEYCAP">Enter</b> to continue with the post-installation
configuration.</p>

<div class="WARNING">
<blockquote class="WARNING">
<p><b>Warning:</b> The security profile is not a silver bullet! Even if you use the
extreme setting, you need to keep up with security issues by reading an appropriate
mailing list (<a href="eresources.html#ERESOURCES-MAIL">Section C.1</a>), using good
passwords and passphrases, and generally adhering to good security practices. It simply
sets up the desired security to convenience ratio out of the box.</p>
</blockquote>
</div>
</div>

<div class="SECT2">
<h2 class="SECT2"><a id="CONSOLE" name="CONSOLE">2.9.7 System Console Settings</a></h2>

<p>There are several options available to customize the system console.</p>

<pre class="SCREEN">
                      User Confirmation Requested 
       Would you like to customize your system console settings?

                              [ Yes ]  No
</pre>

<p>To view and configure the options, select <span
class="GUIBUTTON">[&nbsp;Yes&nbsp;]</span> and press <b class="KEYCAP">Enter</b>.</p>

<div class="FIGURE"><a id="SAVER-OPTIONS" name="SAVER-OPTIONS"></a>
<p><b>Figure 2-38. System Console Configuration Options</b></p>

<p><img src="install/console-saver1.png" /></p>
</div>

<p>A commonly used option is the screen saver. Use the arrow keys to select <span
class="GUIMENUITEM">Saver</span> and then press <b class="KEYCAP">Enter</b>.</p>

<div class="FIGURE"><a id="SAVER-SELECT" name="SAVER-SELECT"></a>
<p><b>Figure 2-39. Screen Saver Options</b></p>

<p><img src="install/console-saver2.png" /></p>
</div>