I will assume that if you are reading this, that you have completed the installation steps described in our Installing FreeBSD 6.2 document. This document will show the steps to take to deploy a FreeBSD server. This server will have the latest stable from the Apache 2.2 tree, PHP 5, MySQL 5.0, Sendmail with SMTP-AUTH, Webmail, Bind DNS, SNMP, synchronized local time, and Webmin. I have also included steps to take to build a network graphing solution with Rrdtool/Cacti, and this part can be considered optional. This document is basically, "the way I do it", and I hope you find it useful.

Setup Useful Daemons

We are going to install Webmin with SSL, net-snmp, and then set up ntpd for time synchronization. When you configure Webmin, be sure to choose 'yes' when asked if you want to use SSL. When configuring net-snmp, make sure you specify snmp-v1 and snmp-v2 community strings that only you know (this is for security). Portupgrade, Webmin, and net-snmp can all be safely installed using the 'pkg_add -r' method as well, if you want to save some time (all though I usually prefer to build from the ports collection).

# cd /usr/ports/ports-mgmt/portupgrade; make install clean
# cd /usr/ports/sysutils/webmin; make install clean
# cd /usr/ports/net-mgmt/net-snmp; make install clean

As we begin time synchronization, lets first manually sync the time of the computer (optional).

# ntpdate -v -b 0.us.pool.ntp.org

Configure net-snmp, and set your community strings.

# snmpconf

Configure webmin.

# /usr/local/lib/webmin/setup.sh

Add these daemons to /etc/rc.conf, so that they start at boot.

ntpdate_enable="YES"
ntpdate_hosts="0.us.pool.ntp.org"
snmpd_enable="YES"
webmin_enable="YES"
ntpd_enable="YES"

Ntpd will require the creation and population of the file /etc/ntp.conf, with these settings:

server 0.us.pool.ntp.org
server 1.us.pool.ntp.org
server 2.us.pool.ntp.org
restrict 192.168.125.0 mask 255.255.255.0 nomodify notrap
driftfile /var/db/ntp.drift

Last, we start our daemons (webmin already started with the configuration script)

# /etc/rc.d/ntpd start; /usr/local/etc/rc.d/snmpd start

Configuring Mail Services

Now we will begin with configuring the Sendmail SMTP server, with SMTP-AUTH. When we compile Sendmail, we want it to recognize that we will use SASL2 for smtp authentication. So, we need to add these items to the file /etc/make.conf:

SENDMAIL_CFLAGS=-I/usr/local/include -DSASL=2
SENDMAIL_LDFLAGS=-L/usr/local/lib
SENDMAIL_LDADD=-lsasl2

Now, compile sasl2 and sasl2-saslauthd (in 1 operation):

# cd /usr/ports/security/cyrus-sasl2-saslauthd; make install clean

Check the contents of /usr/local/lib/sasl2/Sendmail.conf, make sure it says: pwcheck_method: saslauthd

# cat /usr/local/lib/sasl2/Sendmail.conf
pwcheck_method: saslauthd

Configure saslauthd to load at boot. Add this to the end of /etc/rc.conf:

saslauthd_enable="YES"

Start saslauthd:

# /usr/local/etc/rc.d/saslauthd start

Now its time to recompile sendmail with SASL2 support.

# cd /usr/src/lib/libsm; make clean; make obj; make depend; make
# cd /usr/src/lib/libsmutil; make clean; make obj; make depend; make
# cd /usr/src/usr.sbin/sendmail; make clean; make obj; make depend; make; make install

Create your servers copy of the .mc file. it will be [hostname].mc.

# cd /etc/mail
# make all

Edit the [hostname].mc file, add these lines, I put mine above DAEMON_OPTIONS:

define(`confAUTH_MECHANISMS',`PLAIN LOGIN')dnl
TRUST_AUTH_MECH(`PLAIN LOGIN')dnl

Set sendmail to start (and listen) at boot, so add this to /etc/rc.conf:

sendmail_enable="YES"

Create the file /etc/mail/local-host-names and insert your domain name(s) to accept mail for. Then, finish the sendmail re-build.

# touch /etc/mail/local-host-names
# make all install restart

For good measure, I always give Sendmail a second restart, forcing it to re-read all configuration files.

# /etc/rc.d/sendmail restart

Dovecot is going to be our POP3/IMAP daemon, so our users can get their mail from remote.

# cd /usr/ports/mail/dovecot; make install clean
# cd /usr/local/etc
# cp dovecot-example.conf dovecot.conf

When you edit the dovecot.conf file, you will need to disable ssl support, and enable plain text login. Also, verify that mail_extra_groups is set to mail.

ssl_disable = yes
disable_plaintext_auth = no
mail_extra_groups = mail

Configure Dovecot to start at boot, add this to /etc/rc.conf:

dovecot_enable="YES"

And then start dovecoot:

# /usr/local/etc/rc.d/dovecot start

Spam Control is pretty much a necessity in this day and age, and Spamassassin is up for the job.

# cd /usr/ports/mail/spamass-milter; make install clean

And add the following to /etc/rc.conf so that Spamassassin will start at boot time:

spamd_enable="YES"
spamd_flags="-u spamd"
spamass_milter_enable="YES"

* NOTE: I am still researching if this next line is the [wrong] way to do this, but on my system, I make this change so that spamd can write to a single directory in /root (so that it can keep its learning files updated). If you skip this, spamassassin will still work, it just wont be updating its white list.

mkdir /root/.spamassassin
chmod 775 /root/.spamassassin
chown root:spamd /root/.spamassassin

Finally, create or edit the file /usr/local/etc/mail/spamassassin/local.cf. Here is an example that should get you started, but it would do you well to dig deeper into the available options.

rewrite_header Subject *****SPAM*****
report_safe 1
# trusted_networks 212.17.35.
# lock_method flock
required_score 5.0
use_bayes 1
bayes_auto_learn 1
skip_rbl_checks         0
use_razor2              1
use_dcc                 1
use_pyzor               1
bayes_ignore_header X-Bogosity
bayes_ignore_header X-Spam-Flag
bayes_ignore_header X-Spam-Status

Start Spamassassin:

# /usr/local/etc/rc.d/sa-spamd.sh start
# /usr/local/etc/rc.d/spamass-milter.sh start

Add the following to /etc/mail/[hostname].mc

INPUT_MAIL_FILTER(`spamassassin', `S=local:/var/run/spamass-milter.sock, F=, T=C:15m;S:4m;R:4m;E:10m')
define(`confINPUT_MAIL_FILTERS', `spamassassin')

Apply the configuration changes from [hostname].mc

# make all install restart

Again, I always do the scripted restart of Sendmail as well.

# /etc/rc.d/sendmail restart

Configuring Web Services

Next up, is to compile Apache 2.2.x, with mod_ssl and php5. *Important!* Check the Makefile in /usr/ports/lang/php5 by typing 'make config'. Be sure that the apache module is selected, or php5 will not work as planned!

# cd /usr/ports/www/apache22; make install clean
# cd /usr/ports/lang/php5; make install clean

There will need to be some lines to /usr/local/etc/apache22/httpd.conf so that the php modules will work, and load php pages. At the end of the LoadModules section of httpd.conf:

AddType application/x-httpd-php .php
AddType application/x-httpd-php-source .phps

Append this to the line for DirectoryIndex:

index.php

We need to generate SSL keys for the Apache server.

# openssl genrsa -des3 -out server.key 1024
# openssl req -new -key server.key -out server.csr
# openssl x509 -req -days 365 -in /root/server.csr -signkey /root/server.key -out /root/server.crt

Copy the certs to the destination directory.

# cp ~/server.key /usr/local/etc/apache22/
# cp ~/server.crt /usr/local/etc/apache22/

I prefer to remove the passphrase from the cert, otherwise each time apache22 must start, you must enter the passphrase.

# cd /usr/local/etc/apache22/
# cp server.key server.key.orig
# openssl rsa -in server.key.orig -out server.key

Set the proper security on your new keys.

# chmod 0400 /usr/local/etc/apache22/server.key
# chmod 0400 /usr/local/etc/apache22/server.crt

Uncomment this line in the /usr/local/etc/apache22/httpd.conf to call the SSL config (remove the '#' sign)

#Include etc/apache22/extra/httpd-ssl.conf

Add this to /etc/rc.conf to autostart Apache with SSL at boot:

apache22_enable="YES"
apache22_flags="-DSSL"

Compile the Squirrelmail webmail interface

# cd /usr/ports/mail/squirrelmail; make install clean

Create httpd-local.conf in /usr/local/etc/apache22/Includes/, and add these lines to it:

<Directory /usr/local/www/squirrelmail>
    AllowOverride None
    Order Allow,deny
    Allow from all
</Directory>
Alias /webmail /usr/local/www/squirrelmail

Our httpd-local.conf will already be tied into the httpd.conf, because of the last line of the file (take a look if you like). Last, Start Apache.

# /usr/local/etc/rc.d/apache22 start

Configuring System Graphing, powered by MySQL

Compile MySQL 5.0 Server

# cd /usr/ports/databases/mysql50-server; make install clean

Configure MySQL server to load at boot, add this to /etc/rc.conf:

mysql_enable="YES"

and then start MySQL

# /usr/local/etc/rc.d/mysql-server start

Cacti is a powerful network graphing utility that front ends Rrdtool. This process will compile Rrdtool and all of its dependencies for you.

# cd /usr/ports/net/cacti; make install clean

In order to access the Cacti web directory, we have to add a directory listing to our apache httpd-local.conf file. Edit the file /usr/local/etc/apache/Includes/httpd-local.conf, and add these lines:

<Directory /usr/local/share/cacti>
    AllowOverride None
    Order Allow,deny
    Allow from all
</Directory>
Alias /systems /usr/local/share/cacti/

Notice, that we dont alias as /cacti, but as /systems. This is to avoid a security exploit, where the /cacti alias is randomly probed by script kiddies. Use /systems, or something else of your preference, but avoid using /cacti as the alias name. This needs to be added to your /etc/crontab, to poll your system information every 5 minutes.

*/5 * * * * cacti /usr/local/bin/php /usr/local/share/cacti/poller.php > /dev/null 2>&1

Now, Create the MySQL database:

mysqladmin --user=root create cacti

Set the passwd for the cacti user.

# passwd cacti
Changing local password for cacti
New Password: [cactipasswd]
Retype New Password: [cactipasswd]

Edit the /usr/local/share/cacti/include/db-settings.php file for the proper database permissions:

$database_type = "mysql"; 
$database_default = "cacti"; 
$database_hostname = "localhost"; 
$database_username = "cacti"; 
$database_password = "cactipasswd"; 
$database_port = "3306";

Set the Cacti database's permissions.

echo "GRANT ALL ON cacti.* TO cacti@localhost IDENTIFIED BY 'cactipasswd'; FLUSH PRIVILEGES;" | mysql

Import the default tables:

mysql cacti < /usr/local/share/cacti/cacti.sql

Finally, log into the page, using the /system alias that was set up earlier. The default login and password is admin:admin, and you will be promted to change it on your first successful login.

http://yourserver.yourdomain.com/systems

Configure Bind

Install and Configure Bind DNS server, so that we can give our local network DNS resolution against internet hosts. When you start the install, the config page will come up. I choose to enable "Replace base BIND with this version". This way the port will keep us up to date, and if a security flaw is found with bind, its quite simple and quick to update it (instead rebuilding the world).

# cd /usr/ports/dns/bind9; make install clean

Configure /var/named/etc/namedb/named.conf to listen on all ips, becuase by default it only wants to listen on loopback. Configure Bind to load at boot by adding this to /etc/rc.conf:

named_enable="YES"
named_program="/usr/local/sbin/named"

Written by Sharaz, our resident FreeBSD guru.